Rewrite the JSON parser around a SIMD structural index

bench/json-corpus/.gitignore

@@ -0,0 +1 @@
+*.json

bench/json-corpus/fetch.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Fetch the JSON benchmark fixture corpus: real package.json files and real
+# npm registry API responses (both abbreviated install-v1 manifests, which is
+# what `bun install` fetches, and full packuments).
+set -euo pipefail
+cd "$(dirname "$0")"
+
+ACCEPT_ABBREV='Accept: application/vnd.npm.install-v1+json'
+
+# package.json files (pretty-printed, human-authored shape)
+pkg() { curl -fsSL "https://unpkg.com/$1@$2/package.json" -o "pkgjson-$1.json"; echo "pkgjson-$1.json"; }
+pkg express 4.19.2
+pkg react 18.3.1
+pkg typescript 5.5.4
+pkg webpack 5.93.0
+pkg eslint 9.8.0
+pkg axios 1.7.3
+pkg next 14.2.5
+pkg vite 5.3.5
+
+# Abbreviated registry manifests (what `bun install` actually parses, minified)
+abbrev() { curl -fsSL -H "$ACCEPT_ABBREV" "https://registry.npmjs.org/$1" -o "manifest-abbrev-$2.json"; echo "manifest-abbrev-$2.json"; }
+abbrev is-number is-number
+abbrev express express
+abbrev react react
+abbrev lodash lodash
+abbrev typescript typescript
+abbrev next next
+abbrev @types/node types-node
+abbrev @babel/core babel-core
+
+# Full packuments (largest realistic payloads; `bun audit` / `bun pm view` shape)
+full() { curl -fsSL "https://registry.npmjs.org/$1" -o "packument-full-$2.json"; echo "packument-full-$2.json"; }
+full express express
+full axios axios
+
+ls -la
+
+# huge real-world manifests bun install parses constantly
+abbrev drizzle-orm drizzle-orm
+abbrev drizzle-kit drizzle-kit

bench/json-corpus/jsonc-parse.mjs

@@ -0,0 +1,55 @@
+// End-to-end benchmark of Bun's JSON parser through its JS-visible entry
+// point, `Bun.JSONC.parse` (src/parsers/json.rs -> Expr -> JSValue), over the
+// corpus in this directory, with `JSON.parse` (JavaScriptCore) as a reference.
+//
+//   bun bench/json-corpus/jsonc-parse.mjs            # all fixtures
+//   bun bench/json-corpus/jsonc-parse.mjs drizzle    # filter by name
+//
+// `Bun.JSONC.parse` does strictly more work than `JSON.parse` here: it parses
+// to Bun's AST and then converts that AST to JS values, so it measures the
+// whole pipeline a `.json`/`.jsonc`/tsconfig import or `bun pm` command sees.
+import { readdirSync, readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+
+const dir = dirname(Bun.fileURLToPath(import.meta.url));
+const filter = process.argv[2] ?? "";
+const files = readdirSync(dir)
+  .filter(f => f.endsWith(".json") && f.includes(filter))
+  .sort();
+
+const runs = +(process.env.RUNS ?? 30);
+function bench(label, fn) {
+  fn(); // warmup
+  fn();
+  const times = [];
+  for (let i = 0; i < runs; i++) {
+    const t0 = Bun.nanoseconds();
+    fn();
+    times.push(Bun.nanoseconds() - t0);
+  }
+  times.sort((a, b) => a - b);
+  return { label, best: times[0], median: times[(times.length / 2) | 0] };
+}
+
+console.log("bun", Bun.version, Bun.revision.slice(0, 9));
+console.log(
+  "file".padEnd(40),
+  "bytes".padStart(10),
+  "JSONC med".padStart(12),
+  "JSON.parse".padStart(12),
+  "JSONC MB/s".padStart(11),
+);
+for (const f of files) {
+  const text = readFileSync(join(dir, f), "utf8");
+  const bytes = Buffer.byteLength(text);
+  const jsonc = bench("jsonc", () => Bun.JSONC.parse(text));
+  const jsonp = bench("json", () => JSON.parse(text));
+  const mbs = bytes / (jsonc.median / 1e3) / 1.048576; // MiB/s
+  console.log(
+    f.padEnd(40),
+    String(bytes).padStart(10),
+    (jsonc.median / 1e6).toFixed(3).padStart(9) + " ms",
+    (jsonp.median / 1e6).toFixed(3).padStart(9) + " ms",
+    mbs.toFixed(0).padStart(11),
+  );
+}

scripts/bench-json-rust.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Build + run the JSON parser criterion bench (src/parsers/benches/json_parse.rs).
+#
+# A cargo bench binary links the bun Rust crates but not the CMake-built C++
+# side, so this script compiles the few native pieces the parser actually
+# reaches — mimalloc, simdutf (+ Bun's simdutf__* wrapper), the highway
+# runtime, and the highway JSON structural-index kernel — from the repo's own
+# vendored sources into one small archive, then points RUSTFLAGS at it.
+# Everything else (StackCheck bound, OOM handler, the one legacy lexer highway
+# call) is shimmed inside the bench file itself.
+#
+# Requires `vendor/` and `build/debug/codegen` to exist (run `bun bd` once).
+#
+#   scripts/bench-json-rust.sh                 # whole corpus
+#   scripts/bench-json-rust.sh -- 'drizzle'    # criterion filter
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+if [ ! -d vendor/mimalloc ] || [ ! -d vendor/highway ]; then
+  echo "error: vendor/ not populated — run \`bun bd\` (or \`bun run build\`) once first" >&2
+  exit 1
+fi
+
+SUP=target/bench-json-cdeps
+mkdir -p "$SUP/wtf"
+CC=${CC:-cc}
+CXX=${CXX:-c++}
+# Pinned simdutf amalgamation for Bun's simdutf__* C wrapper (the real build
+# gets simdutf from WebKit's WTF; the version difference is irrelevant here).
+SIMDUTF_VERSION=v7.3.6
+if [ ! -f "$SUP/simdutf.cpp" ]; then
+  curl -fsSL -o "$SUP/simdutf.cpp" "https://github.com/simdutf/simdutf/releases/download/$SIMDUTF_VERSION/simdutf.cpp"
+  curl -fsSL -o "$SUP/simdutf.h" "https://github.com/simdutf/simdutf/releases/download/$SIMDUTF_VERSION/simdutf.h"
+fi
+printf '#pragma once\n#include "simdutf.h"\n' > "$SUP/wtf/SIMDUTF.h"
+
+build() { # build <out.o> <cmd...>
+  local out=$1
+  shift
+  if [ ! -f "$out" ] || [ "$1" = "-f" ]; then "$@" -o "$out"; fi
+}
+MI_FLAGS=(-O2 -fPIC -ftls-model=initial-exec -DNDEBUG -D_GNU_SOURCE -DMI_STATIC_LIB
+  -DMI_SKIP_COLLECT_ON_EXIT=1 -DMI_DEFAULT_ALLOW_THP=0 -DMI_NO_SET_VMA_NAME=1)
+build "$SUP/mimalloc.o" $CC "${MI_FLAGS[@]}" -Ivendor/mimalloc/include -c vendor/mimalloc/src/static.c
+build "$SUP/simdutf.o" $CXX -O3 -fPIC -std=c++20 -I"$SUP" -c "$SUP/simdutf.cpp"
+build "$SUP/simdutf_shim.o" $CXX -O3 -fPIC -std=c++20 -I"$SUP" -c src/parsers/benches/support/simdutf_shim.cpp
+for f in abort targets per_target print timer nanobenchmark aligned_allocator; do
+  build "$SUP/hwy_$f.o" $CXX -O3 -fPIC -std=c++17 -Ivendor/highway -c "vendor/highway/hwy/$f.cc"
+done
+if [ -f src/jsc/bindings/highway_json.cpp ]; then
+  # Always rebuild the kernel under iteration; it's one small TU.
+  $CXX -O3 -fPIC -std=c++17 -Ivendor/highway -Isrc/jsc/bindings -c src/jsc/bindings/highway_json.cpp -o "$SUP/highway_json.o"
+fi
+rm -f "$SUP/libbun_bench_cdeps.a"
+ar rcs "$SUP/libbun_bench_cdeps.a" "$SUP"/*.o
+ranlib "$SUP/libbun_bench_cdeps.a"
+
+# A criterion iteration is much slower than a real `bun install` manifest
+# parse, so mimalloc's default 10ms purge delay returns the arena pages to
+# the OS between iterations and the bench turns into a page-fault storm bun
+# never sees in production. Keep pages resident like a busy install process.
+export MIMALLOC_PURGE_DELAY=${MIMALLOC_PURGE_DELAY:-2000}
+export BUN_CODEGEN_DIR=${BUN_CODEGEN_DIR:-$PWD/build/debug/codegen}
+export BUN_JSON_BENCH_FIXTURES=${BUN_JSON_BENCH_FIXTURES:-$PWD/bench/json-corpus}
+export RUSTFLAGS="${RUSTFLAGS:-} -Clink-arg=$PWD/$SUP/libbun_bench_cdeps.a -Clink-arg=-lstdc++ -Clink-arg=-lm -Clink-arg=-ldl -Clink-arg=-lpthread -Clink-arg=-lc"
+
+# `--test`: run the crate's unit tests (they need the same native archive).
+if [ "${1:-}" = "--test" ]; then
+  shift
+  exec cargo test -p bun_parsers --lib --release "$@"
+fi
+exec cargo bench -p bun_parsers --bench json_parse "$@"

scripts/build/bun.ts

@@ -299,6 +299,14 @@ export function emitBun(n: Ninja, cfg: Config, sources: Sources): BunOutput {
   // force-include would lock those in before the source can speak.
   const noPchSources = new Set<string>();
 
+  // highway_json.cpp is compiled -O2 even in debug profiles (see its
+  // fileOverrides entry in flags.ts); a TU at a different -O level than the
+  // PCH cannot use the PCH ("__OPTIMIZE__ ... was disabled in precompiled
+  // file"). It only includes highway + libc headers anyway.
+  if (cfg.debug) {
+    noPchSources.add(resolve(cfg.cwd, "src/jsc/bindings/highway_json.cpp"));
+  }
+
   // Windows-only cpp sources (rescle — PE resource editor for --compile).
   if (cfg.windows) {
     // rescle.h does `#define UNICODE` before including ATL; with PCH the

scripts/build/flags.ts

@@ -1536,6 +1536,17 @@ export const fileOverrides: FileOverride[] = [
     when: c => c.windows,
     desc: "Vendored electron/rcedit; VersionInfo ctor throws std::system_error caught in OnEnumResourceLanguage. Self-contained throw/catch — already excluded from PCH",
   },
+  {
+    file: "src/jsc/bindings/highway_json.cpp",
+    extraFlags: ["-O2"],
+    when: c => c.debug,
+    desc:
+      "Always optimize the JSON structural-index kernel (debug builds use -O0 globally). At -O0 every " +
+      "highway op is an outlined call taking 64-byte vectors by value through the stack, and clang's " +
+      "unoptimized codegen for that pattern raises #GP on an aligned zmm stack store under the debug " +
+      "sanitizer set; it would also make every JSON parse in debug builds pathologically slow. " +
+      "Covered by test/js/bun/jsonc/jsonc.test.ts and `scripts/bench-json-rust.sh --test`.",
+  },
 ];
 
 // ═══════════════════════════════════════════════════════════════════════════

scripts/build/unified.ts

@@ -134,6 +134,9 @@ const noUnify: readonly string[] = [
   "src/jsc/bindings/xxhash3.cpp",
   // Fourth highway TU — same foreach_target.h include-guard reason.
   "src/jsc/bindings/highway_sourcemap.cpp",
+  // Fifth highway TU (JSON structural indexer) — same foreach_target.h
+  // include-guard reason.
+  "src/jsc/bindings/highway_json.cpp",
   // Declares its own minimal CGRect/kCFStringEncodingUTF8/kCFNumberDoubleType
   // so it doesn't pull a CoreGraphics load command; bundled with files that
   // include the real CF headers those names become ambiguous.

src/highway/lib.rs

@@ -87,6 +87,24 @@
     ) -> usize;
 
     fn highway_count_mapping_delims(bytes: *const u8, len: usize) -> usize;
+
+    fn highway_json_index(
+        input: *const u8,
+        len: usize,
+        out_indices: *mut u32,
+        out_dirty: *mut u64,
+        out_flags: *mut u32,
+    ) -> usize;
+
+    fn highway_json_index_chunk(
+        input: *const u8,
+        len: usize,
+        base_offset: usize,
+        out_indices: *mut u32,
+        out_dirty: *mut u64,
+        inout_state: *mut u64,
+        out_flags: *mut u32,
+    ) -> usize;
 }
 
 // NOTE: every public wrapper below is `#[inline(always)]`. They are thin
@@ -589,6 +607,89 @@
     unsafe { highway_count_mapping_delims(bytes.as_ptr(), bytes.len()) }
 }
 
+/// JSON structural index (simdjson-style stage 1) — see
+/// `src/jsc/bindings/highway_json.cpp` for the kernel and
+/// `bun_parsers::json_index` for the consumer and the output contract.
+///
+/// The output buffers are intentionally `MaybeUninit`: an index buffer is
+/// `input.len() + 66` entries (hundreds of MB for the largest npm manifests)
+/// and zero-filling it would cost more than the whole parse. The kernel
+/// initializes exactly the prefix it reports.
+///
+/// Requirements (asserted): `out.len() >= input.len() + 66` (CompressStore may
+/// overshoot by a vector, and two sentinels are appended) and
+/// `dirty.len() >= ceil(ceil(input.len()/64)/64)`.
+///
+/// Returns `(n, flags)`. When `flags & ODDITY == 0`:
+///   - `out[..n + 2]` is initialized: the `n` structural indices in document
+///     order plus two `input.len()` sentinels
+///   - `dirty[..ceil(ceil(input.len()/64)/64)]` is initialized: one bit per
+///     64-byte input block ("contains a backslash or control char inside a
+///     string")
+#[inline(always)]
+pub fn json_structural_index(
+    input: &[u8],
+    out: &mut [core::mem::MaybeUninit<u32>],
+    dirty: &mut [core::mem::MaybeUninit<u64>],
+) -> (usize, u32) {
+    assert!(out.len() >= input.len() + 66);
+    assert!(dirty.len() >= (input.len().div_ceil(64)).div_ceil(64));
+    let mut flags: u32 = 0;
+    // SAFETY: pointers/lengths come from live slices whose sizes satisfy the
+    // kernel's documented requirements (asserted above); the kernel writes
+    // only within them (at most `input.len() + 66` index entries and
+    // `ceil(nblocks/64)` dirty words) and `out_flags` is a valid out-pointer.
+    // `MaybeUninit<T>` has the same layout as `T`.
+    let n = unsafe {
+        highway_json_index(
+            input.as_ptr(),
+            input.len(),
+            out.as_mut_ptr().cast::<u32>(),
+            dirty.as_mut_ptr().cast::<u64>(),
+            &mut flags,
+        )
+    };
+    (n, flags)
+}
+
+/// Resumable form of [`json_structural_index`] for one chunk of a larger
+/// document, so the caller never needs a worst-case whole-document output
+/// buffer (4 bytes per input byte). `chunk` must start at `base_offset` in
+/// the document; every chunk's length except the last must be a multiple of
+/// 4096 (so 64-block dirty words never straddle calls); `state` carries the
+/// kernel's escape / in-string / scalar-run state and must be zeroed before
+/// the first chunk.
+///
+/// On return `out[..n]` is initialized with absolute indices (no sentinels)
+/// and `dirty[..ceil(ceil(chunk.len()/64)/64)]` with this chunk's blocks.
+#[inline(always)]
+pub fn json_structural_index_chunk(
+    chunk: &[u8],
+    base_offset: usize,
+    out: &mut [core::mem::MaybeUninit<u32>],
+    dirty: &mut [core::mem::MaybeUninit<u64>],
+    state: &mut [u64; 3],
+) -> (usize, u32) {
+    assert!(out.len() >= chunk.len() + 66);
+    assert!(dirty.len() >= (chunk.len().div_ceil(64)).div_ceil(64));
+    assert!(base_offset % 4096 == 0);
+    let mut flags: u32 = 0;
+    // SAFETY: same contract as `json_structural_index`, per chunk; `state`
+    // is a valid 3-element buffer the kernel reads and writes.
+    let n = unsafe {
+        highway_json_index_chunk(
+            chunk.as_ptr(),
+            chunk.len(),
+            base_offset,
+            out.as_mut_ptr().cast::<u32>(),
+            dirty.as_mut_ptr().cast::<u64>(),
+            state.as_mut_ptr(),
+            &mut flags,
+        )
+    };
+    (n, flags)
+}
+
 /// Raw output column pointers for [`parse_mappings`]. Each points to `cap`
 /// writable rows: `generated`/`original` as `[line, column]` i32 pairs
 /// (byte-compatible with `bun_sourcemap::LineColumnOffset`, which is

src/install/PackageInstall.rs

@@ -994,10 +994,9 @@ impl<'a> PackageInstall<'a> {
         if package_json_checker.parse_expr().is_err() {
             return false;
         }
-        // Reshaped for borrowck — `log` is exclusively borrowed by the
-        // checker's lexer; route the read through `lexer.log_mut()` (single
-        // provenance chain, see PackageJSONVersionChecker doc).
-        if package_json_checker.lexer.log_mut().errors > 0 || !package_json_checker.has_found_name {
+        // `log` is exclusively borrowed by the checker; read the error count
+        // through it.
+        if package_json_checker.has_errors() || !package_json_checker.has_found_name {
             return false;
         }
         // workspaces aren't required to have a version

src/install/npm.rs

@@ -1964,7 +1964,10 @@ impl PackageManifest {
         // bulk-frees via `reset_retain_with_limit` on the next call — see
         // `initialize_mini_store` in lib.rs for why.
         let bump = bun_alloc::Arena::new();
-        let json = match JSON::parse_utf8(&source, log, &bump) {
+        // Registry manifests get no duplicate-key warnings: nothing ever
+        // reads them for this log, and they cost a measurable fraction of
+        // every manifest parse.
+        let json = match JSON::parse_utf8_registry(&source, log, &bump) {
             Ok(j) => j,
             Err(_) => {
                 // don't use the arena memory!