Repository navigation
Bump WebKit to 87ee10da087b - #45567
Conversation
|
Updated 1:05 PM PT - Oct 16th, 2026
@dylan-conway, your commit 1d2566f is building: |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe pinned WebKit revision changes from ChangesWebKit revision update
Suggested reviewers: Priority: ⬆️ High Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely identifies the primary change: updating WebKit to the specified revision. |
| Description check | |
The description explains the WebKit revision update and includes local verification details. It covers both required template topics, although it does not use the template headings. |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches: 💡 1
-
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Beyond the inline finding, I also grepped the repo for the old WebKit sha (b1e30d08cb14) — it appears nowhere outside scripts/build/deps/webkit.ts, so no CI config, Dockerfile, or assertion table needs a matching update. The new value is a full 40-hex sha, so the autobuild-preview-pr rejection in scripts/build/download.ts and the webkit-prebuilt-url source lint are satisfied. I could not check from here that autobuild artifacts exist for every platform/flavor; CI will settle that.
Extended reasoning...
One-line bump of WEBKIT_VERSION in scripts/build/deps/webkit.ts, the single source of truth consumed by download.ts, sync-webkit-source.ts, and the inspector protocol generator; no security-sensitive surface. Ruled out stale duplicates of the old sha elsewhere in the repo and tag-shape violations; artifact availability per platform is left to CI.
| * From https://github.com/oven-sh/WebKit releases. | ||
| */ | ||
| export const WEBKIT_VERSION = "b1e30d08cb1428688c5f24109fe4f534096ee2ad"; | ||
| export const WEBKIT_VERSION = "87ee10da087b63e011bd1ada64d1814a850a4395"; |
There was a problem hiding this comment.
🔴 Maintainers get no CI signal if a later WebKit bump reintroduces the Array#sort miscompile this bump fixes; the fix is only checked by hand. The PR picks up oven-sh/WebKit#792 (PutCellButterflySlot double format) and the only verification is a local 200,000-call loop described in the PR, with no test in test/. Fix: add a regression test alongside this bump (e.g. under test/js/bun or test/regression) that spawns bun and runs the sort-with-double-comparator repro enough iterations to reach DFG/FTL, asserting the exact sorted result, so the behavioral change carried by scripts/build/deps/webkit.ts:6 is covered.
Why this was flagged
The bump at scripts/build/deps/webkit.ts:6 moves the prebuilt JSC to a build that contains the fix for the DFG PutCellButterflySlot double-format bug, which the PR says made [17, 8, 1, 1] sort wrong in 192,141 of 200,000 calls on Bun 1.4.3. The PR adds no test file; the diff touches only the one constant. The repo review rules require every behavioral change to ship an automated test and explicitly say manual verification does not count even for one-liners. Consequence over base: on the base branch the bug is present and also untested; after merge the bug is fixed but still untested, so a future WEBKIT_VERSION bump that regresses the DFG fix (or picks up a new one) ships a wrong Array#sort result to users with nothing in CI flagging it. No existing test covers this: a repo grep for the old sha and for a sort-with-double-comparator fixture found none.
Verification: normal — triggers whenever a future WebKit bump (or fork rebase) regresses the DFG PutCellButterflySlot fix: nothing in test/ would catch it. git diff 5866b5f..HEAD touches only scripts/build/deps/webkit.ts:6; no test file is added. Grep of the whole repo for PutCellButterflySlot, WebKit#792, or the (a + 0.5) - (b + 0.5) comparator returns nothing.
37 upstream commits: SQL consolidation (oven-sh#45304), bun lint/check/fmt rewrite (oven-sh#45595), b.bytes + bindgen Bun.* functions (oven-sh#45590), WebSocket closing handshake rewrite (oven-sh#45223), install/yarn.lock migration (oven-sh#45616), YAML.parse (oven-sh#45593), bake fixes (oven-sh#45605), file-behind-symlink installs (oven-sh#45477), WebKit bump 87ee10da087b (oven-sh#45567). Conflicts (14): src/install/{PackageInstall,PackageInstaller}.rs, src/jsc/bindings/c-bindings.cpp, src/uws_sys/libuwsockets.cpp + 10 tests. Resolution: upstream structure + re-applied OHOS patches (is_linked_folder package.json identity, OHOS ELF signing, is_executable_file access(X_OK), loop post handler) and the serialization policy (bun-audit/lifecycle/ catalogs: describe.concurrent/test.concurrent -> serial).
Bumps
WEBKIT_VERSIONfromb1e30d08cb14to87ee10da087b(current oven-sh/WebKitmain). Theautobuild-87ee10da087b63e011bd1ada64d1814a850a4395release exists.oven-sh/WebKit changes picked up:
Checked locally on a debug build, whose
process.versions.webkitis87ee10da087b63e011bd1ada64d1814a850a4395:[17, 8, 1, 1]passed as four arguments to(v, w, x, y) => [v, w, x, y].sort((a, b) => (a + 0.5) - (b + 0.5))comes back as1,1,8,17in 200,000 of 200,000 calls. Bun 1.4.3 returns a wrong array in 192,141 of them. Everything else is left to CI.