Upgrade to upstream WebKit 8c4fd56347

[robobun]

Merges upstream WebKit main at 8c4fd56347 (2026-08-23): 412 commits since the previous merge base 47f7250137c6 (2026-08-16), 90 of them touching JavaScriptCore, WTF or bmalloc.

This supersedes #488 (upstream baf4a9a7ec0b), which stopped merging once the bytecode cache rework landed on main (#490, #493, #494, #497). The branch is main, then a merge of #488's head d0fae3b3c9 (its conflict resolutions and its per-commit review are carried over below), then a merge of upstream/main. git merge-base origin/main upstream/main still reports 3722912ff800 because #455 was squash-merged; going through #488's merge commit (second parent baf4a9a7ec0b) gives the right base, so no graft was needed this time. The last merge commit of this PR has 8c4fd56347 as its second parent, so the next upgrade does not need one either as long as this lands as a merge commit rather than a squash.

Conflict resolutions

New in this PR (main's bytecode cache rework against upstream 3d0e6c14b1 and 0b92c2bcd0, and one hunk of cea233cede):

• runtime/CachedTypes.cpp: main (Bytecode cache: smaller payloads that page in only what is decoded (alias mapped bytes, region layout, 32-bit offsets, sparse metadata table) #494, Bytecode cache: arrays-first code block records, strings deduplicated by contents, geometric encoder pages #497) writes a code block as one checksummed region with a varint tail of scalars and an optional CachedCodeBlockExtras; upstream moved m_features, m_lexicallyScopedFeatures, m_hasCapturedVariables, m_lineCount, m_endColumn and the two source-URL directives from UnlinkedCodeBlock to UnlinkedGlobalCodeBlock (3d0e6c14b1) and deleted UnlinkedCodeBlock::m_jumpTargets (0b92c2bcd0). Resolution: those five scalars leave the per-block varint tail (the flag word is renumbered), the two directives leave CachedCodeBlockExtras (which now holds only rareData and outOfLineJumpTargets), and a CachedGlobalCodeBlock<T> record sits between CachedCodeBlock<T> and the Program/Module/Eval records and writes those seven members as the first of the record's own members through the fork's encodeOwnMembers/decodeOwnMembers chain, so function records (nearly all of them) no longer carry them. The jumpTargets array is gone from Layout, packLayout/readTail, create, decode and regionIsIntact (three shareable arrays instead of four). The payload shape changes, which computeJSCBytecodeCacheVersion() already invalidates.
• runtime/JSGlobalObject.cpp (cea233cede): a whitespace-only conflict in addStaticGlobals; upstream's InlineWatchpointSet* is taken.
• CodeCache.cpp, UnlinkedCodeBlock.h, UnlinkedFunctionExecutable.cpp, BytecodeRewriter.cpp, jsc.cpp, OptionsList.h: main's and Upgrade to upstream WebKit baf4a9a7ec0b #488's edits merged without conflict; the result compiles and the disk cache round-trips (see Verification).

Merge of main 94c452c6e9 (2026-08-25, merge commit d2654c3b39), after #499, #502, #504, #506, #507 and #508 landed on main:

• bytecode/UnlinkedCodeBlock.cpp: main reports the expression info to the GC through byteSizeForGCPacing(); upstream 0b92c2bcd0 deleted m_jumpTargets. Both taken.
• runtime/CodeCache.cpp: main's depth bound on generateUnlinkedCodeBlockForFunctions (Bytecode cache: entry kind for an embedder's builtin function executables #502) is applied to upstream's c823243598 shape of that function (one generate lambda that picks CodeForConstruct through isClassConstructorFunction()). Same behaviour as main's version of the loop.
• runtime/CachedTypes.cpp: main (Bytecode cache: numbered strings with stored hashes, so repeat lookups skip the atom table #506) made sourceURLDirective() and sourceMappingURLDirective() on CachedCodeBlock reuse the parsed tail; this branch had already moved the two directives to CachedGlobalCodeBlock (upstream 3d0e6c14b1), so those two accessors are gone. Everything else from main (numbered strings, inline and external strings, ActiveTailScope, BuiltinFunctionCacheEntry, the JSBigInt algorithms) merged without conflict.
• Checked on the merged tree: bun run jsc:build:debug builds. The disk-cache round-trip described under Verification (4 bytecode-cache-*.js, the 105 top-level JSTests/modules tests, 400 random JSTests/stress tests, each run plain, with JSC_forceDiskCache=true, and with JSC_diskCachePayloadIsPersistentForTesting=true) passes 396 files and skips 105 that declare their own options. The 8 that fail are in the categories listed under Verification: forced-cache mode on a module served from the in-memory CodeCache (caching-should-not-make-ambiguous.js, namespace-ambiguous.js, ASSERTION FAILED: codeBlock in CodeCacheMap::fetchFromDisk), five module tests that check the fork's error wording (different-view.js, fallback-ambiguous.js, import-error.js, indirect-export-error.js, namespace-error.js, same failure without a cache), and stack-overflow-in-scope-with-catch.js, which needs more than 3 minutes under debug + ASAN. No decode failure or checksum mismatch. encodeBuiltinFunction / decodeBuiltinFunction (Bytecode cache: entry kind for an embedder's builtin function executables #502) round-trip a builtin with nested, class, async and generator functions through the jsc shell's builtinFromBytecodeCache at depths 0, 1, 2 and unbounded. Main's new JSBigInt tests (bigint-multiply-karatsuba.js, bigint-multiply-toom-fft.js, bigint-divide-burnikel-ziegler-barrett.js, bigint-parse-large.js, bigint-tostring-divide-and-conquer.js, the six bigint-terminate-*.js with their watchdog options) and the upstream tests listed under Verification pass. Bun was not rebuilt against this merge; the preview build this push produces is what the companion Bun PR should pin.

Carried over from #488 (47f7250..baf4a9a):

• yarr/YarrJIT.cpp: kept at the fork's version (Yarr: JIT lookbehinds, first-code-point alternation dispatch, Boyer-Moore and /u·/v spec alignment, RegExp correctness fixes #299 policy, same as Upgrade to upstream WebKit 47f7250137c6 #455). Upstream's 01f04c4fb4 (JIT lookbehinds that contain backreferences) restructures the backreference codegen that the fork already reworked for mirrored frames; the fork compiles these patterns already. Upstream's three new tests (regexp-lookbehind-jit-backreferences.js, regexp-lookbehind-jit-backreferences-unicode.js, regexp-backreference-greedy-non-bmp-capture-restore-pos.js) pass on this build in JIT and --useRegExpJIT=false mode. 2165451fd3 (interpreter tryConsumeBackReference position restore) was already in the fork. de9231d86e (FixedVector ovector) merged cleanly.
• WTF/URLParser.cpp and .h: kept at the fork's version. Upstream's eb44b6cfaa SIMD-scans path, query, fragment and opaque-path runs, which the fork's URLParser rewrite (0cbb4a1946, c6cfe90c60, eeab04040f) already does with its own table-driven scanners. Upstream's CodePointIterator::span()/advanceBy() additions and the two new TestWebKitAPI cases are in.
• Atomics.wait termination (03e836de2f vs the fork's [JSC] Atomics.wait / memory.atomic.wait: wake up for a termination requested from another thread #432): WaiterListManager::waitSyncImpl keeps the fork's version (termination wake-up delivered under the waiter list lock, deferred termination respected, trap consumed and the TerminationException thrown before returning Terminated). The two callers take upstream's vm.throwTerminationExceptionIfNeeded(), which is a no-op when the exception is already pending. throwWasmToJSException's early-out for a pending TerminationException is in.
• Module map (f324cca020): upstream no longer registers a module entry for a fetch failure and evicts a FetchFailed entry on the next loadModule. The fork's ModuleLoader: record a non-Error fetch rejection as a fetch failure #262 (setFetchError for a non-ErrorInstance fetch rejection in moduleLoadTopSettled) is dropped: that path no longer registers anything for any fetch failure, so the poisoned EvaluationFailed entry ModuleLoader: record a non-Error fetch rejection as a fetch failure #262 fixed cannot be created. Verified ModuleLoader: record a non-Error fetch rejection as a fetch failure #262's repro (import a file with a parse error, then import a file that statically imports it) completes on a Bun built against this tree. JSModuleLoader.h/.cpp: both sides' additions kept (removeFailedFetchEntry, public getRegisteredMayBeNull, the fork's registryEntry/removeEntry/clearAll/loadModuleSync).
• CodeCache.cpp: upstream's c823243598 generates CodeForConstruct for class constructors via UnlinkedFunctionExecutable::isClassConstructorFunction(). The fork's "NOTE: We changed this in Bun" loop called isConstructor() on the UnlinkedFunctionExecutable, which resolves to JSCell::isConstructor() and is always false for a non-object cell, so it never generated anything but CodeForCall. Upstream's version replaces it. The fork's recordParseFromUnlinkedCodeBlock now takes an UnlinkedGlobalCodeBlock* because 3d0e6c14b1 moved the parse results off UnlinkedCodeBlock (follow-up commit d7ff6be).
• SyntheticModuleRecord: db2d849cbe changes tryCreateWithExportNamesAndValues to take ArgList; the fork's lazy-export overloads (SyntheticModuleRecord: exports whose values are produced on first binding #408) follow. MarkedArgumentBuffer converts implicitly.
• ThreadingPOSIX.cpp (9a18171a13, RT threads removed, per-QOS sched_setattr on Linux): the fork's !USE(BUN_JSC_ADDITIONS) main-thread detection branch keeps its guard and takes the new Thread(QOS, SchedulingPolicy, IsMain) constructor. Thread::updateSchedulingAttributes is a no-op under USE(BUN_JSC_ADDITIONS) on Linux: upstream now resets every WTF thread to SCHED_OTHER nice 0 with a 100% utilization clamp and puts JIT/Wasm compiler threads on SCHED_BATCH nice 10 when the host has 4 or fewer cores. Bun's threads keep inheriting the process's scheduling policy, nice level and clamps, as they did before this merge. Drop that hunk if following upstream is preferred. RealTimeThreads.cpp is deleted (the fork only added an include to it).
• Options.h, JSWebAssemblyInstance.h: upstream's new includes (OSCheck.h, WasmLimits.h, <wtf/BitSet.h>) added in the fork's quoted-include style.
• JSType.h, .github/workflows and the release tarball names are unchanged. PromiseOperations.js is gone upstream (see 38027ff0ec below): Bun's six $newPromiseCapability call sites move to $newPromise() plus $resolvePromise/$rejectPromise (or the ...WithFirstResolvingFunctionCallCheck variants) in the Bun PR.

Verification

• bun run jsc:build:debug (Linux x64, debug + ASAN): builds, jsc shell runs.
• Bytecode disk cache round-trip on the merged jsc: 509 JSTests files (every bytecode-cache-*.js, every top-level JSTests/modules test, 400 random JSTests/stress tests), each run plain with JSC_diskCachePath (writes the cache), then with JSC_forceDiskCache=true (must decode), then with JSC_diskCachePayloadIsPersistentForTesting=true as well (borrowed instruction bytes and metadata steps), outputs compared. 77 files declare their own options and were skipped; 414 pass all three ways; the 18 that fail do so identically on a jsc built from main 62f427b86f with the same configuration (cwd-relative load() paths, the fork's error-message wording in module tests, locale data the filtered libicudata only exposes through Bun's decompress hook, and forced-cache mode on modules whose code block was served from the in-memory CodeCache or never compiled because of a syntax error). No decode failure or checksum mismatch.
• The tests upstream added in the new range pass (inc-dec-int32-overflow-dce.js with its requireOptions, object-assign-clone-multiple-sources.js, wasm/stress/omg-reduce-strength-select-exception-stackmap.js); inc-dec-int32-overflow-dce.js fails on main's jsc, as expected for a bug fixed in this range.
• bun run build:local: Bun (main d43ddf309a plus the bun-side changes of the companion PR) links and runs against this tree. test/js/bun/jsc, bun/jsc-stress (116/116 incl. the FFI and Wasm BBQ/OMG fixtures), node/events, node/util, node/dgram, node/vm, node/module, bun/resolve, node/worker_threads, bun/wasm, web/url, web/atomics, node/http/node-http-connect, node/async_hooks, node/string_decoder, bundler/bundler_compile, bundler/bun-build-api, regression/issue/26298: 3,548 pass; the only failures are 5-second timeouts under debug + ASAN (DOMJIT warm-up loops, worker termination, parseArgs stress), the IPv6 multicast ENODEV of this machine, and compile/HelloWorldWithProcessVersionsBun, which fails the same way on a debug build at the current pin (process.versions.bun keeps the -debug suffix).
• The earlier checks from Upgrade to upstream WebKit baf4a9a7ec0b #488 (the 464 regexp/string/yarr stress tests in JIT and interpreter mode, Atomics.wait termination, ModuleLoader: record a non-Error fetch rejection as a fetch failure #262's module-map repro) were done on the baf4a9a7ec0b merge this PR carries; the upstream range since then touches none of those areas.

Upstream changes

Each remaining commit appears once, under the most specific heading that applies. The range is 47f7250137c6..8c4fd56347; the commits after baf4a9a7ec0b are marked with (new). The 18 commits in the range whose only engine-side footprint is a WebCore/WebKit preference entry, a WTF build-file list change, or Cocoa/GTK/WPE-only code the JSCOnly port does not compile are omitted (cb7daacd43, 7d86b2c8a0, 94f879afe6, 2f072fbfec, 3dfdbed8e4, 86a8860a42, 0c33544154, 722d0b38a9, cc7a6821b7, d8ad5b5f9a, b66aab8e21, 5e3cb10ac4, c2b3e55128, 2dce2395a4, d27b7fd89e, 6248fa7145, 8bd2ba0d3e, f0a1fd2b32).

API and ABI changes

• cea233cede (new) — [PERF] [API] SymbolTableEntry no longer allocates a WatchpointSet when a variable is merely prepared for watching. Every closure variable its own function stores to (so every var/let/function/class binding and captured parameter) and every global variable gets prepareToWatch() when its CodeBlock is linked or the global is declared, which used to allocate a 16-byte FatEntry plus a 32-byte WatchpointSet per variable. The fat entry now holds an InlineWatchpointSet (one word that tracks ClearWatchpoint/IsWatched/IsInvalidated) that inflates to a real WatchpointSet only when the DFG adds a Watchpoint to it; LLInt, Baseline, DFG and FTL check the inline word first. Upstream measured a 250-module CommonJS server app going from 1,466 WatchpointSets at load to none, and only 376 of 1,752 inflating after DFG/FTL compilation. API: SymbolTableEntry's copy constructor and assignment are deleted (a copy is always the thin SymbolTableEntry::Fast, which SymbolTable::get()/inlineGet() and symbolTableGet() now return), watchpointSet() returns InlineWatchpointSet*, disableWatching() and the lockless SymbolTable::set(key, entry) overload are gone, and ResolveOp, ScopedArgumentsTable, symbolTablePutTouchWatchpointSet/symbolTablePutInvalidateWatchpointSet and SymbolTable::hasScopedWatchpointSet take InlineWatchpointSet*. Bun's one use (NodeVMSyntheticModule.cpp moves a fresh SymbolTableEntry(VarOffset(offset)) into set(NoLockingNecessary, ...)) is unaffected. The follow-up 0f924849f5 marks SymbolTableEntry::inflate JS_EXPORT_PRIVATE for the CMake (-fpch-codegen) build. Authored by Bun's Sosuke Suzuki.

• 314133b7a6 (new) — [API] WTF: the UUID-backed flavour of ObjectIdentifier is removed (reverting 279402@main). ObjectIdentifierGenericBase and ObjectIdentifierGeneric lose their RawValue template parameter and are uint64_t-only again, UUIDObjectIdentifier is gone, the access-traits structs are no longer templates, and toRawValue() is folded back into toUInt64(); ObjectIdentifier<T>, AtomicObjectIdentifier<T> and the TextStream/CrossThreadCopier support keep their names and behaviour. Bun's ProcessIdentifier = ObjectIdentifier<ProcessIdentifierType> (src/jsc/bindings/ProcessIdentifier.h) and ScriptExecutionContext.h use the uint64_t form, so nothing changes on Bun's side. Also adds the <wtf/HexNumber.h> include that yarr/YarrJIT.cpp got through the removed header.

• cffd5ed032 — [API][PERF] WTF::PriorityQueue now follows std::priority_queue conventions: the template takes a less-than functor type (default std::less<T>, function pointers are rejected by static_assert) instead of an isHigherPriority function pointer and serves the greatest element first; the isLessThan/isLessThanEqual/isGreaterThan/isGreaterThanEqual helpers were removed from wtf/MathExtras.h. This fixes Wasm::Worklist, whose comparator was never flipped when it moved off std::priority_queue (present in Bun's previous WebKit): compilation plans were served in reverse priority (Preparation before Compilation before Synchronous before Shutdown) and newest-first within a priority, and completePlanSynchronously bumped the plan with decreaseKey instead of increaseKey, so synchronous WebAssembly.Module/Instance compiles could wait behind queued async work. DFG inlining, Wasm inlining and the greedy register allocator were adapted to the new convention with no change in ordering; Bun has no direct PriorityQueue usage.

• 9a18171a13 — [API][PERF] Linux thread scheduling in WTF is reworked: the RealTimeThreads/SCHED_RR machinery is removed (wtf/linux/RealTimeThreads.h renamed to HighPriorityThreads.h, rtkit nice-boosting only under USE(GLIB)), and every WTF::Thread now applies its QOS from its own entry point via sched_setattr: the default UserInitiated QOS maps to SCHED_OTHER, nice 0 plus SCHED_FLAG_UTIL_CLAMP_MIN = 1024 (a 100% DVFS frequency floor, with automatic fallback on kernels that reject uclamp), Default gets a 20% floor, Utility gets SCHED_BATCH/nice 10 and Background gets SCHED_IDLE/nice 19. JIT and Wasm worklist threads now pass compilerThreadQOS(), which is Utility on Linux hosts with <= 4 cores, so concurrent compilation is deprioritized on small machines/containers. API surface: the protected Thread ctor is now Thread(QOS, SchedulingPolicy, IsMain), AutomaticThread gains a ThreadQOS ctor overload, Thread::qos() is added and isRealtime() is derived from the scheduling policy, and ThreadingEnums.h adds ThreadSchedulingState, defaultThreadQOS, defaultThreadSchedulingPolicy, compilerThreadQOS(); Darwin and Windows behaviour is unchanged.

• e1fdc80a34 — [API] WTF::weekDay(int32_t days) in wtf/DateMath.h is rewritten as a branchless unsigned multiply-and-shift (Ben Joffe's method) that is well-defined for the whole int32_t range (the old (days + 4) % 7 was signed overflow for days > INT32_MAX - 4, unreachable from JS since day counts are clipped to +-1e8), and the unused WTF::msToWeekDay(double) is removed. ISO8601::dayOfWeek (Temporal PlainDate/PlainDateTime dayOfWeek) drops its private Int128 copy of the modulo and uses daysFromYearMonth + WTF::weekDay. Results are unchanged (upstream checked all 2^32 inputs); authored by Bun's Sosuke Suzuki.

• 75a9d414a4 — [API] (additive) Correctness fix for VM::deleteAllCode / Heap::deleteAllCodeBlocks: the VM-level m_syncResumeCallCache (the MicrotaskCallCache used to resume async functions/async generators from the microtask queue) lives outside any VMEntryScope and kept stale Executable->CodeBlock entry points after all code was detached, so a later resumption could call into a detached CodeBlock. Adds MicrotaskCall::clear(), MicrotaskCallCache::clear() and public VM::clearMicrotaskCallCaches(), which Heap::deleteAllCodeBlocks now calls; CodeCache::clear() also now calls write() first. Directly relevant to Bun, which calls vm.deleteAllCode(...) in WebWorker__teardownJSCVM, JSC__VM__deleteAllCode, and via the debugger's recompileAllJSFunctions path while async work may still be pending.

• 3302d7a455 — [PERF][API] SourceProviderCache now pre-reserves its m_map hash map from the source length (sourceLength / 512 entries, capped at 64K) to avoid repeated rehash/realloc while a large script is parsed. The public default constructor is replaced by a private explicit SourceProviderCache(unsigned sourceLength) plus static Ref<SourceProviderCache> create(unsigned); VM::addSourceProviderCache is updated. Bun only includes the header (src/jsc/modules/BunJSCModule.h) and never constructs one directly, so no Bun changes are needed.

• 1450e69522 — [API] WTF DequeIterator and DequeConstIterator gain defaulted default constructors (required by the C++20 bidirectional_iterator concept, and by MSVC's STL std::reverse_iterator, which value-initializes its stored iterator). Purely additive; Bun's many WTF::Deque uses (streams, JSBufferList, worker queues) are unaffected and this may help MSVC-STL builds that instantiate Deque::rbegin().

• f2d69489c6 — Removes the unused tryAllocateBuffer helper from VectorBufferBase/VectorBuffer in wtf/Vector.h; allocateBuffer<FailureAction::Report> remains for the same purpose. [API] Technically a public-header removal, but Bun's src/ has no references to it, so no action needed.

• 03e836de2f — [BEHAVIOR] Fixes a thread blocked in Atomics.wait / Wasm memory.atomic.wait never unblocking after VM::notifyNeedTermination(): WaiterListManager::waitSyncImpl now also observes the pending NeedTermination trap (not just hasTerminationRequest()), dequeues the waiter and returns Terminated, and the new VM::throwTerminationExceptionIfNeeded() materializes the TerminationException through handleTraps. This directly affects Bun, whose VmHandle::request_termination (used by worker.terminate()) fires exactly that trap, so a worker parked in Atomics.wait now terminates instead of hanging. [API] Adds VM::throwTerminationExceptionIfNeeded(); throwWasmToJSException now early-outs whenever a TerminationException is already pending.

• 88b46e6bc7 — [API] wtf/BorrowedBytes.h is deleted and replaced by wtf/EscapableByteSpan.h: BorrowedBytes/BorrowedSpanScope/BorrowedVectorScope are gone, replaced by a stack-only, non-refcounted EscapableByteSpan (plus escapableSpan() helper and SpanUInt8/MutableSpanUInt8/VectorUInt8 aliases) that RELEASE_ASSERTs if a copy outlives the borrow. This is a Swift-interop type used only by PAL crypto on Cocoa; Bun has no references to either header, so no impact beyond the header rename in WTF_PUBLIC_HEADERS.

• f324cca020 — [BEHAVIOR] [API] The module loader stops caching fetch failures: JSModuleLoader::loadModule now evicts a FetchFailed registry entry (new removeFailedFetchEntry) and re-fetches instead of re-rejecting with a duplicated copy of the old error, and the top-level rejection paths in JSMicrotask.cpp no longer call ensureRegistered just to stash an error (evaluation errors are still cached; maybeDuplicateFetchError is no longer used on that path). For Bun this means a second import() of a specifier whose fetch previously rejected (e.g. a missing file or failed loader) will invoke Bun's module-loader fetch hook again rather than rejecting immediately from the cache, so anything that relied on the cached rejection (tests, error identity) may see different behavior. JSModuleLoader::getRegisteredMayBeNull is also moved from private to public.

• 905a225671 — [API] wtf/UniStdExtras.h is now wrapped in #if OS(UNIX), so setCloseOnExec/unsetCloseOnExec/dupCloseOnExec/closeWithRetry/setNonBlock are no longer declared on Windows (done to keep the Windows Swift C++ importer happy). Only matters if the embedder includes that header on Windows; Bun's bindings do not reference it.

• 76b474b322 — [API] Refactors JSC::Wasm::TypeKind: the type-section forms Func, Struct, Array, Rec, Sub, Subfinal are removed from TypeKind and moved to a new generated Wasm::DefinedTypeKind enum (with isValidDefinedTypeKind / makeString(DefinedTypeKind)), and the section parser dispatches on that. Pure cleanup that removes dummy switch cases; no behavior change. Bun does not reference these enumerators, so nothing to update.

• 218421554b — [PERF] [API] JSON.parse now buffers array elements on a MarkedArgumentBuffer element stack and allocates each JSArray once at its final length and indexing type (Int32/Double/Contiguous) instead of growing the butterfly via putDirectIndex per element; also skips two Structure loads for outOfLineCapacity when a property offset is still inline. Drive-by change to the inlined MarkedVector::append fast path (stays inline once heap-allocated and registered with a mark set, rather than calling slowAppend on every append) and an additive MarkedVector::shrink(size_t) — both are inlined into Bun's many MarkedArgumentBuffer users, but no signature changes. Also speeds up Bun's native JSONParse/JSONParseWithException callers (JSON module loading, .json(), SQL client, etc.).

• 6446fdc8e0 — WebCore ISO-BMFF box serialization work; the only engine touch is JSC::DataView::get<T>() and DataView::read<T>() in runtime/DataView.h becoming const member functions. [API] Source-compatible (header-only inline templates, only adds const), so no embedder action needed.

• 38027ff0ec — Removes the @newPromiseCapability private builtin/link-time constant from JSC (builtins/BuiltinNames.h, bytecode/LinkTimeConstant.h, host function in runtime/JSGlobalObject.cpp), since upstream builtins now use @newPromise + @resolvePromiseWithFirstResolvingFunctionCallCheck/@rejectPromiseWithFirstResolvingFunctionCallCheck (no tuple object allocation, no property lookups). [API] After this upgrade @newPromiseCapability no longer resolves as a private name. Bun's bundled modules called $newPromiseCapability(Promise) in src/js/node/dgram.ts, events.ts, _http_server.ts (3 sites) and util.ts; the Bun PR rewrites them to $newPromise() plus the $resolvePromise/$rejectPromise family. Note the preceding upstream commit 7f38ebbabf had already deleted builtins/PromiseOperations.js (the JS implementation); the C++ JSPromise::createNewPromiseCapability() used by src/jsc/bindings/JSMockFunction.cpp is unaffected.

• 0b92c2bcd0 — [PERF] Deletes UnlinkedCodeBlock::m_jumpTargets (a per-label offset list that nothing in a shipping configuration read; DFG/liveness already recompute targets via computePreciseJumpTargets()), saving 4 bytes per label (~38 KB after loading typescript.js), shrinking UnlinkedFunctionCodeBlock from 216 to 208 bytes (GC cell 224 -> 208), and cutting the serialized bytecode cache by ~1.4%. [API] Removes CodeBlock::numberOfJumpTargets()/jumpTarget(), UnlinkedCodeBlock::numberOfJumpTargets()/jumpTarget()/lastJumpTarget(), UnlinkedCodeBlockGenerator::addJumpTarget() etc., and recomputePreciseJumpTargets(), adding a computePreciseJumpTargets(UnlinkedCodeBlock*, ...) overload — Bun's bindings use none of these. The CachedCodeBlock layout changes (field dropped from runtime/CachedTypes.cpp), but bun build --bytecode output is already keyed to the build via computeJSCBytecodeCacheVersion(), so old caches are rejected rather than misread.

• 3d0e6c14b1 — [PERF][API] Memory: moves m_features, m_lexicallyScopedFeatures, m_hasCapturedVariables, m_lineCount, m_endColumn and the sourceURL/sourceMappingURL directive pointers from UnlinkedCodeBlock down to UnlinkedGlobalCodeBlock (only Program/Eval/Module code uses them), shrinking UnlinkedFunctionCodeBlock from 216 to 192 bytes (cell 224 -> 192; ~53 KB saved after loading typescript.js). The accessors codeFeatures(), allowDirectEvalCache(), lexicallyScopedFeatures(), hasCapturedVariables(), lineCount(), endColumn(), sourceURLDirective(), sourceMappingURLDirective() and recordParse() are removed from UnlinkedCodeBlock and now exist only on UnlinkedGlobalCodeBlock; UnlinkedCodeBlock::usesImportMeta() is deleted outright (Bun's bindings use none of these; Bun's sourceURLDirective() calls are on SourceProvider). The serialized CachedCodeBlock layout for the bytecode cache also changes (split into CachedCodeBlock + CachedGlobalCodeBlock), which is covered by Bun keying the cache version on BUN_WEBKIT_VERSION.

• 0bbbac7b52 — [BEHAVIOR] [API] Wasm memory64 now works together with multi-memory: the WasmSectionParser check that rejected any module combining a 64-bit memory with multiple memories ("if using memory64 then multiple memories are illegal for now") is removed, so such modules now validate/compile/run instead of failing with CompileError. IPInt decides whether to zero-extend an i32 address per accessed memory using a new WTF::BitSet<Wasm::maxMemories> (JSWebAssemblyInstance::m_memoryIsMemory64Bits) instead of a single memory-0 flag. JSWebAssemblyInstance::cachedMemory0IsMemory64() and offsetOfCachedMemory0IsMemory64() are removed (replaced by offsetOfMemoryIsMemory64Bits()); Bun does not reference them.

• 71144530c1 — [API] Bumps the vendored wtf/simdutf single-header from 8.2.0 to 9.0.0 (now requires C++17): simdutf::to_string(encoding_type) and implementation::name()/description() return std::string_view instead of std::string, full_result gains a padding_error field and the base64 decoders now report the = position as the error location for padding errors, the SIMDUTF_FEATURE_* macros become #ifndef-overridable, and the icelake (AVX-512) simdutf::find now masks its tail load so searching for NUL no longer false-matches past the end of the input. error_code values, struct result, and every function Bun's src/simdutf_sys shim (bun-simdutf.cpp, simdutf.rs Status constants) calls are unchanged, and Bun falls back to its scalar decoder on any base64 error rather than reading the error offset, so no Bun-side change is needed.

• ee4b208267 — [PERF] [API] Generator/async function bodies whose wrapper has no parameters no longer allocate a 64-byte UnlinkedFunctionExecutable::RareData just to hold an empty parameter-name list (every async () => {...}, async function f() {}, function* g() {} paid this; ~6.4 MB saved per 100k such functions). UnlinkedFunctionExecutable::create and the BytecodeGenerator now take Vector<Identifier>&& instead of std::optional<Vector<Identifier>>&&; Bun does not call UnlinkedFunctionExecutable::create directly, so no action needed.

• b1701b3489 — [BEHAVIOR] [API] Uint8Array.prototype.setFromBase64 on a zero-length target now returns { read: 0, written: 0 } without inspecting the input at all (even an invalid base64 string is accepted), matching step 3 of the proposal spec; Uint8Array.fromBase64 is unchanged. WTF::fromBase64() gains a required fifth parameter OutputSizeIsMaxLength (new enum in wtf/text/Base64.h); Bun does not call WTF::fromBase64 directly, so no source change is needed.

• 870de4ab77 — WTF fix in wtf/text/TextBreakIterator.{h,cpp}: NonSharedCharacterBreakIterator and NonSharedSentenceBreakIterator leaked their ICU UBreakIterator when setTextForIterator() failed (reachable via a null StringView), and the 8-bit path skipped utext_close() on ubrk_setUText() failure. Ownership is now expressed with a new WTF::UBreakIteratorPtr (std::unique_ptr<UBreakIterator, ICUDeleter<ubrk_close>>) and m_iterator becomes that smart pointer; the public operator UBreakIterator*() is unchanged. [API] Only the private member type and the file-static helpers changed, so this is source-compatible for embedders, and Bun does not use these classes at all (JSC only references them from the offline CharacterPropertyDataGenerator tool), so it is a no-op for Bun in practice.

Behavior changes

• 7711916200 (new) — [BEHAVIOR] (bug fix) DFG miscompile of ++/--: FixupPhase's Inc/Dec handler cleared NodeMustGenerate on the ArithAdd/ArithSub it produced in every case, so a CheckOverflow increment whose result was otherwise unused could be dead-code-eliminated together with its overflow check, and an int32 counter that wraps past 2^31 - 1 went unnoticed instead of deoptimizing to a double. The flag is now cleared only on the double-rep path. Test: JSTests/stress/inc-dec-int32-overflow-dce.js.

• 9f07374e9e (new) — [BEHAVIOR] (bug fix) Wasm OMG: a call patchpoint emitted inside a try block carries a catch-restoration stackmap keyed by its CallSiteIndex, so it is now created with cloningForbidden(Patchpoint) like the throw/rethrow patchpoints already were, and B3's ReduceStrength Select specialization now bails when any value it would clone is cloning-forbidden (it previously only refused the Check itself). Before, Select specialization or DuplicateTails could leave two call sites sharing one exception stackmap with different live-value layouts. Test: JSTests/wasm/stress/omg-reduce-strength-select-exception-stackmap.js.

• 3b9afb2b4f — [BEHAVIOR] Wasm correctness fix in BBQ and OMG (B3 lowering): ref.cast/ref.test on a nullable reference now only elides the explicit null check when Options::useWasmFaultSignalHandler() is on, so configurations running without the fault handler (e.g. Bun's Linux ASAN builds, where Options.cpp turns it off unless ASAN_OPTIONS contains allow_user_segv_handler=1) get a proper Wasm trap instead of dereferencing null. In signaling-memory mode, the decision to emit an explicit bounds check for large constant offsets now uses the last accessed byte (offset + size - 1) rather than the base offset; the old computation was slightly off but always still trapped via the PROT_NONE redzone.

• b74760b182 — [BEHAVIOR] The non-ARM64 WTF::roundeven/roundevenf polyfill returned +0.0 for the tie that rounds to zero (roundeven(-0.5) gave +0.0 instead of -0.0); the result is now wrapped in copysign. In JSC this feeds BBQ's constant folding of Wasm f32.nearest/f64.nearest, so on x86_64 a constant -0.5 operand folded to the wrong sign of zero; ARM64 uses __builtin_roundeven (frintn) and was already correct.

• 3c0f403d81 — [PERF] [BEHAVIOR] WasmGC array.fill / array.copy are reworked in BBQ and OMG: null and bounds checks are now emitted inline in JIT code, the runtime call is skipped entirely when size == 0 (observed to be very common), non-ref array.copy uses B3 MemoryCopy, and non-ref array.fill uses MemoryFill or new operationWasmArrayFill{2B,4B,8B,16B} (memset_pattern* on Darwin, std::ranges::fill elsewhere), while ref-typed arrays keep GC-safe loops (operationWasmArrayFillRefs / operationWasmArrayCopyRefs via gcSafeMemmove). Observable change: the trap message for a null array in these ops becomes the generic "access to a null reference" instead of "array.fill to a null reference" / "array.copy to a null reference" (the NullArrayFill / NullArrayCopy enumerators were removed from the internal Wasm::ExceptionType enum, which Bun does not reference). Old operationWasmArrayFill{,Vector} / operationWasmArrayCopy JIT operations are removed.

• 2165451fd3 — [BEHAVIOR] Correctness fix in the YARR interpreter's tryConsumeBackReference: in Forward direction it speculatively advanced the input by matchSize before comparing, and when the captured character was non-BMP and the input at that offset was not a valid surrogate pair, the early errorCodePoint return only restored the position for Backward, so a failed greedy iteration consumed input. Fixes wrong results like /(\u{1F601})\1*$/u.exec("\u{1F601}ab") matching instead of returning null, and /(\u{1F601})(\1*)?/u splitting a surrogate pair; the check now falls through to the common mismatch path which restores the position in both directions. Only affects patterns that run in the interpreter (authored by Sosuke Suzuki from Bun).

• e88b92e29f — [BEHAVIOR] (bug fix) Fixes a BBQ-tier miscompile of Wasm i64.mul_wide_s/i64.mul_wide_u on x86_64: the 128-bit product comes back in rdx:rax, and if the register allocator handed out rax/rdx as the result or scratch registers the halves were clobbered, producing wrong results. Now uses the same PREPARE_FOR_MOD_OR_DIV pattern as div/mod (clobber + lock rax/rdx). Only reachable when Options::useWasmWideArithmetic is on (default off, Bun does not enable it), so this matters only for users opting in via BUN_JSC_useWasmWideArithmetic=1.

• 5cfff9fe44 — [BEHAVIOR] In JSC's Wasm ESM integration (WebAssemblyModuleRecord), immutable exported globals are now exposed in the module namespace as plain JS values instead of WebAssembly.Global wrappers, per the esm-integration spec/WPT; v128 and exnref globals stay TDZ, Instance.exports is unchanged, and wasm-to-wasm ESM imports fall back to the Instance.exports wrapper when the namespace binding is empty. No Bun-visible change today because Bun's .wasm loader (src/runtime/jsc_hooks.rs, L::Wasm arm) returns a file path / wasi-runner instead of creating a JSC Wasm module record; it would matter if Bun ever adopts JSC's native Wasm ESM path.

• b7afce9416 — [BEHAVIOR] When several Wasm functions fail validation during concurrent compilation, the WebAssembly.CompileError message now deterministically reports the lowest-index failing function instead of whichever worker thread finished first; non-function failures (OOM/parse/cancel) still take precedence. Adds protected Plan::failAtFunction / EntryPlan::failFunctionCompilation and an m_errorFunctionIndex field; error messages become stable across runs (useful for snapshot tests).

• 010e57fb4b — [BEHAVIOR] WebAssembly.Module.imports() / WebAssembly.Module.exports() descriptors no longer include the non-standard js-types-proposal type field unless Options::useWasmJSTypes() is enabled (default false, and Bun does not set it). At the merge base this field was emitted unconditionally and could throw for unrepresentable ref types; descriptors now have the spec shape {module, name, kind} / {name, kind}, matching V8/Node. Also tweaks the WasmJSTypesEnabled description in UnifiedWebPreferences.yaml.

• 20c0bd7d62 — [BEHAVIOR] Wasm JS API spec fix: re-exporting an imported immutable WebAssembly.Global now yields the same JS object that was imported (instance.exports.g === importedGlobal), matching the WPT constructor-caching expectations; previously a fresh wrapper was created each time (mutable globals already preserved identity). JSWebAssemblyInstance gains an m_importedGlobalWrappers map (new setImportedGlobalWrapper/importedGlobalWrapper methods, visited by GC). Plain-number global imports still get a new wrapper.

• 39de2d4eea — [BEHAVIOR] Wasm: importing a WebAssembly.Tag and re-exporting it now yields the same JS object (previously a fresh JSWebAssemblyTag wrapper was created on every export, so === identity failed), and locally defined tags are cached on first export so two export names share one wrapper. Implemented via a new m_tagWrappers map on JSWebAssemblyInstance that is visited by GC; no embedder-facing API change.

• 7f38ebbabf — [BEHAVIOR] Promise.try follows the updated spec (Normative: make Promise.try use PromiseResolve in non-error case tc39/ecma262#3883): the result comes from PromiseResolve(C, value) / PromiseReject(C, error) instead of NewPromiseCapability(C), so Promise.try(() => p) now returns p itself when p is a native Promise, and a subclass constructor is invoked after the callback runs rather than before. builtins/PromiseOperations.js is deleted (@newPromiseCapabilitySlow gone) and @newPromiseCapability becomes a C++ link-time constant wrapping JSPromise::createNewPromiseCapability. Heads-up: follow-up upstream commit 38027ff0ec (also in this range) removes @newPromiseCapability entirely; see that entry under "API and ABI changes" for the Bun $newPromiseCapability(Promise) call sites that must be rewritten.

Performance

• 96ca975b2a (new) — [PERF] Object.assign(target, a, b) with 2 to 4 sources goes through the batching path in objectConstructorAssign, which replayed the first source's shape one property at a time. It now tries objectCloneFast for the first source (the same structure-copy fast path a single-source Object.assign already used) and starts the per-source loop at the second source when that succeeds: 1.4x to 1.5x on upstream's object-assign-multiple-sources microbenchmarks. Tests: JSTests/stress/object-assign-clone-multiple-sources.js. Authored by Bun's Sosuke Suzuki.

• 2cba652107 (new) — [PERF] Compile-time: Air::padInterference visited every instruction's arguments twice (needsPadding() then the early-def/late-use scan). Inst::paddingSummary() collects both answers in one forEachArg pass.

• 958a13ecad — [PERF] Wasm BBQ emitIndirectCall computed the CallProfile address with addPtr(TrustedImm32, ...), which on large offsets (functions with many call profiles) silently spills through scratchRegister, clobbering the profile value loaded just before; it now does move + register addPtr. No observable behavior change, but affected call_indirect sites were left permanently un-optimized (polymorphic-callee detection never kicked in), so this restores expected tiering for large wasm functions.

• 01f04c4fb4 — [PERF] YARR JIT now compiles backreferences inside lookbehinds (e.g. /(?<=(a)\1)b/); previously any such pattern forced the entire regex to the interpreter. The backward match compares the capture from its end down to its start, with checkNotEnoughInput becoming index >= length in Backward mode and case-insensitive, duplicate-named-group and surrogate-pair handling reused with the index direction flipped; forward codegen is unchanged. ~10.8x faster on the new regexp-lookbehind-backreference microbenchmark, no intended change in match results (authored by Sosuke Suzuki from Bun).

• 7ef4708559 — [PERF] Parser: when parseFunctionInfo has already computed a function's free-variable list for the SourceProviderCache entry, that span is now handed to popScope, so Scope::collectFreeVariablesFrom (renamed from collectFreeVariables, internal to parser/Parser.h) no longer re-derives it by re-walking used/declared/lexical sets. Pure parse-time speedup for cacheable (>=16/8 byte) function bodies; SourceProviderCacheItemCreationParameters gains a freeVariableCount field and freeVariables() accessor. No behavior change.

• 0ca8f08b89 — [PERF] Lexer::shift drops the 14-year-old "unconditionally zero m_current then overwrite" micro-optimization in favor of a plain if/else, which measures faster on current hardware. Semantics are identical; lexer hot-path only.

• 24a6944b57 — [PERF] In Parser::parseMemberExpression, when the TreeBuilder is SyntaxChecker (the pre-parse/syntax-only pass), the new token start positions are now tracked by a counting placeholder instead of a Vector<JSTextPosition, 4>, since SyntaxChecker::createNewExpr ignores them anyway. Saves allocation/copy work for nested new chains during syntax checking; no behavior change.

• a5fa580c84 — [PERF] B3 LICM (hoistLoopInvariantValues) can now hoist trapping loads (plain Load*, WasmStructGet, WasmArrayLength without fences) and control-dependent values out of loops that contain side exits, as long as no earlier "trap barrier" (write/fence/side-exit) precedes the value on the path from the loop header. Previously any side exit in the loop disabled hoisting of control-dependent values entirely; mainly benefits Wasm OMG and FTL code with bounds/null checks in loops. Adds Effects::isWrite()/isTrapBarrier().

• 6fbae40455 — [PERF] FTL switch on a string that is an unresolved concatenation rope now calls a new noexcept operation (operationSwitchStringResolveRopeAndGetCharacters8) to resolve the rope, and if the result is 8-bit uses the inline binary-search StringSwitch on the resolved characters instead of falling back to the generic slow path. Resolution uses tryGetValue() so an OOM falls through to the slow path rather than throwing from the JIT operation.

• de9231d86e — [PERF] RegExp::m_ovector and RegExp::RareData::m_captureGroupNames switch from Vector to FixedVector, shrinking the RegExp GC cell from 96 to 80 bytes and allocating exactly offsetVectorSize ints instead of Vector::resize's 16-element minimum capacity (64 bytes). Upstream measured per-RegExp cell+ovector going from 160 to 96 bytes and max RSS with 200k live RegExps dropping from 137.5 MB to 115.0 MB; estimatedSize now reports the exact ovector byteSize(). Authored by a Bun contributor.

• 1c2c282d06 — [PERF] Options::computeNumberOfWorkerThreads now caps its result at 32 on non-Darwin platforms; in practice this only affects the default numberOfWasmCompilerThreads (previously cores - 1 with no cap; other callers already pass caps of 3 or 8), limiting it to 31 on Linux/Windows machines with more than 32 cores. Motivated by Wasm compilation OOMs on high-core-count, low-memory hosts; Bun does not override this option (it only sets numberOfGCMarkers), so large Linux servers will see fewer Wasm compiler threads and lower peak memory.

• ce878e190f — [PERF] Map.prototype.forEach/Set.prototype.forEach get inline DFG and FTL lowering for MapIterationNext/MapIterationEntry/MapIterationEntryKey/MapIterationEntryValue, scanning the ordered hash table directly instead of making four C++ operation calls per element (the for-of MapIterator* nodes already did this and now share loadMapEntryData). Upstream microbenchmarks show 1.23x-1.65x speedups on forEach-heavy loops; the now-unreachable operationMap/SetIterationEntry* JIT operations are removed and the remaining operationMap/SetIterationNext become noexcept and only handle obsolete tables. Internal DFG operations only, no embedder-facing API or JS-visible behavior change (new stress tests cover mutation during iteration).

• c823243598 — [PERF] The bytecode cache (generateUnlinkedCodeBlockForFunctions in CodeCache.cpp) now emits CodeForConstruct instead of CodeForCall for class constructors, so cached programs no longer reparse every class constructor body (and its nested functions) on the first new C(); upstream measured 253 -> 4 parses constructing 182 three.js classes and 133 -> 9 parses for babylon.js startup. Cache output grows by the previously missing constructor bodies (three.js +10.8%, a 50 MB bundle +0.5%), which is relevant to Bun's --bytecode builds and node:vm cached-data paths that use generateProgramBytecode/generateModuleBytecode. No API or JS behavior change.

• 9516ed8a4f — [PERF] DFG/FTL switch on strings now handles 8-bit substring ropes inline by reading the base string's buffer at the substring offset, instead of bailing to the slow operationSwitchString call (which resolves the rope). Previously only flat 8-bit strings took the inline binary-switch path, so JIT'd code doing switch (s.slice(...)) / switch (s.substring(...)) gets faster. Internal-only signature rename in DFGSpeculativeJIT.h; no public API change.

• a7a9e233ce — [PERF] The JSON.parse lexer accumulates the int32 value while scanning the digit run instead of re-walking the digits a second time in lexNumber; micro-optimization for integer-heavy JSON. No API or behavior change.

• 6b13bfa7ba — [PERF] TypedArray.prototype.sort() without a comparator now uses an LSD radix sort (8-bit digits, stable passes, skipping digits with a single bucket) for 2/4/8-byte element types above measured thresholds (128 / 512 / 8192 elements), with a SIMD already-sorted pre-scan and a sampled few-distinct-values check that falls back to std::sort; upstream reports 2.3-4.6x on large Int16/Uint16/Int32/Uint32/Float32/Float64 arrays and 6.7x on presorted Int32 (geomean 1.5x). It temporarily allocates an O(n) scratch buffer (plus a snapshot copy for shared buffers) and falls back to std::sort on allocation failure; results are unchanged (NaN canonicalization matches the old sortFloat path). Also adds WTF::SIMD::bitXor/bitXor2 helpers to SIMDHelpers.h.

• db2d849cbe — [PERF] Replaces heap-registering MarkedArgumentBuffer with a stack std::array<EncodedJSValue, N> wrapped in ArgList at every call site where the argument count is statically known (37 files: Promise resolve/reject/then/finally and microtask jobs, VM::callPromiseRejectionCallback, Proxy traps, JSON toJSON/reviver, RegExp/String Symbol.* protocol, iterator protocol, typed-array callbacks, Map/Set/WeakMap constructors, DFG slow paths). This trims per-call overhead and removes the never-hit hasOverflowed()/OOM checks whenever the engine calls back into JS from C++. No public API or JS-visible behavior change; the only signature change (SyntheticModuleRecord::tryCreateWithExportNamesAndValues now takes ArgList) is a private method Bun does not call.

• eb44b6cfaa — [PERF] WTF::URLParser now SIMD-scans the path, opaque-path, query, and fragment states (via SIMD::find from wtf/SIMDHelpers.h) for the first delimiter, encode-set member, control, or non-ASCII code point and consumes the whole preceding run at once (skipped for canonical input, bulk-appended when building the output buffer) instead of looping per code point; upstream measures ~1.33x on 82k real-world URLs and 3-4x on ~100-char components. This directly speeds up every WTF::URL parse in Bun (new URL(), URLPattern, Request/fetch URL handling, module URL resolution). Additive-only header changes: CodePointIterator::span()/advanceBy() and a private URLParser::appendToASCIIBuffer(std::span<const char16_t>) overload; a consteval static_assert verifies each stop-character set covers its percent-encode set, so no parsing behavior changes.

• 70eb5015ae — [PERF] Memory: the buffered-structures set, its lock and bufferingCountdown move from the PropertyInlineCache base class into RepatchingPropertyInlineCache, since handler ICs never buffer; sizeof(HandlerPropertyInlineCache) drops 112 -> 88 bytes per IC site in Baseline/DFG JITData (about -1.27 MB on Octane typescript). Side effect: handler ICs that fail to cache a structure now retry tryCache on the next few visits instead of skipping them; repatching ICs are unchanged. Internal JIT data structure only, not referenced by Bun.

• 1969cf2d9e — [PERF] StringImpl::replace(char16_t, char16_t) (behind String::replace(char, char)) now finds the first occurrence with SIMD WTF::find() instead of a scalar byte-at-a-time loop, for both 8-bit and 16-bit strings; same fix already applied to makeStringByReplacingAll. No behavior change.

• 2d0855229c — [PERF] WTF::copyElements (used throughout string building/concatenation) now handles 2..32-byte copies with inlined overlapping unaligned loads/stores instead of calling libc memcpy, whose size dispatch costs more than the copy itself for short runs. The B3 operationMemoryCopy fast path is hoisted into new WTF helpers copySmallMemory<min,max>(), copyOverlappingEnds, copyOverlappingEndPairs, WidestUnalignedUnit and maxSmallCopySize in wtf/UnalignedAccess.h, available for Bun's own C++ to use; no behavior change.

• 7375405d8e — [PERF] base64EncodeInternal()/base64DecodeInternal() in WTF bound the chosen lookup table with auto, copying the whole 64-byte encode map or 128-byte decode map onto the stack on every call; now auto& references the constexpr table directly. Affects Bun's uses of WTF::base64Decode/base64URLDecode/base64URLEncode (WebCrypto JWK import/export in src/jsc/bindings/webcrypto/CryptoKey*.cpp); no behavior change.

Wasm

• ce60d5d618 — WasmGC concurrent-GC correctness fix in the BBQ tier: struct.new/struct.new_default skipped the mutator fence when every stored field was a constant, but a struct with reference fields still needs the store-store fence before the new object is published to the concurrent marker. BBQ now emits emitMutatorFence() whenever the struct type has ref fields, matching IPInt/OMG; the fence is a no-op on x86_64, so this matters on ARM64.

• c25fbbd346 — Debug-only: fixes a copy-paste typo in an ASSERT in Wasm BBQ emitModOrDiv (x64) that tested lhsLocation twice instead of rhsLocation != edx. No release-build or behavior impact.

• 4cc12fa76b — Debug-build-only fix: assertCalleeIsReferenced in WasmOperations.cpp now returns early when the frame's callee is not a NativeCallee, which happens when a stack overflow during a JS↔Wasm transition reaches operationWasmToJSException with a JS callee still in the frame. Fixes a spurious asNativeCallee() crash under ASSERT_ENABLED; no release behavior change.

• 3400ff6aa7 — Wasm: ModuleInformation now stores the importedStringConstants / qualifiedBuiltinSetNames compile options as UTF-8 byte vectors (Wasm::Name) instead of isolatedCopy()'d WTF::Strings, so no StringImpl is ever shared between the main thread and Wasm compiler threads (not all StringImpl fields are atomic). Import-name matching now compares raw bytes directly, dropping a makeString per import. Internal importedStringConstantsEquals()/builtinSetsInclude() signatures change to const Name& (Bun does not call them); only affects modules compiled with JS string builtins / importedStringConstants options.

• 20d622b6d6 — Build fix: Wasm::CalleeGroup::BBQCalleeReference::operator= is replaced with a named set() method so clang 18's -Wthread-safety-precise analyzer can see the WTF_REQUIRES_LOCK requirement. No runtime behavior change; internal type only.

Other JSC

• 9d03f48340 — Removes the dead CallLinkInfo::m_slowPathCount field (plus offsetOfSlowPathCount()/slowPathCount()) and its increments in the LLInt and JIT virtual-call thunks; CallLinkStatus::computeFromCallLinkInfo already bailed via takesSlowPath() for any m_clearedByVirtual site, so the reads always saw zero. Minor: one fewer memory increment per virtual call and 4 bytes less in CallLinkInfo. Internal-only, not used by Bun.

• 3ddc7045b7 — DFG OSR-exit correctness fix: SpeculativeJIT::emitSwitchChar's StringUse path called op1.use() before speculateString(), so the operand's death preceded the BadType exit and baseline re-executed op_switch_char on a dead/poisoned scrutinee value when the speculation failed (e.g. a switch with single-character string cases later fed a non-string). Now speculates before releasing the operand, matching emitSwitchString; fixes a potential crash/miscompile in optimized code, no API change.

• bdb7246737 — Adds an opt-in DFG/FTL "global inlining planner" (Options::useGlobalInliningPlanner, default false) that surveys and ranks all inlining candidates of a compilation up front (weighted by callee tier and inline depth) and spends a single compilation-wide budget, instead of deciding per call site in bytecode order. Adds nine new Options knobs (globalInliningPlanBudgetForDFG/FTL, maximumGlobalInliningPlanSites, inliningPlanTierBonus*, inliningPlanDepthPenalty). No effect unless enabled; upstream notes the current budget is high enough that it barely changes inlining decisions yet.

WTF and bmalloc

• 386c27f080 — Build-only tweak: the ALWAYS_INLINE fast path of WTFCrashWithInfo (Darwin/PlayStation on x86_64/ARM64) is additionally disabled when compiling under the clang static analyzer (__clang_analyzer__) so the analyzer sees the out-of-line no-return version. No effect on normal Bun builds.

• 390e2c91dc — Only engine-side change is a one-line #import → #include of <wtf/Platform.h> in wtf/MachSendRightAnnotated.h (a Cocoa-only header); the rest is WebKit modulemap hygiene for Swift/Windows. No effect on Bun's JSCOnly build.

• 1f7ab2fec8 — Fixes WTF::symbolize() in wtf/StackTrace.cpp under USE(LIBBACKTRACE): consults the symbol table (mangled names) before DWARF so clang debug builds get fully-qualified frame names, initializes the symbol pointer (previously read uninitialized on lookup miss), and passes a non-null error callback (libbacktrace always invokes it, so null crashed on the first failed lookup). No effect on Bun: USE_LIBBACKTRACE defaults to OFF for the JSCOnly port and Bun's build does not enable it.

• f0148cf5ab — Changes Source/WTF/wtf/module.modulemap so the WTF Core clang module declares requires cplusplus23 instead of cplusplus, and bumps the module-cache touch count to force a rebuild. Only affects builds that consume WTF as a clang module (-fmodules, Apple/Swift-interop builds); Bun's build already uses -std=c++23 and does not enable clang modules, so no effect on Bun.

[robobun]

The Bun side of this upgrade is oven-sh/bun#40276. #501 (upstream 55d9d9007f, one WebCore-only commit ahead of 8c4fd56347) was a parallel attempt with the same structure and the same CachedTypes.cpp resolution. It is closed in favor of this PR, together with oven-sh/bun#40263.

Main has moved since this branch was cut (#499, #504, #502, #506), so this PR needs a re-merge with main before it can land. The Bun PR's WEBKIT_VERSION moves to the autobuild-<sha> release of the merged commit afterwards.

[claude]

I reviewed this PR and the automated bug hunting system found no issues. Given the scale (412 upstream commits, 300+ files) and the hand-authored conflict resolutions in CachedTypes.cpp, CodeCache.cpp, the module map, and the Linux thread-scheduling opt-out, a human look is still warranted before this lands.

What was reviewed:

• The CachedGlobalCodeBlock<T> split and the varint-tail/extras renumbering in CachedTypes.cpp against upstream 3d0e6c14b1/0b92c2bcd0.
• The generateUnlinkedCodeBlockForFunctions merge in CodeCache.cpp (fork's depth bound applied to upstream's isClassConstructorFunction() shape).
• The USE(BUN_JSC_ADDITIONS) no-op for Thread::updateSchedulingAttributes and the dropped #262 setFetchError path — both look intentional per the description.

Extended reasoning...

Overview

This PR merges upstream WebKit 8c4fd56347 into the Bun fork: 412 commits since the previous merge base, 90 of them touching JavaScriptCore/WTF/bmalloc, across 300+ files. The bulk is upstream code taken verbatim (tests, LayoutTests, WebCore/WebKit changes the JSCOnly port doesn't compile), but there are substantial hand-authored conflict resolutions where the fork's bytecode-cache rework (#490–#497, #502, #506) collided with upstream's UnlinkedCodeBlock/UnlinkedGlobalCodeBlock split (3d0e6c14b1) and m_jumpTargets deletion (0b92c2bcd0), plus fork-policy "keep ours" decisions in YarrJIT.cpp, URLParser.cpp, WaiterListManager::waitSyncImpl, and Linux thread scheduling.

Security risks

The merge touches JIT codegen (DFG/FTL/BBQ/OMG), the Yarr regexp JIT, Wasm bounds checking and fault-signal handling, the bytecode disk cache (untrusted-input decode), and thread scheduling. None of these are new attack surface introduced by the conflict resolutions themselves — they're upstream changes plus fork-side re-plumbing — but a mistake in the CachedTypes.cpp layout renumbering or the regionIsIntact array-count change would be a memory-safety issue in the disk-cache decode path. The description reports the disk-cache round-trip passes on 400+ JSTests with no decode failure or checksum mismatch, and computeJSCBytecodeCacheVersion() invalidates old payloads.

Level of scrutiny

High. This is a production-critical engine upgrade with non-mechanical merge work: a new intermediate CachedGlobalCodeBlock<T> record was authored to reconcile the fork's checksummed-region encoder with upstream's field relocation; the fork deliberately diverges from upstream on Linux sched_setattr behaviour under USE(BUN_JSC_ADDITIONS); and #262's setFetchError was dropped on the reasoning that upstream's module-map change makes it dead. Each of these is a design decision a maintainer should sign off on, not something an automated review can bless.

Other factors

The PR description is unusually thorough — per-commit review, explicit conflict-resolution notes, and verification runs (jsc build, disk-cache round-trip, Bun test suites) — which raises confidence. The re-merge with main (d2654c3b39) that robobun flagged has been done. Still, the combination of scale, hand-authored cache-layout code, and intentional fork-policy divergences puts this well outside what should land without human review.