From e537f3e48f8e8e6072d004da91c6e745a8786769 Mon Sep 17 00:00:00 2001
From: Dylan Conway <dylan.conway567@gmail.com>
Date: Thu, 27 Aug 2026 05:34:27 +0000
Subject: [PATCH 1/8] CI: compare bytecode cache record layouts in their own
 job, from per-build layout artifacts

Each Docker-built job uploads its bytecode-cache-layout.txt as a small layout-<label>
artifact next to its tarball. A new bytecode-cache-layout job downloads only those,
diffs every build against linux-amd64, writes a per-build table (and the diffs) to the
job summary, uploads the diffs on failure, and fails on any difference or missing dump.
The release job depends on it, so a layout mismatch blocks the release; it no longer
re-reads every tarball to get at the dumps. The artifact list moves to workflow-level
env so both jobs share it.
---
 .github/workflows/build-reusable.yml | 247 ++++++++++++++++++---------
 1 file changed, 164 insertions(+), 83 deletions(-)

diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml
index cceabc11ff5c..9b5608d4e6db 100644
--- a/.github/workflows/build-reusable.yml
+++ b/.github/workflows/build-reusable.yml
@@ -2,6 +2,56 @@ name: Build WebKit (Reusable)
 
 env:
   LLVM_VERSION: 21
+  # Every build job uploads <label>/bun-webkit.tar.gz. This list is the release: a label missing from the run fails it.
+  ARTIFACTS: |
+    # linux
+    bun-webkit-linux-amd64
+    bun-webkit-linux-amd64-lto
+    bun-webkit-linux-amd64-debug
+    bun-webkit-linux-amd64-asan
+    bun-webkit-linux-amd64-debug-asan
+    bun-webkit-linux-arm64
+    bun-webkit-linux-arm64-lto
+    bun-webkit-linux-arm64-debug
+    bun-webkit-linux-arm64-asan
+    bun-webkit-linux-arm64-debug-asan
+    # linux-musl
+    bun-webkit-linux-amd64-musl
+    bun-webkit-linux-amd64-musl-lto
+    bun-webkit-linux-amd64-musl-debug
+    bun-webkit-linux-arm64-musl
+    bun-webkit-linux-arm64-musl-lto
+    bun-webkit-linux-arm64-musl-debug
+    # macos-cross
+    bun-webkit-macos-arm64
+    bun-webkit-macos-arm64-lto
+    bun-webkit-macos-arm64-debug
+    bun-webkit-macos-arm64-asan
+    bun-webkit-macos-arm64-debug-asan
+    bun-webkit-macos-amd64
+    bun-webkit-macos-amd64-lto
+    bun-webkit-macos-amd64-debug
+    # windows / windows-cross
+    bun-webkit-windows-amd64
+    bun-webkit-windows-amd64-lto
+    bun-webkit-windows-amd64-debug
+    bun-webkit-windows-amd64-asan
+    bun-webkit-windows-arm64
+    bun-webkit-windows-arm64-debug
+    # freebsd
+    bun-webkit-freebsd-amd64
+    bun-webkit-freebsd-amd64-lto
+    bun-webkit-freebsd-amd64-debug
+    bun-webkit-freebsd-arm64
+    bun-webkit-freebsd-arm64-lto
+    bun-webkit-freebsd-arm64-debug
+    # linux-android
+    bun-webkit-linux-arm64-android
+    bun-webkit-linux-arm64-android-lto
+    bun-webkit-linux-arm64-android-debug
+    bun-webkit-linux-amd64-android
+    bun-webkit-linux-amd64-android-lto
+    bun-webkit-linux-amd64-android-debug
 
 on:
   workflow_call:
@@ -125,7 +175,7 @@ jobs:
           RELEASE_FLAGS: ${{matrix.RELEASE_FLAGS}}
           ENABLE_SANITIZERS: ${{matrix.ENABLE_SANITIZERS}}
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
           if [ "${{matrix.package_json_arch}}" = "arm64" ]; then
             export MARCH_FLAG="-march=armv8-a+crc -mtune=ampere1"
           else
@@ -137,12 +187,18 @@ jobs:
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["linux"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
           rm -rf bun-webkit/lib/*.so
           rm -rf bun-webkit/lib/*.so.*
+          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: layout-${{matrix.label}}
+          path: ${{runner.temp}}/bytecode-cache-layout.txt
+          if-no-files-found: error
 
   windows-cross:
     name: Windows (cross-compiled from Linux)
@@ -225,17 +281,23 @@ jobs:
           install: true
       - name: Run
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
           WIN_ARCH="${{matrix.win_arch}}" WEBKIT_RELEASE_TYPE="${{matrix.CMAKE_BUILD_TYPE}}" LTO_FLAG="${{matrix.lto_flag}}" ENABLE_SANITIZERS="${{matrix.ENABLE_SANITIZERS}}" USE_MIMALLOC="${{matrix.USE_MIMALLOC || 'OFF'}}" USE_EXTERNAL_MIMALLOC="${{matrix.USE_EXTERNAL_MIMALLOC || 'OFF'}}" temp=${{runner.temp}} bash windows-cross-release.sh
           cd ${{runner.temp}}
           echo "#define BUN_WEBKIT_VERSION \"${{ inputs.build_ref }}\"" >> bun-webkit/include/cmakeconfig.h
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["windows"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
+          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: layout-${{matrix.label}}
+          path: ${{runner.temp}}/bytecode-cache-layout.txt
+          if-no-files-found: error
 
   windows:
     name: Windows
@@ -361,7 +423,7 @@ jobs:
           install: true
       - name: Run
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
           if [ "${{matrix.package_json_arch}}" = "arm64" ]; then
             export MARCH_FLAG="-march=armv8-a+crc -mtune=ampere1"
           else
@@ -373,12 +435,18 @@ jobs:
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["linux"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
           rm -rf bun-webkit/lib/*.so
           rm -rf bun-webkit/lib/*.so.*
+          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: layout-${{matrix.label}}
+          path: ${{runner.temp}}/bytecode-cache-layout.txt
+          if-no-files-found: error
 
   macos-cross:
     name: macOS (cross-compiled from Linux)
@@ -466,17 +534,23 @@ jobs:
           install: true
       - name: Run
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
           MACOS_ARCH="${{matrix.macos_arch}}" WEBKIT_RELEASE_TYPE="${{matrix.CMAKE_BUILD_TYPE}}" LTO_FLAG="${{matrix.lto_flag}}" CPP_FLAGS="${{matrix.cpp_flags}}" ENABLE_SANITIZERS="${{matrix.ENABLE_SANITIZERS}}" ENABLE_MALLOC_HEAP_BREAKDOWN="${{matrix.ENABLE_MALLOC_HEAP_BREAKDOWN}}" USE_MIMALLOC="${{matrix.USE_MIMALLOC || 'OFF'}}" USE_EXTERNAL_MIMALLOC="${{matrix.USE_EXTERNAL_MIMALLOC || 'OFF'}}" temp=${{runner.temp}} bash macos-cross-release.sh
           cd ${{runner.temp}}
           echo "#define BUN_WEBKIT_VERSION \"${{ inputs.build_ref }}\"" >> bun-webkit/include/cmakeconfig.h
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["darwin"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
+          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: layout-${{matrix.label}}
+          path: ${{runner.temp}}/bytecode-cache-layout.txt
+          if-no-files-found: error
 
   freebsd:
     name: FreeBSD
@@ -536,18 +610,24 @@ jobs:
           install: true
       - name: Run
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
           FREEBSD_ARCH="${{matrix.freebsd_arch}}" WEBKIT_RELEASE_TYPE="${{matrix.CMAKE_BUILD_TYPE}}" LTO_FLAG="${{matrix.lto_flag}}" USE_MIMALLOC="${{matrix.USE_MIMALLOC || 'OFF'}}" USE_EXTERNAL_MIMALLOC="${{matrix.USE_EXTERNAL_MIMALLOC || 'OFF'}}" temp=${{runner.temp}} bash freebsd-release.sh
           cd ${{runner.temp}}
           echo "#define BUN_WEBKIT_VERSION \"${{ inputs.build_ref }}\"" >> bun-webkit/include/cmakeconfig.h
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["freebsd"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
           rm -rf bun-webkit/lib/*.so bun-webkit/lib/*.so.*
+          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: layout-${{matrix.label}}
+          path: ${{runner.temp}}/bytecode-cache-layout.txt
+          if-no-files-found: error
 
   linux-android:
     name: Linux Android
@@ -607,18 +687,95 @@ jobs:
           install: true
       - name: Run
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
           ANDROID_ARCH="${{matrix.android_arch}}" WEBKIT_RELEASE_TYPE="${{matrix.CMAKE_BUILD_TYPE}}" LTO_FLAG="${{matrix.lto_flag}}" USE_MIMALLOC="${{matrix.USE_MIMALLOC || 'OFF'}}" USE_EXTERNAL_MIMALLOC="${{matrix.USE_EXTERNAL_MIMALLOC || 'OFF'}}" temp=${{runner.temp}} bash android-release.sh
           cd ${{runner.temp}}
           echo "#define BUN_WEBKIT_VERSION \"${{ inputs.build_ref }}\"" >> bun-webkit/include/cmakeconfig.h
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["android"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
           rm -rf bun-webkit/lib/*.so bun-webkit/lib/*.so.*
+          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: layout-${{matrix.label}}
+          path: ${{runner.temp}}/bytecode-cache-layout.txt
+          if-no-files-found: error
+
+  # A bytecode cache payload written on one platform is read in place on the others (bun build --compile
+  # cross-compiles), so the records it is made of must be laid out identically everywhere. Every Docker-built job
+  # uploads the layouts of its build (Tools/Scripts/dump-bytecode-cache-layout.ts) as layout-<label>; this job fails,
+  # and blocks the release, if any of them differs from linux-amd64 or is missing. The one native build
+  # (windows-arm64-debug) has no dump and is not compared.
+  bytecode-cache-layout:
+    name: Bytecode cache layouts agree across platforms
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      actions: read
+    needs:
+      - linux
+      - macos-cross
+      - windows-cross
+      - linux-musl
+      - linux-android
+      - freebsd
+    steps:
+      - name: Download layouts
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          for attempt in 1 2 3; do
+            rm -rf layouts
+            gh run download "$GITHUB_RUN_ID" --pattern 'layout-*' -D layouts && break
+            echo "download failed (attempt $attempt)"; sleep $((attempt * 5))
+          done
+          ls layouts
+      - name: Compare
+        run: |
+          set -uo pipefail
+          reference=layouts/layout-bun-webkit-linux-amd64/bytecode-cache-layout.txt
+          if [ ! -s "$reference" ]; then echo "::error::no layout dump for linux-amd64"; exit 1; fi
+          status=0
+          mkdir -p diffs
+          {
+            echo "Reference: linux-amd64 — $(grep -vc '^ ' "$reference") records"
+            echo
+            echo "| build | result |"
+            echo "| --- | --- |"
+          } >> "$GITHUB_STEP_SUMMARY"
+          while read -r name; do
+            [ "$name" = bun-webkit-windows-arm64-debug ] && continue
+            f="layouts/layout-$name/bytecode-cache-layout.txt"
+            if [ ! -s "$f" ]; then
+              echo "::error::$name uploaded no bytecode cache layout dump"
+              echo "| ${name#bun-webkit-} | missing |" >> "$GITHUB_STEP_SUMMARY"
+              status=1
+            elif ! diff -u --label linux-amd64 --label "${name#bun-webkit-}" "$reference" "$f" > "diffs/$name.diff"; then
+              echo "::error::bytecode cache record layouts of $name differ from linux-amd64"
+              echo "| ${name#bun-webkit-} | **differs**: $(grep -c '^[-+][^-+]' "diffs/$name.diff") lines |" >> "$GITHUB_STEP_SUMMARY"
+              status=1
+            else
+              rm "diffs/$name.diff"
+              echo "| ${name#bun-webkit-} | same |" >> "$GITHUB_STEP_SUMMARY"
+            fi
+          done < <(grep -v '^ *#' <<< "$ARTIFACTS" | grep .)
+          for d in diffs/*.diff; do
+            [ -e "$d" ] || continue
+            { echo; echo "<details><summary>$(basename "$d" .diff)</summary>"; echo; echo '```diff'; head -200 "$d"; echo '```'; echo "</details>"; } >> "$GITHUB_STEP_SUMMARY"
+          done
+          exit $status
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: failure()
+        with:
+          name: bytecode-cache-layout-diffs
+          path: diffs/
 
   release:
     name: release
@@ -635,6 +792,7 @@ jobs:
       - linux-musl
       - linux-android
       - freebsd
+      - bytecode-cache-layout
     outputs:
       tag: ${{ steps.release_info.outputs.tag }}
     steps:
@@ -649,60 +807,10 @@ jobs:
       - run: lsipc
       - run: whoami
 
-      # Every build job uploads <label>/bun-webkit.tar.gz. This list is the release: a label missing from the run fails the job.
       - name: Download artifacts
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
-          ARTIFACTS: |
-            # linux
-            bun-webkit-linux-amd64
-            bun-webkit-linux-amd64-lto
-            bun-webkit-linux-amd64-debug
-            bun-webkit-linux-amd64-asan
-            bun-webkit-linux-amd64-debug-asan
-            bun-webkit-linux-arm64
-            bun-webkit-linux-arm64-lto
-            bun-webkit-linux-arm64-debug
-            bun-webkit-linux-arm64-asan
-            bun-webkit-linux-arm64-debug-asan
-            # linux-musl
-            bun-webkit-linux-amd64-musl
-            bun-webkit-linux-amd64-musl-lto
-            bun-webkit-linux-amd64-musl-debug
-            bun-webkit-linux-arm64-musl
-            bun-webkit-linux-arm64-musl-lto
-            bun-webkit-linux-arm64-musl-debug
-            # macos-cross
-            bun-webkit-macos-arm64
-            bun-webkit-macos-arm64-lto
-            bun-webkit-macos-arm64-debug
-            bun-webkit-macos-arm64-asan
-            bun-webkit-macos-arm64-debug-asan
-            bun-webkit-macos-amd64
-            bun-webkit-macos-amd64-lto
-            bun-webkit-macos-amd64-debug
-            # windows / windows-cross
-            bun-webkit-windows-amd64
-            bun-webkit-windows-amd64-lto
-            bun-webkit-windows-amd64-debug
-            bun-webkit-windows-amd64-asan
-            bun-webkit-windows-arm64
-            bun-webkit-windows-arm64-debug
-            # freebsd
-            bun-webkit-freebsd-amd64
-            bun-webkit-freebsd-amd64-lto
-            bun-webkit-freebsd-amd64-debug
-            bun-webkit-freebsd-arm64
-            bun-webkit-freebsd-arm64-lto
-            bun-webkit-freebsd-arm64-debug
-            # linux-android
-            bun-webkit-linux-arm64-android
-            bun-webkit-linux-arm64-android-lto
-            bun-webkit-linux-arm64-android-debug
-            bun-webkit-linux-amd64-android
-            bun-webkit-linux-amd64-android-lto
-            bun-webkit-linux-amd64-android-debug
         run: |
           set -euo pipefail
           grep -v '^ *#' <<< "$ARTIFACTS" | grep . > artifacts.txt
@@ -718,33 +826,6 @@ jobs:
           while read -r name; do mv "dl/$name/bun-webkit.tar.gz" "out/$name.tar.gz"; done < artifacts.txt
           ls -la out
 
-      # A bytecode cache payload written on one platform is read in place on the others (bun build --compile
-      # cross-compiles), so the records it is made of must be laid out identically everywhere. Every Docker-built
-      # archive carries its layouts (Tools/Scripts/dump-bytecode-cache-layout.ts); any difference from linux-amd64, or a
-      # missing dump, fails the release. The one native build (windows-arm64-debug) has no dump and is not compared.
-      - name: Bytecode cache layouts agree across platforms
-        if: false # each image still writes bytecode-cache-layout.txt; the cross-platform comparison moves to its own fast job in a follow-up
-        run: |
-          set -euo pipefail
-          mkdir -p layouts
-          status=0
-          while read -r name; do
-            [ "$name" = bun-webkit-windows-arm64-debug ] && continue
-            if ! tar -xzf "out/$name.tar.gz" -O bun-webkit/bytecode-cache-layout.txt > "layouts/$name.txt"; then
-              echo "::error::$name has no bytecode-cache-layout.txt"
-              status=1
-            fi
-          done < artifacts.txt
-          for f in layouts/*.txt; do
-            if ! diff -u layouts/bun-webkit-linux-amd64.txt "$f" > "$f.diff"; then
-              echo "::error::bytecode cache record layouts in $(basename "$f" .txt) differ from linux-amd64"
-              head -50 "$f.diff"
-              status=1
-            fi
-          done
-          echo "$(ls layouts/*.txt | wc -l) platforms compared"
-          exit $status
-
       - name: Set release info
         id: release_info
         run: |

From 65cac8e3fae251592c171b40e967375649e08b0b Mon Sep 17 00:00:00 2001
From: Dylan Conway <dylan.conway567@gmail.com>
Date: Thu, 27 Aug 2026 05:53:24 +0000
Subject: [PATCH 2/8] CachedTypes.cpp: -Wms-bitfield-padding as an error, so a
 bit-field MSVC would pack differently fails the Itanium build

---
 Source/JavaScriptCore/runtime/CachedTypes.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/CachedTypes.cpp b/Source/JavaScriptCore/runtime/CachedTypes.cpp
index 085688f8ba32..25382151d465 100644
--- a/Source/JavaScriptCore/runtime/CachedTypes.cpp
+++ b/Source/JavaScriptCore/runtime/CachedTypes.cpp
@@ -60,6 +60,13 @@
 
 WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
 
+// A payload written on one platform is read in place on another, so the records below must be laid out identically under
+// the Itanium and MSVC C++ ABIs. Their bit-fields are the likeliest thing to break that: make the compiler refuse any
+// bit-field in this file that MSVC would pack differently.
+#if COMPILER(CLANG) && __has_warning("-Wms-bitfield-padding")
+#pragma clang diagnostic error "-Wms-bitfield-padding"
+#endif
+
 namespace JSC {
 
 bool Decoder::canBorrowPayload() const

From 32d83b5da03255adc99abc35956d41d7ba6d79cb Mon Sep 17 00:00:00 2001
From: Dylan Conway <dylan.conway567@gmail.com>
Date: Thu, 27 Aug 2026 06:16:32 +0000
Subject: [PATCH 3/8] dump-bytecode-cache-layout: entry headers are what
 derives from GenericCacheEntry (a \w*CacheEntry pattern also matched
 JSC::SpecialPropertyCacheEntry, which clang-cl lays out in this TU)

---
 Tools/Scripts/dump-bytecode-cache-layout.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Tools/Scripts/dump-bytecode-cache-layout.ts b/Tools/Scripts/dump-bytecode-cache-layout.ts
index f366b190964d..f28bad66efec 100644
--- a/Tools/Scripts/dump-bytecode-cache-layout.ts
+++ b/Tools/Scripts/dump-bytecode-cache-layout.ts
@@ -101,9 +101,10 @@ function templateArguments(name: string): string[] {
 }
 
 function cacheRecords(records: Map<string, Record>): Record[] {
-  // Roots: everything laid out in a payload derives from CachedObject<> / VariableLengthObjectBase, plus the entry headers.
+  // Roots: everything laid out in a payload derives from CachedObject<> / VariableLengthObjectBase, or (the entry headers)
+  // from GenericCacheEntry.
   const isRoot = (record: Record, seen: string[] = []): boolean =>
-    /^JSC::(\w*CacheEntry\b|CachedObject<|VariableLengthObjectBase$)/.test(record.name) ||
+    /^JSC::(GenericCacheEntry$|CachedObject<|VariableLengthObjectBase$)/.test(record.name) ||
     record.bases.some(base => records.has(base) && !seen.includes(base) && isRoot(records.get(base)!, [...seen, record.name]));
   // T of every CachedObject<T> / VariableLengthObject<T>: the in-memory types the cache converts from, never laid out in a payload.
   const sourceTypes = new Set([...records.values()].filter(r => /^JSC::(CachedObject|VariableLengthObject)</.test(r.name)).map(r => templateArguments(r.name)[0]));

From 2a1467f0daca0e7103a5259e9dc7038cd8e3b0b3 Mon Sep 17 00:00:00 2001
From: Dylan Conway <dylan.conway567@gmail.com>
Date: Thu, 27 Aug 2026 06:25:19 +0000
Subject: [PATCH 4/8] CachedTypes: every record placed in a payload is
 padding-free (has_unique_object_representations) and has an asserted size

A payload written under one C++ ABI is read in place under another. Those ABIs place bases and
fields in declaration order and differ only in where they pad, so a record with no padding under
each of them has the same layout under all of them; a per-record sizeof literal closes the remaining
case (a leaf type whose size differs). Both are now static_asserts: PayloadType<T> at every typed
allocation into the encoder, and one sizeof per record. The dozen records that had padding spell it
out as m_unused (or, for the two 16-bit map entry types, are held in 32 bits via CachedEntryBits), so
their bytes were already zero and now are fields.
---
 Source/JavaScriptCore/runtime/CachedTypes.cpp | 103 +++++++++++++++++-
 1 file changed, 98 insertions(+), 5 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/CachedTypes.cpp b/Source/JavaScriptCore/runtime/CachedTypes.cpp
index 25382151d465..805f37a8efc7 100644
--- a/Source/JavaScriptCore/runtime/CachedTypes.cpp
+++ b/Source/JavaScriptCore/runtime/CachedTypes.cpp
@@ -67,6 +67,13 @@ WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
 #pragma clang diagnostic error "-Wms-bitfield-padding"
 #endif
 
+// Everything placed in a payload must have no padding bytes and no unused bit-field bits on the ABI compiling this. The
+// C++ ABIs a payload moves between all place bases and fields in declaration order and differ only in where they pad, so a
+// type that is padding-free under each of them has the same field offsets under all of them.
+// (Hence the m_unused members below: padding, spelled out.) double only fails the trait because +0/-0 and NaNs have
+// several representations; its layout is IEEE-754 binary64 everywhere.
+template<typename T> concept PayloadType = std::has_unique_object_representations_v<T> || std::is_same_v<T, double>;
+
 namespace JSC {
 
 bool Decoder::canBorrowPayload() const
@@ -552,7 +559,7 @@ class Encoder {
         return malloc(size, alignment);
     }
 
-    template<typename T, typename... Args>
+    template<PayloadType T, typename... Args>
     T* malloc(Args&&... args)
     {
         return new (malloc(sizeof(T), alignof(T)).buffer()) T(std::forward<Args>(args)...);
@@ -566,6 +573,7 @@ class Encoder {
             tail = T::tailSize(*this, source);
         else if constexpr (requires { T::tailSize(source); })
             tail = T::tailSize(source);
+        static_assert(PayloadType<T>);
         return new (malloc(sizeof(T) + tail, alignof(T)).buffer()) T();
     }
 
@@ -1122,6 +1130,7 @@ class VariableLengthObject : public CachedObject<Source>, VariableLengthObjectBa
 #endif
     T* allocate(Encoder& encoder, unsigned size = 1)
     {
+        static_assert(PayloadType<T>);
         uint8_t* result = allocate(encoder, sizeof(T) * size, alignof(T));
         ASSERT(!(std::bit_cast<uintptr_t>(result) % alignof(T)));
         return new (result) T[size];
@@ -1154,6 +1163,7 @@ class VariableLengthObject : public CachedObject<Source>, VariableLengthObjectBa
             tail = T::tailSize(encoder, source);
         else if constexpr (requires { T::tailSize(source); })
             tail = T::tailSize(source);
+        static_assert(PayloadType<T>);
         uint8_t* result = allocate(encoder, sizeof(T) + tail, alignof(T));
         return new (result) T();
     }
@@ -1954,7 +1964,7 @@ class CachedBitVector : public VariableLengthObject<BitVector> {
 public:
     void encode(Encoder& encoder, const BitVector& bitVector)
     {
-        m_numBits = bitVector.size();
+        m_numBits = safeCast<uint32_t>(bitVector.size());
         if (!m_numBits)
             return;
         size_t sizeInBytes = BitVector::byteCount(m_numBits);
@@ -1972,7 +1982,7 @@ class CachedBitVector : public VariableLengthObject<BitVector> {
     }
 
 private:
-    size_t m_numBits;
+    uint32_t m_numBits;
 };
 
 template<typename T, typename HashArg = DefaultHash<T>>
@@ -2067,6 +2077,7 @@ class CachedCodeBlockRareData : public CachedObject<UnlinkedCodeBlock::RareData>
     CachedVector<CachedHashSet<CachedRefPtr<CachedUniquedStringImpl>, IdentifierRepHash>> m_constantIdentifierSets;
     unsigned m_needsClassFieldInitializer : 1;
     unsigned m_privateBrandRequirement : 1;
+    unsigned m_unused : 30 { 0 };
 };
 
 // [u32 numberOfEncodedInfo][u8 flags][varint chapters][varint extensions][pad to 4][payload words][u32 checksum if flagged]
@@ -2143,7 +2154,19 @@ class CachedExpressionInfo : public CachedObject<ExpressionInfo> {
 };
 static_assert(sizeof(CachedExpressionInfo) == sizeof(uint32_t) && alignof(CachedExpressionInfo) == 4);
 
-typedef CachedHashMap<CachedRefPtr<CachedUniquedStringImpl, UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>>, PrivateNameEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, PrivateNameEntryHashTraits> CachedPrivateNameEnvironment;
+// VariableEnvironmentEntry and PrivateNameEntry are 16 bits; held in 32 so the pairs that hold them have no padding.
+template<typename Entry>
+class CachedEntryBits : public CachedObject<Entry> {
+public:
+    void encode(Encoder&, const Entry& entry) { m_bits = std::bit_cast<uint16_t>(entry); }
+    void decode(Decoder&, Entry& entry) const { entry = std::bit_cast<Entry>(static_cast<uint16_t>(m_bits)); }
+    Entry decode(Decoder&) const { return std::bit_cast<Entry>(static_cast<uint16_t>(m_bits)); }
+
+private:
+    uint32_t m_bits;
+};
+
+typedef CachedHashMap<CachedRefPtr<CachedUniquedStringImpl, UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>>, CachedEntryBits<PrivateNameEntry>, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, PrivateNameEntryHashTraits> CachedPrivateNameEnvironment;
 
 class CachedVariableEnvironmentRareData : public CachedObject<VariableEnvironment::RareData> {
 public:
@@ -2189,7 +2212,8 @@ class CachedVariableEnvironment : public CachedObject<VariableEnvironment> {
 private:
     bool m_isEverythingCaptured;
     bool m_hasAwaitUsingDeclaration;
-    CachedInlineMap<CachedRefPtr<CachedUniquedStringImpl, UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>>, VariableEnvironmentEntry, VariableEnvironment::inlineMapCapacity, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, VariableEnvironmentEntryHashTraits> m_map;
+    uint8_t m_unused[2] { };
+    CachedInlineMap<CachedRefPtr<CachedUniquedStringImpl, UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>>, CachedEntryBits<VariableEnvironmentEntry>, VariableEnvironment::inlineMapCapacity, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, VariableEnvironmentEntryHashTraits> m_map;
     CachedPtr<CachedVariableEnvironmentRareData> m_rareData;
 };
 
@@ -2381,6 +2405,7 @@ class CachedSymbolTable : public CachedObject<SymbolTable> {
     unsigned m_usesSloppyEval : 1;
     unsigned m_nestedLexicalScope : 1;
     unsigned m_scopeType : 3;
+    unsigned m_unused : 27 { 0 };
     CachedPtr<CachedScopedArgumentsTable> m_arguments;
     CachedPtr<CachedSymbolTableRareData> m_rareData;
 };
@@ -2422,6 +2447,7 @@ class CachedImmutableButterfly : public CachedObject<JSCellButterfly> {
 
 private:
     IndexingType m_indexingType;
+    uint8_t m_unused[3] { };
     unsigned m_length;
     union {
         CachedArray<double> m_cachedDoubles;
@@ -2446,6 +2472,7 @@ class CachedRegExp : public CachedObject<RegExp> {
 private:
     CachedString m_patternString;
     OptionSet<Yarr::Flags> m_flags;
+    uint8_t m_unused[2] { };
 };
 
 class CachedTemplateObjectDescriptor : public CachedObject<TemplateObjectDescriptor> {
@@ -2503,6 +2530,7 @@ class CachedBigInt : public VariableLengthObject<JSBigInt> {
 private:
     unsigned m_length;
     bool m_sign;
+    uint8_t m_unused[3] { };
 };
 
 // A constant is a kind byte and a 4-byte slot; the owner keeps the kinds in a parallel array (CachedJSValuePool). Small
@@ -2751,6 +2779,7 @@ static ptrdiff_t encodeArrayForTail(Encoder& encoder, const Container& container
         encoder.registerArray(hash, result.offset(), bytes.size());
         return result.offset();
     } else {
+        static_assert(PayloadType<T>);
         auto result = encoder.malloc(sizeof(T) * size, alignof(T));
         T* buffer = new (result.buffer()) T[size];
         for (unsigned i = 0; i < size; ++i)
@@ -2833,6 +2862,7 @@ class CachedSourceProviderShape : public CachedObject<Source> {
     CachedString m_sourceMappingURLDirective;
     CachedTextPosition m_startPosition;
     SourceTaintedOrigin m_sourceTaintedOrigin;
+    uint8_t m_unused[3] { };
 };
 
 class CachedStringSourceProvider : public CachedSourceProviderShape<StringSourceProvider, CachedStringSourceProvider> {
@@ -2984,6 +3014,7 @@ class CachedSourceProvider : public VariableLengthObject<SourceProvider> {
 
 private:
     SourceProviderSourceType m_sourceType;
+    uint8_t m_unused[3] { };
 };
 
 template<typename Source>
@@ -3098,6 +3129,7 @@ class CachedClassElementDefinition : public CachedObject<UnlinkedFunctionExecuta
     CachedJSTextPosition m_position;
     CachedOptional<CachedJSTextPosition> m_initializerPosition;
     uint8_t m_kind;
+    uint8_t m_unused[3] { };
 };
 
 // A header word of presence bits, then only the members that are set: the three vectors (4-byte aligned), then the
@@ -4411,6 +4443,7 @@ auto CachedCodeBlock<CodeBlockType>::create(Encoder& encoder, const CodeBlockTyp
     // The children's slots are part of this block's bytes; the records they point at are written after the region.
     auto allocateSlots = [&](unsigned count) {
         auto result = encoder.malloc(sizeof(CachedWriteBarrier<CachedFunctionExecutable>) * count, alignof(CachedWriteBarrier<CachedFunctionExecutable>));
+        static_assert(PayloadType<CachedWriteBarrier<CachedFunctionExecutable>>);
         new (result.buffer()) CachedWriteBarrier<CachedFunctionExecutable>[count];
         return result.offset();
     };
@@ -4420,6 +4453,7 @@ auto CachedCodeBlock<CodeBlockType>::create(Encoder& encoder, const CodeBlockTyp
         layout.flags |= LayoutHasExtras;
         auto result = encoder.malloc(sizeof(CachedCodeBlockExtras), alignof(CachedCodeBlockExtras));
         layout.extrasAt = safeCast<int32_t>(result.offset() - regionStart);
+        static_assert(PayloadType<CachedCodeBlockExtras>);
         (new (result.buffer()) CachedCodeBlockExtras())->encode(encoder, codeBlock);
     }
 
@@ -4435,6 +4469,7 @@ auto CachedCodeBlock<CodeBlockType>::create(Encoder& encoder, const CodeBlockTyp
         packScalars(codeBlock, writer);
         return sizeof(Record) + writer.size() + trailerBytes;
     });
+    static_assert(PayloadType<Record>);
     Record* record = new (result.buffer()) Record();
     writer.copyTo(record->tailBytes());
     ptrdiff_t trailerOffset = result.offset() + sizeof(Record) + writer.size();
@@ -4800,6 +4835,64 @@ bool isCachedBytecodeStillValid(VM& vm, Ref<CachedBytecode> cachedBytecode, cons
     return cachedEntry->isStillValid(decoder.get(), key, tagFromSourceCodeType(type));
 }
 
+
+// The size of every record under every ABI we build (see PayloadType). Changing a record means changing its number here,
+// and with it the serialized form.
+static_assert(sizeof(GenericCacheEntry) == 24);
+static_assert(sizeof(CacheEntry<UnlinkedProgramCodeBlock>) == 56);
+static_assert(sizeof(CacheEntry<UnlinkedModuleProgramCodeBlock>) == 56);
+static_assert(sizeof(BuiltinFunctionCacheEntry) == 36);
+static_assert(sizeof(VariableLengthObjectBase) == 4);
+static_assert(sizeof(CachedPtr<CachedString>) == 4);
+static_assert(sizeof(CachedRefPtr<CachedUniquedStringImpl>) == 4);
+static_assert(sizeof(CachedWriteBarrier<CachedFunctionExecutable>) == 4);
+static_assert(sizeof(CachedVector<uint32_t>) == 8);
+static_assert(sizeof(CachedArray<double>) == 4);
+static_assert(sizeof(CachedOptional<CachedJSTextPosition>) == 4);
+static_assert(sizeof(CachedPair<CachedRefPtr<CachedUniquedStringImpl>, CachedEntryBits<VariableEnvironmentEntry>>) == 8);
+static_assert(sizeof(CachedHashSet<CachedRefPtr<CachedUniquedStringImpl>, IdentifierRepHash>) == 8);
+static_assert(sizeof(CachedPrivateNameEnvironment) == 8);
+static_assert(sizeof(CachedBigInt) == 12);
+static_assert(sizeof(CachedBitVector) == 8);
+static_assert(sizeof(CachedClassElementDefinition) == 24);
+static_assert(sizeof(CachedCodeBlockExtras) == 12);
+static_assert(sizeof(CachedCodeBlockRareData) == 60);
+static_assert(sizeof(CachedCompactTDZEnvironment) == 12);
+static_assert(sizeof(CachedCompactTDZEnvironmentMapHandle) == 4);
+static_assert(sizeof(CachedEvalCodeBlock) == 40);
+static_assert(sizeof(CachedExpressionInfo) == 4);
+static_assert(sizeof(CachedFunctionCodeBlock) == 4);
+static_assert(sizeof(CachedFunctionExecutable) == 4);
+static_assert(sizeof(CachedFunctionExecutableRareData) == 4);
+static_assert(sizeof(CachedHandlerInfo) == 16);
+static_assert(sizeof(CachedIdentifier) == 4);
+static_assert(sizeof(CachedImmutableButterfly) == 12);
+static_assert(sizeof(CachedJSTextPosition) == 12);
+static_assert(sizeof(CachedJSValue) == 4);
+static_assert(sizeof(CachedJSValuePoolRef) == 4);
+static_assert(sizeof(CachedModuleCodeBlock) == 44);
+static_assert(sizeof(CachedProgramCodeBlock) == 56);
+static_assert(sizeof(CachedRegExp) == 8);
+static_assert(sizeof(CachedScopedArgumentsTable) == 8);
+static_assert(sizeof(CachedSimpleJumpTable) == 20);
+static_assert(sizeof(CachedSourceCodeKey) == 28);
+static_assert(sizeof(CachedSourceOrigin) == 4);
+static_assert(sizeof(CachedSourceProvider) == 8);
+static_assert(sizeof(CachedString) == 4);
+static_assert(sizeof(CachedStringImpl) == 12);
+static_assert(sizeof(CachedStringJumpTable) == 20);
+static_assert(sizeof(CachedStringSourceProvider) == 36);
+static_assert(sizeof(CachedSymbolTable) == 24);
+static_assert(sizeof(CachedSymbolTableEntry) == 4);
+static_assert(sizeof(CachedSymbolTableRareData) == 8);
+static_assert(sizeof(CachedTDZEnvironmentLink) == 8);
+static_assert(sizeof(CachedTemplateObjectDescriptor) == 20);
+static_assert(sizeof(CachedTextPosition) == 8);
+static_assert(sizeof(CachedUniquedStringImpl) == 12);
+static_assert(sizeof(CachedUnlinkedSourceCode) == 12);
+static_assert(sizeof(CachedVariableEnvironment) == 16);
+static_assert(sizeof(CachedVariableEnvironmentRareData) == 8);
+static_assert(sizeof(CachedWebAssemblySourceProvider) == 40);
 void decodeFunctionCodeBlock(Decoder& decoder, int32_t cachedFunctionCodeBlockOffset, WriteBarrier<UnlinkedFunctionCodeBlock>& codeBlock, const JSCell* owner)
 {
     ASSERT(decoder.vm().heap.isDeferred());

From 34ba0937d4225cd662c4de4a7ebf35f4bc87ab19 Mon Sep 17 00:00:00 2001
From: Dylan Conway <dylan.conway567@gmail.com>
Date: Thu, 27 Aug 2026 06:34:39 +0000
Subject: [PATCH 5/8] guard __has_warning with defined() so non-clang
 preprocessors still parse the line

---
 Source/JavaScriptCore/runtime/CachedTypes.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Source/JavaScriptCore/runtime/CachedTypes.cpp b/Source/JavaScriptCore/runtime/CachedTypes.cpp
index 805f37a8efc7..711c4cc64f53 100644
--- a/Source/JavaScriptCore/runtime/CachedTypes.cpp
+++ b/Source/JavaScriptCore/runtime/CachedTypes.cpp
@@ -63,9 +63,11 @@ WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
 // A payload written on one platform is read in place on another, so the records below must be laid out identically under
 // the Itanium and MSVC C++ ABIs. Their bit-fields are the likeliest thing to break that: make the compiler refuse any
 // bit-field in this file that MSVC would pack differently.
-#if COMPILER(CLANG) && __has_warning("-Wms-bitfield-padding")
+#if defined(__has_warning)
+#if __has_warning("-Wms-bitfield-padding")
 #pragma clang diagnostic error "-Wms-bitfield-padding"
 #endif
+#endif
 
 // Everything placed in a payload must have no padding bytes and no unused bit-field bits on the ABI compiling this. The
 // C++ ABIs a payload moves between all place bases and fields in declaration order and differ only in where they pad, so a

From 4d49914de3b991e59fdce1a565d182a37f97d690 Mon Sep 17 00:00:00 2001
From: Dylan Conway <dylan.conway567@gmail.com>
Date: Thu, 27 Aug 2026 06:52:23 +0000
Subject: [PATCH 6/8] BytecodeGenerator: a folded NaN constant is the canonical
 NaN, not the host CPU's (x86 and ARM disagree on the sign of 0/0)

---
 Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 6c163bf7f36e..c00f5630d9cf 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -1694,6 +1694,10 @@ RegisterID* BytecodeGenerator::addConstantValue(JSValue v, SourceCodeRepresentat
 
     if (sourceCodeRepresentation == SourceCodeRepresentation::Double && v.isInt32())
         v = jsDoubleNumber(v.asNumber());
+    // A NaN the parser folded (0 / 0) has whatever bits this CPU's arithmetic produces (the sign differs between x86 and
+    // ARM); the constant, and so the bytecode, should not depend on that.
+    if (v.isDouble() && std::isnan(v.asDouble()))
+        v = jsNaN();
     EncodedJSValueWithRepresentation valueMapKey { JSValue::encode(v), sourceCodeRepresentation };
     JSValueMap::AddResult result = m_jsValueMap.add(valueMapKey, m_nextConstantOffset);
     if (result.isNewEntry) {

From f98dd2541c3fe5293155e154baf05f70d3169df7 Mon Sep 17 00:00:00 2001
From: Dylan Conway <dylan.conway567@gmail.com>
Date: Thu, 27 Aug 2026 06:52:49 +0000
Subject: [PATCH 7/8] guard the CachedWebAssemblySourceProvider size assert
 with ENABLE(WEBASSEMBLY)

---
 Source/JavaScriptCore/runtime/CachedTypes.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/CachedTypes.cpp b/Source/JavaScriptCore/runtime/CachedTypes.cpp
index 711c4cc64f53..5cd9210534ed 100644
--- a/Source/JavaScriptCore/runtime/CachedTypes.cpp
+++ b/Source/JavaScriptCore/runtime/CachedTypes.cpp
@@ -4894,7 +4894,9 @@ static_assert(sizeof(CachedUniquedStringImpl) == 12);
 static_assert(sizeof(CachedUnlinkedSourceCode) == 12);
 static_assert(sizeof(CachedVariableEnvironment) == 16);
 static_assert(sizeof(CachedVariableEnvironmentRareData) == 8);
+#if ENABLE(WEBASSEMBLY)
 static_assert(sizeof(CachedWebAssemblySourceProvider) == 40);
+#endif
 void decodeFunctionCodeBlock(Decoder& decoder, int32_t cachedFunctionCodeBlockOffset, WriteBarrier<UnlinkedFunctionCodeBlock>& codeBlock, const JSCell* owner)
 {
     ASSERT(decoder.vm().heap.isDeferred());

From 18ff9a99477c8d3c6b5dc3ef205294b1cb157d4f Mon Sep 17 00:00:00 2001
From: Dylan Conway <dylan.conway567@gmail.com>
Date: Thu, 27 Aug 2026 06:55:34 +0000
Subject: [PATCH 8/8] Remove the record-layout dump and its CI comparison; the
 static_asserts in CachedTypes.cpp cover it at compile time

---
 .github/workflows/build-reusable.yml        | 220 +++++---------------
 Dockerfile                                  |   1 -
 Dockerfile.android                          |   8 -
 Dockerfile.freebsd                          |   8 -
 Dockerfile.macos                            |   1 -
 Dockerfile.musl                             |   3 +-
 Dockerfile.windows                          |   3 -
 Tools/Scripts/dump-bytecode-cache-layout.ts | 146 -------------
 8 files changed, 57 insertions(+), 333 deletions(-)
 delete mode 100644 Tools/Scripts/dump-bytecode-cache-layout.ts

diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml
index 9b5608d4e6db..9cfcdaa7f515 100644
--- a/.github/workflows/build-reusable.yml
+++ b/.github/workflows/build-reusable.yml
@@ -2,56 +2,6 @@ name: Build WebKit (Reusable)
 
 env:
   LLVM_VERSION: 21
-  # Every build job uploads <label>/bun-webkit.tar.gz. This list is the release: a label missing from the run fails it.
-  ARTIFACTS: |
-    # linux
-    bun-webkit-linux-amd64
-    bun-webkit-linux-amd64-lto
-    bun-webkit-linux-amd64-debug
-    bun-webkit-linux-amd64-asan
-    bun-webkit-linux-amd64-debug-asan
-    bun-webkit-linux-arm64
-    bun-webkit-linux-arm64-lto
-    bun-webkit-linux-arm64-debug
-    bun-webkit-linux-arm64-asan
-    bun-webkit-linux-arm64-debug-asan
-    # linux-musl
-    bun-webkit-linux-amd64-musl
-    bun-webkit-linux-amd64-musl-lto
-    bun-webkit-linux-amd64-musl-debug
-    bun-webkit-linux-arm64-musl
-    bun-webkit-linux-arm64-musl-lto
-    bun-webkit-linux-arm64-musl-debug
-    # macos-cross
-    bun-webkit-macos-arm64
-    bun-webkit-macos-arm64-lto
-    bun-webkit-macos-arm64-debug
-    bun-webkit-macos-arm64-asan
-    bun-webkit-macos-arm64-debug-asan
-    bun-webkit-macos-amd64
-    bun-webkit-macos-amd64-lto
-    bun-webkit-macos-amd64-debug
-    # windows / windows-cross
-    bun-webkit-windows-amd64
-    bun-webkit-windows-amd64-lto
-    bun-webkit-windows-amd64-debug
-    bun-webkit-windows-amd64-asan
-    bun-webkit-windows-arm64
-    bun-webkit-windows-arm64-debug
-    # freebsd
-    bun-webkit-freebsd-amd64
-    bun-webkit-freebsd-amd64-lto
-    bun-webkit-freebsd-amd64-debug
-    bun-webkit-freebsd-arm64
-    bun-webkit-freebsd-arm64-lto
-    bun-webkit-freebsd-arm64-debug
-    # linux-android
-    bun-webkit-linux-arm64-android
-    bun-webkit-linux-arm64-android-lto
-    bun-webkit-linux-arm64-android-debug
-    bun-webkit-linux-amd64-android
-    bun-webkit-linux-amd64-android-lto
-    bun-webkit-linux-amd64-android-debug
 
 on:
   workflow_call:
@@ -175,7 +125,7 @@ jobs:
           RELEASE_FLAGS: ${{matrix.RELEASE_FLAGS}}
           ENABLE_SANITIZERS: ${{matrix.ENABLE_SANITIZERS}}
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
           if [ "${{matrix.package_json_arch}}" = "arm64" ]; then
             export MARCH_FLAG="-march=armv8-a+crc -mtune=ampere1"
           else
@@ -187,18 +137,12 @@ jobs:
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["linux"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
           rm -rf bun-webkit/lib/*.so
           rm -rf bun-webkit/lib/*.so.*
-          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: layout-${{matrix.label}}
-          path: ${{runner.temp}}/bytecode-cache-layout.txt
-          if-no-files-found: error
 
   windows-cross:
     name: Windows (cross-compiled from Linux)
@@ -281,23 +225,17 @@ jobs:
           install: true
       - name: Run
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
           WIN_ARCH="${{matrix.win_arch}}" WEBKIT_RELEASE_TYPE="${{matrix.CMAKE_BUILD_TYPE}}" LTO_FLAG="${{matrix.lto_flag}}" ENABLE_SANITIZERS="${{matrix.ENABLE_SANITIZERS}}" USE_MIMALLOC="${{matrix.USE_MIMALLOC || 'OFF'}}" USE_EXTERNAL_MIMALLOC="${{matrix.USE_EXTERNAL_MIMALLOC || 'OFF'}}" temp=${{runner.temp}} bash windows-cross-release.sh
           cd ${{runner.temp}}
           echo "#define BUN_WEBKIT_VERSION \"${{ inputs.build_ref }}\"" >> bun-webkit/include/cmakeconfig.h
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["windows"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
-          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: layout-${{matrix.label}}
-          path: ${{runner.temp}}/bytecode-cache-layout.txt
-          if-no-files-found: error
 
   windows:
     name: Windows
@@ -423,7 +361,7 @@ jobs:
           install: true
       - name: Run
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
           if [ "${{matrix.package_json_arch}}" = "arm64" ]; then
             export MARCH_FLAG="-march=armv8-a+crc -mtune=ampere1"
           else
@@ -435,18 +373,12 @@ jobs:
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["linux"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
           rm -rf bun-webkit/lib/*.so
           rm -rf bun-webkit/lib/*.so.*
-          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: layout-${{matrix.label}}
-          path: ${{runner.temp}}/bytecode-cache-layout.txt
-          if-no-files-found: error
 
   macos-cross:
     name: macOS (cross-compiled from Linux)
@@ -534,23 +466,17 @@ jobs:
           install: true
       - name: Run
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
           MACOS_ARCH="${{matrix.macos_arch}}" WEBKIT_RELEASE_TYPE="${{matrix.CMAKE_BUILD_TYPE}}" LTO_FLAG="${{matrix.lto_flag}}" CPP_FLAGS="${{matrix.cpp_flags}}" ENABLE_SANITIZERS="${{matrix.ENABLE_SANITIZERS}}" ENABLE_MALLOC_HEAP_BREAKDOWN="${{matrix.ENABLE_MALLOC_HEAP_BREAKDOWN}}" USE_MIMALLOC="${{matrix.USE_MIMALLOC || 'OFF'}}" USE_EXTERNAL_MIMALLOC="${{matrix.USE_EXTERNAL_MIMALLOC || 'OFF'}}" temp=${{runner.temp}} bash macos-cross-release.sh
           cd ${{runner.temp}}
           echo "#define BUN_WEBKIT_VERSION \"${{ inputs.build_ref }}\"" >> bun-webkit/include/cmakeconfig.h
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["darwin"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
-          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: layout-${{matrix.label}}
-          path: ${{runner.temp}}/bytecode-cache-layout.txt
-          if-no-files-found: error
 
   freebsd:
     name: FreeBSD
@@ -610,24 +536,18 @@ jobs:
           install: true
       - name: Run
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
           FREEBSD_ARCH="${{matrix.freebsd_arch}}" WEBKIT_RELEASE_TYPE="${{matrix.CMAKE_BUILD_TYPE}}" LTO_FLAG="${{matrix.lto_flag}}" USE_MIMALLOC="${{matrix.USE_MIMALLOC || 'OFF'}}" USE_EXTERNAL_MIMALLOC="${{matrix.USE_EXTERNAL_MIMALLOC || 'OFF'}}" temp=${{runner.temp}} bash freebsd-release.sh
           cd ${{runner.temp}}
           echo "#define BUN_WEBKIT_VERSION \"${{ inputs.build_ref }}\"" >> bun-webkit/include/cmakeconfig.h
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["freebsd"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
           rm -rf bun-webkit/lib/*.so bun-webkit/lib/*.so.*
-          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: layout-${{matrix.label}}
-          path: ${{runner.temp}}/bytecode-cache-layout.txt
-          if-no-files-found: error
 
   linux-android:
     name: Linux Android
@@ -687,95 +607,18 @@ jobs:
           install: true
       - name: Run
         run: |
-          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz ${{runner.temp}}/bytecode-cache-layout.txt
+          rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz
           ANDROID_ARCH="${{matrix.android_arch}}" WEBKIT_RELEASE_TYPE="${{matrix.CMAKE_BUILD_TYPE}}" LTO_FLAG="${{matrix.lto_flag}}" USE_MIMALLOC="${{matrix.USE_MIMALLOC || 'OFF'}}" USE_EXTERNAL_MIMALLOC="${{matrix.USE_EXTERNAL_MIMALLOC || 'OFF'}}" temp=${{runner.temp}} bash android-release.sh
           cd ${{runner.temp}}
           echo "#define BUN_WEBKIT_VERSION \"${{ inputs.build_ref }}\"" >> bun-webkit/include/cmakeconfig.h
           echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["android"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json
           rm -rf bun-webkit/lib/*.so bun-webkit/lib/*.so.*
-          cp bun-webkit/bytecode-cache-layout.txt .
           tar -czf bun-webkit.tar.gz bun-webkit
           rm -rf bun-webkit
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{matrix.label}}
           path: ${{runner.temp}}/bun-webkit.tar.gz
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: layout-${{matrix.label}}
-          path: ${{runner.temp}}/bytecode-cache-layout.txt
-          if-no-files-found: error
-
-  # A bytecode cache payload written on one platform is read in place on the others (bun build --compile
-  # cross-compiles), so the records it is made of must be laid out identically everywhere. Every Docker-built job
-  # uploads the layouts of its build (Tools/Scripts/dump-bytecode-cache-layout.ts) as layout-<label>; this job fails,
-  # and blocks the release, if any of them differs from linux-amd64 or is missing. The one native build
-  # (windows-arm64-debug) has no dump and is not compared.
-  bytecode-cache-layout:
-    name: Bytecode cache layouts agree across platforms
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      actions: read
-    needs:
-      - linux
-      - macos-cross
-      - windows-cross
-      - linux-musl
-      - linux-android
-      - freebsd
-    steps:
-      - name: Download layouts
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          for attempt in 1 2 3; do
-            rm -rf layouts
-            gh run download "$GITHUB_RUN_ID" --pattern 'layout-*' -D layouts && break
-            echo "download failed (attempt $attempt)"; sleep $((attempt * 5))
-          done
-          ls layouts
-      - name: Compare
-        run: |
-          set -uo pipefail
-          reference=layouts/layout-bun-webkit-linux-amd64/bytecode-cache-layout.txt
-          if [ ! -s "$reference" ]; then echo "::error::no layout dump for linux-amd64"; exit 1; fi
-          status=0
-          mkdir -p diffs
-          {
-            echo "Reference: linux-amd64 — $(grep -vc '^ ' "$reference") records"
-            echo
-            echo "| build | result |"
-            echo "| --- | --- |"
-          } >> "$GITHUB_STEP_SUMMARY"
-          while read -r name; do
-            [ "$name" = bun-webkit-windows-arm64-debug ] && continue
-            f="layouts/layout-$name/bytecode-cache-layout.txt"
-            if [ ! -s "$f" ]; then
-              echo "::error::$name uploaded no bytecode cache layout dump"
-              echo "| ${name#bun-webkit-} | missing |" >> "$GITHUB_STEP_SUMMARY"
-              status=1
-            elif ! diff -u --label linux-amd64 --label "${name#bun-webkit-}" "$reference" "$f" > "diffs/$name.diff"; then
-              echo "::error::bytecode cache record layouts of $name differ from linux-amd64"
-              echo "| ${name#bun-webkit-} | **differs**: $(grep -c '^[-+][^-+]' "diffs/$name.diff") lines |" >> "$GITHUB_STEP_SUMMARY"
-              status=1
-            else
-              rm "diffs/$name.diff"
-              echo "| ${name#bun-webkit-} | same |" >> "$GITHUB_STEP_SUMMARY"
-            fi
-          done < <(grep -v '^ *#' <<< "$ARTIFACTS" | grep .)
-          for d in diffs/*.diff; do
-            [ -e "$d" ] || continue
-            { echo; echo "<details><summary>$(basename "$d" .diff)</summary>"; echo; echo '```diff'; head -200 "$d"; echo '```'; echo "</details>"; } >> "$GITHUB_STEP_SUMMARY"
-          done
-          exit $status
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        if: failure()
-        with:
-          name: bytecode-cache-layout-diffs
-          path: diffs/
 
   release:
     name: release
@@ -792,7 +635,6 @@ jobs:
       - linux-musl
       - linux-android
       - freebsd
-      - bytecode-cache-layout
     outputs:
       tag: ${{ steps.release_info.outputs.tag }}
     steps:
@@ -807,10 +649,60 @@ jobs:
       - run: lsipc
       - run: whoami
 
+      # Every build job uploads <label>/bun-webkit.tar.gz. This list is the release: a label missing from the run fails the job.
       - name: Download artifacts
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
+          ARTIFACTS: |
+            # linux
+            bun-webkit-linux-amd64
+            bun-webkit-linux-amd64-lto
+            bun-webkit-linux-amd64-debug
+            bun-webkit-linux-amd64-asan
+            bun-webkit-linux-amd64-debug-asan
+            bun-webkit-linux-arm64
+            bun-webkit-linux-arm64-lto
+            bun-webkit-linux-arm64-debug
+            bun-webkit-linux-arm64-asan
+            bun-webkit-linux-arm64-debug-asan
+            # linux-musl
+            bun-webkit-linux-amd64-musl
+            bun-webkit-linux-amd64-musl-lto
+            bun-webkit-linux-amd64-musl-debug
+            bun-webkit-linux-arm64-musl
+            bun-webkit-linux-arm64-musl-lto
+            bun-webkit-linux-arm64-musl-debug
+            # macos-cross
+            bun-webkit-macos-arm64
+            bun-webkit-macos-arm64-lto
+            bun-webkit-macos-arm64-debug
+            bun-webkit-macos-arm64-asan
+            bun-webkit-macos-arm64-debug-asan
+            bun-webkit-macos-amd64
+            bun-webkit-macos-amd64-lto
+            bun-webkit-macos-amd64-debug
+            # windows / windows-cross
+            bun-webkit-windows-amd64
+            bun-webkit-windows-amd64-lto
+            bun-webkit-windows-amd64-debug
+            bun-webkit-windows-amd64-asan
+            bun-webkit-windows-arm64
+            bun-webkit-windows-arm64-debug
+            # freebsd
+            bun-webkit-freebsd-amd64
+            bun-webkit-freebsd-amd64-lto
+            bun-webkit-freebsd-amd64-debug
+            bun-webkit-freebsd-arm64
+            bun-webkit-freebsd-arm64-lto
+            bun-webkit-freebsd-arm64-debug
+            # linux-android
+            bun-webkit-linux-arm64-android
+            bun-webkit-linux-arm64-android-lto
+            bun-webkit-linux-arm64-android-debug
+            bun-webkit-linux-amd64-android
+            bun-webkit-linux-amd64-android-lto
+            bun-webkit-linux-amd64-android-debug
         run: |
           set -euo pipefail
           grep -v '^ *#' <<< "$ARTIFACTS" | grep . > artifacts.txt
diff --git a/Dockerfile b/Dockerfile
index 5ebd695e7df2..8dff2f78e788 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -308,7 +308,6 @@ RUN --mount=type=tmpfs,target=/webkitbuild \
     cd /webkitbuild && \
     cmake --build /webkitbuild --config $WEBKIT_RELEASE_TYPE --target "jsc" --target "testFFI" && \
     python3 /webkit/Tools/Scripts/check-classinfo-uniqueness.py $WEBKIT_OUT_DIR/bin/jsc && \
-    node --experimental-strip-types /webkit/Tools/Scripts/dump-bytecode-cache-layout.ts /webkitbuild > /output/bytecode-cache-layout.txt && \
     cp -r $WEBKIT_OUT_DIR/lib/*.a /output/lib && \
     cp $WEBKIT_OUT_DIR/*.h /output/include && \
     cp -r $WEBKIT_OUT_DIR/bin /output/bin && \
diff --git a/Dockerfile.android b/Dockerfile.android
index 8855d167cbdf..88b403c094e4 100644
--- a/Dockerfile.android
+++ b/Dockerfile.android
@@ -86,13 +86,6 @@ RUN mkdir -p /output/lib /output/include /output/include/JavaScriptCore /output/
 # etc.) at build time, so a host build is required first; the target build
 # points at it via --with-cross-build.
 # ───────────────────────────────────────────────────────────────────────────
-
-# Node — only used to run Tools/Scripts/dump-bytecode-cache-layout.ts after the build.
-ARG NODE_VERSION=24.16.0
-RUN wget -qO- "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/').tar.xz" \
-      | tar -xJ -C /usr/local --strip-components=1 && \
-    node --version
-
 FROM base AS build_icu
 
 ARG MARCH_FLAG
@@ -214,7 +207,6 @@ RUN --mount=type=tmpfs,target=/webkitbuild \
     /webkit && \
     cmake --build /webkitbuild --config ${WEBKIT_RELEASE_TYPE} --target jsc --target testFFI && \
     python3 /webkit/Tools/Scripts/check-classinfo-uniqueness.py $WEBKIT_OUT_DIR/bin/jsc && \
-    node --experimental-strip-types /webkit/Tools/Scripts/dump-bytecode-cache-layout.ts /webkitbuild > /output/bytecode-cache-layout.txt && \
     cp -r $WEBKIT_OUT_DIR/lib/*.a /output/lib && \
     cp $WEBKIT_OUT_DIR/*.h /output/include && \
     cp -r $WEBKIT_OUT_DIR/bin /output/bin && \
diff --git a/Dockerfile.freebsd b/Dockerfile.freebsd
index 33b875f5ddb9..05bf38e59e8d 100644
--- a/Dockerfile.freebsd
+++ b/Dockerfile.freebsd
@@ -75,13 +75,6 @@ RUN mkdir -p /output/lib /output/include /output/include/JavaScriptCore /output/
 # ICU — cross-compiled. Same two-stage host/target build as Android: host
 # tools first, then --with-cross-build.
 # ───────────────────────────────────────────────────────────────────────────
-
-# Node — only used to run Tools/Scripts/dump-bytecode-cache-layout.ts after the build.
-ARG NODE_VERSION=24.16.0
-RUN wget -qO- "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/').tar.xz" \
-      | tar -xJ -C /usr/local --strip-components=1 && \
-    node --version
-
 FROM base AS build_icu
 
 ARG MARCH_FLAG
@@ -206,7 +199,6 @@ RUN --mount=type=tmpfs,target=/webkitbuild \
     /webkit && \
     cmake --build /webkitbuild --config ${WEBKIT_RELEASE_TYPE} --target jsc --target testFFI && \
     python3 /webkit/Tools/Scripts/check-classinfo-uniqueness.py $WEBKIT_OUT_DIR/bin/jsc && \
-    node --experimental-strip-types /webkit/Tools/Scripts/dump-bytecode-cache-layout.ts /webkitbuild > /output/bytecode-cache-layout.txt && \
     cp -r $WEBKIT_OUT_DIR/lib/*.a /output/lib && \
     cp $WEBKIT_OUT_DIR/*.h /output/include && \
     cp -r $WEBKIT_OUT_DIR/bin /output/bin && \
diff --git a/Dockerfile.macos b/Dockerfile.macos
index 388371018fb6..a613843c98d6 100644
--- a/Dockerfile.macos
+++ b/Dockerfile.macos
@@ -231,7 +231,6 @@ RUN --mount=type=tmpfs,target=/webkitbuild \
     /webkit && \
     cmake --build /webkitbuild --config ${WEBKIT_RELEASE_TYPE} --target jsc --target testFFI && \
     python3 /webkit/Tools/Scripts/check-classinfo-uniqueness.py $WEBKIT_OUT_DIR/bin/jsc && \
-    bun /webkit/Tools/Scripts/dump-bytecode-cache-layout.ts /webkitbuild > /output/bytecode-cache-layout.txt && \
     # -L everywhere: WebKit's cmake stages the WTF/bmalloc framework headers
     # as *symlinks* into the source tree when the host filesystem supports
     # them. Copied verbatim they'd dangle outside this container (pointing at
diff --git a/Dockerfile.musl b/Dockerfile.musl
index a857975a447b..8dd04397fa80 100644
--- a/Dockerfile.musl
+++ b/Dockerfile.musl
@@ -101,7 +101,7 @@ ARG DEFAULT_CFLAGS
 ARG USE_MIMALLOC
 ARG USE_EXTERNAL_MIMALLOC
 
-RUN apk add --no-cache cpio curl file gnupg ninja nodejs ruby ruby-getoptlong unzip rsync perl python3 openssl-dev openssl linux-headers
+RUN apk add --no-cache cpio curl file gnupg ninja ruby ruby-getoptlong unzip rsync perl python3 openssl-dev openssl linux-headers
 
 ENV WEBKIT_OUT_DIR=/webkitbuild
 # These are unnecessary on musl
@@ -143,7 +143,6 @@ RUN --mount=type=tmpfs,target=/webkitbuild \
     cd /webkitbuild && \
     cmake --build /webkitbuild --config ${WEBKIT_RELEASE_TYPE} --target "jsc" --target "testFFI" && \
     python3 /webkit/Tools/Scripts/check-classinfo-uniqueness.py $WEBKIT_OUT_DIR/bin/jsc && \
-    node --experimental-strip-types /webkit/Tools/Scripts/dump-bytecode-cache-layout.ts /webkitbuild > /output/bytecode-cache-layout.txt && \
     cp -r $WEBKIT_OUT_DIR/lib/*.a /output/lib && \
     cp $WEBKIT_OUT_DIR/*.h /output/include && \
     cp -r $WEBKIT_OUT_DIR/bin /output/bin && \
diff --git a/Dockerfile.windows b/Dockerfile.windows
index 8a99b66576b4..c344daedbefd 100644
--- a/Dockerfile.windows
+++ b/Dockerfile.windows
@@ -325,7 +325,6 @@ ARG USE_MIMALLOC
 ARG USE_EXTERNAL_MIMALLOC
 
 COPY --from=build_icu /icu-out /icu-out
-COPY --from=build_icu /usr/local/bin/node /usr/local/bin/node
 COPY . /webkit
 WORKDIR /webkit
 
@@ -412,11 +411,9 @@ RUN --mount=type=tmpfs,target=/webkitbuild \
     "-DCMAKE_CXX_FLAGS_RELEASE=/O2 /Ob2 /DNDEBUG ${LTO_FLAG}" \
     "-DCMAKE_C_FLAGS_DEBUG=/FS /O0 /Ob0" \
     "-DCMAKE_CXX_FLAGS_DEBUG=/FS /O0 /Ob0" \
-    -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
     -G Ninja \
     /webkit && \
     cmake --build /webkitbuild --config ${WEBKIT_RELEASE_TYPE} --target jsc --target testFFI && \
-    mkdir -p /output && node --experimental-strip-types /webkit/Tools/Scripts/dump-bytecode-cache-layout.ts /webkitbuild > /output/bytecode-cache-layout.txt && \
     \
     mkdir -p /output/lib /output/include/JavaScriptCore /output/include/wtf /output/include/bmalloc && \
     cp -rL $WEBKIT_OUT_DIR/lib/* /output/lib/ && \
diff --git a/Tools/Scripts/dump-bytecode-cache-layout.ts b/Tools/Scripts/dump-bytecode-cache-layout.ts
deleted file mode 100644
index f28bad66efec..000000000000
--- a/Tools/Scripts/dump-bytecode-cache-layout.ts
+++ /dev/null
@@ -1,146 +0,0 @@
-#!/usr/bin/env node
-// Prints the memory layout of every record the bytecode cache (runtime/CachedTypes.cpp) writes into a payload, in a
-// form that is textually identical across targets exactly when the layouts are. The release workflow diffs this file
-// between platforms: a payload encoded on one must decode on the others, so their Cached* records must agree.
-//
-// Usage: (bun | node) dump-bytecode-cache-layout.ts <build dir>            recompiles the CachedTypes.cpp translation unit with -fdump-record-layouts
-//        (bun | node) dump-bytecode-cache-layout.ts --dump <clang output>   parses an existing dump (for testing)
-
-import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { basename, isAbsolute, join } from "node:path";
-
-function fail(message: string): never {
-  process.stderr.write(message + "\n");
-  process.exit(1);
-}
-
-function splitCommand(command: string): string[] {
-  const args: string[] = [];
-  for (const m of command.matchAll(/"((?:\\.|[^"\\])*)"|'([^']*)'|(\S+)/g)) args.push(m[1]?.replace(/\\(["\\])/g, "$1") ?? m[2] ?? m[3]);
-  return args;
-}
-
-function compileCommand(buildDir: string): { directory: string; args: string[] } {
-  const commands: { directory: string; file: string; command?: string; arguments?: string[] }[] = JSON.parse(readFileSync(join(buildDir, "compile_commands.json"), "utf8"));
-  for (const entry of commands) {
-    if (!entry.file.includes("JavaScriptCore") || !entry.file.includes("UnifiedSource")) continue;
-    const path = isAbsolute(entry.file) ? entry.file : join(entry.directory, entry.file);
-    if (!existsSync(path) || !readFileSync(path, "utf8").includes('"runtime/CachedTypes.cpp"')) continue;
-    return { directory: entry.directory, args: entry.arguments ?? splitCommand(entry.command!) };
-  }
-  fail("no translation unit in compile_commands.json includes runtime/CachedTypes.cpp");
-}
-
-function recordLayouts(buildDir: string): string {
-  let { directory, args } = compileCommand(buildDir);
-  if (["ccache", "sccache"].includes(basename(args[0]))) args = args.slice(1);
-  // The same command minus its outputs: only the front end runs, and it prints every record layout it computes.
-  const filtered: string[] = [];
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (["-o", "-MF", "-MT", "-MQ"].includes(arg)) i++;
-    else if (["-c", "/c", "-MD", "-MMD", "/showIncludes"].includes(arg) || /^(-o|\/Fo|\/Fd|-MF|-MT)/.test(arg)) continue;
-    else filtered.push(arg);
-  }
-  filtered.splice(1, 0, "-fsyntax-only", "-Xclang", "-fdump-record-layouts"); // ahead of any `--` (clang-cl commands end `-- <source>`)
-  try {
-    return execFileSync(filtered[0], filtered.slice(1), { cwd: directory, encoding: "utf8", stdio: ["ignore", "pipe", "inherit"], maxBuffer: 1 << 30 });
-  } catch {
-    fail("dumping record layouts failed: " + filtered.join(" "));
-  }
-}
-
-function normalize(name: string): string {
-  return name
-    .replace(/\b(class|struct|union|enum) /g, "")
-    .replace(/\(unnamed (?:\w+ )?at [^)]*?([^/\\:)]+:\d+:\d+)\)/g, "(unnamed at $1)")
-    .replace(/\bunsigned long long\b|\bunsigned long\b/g, "ulong") // uint64_t's spelling differs (LP64 / LLP64); sizes are compared, not spellings
-    .replace(/(?<!unsigned )\blong long\b|(?<![nu] )\blong\b/g, "long")
-    .trim();
-}
-
-type Record = { name: string; size: number; align: number; rows: { offset: string; depth: number; text: string }[]; members: { type: string | null }[]; bases: string[] };
-
-function parse(dump: string): Map<string, Record> {
-  const records = new Map<string, Record>();
-  for (const block of dump.split("*** Dumping AST Record Layout\n").slice(1)) {
-    const lines = block.split("\n");
-    const head = lines[0].match(/^\s*0 \| (.*)$/);
-    const sizes = block.match(/\[sizeof=(\d+),(?:\s*dsize=\d+,)?\s*align=(\d+)/);
-    if (!head || !sizes) continue;
-    const record: Record = { name: normalize(head[1]), size: +sizes[1], align: +sizes[2], rows: [], members: [], bases: [] };
-    for (const line of lines.slice(1)) {
-      const row = line.match(/^\s*([\d:.-]+) \| ( +)(.*)$/);
-      if (!row) continue;
-      const depth = row[2].length / 2, text = normalize(row[3]);
-      record.rows.push({ offset: row[1], depth, text });
-      if (depth !== 1) continue;
-      const base = / \((?:primary |virtual )?base\)(?: \(empty\))?$/;
-      if (base.test(text)) {
-        const type = text.replace(base, "");
-        record.bases.push(type);
-        record.members.push({ type });
-      } else record.members.push({ type: text.match(/^(.+) [A-Za-z_]\w*(\[\d*\])*$/)?.[1] ?? null });
-    }
-    records.set(record.name, record);
-  }
-  return records;
-}
-
-function templateArguments(name: string): string[] {
-  const out: string[] = [];
-  let depth = 0, start = 0;
-  for (let i = 0; i < name.length; i++) {
-    const c = name[i];
-    if (c === "<" && ++depth === 1) start = i + 1;
-    else if (c === ">" && --depth === 0) out.push(name.slice(start, i));
-    else if (c === "," && depth === 1) { out.push(name.slice(start, i)); start = i + 1; }
-  }
-  return out.map(a => a.trim());
-}
-
-function cacheRecords(records: Map<string, Record>): Record[] {
-  // Roots: everything laid out in a payload derives from CachedObject<> / VariableLengthObjectBase, or (the entry headers)
-  // from GenericCacheEntry.
-  const isRoot = (record: Record, seen: string[] = []): boolean =>
-    /^JSC::(GenericCacheEntry$|CachedObject<|VariableLengthObjectBase$)/.test(record.name) ||
-    record.bases.some(base => records.has(base) && !seen.includes(base) && isRoot(records.get(base)!, [...seen, record.name]));
-  // T of every CachedObject<T> / VariableLengthObject<T>: the in-memory types the cache converts from, never laid out in a payload.
-  const sourceTypes = new Set([...records.values()].filter(r => /^JSC::(CachedObject|VariableLengthObject)</.test(r.name)).map(r => templateArguments(r.name)[0]));
-  const selected = new Map<string, Record>();
-  const queue = [...records.values()].filter(r => isRoot(r));
-  while (queue.length) {
-    const record = queue.pop()!;
-    if (selected.has(record.name)) continue;
-    selected.set(record.name, record);
-    // Members held by value are part of the record. So are the elements a Cached container writes into its tail:
-    // the leading template arguments of these (a JSC::Cached* argument anywhere is a record in its own right). Other
-    // template arguments name in-memory source types or traits, and RefPtr<T>, Bag<T> and the like point at T rather
-    // than contain it, so no other template argument is followed.
-    const reached = record.members.map(m => m.type).filter((t): t is string => !!t);
-    const elementArguments: { [container: string]: number } = { CachedVector: 1, CachedArray: 1, CachedOptional: 1, CachedHashSet: 1, CachedPair: 2, CachedHashMap: 2, CachedInlineMap: 2 };
-    const container = record.name.match(/^JSC::(Cached\w+)</)?.[1];
-    if (container && container !== "CachedObject") {
-      const args = templateArguments(record.name);
-      reached.push(...args.filter((t, i) => i < (elementArguments[container] ?? 0) || /^JSC::Cached/.test(t)).filter(t => !sourceTypes.has(t)));
-    }
-    for (const name of reached) {
-      if (/[*&]$/.test(name)) continue;
-      const r = records.get(normalize(name));
-      if (r && !selected.has(r.name)) queue.push(r);
-    }
-  }
-  return [...selected.keys()].sort().map(name => selected.get(name)!);
-}
-
-const argv = process.argv.slice(2);
-const dump = argv[0] === "--dump" ? readFileSync(argv[1], "utf8") : recordLayouts(argv[0] ?? fail("usage: dump-bytecode-cache-layout.ts <build dir>"));
-const selected = cacheRecords(parse(dump));
-if (selected.length < 50) fail(`found only ${selected.length} bytecode cache records; the dump or the selection is broken`);
-const out: string[] = [];
-for (const record of selected) {
-  out.push(`${record.name} size=${record.size} align=${record.align}`);
-  for (const { offset, depth, text } of record.rows) out.push(`  ${"  ".repeat(depth - 1)}${offset} | ${text}`);
-}
-process.stdout.write(out.join("\n") + "\n");