Remove dead code from node:crypto bindings, JSC/WebCore bindings, uSockets, and llhttp - #37454
Remove dead code from node:crypto bindings, JSC/WebCore bindings, uSockets, and llhttp#37454robobun wants to merge 6 commits into
Conversation
…ckets, and llhttp Relinking the debug binary with --gc-sections --print-gc-sections lists every function nothing references at link time. The ones below also have no textual references outside their own declaration and definition and are not removed by any open PR, so they are deleted together with their declarations and Rust-side FFI wrappers. node:crypto: keyFromString, passphraseFromBufferSource, the header overloads of parseKeyFormat/parseKeyType, ByteSource::fromBIO/foreign, Rsa::encrypt/decrypt with the RSA_Cipher template and setRsaMgf1Md, Cipher::ForEach and its helpers, checkScryptParams, scrypt, pbkdf2, X509View::ifRsa/ifEc, BignumPointer::isOne, BIOPointer::NewFp. JSC/WebCore bindings: the per-request InspectorHTTPServerAgent notifications, ScriptExecutionContext::ensureOnMainThread and executionContext(), JSCStackTrace::getStackTraceForThrownValue, JSCStackFrame::typeName, PerformanceResourceTiming::create and the helpers only it used, rejectPromiseWithGetterTypeError and the never-instantiated RejectPromise branch of IDLAttribute::get, JSErrorHandler (whole files), the callback-interface toJS overloads, and the JSBuffer DOMJIT alloc operations whose signatures were removed in #9457. uSockets: unused accessors (us_socket_is_tls, us_socket_detach, us_socket_pair, us_socket_open, us_listen_socket_ext/port/get_fd, us_socket_group_next/timestamp, us_loop_iteration_number, us_poll_ext, us_connecting_socket_get_loop, the UDP local-ip accessor, several QUIC accessors and the never-set on_open callback) and their Rust wrappers. llhttp: the __wasm__-only block and the getter/name/reset/settings_init API that the HTTP parser bindings never call. Rust: four env vars whose readers were not carried over from the Zig sources, and unused re-exports in node_fs. A source lint pins every removed symbol.
WalkthroughRemoved unused public APIs, internal helpers, FFI bindings, and implementations across uSockets, QUIC, crypto, JSC, WebCore, llhttp, filesystem, and environment-variable code. Added source-lint checks to prevent removed symbols from returning. ChangesDead API cleanup
Possibly related PRs
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
Comment |
|
Status (head f0bbd11, plus an empty re-run commit c75475c): ready for a maintainer once build 92131 finishes.
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this PR and found no bugs. Given the breadth — ~1,300 lines removed across 48 files spanning node:crypto, JSC/WebCore bindings, uSockets/QUIC, and llhttp — a human skim would still be worthwhile before merging.
What was reviewed:
- Spot-checked removed uSockets symbols (
us_socket_detach,us_poll_ext,us_socket_pair,us_listen_socket_get_fd,us_loop_iteration_number, SNI userdata, QUICon_open) againstsrc/,packages/bun-uws, and the libuv backend — no remaining callers;sni_node_t::userremoval is safe sinceuseris still stashed on the SSL_CTX ex_data. - Verified
parseKeyFormat/parseKeyTypeThrowScope overloads remain;CastedThisErrorBehavior::RejectPromiseenum value stays forJSDOMOperationReturningPromiseand noIDLAttribute::get<..., RejectPromise>instantiation exists. - Confirmed
JSErrorHandlerhas zero remaining references andus_internal_ssl_detachis still live viaus_internal_socket_close_raw.
Extended reasoning...
Overview
This PR removes ~1,332 lines of provably dead code across 48 files: node:crypto helpers (CryptoUtil.cpp, ncrypto.cpp), JSC/WebCore bindings (ErrorStackTrace, InspectorHTTPServerAgent, ScriptExecutionContext, JSBuffer, JSDOMAttribute, JSErrorHandler, JSAbortAlgorithm, JSPerformanceObserverCallback, PerformanceResourceTiming), the in-tree uSockets fork (TCP/UDP/QUIC accessors, SNI userdata field), llhttp API surface, and Rust FFI wrappers plus unused env-var declarations. Candidates were found via --gc-sections --print-gc-sections on the debug binary, then filtered by textual reference across all source trees and open-PR diffs. A new source-lint test pins every removed symbol.
Security risks
None introduced. Removals touch crypto (ncrypto, CryptoUtil) and TLS SNI (sni_node_t::user), but only delete unreferenced helpers; the live paths (Cipher::encrypt/decrypt, ThrowScope-taking parseKeyFormat/parseKeyType, SSL_CTX ex_data for SNI userdata) are untouched. I verified user is still stored via SSL_CTX_set_ex_data in us_listen_socket_add_server_name, so us_socket_server_name_userdata continues to work.
Level of scrutiny
High, warranting human review. While each individual removal is mechanical and the methodology (linker-driven, cross-referenced against codegen output, all 10 target triples checked) is sound, the aggregate touches critical paths: crypto primitives, JSC GC-sensitive callback wrappers, QUIC connection lifecycle (on_open field/dispatch removed), TLS SNI storage layout, and HTTP parser API. A maintainer familiar with the in-flight work referenced in the description (#33933 uSockets rewrite, #37101, #37149) should confirm none of these are about to gain callers.
Other factors
- Spot-checks against
src/,packages/, and both eventing backends confirm zero remaining callers for a representative sample of removed symbols. - The
CastedThisErrorBehavior::RejectPromisebranch removal fromIDLAttribute::getis safe: the enum value remains forJSDOMOperationReturningPromise, and grep confirms noIDLAttribute::get<..., RejectPromise>instantiation exists. - Only stale references remain in
packages/bun-usockets/misc/manual.md(non-compiled documentation). - The new source-lint test reads
HEADviagit show(matching the siblingdead-code-escapes.test.tspattern) and its regexes correctly use word boundaries so e.g.\\bus_quic_socket_context\\bwon't false-matchus_quic_socket_context_t. - PR description states
bun bdandrust:check-allpass on all targets and lists the test suites run; the test file follows thetest/internal/source-lints/convention.
|
Thanks for the pass. On the two points it leaves for a human:
No open threads. CI build 92078 is in progress (150 jobs green so far, none failed). |
|
This PR may be a duplicate of:
🤖 Generated with Claude Code |
|
Updated 2:49 AM PT - Aug 11th, 2026
✅ @robobun, your commit c75475c6803c652797e4341766e3387eb686d399 passed in 🧪 To try this PR locally: bunx bun-pr 37454That installs a local version of the PR into your bun-37454 --bun |
|
The duplicate-detection bot is right about both overlaps, and they are out of this PR as of 531dbe1:
I also re-diffed the removed lines of this PR against every open PR that touches any of these files (including #37325, #37420, #37427, #37447, #37450 and #37452, which were opened after my first check): there are no other identical deletions, so the rest of the PR is not a duplicate of anything open. The lint and the description are updated to match; the diff is now -1288/+9 in src and packages. CodeRabbit is still rate-limited on this PR, so there is no review from it yet; CI for the new head is build 92093. |
|
Pushed 2877209 for the one claude[bot] finding on 531dbe1 (a doc comment in |
Removing us_quic_pending_connect_user() left us_quic_pending_connect_s::user write-only, so the field, the void *user parameter of us_quic_socket_context_connect, and the argument the h3 client threaded through Context::connect go too. The SSL_CTX ex_data is now the only place SNI userdata is stashed, so its comment no longer says "too".
|
Pushed f0bbd11 for the two claude[bot] findings on 2877209: the pending-connect |
There was a problem hiding this comment.
Both earlier findings are addressed in f0bbd11 (the write-only us_quic_pending_connect_s::user field/parameter chain is gone through to ClientContext::connect, and the stale "too" in the openssl.c SNI comment is dropped); nothing new turned up on this head. Given the breadth (50 files across crypto, JSC/WebCore bindings, uSockets/QUIC, llhttp) and the flagged maintainer call on whether BUN_DUMP_STATE_ON_CRASH should be reimplemented rather than removed, a human look is still warranted.
Checked on this head: the \bus_quic_socket_context\b lint regex does not false-positive on us_quic_socket_context_t/_connect/_on_* (underscore is a word char, no boundary); the updated Context::connect extern signature matches the C definition after the void *user drop; CastedThisErrorBehavior::RejectPromise has no remaining users after its IDLAttribute::get branch was removed.
Extended reasoning...
Overview
Fourth pass on this PR. The head moved from 2877209 to f0bbd11 since my last review; that commit addresses both inline findings I left at 09:00 (the write-only us_quic_pending_connect_s::user field and its parameter chain through quic.h/quic.c/Context.rs/ClientContext.rs, and the dangling "too" in the openssl.c SNI-userdata comment). Commit 00c7d99 also switched the source-lint's symbol checks to read the working tree rather than HEAD, which is orthogonal. The bug-hunting pass on f0bbd11 found nothing.
Security risks
None introduced. Everything removed was already discarded by the linker (--gc-sections --print-gc-sections), so the shipped binary is byte-identical modulo section ordering. The one non-deletion behavior touch — dropping the void *user parameter from us_quic_socket_context_connect — is an FFI signature change I introduced via review; I verified the C definition, header, Rust extern, wrapper, and sole caller all agree on the new arity.
Level of scrutiny
High, because of breadth: 50 files across node:crypto (ncrypto.*, CryptoUtil.*), JSC/WebCore bindings (Buffer DOMJIT ops, JSErrorHandler, IDLAttribute, ScriptExecutionContext, PerformanceResourceTiming), the in-tree uSockets fork (TCP/UDP/QUIC/SNI), llhttp, and Rust FFI wrappers. Each individual hunk is a mechanical deletion, but the interaction with ~open PRs and the one flagged product decision (BUN_DUMP_STATE_ON_CRASH — its reader was never ported from Zig, so removing the declaration vs. reimplementing the feature is a maintainer call the author explicitly deferred) push this past the auto-approve bar.
Other factors
The author's own status comment says "ready for a maintainer once build 92103 finishes" and flags the env-var hunk as needing a human call. CI on the code-identical predecessor 531dbe1 was 160/160 green when superseded; f0bbd11's build 92122 is in flight. All three of my prior findings across earlier heads have been fixed; there are no open threads I'm aware of beyond the two 09:00 inline comments this head resolves.
|
Thanks, agreed on the human look: the current state is summarized in the status comment at the top (head f0bbd11, no open threads, build 92122 in progress), and the one item that is a judgment call rather than a leftover is the |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/bun-usockets/src/crypto/openssl.c (1)
2960-2969: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winStore SNI userdata per registration.
useris documented as per-domain data, but this code stores it in oneSSL_CTXslot. If one context serves multiple hostnames, the last registration makes every hostname use the sameHttpRouter. A duplicate registration can also overwrite the slot beforesni_addrejects it. Storeuserwith the SNI entry, or enforce a one-context/one-user invariant before the write.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/bun-usockets/src/crypto/openssl.c` around lines 2960 - 2969, Update the SNI registration flow around sni_add so the per-domain user value is stored on each SNI node/entry rather than unconditionally in the shared SSL_CTX ex-data slot. Ensure duplicate hostname registration cannot overwrite existing userdata before sni_add rejects it, while preserving the existing rollback via sni_node_destructor and return value.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@packages/bun-usockets/src/crypto/openssl.c`:
- Around line 2960-2969: Update the SNI registration flow around sni_add so the
per-domain user value is stored on each SNI node/entry rather than
unconditionally in the shared SSL_CTX ex-data slot. Ensure duplicate hostname
registration cannot overwrite existing userdata before sni_add rejects it, while
preserving the existing rollback via sni_node_destructor and return value.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: ec504994-1266-400e-9a6a-bf0e8116a5e9
📒 Files selected for processing (50)
packages/bun-usockets/src/bsd.cpackages/bun-usockets/src/context.cpackages/bun-usockets/src/crypto/openssl.cpackages/bun-usockets/src/eventing/epoll_kqueue.cpackages/bun-usockets/src/internal/networking/bsd.hpackages/bun-usockets/src/libusockets.hpackages/bun-usockets/src/loop.cpackages/bun-usockets/src/node_quic_shim.cpackages/bun-usockets/src/quic.cpackages/bun-usockets/src/quic.hpackages/bun-usockets/src/socket.cpackages/bun-usockets/src/udp.csrc/bun_core/env_var.rssrc/http/h3_client/ClientContext.rssrc/jsc/bindings/ErrorStackTrace.cppsrc/jsc/bindings/ErrorStackTrace.hsrc/jsc/bindings/InspectorHTTPServerAgent.cppsrc/jsc/bindings/InspectorHTTPServerAgent.hsrc/jsc/bindings/JSBuffer.cppsrc/jsc/bindings/JSDOMExceptionHandling.cppsrc/jsc/bindings/JSDOMExceptionHandling.hsrc/jsc/bindings/ScriptExecutionContext.cppsrc/jsc/bindings/ScriptExecutionContext.hsrc/jsc/bindings/ncrypto.cppsrc/jsc/bindings/ncrypto.hsrc/jsc/bindings/node/crypto/CryptoUtil.cppsrc/jsc/bindings/node/crypto/CryptoUtil.hsrc/jsc/bindings/node/http/llhttp/api.csrc/jsc/bindings/node/http/llhttp/llhttp.hsrc/jsc/bindings/webcore/EventEmitter.cppsrc/jsc/bindings/webcore/EventTarget.cppsrc/jsc/bindings/webcore/JSAbortAlgorithm.cppsrc/jsc/bindings/webcore/JSAbortAlgorithm.hsrc/jsc/bindings/webcore/JSDOMAttribute.hsrc/jsc/bindings/webcore/JSErrorHandler.cppsrc/jsc/bindings/webcore/JSErrorHandler.hsrc/jsc/bindings/webcore/JSPerformanceObserverCallback.cppsrc/jsc/bindings/webcore/JSPerformanceObserverCallback.hsrc/jsc/bindings/webcore/PerformanceResourceTiming.cppsrc/jsc/bindings/webcore/PerformanceResourceTiming.hsrc/jsc/bindings/webcore/ResourceTiming.cppsrc/jsc/bindings/webcore/ResourceTiming.hsrc/lsquic_sys/lib.rssrc/runtime/node/node_fs.rssrc/uws_sys/ListenSocket.rssrc/uws_sys/SocketGroup.rssrc/uws_sys/quic/Context.rssrc/uws_sys/quic/Socket.rssrc/uws_sys/us_socket_t.rstest/internal/source-lints/dead-symbols-linker-sweep.test.ts
💤 Files with no reviewable changes (41)
- src/jsc/bindings/webcore/JSDOMAttribute.h
- packages/bun-usockets/src/udp.c
- src/bun_core/env_var.rs
- src/jsc/bindings/webcore/ResourceTiming.h
- src/jsc/bindings/webcore/EventEmitter.cpp
- src/jsc/bindings/webcore/JSAbortAlgorithm.cpp
- src/jsc/bindings/InspectorHTTPServerAgent.h
- packages/bun-usockets/src/eventing/epoll_kqueue.c
- src/jsc/bindings/webcore/PerformanceResourceTiming.h
- packages/bun-usockets/src/internal/networking/bsd.h
- src/jsc/bindings/webcore/JSAbortAlgorithm.h
- src/jsc/bindings/JSDOMExceptionHandling.cpp
- src/jsc/bindings/webcore/JSErrorHandler.h
- packages/bun-usockets/src/loop.c
- src/lsquic_sys/lib.rs
- src/jsc/bindings/JSDOMExceptionHandling.h
- src/uws_sys/us_socket_t.rs
- src/jsc/bindings/node/http/llhttp/llhttp.h
- src/jsc/bindings/webcore/JSErrorHandler.cpp
- packages/bun-usockets/src/node_quic_shim.c
- packages/bun-usockets/src/bsd.c
- packages/bun-usockets/src/socket.c
- src/jsc/bindings/webcore/ResourceTiming.cpp
- src/jsc/bindings/webcore/EventTarget.cpp
- src/jsc/bindings/ScriptExecutionContext.cpp
- packages/bun-usockets/src/context.c
- src/jsc/bindings/ErrorStackTrace.h
- src/jsc/bindings/webcore/PerformanceResourceTiming.cpp
- src/jsc/bindings/ErrorStackTrace.cpp
- src/jsc/bindings/webcore/JSPerformanceObserverCallback.h
- src/jsc/bindings/node/crypto/CryptoUtil.cpp
- src/jsc/bindings/node/crypto/CryptoUtil.h
- src/uws_sys/SocketGroup.rs
- src/jsc/bindings/ncrypto.h
- src/jsc/bindings/JSBuffer.cpp
- src/jsc/bindings/ncrypto.cpp
- packages/bun-usockets/src/libusockets.h
- src/jsc/bindings/node/http/llhttp/api.c
- src/jsc/bindings/webcore/JSPerformanceObserverCallback.cpp
- src/jsc/bindings/ScriptExecutionContext.h
- src/jsc/bindings/InspectorHTTPServerAgent.cpp
|
On CodeRabbit's one note (the SNI userdata living in the SSL_CTX ex_data slot, No open threads. Build 92131 (the re-run after an unrelated |
2 participants
Removes 1,302 lines of code that nothing references (16 lines added, all import, signature and comment adjustments), across the C++ JSC bindings, node:crypto helpers, the in-tree uSockets fork, llhttp, and a few Rust FFI wrappers. No behavior change: every removed function was discarded by the linker, i.e. the shipped binary never contained it.
How the candidates were found
Previous sweeps were grep-driven, so this run used the linker instead: the debug binary was relinked with
-Wl,--gc-sections -Wl,--print-gc-sectionsand the discarded.text.*sections from bun's own objects (minus anything still present in the output) gave ~4,300 symbols that nothing references at link time. Those were filtered down bysrc/,packages/,scripts/and freshly regeneratedbuild/debug/codegen/(anything mentioned outside its own declaration/definition was read by hand, e.g. for#ifplatform blocks, macro token pasting, Rustexternblocks,.classes.ts/ builtin string references);napi_*,node_api_*,uv_*, thev8::shim,src/symbols.dyn), which is unreferenced by design and was left alone, together with helpers only those reach;JSCStackTrace::getStackTraceForThrownValue, which Error.prepareStackTrace: index source URLs by visible frame, not by JSC frame #37450 removes as part of its fix, were dropped from this PR (a few hunks inncrypto.*are adjacent to Remove dead code from C++ bindings, bindgen glue, ast, and orphaned scripts #37149's, but they delete different functions).On the Rust side every crate was additionally checked by demoting its
pubitems topub(crate)and letting rustc'sdead_codeanalysis run; almost everything it reported was already claimed by open PRs, so only the items below are included.Removed
node:crypto (
CryptoUtil.*,ncrypto.*)keyFromString,passphraseFromBufferSource, and the header overloads ofparseKeyFormat/parseKeyType(theThrowScopeoverloads are the live ones);ByteSource::fromBIO,ByteSource::foreign; theBunString.hinclude they neededRsa::encrypt/Rsa::decryptand theRSA_Ciphertemplate behind them (the live path isCipher::encrypt/decrypt), plusEVPKeyCtxPointer::setRsaMgf1Md, which only they calledCipher::ForEachwith itsCipherCallbackContext/array_push_backhelpers andCipherNameCallbackalias (node_crypto_binding.cppcallsEVP_CIPHER_do_all_sorteddirectly)checkScryptParams,scrypt,pbkdf2(scrypt/pbkdf2 go through the Rust bindings),X509View::ifRsa/ifEcand theirKeyCallbackalias,BignumPointer::isOne,BIOPointer::NewFpJSC / WebCore bindings
InspectorHTTPServerAgent::requestWillBeSent/responseReceived/bodyChunkReceived/requestFinished/requestHandlerException(their Rust callers were removed in an earlier sweep)ScriptExecutionContext::ensureOnMainThread, free functionexecutionContext(JSGlobalObject*)JSCStackFrame::typeName/retrieveTypeName/m_typeName(the neighbouringgetStackTraceForThrownValueis removed by Error.prepareStackTrace: index source URLs by visible frame, not by JSC frame #37450)PerformanceResourceTiming::createand its constructor, theentryStartTime/entryEndTimehelpers, andResourceTiming::populateServerTiming, which only the constructor used (the class is still exposed as a global constructor; nothing ever instantiates it natively)rejectPromiseWithGetterTypeErrorand theCastedThisErrorBehavior::RejectPromisebranch ofIDLAttribute::getthat was its only (never instantiated) userJSErrorHandler.cpp/JSErrorHandler.h(whole files) and thesetAttributeEventListener<JSErrorHandler>instantiation: no attribute listener is ever created with itcallbackData()and the native-to-JStoJS(...)overloads ofJSAbortAlgorithmandJSPerformanceObserverCallback(only the JS-to-native direction is used)JSBuffer.cpp: thejsBufferConstructorAlloc*WithoutTypeChecksDOMJIT operations (their signatures went away in Fix incorrect include order #9457) and theJSValue-namedvalidateOffsetoverloaduSockets (
packages/bun-usockets) and its Rust wrappersus_socket_is_tls,us_socket_detach,us_connecting_socket_get_loop,us_socket_pair(+SocketGroup::pair),us_socket_open(+us_socket_t::open),us_listen_socket_ext,us_listen_socket_port,us_listen_socket_get_fd(+ListenSocket::fd),us_socket_group_next,us_socket_group_timestamp,us_loop_iteration_number(Rust readsiteration_nrfrom the struct directly),us_poll_extus_listen_socket_find_server_name_userdataand the now write-onlysni_node_t::userfield (userdata is looked up through theSSL_CTXex_data byus_socket_server_name_userdata)us_udp_packet_buffer_local_ip/bsd_udp_packet_buffer_local_ipus_quic_pending_connect_usertogether with the now write-onlyuserfield it read and thevoid *userparameter ofus_quic_socket_context_connect/Context::connectthat only fed it, theus_quic_socket_contextaccessor,us_quic_stream_flush,us_quic_stream_has_unacked,us_quic_socket_close(+quic::Socket::close), the never-seton_opencallback (field, setter and dispatch),us_nq_spec_peer_ctx(+ its Rust declaration)llhttp (
src/jsc/bindings/node/http/llhttp, already trimmed in #36576)__wasm__-only block (llhttp_alloc/llhttp_freeand the wasm settings table; bun never builds this file for wasm), thellhttp_get_*accessors,llhttp_reset,llhttp_settings_init,llhttp_method_name,llhttp_status_name,llhttp__debugRust
env_var.rs:BUN_DUMP_STATE_ON_CRASH(bake's crash-state dump;BUN_NEEDS_PROC_SELF_WORKAROUND,MI_VERBOSEandTODIUMare in the same state but already removed by Remove dead code from C++ bindings, src/js builtins, CSS, and Rust util crates #35437). Its reader lived in the Zig sources and was not carried over in the Rust rewrite, so nothing has read it since May; if the feature is wanted back it needs to be reimplemented, not just declared.node_fs.rs: re-exports ofCpSingleTask,IntoResultListEntry,ResultListEntry,ResultListEntryValuethat nothing imported (the items themselves are still used inside the module and becomepub(crate)).test/internal/source-lints/dead-symbols-linker-sweep.test.tspins every removed symbol so it cannot quietly come back; it fails onmainand passes here.Verification
bun bd(full debug build) passes;bun run rust:check-allpasses on all 10 target triples;cargo fmt --checkand clang-format are clean.bun bd testpasses ontest/js/node/crypto/{node-crypto,crypto-rsa,crypto.key-objects,scrypt,pbkdf2,x509},test/js/node/http/node-http-parser.test.ts,test/js/bun/udp/udp_socket.test.ts,test/js/node/quic/quic-stream.test.ts,test/js/web/abort/abort.test.ts,test/js/node/perf_hooks/perf_hooks.test.ts,test/js/node/v8/capture-stack-trace.test.js,test/regression/issue/prepare-stack-trace-crash.test.ts,test/js/node/buffer.test.js, andbun bd test/js/node/test/parallel/test-tls-sni-server-client.jsexits 0.test/js/bun/http/serve.test.tshas the same 4 failures as the released binary in this container (IPv6, privileged ports, non-loopback clients); everything else in it passes.us_socket_detachin a comment as an example of a detach path; that comment can be reworded when it lands.Left alone on purpose (follow-ups, not in this diff)
DOMPromise::whenPromiseIsSettled->DeferredPromise::whenSettledchain (~85 lines) is dead but its last link is removed by Remove dead code from webcore bindings, watcher, node-fallbacks, and misc crates #37062; it can go once that lands.JSPromise::resolve_task/settle_task,VM::has_termination_request+JSC__VM__hasTerminationRequest,Completion::off_thread,JsThread-witness accessors injob.rs) are left for that work to settle.ServerTiming.h/.cpp,ResourceTiming's constructor andPerformanceServerTiming::createare now only reachable from each other; removing them means deciding what to do with the still-exposedPerformanceServerTimingconstructor.<Class>_gettercustom getters that theFOR_EACH_...macro inZigGlobalObject.cppemits for ~40 classes that never install them are discarded by the linker; dropping them needs the macro split, not a deletion.PerformanceResourceTimingitself,sqlite3.c's RBU/session extensions, and the Loose/ClampJSDOMConvertNumbersinstantiations are unreferenced but are either exposed API surface, vendored, or supported generator options.[review] gate passed · iteration 1 · 50 files touched
fails on main (without fix)
passes on PR (with fix)
diff hotspot
gate history · 1 passed · 1 rejected · iteration 1
evidence per changed file