Files
bun.sh/test/package.json
Jarred Sumner 4d9752a1f0 Upgrade WebKit to f03492d0636f (#26922)
# JavaScriptCore Upstream Changes: 1b6f54d1c872..upstream/main

**Date range**: Feb 5 -- Feb 11, 2026
**Total JSC commits**: 38

---

## 1. New Features

### WebAssembly JSPI (JavaScript Promise Integration)
**Commit**: `53e97afd3421` -- [JSC] JSPI Implementation
**Files changed**: 59 files, +3879/-148 lines

Full implementation of the [WebAssembly JSPI
proposal](https://github.com/WebAssembly/js-promise-integration). Adds
two new APIs:

- `WebAssembly.promising(wasmFun)` -- wraps a wasm function so it
returns a Promise
- `new WebAssembly.Suspending(jsFun)` -- wraps a JS function so wasm can
suspend on its result

Controlled by `useJSPI` feature flag (disabled by default). This is a
large change that introduces:

- New classes: `EvacuatedStack`, `PinballCompletion`, `JSPIContext`,
`WebAssemblySuspending`, `WebAssemblyPromising`,
`JSWebAssemblySuspendError`
- New `JSPIContext` struct added to `VM` (field `topJSPIContext`)
- New `pinballCompletionStructure` in VM
- New `WebAssemblySuspendError` and `WebAssemblySuspending` lazy class
structures in JSGlobalObject
- New methods on VM: `addEvacuatedStackSlice`,
`removeEvacuatedStackSlice`, `gatherEvacuatedStackRoots`
- New iso subspace: `pinballCompletionSpace`

**Follow-up**: `f67441012b90` -- JSPI cages should only generate JIT
code when JITCage is enabled

### WebAssembly Memory64 in BBQ Tier
**Commit**: `7b98e4b17594` -- Add support for Memory64 in BBQ Tier

Extends Memory64 support from the interpreter to the BBQ JIT tier,
allowing wasm modules to address >4GB of memory.

### WebAssembly Multi-Memory (instantiation only)
**Commit**: `bdf26416947e` -- Support instantiating multiple wasm
memories

Adds support for instantiating multiple memories in wasm modules (but
not executing instructions that use memories other than index 0). Gated
behind `useWasmMultiMemory` flag.

### LOL (Lightweight Optimizing Language) JIT -- New Tier (In Progress)
A new JIT compilation tier "LOL" is being built incrementally across
multiple commits:

- `dd56e0f5b991` -- Add get_argument/argument_count bytecodes
- `fb43184a0a77` -- Add to_primitive-like bytecodes
- `f52fa4a30c76` -- Add switch/throw bytecodes
- `7fd04c82d291` -- Add support for this/prototype bytecodes
- `11127b8a61e0` -- Add support for op_ret

These commits add new files under `Source/JavaScriptCore/lol/`
(LOLJIT.cpp, LOLJIT.h, LOLRegisterAllocator.h). This appears to be a new
lightweight JIT tier between Baseline and DFG.

---

## 2. Performance Improvements

### Deep Rope String Slicing -- 168x faster
**Commit**: `93f2fd68619b` -- [JSC] Limit rope traversal depth in
`tryJSSubstringImpl`

Limits rope traversal depth to 16 in `tryJSSubstringImpl`. Deep rope
strings from repeated concatenation (`s += 'A'`) previously caused
O(n^2) behavior. When the depth limit is exceeded, it falls back to
`resolveRope` to flatten the string.

This directly addresses a performance issue reported against Bun where
it was significantly slower than Node.js.

### String#endsWith DFG/FTL Optimization -- up to 10.5x faster
**Commit**: `901865149859` -- [JSC] Optimize `String#endsWith` in
DFG/FTL

Adds a new DFG/FTL intrinsic `StringPrototypeEndsWithIntrinsic` for
`String.prototype.endsWith`. Constant folding case is 10.5x faster;
general case is 1.45x faster.

### RegExp Flag Getters in DFG/FTL and IC -- 1.6x faster
**Commit**: `1fe86a244d00` -- [JSC] Handle RegExp flag getters in
DFG/FTL and IC

Adds DFG/FTL and inline cache support for RegExp flag property getters
(`.global`, `.ignoreCase`, `.multiline`, `.dotAll`, `.sticky`,
`.unicode`, `.unicodeSets`, `.hasIndices`).

### String#@@iterator as NewInternalFieldObject in DFG/FTL
**Commit**: `44cba41d8eef` -- [JSC] Handle `String#@@iterator` as
`NewInternalFieldObject` in DFG/FTL

Optimizes string iterator creation in DFG/FTL by treating it as a
`NewInternalFieldObject`, enabling allocation sinking.

### ArithMod(Int52) in DFG/FTL
**Commit**: `49a21e7ff327` -- [JSC] Add ArithMod(Int52Use, Int52Use) in
DFG / FTL
**Follow-ups**: `f96be6066671` (constant folding fix), `c8f283248f3f`
(NaNOrInfinity fix)

Adds Int52 modulo support in DFG/FTL, avoiding expensive `fmod` double
operations when inputs are integer-like doubles.

### ArithDiv(Int52) in DFG/FTL -- REVERTED
**Commit**: `582cb0306b7c` -- [JSC] Add ArithDiv(Int52Use, Int52Use) in
DFG / FTL
**Revert**: `2e967edd1dc0` -- Reverted due to JetStream3 regressions

### Intl formatToParts Pre-built Structure -- up to 1.15x faster
**Commit**: `a5dd9753d23c` -- [JSC] Optimize Intl formatToParts methods
with pre-built Structure

Optimizes Intl's `formatToParts` methods by using pre-built Structures
for the returned part objects.

### JSBigInt Inline Storage
**Commit**: `dbc50284d4cf` -- [JSC] Inline storage into JSBigInt
**Related**: `304cf0713b9d` -- Remove JSBigInt::rightTrim and
JSBigInt::tryRightTrim

Major structural change to JSBigInt: digits are now stored inline
(trailing storage) instead of via a separate `CagedBarrierPtr`. This
eliminates the separate allocation and pointer indirection.
`tryRightTrim` and `rightTrim` removed; `createFrom` renamed to
`tryCreateFrom` with span-based API.

### WYHash Always Enabled for Strings
**Commit**: `14ba1421ca08` -- [JSC] Always use WYHash for strings

Previously, WYHash had a threshold (disabled for short strings on weak
devices). Now it's enabled regardless of string size.

### JIT Worklist Thread Count: 3 -> 4
**Commit**: `453c578cadf6` -- [JSC] Bump JIT worklist thread number from
3 to 4

### Greedy Register Allocator Improvements
**Commit**: `b642ae17aade` -- [JSC] Proactively coalesce spill slots
during register allocation
**Commit**: `a78705db7c08` -- [JSC] GreedyRegAlloc: amortize cost of
clearing the visited set in the evict loop

---

## 3. Bug Fixes

### RegExp (YARR) Fixes
- `dea6808af40e` -- **Fix stale captures in FixedCount groups in
MatchOnly mode**: `.test()` was not clearing captures between FixedCount
iterations, causing stale values visible to backreferences.

- `437e137889ea` -- **Fix infinite loop in JIT for non-greedy
backreference to zero-width capture**: A non-greedy backreference like
`\1*?` could loop forever when the referenced capture was undefined or
empty.

- `d4f884d21c0e` -- **Fix backtracking in NestedAlternativeEnd**: Wrong
jump target was used when backtracking from NestedAlternativeEnd.

### ARM64 Cached Immediate Fix
**Commit**: `8396ad321ad0` -- [JSC] Fix edge case issue of cached imm in
ARM64

TrustedImm32(-1) was not zero-extended when cached, causing wrong reuse
when followed by TrustedImm64(-1).

### Wasm Fixes
- `cea8513d43ef` -- **Fix RefCast/RefTest folding in B3**: The condition
was inverted, causing wrong cast results.
- `629632da96e1` -- **Fix debugger races with idle and active VMs in
stop-the-world**
- `e5391ad90f47` -- **Stack check on IPInt->BBQ loop OSR entry**
- `fd15e0d70ab1` -- **Use FrameTracer in wasm table_init operations**

### Structure Heap Alignment Assert Fix
**Commit**: `47b52526fd42` -- [JSC] Fix startOfStructureHeap alignment
RELEASE_ASSERT

---

## 4. Bun-side Changes

- Updated `WEBKIT_VERSION` to `f03492d0636f`
- Updated `SerializedScriptValue.cpp`: replaced removed
`JSBigInt::tryRightTrim` with `JSBigInt::tryCreateFrom` span-based API
- Fixed `CloneSerializer`/`CloneDeserializer` inheritance (`private` ->
`public CloneBase`)
- Explicitly disabled `ENABLE_MEDIA_SOURCE`, `ENABLE_MEDIA_STREAM`,
`ENABLE_WEB_RTC` in `build.ts` and `SetupWebKit.cmake` for JSCOnly port

---

## 5. Summary by Component

| Component | Commits | Key Changes |
|-----------|---------|-------------|
| **WASM** | 9 | JSPI implementation, Memory64 BBQ, multi-memory,
RefCast fix, stack checks, debugger races |
| **DFG/FTL** | 6 | String#endsWith opt, RegExp flags opt,
String@@iterator opt, ArithMod(Int52) |
| **YARR (RegExp)** | 3 | Stale captures fix, infinite loop fix,
NestedAlternativeEnd backtracking fix |
| **B3/Air** | 3 | Spill slot coalescing, generational set for eviction,
RefCast/RefTest fix |
| **LOL JIT** | 5 | New JIT tier being built incrementally |
| **Runtime** | 6 | BigInt inline storage, WYHash always-on, Intl
formatToParts opt, ARM64 imm fix, rope depth limit |

---------

Co-authored-by: Sosuke Suzuki <sosuke@bun.com>
2026-02-23 01:28:37 -08:00

132 lines
3.7 KiB
JSON

{
"name": "test",
"devDependencies": {
"@types/react": "18.0.28",
"@types/react-dom": "18.0.11",
"@types/supertest": "2.0.12",
"@types/utf-8-validate": "5.0.0",
"@types/ws": "8.5.10",
"@types/puppeteer": "7.0.4"
},
"dependencies": {
"@astrojs/node": "9.1.3",
"@azure/service-bus": "7.9.4",
"@bufbuild/protobuf": "2.10.2",
"@connectrpc/connect": "2.1.1",
"@connectrpc/connect-node": "2.0.0",
"@electric-sql/pglite": "0.3.15",
"@fastify/websocket": "11.0.2",
"@grpc/grpc-js": "1.12.0",
"@grpc/proto-loader": "0.7.10",
"@happy-dom/global-registrator": "17.0.3",
"@napi-rs/canvas": "0.1.91",
"@nestjs/common": "11.0.3",
"@nestjs/core": "11.0.3",
"@prisma/client": "5.8.0",
"@remix-run/node": "2.16.8",
"@remix-run/react": "2.10.3",
"@remix-run/serve": "2.10.3",
"@resvg/resvg-js": "2.4.1",
"@swc/core": "1.3.38",
"@testing-library/jest-dom": "6.6.3",
"@testing-library/react": "16.1.0",
"@verdaccio/config": "6.0.0-6-next.76",
"acorn": "8.15.0",
"ansi-regex": "6.1.0",
"astro": "5.5.5",
"aws-cdk-lib": "2.148.0",
"axios": "1.6.8",
"body-parser": "1.20.2",
"bun-plugin-svelte": "file:../packages/bun-plugin-svelte",
"bun-plugin-yaml": "0.0.1",
"comlink": "4.4.1",
"commander": "12.1.0",
"detect-libc": "2.0.3",
"devalue": "5.1.1",
"es-module-lexer": "1.3.0",
"esbuild": "0.18.6",
"express": "4.18.2",
"fast-glob": "3.3.1",
"fastify": "5.2.2",
"filenamify": "6.0.0",
"happy-dom": "17.0.3",
"hono": "4.7.2",
"http2-wrapper": "2.2.1",
"https-proxy-agent": "7.0.6",
"iconv-lite": "0.6.3",
"immutable": "5.1.3",
"isbot": "5.1.13",
"jest-extended": "4.0.0",
"jimp": "1.6.0",
"jsdom": "25.0.1",
"jsonwebtoken": "9.0.2",
"jws": "4.0.0",
"lodash": "4.17.21",
"mongodb": "6.0.0",
"msw": "2.3.0",
"mysql2": "3.7.0",
"node-gyp": "10.0.1",
"nodemailer": "6.9.3",
"p-queue": "8.1.0",
"peechy": "0.4.310",
"pg": "8.11.1",
"pg-connection-string": "2.6.1",
"pg-gateway": "0.3.0-beta.4",
"pino": "9.4.0",
"pino-pretty": "11.2.2",
"postgres": "3.3.5",
"prisma": "5.1.1",
"prompts": "2.4.2",
"proxy": "2.2.0",
"react": "file:../node_modules/react",
"react-dom": "18.3.1",
"reflect-metadata": "0.2.2",
"rollup": "4.4.1",
"sass": "1.79.4",
"sharp": "0.34.5",
"sinon": "6.0.0",
"socket.io": "4.7.1",
"socket.io-adapter": "2.5.5",
"socket.io-client": "4.7.1",
"solc": "0.8.28",
"source-map": "0.7.4",
"st": "3.0.0",
"string-width": "7.0.0",
"strip-ansi": "7.1.0",
"stripe": "15.4.0",
"superagent": "10.2.2",
"supertest": "6.3.3",
"svelte": "5.20.4",
"tsyringe": "4.8.0",
"type-graphql": "2.0.0-rc.2",
"typeorm": "0.3.20",
"typescript": "5.9.2",
"undici": "5.20.0",
"unzipper": "0.12.3",
"uuid": "11.1.0",
"v8-heapsnapshot": "1.3.1",
"verdaccio": "6.0.0",
"vitest": "0.32.2",
"webpack": "5.88.0",
"webpack-cli": "4.7.2",
"ws": "8.18.3",
"xml2js": "0.6.2",
"yargs": "17.7.2"
},
"private": true,
"scripts": {
"typecheck": "tsc --noEmit",
"bd:v": "(bun run --silent --cwd=../ build:debug &> /tmp/bun.debug.build.log || (cat /tmp/bun.debug.build.log && rm -rf /tmp/bun.debug.build.log && exit 1)) && rm -f /tmp/bun.debug.build.log && ../build/debug/bun-debug",
"bd": "BUN_DEBUG_QUIET_LOGS=1 bun --silent bd:v"
},
"optionalDependencies": {
"duckdb": "1.3.1",
"@duckdb/node-api": "1.1.3-alpha.7",
"msgpackr-extract": "3.0.2"
},
"resolutions": {
"react": "../node_modules/react",
"@types/node": "25.0.0"
}
}