Remove dead code from FFI sys crates, bun_core, built-in JS, codegen, and build scripts - #36937
Merged
Jarred-Sumner merged 13 commits intoAug 5, 2026
Merged
Conversation
… and build scripts 332 verified-unreferenced symbols, 8 orphaned files, and 21 stale commented-out C++ blocks; 116 files, net -2057 lines. Every removal was validated by cargo check on all 10 CI target triples and a full debug build with freshly regenerated codegen.
Contributor
WalkthroughThis cleanup removes unused build, code-generation, JavaScript, Rust, FFI, and binding declarations. It narrows internal visibility, deletes stale commented code and obsolete files, and adds source-lint coverage. ChangesDead symbol and export cleanup
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
Comment |
robobun
force-pushed
the
claude/farm/81d3ff4b/dead-code-pub-exports-sweep
branch
from
August 5, 2026 06:20
5c830b9 to
bdfa0ec
Compare
Collaborator
Author
|
Updated 1:49 AM PT - Aug 5th, 2026
❌ @robobun, your commit a9da323 has 1 failures in
🧪 To try this PR locally: bunx bun-pr 36937That installs a local version of the PR into your bun-36937 --bun |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
…pins Remove jsFunction_validateSignalName, jsFunction_validatePlainFunction and jsFunction_validateUndefined from NodeValidator.cpp/.h; their only callers were the $newCppFunction bindings this PR already removed. Drop the doc comment orphaned by the MacroJsCtx re-export removal in PluginRunner.rs. Make the source-lint pins read the committed tree for deleted files and JS/C++ content so git stash round-trips that temporarily restore deleted files cannot fail the lint, and fix a pin regex that did not match the block it guards.
jsFunction_validateSignalName, jsFunction_validatePlainFunction and jsFunction_validateUndefined lost their only callers when this PR removed their $newCppFunction bindings from internal/validators.ts. Also drop the doc comment orphaned by the MacroJsCtx re-export removal in PluginRunner.rs.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/shell_parser/braces.rs (1)
179-185: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winAlign the visibility of
ShellCharIterandCharIter.
bracespublicly exportsShellCharIter, but its methods and associated types come only from the privateCharItertrait. External crates cannot use this public type. MakeShellCharIterprivate or makeCharIterpublic.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/shell_parser/braces.rs` around lines 179 - 185, Align the visibility of the publicly exported ShellCharIter with its CharIter implementation: either make ShellCharIter private or expose CharIter publicly, including its associated types and methods as required for external use. Apply the change at the CharIter/ShellCharIter declarations without altering their behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/sys/copy_file.rs`:
- Line 23: Align visibility with referenced types across the affected APIs: in
src/sys/copy_file.rs:23 expose InputType for the public copy functions; in
src/picohttp/lib.rs:195 make Header::curl private; in src/router/lib.rs:139
narrow Routes::list and at :1146 narrow Pattern::len, or make their referenced
types pub(crate); in src/url/lib.rs:38 use public route_param::List for
CombinedScanner::init; in src/zstd/lib.rs:340 make both ZstdReaderArrayList
constructors private; and in src/spawn/process.rs:935 narrow
WaiterThreadPosix::js_process or make ProcessQueue pub(crate).
In `@test/internal/source-lints/dead-symbols-pub-exports-sweep.test.ts`:
- Around line 71-87: Replace the direct existsSync-based resurrection check in
the “orphaned files stay deleted” test with surviving source-contract assertions
for deletions that have one, such as registry or embedding references. For paths
without a surviving contract, retain only explanatory deletion documentation and
remove them from the filesystem-absence assertion; do not use existsSync on
deleted paths.
---
Outside diff comments:
In `@src/shell_parser/braces.rs`:
- Around line 179-185: Align the visibility of the publicly exported
ShellCharIter with its CharIter implementation: either make ShellCharIter
private or expose CharIter publicly, including its associated types and methods
as required for external use. Apply the change at the CharIter/ShellCharIter
declarations without altering their behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8c64b9e6-bf02-4ecb-843a-8f94087f41ad
⛔ Files ignored due to path filters (3)
src/favicon.pngis excluded by!**/*.pngsrc/logo.svgis excluded by!**/*.svgsrc/zlib.test.gzis excluded by!**/*.gz
📒 Files selected for processing (114)
package.jsonscripts/build/error.tsscripts/build/flags.tsscripts/build/source.tssrc/ast/lib.rssrc/ast/nodes.rssrc/base64/lib.rssrc/boringssl/lib.rssrc/boringssl_sys/boringssl.rssrc/brotli/lib.rssrc/brotli_sys/brotli_c.rssrc/bun_alloc/lib.rssrc/bun_core/Global.rssrc/bun_core/env.rssrc/bun_core/fmt.rssrc/bundler/HTMLScanner.rssrc/bundler_jsc/PluginRunner.rssrc/cares_sys/c_ares.rssrc/codegen/generate-classes.tssrc/codegen/generate-js2native.tssrc/codegen/helpers.tssrc/codegen/replacements.tssrc/collections/array_hash_map.rssrc/crash_handler/lib.rssrc/event_loop/MiniEventLoop.rssrc/fallback.htmlsrc/fixtures_example.com.htmlsrc/glob/GlobWalker.rssrc/http/lib.rssrc/install/lib.rssrc/install/lockfile.rssrc/install/resolvers/folder_resolver.rssrc/install_jsc/hosted_git_info_jsc.rssrc/io/lib.rssrc/js/builtins/ConsoleObject.tssrc/js/internal/crypto/x509.tssrc/js/internal/fs/streams.tssrc/js/internal/primordials.jssrc/js/internal/promisify.tssrc/js/internal/shared.tssrc/js/internal/streams/utils.tssrc/js/internal/tls.tssrc/js/internal/validators.tssrc/jsc/ConsoleObject.rssrc/jsc/FFI.rssrc/jsc/HTTPServerAgent.rssrc/jsc/bindings/BunClientData.hsrc/jsc/bindings/DOMWrapperWorld.cppsrc/jsc/bindings/JSDOMWrapper.cppsrc/jsc/bindings/JSX509CertificatePrototype.cppsrc/jsc/bindings/ProcessBindingNatives.cppsrc/jsc/bindings/coroutine.cppsrc/jsc/bindings/webcore/ErrorEvent.cppsrc/jsc/bindings/webcore/Event.cppsrc/jsc/bindings/webcore/JSCustomEvent.cppsrc/jsc/bindings/webcore/JSDOMConvertPromise.hsrc/jsc/bindings/webcore/JSDOMPromiseDeferred.cppsrc/jsc/bindings/webcore/JSEventListener.cppsrc/jsc/bindings/webcore/JSPerformance.cppsrc/jsc/bindings/webcore/JSPerformanceServerTiming.cppsrc/jsc/bindings/webcore/Performance.cppsrc/jsc/bindings/webcore/PerformanceObserver.cppsrc/jsc/bindings/webcore/WebSocket.cppsrc/jsc/bindings/webcrypto/SubtleCrypto.cppsrc/libarchive/lib.rssrc/libdeflate_sys/libdeflate.rssrc/lsquic_sys/lib.rssrc/md/ansi_renderer.rssrc/md/inlines.rssrc/mimalloc_sys/mimalloc.rssrc/node-fallbacks/timers.promises.jssrc/parsers/yaml.rssrc/patch/lib.rssrc/picohttp/lib.rssrc/ptr/ref_count.rssrc/resolver/package_json.rssrc/router/lib.rssrc/runtime/api.rssrc/runtime/api/BunObject.rssrc/runtime/api/bun/SSLContextCache.rssrc/runtime/api/bun/h2/hpack.rssrc/runtime/api/bun/h2/settings.rssrc/runtime/api/cron.rssrc/runtime/api/html_rewriter.rssrc/runtime/crypto/CryptoHasher.rssrc/runtime/crypto/PasswordObject.rssrc/runtime/dns_jsc/dns.rssrc/runtime/napi/napi_body.rssrc/runtime/node/node_crypto_binding.rssrc/runtime/node/node_fs.rssrc/runtime/server/RequestContext.rssrc/runtime/socket/uws_handlers.rssrc/runtime/test_runner/mod.rssrc/runtime/test_runner/pretty_format.rssrc/runtime/valkey_jsc/valkey.rssrc/runtime/webcore.rssrc/runtime/webcore/Blob.rssrc/runtime/webcore/blob/read_file.rssrc/runtime/webcore/streams.rssrc/s3_signing/credentials.rssrc/shell_parser/braces.rssrc/shell_parser/parse.rssrc/sourcemap_jsc/lib.rssrc/spawn/process.rssrc/sql_jsc/mysql/MySQLConnection.rssrc/sql_jsc/postgres.rssrc/sys/copy_file.rssrc/url/lib.rssrc/windows_sys/externs.rssrc/zlib.test.txtsrc/zlib/lib.rssrc/zlib_sys/win32.rssrc/zstd/lib.rstest/internal/source-lints/dead-symbols-pub-exports-sweep.test.ts
💤 Files with no reviewable changes (46)
- package.json
- src/jsc/bindings/DOMWrapperWorld.cpp
- src/jsc/bindings/JSDOMWrapper.cpp
- src/jsc/bindings/webcore/ErrorEvent.cpp
- src/jsc/bindings/webcore/Event.cpp
- src/sql_jsc/mysql/MySQLConnection.rs
- src/bundler_jsc/PluginRunner.rs
- src/fallback.html
- src/jsc/bindings/BunClientData.h
- src/fixtures_example.com.html
- src/js/internal/primordials.js
- src/jsc/bindings/ProcessBindingNatives.cpp
- src/ast/nodes.rs
- src/codegen/helpers.ts
- src/js/internal/crypto/x509.ts
- src/codegen/generate-js2native.ts
- src/codegen/replacements.ts
- src/js/internal/fs/streams.ts
- src/jsc/bindings/webcore/JSEventListener.cpp
- src/js/internal/tls.ts
- scripts/build/error.ts
- scripts/build/source.ts
- src/js/internal/shared.ts
- src/jsc/bindings/webcore/JSPerformanceServerTiming.cpp
- src/jsc/bindings/webcore/Performance.cpp
- src/zlib.test.txt
- src/jsc/bindings/webcore/JSCustomEvent.cpp
- src/node-fallbacks/timers.promises.js
- src/jsc/bindings/webcore/JSDOMConvertPromise.h
- src/js/builtins/ConsoleObject.ts
- src/sourcemap_jsc/lib.rs
- src/jsc/bindings/JSX509CertificatePrototype.cpp
- src/jsc/bindings/webcore/JSDOMPromiseDeferred.cpp
- src/js/internal/streams/utils.ts
- src/sql_jsc/postgres.rs
- src/runtime/valkey_jsc/valkey.rs
- src/js/internal/promisify.ts
- src/jsc/bindings/webcore/PerformanceObserver.cpp
- src/jsc/bindings/coroutine.cpp
- src/jsc/bindings/webcore/WebSocket.cpp
- src/jsc/bindings/webcrypto/SubtleCrypto.cpp
- src/runtime/api.rs
- src/jsc/bindings/webcore/JSPerformance.cpp
- src/jsc/HTTPServerAgent.rs
- src/libdeflate_sys/libdeflate.rs
- src/codegen/generate-classes.ts
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/internal/source-lints/dead-symbols-pub-exports-sweep.test.ts`:
- Around line 28-43: Update headFile and headTree to capture Git stderr and
throw descriptive errors whenever git show or git ls-tree exits unsuccessfully,
rather than returning empty results. Preserve intentional missing-path handling
only after a successful tree lookup, so repository, HEAD, Git, and I/O failures
propagate to the source-lint tests.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 2965d41d-fc7c-4478-8da7-d196c434e14f
📒 Files selected for processing (4)
src/bundler_jsc/PluginRunner.rssrc/jsc/bindings/NodeValidator.cppsrc/jsc/bindings/NodeValidator.htest/internal/source-lints/dead-symbols-pub-exports-sweep.test.ts
💤 Files with no reviewable changes (3)
- src/bundler_jsc/PluginRunner.rs
- src/jsc/bindings/NodeValidator.cpp
- src/jsc/bindings/NodeValidator.h
…d comments, align cfg-pair visibility The deleted mi_theap_* declarations were THeap's only consumers, and the deleted libdeflate_alloc_decompressor_ex was the only consumer of Options; opaque_ffi!'s allow(dead_code) methods and the pub visibility kept the lint quiet on both. Drop comments orphaned by removed declarations in c_ares, libdeflate and HTTPServerAgent (plus its now-empty extern block), demote the not(windows) arms of hostent_int and InputType to match their demoted windows siblings, and make the source-lint git helpers throw on git failure instead of silently passing.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
isSignalName's only callers were inside the removed jsFunction_validateSignalName. Delete comments orphaned by removed items in sql_jsc/postgres.rs, brotli_sys (encoder query-fns header) and boringssl_sys (empty SSL_METHOD section), and reword three comments that still claimed re-export or public status for items this PR made private (crash_handler WriteStackTraceLimits, collections StringHashMapInner, lockfile StringBuilderType).
…ommented header declarations Wildcards was only reachable through the already-demoted MatchOpts and match_hostname. The removed jsFunction_validateSignalName held the only UNKNOWN_SIGNAL call passing triedUppercase, so drop the parameter and its branch, and the now-unused BunProcess.h include in NodeValidator.cpp. Delete commented-out declarations whose commented definitions this PR removed (DOMWrapperWorld.h, Performance.h, ErrorEvent.h, JSPerformance.cpp).
Collaborator
Author
|
CI status: the only failing lane on the latest build (89115) is debian 13 x64-asan, failing on test/js/node/async_hooks/AsyncLocalStorage-tracking.test.ts, a pre-existing leak that also fails on main (BoringSSL RSA keygen allocation surfacing through node_crypto_binding.rs; this PR's only change near that area is pub-to-private visibility, and the failure has been reported for a separate fix). Every other failure across the last three runs was retry-passed flake or one-off CI infra (a tart VM ssh failure on the darwin 14 lane), none touching code this PR changes. All review findings from the bot passes are addressed and resolved: orphaned C++ host functions, cascading helpers (isSignalName, THeap, libdeflate Options, UNKNOWN_SIGNAL's triedUppercase parameter), stale comments, cfg-pair visibility alignment, and hardened source-lint pins that read the committed tree. Verification on the final head: cargo check green on all 10 CI target triples, full debug build with regenerated codegen, source-lint suite (65 tests), and smoke suites for fs, http, glob, resolve, spawn and signals. Ready for review. |
Contributor
There was a problem hiding this comment.
No new issues found on this pass — all earlier cascading-dead-code and stale-comment findings are addressed, and CI is green apart from the pre-existing ASAN leak on main. Deferring to a human because of scope: 124 files with ~230 pub→private demotions across 60 crates, a C++ signature change (UNKNOWN_SIGNAL drops triedUppercase), removals from internal JS module exports (validators, primordials, streams/utils, tls, shared), and deletion of src/ root assets (logo.svg, favicon.png, fallback.html) — worth a maintainer sign-off that none of those are load-bearing for external tooling or intended crate API surface.
What was reviewed:
- Confirmed the removed
primordialsscalar-constructor keys have zero consumers (therepl.jsNumberdestructure is frominternal/repl/node-primordials, a different module). - Confirmed the removed
validators/tls/shared/streams/utilsexport-object entries have no importers insrc/js/; in-file uses of the definitions remain. - Verified the
UNKNOWN_SIGNALsignature change: the sole remaining C++ caller (BunProcess.cpp) uses the three-arg form, so no observable message change. - Re-checked the earlier cascade sites (
isSignalName,THeap,libdeflate::Options, header/decl pairs, orphaned comments) against the final diff — all cleaned up.
Extended reasoning...
Overview
This PR removes ~2,255 lines (net −2,057) of verified-dead code across 124 files: unused FFI extern declarations in the *_sys crates (mimalloc, cares, lsquic, zlib, brotli, boringssl, libdeflate, windows_sys), ~230 pub→private visibility demotions across ~60 Rust crates, dead exports from built-in JS internal modules and codegen scripts, orphaned fixture/asset files under src/, and ~243 lines of stale commented-out C++ in src/jsc/bindings/. It also removes the jsFunction_validateSignalName/validatePlainFunction/validateUndefined C++ host functions and their transitive orphans (isSignalName, the triedUppercase parameter on Bun::ERR::UNKNOWN_SIGNAL, the BunProcess.h include in NodeValidator.cpp). A new source-lint test pins representative removed symbols and deleted files against reintroduction.
The PR went through six rounds of prior bot review; every finding (cascading dead helpers, orphaned/now-false comments after visibility demotion, cfg-pair asymmetry, paired header declarations, vacuous pin regexes) was addressed in follow-up commits, and the final SubtleCrypto stub was intentionally kept for upstream-WebKit shape parity. This run's bug hunter found nothing new.
Security risks
None identified. This is deletion and visibility narrowing only. The one behavioral surface touched — dropping the " (signals must use all capital letters)" suffix from ERR_UNKNOWN_SIGNAL — was already unreachable (the only true caller was the removed jsFunction_validateSignalName, which was itself never bound after this PR's validators.ts change). No auth, crypto logic, permission, or input-validation paths change semantics; the boringssl/crypto edits are visibility demotions and dead-extern removals, not logic changes.
Level of scrutiny
High, on breadth rather than depth. Each individual edit is mechanically trivial (delete a declaration, drop pub, remove a commented block), and the Rust side is compiler-proven via dead_code = deny on all 10 CI target triples plus a full bun bd with regenerated codegen. But the aggregate touches the module boundary of ~60 crates, the export surface of five internal JS modules, a C++ error-code function signature, and deletes files in the src/ root. Whether e.g. logo.svg/favicon.png/fallback.html are referenced by out-of-tree tooling, or whether some of the demoted pub items were intentionally public API for downstream consumers, is a maintainer judgment call the compiler cannot make.
Other factors
- CI on the latest build is green except a single
AsyncLocalStorage-tracking.test.tsASAN leak that also fails on main and is unrelated to any file this PR touches. - Spot-checked the JS export removals:
primordials.{Array,Number,Object,RegExp,String}have zerosrc/js/consumers (therepl.jsNumberdestructure is from a differentnode-primordialsmodule); thestreams/utils,tls,shared, andvalidatorsremovals are export-object entries only, with the definitions kept and still used in-file. - The
brotli_sysBrotliEncoderParameterenum removal was flagged in the diff as carrying an "update kMaxBrotliParam in src/js/node/zlib.ts if this list changes" comment — but the enum was unused Rust-side (encoder param setting goes through rawc_uint), and the JS-side constant is independent, so the removal is safe. - No outstanding unresolved review threads; all comment-cop and prior bot findings are marked resolved with follow-up commits.
Given the guidelines (do not approve large changes touching many subsystems), I'm deferring rather than approving so a maintainer can sign off on the scope.
Jarred-Sumner
deleted the
claude/farm/81d3ff4b/dead-code-pub-exports-sweep
branch
August 5, 2026 09:27
Jarred-Sumner
pushed a commit
that referenced
this pull request
Aug 6, 2026
…indings, and JS internals (#36970) Removes code verified to have zero references across `src/`, `scripts/`, `test/`, and freshly regenerated `build/debug/codegen/` output. Every candidate was grepped for bare-name, quoted-string, and `$`-prefixed references before deletion; items referenced from generated bindings, `.classes.ts` files, attribute-macro exports (`uws_callback(export = ...)`), or `extern "C"` surfaces were left alone. The vendored WebKit tree is part of the reference scan as well: `Bun__errorInstance__finalize` was initially removed here, then restored once the darwin LTO link surfaced its `__attribute__((weak))` reference from JSC's `ErrorInstance.cpp` (weak references satisfy non-LTO links silently). ### Rust - `bun_install::Error`: variants `FileTooBig`, `ProcessFdQuotaExceeded`, `ReadOnlyFileSystem`, `FileSystem`, `FileBusy` were never constructed (the same-named live variants belong to `bun_runtime`'s separate error enum; `node_fs.rs` maps onto that one) - `hosted_git_info::Representation::Ssh`: every ssh-flavored protocol maps to `Sshurl` - `FromTextLockfileError::InvalidSemver` plus its only mention, an unreachable match arm in `bun.lock.rs` (`ParseError::InvalidSemver` stays and is still produced) - `MigratePnpmLockfileError::{PnpmLockfileInvalidOverride, PnpmLockfileInvalidPatchedDependency}`: never produced by the pnpm migration - windows-shim `FailReason::InvalidShimDataSize`: no size check produces it - `bun_event_loop::EventLoopTimer::TimerCallback` struct, its `Tag` variant, and the dispatch arm in `runtime/dispatch.rs`: nothing ever constructed one, so the tag could never be dispatched - `bun_dns::Family::Unix`: neither the string map nor the JS numeric mapping yields it (`AF_UNIX` on the result path is a different, live match) - MySQL wire structs: write-only fields `OKPacket::{warnings, info, session_state_changes}`, `EOFPacket::warnings`, `StmtPrepareOKPacket::warning_count`, `LocalInfileRequest::filename`. The wire reads stay so packet parsing consumes the same bytes; only the dead stores and their zero-initializers are gone. ### C++ bindings - `NodeValidator.cpp`: host functions `jsFunction_validateString` / `jsFunction_validateFunction` / `jsFunction_validateBoolean` and their declarations. Their `$newCppFunction` bindings were removed in an earlier sweep (#36937 removed the sibling trio); the `V::validate*` overloads they forwarded to are live and stay. - `ImportMetaObject.cpp`: `jsFunctionRequireResolve` and its only callee `functionRequireResolve` (static, 76 lines; the live `require.resolve` is built elsewhere) - `BunString.cpp`: `BunString__toWTFString` (no Rust-side caller; the regenerated `cpp.rs` drops the import) - `sliceAnsi.cpp`: never-instantiated `struct HyperlinkInfo` (`wrapAnsi.cpp`'s `HyperlinkState` is the live one) - `NodeFSStatFSBinding.cpp`: `getStatFSPrototype<bool>`, a template with zero instantiations - Declarations with no definition: `functionBunPeek` / `functionBunPeekStatus` (BunObject.h), `callBakeResponse` / `constructBakeResponse` (JSBakeResponse.cpp), `jsSqlStatementGetHasMultipleStatements` (JSSQLStatement.cpp), `bn_set_words` (dh-primes.h) - Commented-out blocks from 2023-2024: the `ErrorCaptureStackTrace` experiment in BunProcess.cpp, the `deleteProperty` block in JSAbortSignal.cpp, the `setOnEachMicrotaskTick` block in BakeGlobalObject.cpp ### Built-in JS internals Export-default entries no requirer ever destructures (verified against every `require()` site, C++ `getDirect` lookups, and `test/` imports of internal modules); backing functions that are still used in-file stay: - `internal/repl/node-shims.js`: `isWritable`, `runScriptInThisContext`, `kEmptyObject`, `addAbortListener`, `promisify` (none of repl.js / internal/repl/* touch them) - `internal/streams/iter/from.ts`: `normalizeAsyncSource`, `normalizeSyncSource`, `normalizeSyncValue`, `primitiveToUint8Array` - `internal/sql/sqlite.ts`: `SQLCommand`, `commandToString`, `parseSQLQuery`, `SQLiteQueryHandle` (sole requirer pulls only `SQLiteAdapter`) - `internal/sql/shared.ts`: `parseDefinitelySqliteUrl`, `buildDefinedColumnsAndQuery`, `normalizeSSLMode` - `internal/http1_server_fallback.ts`: `createHttp1FallbackResponseHandle`, `kHttp1ActiveRequests` - one-line entries: `setTid` (trace_events), `FixedCircularBuffer` (fixed_queue), `EXECUTION_CONTEXT_ID` (inspector/cdp), `defineCustomPromisify` (promisify), `SQLQueryStatus` (sql/query), `allUint8Array` (streams/iter/utils) ### Build config and orphaned files - `scripts/build/flags.ts`: defines `IS_BUILD`, `WITH_BORINGSSL=1`, `STATICALLY_LINKED_WITH_BMALLOC=1`, `BUN_SINGLE_THREADED_PER_VM_ENTRY_SCOPE=1` have zero readers in `src/`, `packages/`, or the pinned WebKit checkout (WebKit reads the lowercase `STATICALLY_LINKED_WITH_bmalloc`, which is not what we were defining) - `src/runtime/ffi/libtcc1.a.macos-aarch64`: prebuilt 30KB archive from 2022 with zero references (`libtcc1.c` is embedded via `include_bytes!` and compiled at runtime) ### Verification - `cargo check --workspace` and `bun run rust:check-all` (10 ok, 0 failed) so platform-gated uses would have surfaced - full `bun bd` debug build, which regenerates codegen and relinks the C++ side - smoke tests: `test/js/bun/repl/repl.test.ts` (148 pass), `test/cli/install/migration/migrate.test.ts` (20 pass), `test/js/sql/wire-frames.test.ts`, `test/js/sql/sql-mysql-clean-reentry.test.ts` against MariaDB, `test/js/sql/adapter-override.test.ts`, fixed-queue node tests, plus module-load smokes for repl/stream/trace_events/http2/util - `test/internal/source-lints/` suite passes, including the new `dead-symbols-install-sql-bindings.test.ts` that pins these removals - checked against all open robobun PRs at deletion granularity: a planned removal of the install lifecycle-script time log was dropped from this PR because #36587 restores that feature, and the mysql `CharacterSet` collation table plus the `Bun__CryptoHasherExtern__*` helpers were left alone after verification showed they are referenced (`label()` at MySQLConnection.rs:661, C++ wrappers in CryptoUtil.cpp) ### Verified-dead but deliberately not removed (for a future pass, pending maintainer judgment) - windows-shim `read_without_launch` / `FromBunShellContext` (~120 lines): zero callers, but the crate docs describe it as the staged in-process path for the shell - `src/runtime/bake/incremental_visualizer.html` + `memory_visualizer.html` (~808 lines): the `/_bun/incremental_visualizer` route that served them was never ported from the Zig dev server, while the websocket topic plumbing they rely on is live and tested - `src/jsc/bindings/webcrypto/*.idl` (29 files, ~1055 lines): nothing in the build reads `.idl`, but they are maintained alongside the handwritten bindings as spec reference (SubtleCrypto.idl was edited in July) <!-- robobun:evidence:begin --> --- **[review]** gate passed · iteration 2 · 43 files touched <details><summary>fails on main (without fix)</summary> ```console ASAN without fix: 1 FAILED $ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-install-sql-bindings.test.ts bun test v1.4.0 (fc376a3) test/internal/source-lints/dead-symbols-install-sql-bindings.test.ts: 79 | expect(reprEnd).toBeGreaterThan(reprStart); 80 | const reprBody = hosted.slice(reprStart, reprEnd); 81 | if (/^\s*Ssh,$/m.test(reprBody)) { 82 | resurrected.push("src/install/hosted_git_info.rs: Representation::Ssh"); 83 | } 84 | expect(resurrected).toEqual([]); ^ error: expect(received).toEqual(expected) - [] + [ + "src/install/error.rs: ^\s*FileTooBig,$", + "src/install/error.rs: ^\s*ProcessFdQuotaExceeded,$", + "src/install/error.rs: ^\s*ReadOnlyFileSystem,$", + "src/install/error.rs: ^\s*FileSystem,$", + "src/install/error.rs: ^\s*FileBusy,$", + "src/install/resolution.rs: \bInvalidSemver\b", + "src/install/pnpm.rs: PnpmLockfileInvalidOverride|PnpmLockfileInvalidPatchedDependency", + "src/install/windows-shim/bun_shim_impl.rs: \bInvalidShimDataSize\b", + "src/event_loop/EventLoopTimer.rs: \bTimerCallbac ... (truncated) release without fix: 1 FAILED bun test v1.4.0-canary.1 (5fd12c2) test/internal/source-lints/dead-symbols-install-sql-bindings.test.ts: 79 | expect(reprEnd).toBeGreaterThan(reprStart); 80 | const reprBody = hosted.slice(reprStart, reprEnd); 81 | if (/^\s*Ssh,$/m.test(reprBody)) { 82 | resurrected.push("src/install/hosted_git_info.rs: Representation::Ssh"); 83 | } 84 | expect(resurrected).toEqual([]); ^ error: expect(received).toEqual(expected) - [] + [ + "src/install/error.rs: ^\s*FileTooBig,$", + "src/install/error.rs: ^\s*ProcessFdQuotaExceeded,$", + "src/install/error.rs: ^\s*ReadOnlyFileSystem,$", + "src/install/error.rs: ^\s*FileSystem,$", + "src/install/error.rs: ^\s*FileBusy,$", + "src/install/resolution.rs: \bInvalidSemver\b", + "src/install/pnpm.rs: PnpmLockfileInvalidOverride|PnpmLockfileInvalidPatchedDependency", + "src/install/windows-shim/bun_shim_impl.rs: \bInvalidShimDataSize\b", + "src/event_loop/EventLoopTimer.rs: \bTimerCallback\b", + "src/runtime/dispatch.rs: \bTimerCallback\b", + "src/dns/lib.rs: ^\s*Unix,$", + "src/sql/mysql/protocol/OKPacket.rs: session_state_changes|pub info:|pub warnings:", + "src/sql/m ... (truncated) ``` </details> <details><summary>passes on PR (with fix)</summary> ```console ASAN with fix: all passed $ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-install-sql-bindings.test.ts bun test v1.4.0 (fc376a3) test/internal/source-lints/dead-symbols-install-sql-bindings.test.ts: (pass) dead Rust symbols (install, event_loop, dns, mysql protocol) do not reappear [30.77ms] (pass) dead C++ bindings do not reappear [66.65ms] (pass) the WebKit weak error finalizer stays defined [5.74ms] (pass) dead built-in JS exports and build defines do not reappear [32.43ms] 4 pass 0 fail 6 expect() calls Ran 4 tests across 1 file. [2.15s] __F:0:S:0 release with fix: all passed $ bun scripts/build.ts --profile=release [configured] bun-profile → bun (stripped) in 666ms (unchanged) ninja: Entering directory `/workspace/bun/build/release' [1/144] gen generated_host_exports.rs generated_host_exports.rs: 94 exports (host=3, lazy=10, generic=81, rust=0); 239 extern-C blocks audited [2/144] gen cpp.rs (cppbind) [3/144] gen BunProcess.lut.h Generating /workspace/bun/build/release/codegen/BunProcess.lut.h from /workspace/bun/src/jsc/bindings/BunProcess.cpp [4/144] gen JS modules (bundle-modules) Preprocess modules (8773ms) Bundle modules (47ms) Postprocesss modules (48ms) Bundle Functions (653ms) Generate Code (28ms) [9.56s] Bundled "src/js" for production 2571 kb 193 internal modules 13 native modules 84 internal functions across 17 files [4/143] cargo bun_bin → libbun_rust.a (--target x86_64-unknown-linux-gnu) nightly-2026-07-20-x86_64-unknown-linux-gnu unchanged - rustc 1.99.0-nightly (9f36de775 2026-07-19) �[1m�[92m Compiling�[0m bun_core v0.0.0 (/workspace/bun/src/bun_core) �[1m�[92m Compiling�[0m bun_errno v0.0.0 (/workspace/bun/src/errno) �[1m�[92m Compiling�[0m bun_ptr v0.0.0 (/workspace/bun/src/ptr) �[1m�[92m Compi ... (truncated) ``` </details> <details><summary>diff hotspot</summary> ``` scripts/build/flags.ts | 4 - src/dns/lib.rs | 2 - src/event_loop/EventLoopTimer.rs | 9 -- src/install/error.rs | 15 --- src/install/hosted_git_info.rs | 2 - src/install/lockfile/bun.lock.rs | 8 -- src/install/migration.rs | 2 - src/install/pnpm.rs | 4 - src/install/resolution.rs | 2 - src/install/windows-shim/bun_shim_impl.rs | 2 - src/js/internal/fixed_queue.ts | 1 - src/js/internal/http1_server_fallback.ts | 2 - src/js/internal/inspector/cdp.ts | 1 - src/js/internal/promisify.ts | 1 - src/js/internal/repl/node-shims.js | 23 ---- src/js/internal/sql/query.ts | 1 - src/js/internal/sql/shared.ts | 3 - src/js/internal/sql/sqlite.ts | 4 - src/js/internal/streams/iter/from.ts | 4 - src/js/internal/streams/iter/utils.ts | 1 - src/js/internal/trace_events.ts | 1 - src/jsc/bindings/BunObject.h | 2 - src/jsc/bindings/BunProcess.cpp | 18 --- src/jsc/bindings/BunString.cpp | 21 --- src/jsc/bindings/ErrorStackTrace.cpp | 1 + src/jsc/bindings/ImportMetaObject.cpp | 89 ------------- src/jsc/bindings/JSBakeResponse.cpp | 3 - src/jsc/bindings/NodeFSStatFSBinding.cpp | 10 -- src/jsc/bindings/NodeValidator.cpp | 38 ------ src/jsc/bindings/NodeValidator.h | 3 - src/jsc/bindings/dh-primes.h | 2 - src/jsc/bindings/headers-handwritten.h | 1 - src/jsc/bindings/sliceAnsi.cpp ... (truncated) ``` </details> **gate history** · 4 passed · 1 rejected · iteration 2 <details><summary>evidence per changed file</summary> ``` file reads edits tests scripts/build/flags.ts 1 1 0 src/dns/lib.rs 1 2 0 src/event_loop/EventLoopTimer.rs 1 4 0 src/install/error.rs 2 3 0 src/install/hosted_git_info.rs 1 1 0 src/install/lockfile/bun.lock.rs 1 1 0 src/install/migration.rs 1 1 0 src/install/pnpm.rs 1 1 0 src/install/resolution.rs 1 1 0 src/install/windows-shim/bun_shim_impl.rs 1 2 0 src/js/internal/fixed_queue.ts 1 1 0 src/js/internal/http1_server_fallback.ts 1 2 0 src/js/internal/inspector/cdp.ts 1 1 0 src/js/internal/promisify.ts 1 1 0 src/js/internal/repl/node-shims.js 3 6 0 src/js/internal/sql/query.ts 1 1 0 (+ 27 more files) ``` </details> <!-- robobun:evidence:end -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes 2,255 lines (net -2,057) of verified-dead code across 116 files: unused
pubitems thedead_codelint cannot see (it treats everypubitem as an external API root), unreferenced FFI declarations, orphaned files, stale commented-out C++ blocks, and dead build-script helpers.Method: started from
scripts/find-dead-exports.ts, narrowed 8,259 candidates to 1,039 whose name appears in exactly one file across src/, scripts/, test/, and regeneratedbuild/debug/codegen/output, then demoted each to private and let the workspace'sdead_code = denyprove which were genuinely unreferenced. Items the compiler proved live (macro expansions, return-position escapes, cfg(windows)/cfg(darwin) usage, codegen references) were restored; the rest were deleted. Areas with open dead-code PRs (#36237, #35775, #36115, #35437, #35880) were excluded, and the one overlapping deletion found during final diffing (kGetNativeReadableProto, already in #35775) was dropped from this PR.Removed
FFI declaration crates (unused imports of vendored C functions; declarations only, no link-time effect):
src/mimalloc_sys/mimalloc.rs: ~100 declarations (heap-local variantsmi_heap_*, stats/options surfacemi_stats_*mi_option_*, posix shimsmi_posix_memalign/mi_valloc/mi_pvalloc, C++mi_new_*family)src/windows_sys/externs.rs: never-constructedWinsockError+ ~100WSA*error consts,GetBinaryTypeW,CreateJobObjectW,M128Akept (used byCONTEXTon windows)src/zlib_sys/win32.rs: 44 declarations (gz*file API,deflateTune,inflateUndermine,zlibCompileFlags, ...)src/cares_sys/c_ares.rs: 21 (option/server-config surfaceares_set_servers*,ares_mkquery,ares_parse_txt_reply_ext, ...)src/lsquic_sys/lib.rs: 11 (handshake/conn status consts, stream-ctx helpers)src/brotli_sys,src/boringssl_sys,src/libdeflate_sys: 17 combined (BrotliEncoder*estimators,TLS_with_buffers_method,libdeflate_*_decompress, ...)Rust runtime/support crates:
src/bun_core/env.rs:BuildTarget::Wasivariant +IS_WASI(never constructed;IS_BROWSERsimplifies toIS_WASM)src/jsc/HTTPServerAgent.rs: 5 unused Rust-side imports ofBun__HTTPServerAgent__notify*+ 2 type aliasessrc/runtime/test_runner/mod.rs:JSGlobalObjectTestExt::throw2(duplicatedthrow_error)src/runtime/server/NodeHTTPResponse.rs: unusedpause_socketsibling cleanup;pause_socket_readskept (referenced by generated bindings)pubitems to private across 60 crates, which moves them permanently underdead_codeanalysissql_jsc/sourcemap_jsc/bundler_jsc/runtime/api.rs,EventLoopGuard-adjacent aliases, unused importsBuilt-in JS / codegen / build scripts:
src/node-fallbacks/timers.promises.js(238 lines): never registered insrc/resolver/node_fallbacks.rs's 23-module registry, so it was built and compressed on every build but could never be servedsrc/js/internal/crypto/x509.ts+ its row inProcessBindingNatives.cpp:process.binding("crypto/x509")is implemented natively inBunProcess.cppsrc/js/internal/validators.ts:validateUndefined,validateSignalName/validatePlainFunctionexport entriessrc/js/internal/{shared,tls,streams/utils}.ts: dead export-object entries (definitions stay where used in-file);primordials.js: 5 dead scalar-constructor keys (typed-array keys kept:util.inspectreaches them via computedprimordials[tag]access)src/codegen:camelCase,pascalCase,warnOnIdentifiersNotPresentAtRuntime,DOMJITReturnType,ownRow,cppPointerscripts/build:explainFlags(no--explain-flagsexists),assertDefined,depSourceStamp; rootpackage.jsonbumpscript (its target was deleted in Everything is cmake #13427)Orphaned files:
src/fixtures_example.com.html,src/zlib.test.txt+src/zlib.test.gz(2021 inline-test fixtures),src/fallback.html(onlyfallback-backend.htmlis embedded),src/logo.svg,src/favicon.pngStale commented-out C++ blocks (~243 lines, all >6 months old via git blame): minicoro scaffolding in
coroutine.cpp(2022), pasted Node JS source inJSX509CertificatePrototype.cpp, commentedBINDING_INTEGRITYvtable checks,InspectorInstrumentationcalls inWebSocket.cpp, suspended-event-loop paths inJSDOMPromiseDeferred.cpp, commented-out function bodies inPerformance.cpp/Event.cpp/DOMWrapperWorld.cpp/ErrorEvent.cppand 8 more webcore filesVerification
test/internal/source-lints/dead-symbols-pub-exports-sweep.test.tspins representative removed symbols and the deleted files against reintroduction.The compiler-driven loop caught and restored every false positive the textual scan missed: methods on types that escape only via return position (
StdinReader::take_byte,HeaderSet::pairs, bitset iterators), macro-referenced items (comptime_string_map!statics,$crate::paths), platform-gated items (EmptyCopyFileStateon darwin/freebsd,M128A/WriteKindon windows), and generated-binding references (get_insecure_http_parser,pause_socket_reads) which only appear after codegen reruns.Followups (not removed)
patches/ncrypto.patch(919 lines) is referenced by nothing inscripts/build/deps/*.tswhile every other patch file is;src/jsc/bindings/ncrypto.{h,cpp}already exist in patched form. Possibly kept as upstream-sync documentation, so left alone.#if ENABLE(BINDING_INTEGRITY)extern vtable scaffolding inJSCustomEvent.cpp/JSPerformanceServerTiming.cpplost its only (commented) consumer but matches upstream WebKit codegen shape; left in place..github/workflows/release.yml:2references.buildkite/scripts/release.sh, which no longer exists (comment only).src/react_compilerandsrc/iniwere deliberately excluded: the former carries explicit not-yet-wired port markers, the latter's candidates proved live on inspection.[decide:dep] gate passed · iteration 3 · 126 files touched
fails on main (without fix)
passes on PR (with fix)
diff hotspot
gate history · 3 passed · 1 rejected · iteration 3
evidence per changed file