From ff47df5de42723a163c624e93ba941e8cbca1f67 Mon Sep 17 00:00:00 2001
From: Sosuke Suzuki <sosuke@bun.com>
Date: Thu, 4 Jun 2026 17:06:16 +0900
Subject: [PATCH 1/5] Upgrade WebKit to 51cc3feb7298

- JSPromise reject/fulfill/rejectAsHandled/rejectWithCaughtException no
  longer take a JSGlobalObject parameter; promise jobs run in the
  promise's own realm (webkit.org/b/316187). Update all call sites.
- JSType gained SentinelType before ObjectType, shifting object types
  by one; update the JSType mirror.
- OrderedHashTableHelper.h was renamed to JSOrderedHashTableHelper.h.
---
 scripts/build/deps/webkit.ts                  |   2 +-
 src/jsc/JSType.rs                             | 133 +++++++++---------
 .../bindings/BunAnalyzeTranspiledModule.cpp   |   6 +-
 src/jsc/bindings/JSBundlerPlugin.cpp          |   2 +-
 src/jsc/bindings/JSSecrets.cpp                |   2 +-
 src/jsc/bindings/ModuleLoader.cpp             |  12 +-
 src/jsc/bindings/NodeVM.cpp                   |   8 +-
 src/jsc/bindings/ZigGlobalObject.cpp          |  10 +-
 src/jsc/bindings/bindings.cpp                 |  18 +--
 .../bindings/webcore/JSDOMPromiseDeferred.cpp |   4 +-
 src/jsc/bindings/webcore/JSWorker.cpp         |   4 +-
 src/runtime/bake/BakeGlobalObject.cpp         |   6 +-
 src/runtime/webview/ChromeBackend.cpp         |   2 +-
 src/runtime/webview/JSWebView.cpp             |   2 +-
 src/runtime/webview/WebKitBackend.cpp         |   2 +-
 15 files changed, 108 insertions(+), 105 deletions(-)

diff --git a/scripts/build/deps/webkit.ts b/scripts/build/deps/webkit.ts
index c47ae1ba6d03..31269477efae 100644
--- a/scripts/build/deps/webkit.ts
+++ b/scripts/build/deps/webkit.ts
@@ -7,7 +7,7 @@
 // -lto variants built with ThinLTO (per-module summaries for cross-language
 // importing), and the Windows ICU data table filtered + per-item zstd
 // compressed (lazily decompressed via bun_icu_decompress.cpp).
-export const WEBKIT_VERSION = "6d586e293f008f0e74e5697611a379b1b24815c9";
+export const WEBKIT_VERSION = "autobuild-preview-pr-248-cf784902";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.
diff --git a/src/jsc/JSType.rs b/src/jsc/JSType.rs
index b53b57d3bf37..37ad8967b5fc 100644
--- a/src/jsc/JSType.rs
+++ b/src/jsc/JSType.rs
@@ -230,20 +230,23 @@ impl JSType {
     /// JSModuleLoader cell type (new C++ module loader).
     pub const JSModuleLoader: JSType = JSType(31);
 
+    /// Sentinel cell used by ordered hash table iteration.
+    pub const Sentinel: JSType = JSType(32);
+
     /// Base JavaScript object type.
     /// ```js
     /// {}
     /// new Object()
     /// ```
-    pub const Object: JSType = JSType(32);
+    pub const Object: JSType = JSType(33);
 
     /// Optimized object type for object literals with fixed properties.
     /// ```js
     /// { a: 1, b: 2 }
     /// ```
-    pub const FinalObject: JSType = JSType(33);
+    pub const FinalObject: JSType = JSType(34);
 
-    pub const JSCallee: JSType = JSType(34);
+    pub const JSCallee: JSType = JSType(35);
 
     /// JavaScript function object created from JavaScript source code.
     /// ```js
@@ -253,7 +256,7 @@ impl JSType {
     ///   method() {}
     /// }
     /// ```
-    pub const JSFunction: JSType = JSType(35);
+    pub const JSFunction: JSType = JSType(36);
 
     /// Built-in function implemented in native code.
     /// ```js
@@ -262,23 +265,23 @@ impl JSType {
     /// parseInt
     /// console.log
     /// ```
-    pub const InternalFunction: JSType = JSType(36);
+    pub const InternalFunction: JSType = JSType(37);
 
-    pub const NullSetterFunction: JSType = JSType(37);
+    pub const NullSetterFunction: JSType = JSType(38);
 
     /// Boxed Boolean object.
     /// ```js
     /// new Boolean(true)
     /// new Boolean(false)
     /// ```
-    pub const BooleanObject: JSType = JSType(38);
+    pub const BooleanObject: JSType = JSType(39);
 
     /// Boxed Number object.
     /// ```js
     /// new Number(42)
     /// new Number(3.14)
     /// ```
-    pub const NumberObject: JSType = JSType(39);
+    pub const NumberObject: JSType = JSType(40);
 
     /// JavaScript Error object and its subclasses.
     /// ```js
@@ -286,9 +289,9 @@ impl JSType {
     /// new TypeError()
     /// throw new RangeError()
     /// ```
-    pub const ErrorInstance: JSType = JSType(40);
+    pub const ErrorInstance: JSType = JSType(41);
 
-    pub const GlobalProxy: JSType = JSType(41);
+    pub const GlobalProxy: JSType = JSType(42);
 
     /// Arguments object for function parameters.
     /// ```js
@@ -297,10 +300,10 @@ impl JSType {
     ///   console.log(arguments.length);
     /// }
     /// ```
-    pub const DirectArguments: JSType = JSType(42);
+    pub const DirectArguments: JSType = JSType(43);
 
-    pub const ScopedArguments: JSType = JSType(43);
-    pub const ClonedArguments: JSType = JSType(44);
+    pub const ScopedArguments: JSType = JSType(44);
+    pub const ClonedArguments: JSType = JSType(45);
 
     /// JavaScript Array object.
     /// ```js
@@ -309,94 +312,94 @@ impl JSType {
     /// new Array(10)
     /// Array.from(iterable)
     /// ```
-    pub const Array: JSType = JSType(45);
+    pub const Array: JSType = JSType(46);
 
     /// Array subclass created through class extension.
     /// ```js
     /// class MyArray extends Array {}
     /// const arr = new MyArray();
     /// ```
-    pub const DerivedArray: JSType = JSType(46);
+    pub const DerivedArray: JSType = JSType(47);
 
     /// ArrayBuffer for binary data storage.
     /// ```js
     /// new ArrayBuffer(1024)
     /// ```
-    pub const ArrayBuffer: JSType = JSType(47);
+    pub const ArrayBuffer: JSType = JSType(48);
 
     /// Typed array for 8-bit signed integers.
     /// ```js
     /// new Int8Array(buffer)
     /// new Int8Array([1, -1, 127])
     /// ```
-    pub const Int8Array: JSType = JSType(48);
+    pub const Int8Array: JSType = JSType(49);
 
     /// Typed array for 8-bit unsigned integers.
     /// ```js
     /// new Uint8Array(buffer)
     /// new Uint8Array([0, 255])
     /// ```
-    pub const Uint8Array: JSType = JSType(49);
+    pub const Uint8Array: JSType = JSType(50);
 
     /// Typed array for 8-bit unsigned integers with clamping.
     /// ```js
     /// new Uint8ClampedArray([0, 300]) // 300 becomes 255
     /// ```
-    pub const Uint8ClampedArray: JSType = JSType(50);
+    pub const Uint8ClampedArray: JSType = JSType(51);
 
     /// Typed array for 16-bit signed integers.
     /// ```js
     /// new Int16Array(buffer)
     /// ```
-    pub const Int16Array: JSType = JSType(51);
+    pub const Int16Array: JSType = JSType(52);
 
     /// Typed array for 16-bit unsigned integers.
     /// ```js
     /// new Uint16Array(buffer)
     /// ```
-    pub const Uint16Array: JSType = JSType(52);
+    pub const Uint16Array: JSType = JSType(53);
 
     /// Typed array for 32-bit signed integers.
     /// ```js
     /// new Int32Array(buffer)
     /// ```
-    pub const Int32Array: JSType = JSType(53);
+    pub const Int32Array: JSType = JSType(54);
 
     /// Typed array for 32-bit unsigned integers.
     /// ```js
     /// new Uint32Array(buffer)
     /// ```
-    pub const Uint32Array: JSType = JSType(54);
+    pub const Uint32Array: JSType = JSType(55);
 
     /// Typed array for 16-bit floating point numbers.
     /// ```js
     /// new Float16Array(buffer)
     /// ```
-    pub const Float16Array: JSType = JSType(55);
+    pub const Float16Array: JSType = JSType(56);
 
     /// Typed array for 32-bit floating point numbers.
     /// ```js
     /// new Float32Array(buffer)
     /// ```
-    pub const Float32Array: JSType = JSType(56);
+    pub const Float32Array: JSType = JSType(57);
 
     /// Typed array for 64-bit floating point numbers.
     /// ```js
     /// new Float64Array(buffer)
     /// ```
-    pub const Float64Array: JSType = JSType(57);
+    pub const Float64Array: JSType = JSType(58);
 
     /// Typed array for 64-bit signed BigInt values.
     /// ```js
     /// new BigInt64Array([123n, -456n])
     /// ```
-    pub const BigInt64Array: JSType = JSType(58);
+    pub const BigInt64Array: JSType = JSType(59);
 
     /// Typed array for 64-bit unsigned BigInt values.
     /// ```js
     /// new BigUint64Array([123n, 456n])
     /// ```
-    pub const BigUint64Array: JSType = JSType(59);
+    pub const BigUint64Array: JSType = JSType(60);
 
     /// DataView for flexible binary data access.
     /// ```js
@@ -404,7 +407,7 @@ impl JSType {
     /// view.getInt32(0)
     /// view.setFloat64(8, 3.14)
     /// ```
-    pub const DataView: JSType = JSType(60);
+    pub const DataView: JSType = JSType(61);
 
     /// Global object containing all global variables and functions.
     /// ```js
@@ -412,12 +415,12 @@ impl JSType {
     /// window // in browsers
     /// global // in Node.js
     /// ```
-    pub const GlobalObject: JSType = JSType(61);
+    pub const GlobalObject: JSType = JSType(62);
 
-    pub const GlobalLexicalEnvironment: JSType = JSType(62);
-    pub const LexicalEnvironment: JSType = JSType(63);
-    pub const ModuleEnvironment: JSType = JSType(64);
-    pub const StrictEvalActivation: JSType = JSType(65);
+    pub const GlobalLexicalEnvironment: JSType = JSType(63);
+    pub const LexicalEnvironment: JSType = JSType(64);
+    pub const ModuleEnvironment: JSType = JSType(65);
+    pub const StrictEvalActivation: JSType = JSType(66);
 
     /// Scope object for with statements.
     /// ```js
@@ -425,19 +428,19 @@ impl JSType {
     ///   prop; // looks up prop in obj first
     /// }
     /// ```
-    pub const WithScope: JSType = JSType(66);
+    pub const WithScope: JSType = JSType(67);
 
-    pub const AsyncDisposableStack: JSType = JSType(67);
-    pub const DisposableStack: JSType = JSType(68);
+    pub const AsyncDisposableStack: JSType = JSType(68);
+    pub const DisposableStack: JSType = JSType(69);
 
     /// Namespace object for ES6 modules.
     /// ```js
     /// import * as ns from 'module';
     /// ns.exportedFunction()
     /// ```
-    pub const ModuleNamespaceObject: JSType = JSType(69);
+    pub const ModuleNamespaceObject: JSType = JSType(70);
 
-    pub const ShadowRealm: JSType = JSType(70);
+    pub const ShadowRealm: JSType = JSType(71);
 
     /// Regular expression object.
     /// ```js
@@ -445,7 +448,7 @@ impl JSType {
     /// new RegExp('pattern', 'flags')
     /// /abc/gi
     /// ```
-    pub const RegExpObject: JSType = JSType(71);
+    pub const RegExpObject: JSType = JSType(72);
 
     /// JavaScript Date object for date/time operations.
     /// ```js
@@ -453,7 +456,7 @@ impl JSType {
     /// new Date('2023-01-01')
     /// Date.now()
     /// ```
-    pub const JSDate: JSType = JSType(72);
+    pub const JSDate: JSType = JSType(73);
 
     /// Proxy object that intercepts operations on another object.
     /// ```js
@@ -461,7 +464,7 @@ impl JSType {
     ///   get(obj, prop) { return obj[prop]; }
     /// })
     /// ```
-    pub const ProxyObject: JSType = JSType(73);
+    pub const ProxyObject: JSType = JSType(74);
 
     /// Generator object created by generator functions.
     /// ```js
@@ -469,10 +472,10 @@ impl JSType {
     /// const g = gen();
     /// g.next()
     /// ```
-    pub const Generator: JSType = JSType(74);
+    pub const Generator: JSType = JSType(75);
 
     /// Async function generator object (split from JSGenerator in WebKit ~May 2026 to shrink sizeof(JSGenerator)).
-    pub const AsyncFunctionGenerator: JSType = JSType(75);
+    pub const AsyncFunctionGenerator: JSType = JSType(76);
 
     /// Async generator object for asynchronous iteration.
     /// ```js
@@ -480,17 +483,17 @@ impl JSType {
     ///   yield await promise;
     /// }
     /// ```
-    pub const AsyncGenerator: JSType = JSType(76);
+    pub const AsyncGenerator: JSType = JSType(77);
 
     /// Iterator for Array objects.
     /// ```js
     /// [1,2,3][Symbol.iterator]()
     /// for (const x of array) {}
     /// ```
-    pub const JSArrayIterator: JSType = JSType(77);
+    pub const JSArrayIterator: JSType = JSType(78);
 
-    pub const Iterator: JSType = JSType(78);
-    pub const IteratorHelper: JSType = JSType(79);
+    pub const Iterator: JSType = JSType(79);
+    pub const IteratorHelper: JSType = JSType(80);
 
     /// Iterator for Map objects.
     /// ```js
@@ -499,32 +502,32 @@ impl JSType {
     /// map.entries()
     /// for (const [k,v] of map) {}
     /// ```
-    pub const MapIterator: JSType = JSType(80);
+    pub const MapIterator: JSType = JSType(81);
 
     /// Iterator for Set objects.
     /// ```js
     /// set.values()
     /// for (const value of set) {}
     /// ```
-    pub const SetIterator: JSType = JSType(81);
+    pub const SetIterator: JSType = JSType(82);
 
     /// Iterator for String objects.
     /// ```js
     /// 'hello'[Symbol.iterator]()
     /// for (const char of string) {}
     /// ```
-    pub const StringIterator: JSType = JSType(82);
+    pub const StringIterator: JSType = JSType(83);
 
-    pub const WrapForValidIterator: JSType = JSType(83);
+    pub const WrapForValidIterator: JSType = JSType(84);
 
     /// Iterator for RegExp string matching.
     /// ```js
     /// 'abc'.matchAll(/./g)
     /// for (const match of string.matchAll(regex)) {}
     /// ```
-    pub const RegExpStringIterator: JSType = JSType(84);
+    pub const RegExpStringIterator: JSType = JSType(85);
 
-    pub const AsyncFromSyncIterator: JSType = JSType(85);
+    pub const AsyncFromSyncIterator: JSType = JSType(86);
 
     /// JavaScript Promise object for asynchronous operations.
     /// ```js
@@ -532,7 +535,7 @@ impl JSType {
     /// Promise.resolve(42)
     /// async function foo() { await promise; }
     /// ```
-    pub const JSPromise: JSType = JSType(86);
+    pub const JSPromise: JSType = JSType(87);
 
     /// JavaScript Map object for key-value storage.
     /// ```js
@@ -540,7 +543,7 @@ impl JSType {
     /// map.set(key, value)
     /// map.get(key)
     /// ```
-    pub const Map: JSType = JSType(87);
+    pub const Map: JSType = JSType(88);
 
     /// JavaScript Set object for unique value storage.
     /// ```js
@@ -548,34 +551,34 @@ impl JSType {
     /// set.add(value)
     /// set.has(value)
     /// ```
-    pub const Set: JSType = JSType(88);
+    pub const Set: JSType = JSType(89);
 
     /// WeakMap for weak key-value references.
     /// ```js
     /// new WeakMap()
     /// weakMap.set(object, value)
     /// ```
-    pub const WeakMap: JSType = JSType(89);
+    pub const WeakMap: JSType = JSType(90);
 
     /// WeakSet for weak value references.
     /// ```js
     /// new WeakSet()
     /// weakSet.add(object)
     /// ```
-    pub const WeakSet: JSType = JSType(90);
+    pub const WeakSet: JSType = JSType(91);
 
-    pub const WebAssemblyModule: JSType = JSType(91);
-    pub const WebAssemblyInstance: JSType = JSType(92);
-    pub const WebAssemblyGCObject: JSType = JSType(93);
+    pub const WebAssemblyModule: JSType = JSType(92);
+    pub const WebAssemblyInstance: JSType = JSType(93);
+    pub const WebAssemblyGCObject: JSType = JSType(94);
 
     /// Boxed String object.
     /// ```js
     /// new String("hello")
     /// ```
-    pub const StringObject: JSType = JSType(94);
+    pub const StringObject: JSType = JSType(95);
 
-    pub const DerivedStringObject: JSType = JSType(95);
-    pub const InternalFieldTuple: JSType = JSType(96);
+    pub const DerivedStringObject: JSType = JSType(96);
+    pub const InternalFieldTuple: JSType = JSType(97);
 
     pub const MaxJS: JSType = JSType(0b11111111);
     pub const Event: JSType = JSType(0b11101111);
diff --git a/src/jsc/bindings/BunAnalyzeTranspiledModule.cpp b/src/jsc/bindings/BunAnalyzeTranspiledModule.cpp
index baa7ad395ac6..71538245abbd 100644
--- a/src/jsc/bindings/BunAnalyzeTranspiledModule.cpp
+++ b/src/jsc/bindings/BunAnalyzeTranspiledModule.cpp
@@ -169,7 +169,7 @@ extern "C" EncodedJSValue Bun__analyzeTranspiledModule(JSGlobalObject* globalObj
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     auto rejectWithError = [&](JSValue error) {
-        promise->reject(vm, globalObject, error);
+        promise->reject(vm, error);
         return promise;
     };
 
@@ -208,7 +208,7 @@ static EncodedJSValue fallbackParse(JSGlobalObject* globalObject, const Identifi
     VM& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
     auto rejectWithError = [&](JSValue error) {
-        promise->reject(vm, globalObject, error);
+        promise->reject(vm, error);
         return promise;
     };
 
@@ -221,7 +221,7 @@ static EncodedJSValue fallbackParse(JSGlobalObject* globalObject, const Identifi
     ASSERT(moduleProgramNode);
 
     ModuleAnalyzer moduleAnalyzer(globalObject, moduleKey, sourceCode, moduleProgramNode->varDeclarations(), moduleProgramNode->lexicalVariables(), moduleProgramNode->features());
-    RETURN_IF_EXCEPTION(scope, JSValue::encode(promise->rejectWithCaughtException(globalObject, scope)));
+    RETURN_IF_EXCEPTION(scope, JSValue::encode(promise->rejectWithCaughtException(vm, scope)));
 
     auto result = moduleAnalyzer.analyze(*moduleProgramNode);
     if (!result) {
diff --git a/src/jsc/bindings/JSBundlerPlugin.cpp b/src/jsc/bindings/JSBundlerPlugin.cpp
index db1312230460..8ca8f83c6176 100644
--- a/src/jsc/bindings/JSBundlerPlugin.cpp
+++ b/src/jsc/bindings/JSBundlerPlugin.cpp
@@ -675,7 +675,7 @@ extern "C" void JSBundlerPlugin__drainDeferred(Bun::JSBundlerPlugin* pluginObjec
     for (auto promiseValue : arguments) {
         JSPromise* promise = uncheckedDowncast<JSPromise>(promiseValue);
         if (rejected) {
-            promise->reject(vm, globalObject, JSC::jsUndefined());
+            promise->reject(vm, JSC::jsUndefined());
         } else {
             promise->resolve(globalObject, vm, JSC::jsUndefined());
         }
diff --git a/src/jsc/bindings/JSSecrets.cpp b/src/jsc/bindings/JSSecrets.cpp
index de855e558768..5f3373411545 100644
--- a/src/jsc/bindings/JSSecrets.cpp
+++ b/src/jsc/bindings/JSSecrets.cpp
@@ -281,7 +281,7 @@ void Bun__SecretsJobOptions__runFromJS(SecretsJobOptions* opts, JSGlobalObject*
         }
         JSValue error = opts->error.toJS(vm, global);
         RETURN_IF_EXCEPTION(scope, );
-        RELEASE_AND_RETURN(scope, promise->reject(vm, global, error));
+        RELEASE_AND_RETURN(scope, promise->reject(vm, error));
     } else {
         // Success cases
         JSValue result;
diff --git a/src/jsc/bindings/ModuleLoader.cpp b/src/jsc/bindings/ModuleLoader.cpp
index 30d7fe37d59b..7c5ba80bb6a3 100644
--- a/src/jsc/bindings/ModuleLoader.cpp
+++ b/src/jsc/bindings/ModuleLoader.cpp
@@ -74,14 +74,14 @@ static JSC::JSPromise* rejectedInternalPromise(JSC::JSGlobalObject* globalObject
     JSPromise* promise = JSPromise::create(vm, globalObject->promiseStructure());
     auto scope = DECLARE_THROW_SCOPE(vm);
     scope.throwException(globalObject, value);
-    return promise->rejectWithCaughtException(globalObject, scope);
+    return promise->rejectWithCaughtException(vm, scope);
 }
 
 static JSC::JSPromise* resolvedInternalPromise(JSC::JSGlobalObject* globalObject, JSC::JSValue value)
 {
     auto& vm = JSC::getVM(globalObject);
     JSPromise* promise = JSPromise::create(vm, globalObject->promiseStructure());
-    promise->fulfill(vm, globalObject, value);
+    promise->fulfill(vm, value);
     return promise;
 }
 
@@ -470,7 +470,7 @@ extern "C" void Bun__onFulfillAsyncModule(
     JSC::JSPromise* promise = uncheckedDowncast<JSC::JSPromise>(JSC::JSValue::decode(encodedPromiseValue));
 
     if (!res->success) {
-        RELEASE_AND_RETURN(scope, promise->reject(vm, globalObject, JSValue::decode(res->result.err.value)));
+        RELEASE_AND_RETURN(scope, promise->reject(vm, JSValue::decode(res->result.err.value)));
     }
 
     auto* specifierValue = Bun::toJS(globalObject, *specifier);
@@ -502,7 +502,7 @@ extern "C" void Bun__onFulfillAsyncModule(
             auto* exception = scope.exception();
             if (!vm.isTerminationException(exception)) {
                 (void)scope.tryClearException();
-                promise->reject(vm, globalObject, exception);
+                promise->reject(vm, exception);
                 scope.assertNoExceptionExceptTermination();
             }
         }
@@ -1247,7 +1247,7 @@ BUN_DEFINE_HOST_FUNCTION(jsFunctionOnLoadObjectResultResolve, (JSC::JSGlobalObje
         throwException(globalObject, scope, result);
     }
     if (scope.exception()) [[unlikely]] {
-        auto retValue = JSValue::encode(promise->rejectWithCaughtException(globalObject, scope));
+        auto retValue = JSValue::encode(promise->rejectWithCaughtException(vm, scope));
         pendingModule->internalField(2).set(vm, pendingModule, JSC::jsUndefined());
         return retValue;
     }
@@ -1267,7 +1267,7 @@ BUN_DEFINE_HOST_FUNCTION(jsFunctionOnLoadObjectResultReject, (JSC::JSGlobalObjec
     JSC::JSPromise* promise = pendingModule->internalPromise();
 
     pendingModule->internalField(2).set(vm, pendingModule, JSC::jsUndefined());
-    promise->reject(vm, globalObject, reason);
+    promise->reject(vm, reason);
 
     return JSValue::encode(reason);
 }
diff --git a/src/jsc/bindings/NodeVM.cpp b/src/jsc/bindings/NodeVM.cpp
index 16aa553a1ef8..1aea7f54c245 100644
--- a/src/jsc/bindings/NodeVM.cpp
+++ b/src/jsc/bindings/NodeVM.cpp
@@ -341,7 +341,7 @@ static JSPromise* importModuleInner(JSGlobalObject* globalObject, JSString* modu
 
     RETURN_IF_EXCEPTION(scope, nullptr);
 
-    promise->fulfill(vm, globalObject, result);
+    promise->fulfill(vm, result);
     RETURN_IF_EXCEPTION(scope, nullptr);
 
     JSObject* thenResult = promise->then(globalObject, transformer, jsUndefined());
@@ -1463,16 +1463,16 @@ static JSPromise* moduleLoaderImportModuleInner(NodeVMGlobalObject* globalObject
             return NodeVM::importModuleInner(globalObject, moduleName, WTF::move(parameters), sourceOrigin, globalObject->dynamicImportCallback(), JSValue {});
         }
 
-        promise->reject(vm, globalObject, createError(globalObject, ErrorCode::ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING, "A dynamic import callback was not specified."_s));
+        promise->reject(vm, createError(globalObject, ErrorCode::ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING, "A dynamic import callback was not specified."_s));
         return promise;
     }
 
     // Default behavior copied from JSModuleLoader::importModule
     auto moduleNameString = moduleName->value(globalObject);
-    RETURN_IF_EXCEPTION(scope, promise->rejectWithCaughtException(globalObject, scope));
+    RETURN_IF_EXCEPTION(scope, promise->rejectWithCaughtException(vm, scope));
 
     scope.release();
-    promise->reject(vm, globalObject, createError(globalObject, makeString("Could not import the module '"_s, moduleNameString.data, "'."_s)));
+    promise->reject(vm, createError(globalObject, makeString("Could not import the module '"_s, moduleNameString.data, "'."_s)));
     return promise;
 }
 
diff --git a/src/jsc/bindings/ZigGlobalObject.cpp b/src/jsc/bindings/ZigGlobalObject.cpp
index 15858d7bc137..1287aad9e69f 100644
--- a/src/jsc/bindings/ZigGlobalObject.cpp
+++ b/src/jsc/bindings/ZigGlobalObject.cpp
@@ -3568,7 +3568,7 @@ static JSC::JSPromise* rejectedInternalPromise(JSC::JSGlobalObject* globalObject
 {
     auto& vm = JSC::getVM(globalObject);
     JSPromise* promise = JSPromise::create(vm, globalObject->promiseStructure());
-    promise->rejectAsHandled(vm, globalObject, value);
+    promise->rejectAsHandled(vm, value);
     return promise;
 }
 
@@ -3576,7 +3576,7 @@ static JSC::JSPromise* resolvedInternalPromise(JSC::JSGlobalObject* globalObject
 {
     auto& vm = JSC::getVM(globalObject);
     JSPromise* promise = JSPromise::create(vm, globalObject->promiseStructure());
-    promise->fulfill(vm, globalObject, value);
+    promise->fulfill(vm, value);
     return promise;
 }
 
@@ -3753,7 +3753,7 @@ static void handleResponseOnStreamingAction(JSGlobalObject* lexicalGlobalObject,
         globalObject, JSC::JSValue::encode(source), compiler.ptr()));
 
     if (scope.exception()) [[unlikely]] {
-        promise->rejectWithCaughtException(globalObject, scope);
+        promise->rejectWithCaughtException(vm, scope);
         return;
     }
 
@@ -3761,7 +3761,7 @@ static void handleResponseOnStreamingAction(JSGlobalObject* lexicalGlobalObject,
     if (readableStreamMaybe.isNull()) {
         compiler->finalize(globalObject);
         if (scope.exception()) [[unlikely]]
-            promise->rejectWithCaughtException(globalObject, scope);
+            promise->rejectWithCaughtException(vm, scope);
         return;
     }
 
@@ -3773,7 +3773,7 @@ static void handleResponseOnStreamingAction(JSGlobalObject* lexicalGlobalObject,
     arguments.append(readableStreamMaybe);
     JSC::call(globalObject, builtin, callData, wrapper, arguments);
     if (scope.exception()) [[unlikely]]
-        promise->rejectWithCaughtException(globalObject, scope);
+        promise->rejectWithCaughtException(vm, scope);
 }
 
 void GlobalObject::compileStreaming(JSGlobalObject* globalObject, JSC::JSPromise* promise, JSC::JSValue source, std::optional<JSC::WebAssemblyCompileOptions>&& compileOptions)
diff --git a/src/jsc/bindings/bindings.cpp b/src/jsc/bindings/bindings.cpp
index ae3d8986c710..7ada4c57a512 100644
--- a/src/jsc/bindings/bindings.cpp
+++ b/src/jsc/bindings/bindings.cpp
@@ -50,7 +50,7 @@
 #include "JavaScriptCore/JSFunction.h"
 #include "JavaScriptCore/ErrorInstanceInlines.h"
 #include "JavaScriptCore/BigIntObject.h"
-#include "JavaScriptCore/OrderedHashTableHelper.h"
+#include "JavaScriptCore/JSOrderedHashTableHelper.h"
 
 #include "JavaScriptCore/JSCallbackObject.h"
 #include "JavaScriptCore/JSClassRef.h"
@@ -3148,7 +3148,7 @@ JSC::EncodedJSValue JSC__JSModuleLoader__evaluate(JSC::JSGlobalObject* globalObj
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     if (scope.exception()) [[unlikely]] {
-        promise->rejectWithCaughtException(globalObject, scope);
+        promise->rejectWithCaughtException(vm, scope);
     }
 
     auto status = promise->status();
@@ -3664,7 +3664,7 @@ void JSC__AnyPromise__wrap(JSC::JSGlobalObject* globalObject, EncodedJSValue enc
         (void)scope.tryClearException();
 
         if (auto* promise = dynamicDowncast<JSC::JSPromise>(promiseValue)) {
-            promise->reject(vm, globalObject, exception->value());
+            promise->reject(vm, exception->value());
             RETURN_IF_EXCEPTION(scope, );
             return;
         }
@@ -3674,7 +3674,7 @@ void JSC__AnyPromise__wrap(JSC::JSGlobalObject* globalObject, EncodedJSValue enc
 
     if (auto* errorInstance = dynamicDowncast<JSC::ErrorInstance>(result)) {
         if (auto* promise = dynamicDowncast<JSC::JSPromise>(promiseValue)) {
-            promise->reject(vm, globalObject, errorInstance);
+            promise->reject(vm, errorInstance);
             RETURN_IF_EXCEPTION(scope, );
             return;
         }
@@ -3736,7 +3736,7 @@ JSC::EncodedJSValue JSC__JSPromise__wrap(JSC::JSGlobalObject* globalObject, void
         exception = uncheckedDowncast<JSC::Exception>(value);
     }
 
-    arg0->reject(vm, globalObject, exception);
+    arg0->reject(vm, exception);
 }
 
 [[ZIG_EXPORT(check_slow)]] void JSC__JSPromise__rejectAsHandled(JSC::JSPromise* arg0, JSC::JSGlobalObject* arg1, JSC::EncodedJSValue JSValue2)
@@ -3745,7 +3745,7 @@ JSC::EncodedJSValue JSC__JSPromise__wrap(JSC::JSGlobalObject* globalObject, void
     ASSERT_WITH_MESSAGE(arg0->status() == JSC::JSPromise::Status::Pending, "Promise is already resolved or rejected");
 
     auto& vm = JSC::getVM(arg1);
-    arg0->rejectAsHandled(vm, arg1, JSC::JSValue::decode(JSValue2));
+    arg0->rejectAsHandled(vm, JSC::JSValue::decode(JSValue2));
 }
 
 JSC::JSPromise* JSC__JSPromise__rejectedPromise(JSC::JSGlobalObject* arg0, JSC::EncodedJSValue JSValue1)
@@ -3897,20 +3897,20 @@ void JSC__JSInternalPromise__reject(JSC::JSPromise* arg0, JSC::JSGlobalObject* g
         exception = uncheckedDowncast<JSC::Exception>(value);
     }
 
-    arg0->reject(vm, globalObject, exception);
+    arg0->reject(vm, exception);
 }
 void JSC__JSInternalPromise__rejectAsHandled(JSC::JSPromise* arg0,
     JSC::JSGlobalObject* arg1, JSC::EncodedJSValue JSValue2)
 {
     auto& vm = JSC::getVM(arg1);
-    arg0->rejectAsHandled(vm, arg1, JSC::JSValue::decode(JSValue2));
+    arg0->rejectAsHandled(vm, JSC::JSValue::decode(JSValue2));
 }
 void JSC__JSInternalPromise__rejectAsHandledException(JSC::JSPromise* arg0,
     JSC::JSGlobalObject* arg1,
     JSC::Exception* arg2)
 {
     auto& vm = JSC::getVM(arg1);
-    arg0->rejectAsHandled(vm, arg1, arg2);
+    arg0->rejectAsHandled(vm, arg2);
 }
 
 JSC::JSPromise* JSC__JSInternalPromise__rejectedPromise(JSC::JSGlobalObject* arg0,
diff --git a/src/jsc/bindings/webcore/JSDOMPromiseDeferred.cpp b/src/jsc/bindings/webcore/JSDOMPromiseDeferred.cpp
index a5e6c16becdf..a220c05fd81c 100644
--- a/src/jsc/bindings/webcore/JSDOMPromiseDeferred.cpp
+++ b/src/jsc/bindings/webcore/JSDOMPromiseDeferred.cpp
@@ -84,10 +84,10 @@ void DeferredPromise::callFunction(JSGlobalObject& lexicalGlobalObject, ResolveM
         deferred()->resolve(&lexicalGlobalObject, vm, resolution);
         break;
     case ResolveMode::Reject:
-        deferred()->reject(vm, &lexicalGlobalObject, resolution);
+        deferred()->reject(vm, resolution);
         break;
     case ResolveMode::RejectAsHandled:
-        deferred()->rejectAsHandled(vm, &lexicalGlobalObject, resolution);
+        deferred()->rejectAsHandled(vm, resolution);
         break;
     }
 
diff --git a/src/jsc/bindings/webcore/JSWorker.cpp b/src/jsc/bindings/webcore/JSWorker.cpp
index 366663f38dfb..795273360d3a 100644
--- a/src/jsc/bindings/webcore/JSWorker.cpp
+++ b/src/jsc/bindings/webcore/JSWorker.cpp
@@ -674,7 +674,7 @@ static inline JSC::EncodedJSValue jsWorkerPrototypeFunction_getHeapSnapshotBody(
 
     auto* promise = JSC::JSPromise::create(vm, globalObject->promiseStructure());
     if (!worker.isOnline()) {
-        promise->reject(vm, globalObject,
+        promise->reject(vm,
             Bun::createError(globalObject,
                 Bun::ErrorCode::ERR_WORKER_NOT_RUNNING,
                 "Worker instance not running"_s));
@@ -718,7 +718,7 @@ static inline JSC::EncodedJSValue jsWorkerPrototypeFunction_getHeapSnapshotBody(
         // Worker raced to Closing/Closed between isOnline() and the post.
         // Still on the parent thread — safe to destroy the handle here.
         delete promiseHandle;
-        promise->reject(vm, globalObject,
+        promise->reject(vm,
             Bun::createError(globalObject,
                 Bun::ErrorCode::ERR_WORKER_NOT_RUNNING,
                 "Worker instance not running"_s));
diff --git a/src/runtime/bake/BakeGlobalObject.cpp b/src/runtime/bake/BakeGlobalObject.cpp
index ec57b1632648..7f9271165d10 100644
--- a/src/runtime/bake/BakeGlobalObject.cpp
+++ b/src/runtime/bake/BakeGlobalObject.cpp
@@ -38,7 +38,7 @@ bakeModuleLoaderImportModule(JSC::JSGlobalObject* global,
 
         if (!keyString) {
             auto promise = JSC::JSPromise::create(vm, global->promiseStructure());
-            promise->reject(vm, global, JSC::createError(global, "import() requires a string"_s));
+            promise->reject(vm, JSC::createError(global, "import() requires a string"_s));
             return promise;
         }
 
@@ -96,7 +96,7 @@ static JSC::JSPromise* rejectedInternalPromise(JSC::JSGlobalObject* globalObject
 {
     auto& vm = JSC::getVM(globalObject);
     JSC::JSPromise* promise = JSC::JSPromise::create(vm, globalObject->promiseStructure());
-    promise->rejectAsHandled(vm, globalObject, value);
+    promise->rejectAsHandled(vm, value);
     return promise;
 }
 
@@ -104,7 +104,7 @@ static JSC::JSPromise* resolvedInternalPromise(JSC::JSGlobalObject* globalObject
 {
     auto& vm = JSC::getVM(globalObject);
     JSC::JSPromise* promise = JSC::JSPromise::create(vm, globalObject->promiseStructure());
-    promise->fulfill(vm, globalObject, value);
+    promise->fulfill(vm, value);
     return promise;
 }
 
diff --git a/src/runtime/webview/ChromeBackend.cpp b/src/runtime/webview/ChromeBackend.cpp
index 59292fd6df1e..246c60e68367 100644
--- a/src/runtime/webview/ChromeBackend.cpp
+++ b/src/runtime/webview/ChromeBackend.cpp
@@ -1362,7 +1362,7 @@ static JSPromise* sendChromeOp(JSGlobalObject* g, JSWebView* v,
     // rejectAllAndMarkDead reset it). WebSocket mode doesn't need
     // m_wsOpen here — send() queues until onOpen fires.
     if (t.m_dead || t.m_mode == TransportMode::None) {
-        promise->reject(vm, g, createError(g, "Chrome connection is not available"_s));
+        promise->reject(vm, createError(g, "Chrome connection is not available"_s));
         return promise;
     }
     v->m_pendingActivityCount.fetch_add(1, std::memory_order_release);
diff --git a/src/runtime/webview/JSWebView.cpp b/src/runtime/webview/JSWebView.cpp
index e4aa304e62ab..8b482fc8b18c 100644
--- a/src/runtime/webview/JSWebView.cpp
+++ b/src/runtime/webview/JSWebView.cpp
@@ -63,7 +63,7 @@ void settleSlot(JSGlobalObject* g, JSWebView* v,
     if (ok)
         p->resolve(g, g->vm(), value);
     else
-        p->reject(g->vm(), g, value);
+        p->reject(g->vm(), value);
 }
 
 // --- WebViewEventTarget ----------------------------------------------------
diff --git a/src/runtime/webview/WebKitBackend.cpp b/src/runtime/webview/WebKitBackend.cpp
index 870ea165454d..9701979f6af8 100644
--- a/src/runtime/webview/WebKitBackend.cpp
+++ b/src/runtime/webview/WebKitBackend.cpp
@@ -540,7 +540,7 @@ static JSPromise* sendOp(JSGlobalObject* g, JSWebView* view, WriteBarrier<JSProm
     auto* promise = JSPromise::create(vm, g->promiseStructure());
     auto& c = client();
     if (!c.sock || c.dead || us_socket_is_closed(c.sock)) {
-        promise->reject(vm, g, createError(g, "WebView host process is not running"_s));
+        promise->reject(vm, createError(g, "WebView host process is not running"_s));
         return promise;
     }
     // Inc BEFORE slot.set so GC never observes a set slot with count==0.

From 65efebbee0b751973018187abd6393c57a88b517 Mon Sep 17 00:00:00 2001
From: Sosuke Suzuki <sosuke@bun.com>
Date: Thu, 4 Jun 2026 20:33:56 +0900
Subject: [PATCH 2/5] Bump WEBKIT_VERSION to merged autobuild release

[skip size check]
---
 scripts/build/deps/webkit.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/build/deps/webkit.ts b/scripts/build/deps/webkit.ts
index 31269477efae..995262a97fcc 100644
--- a/scripts/build/deps/webkit.ts
+++ b/scripts/build/deps/webkit.ts
@@ -7,7 +7,7 @@
 // -lto variants built with ThinLTO (per-module summaries for cross-language
 // importing), and the Windows ICU data table filtered + per-item zstd
 // compressed (lazily decompressed via bun_icu_decompress.cpp).
-export const WEBKIT_VERSION = "autobuild-preview-pr-248-cf784902";
+export const WEBKIT_VERSION = "5851d4722e461bae1eb5537b091f4103e192a94a";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.

From acf96b049d99b73ad41698a4cef322727d19bdfe Mon Sep 17 00:00:00 2001
From: SUZUKI Sosuke <sosuke@bun.com>
Date: Fri, 12 Jun 2026 11:21:44 +0900
Subject: [PATCH 3/5] Upgrade WebKit to 24362e675175 (#32105)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> [\!NOTE]
> **Stacked on #31796** (base branch is
`claude/webkit-upgrade-51cc3feb7298`). Retarget to `main` after #31796
merges.
>
> `WEBKIT_VERSION` currently points at the preview build
`autobuild-preview-pr-251-10fc0cab` from
[oven-sh/WebKit#251](https://github.com/oven-sh/WebKit/pull/251). After
that PR merges, bump it to the merge commit's `autobuild-<sha>` release
before merging this PR.

## Bun-side changes

- `VM::getHostFunction` gained an `unsigned length` parameter
(name/length now live on the `NativeExecutable`), and
`JSFunction::finishCreation(VM&, NativeExecutable*, unsigned, const
String&)` was deleted upstream. Updated `JSWrappingFunction`,
`JSFFIFunction`, `NapiClass`, and `JSSQLStatementConstructor` to pass
length/name through `getHostFunction` and use the default
`finishCreation(VM&)`.

## WebKit-fork-side changes (in the merge, oven-sh/WebKit#251)

- Ported the `USE(BUN_JSC_ADDITIONS)` AsyncLocalStorage context wrapping
to upstream's reworked internals:
`InternalMicrotask::AsyncGeneratorResumeNext` →
`AsyncGeneratorAwaitReturn`, and `Promise.prototype.finally` contexts
now use `JSSlimPromiseReaction` instead of
`JSPromiseCombinatorsGlobalContext`.
- Cross-compile fixes: `mig` lookup falls back to `find_program` when
`WebKitXcodeSDK.cmake` isn't included (Linux-hosted macOS build); the
new `InlineCacheHandler::offsetOfUid() == 40` layout-drift
`static_assert` is skipped on Windows, where the MSVC ABI ignores
`[[no_unique_address]]` and the offset is 48.

## Verification

- Full debug build against local WebKit; smoke-tested async generator
`return`/`throw`, AsyncLocalStorage across `await`/`.finally()`/`for
await`, `Promise.prototype.finally` semantics, sqlite, and
`expect.extend`.
- Test runs: `AsyncLocalStorage.test.ts`,
`async-local-storage-thenable.test.ts`,
`AsyncLocalStorage-tracking.test.ts` (74 pass), `ffi.test.js`, napi name
tests — all green.

# WebKit upgrade: `51cc3feb7298` → `24362e675175`

83 commits touching `Source/JavaScriptCore`, `Source/WTF`, and
`Source/bmalloc`.

## Highlights (Bun-relevant)

- **`JSType.h` is unchanged in this range** — no JSType additions or
reordering, so Bun's JSType-based checks need no updates.

- **NativeExecutable gains `name`/`length`, JSFunction `finishCreation`
overloads deleted** (`a633a8abfee7`,
[316443](https://bugs.webkit.org/show_bug.cgi?id=316443)).
NativeExecutable now stores name and length the same way
FunctionExecutable does, so `bind` on native functions stops hitting the
slow path. Embedder-visible API changes:
- `NativeExecutable::create(...)` and both `VM::getHostFunction(...)`
overloads take a new `unsigned length` parameter before `name`.
- `JSFunction::finishCreation(VM&, NativeExecutable*, unsigned length,
const String& name)` (and the ASSERT-only `finishCreation(VM&)`) are
deleted, replaced by `DECLARE_DEFAULT_FINISH_CREATION`. Subclasses that
called the old overload must pass length/name through `NativeExecutable`
instead.
- `JSNativeStdFunction::create` / `JSFunctionWithFields::create` no
longer take separate length/name arguments where the executable already
carries them. New `NativeExecutable::length()` and `nameJSString(VM&)`
accessors.

- **Async generators rewritten to current spec** (`d096ff9cfae1`,
[316447](https://bugs.webkit.org/show_bug.cgi?id=316447)).
`InternalMicrotask::AsyncGeneratorResumeNext` is renamed to
`AsyncGeneratorAwaitReturn` (enum in `Microtask.h`; corresponding
link-time constant removed). The generator state machine replaces
`AwaitingReturn` with a new `DrainingQueue` state and adds a
`YieldNoAwait` suspend reason (reason bit-field widened from 1 to 2
bits). `%AsyncGeneratorPrototype%.return`/`.throw` move from JS builtins
to C++ host functions. Fixes re-entrancy confusion when
`Object.prototype.then` is patched.

- **Promise internals cleanup** (`7b0aff184802`,
[316553](https://bugs.webkit.org/show_bug.cgi?id=316553)).
`JSPromiseCombinatorsGlobalContext` is no longer used as a generic cell
holder: `Promise.prototype.finally` now stores its context in a
`JSSlimPromiseReaction` instead. The combinator context itself now uses
a `uint64_t` remaining-elements count. (Builds on `a633a8abfee7`, which
already touched the same `finally` host functions.)

- **GC / Heap changes**:
- `e69c47917811`
([311420](https://bugs.webkit.org/show_bug.cgi?id=311420)): Heap now
protects StringImpls swapped out by `JSString::swapToAtomString` while a
`GCOwnedDataScope` is on the stack —
`m_possiblyAccessedStringsFromConcurrentThreads` becomes a `(JSString*,
String)` pair list pruned via conservative-root discovery instead of
cleared wholesale. Fixes a dangling-buffer bug.
- `c8e53c74403f`
([316635](https://bugs.webkit.org/show_bug.cgi?id=316635)):
`Heap::clearConcurrentRetainedDataIfPossible()` no longer runs while
concurrent marking is active — fixes a collector-thread use-after-free
on racily-loaded StringImpls.
- `441e3da20428`
([316713](https://bugs.webkit.org/show_bug.cgi?id=316713)):
`deleteUnmarkedCompiledCode` now runs with an unset AtomStringTable in
`Heap::runEndPhase`.
- `4d73bc11dd6c`
([316385](https://bugs.webkit.org/show_bug.cgi?id=316385)):
`FreeList::forEach` interval assert bounded by `MarkedBlock::blockSize`.

- **Module loader fixes**:
- `5c64352cd6cc`
([316615](https://bugs.webkit.org/show_bug.cgi?id=316615)):
`GatherAvailableAncestors` / `AsyncModuleExecutionRejected` in
`CyclicModuleRecord` made iterative — no more stack overflow on deep
async module graphs (top-level-await chains).
- `e46667fac721`
([316610](https://bugs.webkit.org/show_bug.cgi?id=316610)): deferred
module namespace objects (`import defer`) no longer leak the synthetic
`"then"` into `Object.keys`.

- **WTF changes embedders may feel**:
- `aae76637c06f`
([316554](https://bugs.webkit.org/show_bug.cgi?id=316554)):
`URLParser`/IDNA — ASCII domains can no longer fail IDNA mapping, even
when they start with `xn--`. Affects `WTF::URL` host parsing behavior.
- `59604007e4c6`
([316511](https://bugs.webkit.org/show_bug.cgi?id=316511)):
`clampToInteger<T>` in `MathExtras.h` now correctly clamps values below
`INT_MIN`.
- `3997b5c96e77`
([316692](https://bugs.webkit.org/show_bug.cgi?id=316692)): revert of an
`AutomaticThread` change that introduced a race permanently inflating
the active thread count (affected JIT/Wasm worklist threads).
- `6667782c52fa`
([316510](https://bugs.webkit.org/show_bug.cgi?id=316510)): missing
`return` statements fixed in `LazyRef.h`/`LazyUniqueRef.h`.
- Removed files: `wtf/MainThreadData.h`, `wtf/StatisticsManager.{h,cpp}`
(dead-code sweeps `012c64ce3ab1`, `5101cdc679ab`); JSC drops
`dfg/DFGPropertyTypeKey.h` and the unused `TemporalTimeZone*` classes.

- **Codebase-wide C++ modernization** that can affect Bun's C++ bindings
compile: `ab23e0e34b7c`
([304023](https://bugs.webkit.org/show_bug.cgi?id=304023)) uses C++20
concepts across JSC (touches `WriteBarrier.h`, `CagedBarrierPtr.h`);
`f582e488dbf4`
([316055](https://bugs.webkit.org/show_bug.cgi?id=316055)) replaces
C-style arrays with `WTF::toArray()`; `66a98ce83600`
([316364](https://bugs.webkit.org/show_bug.cgi?id=316364)) guards
`Platform.h` defines with `!defined()` checks.

## New language / runtime features

- **`Temporal.ZonedDateTime` implemented** (`27ac373783f0`,
[315939](https://bugs.webkit.org/show_bug.cgi?id=315939)) — ~7.5k lines;
the largest change in the range. Follow-ups: carry non-primary time
zones (`c39b3d4d67cb`,
[316517](https://bugs.webkit.org/show_bug.cgi?id=316517)), spec-aligned
option helpers / Duration internals and removal of the obsolete
`TemporalTimeZone` classes (`063066dc87c7`,
[316370](https://bugs.webkit.org/show_bug.cgi?id=316370)), `destroy`
function for `TemporalZonedDateTime` (`1c8ae9884a85`,
[316334](https://bugs.webkit.org/show_bug.cgi?id=316334)).
- Class-field anonymous function names are now set at parse time instead
of via the `SetFunctionName` bytecode (`b6a9b84dae1f`,
[316646](https://bugs.webkit.org/show_bug.cgi?id=316646)).
- Wasm: `Table` constructor fills funcref tables correctly when the
default value is a wrapper function (`7a35a1699bc9`,
[316280](https://bugs.webkit.org/show_bug.cgi?id=316280)).

## Performance

- New DFG `MultiGetByVal` / `MultiPutByVal` nodes for polymorphic array
access (`8f6bc9a16adf`,
[315832](https://bugs.webkit.org/show_bug.cgi?id=315832)).
- `RegExp.prototype[Symbol.match]` moved from JS builtin to C++ with DFG
intrinsic support (`e922a2cecfac`,
[316509](https://bugs.webkit.org/show_bug.cgi?id=316509)).
- YARR regexp engine: auto-possession optimization (`2a8223d802c8`,
[316491](https://bugs.webkit.org/show_bug.cgi?id=316491)), optimized
ParenContext save/restore (`eef93d3c2048`,
[316555](https://bugs.webkit.org/show_bug.cgi?id=316555)), FixedCount
model changed from save-at-END to save-at-BEGIN (`a92d79b27748`,
[316275](https://bugs.webkit.org/show_bug.cgi?id=316275)),
`ParenthesesSubpatternFixedCount` now supports captures (`3f58e2018a6b`,
[316599](https://bugs.webkit.org/show_bug.cgi?id=316599)).
- Struct-layout optimizations: Parser and Lexer (`8243c6b69d66`,
[316211](https://bugs.webkit.org/show_bug.cgi?id=316211)),
InlineCacheHandler (`8cb7e38ecdc8`,
[316163](https://bugs.webkit.org/show_bug.cgi?id=316163)); Wasm
`FuncRefTable` entry size reduced (`8abf5256fdcb`,
[316305](https://bugs.webkit.org/show_bug.cgi?id=316305)).
- Promise combinators presize the result array from the iterable's size
hint (`c6900eb69893`,
[316548](https://bugs.webkit.org/show_bug.cgi?id=316548)); redundant
eager `length` definition removed from `JSPromiseConstructor`
(`deb8f86fbe49`,
[316478](https://bugs.webkit.org/show_bug.cgi?id=316478)).
- Temporal: ICU `UCalendar` cached per CalendarID (`7636f6149708`,
[316569](https://bugs.webkit.org/show_bug.cgi?id=316569)).

## Fixes

**Spec correctness / runtime:**
- Map/Set iteration fast paths perform `IteratorClose` when the callback
throws (`84a71a9868ed`,
[316495](https://bugs.webkit.org/show_bug.cgi?id=316495)).
- `String#split` RegExp fast path missed side effects of
`ToString(this)` / `ToUint32(limit)` (`b4b15818d650`,
[316508](https://bugs.webkit.org/show_bug.cgi?id=316508)).
- `isDefinitelyNonThenable` Structure cache could go stale when the
prototype belongs to another realm (`8d6b11214830`,
[316506](https://bugs.webkit.org/show_bug.cgi?id=316506)) — affects
promise resolution fast paths.
- "Singleton" invalidation now propagates to the originating SymbolTable
(`6da8ead481eb`,
[316472](https://bugs.webkit.org/show_bug.cgi?id=316472)).
- Fixed opcode assert on `Array.prototype.sort` OSR exit
(`e7d51d19e065`,
[316296](https://bugs.webkit.org/show_bug.cgi?id=316296)).
- YARR: string-list fast path dropped a non-final empty alternative
(`e6d0f57f8d04`,
[316288](https://bugs.webkit.org/show_bug.cgi?id=316288)); interpreter
greedy backtracking now tries up to max count (`5fe4838cb7d1`,
[316378](https://bugs.webkit.org/show_bug.cgi?id=316378)).

**Wasm:**
- Name section parsing made thread-safe (`24362e675175`,
[309538](https://bugs.webkit.org/show_bug.cgi?id=309538)).
- IPInt `memory.atomic.notify`/`wait` and `memory.grow` mishandled dirty
upper bits of i32 operands (`a0d2eebf9e13`,
[316507](https://bugs.webkit.org/show_bug.cgi?id=316507)).
- OMG tail-call patchpoint clobbers late pinned registers
(`c18d1e3571f4`,
[316227](https://bugs.webkit.org/show_bug.cgi?id=316227)).

**Temporal / Intl hardening** (mostly crash and OOB fixes in the new
Temporal code):
- OOB read in `ISO8601::parseDate` on short invalid strings
(`d58bad697e50`,
[316366](https://bugs.webkit.org/show_bug.cgi?id=316366)); crash in
`PlainMonthDay.from` with very large strings (`221dcc89aba8`,
[316805](https://bugs.webkit.org/show_bug.cgi?id=316805)); double-throw
crash in Temporal constructors (`19e18af9f088`,
[316793](https://bugs.webkit.org/show_bug.cgi?id=316793)); `PlainDate`
add/subtract day-range assertion (`2c290815d421`,
[316368](https://bugs.webkit.org/show_bug.cgi?id=316368)).
- Stricter ICU error handling (`178eab311235`,
[316346](https://bugs.webkit.org/show_bug.cgi?id=316346));
`toIntegerWithTruncation` for Temporal conversions (`66267990831b`,
[316369](https://bugs.webkit.org/show_bug.cgi?id=316369)); Japanese era
fast-path validation (`31e50e893a11`,
[316477](https://bugs.webkit.org/show_bug.cgi?id=316477)); date-spec
invariants (`544a3bff9b31`,
[316440](https://bugs.webkit.org/show_bug.cgi?id=316440)).
- `Intl.DateTimeFormat` with Temporal types: era width preserved
(`9cd3289437d5`,
[316048](https://bugs.webkit.org/show_bug.cgi?id=316048)); calendar
passed to ICU in BCP47 form (`45b638378595`,
[315984](https://bugs.webkit.org/show_bug.cgi?id=315984)).

**Build / misc:**
- Non-unified and unified build fixes (`ee637a607df2`,
[316381](https://bugs.webkit.org/show_bug.cgi?id=316381);
`6c8b20e9f7b2`,
[316374](https://bugs.webkit.org/show_bug.cgi?id=316374)); PlayStation
SIMDUTF AVX-512 build fix (`08e30f68509b`,
[316649](https://bugs.webkit.org/show_bug.cgi?id=316649)).
- Build-parallelism work landed, was reverted, and re-landed
(`c9e9995641cc` → `653a36adb39a` → `09f89f078e7d`,
[316232](https://bugs.webkit.org/show_bug.cgi?id=316232)); assorted
CMake configuration changes (Apple SDK/ICU handling, configure-time
probe skipping).
- Dead-code removal sweeps (`012c64ce3ab1`,
[316520](https://bugs.webkit.org/show_bug.cgi?id=316520);
`5101cdc679ab`,
[316502](https://bugs.webkit.org/show_bug.cgi?id=316502)); libpas test
harness changes (`e7665a906ab0`,
[316595](https://bugs.webkit.org/show_bug.cgi?id=316595);
`1a8a72a5bc1a`,
[316457](https://bugs.webkit.org/show_bug.cgi?id=316457)).
- Remaining commits in the range are Web Inspector / Site Isolation
protocol work, CSS `calc-mix()`, MediaSession, and visionOS test changes
that only incidentally touch generated inspector code under
`Source/JavaScriptCore/inspector`.
---
 scripts/build/deps/webkit.ts               |  2 +-
 src/jsc/bindings/JSFFIFunction.cpp         | 16 +++++-----------
 src/jsc/bindings/JSFFIFunction.h           |  1 -
 src/jsc/bindings/JSWrappingFunction.cpp    | 10 ++--------
 src/jsc/bindings/JSWrappingFunction.h      |  2 --
 src/jsc/bindings/NapiClass.cpp             |  8 ++++----
 src/jsc/bindings/napi.h                    |  2 +-
 src/jsc/bindings/sqlite/JSSQLStatement.cpp |  2 +-
 8 files changed, 14 insertions(+), 29 deletions(-)

diff --git a/scripts/build/deps/webkit.ts b/scripts/build/deps/webkit.ts
index 995262a97fcc..4243e2e658a3 100644
--- a/scripts/build/deps/webkit.ts
+++ b/scripts/build/deps/webkit.ts
@@ -7,7 +7,7 @@
 // -lto variants built with ThinLTO (per-module summaries for cross-language
 // importing), and the Windows ICU data table filtered + per-item zstd
 // compressed (lazily decompressed via bun_icu_decompress.cpp).
-export const WEBKIT_VERSION = "5851d4722e461bae1eb5537b091f4103e192a94a";
+export const WEBKIT_VERSION = "autobuild-preview-pr-251-92b221c1";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.
diff --git a/src/jsc/bindings/JSFFIFunction.cpp b/src/jsc/bindings/JSFFIFunction.cpp
index d03353812655..cbe3a0f2d373 100644
--- a/src/jsc/bindings/JSFFIFunction.cpp
+++ b/src/jsc/bindings/JSFFIFunction.cpp
@@ -150,18 +150,12 @@ void JSFFIFunction::visitChildrenImpl(JSCell* cell, Visitor& visitor)
 
 DEFINE_VISIT_CHILDREN(JSFFIFunction);
 
-void JSFFIFunction::finishCreation(VM& vm, NativeExecutable* executable, unsigned length, const String& name)
-{
-    Base::finishCreation(vm, executable, length, name);
-    ASSERT(inherits(info()));
-}
-
 JSFFIFunction* JSFFIFunction::create(VM& vm, Zig::GlobalObject* globalObject, unsigned length, const String& name, FFIFunction FFIFunction, Intrinsic intrinsic, NativeFunction nativeConstructor)
 {
-    NativeExecutable* executable = vm.getHostFunction(FFIFunction, ImplementationVisibility::Public, intrinsic, FFIFunction, nullptr, name);
+    NativeExecutable* executable = vm.getHostFunction(FFIFunction, ImplementationVisibility::Public, intrinsic, FFIFunction, nullptr, length, name);
     Structure* structure = globalObject->FFIFunctionStructure();
     JSFFIFunction* function = new (NotNull, allocateCell<JSFFIFunction>(vm)) JSFFIFunction(vm, executable, globalObject, structure, reinterpret_cast<CFFIFunction>(WTF::move(FFIFunction)));
-    function->finishCreation(vm, executable, length, name);
+    function->finishCreation(vm);
     return function;
 }
 
@@ -178,13 +172,13 @@ JSC_DEFINE_HOST_FUNCTION(JSFFIFunction::trampoline, (JSC::JSGlobalObject * globa
 JSFFIFunction* JSFFIFunction::createForFFI(VM& vm, Zig::GlobalObject* globalObject, unsigned length, const String& name, CFFIFunction FFIFunction)
 {
 #if OS(WINDOWS)
-    NativeExecutable* executable = vm.getHostFunction(trampoline, ImplementationVisibility::Public, NoIntrinsic, trampoline, nullptr, name);
+    NativeExecutable* executable = vm.getHostFunction(trampoline, ImplementationVisibility::Public, NoIntrinsic, trampoline, nullptr, length, name);
 #else
-    NativeExecutable* executable = vm.getHostFunction(FFIFunction, ImplementationVisibility::Public, NoIntrinsic, FFIFunction, nullptr, name);
+    NativeExecutable* executable = vm.getHostFunction(FFIFunction, ImplementationVisibility::Public, NoIntrinsic, FFIFunction, nullptr, length, name);
 #endif
     Structure* structure = globalObject->FFIFunctionStructure();
     JSFFIFunction* function = new (NotNull, allocateCell<JSFFIFunction>(vm)) JSFFIFunction(vm, executable, globalObject, structure, reinterpret_cast<CFFIFunction>(WTF::move(FFIFunction)));
-    function->finishCreation(vm, executable, length, name);
+    function->finishCreation(vm);
     return function;
 }
 
diff --git a/src/jsc/bindings/JSFFIFunction.h b/src/jsc/bindings/JSFFIFunction.h
index 6eccae7b6174..fde3e215adbf 100644
--- a/src/jsc/bindings/JSFFIFunction.h
+++ b/src/jsc/bindings/JSFFIFunction.h
@@ -91,7 +91,6 @@ class JSFFIFunction final : public JSC::JSFunction {
 
 private:
     JSFFIFunction(VM&, NativeExecutable*, JSGlobalObject*, Structure*, CFFIFunction&&);
-    void finishCreation(VM&, NativeExecutable*, unsigned length, const String& name);
     DECLARE_VISIT_CHILDREN;
 
     CFFIFunction m_function;
diff --git a/src/jsc/bindings/JSWrappingFunction.cpp b/src/jsc/bindings/JSWrappingFunction.cpp
index 2b35c618e96e..57f53d111b23 100644
--- a/src/jsc/bindings/JSWrappingFunction.cpp
+++ b/src/jsc/bindings/JSWrappingFunction.cpp
@@ -31,23 +31,17 @@ JS_EXPORT_PRIVATE JSWrappingFunction* JSWrappingFunction::create(
     auto name = Identifier::fromString(vm, nameStr);
     // Pass callHostFunctionAsConstructor so `new` on the wrapper throws a
     // TypeError instead of jumping to a null native constructor.
-    NativeExecutable* executable = vm.getHostFunction(functionPointer, ImplementationVisibility::Public, callHostFunctionAsConstructor, nameStr);
+    NativeExecutable* executable = vm.getHostFunction(functionPointer, ImplementationVisibility::Public, callHostFunctionAsConstructor, 0, nameStr);
 
     // Structure* structure = globalObject->FFIFunctionStructure();
     Structure* structure = JSWrappingFunction::createStructure(vm, globalObject, globalObject->objectPrototype());
     JSWrappingFunction* function = new (NotNull, allocateCell<JSWrappingFunction>(vm)) JSWrappingFunction(vm, executable, globalObject, structure, wrappedFn);
     ASSERT(function->structure()->globalObject());
-    function->finishCreation(vm, executable, 0, nameStr);
+    function->finishCreation(vm);
 
     return function;
 }
 
-void JSWrappingFunction::finishCreation(VM& vm, NativeExecutable* executable, unsigned length, const String& name)
-{
-    Base::finishCreation(vm, executable, length, name);
-    ASSERT(inherits(info()));
-}
-
 template<typename Visitor>
 void JSWrappingFunction::visitChildrenImpl(JSCell* cell, Visitor& visitor)
 {
diff --git a/src/jsc/bindings/JSWrappingFunction.h b/src/jsc/bindings/JSWrappingFunction.h
index 5b2aec591ba3..18aa6d3aaeda 100644
--- a/src/jsc/bindings/JSWrappingFunction.h
+++ b/src/jsc/bindings/JSWrappingFunction.h
@@ -65,8 +65,6 @@ class JSWrappingFunction final : public JSC::JSFunction {
     {
     }
 
-    void finishCreation(JSC::VM&, JSC::NativeExecutable*, unsigned length, const String& name);
-
     DECLARE_VISIT_CHILDREN;
 
     JSC::WriteBarrier<JSC::JSObject> m_wrappedFn;
diff --git a/src/jsc/bindings/NapiClass.cpp b/src/jsc/bindings/NapiClass.cpp
index 37381160e7ef..19a0616fbf68 100644
--- a/src/jsc/bindings/NapiClass.cpp
+++ b/src/jsc/bindings/NapiClass.cpp
@@ -92,19 +92,19 @@ NapiClass* NapiClass::create(VM& vm, napi_env env, WTF::String name,
         NapiClass_ConstructorFunction<false>,
         ImplementationVisibility::Public,
         // for constructor call
-        NapiClass_ConstructorFunction<true>, name);
+        NapiClass_ConstructorFunction<true>, 0, name);
     Structure* structure = env->globalObject()->NapiClassStructure();
     NapiClass* napiClass = new (NotNull, allocateCell<NapiClass>(vm)) NapiClass(vm, executable, env, structure, data);
-    napiClass->finishCreation(vm, executable, name, constructor, data, property_count, properties);
+    napiClass->finishCreation(vm, name, constructor, data, property_count, properties);
     return napiClass;
 }
 
-void NapiClass::finishCreation(VM& vm, NativeExecutable* executable, const String& name, napi_callback constructor,
+void NapiClass::finishCreation(VM& vm, const String& name, napi_callback constructor,
     void* data,
     size_t property_count,
     const napi_property_descriptor* properties)
 {
-    Base::finishCreation(vm, executable, 0, name);
+    Base::finishCreation(vm);
     ASSERT(inherits(info()));
     this->m_constructor = constructor;
     auto globalObject = static_cast<Zig::GlobalObject*>(this->globalObject());
diff --git a/src/jsc/bindings/napi.h b/src/jsc/bindings/napi.h
index aa305eae35c3..aa4a29f5cb1a 100644
--- a/src/jsc/bindings/napi.h
+++ b/src/jsc/bindings/napi.h
@@ -828,7 +828,7 @@ class NapiClass final : public JSC::JSFunction {
     {
     }
 
-    void finishCreation(VM&, NativeExecutable*, const String& name, napi_callback constructor,
+    void finishCreation(VM&, const String& name, napi_callback constructor,
         void* data,
         size_t property_count,
         const napi_property_descriptor* properties);
diff --git a/src/jsc/bindings/sqlite/JSSQLStatement.cpp b/src/jsc/bindings/sqlite/JSSQLStatement.cpp
index c68c7c2e8ba1..1e90204a307d 100644
--- a/src/jsc/bindings/sqlite/JSSQLStatement.cpp
+++ b/src/jsc/bindings/sqlite/JSSQLStatement.cpp
@@ -1685,7 +1685,7 @@ JSC_DEFINE_HOST_FUNCTION(jsSQLStatementPrepareStatementFunction, (JSC::JSGlobalO
 
 JSSQLStatementConstructor* JSSQLStatementConstructor::create(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::Structure* structure)
 {
-    NativeExecutable* executable = vm.getHostFunction(jsSQLStatementPrepareStatementFunction, ImplementationVisibility::Private, callHostFunctionAsConstructor, String("SQLStatement"_s));
+    NativeExecutable* executable = vm.getHostFunction(jsSQLStatementPrepareStatementFunction, ImplementationVisibility::Private, callHostFunctionAsConstructor, 0, String("SQLStatement"_s));
     JSSQLStatementConstructor* ptr = new (NotNull, JSC::allocateCell<JSSQLStatementConstructor>(vm)) JSSQLStatementConstructor(vm, executable, globalObject, structure);
     ptr->finishCreation(vm);
 

From b4524822687f0522c756c1850c42d6d6d1ca123d Mon Sep 17 00:00:00 2001
From: Sosuke Suzuki <sosuke@bun.com>
Date: Mon, 15 Jun 2026 13:05:38 +0900
Subject: [PATCH 4/5] Upgrade WebKit to
 9cb85a0716065c461bea14a0de9fe7139e5323aa

Move WEBKIT_VERSION off the per-PR preview build onto the latest
released autobuild, which includes the YarrJIT variable-count
parentheses fix.
---
 scripts/build/deps/webkit.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/build/deps/webkit.ts b/scripts/build/deps/webkit.ts
index 4243e2e658a3..2fe21b9b261d 100644
--- a/scripts/build/deps/webkit.ts
+++ b/scripts/build/deps/webkit.ts
@@ -7,7 +7,7 @@
 // -lto variants built with ThinLTO (per-module summaries for cross-language
 // importing), and the Windows ICU data table filtered + per-item zstd
 // compressed (lazily decompressed via bun_icu_decompress.cpp).
-export const WEBKIT_VERSION = "autobuild-preview-pr-251-92b221c1";
+export const WEBKIT_VERSION = "autobuild-9cb85a0716065c461bea14a0de9fe7139e5323aa";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.

From c4794e757950da2e24cb3f6c8d3b974a2699de14 Mon Sep 17 00:00:00 2001
From: Sosuke Suzuki <sosuke@bun.com>
Date: Tue, 16 Jun 2026 10:50:07 +0900
Subject: [PATCH 5/5] Drop autobuild- prefix from WEBKIT_VERSION

---
 scripts/build/deps/webkit.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/build/deps/webkit.ts b/scripts/build/deps/webkit.ts
index 2fe21b9b261d..982088651f91 100644
--- a/scripts/build/deps/webkit.ts
+++ b/scripts/build/deps/webkit.ts
@@ -7,7 +7,7 @@
 // -lto variants built with ThinLTO (per-module summaries for cross-language
 // importing), and the Windows ICU data table filtered + per-item zstd
 // compressed (lazily decompressed via bun_icu_decompress.cpp).
-export const WEBKIT_VERSION = "autobuild-9cb85a0716065c461bea14a0de9fe7139e5323aa";
+export const WEBKIT_VERSION = "9cb85a0716065c461bea14a0de9fe7139e5323aa";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.