Upgrade WebKit to 3722912ff800

[robobun]

Upgrades the WebKit fork to upstream WebKit/WebKit@3722912ff800 (2026-08-02) via oven-sh/WebKit#383.

oven-sh/WebKit#383 is merged; WEBKIT_VERSION points at the merge commit e6e37cda216c0292ae68c30c84a9dc8601d0fba5.

Bun-side changes

Upstream 90b2ecf79ae3 keys m_loadedModules on (specifier, ScriptFetchParameters::Type) and threads the type through ImportEntry, ExportEntry, StarExportEntry, and ModuleAnalyzer::appendRequestedModule. Under bun test --isolate (the BunTranspiledModule path), Bun'''s synthesized record must agree with what JSC'''s own ModuleAnalyzer would produce from the printed source; a mismatch fails the BUN_DEBUG record diff in debug and null-derefs hostResolveImportedModule in release.

• analyze_transpiled_module / js_printer: every RecordKind now carries one trailing FetchParameters slot. add_import_info_* and add_export_info_* accept it; finalize() propagates the source import'''s slot through the Local->Indirect conversion. RequestedModules dedupes on (specifier, Type, phase).
• analyze_jsc.rs: decodes the trailing slot to the JSC Type enum and passes it to every addImportEntry* / addIndirectExport / addNamespaceExport / addStarExport; buffer validation is per-slot so only the trailing slot accepts the wider FetchParameters sentinel range.
• BunAnalyzeTranspiledModule.cpp: all seven addImportEntry* / add*Export functions take uint8_t moduleRequestType and set .moduleRequestType explicitly; dumpRecordInfo() prints type(N) for import/export/star entries; static_assert pins the ordinal values to_script_fetch_parameters_type() hardcodes.
• RuntimeTranspilerCache EXPECTED_VERSION -> 25 (esm_record layout change).

WebKit-side changes (oven-sh/WebKit#383)

• 17 merge conflicts resolved in JSC/WTF; fork's USE(BUN_JSC_ADDITIONS) hunks preserved.
• Fork ffi/ code adapted to upstream's 32-bit removal (USE_JSVALUE64 macro deleted, is64Bit() removed, payloadFor -> lowWordFor).
• InspectorDebuggerAgent.cpp: handle BunTranspiledModule/Synthetic in new scriptTypeForScript switch.
• Recorded 01aaa3e0be0c as ancestor via -s ours (Upgrade to upstream WebKit 01aaa3e0be0c WebKit#352 was a squash merge).

How did you verify your code works?

• bun run jsc:build:debug builds and the jsc shell runs (-e 'print(42)' -> 42).
• bun run build:local -p '42' links and runs against the local merged WebKit.
• Upgrade to upstream WebKit 3722912ff800 WebKit#383 preview build green on all 38 platform variants.
• bun bd -p 'process.versions.webkit' -> preview-pr-383-b9ea4dc5.
• New test test/js/bun/jsc/webkit-upgrade-3722912f.test.ts: 4/4 pass with bun bd test, 3/4 fail with USE_SYSTEM_BUN=1 bun test (old JSC lacks Iterator.prototype.includes, returns "" for cyclic join, WebAssembly.Exception.length === 1).

JavaScriptCore/WTF/bmalloc changes since 01aaa3e0be0c (Jul 25)

Upstream range: WebKit/WebKit@01aaa3e0be0c...3722912ff800 (474 commits total, 110 touching JSC/WTF/bmalloc, Jul 25 → Aug 2 2026).

Highlights

• 29ceb3c03de3 Remove 32-bit JSValues (JSVALUE32_64 and CPU(NEEDS_ALIGNED_ACCESS) deleted).
• 857bd4334690 Remove ARMv7 JIT support (ARMv7 is CLoop-only now; drops remaining 32-bit/x86 JIT refs).
• 232cebabc1f3 Remove big-endian support and platforms without unaligned loads/stores (WTF + JSC).
• 6eaa5ac1f65d Remove 32-bit libpas support.
• bfb1b1183bc2 Remove the B3/Air graph-coloring register allocator (greedy is the only allocator now).
• 0d0080ea539d Enable WebAssembly Memory64 by default (+ Table64/SIMD follow-ups).
• f2f2c2ddf637 Remove StringRecursionChecker; cyclic toString/join now throws RangeError via stack check (spec-correct).
• 319f94b3db4a Enable Iterator.prototype.includes() by default.
• 90b2ecf79ae3 hostResolveImportedModule now honors import-attribute type (module loader behavior change).
• f5716f6401ed Add preserve_most calling convention to fastMalloc APIs on ARM64 (perf + ABI of WTF alloc entry points).

JavaScriptCore

Runtime / builtins

• f2f2c2ddf637 Remove StringRecursionChecker; rely on stack-overflow checks.
• cd91e7f128dd Add fast flag for ToPrimitive(Object) calls in runtime.
• 173a0bd6d937 Use defaultToPrimitiveFastAndNonObservable in JSObject::toString.
• 960adeccefcd Fast operation for Array#shift.
• 92c6650c7947 Add JSArrayIterator::next C++ helper.
• cb1c48b3e95f Extend Array.from() Set fast path to set.keys()/.values().
• 4a2e724d6789 Fix: Array.from(set.keys()/.values()) fast path ignored Symbol.iterator overrides.
• 73e4c589c1e6 Extend StringSplitCache to RegExp separators.
• 656d3c36830f / 1d355c27ea88 8-byte SWAR fast paths in JSON.stringify string copy (same-type & upconvert).
• 9f9370cc729f Fix JSON.stringify regression around toJSON check.
• 2eb77e9c9473 BigInt: implement Crandall reduction.
• 39b1bb9cfc85 BigInt: deploy Comba multiplication more broadly.
• 319f94b3db4a Enable Iterator.prototype.includes().
• 0731b27c1b60 Iterator.zip: use null-prototype objects for options/underlying iterator.
• 90b2ecf79ae3 hostResolveImportedModule respects module request import-attribute type.
• 4f54300b848a Collect diagnostics when getDirect returns zero JSValue in llint_slow_path_get_by_id.

Parser / bytecompiler

• c2beca7a439f Lexer: scan integer tokens in a single pass.
• 72ea806faa21 Use overflow-safe range when choosing a switch jump table.

LLInt / DFG / FTL / B3

• 29ceb3c03de3 Remove 32-bit JSValues.
• 857bd4334690 Remove ARMv7 JIT support.
• bfb1b1183bc2 Remove B3/Air graph-coloring register allocator.
• 68cde6ba2ad3 Make IRO (Air register allocation) faster.
• 83540481435f DFG: allocate BasicBlock::intersectionOfPastValuesAtHead only for OSR-entry targets.
• 1566615170ec DFG fix: EnumeratorNextUpdateIndexAndMode must require original array structure for InBoundsSaneChain.
• e759fa9dd063 LLInt: inline hot path of op_enter.
• 9610c2113b45 offlineasm: emit ARM64 register-offset addressing for BaseIndex operands.
• 4ebed2479144 Speed up addSortedRange via binary search.
• 1c006b0b0f62 Fix regex setLastIndex on 32-bit.

WebAssembly

• 0d0080ea539d Enable Memory64 feature flag.
• 15aa6fad53e3 Memory64: SIMD support.
• bf0425598904 Memory64: expand declared memory limits.
• 862994e2cc37 Memory64: validate table import address-type match.
• 184ee4c654bd Memory64: Table64 in OMG tier.
• d202bedc5ff6 Memory64: Table64 in BBQ tier.
• bf6512f84f7d Support WebAssembly.Exception options.traceStack (+ stack getter, ctor length = 2).
• 24527bbb9ac8 Optimize Wasm JITCallee publication (lock splitting, icache barrier rework).
• 1803d6109d98 Speed up WebAssembly.Table construction.
• d434a41411a3 BBQ: optimize br_table for consecutive same-target runs.
• 51d3dbaa278e IPInt: add DEFINE_IPINT_THUNK_FOR_ENTRY.
• 244cd98f7986 Fix generateWasmOpsHeader.py under non-UTF-8 locales.

Yarr / RegExp

• 581f1d958329 Start end-anchored fixed-size regexps at the only possible position.
• a458a6c1f0a7 v-mode class-set op loop: stop early when no more output possible.
• 7c5dbbcba110 Extend ParenthesesSubpatternTerminal.
• e1def8f4e5fd Don't save sibling/ancestor-sibling frame slots for ParenContext.
• 1e43057f135a Extend first-character filter further.
• 54916608d7d6 Fix non-BMP advance latch; simplify tryReadUnicodeCharImpl.
• 46a4b17efbe9 optimizeBOL: don't filter contents of negative lookaheads.
• b128ddd863ab Fix dot-star-wrapped optimization for sticky patterns.
• 98d0367d2247 Fix: ^ inside a paren that can match empty does not anchor the pattern.

Intl / Temporal

• 09917ef55b0f Add missing U_FAILURE(status) check in actualLunisolarMonthLength.

Inspector

• 3722912ff800 / 7be5445e4a22 / e8c97076834e / f3e34dde7c9d Canvas: instrument & record WebGPU devices/pipelines.
• 301d6b2b21f7 Associate WebAssembly module scripts with the fetching resource.
• 28b979b1659b / 479edb2e4395 Site Isolation: implement Network.loadResource / Network.getSerializedCertificate.

WTF

• 232cebabc1f3 Remove big-endian support and CPU(NEEDS_ALIGNED_ACCESS).
• e5fa5c604438 Upgrade fast_float to 8.2.10.
• a288a8ec809b Widen find16/find32 SIMD threshold; faster ASCII case-conversion prefix copy.
• 6cb1077d85c8 makeStringByReplacingAll() now uses SIMD-accelerated find().
• 5590f2e70615 Fix AdaptiveStringSearcher good-suffix shift table off-by-one.
• f5716f6401ed Add preserve_most to most fastMalloc APIs on ARM64.
• f7a9d16e1531 Add removeIf() to WeakHashSet / WeakListHashSet.
• e1fc460b8f1d Add removeIf() to RobinHoodHashTable.
• ff1f31c83dc7 Treat creating/destroying a CheckedPtr as no-delete.
• bf15f00ebe95 Remove 12 unused internal-linkage templates (TypeTraits/HashTable/Vector/etc.).
• 5b84cf3719fa Use __builtin_trap instead of inline asm under clang static analyzer.
• 158f737725b7 Add helpers for Darwin temp/cache directories.
• 04e3d47960f3 Limit URL size at IPC boundary (Chrome/Blink parity).
• 5daad377031c / a7ea27dd3bb6 Enable -Wthread-safety on GTK/WPE and fix findings.
• 7eb640d408f8 CMake: merge Mac and iOS ports into "Cocoa".
• cfb222f3c4d1 CMake: run cleandead at end of configuration.

bmalloc

• 6eaa5ac1f65d Remove 32-bit libpas support.
• f5716f6401ed preserve_most on fastMalloc APIs (ARM64).
• 8b8b3e5ee16c Fix inverted MADV_ZERO support latch in VMAllocate.cpp.
• ead6285911f6 libpas: pas_thread_local_cache_for_all clobbered its should-go-again result.
• 90cbe5e85528 libpas: fix benign read from a deallocated TLC.
• e388877954d1 PGM allocator: fix uninitialized free_status misclassifying OOB as UAF.
• 05c83a6550b7 libpas: fix MTE_overrideEnablementForJavaScriptCore=true incorrectly disabling MTE.
• f01297663d40 / 86fb5e3a4eef / d18773ec666e libpas test coverage (scavenging / zeroing / paged-out pages).

Breaking/notable for Bun

• 32-bit purge: 29ceb3c03de3 (JSVALUE32_64 removed), 857bd4334690 (ARMv7 JIT removed), 6eaa5ac1f65d (32-bit libpas removed), 232cebabc1f3 (big-endian + CPU(NEEDS_ALIGNED_ACCESS) removed). Any #if USE(JSVALUE64) / CPU(ADDRESS32) guards in Bun patches are now dead.
• VM layout: f2f2c2ddf637 deletes StringRecursionChecker.{h,cpp} and the stringRecursionCheck* fields from VM.h. Cyclic Array.prototype.join/toString now throws RangeError instead of returning "".
• Module loader: 90b2ecf79ae3 changes hostResolveImportedModule to propagate the import-attribute type — check Bun's module loader hook signatures.
• Register allocator: bfb1b1183bc2 removes the B3/Air graph-coloring allocator and its Options:: toggle.
• fastMalloc ABI (ARM64): f5716f6401ed adds __attribute__((preserve_most)) to fastMalloc/fastFree etc. — affects anything calling these across the WTF boundary on arm64.
• BuiltinNames: bf6512f84f7d registers stackPrivateName as private-only; WebAssembly.Exception constructor length becomes 2 and gains a stack prototype getter.
• Feature defaults: 0d0080ea539d Wasm Memory64 on by default; 319f94b3db4a Iterator.prototype.includes on by default.
• Wasm threading: 24527bbb9ac8 reworks icache barrier / callee publication and adds Thread::barrierInstructionCache() in WTF.

---

[decide:webkit] gate passed · iteration 2 · 8 files touched

fails on main (without fix)

ASAN without fix: BUILD FAILED (no junit output)
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" "test/js/bun/jsc/webkit-upgrade-3722912f.test.ts"
ninja: Entering directory `/workspace/bun/build/debug'
[1/182] gen generated_host_exports.rs
generated_host_exports.rs: 94 exports (host=3, lazy=10, generic=81, rust=0); 238 extern-C blocks audited
[2/182] gen cpp.rs (cppbind)
[3/182] gen JSSink.{cpp,h,lut.h,rs}
generated_jssink.rs: 7 sinks, 84 exported symbols
Generating /workspace/bun/build/debug/codegen/JSSink.lut.h from /workspace/bun/build/debug/codegen/JSSink.lut.txt
[4/182] gen JS modules (bundle-modules)
Preprocess modules (8715ms)
Bundle modules (63ms)
Postprocesss modules (24ms)
Bundle Functions (746ms)
Generate Code (12ms)

[9.57s] Bundled "src/js" for development
  2749 kb
  193 internal modules
  13 native modules
  90 internal functions across 19 files
[4/181] cargo bun_bin → libbun_rust.a (--target x86_64-unknown-linux-gnu)

  nightly-2026-07-20-x86_64-unknown-linux-gnu unchanged - rustc 1.99.0-nightly (9f36de775 2026-07-19)

[177/181] cxx obj/unified/UnifiedSource-src_jsc_bindings-0.cpp.o
FAILED: obj/unified/UnifiedSou
... (truncated)

release without fix: all passed
bun test v1.4.0-canary.1 (385f52890)

test/js/bun/jsc/webkit-upgrade-3722912f.test.ts:
(pass) WebKit 3722912ff800 upgrade > Iterator.prototype.includes is enabled by default (319f94b3db4a) [0.19ms]
(pass) WebKit 3722912ff800 upgrade > cyclic Array.prototype.join throws RangeError (f2f2c2ddf637) [2.51ms]
(pass) WebKit 3722912ff800 upgrade > WebAssembly.Exception gains options.traceStack and stack getter (bf6512f84f7d) [0.48ms]
(pass) WebKit 3722912ff800 upgrade > typed import attributes resolve through BunTranspiledModule (--isolate) (90b2ecf79ae3) [8.49ms]
(pass) WebKit 3722912ff800 upgrade > indirect, namespace and star re-exports link on the JSC ModuleAnalyzer path (90b2ecf79ae3) [22.09ms]

 5 pass
 0 fail
 12 expect() calls
Ran 5 tests across 1 file. [152.00ms]
__F:0:S:0

passes on PR (with fix)

ASAN with fix: all passed
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" "test/js/bun/jsc/webkit-upgrade-3722912f.test.ts"
bun test v1.4.0 (59b0de097)

test/js/bun/jsc/webkit-upgrade-3722912f.test.ts:
(pass) WebKit 3722912ff800 upgrade > Iterator.prototype.includes is enabled by default (319f94b3db4a) [13.19ms]
(pass) WebKit 3722912ff800 upgrade > cyclic Array.prototype.join throws RangeError (f2f2c2ddf637) [10.75ms]
(pass) WebKit 3722912ff800 upgrade > WebAssembly.Exception gains options.traceStack and stack getter (bf6512f84f7d) [3.66ms]
(pass) WebKit 3722912ff800 upgrade > typed import attributes resolve through BunTranspiledModule (--isolate) (90b2ecf79ae3) [317.28ms]
(pass) WebKit 3722912ff800 upgrade > indirect, namespace and star re-exports link on the JSC ModuleAnalyzer path (90b2ecf79ae3) [1138.48ms]

 5 pass
 0 fail
 12 expect() calls
Ran 5 tests across 1 file. [3.17s]
__F:0:S:0

release with fix: all passed
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped) in 676ms (unchanged)
ninja: Entering directory `/workspace/bun/build/release'
[1/140] gen generated_host_exports.rs
generated_host_exports.rs: 94 exports (host=3, lazy=10, generic=81, rust=0); 238 extern-C blocks audited
[2/140] gen cpp.rs (cppbind)
[3/140] gen JSSink.{cpp,h,lut.h,rs}
generated_jssink.rs: 7 sinks, 84 exported symbols
Generating /workspace/bun/build/release/codegen/JSSink.lut.h from /workspace/bun/build/release/codegen/JSSink.lut.txt
[4/140] gen JS modules (bundle-modules)
Preprocess modules (8727ms)
Bundle modules (51ms)
Postprocesss modules (106ms)
Bundle Functions (687ms)
Generate Code (20ms)

[9.61s] Bundled "src/js" for production
  2559 kb
  193 internal modules
  13 native modules
  90 internal functions across 19 files
[4/139] cargo bun_bin → libbun_rust.a (--target x86_64-unknown-linux-gnu)

  nightly-2026-07-20-x86_64-unknown-linux-gnu unchanged - rustc 1.99.0-nightly (9f36de775 2026-07-19)

^[[1m^[[92m   Compiling^[[0m bun_core v0.0.0 (/workspace/bun/src/bun_core)
^[[1m^[[92m   Compiling^[[0m bun_runtime v0.0.0 (/workspace/bun/src/runtime)
^[[1m^[[92m   Compilin
... (truncated)

diff hotspot

scripts/build/deps/webkit.ts                     |   2 +-
 src/bundler/analyze_transpiled_module.rs         |  38 +++--
 src/bundler/linker_context/postProcessJSChunk.rs |   8 +-
 src/bundler_jsc/analyze_jsc.rs                   | 135 ++++++++++++----
 src/js_printer/lib.rs                            | 191 +++++++++++++++++------
 src/jsc/RuntimeTranspilerCache.rs                |   5 +-
 src/jsc/bindings/BunAnalyzeTranspiledModule.cpp  |  39 +++--
 test/js/bun/jsc/webkit-upgrade-3722912f.test.ts  | 106 +++++++++++++
 8 files changed, 416 insertions(+), 108 deletions(-)

gate history · 5 passed · 1 rejected · iteration 2

evidence per changed file

file                                              reads  edits  tests
scripts/build/deps/webkit.ts                          1      1      0
src/bundler/analyze_transpiled_module.rs              3      3      0
src/bundler/linker_context/postProcessJSChunk.rs      1      1      0
src/bundler_jsc/analyze_jsc.rs                       13     15      0
src/js_printer/lib.rs                                 9     16      0
src/jsc/RuntimeTranspilerCache.rs                     2      3      0
src/jsc/bindings/BunAnalyzeTranspiledModule.cpp       8     12      0
test/js/bun/jsc/webkit-upgrade-3722912f.test.ts       2      5      0

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The change pins WebKit to an autobuild preview tag, stores fetch parameters in module records, forwards module request types through Rust and JSC, updates diagnostics, and adds WebKit upgrade tests.

Changes

WebKit upgrade and module request metadata

Layer / File(s)	Summary
WebKit release pin scripts/build/deps/webkit.ts	WEBKIT_VERSION now uses the autobuild-preview-pr-383-b9ea4dc5 release tag.
Module metadata serialization src/js_printer/lib.rs, src/bundler/analyze_transpiled_module.rs, src/bundler/linker_context/postProcessJSChunk.rs, src/jsc/RuntimeTranspilerCache.rs	Module records store fetch parameters. Requested-module deduplication includes specifier, fetch type, and phase. Import processing passes explicit fetch parameters. The cache format version changes from 24 to 25.
JSC request-type bridge src/bundler_jsc/analyze_jsc.rs, src/jsc/bindings/BunAnalyzeTranspiledModule.cpp	Record validation checks fetch-parameter slots. Rust converts fetch parameters to JSC request types and forwards them through import and export APIs. JSC stores and reports the request types.
WebKit upgrade validation test/js/bun/jsc/webkit-upgrade-3722912f.test.ts	Tests cover iterator inclusion, cyclic array joins, WebAssembly.Exception stack APIs, re-exports, and typed JSON imports.

Possibly related PRs

• oven-sh/bun#35914: Both changes propagate FetchParameters through module metadata and JSON import handling.
• oven-sh/bun#35910: Both changes update WebKit and include overlapping WebKit upgrade coverage.
• oven-sh/bun#35971: Both changes update RuntimeTranspilerCache to carry new module metadata.

Suggested reviewers: jarred-sumner

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the primary change: upgrading WebKit to commit 3722912ff800.
Description check	✅ Passed	The description explains the WebKit upgrade, Bun-side changes, WebKit-side changes, and verification results in sufficient detail.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/build/deps/webkit.ts`:
- Line 6: Update the WEBKIT_VERSION constant from the temporary PR preview tag
to the corresponding autobuild-<merged commit SHA> tag once PR `#383` merges, or
select another valid available pin if it closes. Confirm the referenced WebKit
release assets exist so downloads do not return HTTP 404.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 21d9db24-fb4f-4543-8106-cdfda881a5d4

📥 Commits

Reviewing files that changed from the base of the PR and between 54bbd5d and 56ec494.

📒 Files selected for processing (2)

• scripts/build/deps/webkit.ts
• src/jsc/bindings/BunAnalyzeTranspiledModule.cpp

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/js/bun/jsc/webkit-upgrade-3722912f.test.ts`:
- Around line 4-7: Add the relevant bugs.webkit.org issue identifiers to the
suite and each indicated case annotation in the WebKit upgrade test, while
preserving the existing Bun-side adaptation rationale and merge/commit
references. Update the annotations around the visible coverage comment and the
referenced case ranges without changing test behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5c32ba57-7eb0-4d57-945e-1998218fe7b2

📥 Commits

Reviewing files that changed from the base of the PR and between 56ec494 and c4127ec.

📒 Files selected for processing (1)

• test/js/bun/jsc/webkit-upgrade-3722912f.test.ts

[github-actions]

Found 6 issues this PR may fix:

1. WASM Memory64 module is not supported in bun #35706 - WASM Memory64 not supported; upstream explicitly enables WebAssembly Memory64/Table64
2. JSON.stringify: strings with escapes or emoji fall off the SIMD fast path (2-3x slower than V8 14.6, 9x self-penalty per escaped char) #32079 - JSON.stringify falls off SIMD fast path for escapes/emoji; upstream adds SWAR fast paths for JSON.stringify
3. Node.js is 300x faster than Bun at isbot regexp #5197 - isbot regexp 300x slower than Node; upstream includes RegExp fixes and StringSplitCache for RegExp
4. Bun is 20x slower with "marked" npm library compared to Node #3464 - marked library 20x slower than Node due to heavy regexp usage; upstream RegExp engine improvements are relevant
5. Character set intersection of complement classes in v-mode regular expressions not considered #30183 - RegExp v-mode complement class intersection produces wrong results; upstream includes multiple Yarr RegExp correctness fixes
6. ~6x slower than Node on tight u32 arithmetic loop #27372 - ~6x slower than Node on tight u32 arithmetic loop; upstream B3/Air compiler and JIT improvements may improve codegen quality

If this is helpful, copy the block below into the PR description to auto-close these issues on merge.

Fixes #35706
Fixes #32079
Fixes #5197
Fixes #3464
Fixes #30183
Fixes #27372

🤖 Generated with Claude Code

[robobun]

On the find-issues suggestions: not adding Fixes lines for these without verification. The upgrade brings relevant upstream work for each (Memory64 flag in 0d0080ea539d, JSON.stringify SWAR in 656d3c36830f/1d355c27ea88, Yarr improvements for the regex-heavy ones, v-mode class-set early-exit in a458a6c1f0a7), but "may help" is not "fixes". A quick Memory64 smoke test still throws, for instance. Happy to verify specific ones on request and add them then.

[github-actions]

This PR may be a duplicate of:

1. Upgrade WebKit to 2e37adcc23b7 #36267 - Full WebKit upgrade to 2e37adcc23b7, superseded by this PR's newer target (3722912ff800)
2. Upgrade WebKit to 01aaa3e0be0c #35910 - Full WebKit upgrade to 01aaa3e0be0c (the start of this PR's upstream range), superseded
3. Upgrade WebKit to 0e86b49069a5 #33956 - Full WebKit upgrade to 0e86b49069a5, superseded by this PR's newer target
4. Bump WebKit to 6d586e293f #31706 - Full WebKit bump to 6d586e293f, superseded by this PR's newer target

🤖 Generated with Claude Code