Upgrade WebKit to 0e86b49069a5

scripts/build/deps/webkit.ts

@@ -7,7 +7,7 @@
 // -lto variants built with ThinLTO (per-module summaries for cross-language
 // importing), and the Windows ICU data table filtered + per-item zstd
 // compressed (lazily decompressed via bun_icu_decompress.cpp).
-export const WEBKIT_VERSION = "4895f45dfbd0d1226c4d41799887bc0ecb9f341b";
+export const WEBKIT_VERSION = "autobuild-preview-pr-280-1883052d";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.

src/jsc/bindings/BunClientData.cpp

@@ -107,13 +107,13 @@ void JSVMClientData::create(VM* vm, void* bunVM)
     auto provider = WebCore::createBuiltinsSourceProvider();
     JSVMClientData* clientData = new JSVMClientData(*vm, provider);
     clientData->bunVM = bunVM;
-    vm->deferredWorkTimer->onAddPendingWork = [clientData](Ref<JSC::DeferredWorkTimer::TicketData>&& ticket, JSC::DeferredWorkTimer::WorkType kind) -> void {
+    vm->deferredWorkTimer->onAddPendingWork = [clientData](Ref<JSC::DeferredWorkTimer::Ticket>&& ticket, JSC::DeferredWorkTimer::WorkType kind) -> void {
         Bun::JSCTaskScheduler::onAddPendingWork(clientData, WTF::move(ticket), kind);
     };
-    vm->deferredWorkTimer->onScheduleWorkSoon = [clientData](JSC::DeferredWorkTimer::Ticket ticket, JSC::DeferredWorkTimer::Task&& task) -> void {
+    vm->deferredWorkTimer->onScheduleWorkSoon = [clientData](JSC::DeferredWorkTimer::Ticket* ticket, JSC::DeferredWorkTimer::Task&& task) -> void {
         Bun::JSCTaskScheduler::onScheduleWorkSoon(clientData, ticket, WTF::move(task));
     };
-    vm->deferredWorkTimer->onCancelPendingWork = [clientData](JSC::DeferredWorkTimer::Ticket ticket) -> void {
+    vm->deferredWorkTimer->onCancelPendingWork = [clientData](JSC::DeferredWorkTimer::Ticket* ticket) -> void {
         Bun::JSCTaskScheduler::onCancelPendingWork(clientData, ticket);
     };
 

src/jsc/bindings/JSCTaskScheduler.cpp

@@ -5,7 +5,6 @@
 
 using Ticket = JSC::DeferredWorkTimer::Ticket;
 using Task = JSC::DeferredWorkTimer::Task;
-using TicketData = JSC::DeferredWorkTimer::TicketData;
 
 namespace Bun {
 using namespace JSC;
@@ -15,29 +14,26 @@ extern "C" void Bun__eventLoop__incrementRefConcurrently(void* bunVM, int delta)
 
 class JSCDeferredWorkTask {
 public:
-    JSCDeferredWorkTask(Ref<TicketData> ticket, Task&& task)
-        : ticket(WTF::move(ticket))
+    JSCDeferredWorkTask(WebCore::JSVMClientData* clientData, Ref<Ticket> ticket, Task&& task)
+        : clientData(clientData)
+        , ticket(WTF::move(ticket))
         , task(WTF::move(task))
     {
     }
 
-    Ref<TicketData> ticket;
+    // Captured at enqueue time so Bun__runDeferredWork never has to dereference
+    // ticket->scriptExecutionOwner() (cleared once the ticket is cancelled).
+    WebCore::JSVMClientData* clientData;
+    Ref<Ticket> ticket;
     Task task;
     ~JSCDeferredWorkTask()
     {
     }
 
-    JSC::VM& vm() const { return ticket->scriptExecutionOwner()->vm(); }
-
     WTF_MAKE_TZONE_ALLOCATED(JSCDeferredWorkTask);
 };
 
-static JSC::VM& getVM(Ticket& ticket)
-{
-    return ticket->scriptExecutionOwner()->vm();
-}
-
-void JSCTaskScheduler::onAddPendingWork(WebCore::JSVMClientData* clientData, Ref<TicketData>&& ticket, JSC::DeferredWorkTimer::WorkType kind)
+void JSCTaskScheduler::onAddPendingWork(WebCore::JSVMClientData* clientData, Ref<Ticket>&& ticket, JSC::DeferredWorkTimer::WorkType kind)
 {
     auto& scheduler = clientData->deferredWorkTimer;
     Locker<Lock> holder { scheduler.m_lock };
@@ -48,13 +44,13 @@ void JSCTaskScheduler::onAddPendingWork(WebCore::JSVMClientData* clientData, Ref
         scheduler.m_pendingTicketsOther.add(WTF::move(ticket));
     }
 }
-void JSCTaskScheduler::onScheduleWorkSoon(WebCore::JSVMClientData* clientData, Ticket ticket, Task&& task)
+void JSCTaskScheduler::onScheduleWorkSoon(WebCore::JSVMClientData* clientData, Ticket* ticket, Task&& task)
 {
-    auto* job = new JSCDeferredWorkTask(*ticket, WTF::move(task));
+    auto* job = new JSCDeferredWorkTask(clientData, *ticket, WTF::move(task));
     Bun__queueJSCDeferredWorkTaskConcurrently(clientData->bunVM, job);
 }
 
-void JSCTaskScheduler::onCancelPendingWork(WebCore::JSVMClientData* clientData, Ticket ticket)
+void JSCTaskScheduler::onCancelPendingWork(WebCore::JSVMClientData* clientData, Ticket* ticket)
 {
     auto* bunVM = clientData->bunVM;
     auto& scheduler = clientData->deferredWorkTimer;
@@ -87,17 +83,15 @@ static void runPendingWork(void* bunVM, Bun::JSCTaskScheduler& scheduler, JSCDef
     holder.unlockEarly();
 
     if (pendingTicket && !pendingTicket->isCancelled()) {
-        job->task(job->ticket.ptr());
+        job->task(job->ticket.get());
     }
 
     delete job;
 }
 
 extern "C" void Bun__runDeferredWork(Bun::JSCDeferredWorkTask* job)
 {
-    auto& vm = job->vm();
-    auto clientData = WebCore::clientData(vm);
-
+    auto* clientData = job->clientData;
     runPendingWork(clientData->bunVM, clientData->deferredWorkTimer, job);
 }
 

src/jsc/bindings/JSCTaskScheduler.h

@@ -16,14 +16,14 @@ class JSCTaskScheduler {
     {
     }
 
-    static void onAddPendingWork(WebCore::JSVMClientData* clientData, Ref<JSC::DeferredWorkTimer::TicketData>&& ticket, JSC::DeferredWorkTimer::WorkType kind);
-    static void onScheduleWorkSoon(WebCore::JSVMClientData* clientData, JSC::DeferredWorkTimer::Ticket ticket, JSC::DeferredWorkTimer::Task&& task);
-    static void onCancelPendingWork(WebCore::JSVMClientData* clientData, JSC::DeferredWorkTimer::Ticket ticket);
+    static void onAddPendingWork(WebCore::JSVMClientData* clientData, Ref<JSC::DeferredWorkTimer::Ticket>&& ticket, JSC::DeferredWorkTimer::WorkType kind);
+    static void onScheduleWorkSoon(WebCore::JSVMClientData* clientData, JSC::DeferredWorkTimer::Ticket* ticket, JSC::DeferredWorkTimer::Task&& task);
+    static void onCancelPendingWork(WebCore::JSVMClientData* clientData, JSC::DeferredWorkTimer::Ticket* ticket);
 
 public:
     Lock m_lock;
-    UncheckedKeyHashSet<Ref<JSC::DeferredWorkTimer::TicketData>> m_pendingTicketsKeepingEventLoopAlive;
-    UncheckedKeyHashSet<Ref<JSC::DeferredWorkTimer::TicketData>> m_pendingTicketsOther;
+    UncheckedKeyHashSet<Ref<JSC::DeferredWorkTimer::Ticket>> m_pendingTicketsKeepingEventLoopAlive;
+    UncheckedKeyHashSet<Ref<JSC::DeferredWorkTimer::Ticket>> m_pendingTicketsOther;
 };
 
 }

src/jsc/bindings/JSEnvironmentVariableMap.cpp

@@ -489,8 +489,10 @@ static constexpr ASCIILiteral kProxyEnvVarNames[] = {
 // side-effecting var need only be added in one place.
 static void applyTZFromString(JSGlobalObject* globalObject, const String& value)
 {
-    if (value.length() < 32 && WTF::setTimeZoneOverride(value))
-        JSC::getVM(globalObject).dateCache.resetIfNecessarySlow();
+    if (value.length() < 32 && WTF::setTimeZoneOverride(value)) {
+        WTF::timeZoneDidChange();
+        JSC::getVM(globalObject).dateCache.clearForTimeZoneChange();
+    }
 }
 static void applyTLSRejectFromString(JSGlobalObject*, const String& value)
 {

src/jsc/bindings/ZigGlobalObject.cpp

@@ -3216,7 +3216,8 @@ extern "C" bool JSGlobalObject__setTimeZone(JSC::JSGlobalObject* globalObject, c
     auto& vm = JSC::getVM(globalObject);
 
     if (WTF::setTimeZoneOverride(Zig::toString(*timeZone))) {
-        vm.dateCache.resetIfNecessarySlow();
+        WTF::timeZoneDidChange();
+        vm.dateCache.clearForTimeZoneChange();
         return true;
     }
 

src/jsc/bindings/bindings.cpp

@@ -6593,8 +6593,8 @@ extern "C" uint64_t Bun__JSArray__nextPresentIndex(
         uint64_t result = notFound;
         if (JSC::SparseArrayValueMap* map = storage->m_sparseMap.get()) {
             for (const auto& entry : *map) {
-                if (entry.key >= start && entry.key < result)
-                    result = entry.key;
+                if (entry.index() >= start && entry.index() < result)
+                    result = entry.index();
             }
         }
         return result;

src/jsc/bindings/webcore/MessageEvent.cpp

@@ -104,8 +104,10 @@ auto MessageEvent::create(JSC::JSGlobalObject& globalObject, Ref<SerializedScrip
     bool didFail = false;
 
     auto deserialized = data->deserialize(globalObject, &globalObject, ports, SerializationErrorMode::NonThrowing, &didFail);
-    if (topExceptionScope.exception()) [[unlikely]]
+    if (topExceptionScope.exception()) [[unlikely]] {
+        topExceptionScope.clearExceptionExceptTermination();
         deserialized = jsUndefined();
+    }
 
     JSC::Strong<JSC::Unknown> strongData(vm, deserialized);
 

src/jsc/bindings/webcore/SerializedScriptValue.cpp

@@ -6144,6 +6144,7 @@ ExceptionOr<Ref<SerializedScriptValue>> SerializedScriptValue::create(JSGlobalOb
 {
     VM& vm = lexicalGlobalObject.vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
+    RETURN_IF_EXCEPTION(scope, Exception { ExistingExceptionError });
 
     // Fast path optimization: for postMessage/structuredClone with pure strings and no transfers
     const bool canUseFastPath = (context == SerializationContext::WorkerPostMessage || context == SerializationContext::WindowPostMessage || context == SerializationContext::Default)
@@ -6404,9 +6405,8 @@ ExceptionOr<Ref<SerializedScriptValue>> SerializedScriptValue::create(JSGlobalOb
             if (arrayBuffer->isDetached() || arrayBuffer->isShared())
                 return Exception { DataCloneError };
             if (arrayBuffer->isLocked()) {
-                auto scope = DECLARE_THROW_SCOPE(vm);
                 throwVMTypeError(&lexicalGlobalObject, scope, errorMessageForTransfer(arrayBuffer));
-                RELEASE_AND_RETURN(scope, Exception { ExistingExceptionError });
+                return Exception { ExistingExceptionError };
             }
             arrayBuffers.append(WTF::move(arrayBuffer));
             continue;

src/jsc/bindings/webcore/Worker.cpp

@@ -536,6 +536,13 @@
     // property read must not propagate exceptions out of this function.
     auto& vm = JSC::getVM(workerGlobalObject);
     auto scope = DECLARE_TOP_EXCEPTION_SCOPE(vm);
+    // A TerminatedExecutionError can be live on entry (this runs after the
+    // worker's termination trap fired); bail before serialization would
+    // re-raise it. Clear any other inherited exception so the serializer is
+    // never entered with one pending.
+    if (vm.hasPendingTerminationException())
+        return false;
+    CLEAR_IF_EXCEPTION(scope);
 
     auto serialized = SerializedScriptValue::create(*workerGlobalObject, value, SerializationForStorage::No, SerializationErrorMode::NonThrowing);
     CLEAR_IF_EXCEPTION(scope);

src/jsc/modules/BunJSCModule.h

@@ -651,7 +651,8 @@ JSC_DEFINE_HOST_FUNCTION(functionSetTimeZone, (JSGlobalObject * globalObject, Ca
             makeString("Invalid timezone: \""_s, timeZoneName, "\""_s));
         return {};
     }
-    vm.dateCache.resetIfNecessarySlow();
+    WTF::timeZoneDidChange();
+    vm.dateCache.clearForTimeZoneChange();
     WTF::Vector<char16_t, 32> buffer;
     WTF::getTimeZoneOverride(buffer);
     WTF::String timeZoneString(buffer.span());

test/expectations.txt

@@ -29,17 +29,30 @@
 # Verbatim node v26.3.0 test asserting a FinalizationRegistry callback fires
 # within ONE globalThis.gc() + ONE setImmediate after the connect callback's
 # closure is unreferenced. The FinalizationRegistry spec gives no timing
-# guarantee for cleanup callbacks; JSC schedules them via DeferredWorkTimer
-# with no defined ordering relative to the immediate queue. The connect
-# listener IS removed (verified: listenerCount("secureConnect") === 0 in
-# done()) and the object IS collected (test passes 70/70 on darwin and
-# glibc Linux); on alpine x64 the FR callback delivery slips past the single
-# setImmediate after this PR's added module loads at process startup shift
-# the heap layout. The robust fix is gcUntil() rather than a single tick,
-# but the file is a verbatim upstream port. Quarantined on the failing
-# linux-x64-musl matrix only; still runs everywhere else (build 63145:
-# alpine 3.23 x64 + x64-baseline only).
-[ LINUX-X64-MUSL ] test/js/node/test/parallel/test-tls-connect-memleak.js [ FLAKY ] # JSC FinalizationRegistry callback delivery vs setImmediate timing on musl x64
+# guarantee, and JSC uses a conservative stack scan: after the WebKit
+# 0e86b490 GC-marking pipelining change (bug 318297) the `gcObject` value
+# passed as an argument to assert.strictEqual lands in a stack slot the
+# conservative scan keeps reaching on aarch64 macOS and release-ASan, so the
+# object is never collected even with 30 gc+yield iterations (verified on
+# darwin-test-arm64-3 with the CI binary; `FORCE_COLOR` in the runner env
+# happens to be the layout perturbation that flips it, and `gcObject = null`
+# after the assert clears it). The connect listener IS removed
+# (listenerCount("secureConnect") === 0 in done()) and the net.createConnection
+# sibling test passes on every lane, so the once() contract itself holds. The
+# robust fix is gcUntil(), but the file is a verbatim upstream port.
+# Still runs on glibc Linux and FreeBSD.
+[ LINUX-X64-MUSL ] test/js/node/test/parallel/test-tls-connect-memleak.js [ FLAKY ] # JSC conservative scan pins gcObject on musl x64
+[ DARWIN-AARCH64 ] test/js/node/test/parallel/test-tls-connect-memleak.js [ FLAKY ] # JSC conservative scan pins gcObject after WebKit 0e86b490 marking change
+[ ASAN ] test/js/node/test/parallel/test-tls-connect-memleak.js [ FLAKY ] # JSC conservative scan pins gcObject on release-ASan after WebKit 0e86b490
+[ WINDOWS-AARCH64 ] test/js/node/test/parallel/test-tls-connect-memleak.js [ FLAKY ] # JSC conservative scan pins gcObject after WebKit 0e86b490 marking change
+
+# Same class as test-tls-connect-memleak.js above, but here `req` lives in an
+# `async function main()` frame and the conservative scan keeps reaching it
+# through the async-function state on Windows after the WebKit 0e86b490
+# marking change; `setInterval(global.gc, 300)` never collects it and the
+# test hits the runner timeout. Inlining the body into the listen callback
+# (no await) collects at n=1 on the same build. Still runs on POSIX.
+[ WINDOWS ] test/js/node/test/parallel/test-http-client-leaky-with-double-response.js [ TIMEOUT ] # JSC conservative scan pins req via async frame on Windows after WebKit 0e86b490
 
 # Vendored node v26.3.0 stream tests blocked on missing native subsystems (see PR #31826)
 test/js/node/test/parallel/test-stream-pipeline.js [ SKIP ] # block at L271 hangs: pipeline(rs, req) writes 11x'hello' raw after a never-ended GET's \r\n\r\n; node's llhttp rejects lowercase 'h' as a method char (HPE_INVALID_METHOD -> clientError -> 400+close -> req 'close' -> pipeline callback fires), but bun's uWS HttpParser buffers any incomplete run of valid tchars waiting for the request-line, so the connection stays open and the callback never fires. Pre-existing server-parser leniency; needs uWS HttpParser to reject non-uppercase method bytes like llhttp.