diff --git a/scripts/build/deps/webkit.ts b/scripts/build/deps/webkit.ts
index c47ae1ba6d03..982088651f91 100644
--- a/scripts/build/deps/webkit.ts
+++ b/scripts/build/deps/webkit.ts
@@ -7,7 +7,7 @@
 // -lto variants built with ThinLTO (per-module summaries for cross-language
 // importing), and the Windows ICU data table filtered + per-item zstd
 // compressed (lazily decompressed via bun_icu_decompress.cpp).
-export const WEBKIT_VERSION = "6d586e293f008f0e74e5697611a379b1b24815c9";
+export const WEBKIT_VERSION = "9cb85a0716065c461bea14a0de9fe7139e5323aa";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.
diff --git a/src/jsc/JSType.rs b/src/jsc/JSType.rs
index 991eb2639069..a4b95c84605f 100644
--- a/src/jsc/JSType.rs
+++ b/src/jsc/JSType.rs
@@ -230,20 +230,23 @@ impl JSType {
     /// JSModuleLoader cell type (new C++ module loader).
     pub const JSModuleLoader: JSType = JSType(31);
 
+    /// Sentinel cell used by ordered hash table iteration.
+    pub const Sentinel: JSType = JSType(32);
+
     /// Base JavaScript object type.
     /// ```js
     /// {}
     /// new Object()
     /// ```
-    pub const Object: JSType = JSType(32);
+    pub const Object: JSType = JSType(33);
 
     /// Optimized object type for object literals with fixed properties.
     /// ```js
     /// { a: 1, b: 2 }
     /// ```
-    pub const FinalObject: JSType = JSType(33);
+    pub const FinalObject: JSType = JSType(34);
 
-    pub const JSCallee: JSType = JSType(34);
+    pub const JSCallee: JSType = JSType(35);
 
     /// JavaScript function object created from JavaScript source code.
     /// ```js
@@ -253,7 +256,7 @@ impl JSType {
     ///   method() {}
     /// }
     /// ```
-    pub const JSFunction: JSType = JSType(35);
+    pub const JSFunction: JSType = JSType(36);
 
     /// Built-in function implemented in native code.
     /// ```js
@@ -262,23 +265,23 @@ impl JSType {
     /// parseInt
     /// console.log
     /// ```
-    pub const InternalFunction: JSType = JSType(36);
+    pub const InternalFunction: JSType = JSType(37);
 
-    pub const NullSetterFunction: JSType = JSType(37);
+    pub const NullSetterFunction: JSType = JSType(38);
 
     /// Boxed Boolean object.
     /// ```js
     /// new Boolean(true)
     /// new Boolean(false)
     /// ```
-    pub const BooleanObject: JSType = JSType(38);
+    pub const BooleanObject: JSType = JSType(39);
 
     /// Boxed Number object.
     /// ```js
     /// new Number(42)
     /// new Number(3.14)
     /// ```
-    pub const NumberObject: JSType = JSType(39);
+    pub const NumberObject: JSType = JSType(40);
 
     /// JavaScript Error object and its subclasses.
     /// ```js
@@ -286,9 +289,9 @@ impl JSType {
     /// new TypeError()
     /// throw new RangeError()
     /// ```
-    pub const ErrorInstance: JSType = JSType(40);
+    pub const ErrorInstance: JSType = JSType(41);
 
-    pub const GlobalProxy: JSType = JSType(41);
+    pub const GlobalProxy: JSType = JSType(42);
 
     /// Arguments object for function parameters.
     /// ```js
@@ -297,10 +300,10 @@ impl JSType {
     ///   console.log(arguments.length);
     /// }
     /// ```
-    pub const DirectArguments: JSType = JSType(42);
+    pub const DirectArguments: JSType = JSType(43);
 
-    pub const ScopedArguments: JSType = JSType(43);
-    pub const ClonedArguments: JSType = JSType(44);
+    pub const ScopedArguments: JSType = JSType(44);
+    pub const ClonedArguments: JSType = JSType(45);
 
     /// JavaScript Array object.
     /// ```js
@@ -309,94 +312,94 @@ impl JSType {
     /// new Array(10)
     /// Array.from(iterable)
     /// ```
-    pub const Array: JSType = JSType(45);
+    pub const Array: JSType = JSType(46);
 
     /// Array subclass created through class extension.
     /// ```js
     /// class MyArray extends Array {}
     /// const arr = new MyArray();
     /// ```
-    pub const DerivedArray: JSType = JSType(46);
+    pub const DerivedArray: JSType = JSType(47);
 
     /// ArrayBuffer for binary data storage.
     /// ```js
     /// new ArrayBuffer(1024)
     /// ```
-    pub const ArrayBuffer: JSType = JSType(47);
+    pub const ArrayBuffer: JSType = JSType(48);
 
     /// Typed array for 8-bit signed integers.
     /// ```js
     /// new Int8Array(buffer)
     /// new Int8Array([1, -1, 127])
     /// ```
-    pub const Int8Array: JSType = JSType(48);
+    pub const Int8Array: JSType = JSType(49);
 
     /// Typed array for 8-bit unsigned integers.
     /// ```js
     /// new Uint8Array(buffer)
     /// new Uint8Array([0, 255])
     /// ```
-    pub const Uint8Array: JSType = JSType(49);
+    pub const Uint8Array: JSType = JSType(50);
 
     /// Typed array for 8-bit unsigned integers with clamping.
     /// ```js
     /// new Uint8ClampedArray([0, 300]) // 300 becomes 255
     /// ```
-    pub const Uint8ClampedArray: JSType = JSType(50);
+    pub const Uint8ClampedArray: JSType = JSType(51);
 
     /// Typed array for 16-bit signed integers.
     /// ```js
     /// new Int16Array(buffer)
     /// ```
-    pub const Int16Array: JSType = JSType(51);
+    pub const Int16Array: JSType = JSType(52);
 
     /// Typed array for 16-bit unsigned integers.
     /// ```js
     /// new Uint16Array(buffer)
     /// ```
-    pub const Uint16Array: JSType = JSType(52);
+    pub const Uint16Array: JSType = JSType(53);
 
     /// Typed array for 32-bit signed integers.
     /// ```js
     /// new Int32Array(buffer)
     /// ```
-    pub const Int32Array: JSType = JSType(53);
+    pub const Int32Array: JSType = JSType(54);
 
     /// Typed array for 32-bit unsigned integers.
     /// ```js
     /// new Uint32Array(buffer)
     /// ```
-    pub const Uint32Array: JSType = JSType(54);
+    pub const Uint32Array: JSType = JSType(55);
 
     /// Typed array for 16-bit floating point numbers.
     /// ```js
     /// new Float16Array(buffer)
     /// ```
-    pub const Float16Array: JSType = JSType(55);
+    pub const Float16Array: JSType = JSType(56);
 
     /// Typed array for 32-bit floating point numbers.
     /// ```js
     /// new Float32Array(buffer)
     /// ```
-    pub const Float32Array: JSType = JSType(56);
+    pub const Float32Array: JSType = JSType(57);
 
     /// Typed array for 64-bit floating point numbers.
     /// ```js
     /// new Float64Array(buffer)
     /// ```
-    pub const Float64Array: JSType = JSType(57);
+    pub const Float64Array: JSType = JSType(58);
 
     /// Typed array for 64-bit signed BigInt values.
     /// ```js
     /// new BigInt64Array([123n, -456n])
     /// ```
-    pub const BigInt64Array: JSType = JSType(58);
+    pub const BigInt64Array: JSType = JSType(59);
 
     /// Typed array for 64-bit unsigned BigInt values.
     /// ```js
     /// new BigUint64Array([123n, 456n])
     /// ```
-    pub const BigUint64Array: JSType = JSType(59);
+    pub const BigUint64Array: JSType = JSType(60);
 
     /// DataView for flexible binary data access.
     /// ```js
@@ -404,7 +407,7 @@ impl JSType {
     /// view.getInt32(0)
     /// view.setFloat64(8, 3.14)
     /// ```
-    pub const DataView: JSType = JSType(60);
+    pub const DataView: JSType = JSType(61);
 
     /// Global object containing all global variables and functions.
     /// ```js
@@ -412,12 +415,12 @@ impl JSType {
     /// window // in browsers
     /// global // in Node.js
     /// ```
-    pub const GlobalObject: JSType = JSType(61);
+    pub const GlobalObject: JSType = JSType(62);
 
-    pub const GlobalLexicalEnvironment: JSType = JSType(62);
-    pub const LexicalEnvironment: JSType = JSType(63);
-    pub const ModuleEnvironment: JSType = JSType(64);
-    pub const StrictEvalActivation: JSType = JSType(65);
+    pub const GlobalLexicalEnvironment: JSType = JSType(63);
+    pub const LexicalEnvironment: JSType = JSType(64);
+    pub const ModuleEnvironment: JSType = JSType(65);
+    pub const StrictEvalActivation: JSType = JSType(66);
 
     /// Scope object for with statements.
     /// ```js
@@ -425,19 +428,19 @@ impl JSType {
     ///   prop; // looks up prop in obj first
     /// }
     /// ```
-    pub const WithScope: JSType = JSType(66);
+    pub const WithScope: JSType = JSType(67);
 
-    pub const AsyncDisposableStack: JSType = JSType(67);
-    pub const DisposableStack: JSType = JSType(68);
+    pub const AsyncDisposableStack: JSType = JSType(68);
+    pub const DisposableStack: JSType = JSType(69);
 
     /// Namespace object for ES6 modules.
     /// ```js
     /// import * as ns from 'module';
     /// ns.exportedFunction()
     /// ```
-    pub const ModuleNamespaceObject: JSType = JSType(69);
+    pub const ModuleNamespaceObject: JSType = JSType(70);
 
-    pub const ShadowRealm: JSType = JSType(70);
+    pub const ShadowRealm: JSType = JSType(71);
 
     /// Regular expression object.
     /// ```js
@@ -445,7 +448,7 @@ impl JSType {
     /// new RegExp('pattern', 'flags')
     /// /abc/gi
     /// ```
-    pub const RegExpObject: JSType = JSType(71);
+    pub const RegExpObject: JSType = JSType(72);
 
     /// JavaScript Date object for date/time operations.
     /// ```js
@@ -453,7 +456,7 @@ impl JSType {
     /// new Date('2023-01-01')
     /// Date.now()
     /// ```
-    pub const JSDate: JSType = JSType(72);
+    pub const JSDate: JSType = JSType(73);
 
     /// Proxy object that intercepts operations on another object.
     /// ```js
@@ -461,7 +464,7 @@ impl JSType {
     ///   get(obj, prop) { return obj[prop]; }
     /// })
     /// ```
-    pub const ProxyObject: JSType = JSType(73);
+    pub const ProxyObject: JSType = JSType(74);
 
     /// Generator object created by generator functions.
     /// ```js
@@ -469,10 +472,10 @@ impl JSType {
     /// const g = gen();
     /// g.next()
     /// ```
-    pub const Generator: JSType = JSType(74);
+    pub const Generator: JSType = JSType(75);
 
     /// Async function generator object (split from JSGenerator in WebKit ~May 2026 to shrink sizeof(JSGenerator)).
-    pub const AsyncFunctionGenerator: JSType = JSType(75);
+    pub const AsyncFunctionGenerator: JSType = JSType(76);
 
     /// Async generator object for asynchronous iteration.
     /// ```js
@@ -480,17 +483,17 @@ impl JSType {
     ///   yield await promise;
     /// }
     /// ```
-    pub const AsyncGenerator: JSType = JSType(76);
+    pub const AsyncGenerator: JSType = JSType(77);
 
     /// Iterator for Array objects.
     /// ```js
     /// [1,2,3][Symbol.iterator]()
     /// for (const x of array) {}
     /// ```
-    pub const JSArrayIterator: JSType = JSType(77);
+    pub const JSArrayIterator: JSType = JSType(78);
 
-    pub const Iterator: JSType = JSType(78);
-    pub const IteratorHelper: JSType = JSType(79);
+    pub const Iterator: JSType = JSType(79);
+    pub const IteratorHelper: JSType = JSType(80);
 
     /// Iterator for Map objects.
     /// ```js
@@ -499,32 +502,32 @@ impl JSType {
     /// map.entries()
     /// for (const [k,v] of map) {}
     /// ```
-    pub const MapIterator: JSType = JSType(80);
+    pub const MapIterator: JSType = JSType(81);
 
     /// Iterator for Set objects.
     /// ```js
     /// set.values()
     /// for (const value of set) {}
     /// ```
-    pub const SetIterator: JSType = JSType(81);
+    pub const SetIterator: JSType = JSType(82);
 
     /// Iterator for String objects.
     /// ```js
     /// 'hello'[Symbol.iterator]()
     /// for (const char of string) {}
     /// ```
-    pub const StringIterator: JSType = JSType(82);
+    pub const StringIterator: JSType = JSType(83);
 
-    pub const WrapForValidIterator: JSType = JSType(83);
+    pub const WrapForValidIterator: JSType = JSType(84);
 
     /// Iterator for RegExp string matching.
     /// ```js
     /// 'abc'.matchAll(/./g)
     /// for (const match of string.matchAll(regex)) {}
     /// ```
-    pub const RegExpStringIterator: JSType = JSType(84);
+    pub const RegExpStringIterator: JSType = JSType(85);
 
-    pub const AsyncFromSyncIterator: JSType = JSType(85);
+    pub const AsyncFromSyncIterator: JSType = JSType(86);
 
     /// JavaScript Promise object for asynchronous operations.
     /// ```js
@@ -532,7 +535,7 @@ impl JSType {
     /// Promise.resolve(42)
     /// async function foo() { await promise; }
     /// ```
-    pub const JSPromise: JSType = JSType(86);
+    pub const JSPromise: JSType = JSType(87);
 
     /// JavaScript Map object for key-value storage.
     /// ```js
@@ -540,7 +543,7 @@ impl JSType {
     /// map.set(key, value)
     /// map.get(key)
     /// ```
-    pub const Map: JSType = JSType(87);
+    pub const Map: JSType = JSType(88);
 
     /// JavaScript Set object for unique value storage.
     /// ```js
@@ -548,34 +551,34 @@ impl JSType {
     /// set.add(value)
     /// set.has(value)
     /// ```
-    pub const Set: JSType = JSType(88);
+    pub const Set: JSType = JSType(89);
 
     /// WeakMap for weak key-value references.
     /// ```js
     /// new WeakMap()
     /// weakMap.set(object, value)
     /// ```
-    pub const WeakMap: JSType = JSType(89);
+    pub const WeakMap: JSType = JSType(90);
 
     /// WeakSet for weak value references.
     /// ```js
     /// new WeakSet()
     /// weakSet.add(object)
     /// ```
-    pub const WeakSet: JSType = JSType(90);
+    pub const WeakSet: JSType = JSType(91);
 
-    pub const WebAssemblyModule: JSType = JSType(91);
-    pub const WebAssemblyInstance: JSType = JSType(92);
-    pub const WebAssemblyGCObject: JSType = JSType(93);
+    pub const WebAssemblyModule: JSType = JSType(92);
+    pub const WebAssemblyInstance: JSType = JSType(93);
+    pub const WebAssemblyGCObject: JSType = JSType(94);
 
     /// Boxed String object.
     /// ```js
     /// new String("hello")
     /// ```
-    pub const StringObject: JSType = JSType(94);
+    pub const StringObject: JSType = JSType(95);
 
-    pub const DerivedStringObject: JSType = JSType(95);
-    pub const InternalFieldTuple: JSType = JSType(96);
+    pub const DerivedStringObject: JSType = JSType(96);
+    pub const InternalFieldTuple: JSType = JSType(97);
 
     pub const MaxJS: JSType = JSType(0b11111111);
     pub const Event: JSType = JSType(0b11101111);
diff --git a/src/jsc/bindings/BunAnalyzeTranspiledModule.cpp b/src/jsc/bindings/BunAnalyzeTranspiledModule.cpp
index baa7ad395ac6..71538245abbd 100644
--- a/src/jsc/bindings/BunAnalyzeTranspiledModule.cpp
+++ b/src/jsc/bindings/BunAnalyzeTranspiledModule.cpp
@@ -169,7 +169,7 @@ extern "C" EncodedJSValue Bun__analyzeTranspiledModule(JSGlobalObject* globalObj
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     auto rejectWithError = [&](JSValue error) {
-        promise->reject(vm, globalObject, error);
+        promise->reject(vm, error);
         return promise;
     };
 
@@ -208,7 +208,7 @@ static EncodedJSValue fallbackParse(JSGlobalObject* globalObject, const Identifi
     VM& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
     auto rejectWithError = [&](JSValue error) {
-        promise->reject(vm, globalObject, error);
+        promise->reject(vm, error);
         return promise;
     };
 
@@ -221,7 +221,7 @@ static EncodedJSValue fallbackParse(JSGlobalObject* globalObject, const Identifi
     ASSERT(moduleProgramNode);
 
     ModuleAnalyzer moduleAnalyzer(globalObject, moduleKey, sourceCode, moduleProgramNode->varDeclarations(), moduleProgramNode->lexicalVariables(), moduleProgramNode->features());
-    RETURN_IF_EXCEPTION(scope, JSValue::encode(promise->rejectWithCaughtException(globalObject, scope)));
+    RETURN_IF_EXCEPTION(scope, JSValue::encode(promise->rejectWithCaughtException(vm, scope)));
 
     auto result = moduleAnalyzer.analyze(*moduleProgramNode);
     if (!result) {
diff --git a/src/jsc/bindings/JSBundlerPlugin.cpp b/src/jsc/bindings/JSBundlerPlugin.cpp
index af79303c095d..ec33783d466e 100644
--- a/src/jsc/bindings/JSBundlerPlugin.cpp
+++ b/src/jsc/bindings/JSBundlerPlugin.cpp
@@ -675,7 +675,7 @@ extern "C" void JSBundlerPlugin__drainDeferred(Bun::JSBundlerPlugin* pluginObjec
     for (auto promiseValue : arguments) {
         JSPromise* promise = uncheckedDowncast<JSPromise>(promiseValue);
         if (rejected) {
-            promise->reject(vm, globalObject, JSC::jsUndefined());
+            promise->reject(vm, JSC::jsUndefined());
         } else {
             promise->resolve(globalObject, vm, JSC::jsUndefined());
         }
diff --git a/src/jsc/bindings/JSFFIFunction.cpp b/src/jsc/bindings/JSFFIFunction.cpp
index d03353812655..cbe3a0f2d373 100644
--- a/src/jsc/bindings/JSFFIFunction.cpp
+++ b/src/jsc/bindings/JSFFIFunction.cpp
@@ -150,18 +150,12 @@ void JSFFIFunction::visitChildrenImpl(JSCell* cell, Visitor& visitor)
 
 DEFINE_VISIT_CHILDREN(JSFFIFunction);
 
-void JSFFIFunction::finishCreation(VM& vm, NativeExecutable* executable, unsigned length, const String& name)
-{
-    Base::finishCreation(vm, executable, length, name);
-    ASSERT(inherits(info()));
-}
-
 JSFFIFunction* JSFFIFunction::create(VM& vm, Zig::GlobalObject* globalObject, unsigned length, const String& name, FFIFunction FFIFunction, Intrinsic intrinsic, NativeFunction nativeConstructor)
 {
-    NativeExecutable* executable = vm.getHostFunction(FFIFunction, ImplementationVisibility::Public, intrinsic, FFIFunction, nullptr, name);
+    NativeExecutable* executable = vm.getHostFunction(FFIFunction, ImplementationVisibility::Public, intrinsic, FFIFunction, nullptr, length, name);
     Structure* structure = globalObject->FFIFunctionStructure();
     JSFFIFunction* function = new (NotNull, allocateCell<JSFFIFunction>(vm)) JSFFIFunction(vm, executable, globalObject, structure, reinterpret_cast<CFFIFunction>(WTF::move(FFIFunction)));
-    function->finishCreation(vm, executable, length, name);
+    function->finishCreation(vm);
     return function;
 }
 
@@ -178,13 +172,13 @@ JSC_DEFINE_HOST_FUNCTION(JSFFIFunction::trampoline, (JSC::JSGlobalObject * globa
 JSFFIFunction* JSFFIFunction::createForFFI(VM& vm, Zig::GlobalObject* globalObject, unsigned length, const String& name, CFFIFunction FFIFunction)
 {
 #if OS(WINDOWS)
-    NativeExecutable* executable = vm.getHostFunction(trampoline, ImplementationVisibility::Public, NoIntrinsic, trampoline, nullptr, name);
+    NativeExecutable* executable = vm.getHostFunction(trampoline, ImplementationVisibility::Public, NoIntrinsic, trampoline, nullptr, length, name);
 #else
-    NativeExecutable* executable = vm.getHostFunction(FFIFunction, ImplementationVisibility::Public, NoIntrinsic, FFIFunction, nullptr, name);
+    NativeExecutable* executable = vm.getHostFunction(FFIFunction, ImplementationVisibility::Public, NoIntrinsic, FFIFunction, nullptr, length, name);
 #endif
     Structure* structure = globalObject->FFIFunctionStructure();
     JSFFIFunction* function = new (NotNull, allocateCell<JSFFIFunction>(vm)) JSFFIFunction(vm, executable, globalObject, structure, reinterpret_cast<CFFIFunction>(WTF::move(FFIFunction)));
-    function->finishCreation(vm, executable, length, name);
+    function->finishCreation(vm);
     return function;
 }
 
diff --git a/src/jsc/bindings/JSFFIFunction.h b/src/jsc/bindings/JSFFIFunction.h
index 6eccae7b6174..fde3e215adbf 100644
--- a/src/jsc/bindings/JSFFIFunction.h
+++ b/src/jsc/bindings/JSFFIFunction.h
@@ -91,7 +91,6 @@ class JSFFIFunction final : public JSC::JSFunction {
 
 private:
     JSFFIFunction(VM&, NativeExecutable*, JSGlobalObject*, Structure*, CFFIFunction&&);
-    void finishCreation(VM&, NativeExecutable*, unsigned length, const String& name);
     DECLARE_VISIT_CHILDREN;
 
     CFFIFunction m_function;
diff --git a/src/jsc/bindings/JSSecrets.cpp b/src/jsc/bindings/JSSecrets.cpp
index 2d4e9feb3764..39a7e8904fae 100644
--- a/src/jsc/bindings/JSSecrets.cpp
+++ b/src/jsc/bindings/JSSecrets.cpp
@@ -281,7 +281,7 @@ void Bun__SecretsJobOptions__runFromJS(SecretsJobOptions* opts, JSGlobalObject*
         }
         JSValue error = opts->error.toJS(vm, global);
         RETURN_IF_EXCEPTION(scope, );
-        RELEASE_AND_RETURN(scope, promise->reject(vm, global, error));
+        RELEASE_AND_RETURN(scope, promise->reject(vm, error));
     } else {
         // Success cases
         JSValue result;
diff --git a/src/jsc/bindings/JSWrappingFunction.cpp b/src/jsc/bindings/JSWrappingFunction.cpp
index 2b35c618e96e..57f53d111b23 100644
--- a/src/jsc/bindings/JSWrappingFunction.cpp
+++ b/src/jsc/bindings/JSWrappingFunction.cpp
@@ -31,23 +31,17 @@ JS_EXPORT_PRIVATE JSWrappingFunction* JSWrappingFunction::create(
     auto name = Identifier::fromString(vm, nameStr);
     // Pass callHostFunctionAsConstructor so `new` on the wrapper throws a
     // TypeError instead of jumping to a null native constructor.
-    NativeExecutable* executable = vm.getHostFunction(functionPointer, ImplementationVisibility::Public, callHostFunctionAsConstructor, nameStr);
+    NativeExecutable* executable = vm.getHostFunction(functionPointer, ImplementationVisibility::Public, callHostFunctionAsConstructor, 0, nameStr);
 
     // Structure* structure = globalObject->FFIFunctionStructure();
     Structure* structure = JSWrappingFunction::createStructure(vm, globalObject, globalObject->objectPrototype());
     JSWrappingFunction* function = new (NotNull, allocateCell<JSWrappingFunction>(vm)) JSWrappingFunction(vm, executable, globalObject, structure, wrappedFn);
     ASSERT(function->structure()->globalObject());
-    function->finishCreation(vm, executable, 0, nameStr);
+    function->finishCreation(vm);
 
     return function;
 }
 
-void JSWrappingFunction::finishCreation(VM& vm, NativeExecutable* executable, unsigned length, const String& name)
-{
-    Base::finishCreation(vm, executable, length, name);
-    ASSERT(inherits(info()));
-}
-
 template<typename Visitor>
 void JSWrappingFunction::visitChildrenImpl(JSCell* cell, Visitor& visitor)
 {
diff --git a/src/jsc/bindings/JSWrappingFunction.h b/src/jsc/bindings/JSWrappingFunction.h
index 5b2aec591ba3..18aa6d3aaeda 100644
--- a/src/jsc/bindings/JSWrappingFunction.h
+++ b/src/jsc/bindings/JSWrappingFunction.h
@@ -65,8 +65,6 @@ class JSWrappingFunction final : public JSC::JSFunction {
     {
     }
 
-    void finishCreation(JSC::VM&, JSC::NativeExecutable*, unsigned length, const String& name);
-
     DECLARE_VISIT_CHILDREN;
 
     JSC::WriteBarrier<JSC::JSObject> m_wrappedFn;
diff --git a/src/jsc/bindings/ModuleLoader.cpp b/src/jsc/bindings/ModuleLoader.cpp
index 30d7fe37d59b..7c5ba80bb6a3 100644
--- a/src/jsc/bindings/ModuleLoader.cpp
+++ b/src/jsc/bindings/ModuleLoader.cpp
@@ -74,14 +74,14 @@ static JSC::JSPromise* rejectedInternalPromise(JSC::JSGlobalObject* globalObject
     JSPromise* promise = JSPromise::create(vm, globalObject->promiseStructure());
     auto scope = DECLARE_THROW_SCOPE(vm);
     scope.throwException(globalObject, value);
-    return promise->rejectWithCaughtException(globalObject, scope);
+    return promise->rejectWithCaughtException(vm, scope);
 }
 
 static JSC::JSPromise* resolvedInternalPromise(JSC::JSGlobalObject* globalObject, JSC::JSValue value)
 {
     auto& vm = JSC::getVM(globalObject);
     JSPromise* promise = JSPromise::create(vm, globalObject->promiseStructure());
-    promise->fulfill(vm, globalObject, value);
+    promise->fulfill(vm, value);
     return promise;
 }
 
@@ -470,7 +470,7 @@ extern "C" void Bun__onFulfillAsyncModule(
     JSC::JSPromise* promise = uncheckedDowncast<JSC::JSPromise>(JSC::JSValue::decode(encodedPromiseValue));
 
     if (!res->success) {
-        RELEASE_AND_RETURN(scope, promise->reject(vm, globalObject, JSValue::decode(res->result.err.value)));
+        RELEASE_AND_RETURN(scope, promise->reject(vm, JSValue::decode(res->result.err.value)));
     }
 
     auto* specifierValue = Bun::toJS(globalObject, *specifier);
@@ -502,7 +502,7 @@ extern "C" void Bun__onFulfillAsyncModule(
             auto* exception = scope.exception();
             if (!vm.isTerminationException(exception)) {
                 (void)scope.tryClearException();
-                promise->reject(vm, globalObject, exception);
+                promise->reject(vm, exception);
                 scope.assertNoExceptionExceptTermination();
             }
         }
@@ -1247,7 +1247,7 @@ BUN_DEFINE_HOST_FUNCTION(jsFunctionOnLoadObjectResultResolve, (JSC::JSGlobalObje
         throwException(globalObject, scope, result);
     }
     if (scope.exception()) [[unlikely]] {
-        auto retValue = JSValue::encode(promise->rejectWithCaughtException(globalObject, scope));
+        auto retValue = JSValue::encode(promise->rejectWithCaughtException(vm, scope));
         pendingModule->internalField(2).set(vm, pendingModule, JSC::jsUndefined());
         return retValue;
     }
@@ -1267,7 +1267,7 @@ BUN_DEFINE_HOST_FUNCTION(jsFunctionOnLoadObjectResultReject, (JSC::JSGlobalObjec
     JSC::JSPromise* promise = pendingModule->internalPromise();
 
     pendingModule->internalField(2).set(vm, pendingModule, JSC::jsUndefined());
-    promise->reject(vm, globalObject, reason);
+    promise->reject(vm, reason);
 
     return JSValue::encode(reason);
 }
diff --git a/src/jsc/bindings/NapiClass.cpp b/src/jsc/bindings/NapiClass.cpp
index 37381160e7ef..19a0616fbf68 100644
--- a/src/jsc/bindings/NapiClass.cpp
+++ b/src/jsc/bindings/NapiClass.cpp
@@ -92,19 +92,19 @@ NapiClass* NapiClass::create(VM& vm, napi_env env, WTF::String name,
         NapiClass_ConstructorFunction<false>,
         ImplementationVisibility::Public,
         // for constructor call
-        NapiClass_ConstructorFunction<true>, name);
+        NapiClass_ConstructorFunction<true>, 0, name);
     Structure* structure = env->globalObject()->NapiClassStructure();
     NapiClass* napiClass = new (NotNull, allocateCell<NapiClass>(vm)) NapiClass(vm, executable, env, structure, data);
-    napiClass->finishCreation(vm, executable, name, constructor, data, property_count, properties);
+    napiClass->finishCreation(vm, name, constructor, data, property_count, properties);
     return napiClass;
 }
 
-void NapiClass::finishCreation(VM& vm, NativeExecutable* executable, const String& name, napi_callback constructor,
+void NapiClass::finishCreation(VM& vm, const String& name, napi_callback constructor,
     void* data,
     size_t property_count,
     const napi_property_descriptor* properties)
 {
-    Base::finishCreation(vm, executable, 0, name);
+    Base::finishCreation(vm);
     ASSERT(inherits(info()));
     this->m_constructor = constructor;
     auto globalObject = static_cast<Zig::GlobalObject*>(this->globalObject());
diff --git a/src/jsc/bindings/NodeVM.cpp b/src/jsc/bindings/NodeVM.cpp
index 3c51d04db600..910a4f392fef 100644
--- a/src/jsc/bindings/NodeVM.cpp
+++ b/src/jsc/bindings/NodeVM.cpp
@@ -341,7 +341,7 @@ static JSPromise* importModuleInner(JSGlobalObject* globalObject, JSString* modu
 
     RETURN_IF_EXCEPTION(scope, nullptr);
 
-    promise->fulfill(vm, globalObject, result);
+    promise->fulfill(vm, result);
     RETURN_IF_EXCEPTION(scope, nullptr);
 
     JSObject* thenResult = promise->then(globalObject, transformer, jsUndefined());
@@ -1463,16 +1463,16 @@ static JSPromise* moduleLoaderImportModuleInner(NodeVMGlobalObject* globalObject
             return NodeVM::importModuleInner(globalObject, moduleName, WTF::move(parameters), sourceOrigin, globalObject->dynamicImportCallback(), JSValue {});
         }
 
-        promise->reject(vm, globalObject, createError(globalObject, ErrorCode::ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING, "A dynamic import callback was not specified."_s));
+        promise->reject(vm, createError(globalObject, ErrorCode::ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING, "A dynamic import callback was not specified."_s));
         return promise;
     }
 
     // Default behavior copied from JSModuleLoader::importModule
     auto moduleNameString = moduleName->value(globalObject);
-    RETURN_IF_EXCEPTION(scope, promise->rejectWithCaughtException(globalObject, scope));
+    RETURN_IF_EXCEPTION(scope, promise->rejectWithCaughtException(vm, scope));
 
     scope.release();
-    promise->reject(vm, globalObject, createError(globalObject, makeString("Could not import the module '"_s, moduleNameString.data, "'."_s)));
+    promise->reject(vm, createError(globalObject, makeString("Could not import the module '"_s, moduleNameString.data, "'."_s)));
     return promise;
 }
 
diff --git a/src/jsc/bindings/ZigGlobalObject.cpp b/src/jsc/bindings/ZigGlobalObject.cpp
index 456898e72aaf..3ae06a14b9fa 100644
--- a/src/jsc/bindings/ZigGlobalObject.cpp
+++ b/src/jsc/bindings/ZigGlobalObject.cpp
@@ -3564,7 +3564,7 @@ static JSC::JSPromise* rejectedInternalPromise(JSC::JSGlobalObject* globalObject
 {
     auto& vm = JSC::getVM(globalObject);
     JSPromise* promise = JSPromise::create(vm, globalObject->promiseStructure());
-    promise->rejectAsHandled(vm, globalObject, value);
+    promise->rejectAsHandled(vm, value);
     return promise;
 }
 
@@ -3572,7 +3572,7 @@ static JSC::JSPromise* resolvedInternalPromise(JSC::JSGlobalObject* globalObject
 {
     auto& vm = JSC::getVM(globalObject);
     JSPromise* promise = JSPromise::create(vm, globalObject->promiseStructure());
-    promise->fulfill(vm, globalObject, value);
+    promise->fulfill(vm, value);
     return promise;
 }
 
@@ -3749,7 +3749,7 @@ static void handleResponseOnStreamingAction(JSGlobalObject* lexicalGlobalObject,
         globalObject, JSC::JSValue::encode(source), compiler.ptr()));
 
     if (scope.exception()) [[unlikely]] {
-        promise->rejectWithCaughtException(globalObject, scope);
+        promise->rejectWithCaughtException(vm, scope);
         return;
     }
 
@@ -3757,7 +3757,7 @@ static void handleResponseOnStreamingAction(JSGlobalObject* lexicalGlobalObject,
     if (readableStreamMaybe.isNull()) {
         compiler->finalize(globalObject);
         if (scope.exception()) [[unlikely]]
-            promise->rejectWithCaughtException(globalObject, scope);
+            promise->rejectWithCaughtException(vm, scope);
         return;
     }
 
@@ -3769,7 +3769,7 @@ static void handleResponseOnStreamingAction(JSGlobalObject* lexicalGlobalObject,
     arguments.append(readableStreamMaybe);
     JSC::call(globalObject, builtin, callData, wrapper, arguments);
     if (scope.exception()) [[unlikely]]
-        promise->rejectWithCaughtException(globalObject, scope);
+        promise->rejectWithCaughtException(vm, scope);
 }
 
 void GlobalObject::compileStreaming(JSGlobalObject* globalObject, JSC::JSPromise* promise, JSC::JSValue source, std::optional<JSC::WebAssemblyCompileOptions>&& compileOptions)
diff --git a/src/jsc/bindings/bindings.cpp b/src/jsc/bindings/bindings.cpp
index 5ddf563c32c3..51044d19fe48 100644
--- a/src/jsc/bindings/bindings.cpp
+++ b/src/jsc/bindings/bindings.cpp
@@ -50,7 +50,7 @@
 #include "JavaScriptCore/JSFunction.h"
 #include "JavaScriptCore/ErrorInstanceInlines.h"
 #include "JavaScriptCore/BigIntObject.h"
-#include "JavaScriptCore/OrderedHashTableHelper.h"
+#include "JavaScriptCore/JSOrderedHashTableHelper.h"
 
 #include "JavaScriptCore/JSCallbackObject.h"
 #include "JavaScriptCore/JSClassRef.h"
@@ -3148,7 +3148,7 @@ JSC::EncodedJSValue JSC__JSModuleLoader__evaluate(JSC::JSGlobalObject* globalObj
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     if (scope.exception()) [[unlikely]] {
-        promise->rejectWithCaughtException(globalObject, scope);
+        promise->rejectWithCaughtException(vm, scope);
     }
 
     auto status = promise->status();
@@ -3664,7 +3664,7 @@ void JSC__AnyPromise__wrap(JSC::JSGlobalObject* globalObject, EncodedJSValue enc
         (void)scope.tryClearException();
 
         if (auto* promise = dynamicDowncast<JSC::JSPromise>(promiseValue)) {
-            promise->reject(vm, globalObject, exception->value());
+            promise->reject(vm, exception->value());
             RETURN_IF_EXCEPTION(scope, );
             return;
         }
@@ -3674,7 +3674,7 @@ void JSC__AnyPromise__wrap(JSC::JSGlobalObject* globalObject, EncodedJSValue enc
 
     if (auto* errorInstance = dynamicDowncast<JSC::ErrorInstance>(result)) {
         if (auto* promise = dynamicDowncast<JSC::JSPromise>(promiseValue)) {
-            promise->reject(vm, globalObject, errorInstance);
+            promise->reject(vm, errorInstance);
             RETURN_IF_EXCEPTION(scope, );
             return;
         }
@@ -3736,7 +3736,7 @@ JSC::EncodedJSValue JSC__JSPromise__wrap(JSC::JSGlobalObject* globalObject, void
         exception = uncheckedDowncast<JSC::Exception>(value);
     }
 
-    arg0->reject(vm, globalObject, exception);
+    arg0->reject(vm, exception);
 }
 
 [[ZIG_EXPORT(check_slow)]] void JSC__JSPromise__rejectAsHandled(JSC::JSPromise* arg0, JSC::JSGlobalObject* arg1, JSC::EncodedJSValue JSValue2)
@@ -3745,7 +3745,7 @@ JSC::EncodedJSValue JSC__JSPromise__wrap(JSC::JSGlobalObject* globalObject, void
     ASSERT_WITH_MESSAGE(arg0->status() == JSC::JSPromise::Status::Pending, "Promise is already resolved or rejected");
 
     auto& vm = JSC::getVM(arg1);
-    arg0->rejectAsHandled(vm, arg1, JSC::JSValue::decode(JSValue2));
+    arg0->rejectAsHandled(vm, JSC::JSValue::decode(JSValue2));
 }
 
 JSC::JSPromise* JSC__JSPromise__rejectedPromise(JSC::JSGlobalObject* arg0, JSC::EncodedJSValue JSValue1)
@@ -3897,20 +3897,20 @@ void JSC__JSInternalPromise__reject(JSC::JSPromise* arg0, JSC::JSGlobalObject* g
         exception = uncheckedDowncast<JSC::Exception>(value);
     }
 
-    arg0->reject(vm, globalObject, exception);
+    arg0->reject(vm, exception);
 }
 void JSC__JSInternalPromise__rejectAsHandled(JSC::JSPromise* arg0,
     JSC::JSGlobalObject* arg1, JSC::EncodedJSValue JSValue2)
 {
     auto& vm = JSC::getVM(arg1);
-    arg0->rejectAsHandled(vm, arg1, JSC::JSValue::decode(JSValue2));
+    arg0->rejectAsHandled(vm, JSC::JSValue::decode(JSValue2));
 }
 void JSC__JSInternalPromise__rejectAsHandledException(JSC::JSPromise* arg0,
     JSC::JSGlobalObject* arg1,
     JSC::Exception* arg2)
 {
     auto& vm = JSC::getVM(arg1);
-    arg0->rejectAsHandled(vm, arg1, arg2);
+    arg0->rejectAsHandled(vm, arg2);
 }
 
 JSC::JSPromise* JSC__JSInternalPromise__rejectedPromise(JSC::JSGlobalObject* arg0,
diff --git a/src/jsc/bindings/napi.h b/src/jsc/bindings/napi.h
index aa305eae35c3..aa4a29f5cb1a 100644
--- a/src/jsc/bindings/napi.h
+++ b/src/jsc/bindings/napi.h
@@ -828,7 +828,7 @@ class NapiClass final : public JSC::JSFunction {
     {
     }
 
-    void finishCreation(VM&, NativeExecutable*, const String& name, napi_callback constructor,
+    void finishCreation(VM&, const String& name, napi_callback constructor,
         void* data,
         size_t property_count,
         const napi_property_descriptor* properties);
diff --git a/src/jsc/bindings/sqlite/JSSQLStatement.cpp b/src/jsc/bindings/sqlite/JSSQLStatement.cpp
index c68c7c2e8ba1..1e90204a307d 100644
--- a/src/jsc/bindings/sqlite/JSSQLStatement.cpp
+++ b/src/jsc/bindings/sqlite/JSSQLStatement.cpp
@@ -1685,7 +1685,7 @@ JSC_DEFINE_HOST_FUNCTION(jsSQLStatementPrepareStatementFunction, (JSC::JSGlobalO
 
 JSSQLStatementConstructor* JSSQLStatementConstructor::create(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::Structure* structure)
 {
-    NativeExecutable* executable = vm.getHostFunction(jsSQLStatementPrepareStatementFunction, ImplementationVisibility::Private, callHostFunctionAsConstructor, String("SQLStatement"_s));
+    NativeExecutable* executable = vm.getHostFunction(jsSQLStatementPrepareStatementFunction, ImplementationVisibility::Private, callHostFunctionAsConstructor, 0, String("SQLStatement"_s));
     JSSQLStatementConstructor* ptr = new (NotNull, JSC::allocateCell<JSSQLStatementConstructor>(vm)) JSSQLStatementConstructor(vm, executable, globalObject, structure);
     ptr->finishCreation(vm);
 
diff --git a/src/jsc/bindings/webcore/JSDOMPromiseDeferred.cpp b/src/jsc/bindings/webcore/JSDOMPromiseDeferred.cpp
index a5e6c16becdf..a220c05fd81c 100644
--- a/src/jsc/bindings/webcore/JSDOMPromiseDeferred.cpp
+++ b/src/jsc/bindings/webcore/JSDOMPromiseDeferred.cpp
@@ -84,10 +84,10 @@ void DeferredPromise::callFunction(JSGlobalObject& lexicalGlobalObject, ResolveM
         deferred()->resolve(&lexicalGlobalObject, vm, resolution);
         break;
     case ResolveMode::Reject:
-        deferred()->reject(vm, &lexicalGlobalObject, resolution);
+        deferred()->reject(vm, resolution);
         break;
     case ResolveMode::RejectAsHandled:
-        deferred()->rejectAsHandled(vm, &lexicalGlobalObject, resolution);
+        deferred()->rejectAsHandled(vm, resolution);
         break;
     }
 
diff --git a/src/jsc/bindings/webcore/JSWorker.cpp b/src/jsc/bindings/webcore/JSWorker.cpp
index 366663f38dfb..795273360d3a 100644
--- a/src/jsc/bindings/webcore/JSWorker.cpp
+++ b/src/jsc/bindings/webcore/JSWorker.cpp
@@ -674,7 +674,7 @@ static inline JSC::EncodedJSValue jsWorkerPrototypeFunction_getHeapSnapshotBody(
 
     auto* promise = JSC::JSPromise::create(vm, globalObject->promiseStructure());
     if (!worker.isOnline()) {
-        promise->reject(vm, globalObject,
+        promise->reject(vm,
             Bun::createError(globalObject,
                 Bun::ErrorCode::ERR_WORKER_NOT_RUNNING,
                 "Worker instance not running"_s));
@@ -718,7 +718,7 @@ static inline JSC::EncodedJSValue jsWorkerPrototypeFunction_getHeapSnapshotBody(
         // Worker raced to Closing/Closed between isOnline() and the post.
         // Still on the parent thread — safe to destroy the handle here.
         delete promiseHandle;
-        promise->reject(vm, globalObject,
+        promise->reject(vm,
             Bun::createError(globalObject,
                 Bun::ErrorCode::ERR_WORKER_NOT_RUNNING,
                 "Worker instance not running"_s));
diff --git a/src/runtime/bake/BakeGlobalObject.cpp b/src/runtime/bake/BakeGlobalObject.cpp
index b86cfa16c340..43919747bd87 100644
--- a/src/runtime/bake/BakeGlobalObject.cpp
+++ b/src/runtime/bake/BakeGlobalObject.cpp
@@ -38,7 +38,7 @@ bakeModuleLoaderImportModule(JSC::JSGlobalObject* global,
 
         if (!keyString) {
             auto promise = JSC::JSPromise::create(vm, global->promiseStructure());
-            promise->reject(vm, global, JSC::createError(global, "import() requires a string"_s));
+            promise->reject(vm, JSC::createError(global, "import() requires a string"_s));
             return promise;
         }
 
@@ -94,7 +94,7 @@ static JSC::JSPromise* rejectedInternalPromise(JSC::JSGlobalObject* globalObject
 {
     auto& vm = JSC::getVM(globalObject);
     JSC::JSPromise* promise = JSC::JSPromise::create(vm, globalObject->promiseStructure());
-    promise->rejectAsHandled(vm, globalObject, value);
+    promise->rejectAsHandled(vm, value);
     return promise;
 }
 
@@ -102,7 +102,7 @@ static JSC::JSPromise* resolvedInternalPromise(JSC::JSGlobalObject* globalObject
 {
     auto& vm = JSC::getVM(globalObject);
     JSC::JSPromise* promise = JSC::JSPromise::create(vm, globalObject->promiseStructure());
-    promise->fulfill(vm, globalObject, value);
+    promise->fulfill(vm, value);
     return promise;
 }
 
diff --git a/src/runtime/webview/ChromeBackend.cpp b/src/runtime/webview/ChromeBackend.cpp
index 6562810592bd..16a82f9e7514 100644
--- a/src/runtime/webview/ChromeBackend.cpp
+++ b/src/runtime/webview/ChromeBackend.cpp
@@ -1362,7 +1362,7 @@ static JSPromise* sendChromeOp(JSGlobalObject* g, JSWebView* v,
     // rejectAllAndMarkDead reset it). WebSocket mode doesn't need
     // m_wsOpen here — send() queues until onOpen fires.
     if (t.m_dead || t.m_mode == TransportMode::None) {
-        promise->reject(vm, g, createError(g, "Chrome connection is not available"_s));
+        promise->reject(vm, createError(g, "Chrome connection is not available"_s));
         return promise;
     }
     v->m_pendingActivityCount.fetch_add(1, std::memory_order_release);
diff --git a/src/runtime/webview/JSWebView.cpp b/src/runtime/webview/JSWebView.cpp
index 4c248ceb5240..d897048f0365 100644
--- a/src/runtime/webview/JSWebView.cpp
+++ b/src/runtime/webview/JSWebView.cpp
@@ -63,7 +63,7 @@ void settleSlot(JSGlobalObject* g, JSWebView* v,
     if (ok)
         p->resolve(g, g->vm(), value);
     else
-        p->reject(g->vm(), g, value);
+        p->reject(g->vm(), value);
 }
 
 // --- WebViewEventTarget ----------------------------------------------------
diff --git a/src/runtime/webview/WebKitBackend.cpp b/src/runtime/webview/WebKitBackend.cpp
index cd961d74c420..eeb408562f0a 100644
--- a/src/runtime/webview/WebKitBackend.cpp
+++ b/src/runtime/webview/WebKitBackend.cpp
@@ -540,7 +540,7 @@ static JSPromise* sendOp(JSGlobalObject* g, JSWebView* view, WriteBarrier<JSProm
     auto* promise = JSPromise::create(vm, g->promiseStructure());
     auto& c = client();
     if (!c.sock || c.dead || us_socket_is_closed(c.sock)) {
-        promise->reject(vm, g, createError(g, "WebView host process is not running"_s));
+        promise->reject(vm, createError(g, "WebView host process is not running"_s));
         return promise;
     }
     // Inc BEFORE slot.set so GC never observes a set slot with count==0.