Bump WebKit (oven-sh/WebKit#702 preview): in a generator, yield in the parameters of an arrow function nested in another's parameters is a SyntaxError

[robobun]

Blocked on oven-sh/WebKit#702. A draft until the pin is a commit of the fork's main.

Problem

• In a generator, yield in arrow function parameters is a SyntaxError. Bun accepts it when that arrow function is in the parameters of another arrow function: (0, eval)("(function* () { (a = (yield) => 1) => a })"). With BUN_JSC_useSourceProviderCache=0 it throws SyntaxError: Cannot use 'yield' as a parameter name in a generator function. Node rejects it.
• The cause is in JavaScriptCore's parser. isArrowFunctionParameters() parses ( ... ) in a scope that is never a generator, and the nested arrow function goes to the parser's function cache from there. The parse that knows the generator then skips it.

Fix

• The engine change is [JSC] Parser: in a generator, reject yield in the parameters of an arrow function nested in another's parameters WebKit#702. isArrowFunctionParameters() now parses the parameters with [+Yield] in a generator, as the parse that follows it does. So what it puts in the cache is valid for that parse.
• This PR pins the preview build of Ways to support bun development? #702 (autobuild-preview-pr-702-54004fef) so that CI runs the test. Before it merges, replace the tag with the merge commit of Ways to support bun development? #702.
• Verified: test/js/bun/jsc/parser-yield-in-arrow-parameters.test.ts (new). USE_SYSTEM_BUN=1 bun test fails 16 of 47. bun bd test passes all 47, also with BUN_JSC_validateExceptionChecks=1.
• Self-reviewed: 1 concern raised, 1 addressed (fix the parameter check, do not refuse cache items).

Background

• WEBKIT_VERSION in scripts/build/deps/webkit.ts names the oven-sh/WebKit release that the build downloads. A pull request there publishes a prerelease, autobuild-preview-pr-<n>-<sha8>.
• ArrowParameters[?Yield]: arrow function parameters take the [Yield] of the code around them, so in a generator yield is not an identifier in them.
• The parser's function cache (SourceProviderCache) lets JavaScriptCore skip a function that it parsed before.

Notes

Where Bun users can see it. Only where text goes to JavaScriptCore as it is: eval, new Function, node:vm. For a file, Bun's transpiler rejects the same text first (error: Invalid binding pattern). The test uses eval.

The preview is the current pin (ebd5a6145b) plus the six commits of oven-sh/WebKit#702 (the last one is the change, it removes what the first five did). #43402 (the preview of oven-sh/WebKit#699) changes the same line of scripts/build/deps/webkit.ts. One bump can carry both when they are on the fork's main.

Earlier pins of this PR. The first five commits of oven-sh/WebKit#702 left the parameter check as it was and made the parser refuse a cache item instead. Three of those previews made valid programs fail: a refused item means a second parse of valid code, and that parse has bugs of its own (oven-sh/WebKit#430, #43569). Examples: (async function* () { ((...[a = () => await => 1]) => a); }) threw a SyntaxError, and a generator with ({ yield: b } = { yield: N }) => { var N = 7; return b; } in arrow function parameters threw ReferenceError: N is not defined. The current version parses no valid code again. The test has these programs (shadowed, yieldAsPropertyName, yieldAsVariable, and the must-parse list).

The test. 19 expressions, each in 5 generator contexts (must throw; in the four that are not strict mode code, with the message of the parse without the cache) and in 3 contexts where yield is an identifier (must parse). Eight valid programs must still parse: three with await as an identifier in an async generator, two with await in a generator, three with yield as a property name or a function name. The last test calls nested arrow functions from a generator and from a plain function and checks what they capture. The first version of the test also gave the text to new Function. That hit an unrelated exception check failure on the ASAN lane (#43524), so the test uses eval only.

Found during this work, not fixed here.

• JavaScriptCore accepts await as an arrow function parameter name in an async function when the parser's function cache holds the arrow function #43476: the same cache hole for await in an async function.
• A parameter default value reads the wrong binding when the function body has a var of the same name and the function is nested in another function #43569: a default value reads the wrong binding when the body has a var of the same name and the function is nested in another function.
• JavaScriptCore accepts arguments and some await parameter names in an arrow function in a class static block #43477: arguments and some await parameter names in an arrow function in a class static block.
• new Function() with a syntax error fails exception check validation in constructFunctionSkippingEvalEnabledCheck #43524: new Function() with a syntax error fails exception check validation.

Other suites. I ran only this test file on linux x64 with the debug ASAN build. oven-sh/WebKit#702 has the engine side: both JSTests lanes, a test262 differential run, and generated corpora.

---

[policy-decision:webkit] gate passed · iteration 1 · 2 files touched

passes on PR (with fix)

Test-only change.

Debug/ASAN (expected pass):
$ bun bd test 'test/js/bun/jsc/parser-yield-in-arrow-parameters.test.ts'
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test test/js/bun/jsc/parser-yield-in-arrow-parameters.test.ts
bun test v1.4.3 (367d939d9)

test/js/bun/jsc/parser-yield-in-arrow-parameters.test.ts:
(pass) yield in the parameters of an arrow function > the text around the expressions is valid [14.53ms]
(pass) yield in the parameters of an arrow function > (a = (yield) => 1) => a is a SyntaxError in a generator [9.77ms]
(pass) yield in the parameters of an arrow function > (a = (b = yield) => b) => a is a SyntaxError in a generator [8.52ms]
(pass) yield in the parameters of an arrow function > (b = (yield) => 1, c) => b is a SyntaxError in a generator [5.75ms]
(pass) yield in the parameters of an arrow function > (a = (...yield) => 1) => a is a SyntaxError in a generator [5.47ms]
(pass) yield in the parameters of an arrow function > (a = ({ b = yield }) => 1) => a is a SyntaxError in a generator [7.02ms]
(pass) yield in the parameters of an arrow function > (a = async (yield) => 1) => a is a SyntaxError in a generator [6.21ms]
(pass) yield in the parameters of an arrow function > async (a = (yield) => 1) => a is a SyntaxError in a generator [5.55ms]
(pass) yield in the parameters of an arrow function > ({ a = (yield) => 1 }) => a is a SyntaxError in a generator [5.94ms]
(pass) yield in the parameters of an arrow function > ([a = (b = yield) => b]) => a is a SyntaxError in a generator [6.47ms]
(pass) yield in the parameters of an arrow function > (...[a = (yield) => 1]) => a is a SyntaxError in a generator [5.28ms]
(pass) yield in the parameters of an arrow function > (a = (b = (c = yield) => c) => b) => a is a SyntaxError in a generator [8.64ms]
(pass) yield in the parameters of an arrow function > (a = (b = { yield }) => b) => a is a SyntaxError in a generator [5.28ms]
(pass) yield in the parameters of an arrow function > (a = (b = [yield] = []) => b) => a is a SyntaxError in a generator [7.07ms]
(pass) yield in the parameters of 
... (truncated)
Exit: 0

diff hotspot

scripts/build/deps/webkit.ts                       |   2 +-
 .../jsc/parser-yield-in-arrow-parameters.test.ts   | 135 +++++++++++++++++++++
 2 files changed, 136 insertions(+), 1 deletion(-)

gate history · 1 passed · 1 rejected · iteration 1

evidence per changed file

file                                                      reads  edits  tests
scripts/build/deps/webkit.ts                                  0      0     27
test/js/bun/jsc/parser-yield-in-arrow-parameters.test.ts      3      3     27

[robobun]

^{Updated 5:29 AM PT - Sep 20th, 2026}

✅ @robobun, your commit 7002d5c74fd665bf76eb756810ed5797f32cf7fe passed in Build #118922! 🎉

---

🧪   To try this PR locally:

bunx bun-pr 43497

That installs a local version of the PR into your bun-43497 executable, so you can run:

bun-43497 --bun

[robobun]

Reproduced with bun 1.4.3-canary.1+367d939d9: (0, eval)("(function* () { (a = (yield) => 1) => a })") is accepted. With BUN_JSC_useSourceProviderCache=0 it throws SyntaxError: Cannot use 'yield' as a parameter name in a generator function. node 26 rejects it too.

The engine change is oven-sh/WebKit#702. This PR pins its preview build (autobuild-preview-pr-702-54004fef) and adds the test. USE_SYSTEM_BUN=1 bun test test/js/bun/jsc/parser-yield-in-arrow-parameters.test.ts fails 16 of 47. bun bd test on this branch passes all 47, also with BUN_JSC_validateExceptionChecks=1.

[coderabbitai]

Warning

Review paused — included plan limit reached

Keep your review moving with free on-demand reviews.

• Run this review for free

On-demand reviews are free for one more day.

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Promotion and pricing details

On-demand reviews are free for one more day. After that, they cost $0.25 per reviewed file.

Review limit details

Or wait 2 minutes for your next included review.

Check out review usage here.

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: oven-sh/bun/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Essentials

Run ID: b395694d-a6d0-403f-a13b-d31952f491df

📥 Commits

Reviewing files that changed from the base of the PR and between 26e7a4b and 7a51c60.

📒 Files selected for processing (2)

• scripts/build/deps/webkit.ts
• test/js/bun/jsc/parser-yield-in-arrow-parameters.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Findings marked 🟡 are optional suggestions and need no follow-up push.

[claude]

Code review found no issues

No high-confidence issues detected in this change.