Upgrade WebKit to 51cc3feb7298#31796
Merged
Merged
Conversation
- JSPromise reject/fulfill/rejectAsHandled/rejectWithCaughtException no longer take a JSGlobalObject parameter; promise jobs run in the promise's own realm (webkit.org/b/316187). Update all call sites. - JSType gained SentinelType before ObjectType, shifting object types by one; update the JSType mirror. - OrderedHashTableHelper.h was renamed to JSOrderedHashTableHelper.h.
Collaborator
|
Updated 8:36 PM PT - Jun 15th, 2026
❌ @sosukesuzuki, your commit c4794e7 has 1 failures in
Add 🧪 To try this PR locally: bunx bun-pr 31796That installs a local version of the PR into your bun-31796 --bun |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Contributor
|
Found 1 issue this PR may fix:
🤖 Generated with Claude Code |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughBumps the WebKit build target, inserts a JSType Sentinel (shifting subsequent JSType discriminants by +1), and updates many JSPromise reject/fulfill call sites to use vm-first overloads (removing globalObject arguments) across bindings and runtime backends. ChangesWebKit upgrade and JavaScriptCore API alignments
Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
Contributor
|
This PR may be a duplicate of:
🤖 Generated with Claude Code |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
The Bun-side adaptations look mechanically correct, but a JSC engine upgrade (155 commits, JSType renumbering, cross-realm promise semantics change) warrants a human sign-off — and per the description, WEBKIT_VERSION still points at the preview tag.
Extended reasoning...
Overview
This PR upgrades the vendored WebKit/JavaScriptCore from 39d4ce1f12ea to 51cc3feb7298 (155 upstream commits) and applies the required Bun-side adaptations:
scripts/build/deps/webkit.ts:WEBKIT_VERSIONbumped toautobuild-preview-pr-248-cf784902(preview build — explicitly flagged as needing a follow-up bump before merge).src/jsc/JSType.rs: insertedSentinel = 32and shifted every value fromObjectthroughInternalFieldTupleby +1. Range checks (is_object, typed-array bounds) reference the named constants, so they shift correctly.- 13 C++ files: dropped the
JSGlobalObject*argument fromJSPromise::reject/fulfill/rejectAsHandled/rejectWithCaughtExceptioncall sites to match the upstream signature change; one header rename (OrderedHashTableHelper.h→JSOrderedHashTableHelper.h).
Security risks
No new attack surface is introduced by the Bun-side diffs themselves — they are signature adaptations and constant renumbering. The pulled-in WebKit range does include several upstream correctness/security fixes (DFG constant-folding, YARR, GC scanning of OSR scratch buffers, etc.), which is net positive but also means a large body of new engine code is being adopted.
Level of scrutiny
High. This is a JS engine upgrade — the most foundational dependency in the project. Even though each Bun-side edit is mechanical, the upstream changes alter promise-realm semantics (jobs now queue on the promise's own realm via JSPromise::realm()), which interacts with Bun's multi-global setups (node:vm, workers, Bake, WebView). The JSType renumbering must exactly match the C++ enum across the FFI boundary; a one-off error would be a silent miscompile.
Other factors
- The PR description itself states
WEBKIT_VERSIONmust be bumped from the preview tag to the realautobuild-<sha>before merge, so this is not yet in a mergeable state by the author's own criteria. - No bugs were flagged by the bug-hunting pass, and spot-checking the
JSType.rsshift and thereject/fulfillcall-site edits shows them to be consistent and complete. - CI build is still in progress; engine upgrades typically need the full test matrix to validate.
[skip size check]
…kit-upgrade-51cc3feb7298
> [\!NOTE] > **Stacked on #31796** (base branch is `claude/webkit-upgrade-51cc3feb7298`). Retarget to `main` after #31796 merges. > > `WEBKIT_VERSION` currently points at the preview build `autobuild-preview-pr-251-10fc0cab` from [oven-sh/WebKit#251](oven-sh/WebKit#251). After that PR merges, bump it to the merge commit's `autobuild-<sha>` release before merging this PR. ## Bun-side changes - `VM::getHostFunction` gained an `unsigned length` parameter (name/length now live on the `NativeExecutable`), and `JSFunction::finishCreation(VM&, NativeExecutable*, unsigned, const String&)` was deleted upstream. Updated `JSWrappingFunction`, `JSFFIFunction`, `NapiClass`, and `JSSQLStatementConstructor` to pass length/name through `getHostFunction` and use the default `finishCreation(VM&)`. ## WebKit-fork-side changes (in the merge, oven-sh/WebKit#251) - Ported the `USE(BUN_JSC_ADDITIONS)` AsyncLocalStorage context wrapping to upstream's reworked internals: `InternalMicrotask::AsyncGeneratorResumeNext` → `AsyncGeneratorAwaitReturn`, and `Promise.prototype.finally` contexts now use `JSSlimPromiseReaction` instead of `JSPromiseCombinatorsGlobalContext`. - Cross-compile fixes: `mig` lookup falls back to `find_program` when `WebKitXcodeSDK.cmake` isn't included (Linux-hosted macOS build); the new `InlineCacheHandler::offsetOfUid() == 40` layout-drift `static_assert` is skipped on Windows, where the MSVC ABI ignores `[[no_unique_address]]` and the offset is 48. ## Verification - Full debug build against local WebKit; smoke-tested async generator `return`/`throw`, AsyncLocalStorage across `await`/`.finally()`/`for await`, `Promise.prototype.finally` semantics, sqlite, and `expect.extend`. - Test runs: `AsyncLocalStorage.test.ts`, `async-local-storage-thenable.test.ts`, `AsyncLocalStorage-tracking.test.ts` (74 pass), `ffi.test.js`, napi name tests — all green. # WebKit upgrade: `51cc3feb7298` → `24362e675175` 83 commits touching `Source/JavaScriptCore`, `Source/WTF`, and `Source/bmalloc`. ## Highlights (Bun-relevant) - **`JSType.h` is unchanged in this range** — no JSType additions or reordering, so Bun's JSType-based checks need no updates. - **NativeExecutable gains `name`/`length`, JSFunction `finishCreation` overloads deleted** (`a633a8abfee7`, [316443](https://bugs.webkit.org/show_bug.cgi?id=316443)). NativeExecutable now stores name and length the same way FunctionExecutable does, so `bind` on native functions stops hitting the slow path. Embedder-visible API changes: - `NativeExecutable::create(...)` and both `VM::getHostFunction(...)` overloads take a new `unsigned length` parameter before `name`. - `JSFunction::finishCreation(VM&, NativeExecutable*, unsigned length, const String& name)` (and the ASSERT-only `finishCreation(VM&)`) are deleted, replaced by `DECLARE_DEFAULT_FINISH_CREATION`. Subclasses that called the old overload must pass length/name through `NativeExecutable` instead. - `JSNativeStdFunction::create` / `JSFunctionWithFields::create` no longer take separate length/name arguments where the executable already carries them. New `NativeExecutable::length()` and `nameJSString(VM&)` accessors. - **Async generators rewritten to current spec** (`d096ff9cfae1`, [316447](https://bugs.webkit.org/show_bug.cgi?id=316447)). `InternalMicrotask::AsyncGeneratorResumeNext` is renamed to `AsyncGeneratorAwaitReturn` (enum in `Microtask.h`; corresponding link-time constant removed). The generator state machine replaces `AwaitingReturn` with a new `DrainingQueue` state and adds a `YieldNoAwait` suspend reason (reason bit-field widened from 1 to 2 bits). `%AsyncGeneratorPrototype%.return`/`.throw` move from JS builtins to C++ host functions. Fixes re-entrancy confusion when `Object.prototype.then` is patched. - **Promise internals cleanup** (`7b0aff184802`, [316553](https://bugs.webkit.org/show_bug.cgi?id=316553)). `JSPromiseCombinatorsGlobalContext` is no longer used as a generic cell holder: `Promise.prototype.finally` now stores its context in a `JSSlimPromiseReaction` instead. The combinator context itself now uses a `uint64_t` remaining-elements count. (Builds on `a633a8abfee7`, which already touched the same `finally` host functions.) - **GC / Heap changes**: - `e69c47917811` ([311420](https://bugs.webkit.org/show_bug.cgi?id=311420)): Heap now protects StringImpls swapped out by `JSString::swapToAtomString` while a `GCOwnedDataScope` is on the stack — `m_possiblyAccessedStringsFromConcurrentThreads` becomes a `(JSString*, String)` pair list pruned via conservative-root discovery instead of cleared wholesale. Fixes a dangling-buffer bug. - `c8e53c74403f` ([316635](https://bugs.webkit.org/show_bug.cgi?id=316635)): `Heap::clearConcurrentRetainedDataIfPossible()` no longer runs while concurrent marking is active — fixes a collector-thread use-after-free on racily-loaded StringImpls. - `441e3da20428` ([316713](https://bugs.webkit.org/show_bug.cgi?id=316713)): `deleteUnmarkedCompiledCode` now runs with an unset AtomStringTable in `Heap::runEndPhase`. - `4d73bc11dd6c` ([316385](https://bugs.webkit.org/show_bug.cgi?id=316385)): `FreeList::forEach` interval assert bounded by `MarkedBlock::blockSize`. - **Module loader fixes**: - `5c64352cd6cc` ([316615](https://bugs.webkit.org/show_bug.cgi?id=316615)): `GatherAvailableAncestors` / `AsyncModuleExecutionRejected` in `CyclicModuleRecord` made iterative — no more stack overflow on deep async module graphs (top-level-await chains). - `e46667fac721` ([316610](https://bugs.webkit.org/show_bug.cgi?id=316610)): deferred module namespace objects (`import defer`) no longer leak the synthetic `"then"` into `Object.keys`. - **WTF changes embedders may feel**: - `aae76637c06f` ([316554](https://bugs.webkit.org/show_bug.cgi?id=316554)): `URLParser`/IDNA — ASCII domains can no longer fail IDNA mapping, even when they start with `xn--`. Affects `WTF::URL` host parsing behavior. - `59604007e4c6` ([316511](https://bugs.webkit.org/show_bug.cgi?id=316511)): `clampToInteger<T>` in `MathExtras.h` now correctly clamps values below `INT_MIN`. - `3997b5c96e77` ([316692](https://bugs.webkit.org/show_bug.cgi?id=316692)): revert of an `AutomaticThread` change that introduced a race permanently inflating the active thread count (affected JIT/Wasm worklist threads). - `6667782c52fa` ([316510](https://bugs.webkit.org/show_bug.cgi?id=316510)): missing `return` statements fixed in `LazyRef.h`/`LazyUniqueRef.h`. - Removed files: `wtf/MainThreadData.h`, `wtf/StatisticsManager.{h,cpp}` (dead-code sweeps `012c64ce3ab1`, `5101cdc679ab`); JSC drops `dfg/DFGPropertyTypeKey.h` and the unused `TemporalTimeZone*` classes. - **Codebase-wide C++ modernization** that can affect Bun's C++ bindings compile: `ab23e0e34b7c` ([304023](https://bugs.webkit.org/show_bug.cgi?id=304023)) uses C++20 concepts across JSC (touches `WriteBarrier.h`, `CagedBarrierPtr.h`); `f582e488dbf4` ([316055](https://bugs.webkit.org/show_bug.cgi?id=316055)) replaces C-style arrays with `WTF::toArray()`; `66a98ce83600` ([316364](https://bugs.webkit.org/show_bug.cgi?id=316364)) guards `Platform.h` defines with `!defined()` checks. ## New language / runtime features - **`Temporal.ZonedDateTime` implemented** (`27ac373783f0`, [315939](https://bugs.webkit.org/show_bug.cgi?id=315939)) — ~7.5k lines; the largest change in the range. Follow-ups: carry non-primary time zones (`c39b3d4d67cb`, [316517](https://bugs.webkit.org/show_bug.cgi?id=316517)), spec-aligned option helpers / Duration internals and removal of the obsolete `TemporalTimeZone` classes (`063066dc87c7`, [316370](https://bugs.webkit.org/show_bug.cgi?id=316370)), `destroy` function for `TemporalZonedDateTime` (`1c8ae9884a85`, [316334](https://bugs.webkit.org/show_bug.cgi?id=316334)). - Class-field anonymous function names are now set at parse time instead of via the `SetFunctionName` bytecode (`b6a9b84dae1f`, [316646](https://bugs.webkit.org/show_bug.cgi?id=316646)). - Wasm: `Table` constructor fills funcref tables correctly when the default value is a wrapper function (`7a35a1699bc9`, [316280](https://bugs.webkit.org/show_bug.cgi?id=316280)). ## Performance - New DFG `MultiGetByVal` / `MultiPutByVal` nodes for polymorphic array access (`8f6bc9a16adf`, [315832](https://bugs.webkit.org/show_bug.cgi?id=315832)). - `RegExp.prototype[Symbol.match]` moved from JS builtin to C++ with DFG intrinsic support (`e922a2cecfac`, [316509](https://bugs.webkit.org/show_bug.cgi?id=316509)). - YARR regexp engine: auto-possession optimization (`2a8223d802c8`, [316491](https://bugs.webkit.org/show_bug.cgi?id=316491)), optimized ParenContext save/restore (`eef93d3c2048`, [316555](https://bugs.webkit.org/show_bug.cgi?id=316555)), FixedCount model changed from save-at-END to save-at-BEGIN (`a92d79b27748`, [316275](https://bugs.webkit.org/show_bug.cgi?id=316275)), `ParenthesesSubpatternFixedCount` now supports captures (`3f58e2018a6b`, [316599](https://bugs.webkit.org/show_bug.cgi?id=316599)). - Struct-layout optimizations: Parser and Lexer (`8243c6b69d66`, [316211](https://bugs.webkit.org/show_bug.cgi?id=316211)), InlineCacheHandler (`8cb7e38ecdc8`, [316163](https://bugs.webkit.org/show_bug.cgi?id=316163)); Wasm `FuncRefTable` entry size reduced (`8abf5256fdcb`, [316305](https://bugs.webkit.org/show_bug.cgi?id=316305)). - Promise combinators presize the result array from the iterable's size hint (`c6900eb69893`, [316548](https://bugs.webkit.org/show_bug.cgi?id=316548)); redundant eager `length` definition removed from `JSPromiseConstructor` (`deb8f86fbe49`, [316478](https://bugs.webkit.org/show_bug.cgi?id=316478)). - Temporal: ICU `UCalendar` cached per CalendarID (`7636f6149708`, [316569](https://bugs.webkit.org/show_bug.cgi?id=316569)). ## Fixes **Spec correctness / runtime:** - Map/Set iteration fast paths perform `IteratorClose` when the callback throws (`84a71a9868ed`, [316495](https://bugs.webkit.org/show_bug.cgi?id=316495)). - `String#split` RegExp fast path missed side effects of `ToString(this)` / `ToUint32(limit)` (`b4b15818d650`, [316508](https://bugs.webkit.org/show_bug.cgi?id=316508)). - `isDefinitelyNonThenable` Structure cache could go stale when the prototype belongs to another realm (`8d6b11214830`, [316506](https://bugs.webkit.org/show_bug.cgi?id=316506)) — affects promise resolution fast paths. - "Singleton" invalidation now propagates to the originating SymbolTable (`6da8ead481eb`, [316472](https://bugs.webkit.org/show_bug.cgi?id=316472)). - Fixed opcode assert on `Array.prototype.sort` OSR exit (`e7d51d19e065`, [316296](https://bugs.webkit.org/show_bug.cgi?id=316296)). - YARR: string-list fast path dropped a non-final empty alternative (`e6d0f57f8d04`, [316288](https://bugs.webkit.org/show_bug.cgi?id=316288)); interpreter greedy backtracking now tries up to max count (`5fe4838cb7d1`, [316378](https://bugs.webkit.org/show_bug.cgi?id=316378)). **Wasm:** - Name section parsing made thread-safe (`24362e675175`, [309538](https://bugs.webkit.org/show_bug.cgi?id=309538)). - IPInt `memory.atomic.notify`/`wait` and `memory.grow` mishandled dirty upper bits of i32 operands (`a0d2eebf9e13`, [316507](https://bugs.webkit.org/show_bug.cgi?id=316507)). - OMG tail-call patchpoint clobbers late pinned registers (`c18d1e3571f4`, [316227](https://bugs.webkit.org/show_bug.cgi?id=316227)). **Temporal / Intl hardening** (mostly crash and OOB fixes in the new Temporal code): - OOB read in `ISO8601::parseDate` on short invalid strings (`d58bad697e50`, [316366](https://bugs.webkit.org/show_bug.cgi?id=316366)); crash in `PlainMonthDay.from` with very large strings (`221dcc89aba8`, [316805](https://bugs.webkit.org/show_bug.cgi?id=316805)); double-throw crash in Temporal constructors (`19e18af9f088`, [316793](https://bugs.webkit.org/show_bug.cgi?id=316793)); `PlainDate` add/subtract day-range assertion (`2c290815d421`, [316368](https://bugs.webkit.org/show_bug.cgi?id=316368)). - Stricter ICU error handling (`178eab311235`, [316346](https://bugs.webkit.org/show_bug.cgi?id=316346)); `toIntegerWithTruncation` for Temporal conversions (`66267990831b`, [316369](https://bugs.webkit.org/show_bug.cgi?id=316369)); Japanese era fast-path validation (`31e50e893a11`, [316477](https://bugs.webkit.org/show_bug.cgi?id=316477)); date-spec invariants (`544a3bff9b31`, [316440](https://bugs.webkit.org/show_bug.cgi?id=316440)). - `Intl.DateTimeFormat` with Temporal types: era width preserved (`9cd3289437d5`, [316048](https://bugs.webkit.org/show_bug.cgi?id=316048)); calendar passed to ICU in BCP47 form (`45b638378595`, [315984](https://bugs.webkit.org/show_bug.cgi?id=315984)). **Build / misc:** - Non-unified and unified build fixes (`ee637a607df2`, [316381](https://bugs.webkit.org/show_bug.cgi?id=316381); `6c8b20e9f7b2`, [316374](https://bugs.webkit.org/show_bug.cgi?id=316374)); PlayStation SIMDUTF AVX-512 build fix (`08e30f68509b`, [316649](https://bugs.webkit.org/show_bug.cgi?id=316649)). - Build-parallelism work landed, was reverted, and re-landed (`c9e9995641cc` → `653a36adb39a` → `09f89f078e7d`, [316232](https://bugs.webkit.org/show_bug.cgi?id=316232)); assorted CMake configuration changes (Apple SDK/ICU handling, configure-time probe skipping). - Dead-code removal sweeps (`012c64ce3ab1`, [316520](https://bugs.webkit.org/show_bug.cgi?id=316520); `5101cdc679ab`, [316502](https://bugs.webkit.org/show_bug.cgi?id=316502)); libpas test harness changes (`e7665a906ab0`, [316595](https://bugs.webkit.org/show_bug.cgi?id=316595); `1a8a72a5bc1a`, [316457](https://bugs.webkit.org/show_bug.cgi?id=316457)). - Remaining commits in the range are Web Inspector / Site Isolation protocol work, CSS `calc-mix()`, MediaSession, and visionOS test changes that only incidentally touch generated inspector code under `Source/JavaScriptCore/inspector`.
Move WEBKIT_VERSION off the per-PR preview build onto the latest released autobuild, which includes the YarrJIT variable-count parentheses fix.
| // importing), and the Windows ICU data table filtered + per-item zstd | ||
| // compressed (lazily decompressed via bun_icu_decompress.cpp). | ||
| export const WEBKIT_VERSION = "6d586e293f008f0e74e5697611a379b1b24815c9"; | ||
| export const WEBKIT_VERSION = "autobuild-9cb85a0716065c461bea14a0de9fe7139e5323aa"; |
Member
There was a problem hiding this comment.
this can point at main now?
This was referenced Jun 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
oven-sh/WebKit#248 is merged and
WEBKIT_VERSIONnow points at the releaseautobuild-5851d4722e461bae1eb5537b091f4103e192a94a. Ready to merge once CI is green.Bun-side changes
src/jsc/JSType.rs: addedSentineland shifted all object JSType values by +1 (upstream addedSentinelTypebeforeObjectType)JSGlobalObject*argument fromJSPromise::reject/fulfill/rejectAsHandled/rejectWithCaughtExceptioncall sites (upstream cross-realm fix changed the signatures)bindings.cpp:OrderedHashTableHelper.h→JSOrderedHashTableHelper.h(upstream header rename)WebKit upgrade:
39d4ce1f12ea→51cc3feb7298155 commits touching
Source/JavaScriptCore,Source/WTF, andSource/bmalloc.Highlights (Bun-relevant)
JSType.hchanged —src/jsc/JSType.rsmust be updated. "[JSC] Add foundation of handling builtin iterators in fast-iteration-protocol" (3d1bebd7930d, 315933) addsSentinelTypeimmediately beforeObjectType, shifting the numeric value ofObjectTypeand every JSType after it by one.51cc3feb7298, 316187):rejectPromise,fulfillPromise,performPromiseThenWithInternalMicrotask,reject,fulfill, andrejectWithCaughtExceptionno longer take aJSGlobalObject*— promise jobs are now queued on the promise's own realm viaJSPromise::realm(). Any embedder code calling these APIs needs theglobalObjectargument dropped.OrderedHashTable.h→JSOrderedHashTable.h(andOrderedHashTableHelper.h→JSOrderedHashTableHelper.h), "Unreviewed, just making JSC::OrderedHashTable => JSC::JSOrderedHashTable" (54982d6c532d, 315420).queueMicrotaskfast/slow path split. "[JSC] Fold microtask queueing slow path condition to m_canFastQueueMicrotask" (e88edb51fd50, 315743) introducesJSGlobalObject::queueMicrotaskSlow; the fast path checks a singlem_canFastQueueMicrotaskflag.69ec4dddc261, 315603) —createUndefinedVariableErrornow usestryMakeString(interacts with Bun's custom "X is not defined" message).ModuleRegistryEntryerror fields merged (198caec02193, 315001) — touches the module registry that Bun's synchronous module loading builds on.New language / runtime features
Intl.DateTimeFormatTemporal support andtoLocaleString(5745eb4c8ff1, 315637);Temporal.Calendarobject removed, JS layer updated to Stage 4 spec (b35d67a6fdad, 315608);TemporalTimeZonemade destructible (4f41ed450183); third-party license files fortemporal_rs/icu4x(3555ec26edc7).Iterator.prototype.includesthrows RangeError whenskippedElements > Number.MAX_SAFE_INTEGER(40a1acb199d9, 315920).Performance
3d1bebd7930d), String fast iteration (4a781308731b, 315330), Map/Set iterators handled in DFG (300fd8c35ee7, 316074), iterator storage set at creation in DFG/FTL (0206365a0d08).String#matchAll(31e38187aad2) andString#search(c800622bab89) moved to C++.ArrayJoin(26b192b1d624),String.fromCodePoint(93a4fbeda183),NewWeakMap/NewWeakSet(d61d43e680e1) with inline cell allocation (8317f5c80ed4).JSBigIntfor inc/dec (9923753ca3b3) and small-size calculations (c60baa450f96).gcSafeMemcpyfast path for cloning large Maps/Sets (253bd0c20582);JSOrderedHashTableover-allocation fix (f72ea56abf5c); Set prototype cleanup viaforEachInSetStorage(6d826ae9d949).Intl.DurationFormat(7e34b0157828); language-tag canonicalization cache inIntlCache(99cab5c03916); root-locale fast path fortoLocaleLowerCase/toLocaleUpperCase(e14189a28e4c).e8eb62b22193);WTF::reverseFindDoubleforArray#lastIndexOf(9a9fa471589e).1b422914d55f, 172456).ownPropertyKeysreturns CoW arrays in the common case (a5760beba07c).6646c49f2a7b, 307145); shared lead-surrogate optimization (6eff2e74e048).NewTypedArrayWithSizezero-fills 8 bytes at a time (dcc2aea406e0).Correctness / security fixes
51cc3feb7298, see Highlights).95d80761e676, 316180);putRange()missing Unicode canonical equivalents U+017F/U+212A (faf717c136d1); named group omitted fromindices.groupson backtrack (e1cdfab158f3, 312688).GetByStatus::computeFormust not constant-fold prototype loads on dictionary structures (73689f543082); dictionary structures rejected intryEnsureAbsence(177d2cad35bf,78c04ea7a1bc); object allocation sinkingPutByValfix (cdfa73fdc391);StringAtCSE arrayMode fix (1f4e4caab01b); no bytecode advance when reifying inline frames at a checkpoint (4e802a14cac6).Array.prototype.joinskipping prototype elements added duringtoString(f181acea4464); rematerialization preserving double-array holes when "having a bad time" (a82eb9dd7fab,eba64ef44de3);ClonedArguments::copyToArgumentsloop condition with non-zero offset (5099a4a8958e); ArrayToPrimitivefast path ignoringvalueOfoverride (8a7e39c2bf81).matchAllfast path must not skipSpeciesConstructorwhen the species watchpoint is invalidated (66b61320dbd7); missing exception inreplaceAllWithCacheUsingRegExpSearchThreeArguments(18a2c9a10033).IteratorCloseon callback throw (87547f94b76e); missing exception check in Set fast path (b67282ad890b).TypeErrorfrom the current realm per spec (26cc47d853a8).3825a1a93bbf).WaiterListManager::unregisterdata race (21ab50e40f06);JSLock m_hasOwnerThreadconcurrency issue (aed1fddc0be2);RegExp::byteCodeCompileIfNecessarymade threadsafe (dcf25ed3c992).Table.growwith default value (36a3e59badd1); missing exception check after rope resolution (57df341619ed);WebAssemblyCompileOptions::tryCreateOOM throw (d8b63073f0c5);Wasm::InstanceAnchorunregistration order (76b34686210f).AirFixObviousSpillsearly-def modeling (fa0214fe9a50); dominance analysis inB3CanonicalizePrePostIncrements(81aa535db3c9).OpDelBy{Id,Val}(1cdc540e6ebe).GC / memory
ScratchBuffers are now scanned (87b4375777a3, 309599).e638840dd2cd).CacheLookupKey(32f1bfb84129).cffeaa6ccbf4).ba26b5242151);pas_enumerator_createvalidity check (ed57dc0915ee).b9019a00056e).WTF / build
WTF::VariantGCC 15 build fix (3917eb489bf7);std::to_array()→WTF::toArray()(f1df550f3723).8916f524a78a), @cost weighting (9816b1440ae4), prefix-header tuning (9238babac42c) — source of many#include-style churn conflicts.17e27ee7cfd3) then was reverted (8ed5bbe28206); JS builtins fornext()restored (0047d9699435).QOS_UTILITYon less powerful devices (371f7ad0ed89).