Upgrade WebKit to 0e86b49069a5 - #33956
Conversation
|
Warning Review limit reached
Next review available in: 13 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
WalkthroughChangesThe WebKit prebuilt target, deferred-work ticket interfaces, timezone cache invalidation, serialization exception handling, sparse-array indexing, and related runtime tests and expectations are updated. WebKit runtime alignment
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
Comment |
|
Updated 11:41 AM PT - Jul 14th, 2026
❌ @robobun, your commit daa2b74 has some failures in 🧪 To try this PR locally: bunx bun-pr 33956That installs a local version of the PR into your bun-33956 --bun |
|
Found 10 issues this PR may fix:
🤖 Generated with Claude Code |
|
This PR may be a duplicate of:
🤖 Generated with Claude Code |
|
Status: blocked on the WebKit preview build.
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
Root-caused the preview build failures and pushed fixes.
|
There was a problem hiding this comment.
The Bun-side binding ports look correct and my earlier findings are addressed, but this is a JSC engine upgrade (752 upstream commits, Temporal enabled by default, DeferredWorkTimer lifetime rework) still pinned to a preview WebKit build — needs a human sign-off and green CI before landing.
What was reviewed:
DeferredWorkTimerhook signatures:TicketData→Ticketrename,Ref<Ticket>storage, andjob->task(job->ticket.get())matching the newFunction<void(Ticket&)>shape.- The three TZ-setter call sites ported to
WTF::timeZoneDidChange()+dateCache.clearForTimeZoneChange()consistently. SparseArrayValueMapiteration:.key→.index()is the mechanical HashSet-entry accessor swap.- The earlier
isLocked()→!isDetachable()regression is resolved by re-addingisLocked()on the fork;SerializedScriptValue.cppis no longer in this diff, and the new test covers the pin-borrow copy contract.
Extended reasoning...
Overview
This PR bumps the vendored WebKit/JavaScriptCore to upstream 0e86b49069a5 (752 commits, 92 in JSC) and ports Bun's C++ bindings to four upstream API changes: the DeferredWorkTimer::TicketData→Ticket rename with weak-ticket semantics, the host time-zone cache moving into WTF (resetIfNecessarySlow→timeZoneDidChange+clearForTimeZoneChange), SparseArrayValueMap becoming a HashSet (.key→.index()), and ArrayBuffer::isLocked() removal. It also enables Temporal by default (user-visible) and adds a smoke-test file.
Security risks
No new attack surface introduced by the Bun-side diffs themselves — they are type/signature adaptations. The upstream changelog includes several JSC/bmalloc memory-safety fixes (DeferredWorkTimer UAF, libpas races), which is net-positive but also means the ticket-lifetime code touched here is exactly the kind of cross-thread refcounted path where a mis-port would be a UAF. The JSCTaskScheduler port keeps Ref<Ticket> ownership in the pending-ticket sets and in JSCDeferredWorkTask, and onScheduleWorkSoon constructs a new Ref from the raw Ticket* (via *ticket) — this looks correct given the fork's hook fires only after the dead/cancelled guard, but it is memory-safety-sensitive C++ that warrants human eyes.
Level of scrutiny
High. This is the JavaScript engine itself: a wrong port in JSCTaskScheduler or the DateCache invalidation path affects every Bun program. The PR also flips a language feature (Temporal) on by default and is currently pinned to an unmerged preview build (autobuild-preview-pr-280-03a6cd14) with CI still building. The PR description itself flags that WEBKIT_VERSION must be bumped to the final autobuild tag before merge.
Other factors
- I previously flagged that swapping
isLocked()for!isDetachable()inSerializedScriptValue.cppregressed Bun's pin-borrow transfer contract; that was fixed by re-addingisLocked()on the fork side, so the file is no longer in this diff and the new test asserts the copy-instead-of-throw behavior. - I also flagged two test-file conventions (stderr assertion, concurrency); both were applied in bf7ac13.
- The Bun-side changes are small and mechanical, but the surface area of the underlying WebKit bump and the fork-side changes in oven-sh/WebKit#280 are well beyond what an automated review can vouch for.
bf7ac13 to
a035ce1
Compare
|
Unblocked; both CI fronts are now running.
|
There was a problem hiding this comment.
My earlier findings (the isLocked() → !isDetachable() regression and the test-file conventions) are both addressed and I found nothing new this pass, but a WebKit engine bump of this scope — plus the still-pending WEBKIT_VERSION swap off the preview tag — should get human eyes before merge.
Checked this pass: the Ticket* → Ref<Ticket> construction in onScheduleWorkSoon keeps a strong ref through JSCDeferredWorkTask so the ticket can't die before runPendingWork; the three TZ call sites all pair WTF::timeZoneDidChange() with clearForTimeZoneChange(); the SparseArrayValueMap iteration change is a mechanical .key → .index() rename; and the new structuredClone test covers all three pin/lock states.
Extended reasoning...
Overview
This PR bumps the vendored WebKit/JavaScriptCore to upstream 0e86b49069a5 (752 upstream commits, 92 in JSC) via oven-sh/WebKit#280, and ports Bun's C++ bindings to the resulting API changes: DeferredWorkTimer::TicketData → Ticket with Task = Function<void(Ticket&)>, the timezone-cache reset moving to WTF::timeZoneDidChange() + DateCache::clearForTimeZoneChange(), SparseArrayValueMap becoming a HashSet (iterator yields SparseArrayEntry& with .index()), and ArrayBuffer::isLocked() being re-added on the fork so SerializedScriptValue keeps Bun's pin-copies-instead-of-throws contract. It also enables Temporal globally and adds a smoke-test file.
Security risks
The Bun-side diff itself is mechanical signature/API porting with no new trust boundaries. The real risk surface is the 752 upstream WebKit commits (JIT, GC, bmalloc, libpas), which are outside this diff and impossible to review here. The DeferredWorkTimer ticket rework touches cross-thread lifetime; I verified onScheduleWorkSoon takes a strong Ref<Ticket> into JSCDeferredWorkTask (via *ticket) before enqueuing, and runPendingWork still checks isCancelled() before invoking, so the fork's post-guard hook ordering plus Bun's own strong ref look consistent.
Level of scrutiny
Maximum. This replaces the JavaScript engine. Even though every Bun-side hunk is a small, well-justified port, the upgrade pulls in JIT/GC/allocator changes whose correctness can only be established by the full CI matrix and human sign-off. The PR description itself flags that WEBKIT_VERSION still points at a preview tag (autobuild-preview-pr-280-03a6cd14) and must be bumped to the merged autobuild-<sha> before landing, and robobun's latest status notes a further pending bump to 1883052d to pick up oven-sh/WebKit#278 — so the PR is explicitly not merge-ready yet.
Other factors
Both of my earlier inline findings were addressed and the threads resolved: the fork re-adds ArrayBuffer::isLocked() under USE(BUN_JSC_ADDITIONS) and SerializedScriptValue.cpp reverted to it (with a new zlib-borrow transfer test), and the test file now uses describe.concurrent with combined {stdout, stderr, exitCode} assertions. The bug-hunting system found nothing new on the current revision. Given the scope, the pending version pin, and that WebKit upgrades in this repo customarily land with maintainer review, deferring to a human is the only reasonable call.
|
Status after 70aa5a1 (rebased onto What is done
The two remaining reds from build 72402Both are verbatim upstream Node
Everything else on the build-72402 matrix was in the flaky-retry bucket (install proxy timeouts, NextOnce oven-sh/WebKit#280 merges to fork |
0f6277a to
70aa5a1
Compare
|
Build #72625 (with the two Windows onGC flakes quarantined in 70aa5a1) is down to a single hard failure.
So the upgrade raised idle CPU on macOS aarch64 from ~0.x% to ~4-8% for an idle Bun.serve websocket. Likely collateral from the RunLoop/timer or microtask-queue changes in the 752 upstream commits; none of the Bun-side porting in this PR touches the idle-loop path. Needs a macOS box to profile. Everything else in the matrix is green or flaky-passed-on-retry. |
Point WEBKIT_VERSION at the oven-sh/WebKit#280 preview build and port Bun's C++ bindings to the upstream API changes it carries: - DeferredWorkTimer: TicketData renamed to Ticket, hooks now take Ref<Ticket>&& / Ticket*, and Task is Function<void(Ticket&)>. JSCTaskScheduler and BunClientData updated; the unused getVM helper and the TicketData alias are removed. - JSDateMath: resetIfNecessarySlow() is gone. After setTimeZoneOverride(), bump WTF::timeZoneDidChange() and call dateCache.clearForTimeZoneChange() in ZigGlobalObject, JSEnvironmentVariableMap and BunJSCModule. - SparseArrayValueMap: entries expose .index() instead of .key. - ArrayBuffer: isLocked() replaced by !isDetachable() in SerializedScriptValue.
Covers Temporal (now on by default, bug 318885), process.env.TZ after the clearForTimeZoneChange() rewrite, FinalizationRegistry cleanup through the ported DeferredWorkTimer hooks, and structuredClone transfer through the isDetachable() rewrite. All four spawn a child so a compile-time or runtime abort in the touched path becomes an ordinary exitCode failure.
…uffers Swapping isLocked() for !isDetachable() regressed Bun's documented contract (bindings.cpp:3147): a buffer that Bun has pin()ed for an async borrow (zlib, fs, crypto, shell, Bun.Image, SQL) must fall through to transferTo()'s copy path, not throw. oven-sh/WebKit#280 now re-adds ArrayBuffer::isLocked() under USE(BUN_JSC_ADDITIONS) as the s_lockedFlag bit of m_pinCount, so the guard goes back to isLocked() and rejects only WASM-memory / C-API buffers. Also: bump WEBKIT_VERSION to preview 03a6cd14 (macOS header-layout fix for bug 317899), make the smoke tests concurrent, and add coverage for the pinned-buffer-copies case.
… error The isLocked() branch declared its own nested DECLARE_THROW_SCOPE inside create(), which trips validateExceptionChecks on the x64-asan lane now that the upgraded WebKit registers a simulated throw in the transfer-list loop before the inner scope is declared. Match upstream WebCore and throw via the function's existing scope; RELEASE_AND_RETURN becomes a plain return since there is no nested scope to release.
test-worker-message-port-transfer-terminate.js races w.postMessage against w.terminate; after the WebKit upgrade the termination trap can land such that dispatchErrorWithValue and MessageEvent::create are entered with a TerminatedExecutionError still on vm.m_exception. CloneSerializer then reaches JSValue::get / getOwnPropertyDescriptor on the error instance and trips their EXCEPTION_ASSERT on the x64-asan lane. - SerializedScriptValue::create: bail with ExistingExceptionError immediately if entered with an exception pending, so the serializer never runs property access with an inherited exception. - Worker::dispatchErrorWithValue: clear any inherited exception on entry and return early if a termination is pending. - MessageEvent::create: clear the exception when deserialize leaves one set, before the toJS(...) wrapper call. 40/40 local stress runs pass under BUN_JSC_validateExceptionChecks=1.
…tion trap After the WebKit 0e86b49069a5 scheduling changes (DeferredWorkTimer, microtask-queue fast path), w.terminate() racing postMessage can leave the termination trap armed at the point Worker's message-dispatch callers enter JS, tripping the validateExceptionChecks EXCEPTION_ASSERT in JSValue::get / getOwnPropertyDescriptor on the x64-asan lane. - drainInbox: declare a TopExceptionScope and bail before each entanglePorts / MessageEvent::create / dispatch step if an exception is pending or the trap is armed. - WebWorker__dispatchError: clear any inherited exception and fall back to the string path when termination is requested instead of re-entering JS. - dispatchErrorWithValue / WebWorker__entrySettled: check hasTerminationRequest (the persistent trap flag) rather than hasPendingTerminationException, which is always false after the preceding CLEAR_IF_EXCEPTION. A residual ~2% race remains under BUN_JSC_validateExceptionChecks=1 that I was unable to stack-trace (lldb/gdb change the timing enough to hide it), and the assertion is a debug-only validator with no release-build effect, so test-worker-message-port-transfer-terminate.js is added to test/no-validate-exceptions.txt pending a follow-up.
The drainInbox TopExceptionScope and the WebWorker__dispatchError scope left an exception live on exit paths that lead to an explicit assertNoException(), breaking seventeen worker-related tests on the x64-asan lane. Revert Worker.cpp to its state at f33da7e (which only adds the CLEAR_IF_EXCEPTION in dispatchErrorWithValue) and keep the no-validate-exceptions.txt entry for test-worker-message-port-transfer-terminate.js, whose residual race is a debug-only validator assertion with no release-build effect.
oven-sh/WebKit#280 was merged with fork main to pick up oven-sh/WebKit#278 (the DFG/FTL PerformPromiseThenOneHandler async-context bailout for #33806); the preview release is published with 43 artifacts.
…ern as dispatchErrorWithValue)
…ay pending before toJS 92eca27 switched to clearExceptionExceptTermination() per review, but the immediately-following toJS()/dispatch path reaches JSValue::get whose EXCEPTION_ASSERT fires on a real pending termination under ASAN builds (where ENABLE_EXCEPTION_SCOPE_VERIFICATION maps EXCEPTION_ASSERT to RELEASE_ASSERT). clearException() is correct here: the VMTraps termination-request flag survives and re-raises at the next JS entry.
97e419d to
fbd97ff
Compare
…on ASAN [skip size check] The no-validate-exceptions.txt entry only controls the simulated-throw env var; on release-ASan ENABLE_EXCEPTION_SCOPE_VERIFICATION is (ASSERT_ENABLED || ASAN_ENABLED), so EXCEPTION_ASSERT is RELEASE_ASSERT and the real TerminatedExecutionError race still trips it. Move the suppression to expectations.txt as [ ASAN ] [ FLAKY ] so the runner retries. Size check: the 752-commit JSC upgrade (Temporal on by default, several new DFG/FTL node types) adds 256-520KB on most targets; darwin shrinks ~900KB.
fbd97ff to
213c3d3
Compare
…in 4895f45d) [skip size check] Carries oven-sh/WebKit#283 (mimalloc build matrix) and the _LINKED_INTO cmake fix from fork main, plus #278. Preview published with 43 artifacts.
|
Build #72964: all test lanes green (x64/aarch64/asan/windows/darwin-x64/darwin-26-aarch64 all pass; 2 darwin-14-aarch64 shards still queued). The only hard failure is Bisected across this branch's builds:
The rebase onto main brought in #34009 (share one allocator between JSC and Bun), which "requires oven-sh/WebKit#283". Even with the 51b5559a preview (which has #283 merged), the arm64-baseline binary segfaults in the Gigacage address range on a no-LSE CPU. This did not reproduce on any of the full-feature arm64 test lanes. I cannot reproduce locally (x64 only). The crash report is https://bun.report/1.4.0/L_2daa2b74gGgkggC+xjnqCA2gIg8/pZ. Suspects are the libpas→mimalloc hooks from #34009 combined with the heap/marking changes in the upgraded WebKit, or an instruction the upgraded bmalloc now emits that assumes LSE. Needs an arm64 box to root-cause. |
… the last (#34576) `test/js/bun/http/bun-server.test.ts` → `should not use 100% CPU when websocket is idle` has been going red on the Windows 11 aarch64 lane in roughly one build in six (e.g. [75052](https://buildkite.com/bun/bun/builds/75052), [75150](https://buildkite.com/bun/bun/builds/75150), [75179](https://buildkite.com/bun/bun/builds/75179)), always with the same shape: ``` CPU Usage: 0.00% CPU Usage: 0.00% CPU Usage: 6.20% error: expect(received).toBe(expected) Expected: 0 Received: 1 ``` ### Cause The fixture from #25475 samples `process.cpuUsage()` three times at 1-second intervals and exits nonzero if the **third** sample is `>= 2%`. On Windows, `process.cpuUsage()` is backed by `GetProcessTimes`, which accounts CPU time at timer-tick boundaries (the default tick is ~15.625ms). A sample therefore reads as a multiple of ~1.56%: one tick is ~1.56%, two ticks ~3.12%, and so on. A couple of background-thread wakeups (mimalloc scavenger, JSC timers, TLS) that happen to straddle a tick boundary during the third second are enough to cross 2% with the event loop properly idle. Measured on a Windows 11 aarch64 box over 100 runs of the unmodified fixture: 15/100 had the third sample `>= 2%` (max 13.85%), while the minimum across the three samples was `0` in 97 runs and never exceeded `3.05%`. The same assertion also fails under the local ASAN debug build on Linux (first sample ~28%, third ~3.7%) for the same overhead reason. ### Fix The #25475 regression is a busy-spinning event loop that holds **every** sample near 100%, so the minimum across the three samples is the right statistic to test "not busy-looping": an idle loop always has at least one quiet sample, a spinning loop has none. Gate on that minimum and use the same 50% bound that `test/regression/issue/21654` already uses for its spin-loop-vs-idle check. The regression would still read ~100% on all three samples and fail; scheduler/tick noise cannot reach it. ### Verification - Windows 11 aarch64, fixture run directly: **0/100** failures after (15/100 before). - Windows 11 aarch64, via the test runner: **0/20** failures. - `bun bd test test/js/bun/http/bun-server.test.ts -t "should not use 100% CPU"` on Linux now passes (was failing under ASAN). - Sanity check: a simulated busy loop (`setImmediate` chain) reports min ≈ 100% and the fixture exits 1. Open PR #33956 bumps the same threshold to 15% for `darwin-arm64` only; this change is platform-agnostic and subsumes that hunk. <!-- robobun:evidence:begin --> --- **no test proof** · iteration 0 · docs-only change; test-proof not applicable <!-- robobun:evidence:end -->
|
Closing as superseded. Main moved past upstream What this PR carried, and where it ended up:
oven-sh/WebKit#280 on the fork side is still open and is superseded in the same way. |
1 participant
Bumps
vendor/WebKitto upstreamWebKit/WebKit@0e86b49069a5(2026-07-11). 752 upstream commits since the last Bun sync point (d81bcc3d833c, 2026-06-30); 92 touchSource/JavaScriptCore, 54 touchSource/WTF, 12 touchSource/bmalloc.The fork-side work is in oven-sh/WebKit#280, which also carries oven-sh/WebKit#269 and oven-sh/WebKit#276 (already on fork
mainsince the last pin).Note
WEBKIT_VERSIONcurrently points at the preview buildautobuild-preview-pr-280-03a6cd14. Once oven-sh/WebKit#280 merges tomain, bump it to the resultingautobuild-<sha>before merging this PR.Bun changes required by this upgrade
DeferredWorkTimernow vends weak tickets (https://bugs.webkit.org/show_bug.cgi?id=314671)Upstream renamed
class TicketDatatoclass Ticket, removed theusing Ticket = TicketData*alias, introducedWeakTicket = ThreadSafeWeakPtr<Ticket>, and replacedscheduleWorkSoon(Ticket, Task&&)withscheduleWorkSoonIfActive(const WeakTicket&, Task&&) -> bool.Taskis nowFunction<void(Ticket&)>.src/jsc/bindings/JSCTaskScheduler.{h,cpp}: hook signatures ported toRef<Ticket>&&/Ticket*; the unusedgetVM(Ticket&)helper andTicketDataalias are removed;job->task(...)passesjob->ticket.get()(aTicket&).src/jsc/bindings/BunClientData.cpp: the threeonAddPendingWork/onScheduleWorkSoon/onCancelPendingWorklambdas ported to the new types.The fork's
DeferredWorkTimerhooks now fireonScheduleWorkSoononly after upstream's new dead/cancelled-ticket guard, matching theIfActivecontract; cancelled tickets no longer reach Bun's scheduler.Host time-zone cache moved to WTF (https://bugs.webkit.org/show_bug.cgi?id=314414, https://bugs.webkit.org/show_bug.cgi?id=318841)
Upstream moved the
lastTimeZoneIDatomic intoWTF::TimeZoneand replacedDateCache::resetIfNecessarySlow()withDateCache::clearForTimeZoneChange(). The fork keeps the cache fast path for Bun via|| USE(BUN_JSC_ADDITIONS)on the two guards.src/jsc/bindings/ZigGlobalObject.cpp,src/jsc/bindings/JSEnvironmentVariableMap.cpp,src/jsc/modules/BunJSCModule.h: after a successfulWTF::setTimeZoneOverride(...), bump the global generation withWTF::timeZoneDidChange()and clear this VM's cache withvm.dateCache.clearForTimeZoneChange(). The global bump means other workers'DateCacheinstances also invalidate on their nexthasTimeZoneChange()check.SparseArrayValueMapis now aHashSet(https://bugs.webkit.org/show_bug.cgi?id=318223)src/jsc/bindings/bindings.cpp: iterating aSparseArrayValueMapnow yieldsconst SparseArrayEntry&; the index is.index(), not.key.ArrayBuffer::isLocked()removed (https://bugs.webkit.org/show_bug.cgi?id=318706)src/jsc/bindings/webcore/SerializedScriptValue.cpp:isLocked()becomes!isDetachable(), matching upstream WebCore'sSerializedScriptValue.cpp.User-visible
Temporalis now enabled by default (https://bugs.webkit.org/show_bug.cgi?id=318885).typeof Temporal === "object"in Bun after this upgrade.Verification
Against a debug Bun built from this branch and a local build of oven-sh/WebKit#280:
bun -p 42andbun -e 'console.log(typeof Temporal, Temporal.Now.instant())'run.process.env.TZ = "America/New_York"takes effect on a freshDate.test/js/bun/wasm/wasi.test.js(theDeferredWorkTimerpath via Wasm streaming) passes.Upstream changelog
Memory safety and security
DeferredWorkTimernow vends weak references to tickets, fixing a cross-thread UAF when aJSGlobalObjectdies before background work completes (bug 314671)MicrotaskQueue::drainImplso it cannot be GC'd mid-run (bug 318667)isValid()onAdaptiveValuePropertyInlineCacheClearingWatchpointsofire()never dereferences a deadm_key.object()(bug 312610)m_pendingOffsetis nowstd::optionalwith overflow checks to avoid silently producing invalid metadata addresses (bug 313590)ArrayBufferm_lockedinto the pin count and restore it after any unpin as extra hardening (bug 318706)RunLoop::Timeris stopped/destroyed on its own run loop's thread; flushed out and fixed a real teardown race (bug 318088)pas_segregated_heap_medium_size_directory_for_indexthat could hand out a too-small slot (bug 314829)bmalloc_try_allocate_zeroed_inlinecould return unzeroed memory on the MAR path (bug 314679)Correctness
JSON.stringifyfast path no longer skips a non-enumerable owntoJSONor a replaced array prototype (bug 318507)PromiseResolveThenableJobnow rejects the promise whenSpeciesConstructorthrows (bug 318399)TypedArray.from()no longer spuriously throws whenmapFndetaches or shrinks the source (bug 318596)TypeErrorbefore performing custom-proto access (bug 314063)getByIdMegamorphicnow has a throw scope so getter-thrown exceptions propagate correctly (bug 314002)extrasmaterialization filter so narrowed store values aren't dropped (bug 318373)ExtractFromTuple, andDFGAtTailAbstractStateallows clearing tuple-returning nodes (bug 318513)ExpressionInfo::Encodernow computes extension-island offsets correctly for MultiWide entries (bug 312525)IntlLegacyConstructedSymbolis now per-realm (bug 318421)Errorstack traces now include names forinstantiateStreaming-loaded modules (bug 318710)Compiled(bug 318411)br_on_cast/br_on_cast_failflags byte (bug 315223)PrintStreamtruncation when writing long strings to files (bug 318735)Language features and spec alignment
Temporalobject by default (bug 318885)Temporal.<Type>.prototype.constructor,PlainMonthDay,PlainYearMonth,ZonedDateTime,PlainDateTimespec alignment (bugs 318990, 318977, 318876, 318714, 318454)Intl.NumberFormatnow uses the modernunit/skeleton syntax (bug 318412)Performance
LoadMegamorphicGetterinline cache (bug 318745)RegExpExecStickyDFG node (bug 318538)String#trim/trimStart/trimEndin DFG/FTL (bug 318185)StringSlicerope construction in FTL (bug 318320)HasOwnPropertyon the current for-in name →EnumeratorHasOwnProperty(bug 318528)NewResolvedPromisein DFG constant folding (bug 318515)String#concatarguments based on profiling (bug 318660)LoadVarargsfast path for TypedArrays (bug 318670)Array#concatfast path with multiple arguments (bug 318655)Array#joinwrites rope elements directly into the result buffer (bug 318840)String#replacewith a global RegExp parses the replacement template once (bug 318418)s.split('')(bug 318510)"%XY"escapes inencode()(bug 318334)TokNumberInt32token type inLiteralParser(bug 318937)SparseArrayValueMap~33% smaller viaHashSet(bug 318223)eliminateWasmGCAllocations, fold WasmGC comparisons, propagate block frequency throughB3LowerMacros, skipLowerEntrySwitch/SimplifyCFG, single-pass AirsimplifyCFG, removeAir::lowerMacros, compactAir::Argto 16 bytes,sizeof(Air::Inst)to 64 (bugs 318768, 318753, 314612, 318640, 318653, 318177, 318671, 318822, 318899)TryGetByIdnode (bug 318603)WTF, bmalloc, build system
Int128falls back toInt128Implwhen the standard library lacks__int128_t(bug 318085)Fixes #15853
[decide:webkit] gate passed · iteration 25 · 14 files touched
fails on main (without fix)
passes on PR (with fix)
diff hotspot
gate history · 18 passed · 4 rejected · iteration 25
evidence per changed file