Upgrade to upstream WebKit 6b879687ee

[robobun]

Merges upstream WebKit main at 6b879687ee (2026-08-28): 343 commits since the previous merge base 8c4fd56347 (2026-08-23), 77 of them touching JavaScriptCore, WTF or bmalloc. git merge-base origin/main upstream/main reports 8c4fd56347 directly (#503 landed as a merge commit), so no graft was needed. This merge commit has 6b879687ee as its second parent.

The companion Bun PR is oven-sh/bun#40681. It needs one source change: c8fdf5eb81 adds a const String& referrer parameter to GlobalObjectMethodTable::moduleLoaderFetch, so every Bun moduleLoaderFetch (ZigGlobalObject, StandaloneGlobalObject, BakeGlobalObject) gains that parameter.

Conflict resolutions

• bytecode/UnlinkedMetadataTable.cpp (97df94ead0): upstream computes the metadata offsets in finalize() with CheckedUint32, rejects a table whose offset + s_offset32TableSize + valueProfiles * sizeof(ValueProfile) does not fit 32 bits, and makes finalize() return bool (the generator turns a failure into ParserError::OutOfMemory). The fork's finalize() (Bytecode cache: smaller payloads that page in only what is decoded (alias mapped bytes, region layout, 32-bit offsets, sparse metadata table) #494) allocates only the offset table and leaves the ValueProfile and LinkingData allocation to link(), which sizes it from totalSize(). Resolution: upstream's checked computation and failure path are kept (the bound still protects link()), the fork's ASSERT(!m_isLinked) and offset-table-only allocation stay, and the now unused valueProfileSize local is dropped. The two comments now point at link(). The fork's cached-steps layout (expandSteps) keeps its own RELEASE_ASSERT against a 32-bit offset overflow.
• runtime/JSModuleLoader.cpp, .h (c8fdf5eb81): upstream adds const String& referrer to loadModule and passes moduleReferrer(referrer) from requestImportModule; the fork had already added int64_t referrerAsyncOrder to both functions. Both parameters are kept: loadModule(..., OptionSet<ModuleLoadFlag>, int64_t referrerAsyncOrder = -1, const String& referrer = { }), and requestImportModule passes both. The fork's extra fetch() call in hostLoadImportedModule (the synchronous require(esm) re-issue under m_synchronousModuleQueue) passes moduleReferrer(referrerKey), the same value as upstream's Status::New call site a few lines below.
• runtime/JSString.h (24f0a33655): upstream's isDefinitelyAtom(), markAsAtom() and existingAtomOrNull() land next to the fork's value(jsstring_iterator*) declaration. Both kept.
• yarr/YarrJIT.cpp, yarr/YarrPattern.cpp (d21310b806, 44ebe94906): kept at the fork's version (Yarr: JIT lookbehinds, first-code-point alternation dispatch, Boyer-Moore and /u·/v spec alignment, RegExp correctness fixes #299 policy, as in Upgrade to upstream WebKit 47f7250137c6 #455 and Upgrade to upstream WebKit 8c4fd56347 #503). Both upstream commits are ports of capabilities the fork's mirrored-frame lookbehind JIT already has: mirrorAlternativeInto mirrors groups of any quantifier and deep-copies nested forward assertions through copyForwardDisjunctionForMirror, the zero-iteration backtrack already skips emitClearCapturesForTerm for a split copy (isCopy), and the lazy re-entry branch is already direction-aware (op.m_direction == Backward ? Below : Above). The YarrPattern.cpp conflict was a comment. Upstream's four new tests pass on the fork's JIT and with --useRegExpJIT=false (see Verification).
• Source/cmake/WebKitCompilerFlags.cmake (82220a2f11): upstream moves the sanitizer link flags from the CMAKE_*_LINKER_FLAGS strings to add_link_options. The fork's Windows ASAN runtime selection (the static-CRT clang_rt.asan_static_runtime_thunk, /WHOLEARCHIVE so the thunk's interceptor objects are not dropped) is carried over as add_link_options("/WHOLEARCHIVE:${CLANG_ASAN_LIBRARY}" ${CLANG_ASAN_RT_LIBRARY}).

Checked and unchanged: runtime/JSType.h, .github/workflows, the release tarball names. The WebCore bindings generator change in the range (IDLAttributes.json, preprocess-idls.pl) does not affect the JSCOnly build.

Verification

• bun run jsc:build:debug (Linux x64, debug + ASAN, clang 21): builds, the jsc shell runs.
• The 19 JSTests added in the range: 18 pass on the merged jsc with the options their headers name (jsstring-definitely-atom-bit.js needs --useDollarVM=1, the three Wasm tests need -m, multimemory-shared-grow-refreshes-only-its-own-slots.js also needs ASAN_OPTIONS=allow_user_segv_handler=1 for the fault signal handler). unlinked-metadata-table-finalize-overflow.js is skipped on debug builds upstream. The four new Yarr lookbehind tests pass in JIT and --useRegExpJIT=false mode on the fork's YarrJIT.
• Yarr on the merged MacroAssembler (80fc868e73, 1330d5747e, 2b0e50239a change codegen every Yarr pattern goes through): all 296 JSTests/stress/regexp*.js run in JIT and --useRegExpJIT=false mode. 294 pass in both modes. regexp-bol-optimize-out-of-stack.js and regexp-quantify-atom-copy-term-out-of-stack.js pass when run without their $memoryLimited header option. The three that fail do so identically on a jsc built from the fork's main before this merge (the autobuild-preview-pr-525-998a2251-debug-asan prebuilt): regexp-boundary-assertions.js and regexp-buffer-boundaries-anchoring.js need upstream's --useRegExpBufferBoundaries, which the fork's Yarr does not have, and regexp-unicode-code-unit-read-for-bmp-terms.js line 20 (a sticky /u match started on a trail surrogate), where the fork matches the surrogate pair as V8 does.
• Bytecode disk cache round trip on the merged jsc (the UnlinkedMetadataTable.cpp conflict): every bytecode-cache-*.js, every top-level JSTests/modules test (-m) and 300 random JSTests/stress tests, each run plain with --diskCachePath (writes the cache), then with --forceDiskCache=true (must decode), then with --diskCachePayloadIsPersistentForTesting=true as well, outputs compared. 82 files declare their own options and were skipped; 310 pass all three ways. The 18 that fail do so identically in all three modes, so none is a cache problem: 8 module tests that check the fork's error wording or import-attribute handling (aliasing, different-view, fallback-ambiguous, import-attributes-unsupported, import-error, indirect-export-error, module-is-strict-code, namespace-error, all failing the same way on the pre-merge prebuilt jsc), 8 Intl tests (the prebuilt libicudata.a this machine links is the per-item zstd-compressed one that only Bun's bun_icu_maybe_decompress hook can read; the same Intl calls succeed in the Bun built against this tree), has-indexed-property-slow-put-array-storage-ftl.js (needs runFTLNoCJIT) and iterator-error-messages-consistent.js (fork error wording). No decode failure, checksum mismatch or crash.
• bun run build:local: Bun (main d64a03fadc plus compile: pre-register embedded modules without allocating loader promises bun#40674, which pins the fork's f5deafe090, plus the moduleLoaderFetch parameter) links and runs against this tree. test/js/bun/jsc/webkit-upgrade-6b879687ee.test.ts pins three engine behaviors from this range that crash or miscompile on the current pin and passes. Suites run on that debug + ASAN build: test/js/bun/jsc, bun/jsc-stress (146/146), node/events, node/util, node/vm, node/module, bun/resolve, node/worker_threads, bun/wasm, web/url (1305/1305), web/atomics, web/temporal, web/intl, web/workers, node/string_decoder, bundler/bundler_compile, bundler/bun-build-api, bundler/bun-build-compile: 3,719 pass. Every failure is one of: a 5 s (or per-test) timeout under debug + ASAN that passes with a longer timeout (the DOMJIT warm-up loops, parseArgs stress, util.inspect, vm.Script leak check, worker termination, the two bun-build-api bytecode tests, bun-build-compile's --compile --bytecode cases; the compiled-executable aliasing check was run by hand: 4000 decoded functions keep 12.7 MB out of anonymous memory), a test that fails the same way on a debug build at the current pin (compile/HelloWorldWithProcessVersionsBun, the worker "message flood" timing check, and the ASAN-only terminate() while dns.lookup() test, which fails on LeakSanitizer for a node_fs_binding::Binding that main already leaks), or a cascade from one of those (the cross-process structured-clone child).

Upstream changes

Each commit appears once under the most specific heading that applies. Commits whose only engine-side footprint is a WebCore/WebKit preference entry, an xcconfig, a safer C++ expectations list, or Cocoa/GTK/WPE/Swift-only code that the JSCOnly port does not compile are listed at the end.

Needs a Bun-side change

• c8fdf5eb81 [API] [BEHAVIOR]: the module fetch hook receives the referring script's base URL. GlobalObjectMethodTable::moduleLoaderFetch is now JSPromise* (*)(JSGlobalObject*, JSModuleLoader*, JSValue key, const String& referrer, RefPtr<ScriptFetchParameters>, RefPtr<ScriptFetcher>), JSModuleLoader::fetch and loadModule take the same referrer, hostLoadImportedModule passes the referring module's key for static descendants and requestImportModule passes the importing module's key for dynamic import(). A Symbol key (inline module) yields the empty string, a null string means no referring script. WebCore uses it to send the spec-correct Referer header; inside JSC nothing JS-visible changes. Bun: ZigGlobalObject.h:195 and :853, ZigGlobalObject.cpp:3649 and :3893 (three forwarding calls), runtime/bake/BakeGlobalObject.cpp:130 (two forwarding calls) gain the parameter; the method tables need no edit once the signatures match, and NodeVM.cpp stores nullptr. Bun ignores the value for now.

API and ABI changes

• 0c7e7ad97b [API]: wtf/Expected.h is now #include <expected> plus template<class T, class E> using Expected = std::expected<T, E>; and unexpect = std::unexpect; the in-tree std::experimental::fundamentals_v3::expected (378 lines) is gone. std::expected is stricter: return { { lvalue } } no longer compiles, assignment requires is_nothrow_move_constructible_v<T> || is_nothrow_move_constructible_v<E> (so Ref(Ref&&) and RefPtr(RefPtr&&) are now noexcept, which makes String and Exception nothrow-move-constructible), and value() requires a copy-constructible E (NativePromise uses *result). makeUnexpected (StdLibExtras.h:1613) already returned std::unexpected. Bun's ExceptionOr.h (Expected<T, Exception>), webcore/JSDOMConvertResult.h, webcore/CallbackResult.h and InspectorLifecycleAgent.cpp satisfy the new constraints and compile unchanged; Bun builds with -std=gnu++23.
• f057e7bc12, 54b9fc03d8, 44d3c5c94d [API]: WTF::ScopedLambda gains an implicit converting constructor from any invocable (LIFETIME_BOUND, no copy), so a callee taking const ScopedLambda<Sig>& accepts a bare lambda; scopedLambda<Sig>(), scopedLambdaRef<Sig>(), ScopedLambdaFunctor and ScopedLambdaRefFunctor are removed; ScopedLambda is now non-copyable and non-movable (a copy could outlive the lambda it points at); the constraint excludes ScopedLambda itself to fix a clang 18 to 20 recursion. LazyFireDetail owns its functor, and JSC::initialize, Options::initialize, VMManager::forEachVM, Heap::forEachCodeBlock, ParkingLot::parkConditionally and friends pass lambdas directly. Bun's only indirect use is JSC::initialize([&] { ... }) (ZigGlobalObject.cpp:301), unchanged.
• 140ec9c4a1 [API]: wtf/TypeTraits.h replaces the SFINAE structs HasRefPtrMemberFunctions<T>, HasWeakPtrFunctions<T>, HasThreadSafeWeakPtrFunctions<T>, HasCheckedPtrMemberFunctions<T> with C++20 concepts of the same names (X<T>::value no longer compiles) and removes LooksLikeRCSerialDispatcher, SFINAE_OVERLOAD* and detail::SFINAE1*. Bun does not reference any of them.
• a90ff51d22 [API] [FIX]: ThreadSafeWeakPtr<T> and ThreadSafeWeakRef<T> drop the TaggingTraits template parameter and setTag()/tag(), and store a control block pointer, an int16_t object offset and a Lock (copy, move, assign and get() lock), so mutating one weak pointer from several threads is safe. Upstream's microbenchmark: 1M construct+get from 8.4 ms to 19.4 ms. Bun's ThreadSafeWeakPtr<MessagePort> (webcore/MessagePort.cpp, MessagePortPipe.h) and ThreadSafeWeakPtr<BroadcastChannel> (BunBroadcastChannelRegistry) use the single template argument and compile unchanged.
• 4d79cb17cc [API] [FIX]: adds virtual VM::ClientData::reconcileWeakReferencesAtGCEnd(VM&, CollectionScope) with an empty default, called from Heap::reconcileWeakReferencesAtGCEnd() after marking, so an embedder can reconcile weak references of ErrorInstance subclasses it keeps in its own IsoSubspaces (WebCore's JSDOMException). Bun's JSVMClientData inherits the default; Bun's JSDOMException is a JSDOMWrapper, not an ErrorInstance.
• 045a0c6379 [API] [BEHAVIOR]: ErrorInstance::finishCreation(VM&, StackTraceCapturePolicy) and StackTraceCapturePolicy are replaced by finishCreationForEmbedderError(VM&) and setErrorInfoForEmbedderError(LineColumn, String&& sourceURL, String&& stackString); StructuredCloneTags.h bumps CurrentMajorVersion 15 to 16. The JS-visible part (DOMException.stack) lives in WebCore. Bun's SerializedScriptValue.cpp keeps its own CurrentVersion = 14 and Bun does not reference the removed names.
• f6a959b7e8 [API] [PERF]: removes CodeBlock::valueProfileLock() and the ConcurrentJSLocker& parameter from ValueProfileBase::computeUpdatedPrediction, CodeBlock::valueProfilePredictionForBytecodeIndex, updateAllNonLazyValueProfilePredictions, updateAllLazyValueProfilePredictions and LazyOperandValueProfileParser::prediction; DFG::ByteCodeParser::injectLazyOperandSpeculation no longer takes the CodeBlock lock. Bun does not reference these.
• 57d983744d [API] [PERF]: StructureCache::emptyStructureForPrototypeFromBaseStructure gains a defaulted ShouldCacheStructure parameter; createEmptyStructure skips the hash lookup when !prototype->mayBePrototype(), and InternalFunctionAllocationProfile does not cache the first structure (it is memoized in FunctionRareData). Bun's twenty emptyObjectStructureForPrototype callers and its InternalFunction::createSubclassStructure callers see unchanged signatures.
• d9d2fbd881 [API] [PERF]: Darwin arm64 core detection. hwNumberOfP0Cores()/P1/P2 are replaced by CoreCategory { Super, Performance, Efficiency } and hwNumberOfCores(CoreCategory), read from hw.perflevelN.name; on M5 Pro/Max the old code counted Performance cores as efficiency cores. numberOfGCMarkers and the macOS low-core DFG/FTL threshold scaling follow. Options renamed: numberOfSuperAndPerformanceCoresOverride, dfgThresholdScaleForFewPerformanceCores, ftlThresholdScaleForFewPerformanceCores. Changes GC marker count and JIT thresholds for Bun on Apple silicon; Bun does not reference the symbols.
• f479ae9f53 [API] [PERF]: Wasm::TypeInformation::tryCleanup() is private; requestCleanup() sets a flag from JSWebAssemblyModule::destroy() and cleanupIfRequested() runs in Heap::runCollectionEpilogue, sweepSynchronously and lastChanceToFinalize, so the global Wasm type registry is swept once per GC cycle instead of per module destruction. Bun does not reference TypeInformation.
• 7d867192b7 [API] [FIX]: B3::Procedure::backwardsDominators() becomes JS_EXPORT_PRIVATE as part of the BackwardsGraph fix below.
• 436d708da9, cbf0ef68ad [API] [INFRA]: wtf/CompletionHandler.h gains Swift bridging (SwiftClosureInvoke/SwiftClosureDestroy, a __swift__-only constructor and passArgumentToSwift), WTF::VoidCompletionHandler and WTF::BoolCompletionHandler aliases, WTF_NONNULL/WTF_NULLABLE annotations, and deletes the Objective-C block constructor on Apple; OptionSet.h widens a friend for a compiler bug. Bun includes the header (ScriptExecutionContext.h, webcore/SerializedScriptValue.cpp) and uses none of this.
• 3e6559f2f3 [INFRA]: wtf/MemoryPressureHandler.h adds using WTF::MemoryPressureHandlerConfiguration; for WebKit IPC serialization. No Bun reference.

Behavior changes and correctness fixes

• 752ab90072 [FIX] [BEHAVIOR]: ArrayPatternNode::bindValue and ObjectPatternNode::bindValue check isSafeToRecurse() and emit a RangeError. A destructuring pattern nested a few thousand levels deep passed the parser's recursion guard and overflowed the native stack during bytecode generation (SIGSEGV). Pinned by the companion Bun PR's test.
• 33876268a1 [FIX]: an Absence PropertyCondition now consults a structure's non-reified static property table (hasNonReifiedStaticProperties() plus findPropertyHashEntry), as AbsenceOfSetEffect already did. The DFG could fold symbolObject.description (a static Symbol.prototype property) to Object.prototype.description's value. Ten Bun classes use HasStaticPropertyTable without reifying (BunProcess, JSBuffer, JSEvent, the ProcessBinding* objects, JSNodeHTTPServerSocketPrototype) and were exposed to the same misfold. Pinned by the companion Bun PR's test.
• 9f3eea6f46 [FIX]: DFGFixupPhase cleared NodeMustGenerate on Int32/Int52 ArithMul, ArithDiv, ArithMod, ArithNegate and ArithAbs even with CheckOverflow or CheckOverflowAndNegativeZero selected, so the AI proved the result Int32, folded (y | 0) === y to true, and DCE deleted the node with its check. Now only the Arith::Unchecked branches clear the flag. Pinned by the companion Bun PR's test (the old engine returns true for 65536 * 65536 being an int32).
• 03a07e4200 [FIX]: DFGIntegerRangeOptimizationPhase flipped checked ArithAbs/ArithAdd/ArithSub/ArithMul to Unchecked using range proofs from other checked nodes without recording the dependency, so DCE could later delete the proving checks. rangeFor() now returns RangeBound { value, proof } pairs and pinRangeBounds() sets NodeMustGenerate on the nodes behind each proof before a flip.
• 8283d4f127 [FIX]: DFG setIntTypedArrayLoadResult for a boxed Uint32Array load typed SpecInt32Only by the AI emitted convertUInt32ToDouble + boxDouble; consumers relying on the Int32 proof read a boxed double. Now it speculates < 0 with an Overflow exit and boxes an int32, matching FTL.
• cb05a6083a [FIX]: DFGConstantFoldingPhase re-runs the abstract interpreter after folding GetScope of a fresh NewFunction-family node to Identity, so the node's AbstractValue is not left at a stale bottom value that made later phases treat it as unreachable.
• 1d5c10e2f9 [FIX]: B3ReduceStrength::specializeSelect() deleted Checks that PureCSE still indexed (Checks are pure-keyed), leaving a dangling Value* read by PureCSE::findMatch. New PureCSE::remove(const ValueKey&, Value*) is called before deleteValue. Affects FTL and Wasm OMG.
• 7d867192b7 [FIX]: WTF::BackwardsGraph used one worklist for synthetic-root membership and the predecessor flood, so a back-edge source already visited through another back-edge was dropped from the root successors. B3::BackwardsDominators then claimed a block post-dominated a loop pre-header and LICM hoisted a control-dependent load. The same template backs DFGBackwardsCFG.
• 7920db18a5 [FIX]: virtualForWithFunction now records an InternalFunction callee and operationPolymorphicCall/llint_polymorphic_call only call linkPolymorphicCall when the callee cell is non-null, because handleHostCall can run JS (a Proxy apply trap) that fires a watchpoint and frees the CallLinkInfo (use after free). An InternalFunction callee now keeps the IC polymorphic instead of downgrading it to virtual.
• 8f229fb729 [FIX] [BEHAVIOR]: Wasm validator security fix. The End of every structured control instruction forces the block's declared result types onto the expression stack, not only if/else; a try/catch declared anyref whose fallthrough arm left (ref $array) kept the subtype and a following ref.test/ref.cast was folded away, so a non-cell externref from the other arm caused type confusion.
• 4002a938c8 [FIX]: Wasm multi-memory use after free. Growing a shared memory refreshed every anchored instance's cached memories, including non-shared siblings whose handles the owning thread may have just freed. New JSWebAssemblyInstance::updateMatchingCachedMemoriesConcurrently(const SharedArrayBufferContents&) refreshes only the slots backed by the grown memory. Relevant to Bun workers that share a WebAssembly.Memory.
• 9a17cd1100 [FIX]: OMG inlining a SIMD callee into a non-SIMD root did not mark the B3 Procedure as using SIMD (setUsesSIMD(), renamed from setUsessSIMD()), so Air spilled and shuffled FP registers at scalar width and corrupted externref results. Applies to Bun's x64 and arm64 Wasm SIMD.
• 97df94ead0 [FIX] [API]: UnlinkedMetadataTable::finalize() computes offsets with CheckedUint32 and returns bool; UnlinkedCodeBlockGenerator::finalize returns bool and BytecodeGenerator::generate reports ParserError::OutOfMemory on overflow. A function with very many metadata-bearing opcodes could overflow the 32-bit offsets. See the conflict resolution above. Bun does not call either finalize.
• 1afb343a6d [FIX]: WTF::HighPriorityThreads (Linux) no longer derives from CanMakeWeakPtr; the GLib RealtimeKit proxy timer uses a lambda over the singleton instead of a WeakPtr bound to the first high-priority thread. GLib only; Bun's JSCOnly build uses EVENT_LOOP_TYPE=Bun.
• d3699b5838 [FIX]: Logger::Observer::~Observer() asserts the observer is no longer registered (assertIsNotRegistered()); the fix proper is WebCore's MediaSource removing itself. Bun defines no Logger::Observer.
• 2ca559226b [PERF] [BEHAVIOR]: Temporal chinese/dangi calendars: advanceToNextLunisolarMonth jumps to day 29 and walks at most 3 days, with two lock-protected process-global memo tables (lunisolarWalkMemos, lunisolarMonthLengthMemos). Upstream: temporal-plain-month-day-lunisolar-month-code 14785 to 224 (66x). Bun enables Temporal; results are unchanged.

Performance

• 48985e195c [PERF] [API]: DFG VariableEventStream is a byte stream (tag byte plus LEB128 payloads) with a side table of Reset offsets; VariableEventStreamBuilder::finalize() returns the stream and OSR exit stream indices become byte offsets. New wtf/LEBEncoder.h, LEBDecoder.h gains decode*OrCrash. Upstream on JetStream3: 66.6 MB to 17.8 MB for the event streams (-73%), +0.5 us per reconstruct(). Bun does not reference these.
• 580b6dade2 [PERF]: FTL OSRExitDescriptor::m_values becomes OSRExitValues, a tag+payload byte stream with run-length encoded dead values and a shared constants table; OSRExitDescriptor::values(const JITCode&) decodes at exit-stub compile time. Upstream: 86 MB to 4.77 MB (-94.5%) across 5,455 FTL compiles, 122 ns encode and 104 ns decode per descriptor.
• 24f0a33655 [PERF] [FIX]: JSString::isDefinitelyAtom() uses the per-cell type-info bit, set on construction from an atom and by markAsAtom()/swapToAtomString()/convertToNonRope() after a fence. Value profiling (speculationFromValueForProfiling) reads the bit instead of dereferencing the StringImpl, which removes a memory-ordering hazard for concurrent compiler threads; AssemblyHelpers::branchIfNotAtomStringImpl lets Baseline, DFG and FTL skip the rope and flagIsAtom checks. ValueProfileBase::classInfo(unsigned) is deleted. No CachedTypes change.
• 57d983744d, bc2c8875fc [PERF]: see above for the StructureCache skip; LINK(OpInstanceof) is added to CodeBlock::finishCreation, so the LLInt caches the Symbol.hasInstance load (upstream: instanceof microbenchmarks 1.4x to 2.3x faster with useJIT=false). Authored by Bun's Sosuke Suzuki.
• c9740e5b2b [PERF]: @copyDataProperties (object rest destructuring) tries objectCloneFast when the target is empty and there is no excluded set, like Object.assign since 319645@main. Upstream: object-rest-clone 1.47x faster.
• 2b0e50239a, 1330d5747e, 80fc868e73, 0a67a6646c, ba84b36bc6 [PERF]: MacroAssembler peepholes. The megamorphic cache hash uses addUnsignedRightShift32 (one add ..., lsr #8 on arm64); unsigned Above/BelowOrEqual compares against zero become cbz/cbnz or test (99.4% of 65,764 sites are the unfenced write barrier, about 263 KB of JetStream3 JIT code); add/sub of a zero immediate become a mov or nothing (the x86_64 flag write disappears for zero immediates; the fork's YarrJIT does not rely on flags from these entry points, and its tests pass). The Baseline ldp pairing of adjacent metadata loads (0a67a6646c) was reverted in-range by ba84b36bc6 (a speculative 1% JetStream3 regression), net zero.
• b5928f9be1, 5bbcf5a4c9, 798b6ba2bd [PERF]: Wasm. The wasmToWasm import stub loads targetInstance and entrypointLoadLocation with one loadPairPtr; table.size is emitted inline in BBQ and OMG; table.get on externref/anyref tables is inlined in BBQ and OMG (funcref tables still call out). Adds ExternOrAnyRefTable::offsetOfJSValues().
• 041ad12a18, f198e8af3b, f69aff0fba, 2eedeabcb7, f733e45e7f [PERF]: GC. MarkedBlock::Handle::stopAllocating iterates free-list intervals (FreeList::forEachInterval), bulk-clears and bulk-sets m_newlyAllocated with new BitSet::clearEachNthBit/setEachNthBit (one store per word), and skips zapping for cells that need no destruction; BitSet::concurrentTestAndSet/Clear use exchangeOr/exchangeAnd (ldset/ldclr on arm64 LSE); a finished bonus visitor task signals a dedicated condition instead of waking every parallel marker; SlotVisitor::drainFromShared no longer broadcasts termination from the thread that observed it. SlotVisitor::waitForTermination is removed. Bun uses WTF::BitSet (StrongRootBlock.h, EncodeURIComponent.cpp) but not these methods.
• ecc99e5029, 96b1030b8d [PERF]: Air compile time. FixObviousSpills skips empty states and instructions without spill slots; the Greedy register allocator caches clobber sites per program point and enumerates Tmps with forEachTmpFast. 96b1030b8d also fixes PrintSpecial::forEachArg reporting no args (liveness ended printed Tmps early) and drops unused PrintSpecial accessors. The fork's clang-cl Cost comparison workaround in AirAllocateRegistersByGreedy.cpp is unaffected.

Build and infrastructure

• 82220a2f11 [INFRA]: CMake stops rewriting swiftc arguments. For every port including JSCOnly: add_definitions(-DBUILDING_WITH_CMAKE=1 ...) becomes webkit_add_compile_definitions(...), -fuse-ld=lld, --gc-sections, --disable-new-dtags, --gdb-index, LTO -flto=, --no-keep-memory, the sanitizer flags and --no-undefined (now SHARED/MODULE targets only) move to add_compile_options/add_link_options, and ENABLED_COMPILER_SANITIZERS is built in the sanitizer loop instead of a regex over CMAKE_CXX_FLAGS. The effective flags are unchanged; the fork's Windows ASAN hunk is ported (see the conflict above). bun run jsc:build:debug is the check.
• 1fec4985d1 [INFRA]: GCC floor raised to 13.1.0 (libstdc++ 13.1 for C++23 std::format); the GCC < 12 warning block and the jit/JIT.h using enum WriteBarrierMode workaround are removed. Bun builds with clang.
• f69625842f [INFRA]: wasm/WasmAddressType.h guards the B3::Type conversions with ENABLE(JIT) for ENABLE_JIT=OFF builds. Bun builds with JIT on.
• b13574b29b, e6f6ed997e, 23d9fb2bf1, 5c7edee974 [INFRA]: safer C++ analyzer annotations only: DefaultWeakPtrImpl::deref() and the Lock/UnfairLock/WordLock methods get NODELETE, memcpySpan gets NODELETE, FlatteningVariantAdaptor::switchOn gets NOESCAPE. Empty on MSVC and older clang; Bun's WTF::Lock and memcpySpan uses compile unchanged.
• f918fec1e1 [INFRA]: libpas inlines the PAS_MTE_HANDLE indirections that resolved to PAS_MTE_CLEAR*; pas_mte.h defines them outside PAS_ENABLE_MTE. On non-MTE builds (all Bun targets) the sites now mask the top byte, which is already zero.
• e5c29fb322, 118f677663 [INFRA]: Mya (an Apple-only memory analyzer) and libJavaScriptCoreTools were added with if (APPLE) cmake blocks in Source/JavaScriptCore/CMakeLists.txt and shell/CMakeLists.txt, then reverted in-range. HEAD contains none of it.
• 9fa946d9a7 [INFRA]: GLib API cleanup (jsObjectCall takes a span); ENABLE_JSC_GLIB_API is off for JSCOnly.

Omitted (no JSCOnly footprint)

ada29caa0f, ea3dd8bd98, de94eda046 (safer C++ expectations lists); 37787f8a4d, 34a2ffae86, cb138473ae (UnifiedWebPreferences.yaml entries); f16770926a (xcconfig $(inherited)); fa83add634 (Cocoa RuntimeApplicationChecksCocoa.mm); bc9f768050 (Cocoa cmake); c9d8bf6fee (a Cocoa-only HAVE_NETWORK_FRAMEWORK_HTTP_MESSAGING condition); 4e646d190c (Swift-only build scripts); 81c94dae4c (a GTK/WPE-only ENABLE_IPC_TESTING_API guard).

[github-actions]

Preview Builds

Commit	Release	Date
41528be5	autobuild-preview-pr-528-41528be5	2026-08-28 02:03:31 UTC

[claude]

🔴 RangeBound::proof is a raw const Relationship* into m_relationships[child1]'s backing Vector, but for ArithAbs the transform loop calls executeNode() between rangeFor() (line 1352) and pinRangeBounds() (lines 1370/1377). executeNode(ArithAbs) invokes setRelationship(Relationship(node, m_zero, …)), and setOneSide()'s transitive-equality propagation (lines 2063-2085 / 2119-2121) can recursively append() to m_relationships[child1] when an Equal edge links m_zero (or node) to child1. That append may reallocate the Vector, leaving minBound.proof/maxBound.proof dangling; pinRangeBoundProof() then dereferences freed memory at line 1076. …

Extended reasoning...

…ArithAdd/ArithSub pin before executeNode() and ArithMul's executeNode() is a no-op, so only ArithAbs is exposed. The fix is to pin before executeNode() (as the other ops do) or capture the proof's left()/right() Nodes by value in RangeBound instead of storing a Relationship*.

In FTL-compiled code where Math.abs(x) has an Int32 input x that IRO has proven equal to a negative constant via a non-constant node (e.g. x = y + (-3) with y proven 0 through a CheckInBounds/ArithAdd chain, so m_relationships[m_zero] holds m_zero Equal x + 3), the flipped setOneSide(m_zero, node, …) walks that Equal edge and appends a new relationship to m_relationships[x]. If that Vector is at capacity it reallocates, and the subsequent pinRangeBounds(minBound, maxBound) reads bound.proof->right()/left() from freed heap. Under ASAN this is a heap-use-after-free crash on the DFG/FTL compiler thread; in release builds it can read a stale/overwritten Relationship and call mergeFlags(NodeMustGenerate) on an arbitrary Node*, or crash. This is new behaviour…

Verification: normal — This is a newly-introduced use-after-free hazard. The RangeBound::proof field added in this diff (line 1026: const Relationship* proof { nullptr };) is populated by rangeFor() at line 1046 (minBound.proof = &relationship;) with a raw pointer into m_relationships.find(node)->value, a Vector<Relationship> (map type at line 1012: `UncheckedKeyHashMap<NodeFlowProjection,…