Upgrade to upstream WebKit 55d9d9007f

[robobun]

Merges upstream WebKit main at 55d9d9007f (2026-08-23): 413 commits since the previous merge base 47f7250137c6 (2026-08-16), 90 of them touching JavaScriptCore, WTF or bmalloc.

This supersedes #488 (upstream baf4a9a7ec0b), which conflicts with the fork's main since the bytecode cache work landed (#490, #493, #494, #497). The branch is built in two merge commits on top of the fork's current main (62f427b86f):

1. d033f18292 merges Upgrade to upstream WebKit baf4a9a7ec0b #488's head (d0fae3b3c9). That brings in its upstream merge, its conflict resolutions and its review fixes unchanged. The one conflict is runtime/CachedTypes.cpp, see below.
2. fabdd1dbd0 merges upstream/main (55d9d9007f): 26 more commits, 8 in JavaScriptCore/WTF. The one conflict is a whitespace-only hunk in JSGlobalObject::addStaticGlobals (upstream's InlineWatchpointSet* is taken).

The second merge commit has 55d9d9007f as its second parent, so the next upgrade does not need a graft as long as this lands as a merge commit rather than a squash. #488 and oven-sh/bun#40054 can be closed once this is in.

Conflict resolutions

New in this PR:

• runtime/CachedTypes.cpp: upstream 3d0e6c14b1 moved m_features, m_lexicallyScopedFeatures, m_hasCapturedVariables, m_lineCount, m_endColumn and the sourceURL/sourceMappingURL directives from UnlinkedCodeBlock to UnlinkedGlobalCodeBlock, and 0b92c2bcd0 removed UnlinkedCodeBlock::m_jumpTargets. The fork's region layout (Bytecode cache: smaller payloads that page in only what is decoded (alias mapped bytes, region layout, 32-bit offsets, sparse metadata table) #494, Bytecode cache: arrays-first code block records, strings deduplicated by contents, geometric encoder pages #497) encoded those scalars in every code block's varint tail, the two directives in CachedCodeBlockExtras, and the jump targets as one of the four shareable arrays. Resolution: the five scalars leave CachedCodeBlock::Scalars/packScalars/readTail (the CodeBlockHasCapturedVariablesShift flag bit is gone and the remaining bits are renumbered), the directives leave CachedCodeBlockExtras, the jump-target array leaves Layout (three shareable arrays now), and a new CachedGlobalCodeBlock<CodeBlockType> record between CachedCodeBlock and the program/module/eval records carries the seven moved members as plain fixed fields, written by its encodeOwnMembers and read back by decodeOwnMembers, which the three derived records chain to. Function code blocks are unchanged apart from the dropped fields. UnlinkedGlobalCodeBlock.h already forward-declares and befriends template<typename> class CachedGlobalCodeBlock. The cache version (computeJSCBytecodeCacheVersion) is per build, so old caches are rejected rather than misread.
• runtime/JSGlobalObject.cpp (addStaticGlobals): cea233cede changes the local to InlineWatchpointSet*; the fork's side only differed in a stripped trailing space.

Carried over from #488 (unchanged, see that PR for the discussion):

• yarr/YarrJIT.cpp: kept at the fork's version (Yarr: JIT lookbehinds, first-code-point alternation dispatch, Boyer-Moore and /u·/v spec alignment, RegExp correctness fixes #299 policy, same as Upgrade to upstream WebKit 47f7250137c6 #455). Upstream's 01f04c4fb4 (JIT lookbehinds that contain backreferences) restructures the backreference codegen that the fork already reworked for mirrored frames; the fork compiles these patterns already. Upstream's three new tests pass on the Upgrade to upstream WebKit baf4a9a7ec0b #488 build in JIT and --useRegExpJIT=false mode.
• WTF/URLParser.cpp and .h: kept at the fork's version. Upstream's eb44b6cfaa SIMD-scans path, query, fragment and opaque-path runs, which the fork's URLParser rewrite already does with its own table-driven scanners. Upstream's CodePointIterator::span()/advanceBy() additions and the two new TestWebKitAPI cases are in.
• Atomics.wait termination (03e836de2f vs the fork's [JSC] Atomics.wait / memory.atomic.wait: wake up for a termination requested from another thread #432): WaiterListManager::waitSyncImpl keeps the fork's version. The two callers take upstream's vm.throwTerminationExceptionIfNeeded().
• Module map (f324cca020): upstream no longer registers a module entry for a fetch failure. The fork's ModuleLoader: record a non-Error fetch rejection as a fetch failure #262 (setFetchError in moduleLoadTopSettled) is dropped since the entry it fixed can no longer be created.
• CodeCache.cpp: upstream's c823243598 (CodeForConstruct for class constructors) replaces the fork's loop. recordParseFromUnlinkedCodeBlock takes an UnlinkedGlobalCodeBlock*.
• SyntheticModuleRecord: db2d849cbe changes tryCreateWithExportNamesAndValues to take ArgList; the fork's lazy-export overloads (SyntheticModuleRecord: exports whose values are produced on first binding #408) follow.
• ThreadingPOSIX.cpp (9a18171a13): the fork's !USE(BUN_JSC_ADDITIONS) main-thread detection branch keeps its guard. Thread::updateSchedulingAttributes is a no-op under USE(BUN_JSC_ADDITIONS) on Linux, so Bun's threads keep inheriting the process's scheduling policy.
• Options.h, JSWebAssemblyInstance.h: upstream's new includes added in the fork's quoted-include style.
• PlatformJSCOnly.cmake: the Android branch builds linux/HighPriorityThreads.cpp (review fix from Upgrade to upstream WebKit baf4a9a7ec0b #488).

JSType.h, .github/workflows and the release tarball names are unchanged across the whole range. No file under builtins/ changed after baf4a9a7ec0b; the @newPromiseCapability removal from #488's range still applies (the Bun PR ports the six call sites).

Verification

• bun run jsc:build:debug (Linux x64, debug + ASAN) builds; the jsc shell runs.
• Bytecode cache round trips on the merged build: a program with a captured variable, classes, generators, async functions, a direct eval and //# sourceURL / //# sourceMappingURL directives; a "use strict" program whose direct evals must stay strict (that is lexicallyScopedFeatures coming back from the cache through UnlinkedGlobalCodeBlock and ProgramExecutable::recordParse); and a module with top-level await. Each produces identical output uncached, on the write run, with JSC_forceDiskCache=true, and with JSC_forceDiskCache=true JSC_useBorrowedBytecodeFromCache=true JSC_diskCachePayloadIsPersistentForTesting=true.
• JSTests/stress/bytecode-cache-*.js and class-fields-bytecode-cache.js pass through bytecode-cache-test-helper.sh. 60 class-syntax-*/generator-*/async-arrow-*/eval-* stress tests run through the same helper: 51 pass; the 9 eval-* failures fail identically without the cache, for reasons that predate this merge (the fork's V8-style ReferenceError messages, and toLocaleString without bundled ICU data).
• Bun: see the Bun PR for the build against this tree and the test suites run.

Upstream changes after baf4a9a7ec0b (new since #488)

26 commits; 8 touch JavaScriptCore or WTF, none touch bmalloc. The other 18 only touch WebCore, WebKit, Tools or LayoutTests (089848d399, 1feb6ac19b, 22fbd8510c, 3e5b31e006, 4fa207d1c8, 5278e92549, 53e6dc79c7, 55d9d9007f, 5dd82e774c, 6a2b412d19, 884e316977, 889d15f0a7, 8c4fd56347, b3f6dc92c6, cd9803c538, df06a95a28, e7ffac0f4e, ee94630405).

API and ABI changes

• cea233cede — [API] [PERF] SymbolTableEntry no longer allocates a WatchpointSet until somebody watches the variable (Sosuke Suzuki). Every closure variable that its own function stores to, and every global variable, got prepareToWatch() when its CodeBlock was linked, which allocated a 16-byte FatEntry plus a 32-byte WatchpointSet per variable even though only DFG constant folding ever adds a Watchpoint. FatEntry now embeds an InlineWatchpointSet (one word of thin ClearWatchpoint/IsWatched/IsInvalidated state, inflated to a real WatchpointSet only when a Watchpoint is added); upstream measured a ~250-module CommonJS server going from 1,466 WatchpointSet allocations at load to 0. Signature changes: SymbolTableEntry::watchpointSet() returns InlineWatchpointSet*; SymbolTableEntry is move-only (copy constructor and assignment deleted); SymbolTable::get()/inlineGet() return SymbolTableEntry::Fast; the unlocked SymbolTable::set(UniquedStringImpl*, Entry&&) overload is removed (the set(const ConcurrentJSLocker&, ...) one stays); disableWatching, copySlow, inflateSlow are gone; symbolTablePutTouchWatchpointSet/symbolTablePutInvalidateWatchpointSet, ScopedArgumentsTable::getWatchpointSet/trySetWatchpointSet, ResolveOp::watchpointSet, VariableWriteFireDetail::touch, DFG::Node::watchpointSet() and operationNotifyWrite all take or return InlineWatchpointSet*; the op_get_from_scope/op_put_to_scope metadata field is InlineWatchpointSet*; the LLInt notifyWrite macro takes a scratch register and checks the inline word before the WatchpointSet state; new AssemblyHelpers::branchIfInlineWatchpointSetIsStillValid, InlineWatchpointSet::inflatedSetConcurrently()/offsetOfData()/encodeState(). No JS-observable change (a regression test covers the duplicate-parameter set path). Bun: src/jsc/bindings/NodeVMSyntheticModule.cpp calls exportSymbolTable->set(NoLockingNecessary, key, SymbolTableEntry(VarOffset(offset))), which resolves to the surviving locked overload with an rvalue entry and compiles unchanged; Bun references none of the other changed names.

• 0f924849f5 — [API] Build fix for the previous commit under CMake: SymbolTableEntry::inflate() becomes JS_EXPORT_PRIVATE, because -fpch-codegen hoists it out of the PCH as a strong definition and the inline prepareToWatch() calls it. Must be taken together with cea233cede.

• 314133b7a6 — [API] Removes the UUID flavour of WTF::ObjectIdentifier (reverts 279402@main): ObjectIdentifierGenericBase, the access traits and ObjectIdentifierGeneric<T, ThreadSafety> are uint64_t-only again, UUIDObjectIdentifier<T> and toRawValue() are deleted (toUInt64() remains), and wtf/ObjectIdentifier.h no longer includes <wtf/UUID.h>, so <wtf/HexNumber.h> is no longer reachable through VM.h; upstream added explicit includes to testmasm.cpp, WasmDebugServerUtilities.cpp, WasmExecutionHandler.cpp and YarrJIT.cpp. Bun: src/jsc/bindings/ProcessIdentifier.h/.cpp and ZigGlobalObject.cpp only use the single-argument ObjectIdentifier<T> alias, the uint64_t constructor and toUInt64(), which compile unchanged. src/jsc/bindings/EncodeURIComponent.cpp calls hex() without including <wtf/HexNumber.h>; the Bun PR adds the include if the build needs it.

Behavior changes

• 7711916200 — [BEHAVIOR] DFG correctness fix (Kai Tamkun): DFGFixupPhase's Inc/Dec handler cleared NodeMustGenerate for all three numeric lowerings, so an overflow-checked Int32/Int52 ++/-- whose result was otherwise unused could be dead-code-eliminated together with its overflow check and OSR exit. The flag is now only cleared for the Double (Arith::Unchecked) lowering. Test: let y = 2147483647; ++y; (y|0) === y must be false (JSTests/stress/inc-dec-int32-overflow-dce.js).

• 9f07374e9e — [BEHAVIOR] Wasm OMG correctness fix (Dan Hecht): a call patchpoint inside a try block carries an exception-restoration stackmap keyed by its CallSiteIndex, so cloning it through B3 Select specialization or DuplicateTails left two call sites sharing one stackmap. WasmOMGIRGenerator::createCallPatchpoint marks such patchpoints cloningForbidden when m_tryCatchDepth != 0, and B3ReduceStrength's Check-of-Select specialization bails if any value between the Select and the Check is cloning-forbidden. Fixes a miscompile/crash for Wasm exception handling in OMG (JSTests/wasm/stress/omg-reduce-strength-select-exception-stackmap.js).

Performance

• 96ca975b2a — [PERF] Object.assign(target, a, b[, c]) with 2 to 3 sources (the batching path in objectConstructorAssign) now first tries objectCloneFast for the first source and starts the per-source loop at index 2, instead of replaying the first source's shape one property at a time (Sosuke Suzuki). 1.41x to 1.53x on the new microbenchmark; results unchanged (JSTests/stress/object-assign-clone-multiple-sources.js covers key order, frozen sources, symbols, non-enumerable properties and non-empty targets).

• 2cba652107 — [PERF] Compile-time only: Air::padInterference used Inst::needsPadding(prev, next), which walked each instruction's args twice; new Inst::paddingSummary() collects hasEarlyDef/hasLateUseOrDef in one forEachArg pass and the previous instruction's summary is carried across the block. Inst::needsPadding is removed (internal B3/Air API). Generated code is unchanged.

Other

• cb7daacd43 — WTF side of a WebKit Cocoa sandbox change (ENABLE_INHERITANCE_OF_NETWORK_ACCESS_FROM_UI_PROCESS on all Cocoa platforms, a new SDKAlignedBehavior entry, DYLD_*_VERSION_26_6 constants in dyldSPI.h). No effect on the JSCOnly port.

Upstream changes 47f7250137c6..baf4a9a7ec0b (from #488)

Each remaining commit appears once, under the most specific heading that applies. The 17 commits in the range whose only engine-side footprint is a WebCore/WebKit preference entry, a WTF build-file list change, or Cocoa/GTK/WPE-only code the JSCOnly port does not compile are omitted (7d86b2c8a0, 94f879afe6, 2f072fbfec, 3dfdbed8e4, 86a8860a42, 0c33544154, 722d0b38a9, cc7a6821b7, d8ad5b5f9a, b66aab8e21, 5e3cb10ac4, c2b3e55128, 2dce2395a4, d27b7fd89e, 6248fa7145, 8bd2ba0d3e, f0a1fd2b32).

API and ABI changes

• cffd5ed032 — [API][PERF] WTF::PriorityQueue now follows std::priority_queue conventions: the template takes a less-than functor type (default std::less<T>, function pointers are rejected by static_assert) instead of an isHigherPriority function pointer and serves the greatest element first; the isLessThan/isLessThanEqual/isGreaterThan/isGreaterThanEqual helpers were removed from wtf/MathExtras.h. This fixes Wasm::Worklist, whose comparator was never flipped when it moved off std::priority_queue (present in Bun's previous WebKit): compilation plans were served in reverse priority (Preparation before Compilation before Synchronous before Shutdown) and newest-first within a priority, and completePlanSynchronously bumped the plan with decreaseKey instead of increaseKey, so synchronous WebAssembly.Module/Instance compiles could wait behind queued async work. DFG inlining, Wasm inlining and the greedy register allocator were adapted to the new convention with no change in ordering; Bun has no direct PriorityQueue usage.

• 9a18171a13 — [API][PERF] Linux thread scheduling in WTF is reworked: the RealTimeThreads/SCHED_RR machinery is removed (wtf/linux/RealTimeThreads.h renamed to HighPriorityThreads.h, rtkit nice-boosting only under USE(GLIB)), and every WTF::Thread now applies its QOS from its own entry point via sched_setattr: the default UserInitiated QOS maps to SCHED_OTHER, nice 0 plus SCHED_FLAG_UTIL_CLAMP_MIN = 1024 (a 100% DVFS frequency floor, with automatic fallback on kernels that reject uclamp), Default gets a 20% floor, Utility gets SCHED_BATCH/nice 10 and Background gets SCHED_IDLE/nice 19. JIT and Wasm worklist threads now pass compilerThreadQOS(), which is Utility on Linux hosts with <= 4 cores, so concurrent compilation is deprioritized on small machines/containers. API surface: the protected Thread ctor is now Thread(QOS, SchedulingPolicy, IsMain), AutomaticThread gains a ThreadQOS ctor overload, Thread::qos() is added and isRealtime() is derived from the scheduling policy, and ThreadingEnums.h adds ThreadSchedulingState, defaultThreadQOS, defaultThreadSchedulingPolicy, compilerThreadQOS(); Darwin and Windows behaviour is unchanged.

• e1fdc80a34 — [API] WTF::weekDay(int32_t days) in wtf/DateMath.h is rewritten as a branchless unsigned multiply-and-shift (Ben Joffe's method) that is well-defined for the whole int32_t range (the old (days + 4) % 7 was signed overflow for days > INT32_MAX - 4, unreachable from JS since day counts are clipped to +-1e8), and the unused WTF::msToWeekDay(double) is removed. ISO8601::dayOfWeek (Temporal PlainDate/PlainDateTime dayOfWeek) drops its private Int128 copy of the modulo and uses daysFromYearMonth + WTF::weekDay. Results are unchanged (upstream checked all 2^32 inputs); authored by Bun's Sosuke Suzuki.

• 75a9d414a4 — [API] (additive) Correctness fix for VM::deleteAllCode / Heap::deleteAllCodeBlocks: the VM-level m_syncResumeCallCache (the MicrotaskCallCache used to resume async functions/async generators from the microtask queue) lives outside any VMEntryScope and kept stale Executable->CodeBlock entry points after all code was detached, so a later resumption could call into a detached CodeBlock. Adds MicrotaskCall::clear(), MicrotaskCallCache::clear() and public VM::clearMicrotaskCallCaches(), which Heap::deleteAllCodeBlocks now calls; CodeCache::clear() also now calls write() first. Directly relevant to Bun, which calls vm.deleteAllCode(...) in WebWorker__teardownJSCVM, JSC__VM__deleteAllCode, and via the debugger's recompileAllJSFunctions path while async work may still be pending.

• 3302d7a455 — [PERF][API] SourceProviderCache now pre-reserves its m_map hash map from the source length (sourceLength / 512 entries, capped at 64K) to avoid repeated rehash/realloc while a large script is parsed. The public default constructor is replaced by a private explicit SourceProviderCache(unsigned sourceLength) plus static Ref<SourceProviderCache> create(unsigned); VM::addSourceProviderCache is updated. Bun only includes the header (src/jsc/modules/BunJSCModule.h) and never constructs one directly, so no Bun changes are needed.

• 1450e69522 — [API] WTF DequeIterator and DequeConstIterator gain defaulted default constructors (required by the C++20 bidirectional_iterator concept, and by MSVC's STL std::reverse_iterator, which value-initializes its stored iterator). Purely additive; Bun's many WTF::Deque uses (streams, JSBufferList, worker queues) are unaffected and this may help MSVC-STL builds that instantiate Deque::rbegin().

• f2d69489c6 — Removes the unused tryAllocateBuffer helper from VectorBufferBase/VectorBuffer in wtf/Vector.h; allocateBuffer<FailureAction::Report> remains for the same purpose. [API] Technically a public-header removal, but Bun's src/ has no references to it, so no action needed.

• 03e836de2f — [BEHAVIOR] Fixes a thread blocked in Atomics.wait / Wasm memory.atomic.wait never unblocking after VM::notifyNeedTermination(): WaiterListManager::waitSyncImpl now also observes the pending NeedTermination trap (not just hasTerminationRequest()), dequeues the waiter and returns Terminated, and the new VM::throwTerminationExceptionIfNeeded() materializes the TerminationException through handleTraps. This directly affects Bun, whose VmHandle::request_termination (used by worker.terminate()) fires exactly that trap, so a worker parked in Atomics.wait now terminates instead of hanging. [API] Adds VM::throwTerminationExceptionIfNeeded(); throwWasmToJSException now early-outs whenever a TerminationException is already pending.

• 88b46e6bc7 — [API] wtf/BorrowedBytes.h is deleted and replaced by wtf/EscapableByteSpan.h: BorrowedBytes/BorrowedSpanScope/BorrowedVectorScope are gone, replaced by a stack-only, non-refcounted EscapableByteSpan (plus escapableSpan() helper and SpanUInt8/MutableSpanUInt8/VectorUInt8 aliases) that RELEASE_ASSERTs if a copy outlives the borrow. This is a Swift-interop type used only by PAL crypto on Cocoa; Bun has no references to either header, so no impact beyond the header rename in WTF_PUBLIC_HEADERS.

• f324cca020 — [BEHAVIOR] [API] The module loader stops caching fetch failures: JSModuleLoader::loadModule now evicts a FetchFailed registry entry (new removeFailedFetchEntry) and re-fetches instead of re-rejecting with a duplicated copy of the old error, and the top-level rejection paths in JSMicrotask.cpp no longer call ensureRegistered just to stash an error (evaluation errors are still cached; maybeDuplicateFetchError is no longer used on that path). For Bun this means a second import() of a specifier whose fetch previously rejected (e.g. a missing file or failed loader) will invoke Bun's module-loader fetch hook again rather than rejecting immediately from the cache, so anything that relied on the cached rejection (tests, error identity) may see different behavior. JSModuleLoader::getRegisteredMayBeNull is also moved from private to public.

• 905a225671 — [API] wtf/UniStdExtras.h is now wrapped in #if OS(UNIX), so setCloseOnExec/unsetCloseOnExec/dupCloseOnExec/closeWithRetry/setNonBlock are no longer declared on Windows (done to keep the Windows Swift C++ importer happy). Only matters if the embedder includes that header on Windows; Bun's bindings do not reference it.

• 76b474b322 — [API] Refactors JSC::Wasm::TypeKind: the type-section forms Func, Struct, Array, Rec, Sub, Subfinal are removed from TypeKind and moved to a new generated Wasm::DefinedTypeKind enum (with isValidDefinedTypeKind / makeString(DefinedTypeKind)), and the section parser dispatches on that. Pure cleanup that removes dummy switch cases; no behavior change. Bun does not reference these enumerators, so nothing to update.

• 218421554b — [PERF] [API] JSON.parse now buffers array elements on a MarkedArgumentBuffer element stack and allocates each JSArray once at its final length and indexing type (Int32/Double/Contiguous) instead of growing the butterfly via putDirectIndex per element; also skips two Structure loads for outOfLineCapacity when a property offset is still inline. Drive-by change to the inlined MarkedVector::append fast path (stays inline once heap-allocated and registered with a mark set, rather than calling slowAppend on every append) and an additive MarkedVector::shrink(size_t) — both are inlined into Bun's many MarkedArgumentBuffer users, but no signature changes. Also speeds up Bun's native JSONParse/JSONParseWithException callers (JSON module loading, .json(), SQL client, etc.).

• 6446fdc8e0 — WebCore ISO-BMFF box serialization work; the only engine touch is JSC::DataView::get<T>() and DataView::read<T>() in runtime/DataView.h becoming const member functions. [API] Source-compatible (header-only inline templates, only adds const), so no embedder action needed.

• 38027ff0ec — Removes the @newPromiseCapability private builtin/link-time constant from JSC (builtins/BuiltinNames.h, bytecode/LinkTimeConstant.h, host function in runtime/JSGlobalObject.cpp), since upstream builtins now use @newPromise + @resolvePromiseWithFirstResolvingFunctionCallCheck/@rejectPromiseWithFirstResolvingFunctionCallCheck (no tuple object allocation, no property lookups). [API] After this upgrade @newPromiseCapability no longer resolves as a private name. Bun's bundled modules called $newPromiseCapability(Promise) in src/js/node/dgram.ts, events.ts, _http_server.ts (3 sites) and util.ts; the Bun PR rewrites them to $newPromise() plus the $resolvePromise/$rejectPromise family. Note the preceding upstream commit 7f38ebbabf had already deleted builtins/PromiseOperations.js (the JS implementation); the C++ JSPromise::createNewPromiseCapability() used by src/jsc/bindings/JSMockFunction.cpp is unaffected.

• 0b92c2bcd0 — [PERF] Deletes UnlinkedCodeBlock::m_jumpTargets (a per-label offset list that nothing in a shipping configuration read; DFG/liveness already recompute targets via computePreciseJumpTargets()), saving 4 bytes per label (~38 KB after loading typescript.js), shrinking UnlinkedFunctionCodeBlock from 216 to 208 bytes (GC cell 224 -> 208), and cutting the serialized bytecode cache by ~1.4%. [API] Removes CodeBlock::numberOfJumpTargets()/jumpTarget(), UnlinkedCodeBlock::numberOfJumpTargets()/jumpTarget()/lastJumpTarget(), UnlinkedCodeBlockGenerator::addJumpTarget() etc., and recomputePreciseJumpTargets(), adding a computePreciseJumpTargets(UnlinkedCodeBlock*, ...) overload — Bun's bindings use none of these. The CachedCodeBlock layout changes (field dropped from runtime/CachedTypes.cpp), but bun build --bytecode output is already keyed to the build via computeJSCBytecodeCacheVersion(), so old caches are rejected rather than misread.

• 3d0e6c14b1 — [PERF][API] Memory: moves m_features, m_lexicallyScopedFeatures, m_hasCapturedVariables, m_lineCount, m_endColumn and the sourceURL/sourceMappingURL directive pointers from UnlinkedCodeBlock down to UnlinkedGlobalCodeBlock (only Program/Eval/Module code uses them), shrinking UnlinkedFunctionCodeBlock from 216 to 192 bytes (cell 224 -> 192; ~53 KB saved after loading typescript.js). The accessors codeFeatures(), allowDirectEvalCache(), lexicallyScopedFeatures(), hasCapturedVariables(), lineCount(), endColumn(), sourceURLDirective(), sourceMappingURLDirective() and recordParse() are removed from UnlinkedCodeBlock and now exist only on UnlinkedGlobalCodeBlock; UnlinkedCodeBlock::usesImportMeta() is deleted outright (Bun's bindings use none of these; Bun's sourceURLDirective() calls are on SourceProvider). The serialized CachedCodeBlock layout for the bytecode cache also changes (split into CachedCodeBlock + CachedGlobalCodeBlock), which is covered by Bun keying the cache version on BUN_WEBKIT_VERSION.

• 0bbbac7b52 — [BEHAVIOR] [API] Wasm memory64 now works together with multi-memory: the WasmSectionParser check that rejected any module combining a 64-bit memory with multiple memories ("if using memory64 then multiple memories are illegal for now") is removed, so such modules now validate/compile/run instead of failing with CompileError. IPInt decides whether to zero-extend an i32 address per accessed memory using a new WTF::BitSet<Wasm::maxMemories> (JSWebAssemblyInstance::m_memoryIsMemory64Bits) instead of a single memory-0 flag. JSWebAssemblyInstance::cachedMemory0IsMemory64() and offsetOfCachedMemory0IsMemory64() are removed (replaced by offsetOfMemoryIsMemory64Bits()); Bun does not reference them.

• 71144530c1 — [API] Bumps the vendored wtf/simdutf single-header from 8.2.0 to 9.0.0 (now requires C++17): simdutf::to_string(encoding_type) and implementation::name()/description() return std::string_view instead of std::string, full_result gains a padding_error field and the base64 decoders now report the = position as the error location for padding errors, the SIMDUTF_FEATURE_* macros become #ifndef-overridable, and the icelake (AVX-512) simdutf::find now masks its tail load so searching for NUL no longer false-matches past the end of the input. error_code values, struct result, and every function Bun's src/simdutf_sys shim (bun-simdutf.cpp, simdutf.rs Status constants) calls are unchanged, and Bun falls back to its scalar decoder on any base64 error rather than reading the error offset, so no Bun-side change is needed.

• ee4b208267 — [PERF] [API] Generator/async function bodies whose wrapper has no parameters no longer allocate a 64-byte UnlinkedFunctionExecutable::RareData just to hold an empty parameter-name list (every async () => {...}, async function f() {}, function* g() {} paid this; ~6.4 MB saved per 100k such functions). UnlinkedFunctionExecutable::create and the BytecodeGenerator now take Vector<Identifier>&& instead of std::optional<Vector<Identifier>>&&; Bun does not call UnlinkedFunctionExecutable::create directly, so no action needed.

• b1701b3489 — [BEHAVIOR] [API] Uint8Array.prototype.setFromBase64 on a zero-length target now returns { read: 0, written: 0 } without inspecting the input at all (even an invalid base64 string is accepted), matching step 3 of the proposal spec; Uint8Array.fromBase64 is unchanged. WTF::fromBase64() gains a required fifth parameter OutputSizeIsMaxLength (new enum in wtf/text/Base64.h); Bun does not call WTF::fromBase64 directly, so no source change is needed.

• 870de4ab77 — WTF fix in wtf/text/TextBreakIterator.{h,cpp}: NonSharedCharacterBreakIterator and NonSharedSentenceBreakIterator leaked their ICU UBreakIterator when setTextForIterator() failed (reachable via a null StringView), and the 8-bit path skipped utext_close() on ubrk_setUText() failure. Ownership is now expressed with a new WTF::UBreakIteratorPtr (std::unique_ptr<UBreakIterator, ICUDeleter<ubrk_close>>) and m_iterator becomes that smart pointer; the public operator UBreakIterator*() is unchanged. [API] Only the private member type and the file-static helpers changed, so this is source-compatible for embedders, and Bun does not use these classes at all (JSC only references them from the offline CharacterPropertyDataGenerator tool), so it is a no-op for Bun in practice.

Behavior changes

• 3b9afb2b4f — [BEHAVIOR] Wasm correctness fix in BBQ and OMG (B3 lowering): ref.cast/ref.test on a nullable reference now only elides the explicit null check when Options::useWasmFaultSignalHandler() is on, so configurations running without the fault handler (e.g. Bun's Linux ASAN builds, where Options.cpp turns it off unless ASAN_OPTIONS contains allow_user_segv_handler=1) get a proper Wasm trap instead of dereferencing null. In signaling-memory mode, the decision to emit an explicit bounds check for large constant offsets now uses the last accessed byte (offset + size - 1) rather than the base offset; the old computation was slightly off but always still trapped via the PROT_NONE redzone.

• b74760b182 — [BEHAVIOR] The non-ARM64 WTF::roundeven/roundevenf polyfill returned +0.0 for the tie that rounds to zero (roundeven(-0.5) gave +0.0 instead of -0.0); the result is now wrapped in copysign. In JSC this feeds BBQ's constant folding of Wasm f32.nearest/f64.nearest, so on x86_64 a constant -0.5 operand folded to the wrong sign of zero; ARM64 uses __builtin_roundeven (frintn) and was already correct.

• 3c0f403d81 — [PERF] [BEHAVIOR] WasmGC array.fill / array.copy are reworked in BBQ and OMG: null and bounds checks are now emitted inline in JIT code, the runtime call is skipped entirely when size == 0 (observed to be very common), non-ref array.copy uses B3 MemoryCopy, and non-ref array.fill uses MemoryFill or new operationWasmArrayFill{2B,4B,8B,16B} (memset_pattern* on Darwin, std::ranges::fill elsewhere), while ref-typed arrays keep GC-safe loops (operationWasmArrayFillRefs / operationWasmArrayCopyRefs via gcSafeMemmove). Observable change: the trap message for a null array in these ops becomes the generic "access to a null reference" instead of "array.fill to a null reference" / "array.copy to a null reference" (the NullArrayFill / NullArrayCopy enumerators were removed from the internal Wasm::ExceptionType enum, which Bun does not reference). Old operationWasmArrayFill{,Vector} / operationWasmArrayCopy JIT operations are removed.

• 2165451fd3 — [BEHAVIOR] Correctness fix in the YARR interpreter's tryConsumeBackReference: in Forward direction it speculatively advanced the input by matchSize before comparing, and when the captured character was non-BMP and the input at that offset was not a valid surrogate pair, the early errorCodePoint return only restored the position for Backward, so a failed greedy iteration consumed input. Fixes wrong results like /(\u{1F601})\1*$/u.exec("\u{1F601}ab") matching instead of returning null, and /(\u{1F601})(\1*)?/u splitting a surrogate pair; the check now falls through to the common mismatch path which restores the position in both directions. Only affects patterns that run in the interpreter (authored by Sosuke Suzuki from Bun).

• e88b92e29f — [BEHAVIOR] (bug fix) Fixes a BBQ-tier miscompile of Wasm i64.mul_wide_s/i64.mul_wide_u on x86_64: the 128-bit product comes back in rdx:rax, and if the register allocator handed out rax/rdx as the result or scratch registers the halves were clobbered, producing wrong results. Now uses the same PREPARE_FOR_MOD_OR_DIV pattern as div/mod (clobber + lock rax/rdx). Only reachable when Options::useWasmWideArithmetic is on (default off, Bun does not enable it), so this matters only for users opting in via BUN_JSC_useWasmWideArithmetic=1.

• 5cfff9fe44 — [BEHAVIOR] In JSC's Wasm ESM integration (WebAssemblyModuleRecord), immutable exported globals are now exposed in the module namespace as plain JS values instead of WebAssembly.Global wrappers, per the esm-integration spec/WPT; v128 and exnref globals stay TDZ, Instance.exports is unchanged, and wasm-to-wasm ESM imports fall back to the Instance.exports wrapper when the namespace binding is empty. No Bun-visible change today because Bun's .wasm loader (src/runtime/jsc_hooks.rs, L::Wasm arm) returns a file path / wasi-runner instead of creating a JSC Wasm module record; it would matter if Bun ever adopts JSC's native Wasm ESM path.

• b7afce9416 — [BEHAVIOR] When several Wasm functions fail validation during concurrent compilation, the WebAssembly.CompileError message now deterministically reports the lowest-index failing function instead of whichever worker thread finished first; non-function failures (OOM/parse/cancel) still take precedence. Adds protected Plan::failAtFunction / EntryPlan::failFunctionCompilation and an m_errorFunctionIndex field; error messages become stable across runs (useful for snapshot tests).

• 010e57fb4b — [BEHAVIOR] WebAssembly.Module.imports() / WebAssembly.Module.exports() descriptors no longer include the non-standard js-types-proposal type field unless Options::useWasmJSTypes() is enabled (default false, and Bun does not set it). At the merge base this field was emitted unconditionally and could throw for unrepresentable ref types; descriptors now have the spec shape {module, name, kind} / {name, kind}, matching V8/Node. Also tweaks the WasmJSTypesEnabled description in UnifiedWebPreferences.yaml.

• 20c0bd7d62 — [BEHAVIOR] Wasm JS API spec fix: re-exporting an imported immutable WebAssembly.Global now yields the same JS object that was imported (instance.exports.g === importedGlobal), matching the WPT constructor-caching expectations; previously a fresh wrapper was created each time (mutable globals already preserved identity). JSWebAssemblyInstance gains an m_importedGlobalWrappers map (new setImportedGlobalWrapper/importedGlobalWrapper methods, visited by GC). Plain-number global imports still get a new wrapper.

• 39de2d4eea — [BEHAVIOR] Wasm: importing a WebAssembly.Tag and re-exporting it now yields the same JS object (previously a fresh JSWebAssemblyTag wrapper was created on every export, so === identity failed), and locally defined tags are cached on first export so two export names share one wrapper. Implemented via a new m_tagWrappers map on JSWebAssemblyInstance that is visited by GC; no embedder-facing API change.

• 7f38ebbabf — [BEHAVIOR] Promise.try follows the updated spec (Normative: make Promise.try use PromiseResolve in non-error case tc39/ecma262#3883): the result comes from PromiseResolve(C, value) / PromiseReject(C, error) instead of NewPromiseCapability(C), so Promise.try(() => p) now returns p itself when p is a native Promise, and a subclass constructor is invoked after the callback runs rather than before. builtins/PromiseOperations.js is deleted (@newPromiseCapabilitySlow gone) and @newPromiseCapability becomes a C++ link-time constant wrapping JSPromise::createNewPromiseCapability. Heads-up: follow-up upstream commit 38027ff0ec (also in this range) removes @newPromiseCapability entirely; see that entry under "API and ABI changes" for the Bun $newPromiseCapability(Promise) call sites that must be rewritten.

Performance

• 958a13ecad — [PERF] Wasm BBQ emitIndirectCall computed the CallProfile address with addPtr(TrustedImm32, ...), which on large offsets (functions with many call profiles) silently spills through scratchRegister, clobbering the profile value loaded just before; it now does move + register addPtr. No observable behavior change, but affected call_indirect sites were left permanently un-optimized (polymorphic-callee detection never kicked in), so this restores expected tiering for large wasm functions.

• 01f04c4fb4 — [PERF] YARR JIT now compiles backreferences inside lookbehinds (e.g. /(?<=(a)\1)b/); previously any such pattern forced the entire regex to the interpreter. The backward match compares the capture from its end down to its start, with checkNotEnoughInput becoming index >= length in Backward mode and case-insensitive, duplicate-named-group and surrogate-pair handling reused with the index direction flipped; forward codegen is unchanged. ~10.8x faster on the new regexp-lookbehind-backreference microbenchmark, no intended change in match results (authored by Sosuke Suzuki from Bun).

• 7ef4708559 — [PERF] Parser: when parseFunctionInfo has already computed a function's free-variable list for the SourceProviderCache entry, that span is now handed to popScope, so Scope::collectFreeVariablesFrom (renamed from collectFreeVariables, internal to parser/Parser.h) no longer re-derives it by re-walking used/declared/lexical sets. Pure parse-time speedup for cacheable (>=16/8 byte) function bodies; SourceProviderCacheItemCreationParameters gains a freeVariableCount field and freeVariables() accessor. No behavior change.

• 0ca8f08b89 — [PERF] Lexer::shift drops the 14-year-old "unconditionally zero m_current then overwrite" micro-optimization in favor of a plain if/else, which measures faster on current hardware. Semantics are identical; lexer hot-path only.

• 24a6944b57 — [PERF] In Parser::parseMemberExpression, when the TreeBuilder is SyntaxChecker (the pre-parse/syntax-only pass), the new token start positions are now tracked by a counting placeholder instead of a Vector<JSTextPosition, 4>, since SyntaxChecker::createNewExpr ignores them anyway. Saves allocation/copy work for nested new chains during syntax checking; no behavior change.

• a5fa580c84 — [PERF] B3 LICM (hoistLoopInvariantValues) can now hoist trapping loads (plain Load*, WasmStructGet, WasmArrayLength without fences) and control-dependent values out of loops that contain side exits, as long as no earlier "trap barrier" (write/fence/side-exit) precedes the value on the path from the loop header. Previously any side exit in the loop disabled hoisting of control-dependent values entirely; mainly benefits Wasm OMG and FTL code with bounds/null checks in loops. Adds Effects::isWrite()/isTrapBarrier().

• 6fbae40455 — [PERF] FTL switch on a string that is an unresolved concatenation rope now calls a new noexcept operation (operationSwitchStringResolveRopeAndGetCharacters8) to resolve the rope, and if the result is 8-bit uses the inline binary-search StringSwitch on the resolved characters instead of falling back to the generic slow path. Resolution uses tryGetValue() so an OOM falls through to the slow path rather than throwing from the JIT operation.

• de9231d86e — [PERF] RegExp::m_ovector and RegExp::RareData::m_captureGroupNames switch from Vector to FixedVector, shrinking the RegExp GC cell from 96 to 80 bytes and allocating exactly offsetVectorSize ints instead of Vector::resize's 16-element minimum capacity (64 bytes). Upstream measured per-RegExp cell+ovector going from 160 to 96 bytes and max RSS with 200k live RegExps dropping from 137.5 MB to 115.0 MB; estimatedSize now reports the exact ovector byteSize(). Authored by a Bun contributor.

• 1c2c282d06 — [PERF] Options::computeNumberOfWorkerThreads now caps its result at 32 on non-Darwin platforms; in practice this only affects the default numberOfWasmCompilerThreads (previously cores - 1 with no cap; other callers already pass caps of 3 or 8), limiting it to 31 on Linux/Windows machines with more than 32 cores. Motivated by Wasm compilation OOMs on high-core-count, low-memory hosts; Bun does not override this option (it only sets numberOfGCMarkers), so large Linux servers will see fewer Wasm compiler threads and lower peak memory.

• ce878e190f — [PERF] Map.prototype.forEach/Set.prototype.forEach get inline DFG and FTL lowering for MapIterationNext/MapIterationEntry/MapIterationEntryKey/MapIterationEntryValue, scanning the ordered hash table directly instead of making four C++ operation calls per element (the for-of MapIterator* nodes already did this and now share loadMapEntryData). Upstream microbenchmarks show 1.23x-1.65x speedups on forEach-heavy loops; the now-unreachable operationMap/SetIterationEntry* JIT operations are removed and the remaining operationMap/SetIterationNext become noexcept and only handle obsolete tables. Internal DFG operations only, no embedder-facing API or JS-visible behavior change (new stress tests cover mutation during iteration).

• c823243598 — [PERF] The bytecode cache (generateUnlinkedCodeBlockForFunctions in CodeCache.cpp) now emits CodeForConstruct instead of CodeForCall for class constructors, so cached programs no longer reparse every class constructor body (and its nested functions) on the first new C(); upstream measured 253 -> 4 parses constructing 182 three.js classes and 133 -> 9 parses for babylon.js startup. Cache output grows by the previously missing constructor bodies (three.js +10.8%, a 50 MB bundle +0.5%), which is relevant to Bun's --bytecode builds and node:vm cached-data paths that use generateProgramBytecode/generateModuleBytecode. No API or JS behavior change.

• 9516ed8a4f — [PERF] DFG/FTL switch on strings now handles 8-bit substring ropes inline by reading the base string's buffer at the substring offset, instead of bailing to the slow operationSwitchString call (which resolves the rope). Previously only flat 8-bit strings took the inline binary-switch path, so JIT'd code doing switch (s.slice(...)) / switch (s.substring(...)) gets faster. Internal-only signature rename in DFGSpeculativeJIT.h; no public API change.

• a7a9e233ce — [PERF] The JSON.parse lexer accumulates the int32 value while scanning the digit run instead of re-walking the digits a second time in lexNumber; micro-optimization for integer-heavy JSON. No API or behavior change.

• 6b13bfa7ba — [PERF] TypedArray.prototype.sort() without a comparator now uses an LSD radix sort (8-bit digits, stable passes, skipping digits with a single bucket) for 2/4/8-byte element types above measured thresholds (128 / 512 / 8192 elements), with a SIMD already-sorted pre-scan and a sampled few-distinct-values check that falls back to std::sort; upstream reports 2.3-4.6x on large Int16/Uint16/Int32/Uint32/Float32/Float64 arrays and 6.7x on presorted Int32 (geomean 1.5x). It temporarily allocates an O(n) scratch buffer (plus a snapshot copy for shared buffers) and falls back to std::sort on allocation failure; results are unchanged (NaN canonicalization matches the old sortFloat path). Also adds WTF::SIMD::bitXor/bitXor2 helpers to SIMDHelpers.h.

• db2d849cbe — [PERF] Replaces heap-registering MarkedArgumentBuffer with a stack std::array<EncodedJSValue, N> wrapped in ArgList at every call site where the argument count is statically known (37 files: Promise resolve/reject/then/finally and microtask jobs, VM::callPromiseRejectionCallback, Proxy traps, JSON toJSON/reviver, RegExp/String Symbol.* protocol, iterator protocol, typed-array callbacks, Map/Set/WeakMap constructors, DFG slow paths). This trims per-call overhead and removes the never-hit hasOverflowed()/OOM checks whenever the engine calls back into JS from C++. No public API or JS-visible behavior change; the only signature change (SyntheticModuleRecord::tryCreateWithExportNamesAndValues now takes ArgList) is a private method Bun does not call.

• eb44b6cfaa — [PERF] WTF::URLParser now SIMD-scans the path, opaque-path, query, and fragment states (via SIMD::find from wtf/SIMDHelpers.h) for the first delimiter, encode-set member, control, or non-ASCII code point and consumes the whole preceding run at once (skipped for canonical input, bulk-appended when building the output buffer) instead of looping per code point; upstream measures ~1.33x on 82k real-world URLs and 3-4x on ~100-char components. This directly speeds up every WTF::URL parse in Bun (new URL(), URLPattern, Request/fetch URL handling, module URL resolution). Additive-only header changes: CodePointIterator::span()/advanceBy() and a private URLParser::appendToASCIIBuffer(std::span<const char16_t>) overload; a consteval static_assert verifies each stop-character set covers its percent-encode set, so no parsing behavior changes.

• 70eb5015ae — [PERF] Memory: the buffered-structures set, its lock and bufferingCountdown move from the PropertyInlineCache base class into RepatchingPropertyInlineCache, since handler ICs never buffer; sizeof(HandlerPropertyInlineCache) drops 112 -> 88 bytes per IC site in Baseline/DFG JITData (about -1.27 MB on Octane typescript). Side effect: handler ICs that fail to cache a structure now retry tryCache on the next few visits instead of skipping them; repatching ICs are unchanged. Internal JIT data structure only, not referenced by Bun.

• 1969cf2d9e — [PERF] StringImpl::replace(char16_t, char16_t) (behind String::replace(char, char)) now finds the first occurrence with SIMD WTF::find() instead of a scalar byte-at-a-time loop, for both 8-bit and 16-bit strings; same fix already applied to makeStringByReplacingAll. No behavior change.

• 2d0855229c — [PERF] WTF::copyElements (used throughout string building/concatenation) now handles 2..32-byte copies with inlined overlapping unaligned loads/stores instead of calling libc memcpy, whose size dispatch costs more than the copy itself for short runs. The B3 operationMemoryCopy fast path is hoisted into new WTF helpers copySmallMemory<min,max>(), copyOverlappingEnds, copyOverlappingEndPairs, WidestUnalignedUnit and maxSmallCopySize in wtf/UnalignedAccess.h, available for Bun's own C++ to use; no behavior change.

• 7375405d8e — [PERF] base64EncodeInternal()/base64DecodeInternal() in WTF bound the chosen lookup table with auto, copying the whole 64-byte encode map or 128-byte decode map onto the stack on every call; now auto& references the constexpr table directly. Affects Bun's uses of WTF::base64Decode/base64URLDecode/base64URLEncode (WebCrypto JWK import/export in src/jsc/bindings/webcrypto/CryptoKey*.cpp); no behavior change.

Wasm

• ce60d5d618 — WasmGC concurrent-GC correctness fix in the BBQ tier: struct.new/struct.new_default skipped the mutator fence when every stored field was a constant, but a struct with reference fields still needs the store-store fence before the new object is published to the concurrent marker. BBQ now emits emitMutatorFence() whenever the struct type has ref fields, matching IPInt/OMG; the fence is a no-op on x86_64, so this matters on ARM64.

• c25fbbd346 — Debug-only: fixes a copy-paste typo in an ASSERT in Wasm BBQ emitModOrDiv (x64) that tested lhsLocation twice instead of rhsLocation != edx. No release-build or behavior impact.

• 4cc12fa76b — Debug-build-only fix: assertCalleeIsReferenced in WasmOperations.cpp now returns early when the frame's callee is not a NativeCallee, which happens when a stack overflow during a JS↔Wasm transition reaches operationWasmToJSException with a JS callee still in the frame. Fixes a spurious asNativeCallee() crash under ASSERT_ENABLED; no release behavior change.

• 3400ff6aa7 — Wasm: ModuleInformation now stores the importedStringConstants / qualifiedBuiltinSetNames compile options as UTF-8 byte vectors (Wasm::Name) instead of isolatedCopy()'d WTF::Strings, so no StringImpl is ever shared between the main thread and Wasm compiler threads (not all StringImpl fields are atomic). Import-name matching now compares raw bytes directly, dropping a makeString per import. Internal importedStringConstantsEquals()/builtinSetsInclude() signatures change to const Name& (Bun does not call them); only affects modules compiled with JS string builtins / importedStringConstants options.

• 20d622b6d6 — Build fix: Wasm::CalleeGroup::BBQCalleeReference::operator= is replaced with a named set() method so clang 18's -Wthread-safety-precise analyzer can see the WTF_REQUIRES_LOCK requirement. No runtime behavior change; internal type only.

Other JSC

• 9d03f48340 — Removes the dead CallLinkInfo::m_slowPathCount field (plus offsetOfSlowPathCount()/slowPathCount()) and its increments in the LLInt and JIT virtual-call thunks; CallLinkStatus::computeFromCallLinkInfo already bailed via takesSlowPath() for any m_clearedByVirtual site, so the reads always saw zero. Minor: one fewer memory increment per virtual call and 4 bytes less in CallLinkInfo. Internal-only, not used by Bun.

• 3ddc7045b7 — DFG OSR-exit correctness fix: SpeculativeJIT::emitSwitchChar's StringUse path called op1.use() before speculateString(), so the operand's death preceded the BadType exit and baseline re-executed op_switch_char on a dead/poisoned scrutinee value when the speculation failed (e.g. a switch with single-character string cases later fed a non-string). Now speculates before releasing the operand, matching emitSwitchString; fixes a potential crash/miscompile in optimized code, no API change.

• bdb7246737 — Adds an opt-in DFG/FTL "global inlining planner" (Options::useGlobalInliningPlanner, default false) that surveys and ranks all inlining candidates of a compilation up front (weighted by callee tier and inline depth) and spends a single compilation-wide budget, instead of deciding per call site in bytecode order. Adds nine new Options knobs (globalInliningPlanBudgetForDFG/FTL, maximumGlobalInliningPlanSites, inliningPlanTierBonus*, inliningPlanDepthPenalty). No effect unless enabled; upstream notes the current budget is high enough that it barely changes inlining decisions yet.

WTF and bmalloc

• 386c27f080 — Build-only tweak: the ALWAYS_INLINE fast path of WTFCrashWithInfo (Darwin/PlayStation on x86_64/ARM64) is additionally disabled when compiling under the clang static analyzer (__clang_analyzer__) so the analyzer sees the out-of-line no-return version. No effect on normal Bun builds.

• 390e2c91dc — Only engine-side change is a one-line #import → #include of <wtf/Platform.h> in wtf/MachSendRightAnnotated.h (a Cocoa-only header); the rest is WebKit modulemap hygiene for Swift/Windows. No effect on Bun's JSCOnly build.

• 1f7ab2fec8 — Fixes WTF::symbolize() in wtf/StackTrace.cpp under USE(LIBBACKTRACE): consults the symbol table (mangled names) before DWARF so clang debug builds get fully-qualified frame names, initializes the symbol pointer (previously read uninitialized on lookup miss), and passes a non-null error callback (libbacktrace always invokes it, so null crashed on the first failed lookup). No effect on Bun: USE_LIBBACKTRACE defaults to OFF for the JSCOnly port and Bun's build does not enable it.

• f0148cf5ab — Changes Source/WTF/wtf/module.modulemap so the WTF Core clang module declares requires cplusplus23 instead of cplusplus, and bumps the module-cache touch count to force a rebuild. Only affects builds that consume WTF as a clang module (-fmodules, Apple/Swift-interop builds); Bun's build already uses -std=c++23 and does not enable clang modules, so no effect on Bun.

[claude]

I reviewed this PR and the automated bug hunt found no issues. Given the scope — a 413-commit upstream merge touching JIT tiers, GC, Wasm, and threading, plus a hand-authored CachedTypes.cpp conflict resolution that restructures the bytecode cache format — a human review is still warranted.

Checked: the CachedGlobalCodeBlock split matches the described field moves and the flag-bit renumbering; the addStaticGlobals conflict is whitespace-only as stated; the carried-over #488 resolutions (YarrJIT, URLParser, waitSyncImpl, module map) are internally consistent with the PR description; the new JSTests and Wasm stress tests are additive.

Extended reasoning...

Overview

This PR merges upstream WebKit main at 55d9d9007f into the Bun fork: 413 upstream commits (90 in JSC/WTF/bmalloc) across 300+ files, superseding #488. It is built as two merge commits — first re-merging #488's head to pick up its already-reviewed conflict resolutions, then merging 26 more upstream commits on top. The engine-side surface includes DFG/FTL/B3 changes, Wasm OMG/BBQ codegen, the garbage collector and IsoHeap plumbing, SymbolTableEntry/InlineWatchpointSet restructuring, module loader semantics, Linux thread scheduling, and typed-array/JSON/Map/Set runtime paths. The one substantive new conflict resolution is runtime/CachedTypes.cpp, where five scalars, two directive strings, and the jump-target array move out of the per-codeblock varint tail into a new CachedGlobalCodeBlock<CodeBlockType> layer to track upstream's UnlinkedCodeBlock → UnlinkedGlobalCodeBlock field migration.

Security risks

Several merged commits are security-relevant by nature: JIT correctness fixes (7711916200 DFG Inc/Dec DCE of overflow checks, 9f07374e9e Wasm OMG patchpoint cloning inside try blocks), Wasm bounds-checking changes (signaling-memory large-offset tests, memory64 multi-memory), a use-after-free fix in MediaElementAudioSourceNode (WebCore, not compiled in JSCOnly), and the SymbolTableEntry move-only/watchpoint refactor that touches LLInt and JIT codegen for scope access. These are upstream-authored and upstream-reviewed, so the risk here is in the merge/conflict-resolution seams rather than the commits themselves. The CachedTypes.cpp resolution is the highest-risk seam: a mis-encoded lexicallyScopedFeatures or hasCapturedVariables in the cache would silently change strict-mode or closure semantics on cache replay. The PR description documents targeted round-trip verification of exactly those fields.

Level of scrutiny

High. This is a large upstream sync into a production JavaScript engine, with hand-authored conflict resolution in the bytecode cache serialization format — a component where a mistake produces wrong-behavior-only-on-cache-hit bugs that are hard to bisect. The rest of the merge inherits upstream's review, but the CachedTypes.cpp restructuring, the waitSyncImpl fork/upstream reconciliation, and the dropped setFetchError path are fork-authored decisions that a maintainer familiar with #490/#493/#494/#497 and #432/#262 should confirm. This also has a paired Bun-side PR for the API/ABI changes (SymbolTable::set, ObjectIdentifier, PriorityQueue, SourceProviderCache), so it needs to land in coordination.

Other factors

The author ran a debug+ASAN build, bytecode-cache round-trip tests covering the moved fields, and the bytecode-cache-* stress suite. No CI results are attached to the PR yet. No prior reviews or comments exist on this PR. The description is unusually thorough and pre-answers most questions a reviewer would ask, but the sheer breadth (JIT, GC, Wasm, threading, cache format) and the need to coordinate with the Bun-side PR put this well outside what should be auto-approved.

[github-actions]

Preview Builds

Commit	Release	Date
fabdd1db	autobuild-preview-pr-501-fabdd1db	2026-08-23 22:23:47 UTC

[robobun]

Closing in favor of #503. Both PRs merge upstream main into the fork with the same structure (main at 62f427b86f, then #488's head, then upstream/main) and the same CachedTypes.cpp resolution. The two upstream targets differ by one commit: 55d9d9007f is 8c4fd56347 plus the MediaElementAudioSourceNode use-after-free fix in WebCore, which the JSCOnly port does not compile. The Bun side is oven-sh/bun#40276, which replaces oven-sh/bun#40263.

Main has moved since both branches were cut (#499, #504, #502, #506), so the re-merge with main happens on #503.