Upgrade WebKit to 2e37adcc23b7 - #36267
Conversation
Bumps vendor/WebKit to upstream WebKit/WebKit@01aaa3e0be0c via oven-sh/WebKit#352. Bun-side adaptations: - JSModuleRecord no longer stores VariableEnvironments (bug 320151): drop the declared/lexical-env plumbing from the fast-path JSModuleRecord construction and from the node:vm ModuleAnalyzer call. - JSAsyncFromSyncIterator::create takes IterationMode (bug 319435): pass Generic from ReadableStream.from's sync-iterable path. - VM::performOpportunisticallyScheduledTasks takes ApproximateTime (bug 319662).
The first pass over record_kinds is now purely structural validation (kind is known + buffer bounds) since JSModuleRecord no longer takes VariableEnvironments at construction. Fold the no-op arms together.
Bun already pins useExplicitResourceManagement=true in ZigGlobalObject.cpp, so the 'using enabled by default' test passed on the pre-upgrade release too and proved nothing about this sync. The remaining three cases each spawn an independent bun -e subprocess; run them concurrently.
… tests Upstream caches Intl.DateTimeFormat instances (bug 314337) and clears the cache on VM entry when hasTimeZoneChange() trips. Bun flips the zone mid-execution via process.env.TZ / setTimeZone(), so clear vm.intlCache() alongside vm.dateCache at the three setter sites. Also bump WEBKIT_VERSION to preview-pr-352-642e4852 for the fork-side hostResolveImportedModule HostDefined probe and the Linux main-thread uid pinning opt-out, and add regression tests for the TZ cache and the HostDefined import path. [skip size check] WebKit sync adds ~600KB of upstream JSC/WTF code.
IntlCache.h transitively includes <unicode/udat.h> which is not available to Bun's own C++ on macOS (the prebuilt WebKit tarball drops include/unicode/ there and Bun does not add system ICU to its include path). Use the new fork-side JS_EXPORT_PRIVATE VM::clearForTimeZoneChange() helper instead so the three setter sites (ZigGlobalObject, JSEnvironmentVariableMap, BunJSCModule) clear both dateCache and the new Intl.DateTimeFormat instance cache without needing IntlCache.h. Bump WEBKIT_VERSION to preview-pr-352-f8c38e23 for the helper. [skip size check] WebKit sync adds ~600KB of upstream JSC/WTF code.
[skip size check]
Bumps WEBKIT_VERSION to the oven-sh/WebKit#370 preview build and adds regression coverage for the Yarr correctness fixes delivered by this sync (bugs 320348 and 320347). No Bun-side API adaptation is needed on top of the 01aaa3e0be0c changes: all JSC/WTF/bmalloc header changes in the 163 new upstream commits are additive.
|
Warning Review limit reached
Next review available in: 17 seconds Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (10)
Comment |
|
Found 1 issue this PR may fix:
🤖 Generated with Claude Code |
|
This PR may be a duplicate of:
🤖 Generated with Claude Code |
|
Updated 8:45 PM PT - Jul 28th, 2026
❌ @robobun, your commit 11a3597 has 3 failures in
🧪 To try this PR locally: bunx bun-pr 36267That installs a local version of the PR into your bun-36267 --bun |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I didn't find bugs in the Bun-side adaptations, but this is a JS-engine version bump (163 upstream commits) with WEBKIT_VERSION still pointing at a preview tag the description says must change before merge — needs a human to gate on full CI and the oven-sh/WebKit#370 merge.
What was reviewed:
asObject(syncRecord.iterator)in ReadableStreamOperations — safe,isObject()is checked 6 lines above.vm.clearForTimeZoneChange()— all three formerdateCache.clearForTimeZoneChange()sites (env-var setter,JSGlobalObject__setTimeZone,bun:jscsetTimeZone) updated consistently.- Rust↔C++
zig__ModuleInfoDeserialized__toJSModuleRecord/JSC_JSModuleRecord__createsignatures match after theVariableEnvironmentremoval; record-kind loops still advanceicorrectly for the now-ignored kinds.
Extended reasoning...
Overview
This PR bumps vendor/WebKit to upstream 2e37adcc23b7 (163 commits; 17 in JSC, 16 in WTF, 3 in bmalloc), superseding #35910. Bun-side changes are mechanical adaptations to upstream API signature changes: JSModuleRecord::create/ModuleAnalyzer dropped their VariableEnvironment params (bug 320151), VM gained clearForTimeZoneChange() subsuming dateCache.clearForTimeZoneChange(), performOpportunisticallyScheduledTasks now takes ApproximateTime, and JSAsyncFromSyncIterator::create gained JSObject*/IterationMode params. A new test file covers each adaptation plus two Yarr regressions delivered by the sync.
Security risks
None introduced by the Bun-side diff itself — the changes are signature adaptations with no new parsing of untrusted input, no new allocation logic, and no auth/crypto paths. The upstream WebKit changes themselves (Yarr, JSON.stringify SWAR, Wasm Memory64, etc.) are outside what can be reviewed here and are the reason full-suite CI is the real gate.
Level of scrutiny
High. A JavaScriptCore version bump has the largest possible blast radius in this repo — every JS execution path runs through it. The Bun-side hunks are individually small and forced by compile errors, but correctness depends on (a) the fork-side merge in oven-sh/WebKit#370 being clean and (b) the full test matrix passing on all platforms. Neither is verifiable from this diff alone. Additionally, WEBKIT_VERSION currently points at autobuild-preview-pr-370-06ee8632, which the PR description explicitly flags as needing replacement with the post-merge autobuild-<sha> tag before this lands.
Other factors
- CI build
#84457is still in progress; WebKit upgrades routinely surface platform-specific failures that only show in the full matrix. - The
JSModuleRecordVariableEnvironmentremoval touches the fast-path module-record construction used on every ES module load; the new test exercisesnode:vmand onewith { type: "text" }import, but the debug-onlyfallbackParsediff-check inBunAnalyzeTranspiledModule.cppand the broader test suite are the real coverage. - My earlier inline note about the dead-in-effect
add_var/RecordKind::{Declared,Lexical}Variableproducer chain was addressed by the author (named in the PR description with a stated follow-up rationale) and the thread is resolved. - The
ReadableStream.fromsync-iterable test covers theJSAsyncFromSyncIterator::createadaptation;IterationMode::Genericis the correct value for CreateAsyncFromSyncIterator per spec.
|
Build #84457: 185+ passed; three tests marked
Build completed (191 passed / 196). The three darwin-14 lanes finished as CI infra, not test failures: two |
2 participants
Bumps
vendor/WebKitto upstreamWebKit/WebKit@2e37adcc23b7(2026-07-28). 163 upstream commits since the last sync point (01aaa3e0be0c); 17 touchSource/JavaScriptCore, 16 touchSource/WTF, 3 touchSource/bmalloc.The fork-side merge is in oven-sh/WebKit#370. Supersedes #35910, whose branch this one is built on.
Note
WEBKIT_VERSIONcurrently points at the preview buildautobuild-preview-pr-370-06ee8632. Once oven-sh/WebKit#370 merges tomain, bump it to the resultingautobuild-<sha>before merging this PR. The first CI run here will fail its WebKit fetch until that preview build publishes (~45 min after the WebKit PR opened).Bun changes required by this upgrade
None on top of #35910. All
runtime/,heap/,API/andWTF/header changes in the 163 new commits are additive; Bun's bindings build and link unchanged against the merged tree. TheJSModuleRecord/JSAsyncFromSyncIterator/ApproximateTime/IntlCache/hostResolveImportedModuleadaptations carried over from #35910 remain sufficient.Dead-in-effect producer chain (follow-up, not removed here)
The
JSModuleRecordadaptation (#35910, from https://bugs.webkit.org/show_bug.cgi?id=320151) makeszig__ModuleInfoDeserialized__toJSModuleRecordignoreRecordKind::DeclaredVariable/LexicalVariablerecords. The producer side still writes them:add_var/add_declared_variable/add_lexical_variableinsrc/js_printer/lib.rs(~16 call sites) andsrc/bundler/linker_context/postProcessJSChunk.rs(6 call sites) serialize every top-level binding into module_info bytes that are now read and discarded. Removing that chain touches the printer/bundler and the serialized cache format, which is out of scope for a WebKit sync; it is left for a follow-up and is kept so on-disk transpiler caches written by older builds continue to deserialize.Notable upstream changes
/^.*EXPR.*$/yno longer drops the leading.*(https://bugs.webkit.org/show_bug.cgi?id=320348);^inside an empty-matching parenthesis no longer anchors the whole pattern (https://bugs.webkit.org/show_bug.cgi?id=320347). New regression tests cover both intest/js/bun/jsc/webkit-upgrade.test.ts.JSON.stringify8-byte SWAR fast path for short strings (bugs 320393 and 320419) and a non-enumerable-own-toJSONfix (320437).Structure::defaultToPrimitiveFastAndNonObservable()cache (320343).RegExp::firstCharacterBitmap()(merged first-char filter computation; 320258).BasicBlock::intersectionOfPastValuesAtHeadallocated only for OSR-entry targets (320177).Iterator.zipnull-prototype options/underlying-iterator objects (320312).WTF::RobinHoodHashTable::removeIf(320337); SIMDmakeStringByReplacingAll(320155).SegmentedVectoroffsetofassert,Heap.hfriendJS_EXPORT_PRIVATE; 320179). The fork's narrower#if !OS(WINDOWS)inSegmentedVector.his replaced by upstream's version.MADV_ZEROlatch fix (320384); libpas MTE override fix (319668).Verification
Built debug+ASAN with
--webkit=localagainst the oven-sh/WebKit#370 branch.bun-debuglinks and passestest/js/bun/jsc/webkit-upgrade.test.ts(7/7) andtest/js/bun/jsc/bun-jsc.test.ts(36/36). The two new Yarr tests fail on the pre-sync WebKit and pass after.[decide:webkit] gate passed · iteration 1 · 10 files touched
fails on main (without fix)
passes on PR (with fix)
diff hotspot
gate history · 1 passed · 1 rejected · iteration 1
evidence per changed file