Upgrade WebKit to 39d4ce1f12ea

[sosukesuzuki]

Upgrades Bun's WebKit fork to upstream 39d4ce1f12ea (~422 upstream commits since 49d2e914a4cc). Fork PR: oven-sh/WebKit#236.

Note: WEBKIT_VERSION currently points at the preview build (autobuild-preview-pr-236-e54e803f). After oven-sh/WebKit#236 is merged, this should be updated to the merge-commit autobuild before this PR is merged.

WebKit Upgrade: 49d2e914a4cc → 39d4ce1f12ea

~422 upstream commits total; ~80 touch Source/JavaScriptCore, Source/WTF, or Source/bmalloc.

⚠️ Embedder-facing API / ABI changes

These directly affect Bun's bindings and were resolved during the merge.

• JSType enum changed — HeapDoubleType and HeapInt32Type removed; JSAsyncFunctionGeneratorType added after JSGeneratorType; constant LastMaybeFalsyCellPrimitive renamed to LastValueCompareCellType. Every JSType value after HeapBigIntType shifts down by 2, and every value after JSGeneratorType shifts up by 1. Bun's mirror of this enum in src/jsc/bindings/JSType.zig (and any consumers) must be regenerated/checked.
• JSGenerator split into JSGenerator + JSAsyncFunctionGenerator (e0704d3127d5, bug 314933). sizeof(JSGenerator) shrinks 64 → 48 bytes by moving the Context internal field into the new JSAsyncFunctionGenerator class. Async functions now drive a JSAsyncFunctionGenerator, not a plain JSGenerator. Anything that downcasts the async function generator must use the new type.
• JSPromise::performPromiseThenWithInternalMicrotask signature changed (8f742098b444, bug 314788). Fourth parameter was JSValue promise, now JSCell* cell. Pass nullptr where jsUndefined() was passed before. setInlineMicrotaskReaction also gained the JSCell* parameter; the inline reaction now stores a separate cell payload alongside the context, so a single JSPromise can carry an inlined InternalMicrotask reaction plus a result-promise cell without allocating a JSPromiseReaction.
• JSModuleLoader::loadModule now takes OptionSet<ModuleLoadFlag> instead of separate bool evaluate, bool dynamic, bool useImportMap parameters (7f062965e945, bug 314794). New flag ModuleLoadFlag::Deferred added for import.defer(). ModuleLoadingContext::create likewise switched to the OptionSet.
• globalObjectMethodTable()->moduleLoaderImportModule gained a trailing bool deferred parameter (7f062965e945). Bun's JSGlobalObject method table override must accept and (for now, can ignore) it.
• JSHeapInt32 / JSHeapDouble removed (3bb4fc93fb37, bug 314894). These were the experimental 32-bit-JSValues "compressed heap" boxing types; the headers, IsoSubspaces, and includes are gone.
• Symbol::toString(JSGlobalObject*) added (5e57a5812ef4, bug 314842). Caches the descriptive string on the Symbol object. stringConstructor() now calls it instead of building the string inline.
• AbstractModuleRecord::ImportEntries / ExportEntries switched to WTF::OrderedHashMap (4d67159942bc, bug 314961). Was UncheckedKeyHashMap. Iteration order is now insertion order; module-binding error messages are deterministic.

JSType.h diff

@@ -31,10 +31,12 @@ namespace JSC {
     macro(CellType, SpecCellOther) \
     macro(StructureType, SpecCellOther) \
+    \
+    /* These JSCells require non-pointer-comparison identity check */ \
+    /* (e.g. String value comparison). Keep in sync with LastValueCompareCellType. */ \
     macro(StringType, SpecString) \
     macro(HeapBigIntType, SpecHeapBigInt) \
-    macro(HeapDoubleType, SpecCellOther) \
-    macro(HeapInt32Type, SpecCellOther) \
+    \
     macro(SymbolType, SpecSymbol) \
@@ -133,6 +135,7 @@ namespace JSC {
     macro(JSGeneratorType, SpecObjectOther) \
+    macro(JSAsyncFunctionGeneratorType, SpecObjectOther) \
     macro(JSAsyncGeneratorType, SpecObjectOther) \
@@ -168,7 +171,7 @@ enum JSType : uint8_t {
-static constexpr uint32_t LastMaybeFalsyCellPrimitive = HeapBigIntType;
+static constexpr uint32_t LastValueCompareCellType = HeapBigIntType;

Promise / async-function fast path work

A coordinated batch of patches replacing JS-builtin promise plumbing with C++ InternalMicrotask plumbing and removing per-await/per-element allocations. Combined effect: large reductions in object allocation and promise-resolution latency.

• 8f742098b444 — Inlined InternalMicrotask reaction: a pending JSPromise can carry a single InternalMicrotask reaction (task id + context + cell) directly in its m_packed / m_slot fields instead of allocating a JSSlimPromiseReaction.
• c3276f48dfd6 — Optimize the initial then call path for plain promises.
• cdf77b6570ff — Cache isDefinitelyNonThenable result on Structure; avoids re-walking the prototype chain for the same shape.
• b1a624172673 — Inline allocation for Promise.resolve() of a non-thenable object.
• c71210975aaf — Avoid creating both first resolving functions when only one is needed in Promise.all / Promise.any.
• 0f6a35669fa8 — Avoid per-element JSPromiseCombinatorsContext allocation in promise combinators.
• 4ed24b821a12 — Skip intermediate promise allocation for non-thenable elements in Promise combinators.
• e0704d3127d5 — JSGenerator shrink + JSAsyncFunctionGenerator split (see above).

DFG / FTL / JIT

• b07dca9615f1 — GetByStatus::computeFor should not walk the proto chain for direct property access (bug 309519).
• fb8bfead603e — Fix incorrect side-effect modeling for Spread(SetObjectUse) in the DFG abstract interpreter (bug 315132).
• c415e39f485b — Introduce private tmp mechanism in DFG ByteCodeParser (bug 315173).
• 1aeca6948c89 — DFG abstract interpreter misclassifies ArraySortCompact result as SpecObjectOther (bug 315143).
• 227528432e5f — Collect profiles from Baseline JIT compiler when transitioning LLInt → Baseline (bug 315183).
• 7429d22f2bfd — Fix DFG CPS validation for inlined sort comparator (bug 315144).
• d53865edf63b — Add new DateNow DFG node (bug 315065).
• 596590000220 — Implement DFG / FTL ArrayUnshift (bug 315068).
• dfe5dc6ed106 — Implement ArrayShift DFG node (bug 314926).
• 953bc0380f0b — Add missing ExitOK after constant folding then (bug 315042).
• 4d1b8f9f75bb — Add StringSubstr DFG node (bug 314921).
• 67969621f703 — Inline String#startsWith / String#endsWith with constant search string in DFG/FTL (bug 314517).
• ce3942e437cb — Extend megamorphic ByVal IC with symbols (bug 314890).
• 8f52a29461ca — Optimize === (stricteq) with non-String / non-HeapBigInt cells; uses the new LastValueCompareCellType boundary (bug 314855).
• 59a20ddcb9ca — Use scratch buffer for ObjectDefinePropertyFromFields (bug 315074).

Runtime / interpreter

• 1440f8619f82 — Implement String#match in C++ (bug 314466).
• f9477aedc258 — Compare 8-bit strings a word at a time in Array#indexOf / Array#includes (bug 314877).
• a3aa7524f30f — Use truncateDoubleToInt32/64() in more round-trip double-to-int checks (bug 314884). Touches TypedArrayAdaptors.h.
• 8608a8ac3b20 — Fix test262 failure in TypedArray/constructor-buffer-sequence.js (bug 313927).
• 918d694777b9 — Fix / update iterator return function call's arguments (bug 315095).
• 72272dcc4feb — ScopedArgumentsTable ScopeOffset buffer should allocate from fastMalloc (bug 315082).
• 83e85f875a70 — Simplify bytecode writer (bug 314878). InstructionStream.h now includes <wtf/UnalignedAccess.h> directly.
• 3c73fbe0cf5d — Shard JSTypedArrayViewPrototype host functions across @no-unify translation units (bug 313968).

Modules

• 7f062965e945 — Implement dynamic import.defer() semantics (bug 314794). See API changes above.
• 4d67159942bc — Use OrderedHashMap for module ImportEntries / ExportEntries so error reporting is deterministic (bug 314961).

Temporal

• 7f9fbe74e492 — Fix fractionToDouble for large denominators; consolidate ZonedDateTime diff (bug 314848).
• 20ca333f3a4d — Add duration rounding, calendar field resolution, and date-time difference algorithms (bug 314765).

Wasm

• ca0c6bb18657 — JS wrappers for Wasm Tables created lazily (bug 314958).
• 29ac32293df6 — Build JS wrappers and JSToWasmCallees lazily (bug 314910).
• 280445b02587 — Address an unexpected safer-cpp failure in WasmConstExprGenerator.cpp.

WTF / build infrastructure

• 368c0bec7652 — Introduce WTF::toArray() to work around std::to_array() not being detected as NODELETE by static analysis (bug 313933). Many files migrated by 97bbefac03a5.
• 097a8276c97a — Simplify WTF::Variant (build-speed work, bug 315055).
• 912cfd18d9b4 — [Win] OSAllocator::tryProtect fails when memory spans multiple reserved regions (bug 315080).
• b15055c7b0ed — Update / fix Lock/Condition performance test binaries (bug 315171).
• 6cfb79671c10 — [CMake] Touching a WTF .cpp no longer triggers an 11-second LLInt rebuild (bug 315226).
• 5780e754ea9b — [CMake] Standardize -Wunsafe-buffer-usage flags (bug 314991).
• 13415f9ed9f3 — Remove -fsafe-buffer-usage-suggestions (bug 314917).
• 99f0b44bc5ce — [CMake] Fix some Linux builds with precompiled headers (bug 314763).
• c1f868200266 / f31bec07e0e3 / 67ab82bd25dc — Swift-in-WTF interop work (parts 4), with one revert/reland cycle (bug 314469 / 315224 / 315166).
• f1e8bc403871 / 286cd2780073 — WTF module-verification fixes for some configurations (bugs 314977, 314858).
• 94043d8f9138 / b035254290ed — Suppress new Clang-22 -Wunsafe-buffer-usage warnings on GTK/WPE.
• e6f4d3c2b495 — Adopt ReducedResolutionSeconds more widely (bug 314722).
• dc311bb8313d — [Win] Enable MemoryPressureHandlerWin and implement a low-memory watcher (bug 297533).

Cleanup / removal

• 3bb4fc93fb37 — Remove JSHeapInt32 / JSHeapDouble (experimental 32-bit-JSValues boxing). Drops two JSType enum values and two IsoSubspaces.
• 85bcefbc014c — Fix a few more missing includes (bug 314821).
• 85015722cb65 — Fix a stray -Wunsafe-buffer-usage pragma that accidentally disabled the check (bug 314771).

Not relevant to Bun's JSCOnly build

• b958a2407b33 — Order files for WebCore/JSC on macOS framework builds.
• 2bfe8aece710 — Site Isolation Web Inspector network ID changes (mostly WebCore/WebKit2).
• 8e1c6277f598 / 6c766638e894 / f34545487d2f — Threaded time-based animations toggling.
• f3d2e2f2ea01 — GTK/WPE skia compositor default.
• 02ee8d8ba70b, 79003b865f9f, 8f1f5a27db3d, 56a1500e4215, 761dfab7357a, d47452669e1a, 3784776034f9, 39d4ce1f12ea — Cocoa/visionOS/sandbox/HDR/AVCapture/MTE platform work.
• 5a256540dbde, 17c8e7383a38, fb6c928ed4b3, 3ab6c7c73f9a, 3cef60980461 — iOS/watchOS/tvOS SDK build fixes and reverts.

[robobun]

^{Updated 8:50 AM PT - May 22nd, 2026}

❌ @sosukesuzuki, your commit c1d32a3 has 2 failures in Build #56867 (All Failures):

• test/js/node/http/node-http-backpressure-max.test.ts - code 1 on 🍎 14 x64
• test/js/node/http/node-http-backpressure.test.ts - SIGKILL on 🐧 25.04 x64
• test/js/node/http/node-http-backpressure.test.ts - SIGKILL on 🐧 13 x64
• test/js/node/http/node-http-backpressure.test.ts - SIGKILL on 🐧 25.04 x64-baseline
• test/js/node/http/node-http-backpressure.test.ts - SIGKILL on 🐧 13 x64-baseline

---

🧪   To try this PR locally:

bunx bun-pr 31169

That installs a local version of the PR into your bun-31169 executable, so you can run:

bun-31169 --bun

[github-actions]

Found 5 issues this PR may fix:

1. Async generator function are not properly identified in console.log #18324 - New AsyncFunctionGenerator JSType directly addresses async generator function identification in console.log
2. Temporal support (TC39 stage 3 proposal) #15853 - Upstream WebKit commits include Temporal API improvements
3. Async stack traces not produced within AsyncLocalStorage #24003 - Async stack trace collection code updated from JSGenerator to JSAsyncFunctionGenerator, improving async stack frame walking
4. incomplete async stack trace for error thrown from then callback #23760 - Same async stack trace code changes may fix incomplete traces from then callbacks
5. Insufficient traceback in async closures incompatible with node #10483 - Same async stack trace improvements may fix insufficient tracebacks in async closures

If this is helpful, copy the block below into the PR description to auto-close these issues on merge.

Fixes #18324
Fixes #15853
Fixes #24003
Fixes #23760
Fixes #10483

🤖 Generated with Claude Code

[github-actions]

This PR may be a duplicate of:

1. [RETEST] WebKit a497d59689e4 full upgrade (verify original failure was real) #29625 - Also a full WebKit upgrade PR (to commit a497d59689e4) that would be superseded by this newer upgrade to 39d4ce1f12ea

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Walkthrough

This PR updates the JSType runtime type system discriminants, changes symbol representation to use uid identifiers, adds a deferred flag to cross-context module loader hooks, refactors async stack trace collection for async generators, and bumps the WebKit build version.

Changes

Runtime Type System and Symbol Representation

Layer / File(s)	Summary
JSType discriminant renumbering src/jsc/JSType.rs	Symbol moves to JSType(4), HeapDouble and HeapInt32 are removed, GetterSetter is introduced at JSType(5), and all subsequent object, function, executable, arguments, array, iterator, and WebAssembly-related types receive new discriminant values throughout the taxonomy.
Symbol uid-based representation src/jsc/bindings/ErrorCode.cpp, src/jsc/bindings/ZigException.cpp, src/jsc/bindings/bindings.cpp	Symbol-to-string conversions in JSValueToStringSafe and exceptionFromString now check and use symbol uid instead of description(). The bindings getSymbolDescription API is updated to return uid when non-null and non-empty.
Async stack trace collection refactor src/jsc/bindings/bindings.cpp	Async stack trace logic switches from JSGenerator to JSAsyncFunctionGenerator. The unwrapGeneratorFromContext helper returns JSAsyncFunctionGenerator*, promise-chain walking follows payloadCell when no async generator is found, bytecode-index computation reads from JSAsyncFunctionGenerator state, and appendFrame parameter type is updated.
Module loader deferred parameter src/jsc/bindings/NodeVM.cpp, src/jsc/bindings/NodeVM.h, src/jsc/bindings/ZigGlobalObject.cpp, src/jsc/bindings/ZigGlobalObject.h, src/runtime/bake/BakeGlobalObject.cpp	The moduleLoaderImportModule hook signature is extended across all global object implementations to accept a bool deferred parameter. Call sites pass false when invoking the loader.
WebKit version update scripts/build/deps/webkit.ts	WEBKIT_VERSION constant is updated to a new WebKit commit hash for artifact downloads.

Possibly related PRs

• oven-sh/bun#22499: Updates WebKit build dependency version in cmake/tools/SetupWebKit.cmake as part of WebKit upgrade work.
• oven-sh/bun#30705: Part of the same WebKit upgrade and JSType discriminant renumbering effort.

Suggested reviewers

• alii
• Jarred-Sumner

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Upgrade WebKit to 39d4ce1f12ea' directly matches the PR's main objective of upgrading the WebKit version to a specific upstream commit.
Description check	✅ Passed	The PR description exceeds the template requirements with comprehensive detail about what the upgrade does and how it was verified, but the template structure is not explicitly followed.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

I didn't find any issues in the binding adaptations, but a WebKit upgrade of this scope (JSType renumbering, JSGenerator→JSAsyncFunctionGenerator split, module loader signature changes, new inline-reaction promise-chain walking) warrants a human pass.

Extended reasoning...

Overview

This PR upgrades Bun's WebKit fork by ~422 upstream commits and adapts Bun's embedder bindings to the resulting ABI changes. The Bun-side diff touches: the WEBKIT_VERSION pin, the Rust JSType enum mirror (renumbered after HeapDouble/HeapInt32 removal and AsyncFunctionGenerator insertion), the async-stack-frame collector in bindings.cpp (migrated from JSGenerator to JSAsyncFunctionGenerator and extended to follow the new inline-reaction payloadCell() promise chain), three moduleLoaderImportModule overrides plus call sites (new trailing bool deferred param), and three Symbol::description() call sites rewritten to go through symbol->uid() directly.

Security risks

No new attack surface is introduced by the Bun-side adaptations themselves — they are signature/type adjustments to match upstream. The underlying risk is the engine swap itself: ~80 JSC/WTF/bmalloc commits including JIT changes, promise fast-path rewrites, and a JSType renumbering. A mis-numbered JSType constant or incorrect downcast would manifest as type confusion. I spot-checked the renumbering against the description's JSType.h diff and it looks consistent (−2 after HeapBigInt, +1 after Generator, net −1 from AsyncGenerator onward).

Level of scrutiny

High. WebKit upgrades are among the most consequential changes in this repo — they replace the JS engine and any binding mismatch can cause memory corruption or silent miscompilation. The collectAsyncStackFramesFromPromise change in particular adds new logic (following payloadCell() through the inline-microtask reaction) rather than being a pure mechanical port, and the JSType.rs renumbering is hand-maintained rather than generated.

Other factors

CI is mostly green (the two node-http-backpressure failures look like known flakes unrelated to this diff). The PR description notes WEBKIT_VERSION was on a preview build pending the fork-PR merge; the latest commit bumps it to a real hash, which someone should confirm corresponds to the merged oven-sh/WebKit#236. The LAST_MAYBE_FALSY_CELL_PRIMITIVE constant in JSType.rs was left under its old name (upstream renamed it to LastValueCompareCellType) but its value is unchanged, so that's cosmetic only.