Upgrade WebKit

CMakeLists.txt

@@ -4,7 +4,7 @@ cmake_policy(SET CMP0067 NEW)
 
 set(CMAKE_POLICY_DEFAULT_CMP0069 NEW)
 set(Bun_VERSION "1.1.22")
-set(WEBKIT_TAG f9a0fda2d2b2fd001a00bfcf8e7917a56b382516)
+set(WEBKIT_TAG a060f087c2232fb20d82c321d21e074e735d3261)
 
 set(BUN_WORKDIR "${CMAKE_CURRENT_BINARY_DIR}")
 message(STATUS "Configuring Bun ${Bun_VERSION} in ${BUN_WORKDIR}")

Makefile

@@ -1309,6 +1309,7 @@ jsc-build-mac-compile-debug:
 			-DCMAKE_BUILD_TYPE=Debug \
 			-DUSE_THIN_ARCHIVES=OFF \
 			-DENABLE_FTL_JIT=ON \
+			-DENABLE_MALLOC_HEAP_BREAKDOWN=ON \
 			-DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
 			-DUSE_BUN_JSC_ADDITIONS=ON \
 			-DENABLE_BUN_SKIP_FAILING_ASSERTIONS=ON \

packages/bun-uws/src/WebSocketProtocol.h

@@ -26,7 +26,7 @@
 #include <string_view>
 
 // bun-specific
-#include "simdutf.h"
+#include "wtf/SIMDUTF.h"
 
 namespace uWS {
 

src/bun.js/api/server.zig

@@ -1904,13 +1904,13 @@ fn NewRequestContext(comptime ssl_enabled: bool, comptime debug_mode: bool, comp
             // if signal is not aborted, abort the signal
             if (this.signal) |signal| {
                 this.signal = null;
+                defer signal.unref();
                 if (!signal.aborted()) {
                     const reason = JSC.WebCore.AbortSignal.createAbortError(JSC.ZigString.static("The user aborted a request"), &JSC.ZigString.Empty, this.server.globalThis);
                     reason.ensureStillAlive();
                     _ = signal.signal(reason);
                     any_js_calls = true;
                 }
-                _ = signal.unref();
             }
 
             //if have sink, call onAborted on sink
@@ -1975,12 +1975,12 @@ fn NewRequestContext(comptime ssl_enabled: bool, comptime debug_mode: bool, comp
             // if signal is not aborted, abort the signal
             if (this.signal) |signal| {
                 this.signal = null;
+                defer signal.unref();
                 if (this.flags.aborted and !signal.aborted()) {
                     const reason = JSC.WebCore.AbortSignal.createAbortError(JSC.ZigString.static("The user aborted a request"), &JSC.ZigString.Empty, this.server.globalThis);
                     reason.ensureStillAlive();
                     _ = signal.signal(reason);
                 }
-                _ = signal.unref();
             }
 
             if (this.request_body) |body| {

src/bun.js/bindings/Base64Helpers.cpp

@@ -1,6 +1,6 @@
 
 #include "root.h"
-#include "simdutf.h"
+#include "wtf/SIMDUTF.h"
 
 #include "ExceptionOr.h"
 

src/bun.js/bindings/BunClientData.cpp

@@ -76,9 +76,15 @@ void JSVMClientData::create(VM* vm, void* bunVM)
     auto provider = WebCore::createBuiltinsSourceProvider();
     JSVMClientData* clientData = new JSVMClientData(*vm, provider);
     clientData->bunVM = bunVM;
-    vm->deferredWorkTimer->onAddPendingWork = Bun::JSCTaskScheduler::onAddPendingWork;
-    vm->deferredWorkTimer->onScheduleWorkSoon = Bun::JSCTaskScheduler::onScheduleWorkSoon;
-    vm->deferredWorkTimer->onCancelPendingWork = Bun::JSCTaskScheduler::onCancelPendingWork;
+    vm->deferredWorkTimer->onAddPendingWork = [clientData](Ref<JSC::DeferredWorkTimer::TicketData>&& ticket, JSC::DeferredWorkTimer::WorkType kind) -> void {
+        Bun::JSCTaskScheduler::onAddPendingWork(clientData, WTFMove(ticket), kind);
+    };
+    vm->deferredWorkTimer->onScheduleWorkSoon = [clientData](JSC::DeferredWorkTimer::Ticket ticket, JSC::DeferredWorkTimer::Task&& task) -> void {
+        Bun::JSCTaskScheduler::onScheduleWorkSoon(clientData, ticket, WTFMove(task));
+    };
+    vm->deferredWorkTimer->onCancelPendingWork = [clientData](JSC::DeferredWorkTimer::Ticket ticket) -> void {
+        Bun::JSCTaskScheduler::onCancelPendingWork(clientData, ticket);
+    };
 
     vm->clientData = clientData; // ~VM deletes this pointer.
     clientData->m_normalWorld = DOMWrapperWorld::create(*vm, DOMWrapperWorld::Type::Normal);

src/bun.js/bindings/BunObject.cpp

@@ -284,7 +284,7 @@ static JSValue constructBunShell(VM& vm, JSObject* bunObject)
     auto* globalObject = jsCast<Zig::GlobalObject*>(bunObject->globalObject());
     JSFunction* createParsedShellScript = JSFunction::create(vm, bunObject->globalObject(), 2, "createParsedShellScript"_s, BunObject_callback_createParsedShellScript, ImplementationVisibility::Private, NoIntrinsic);
     JSFunction* createShellInterpreterFunction = JSFunction::create(vm, bunObject->globalObject(), 1, "createShellInterpreter"_s, BunObject_callback_createShellInterpreter, ImplementationVisibility::Private, NoIntrinsic);
-    JSC::JSFunction* createShellFn = JSC::JSFunction::create(vm, shellCreateBunShellTemplateFunctionCodeGenerator(vm), globalObject);
+    JSC::JSFunction* createShellFn = JSC::JSFunction::create(vm, globalObject, shellCreateBunShellTemplateFunctionCodeGenerator(vm), globalObject);
 
     auto scope = DECLARE_THROW_SCOPE(vm);
     auto args = JSC::MarkedArgumentBuffer();
@@ -348,8 +348,8 @@ static JSValue constructBunPeekObject(VM& vm, JSObject* bunObject)
 {
     JSGlobalObject* globalObject = bunObject->globalObject();
     JSC::Identifier identifier = JSC::Identifier::fromString(vm, "peek"_s);
-    JSFunction* peekFunction = JSFunction::create(vm, peekPeekCodeGenerator(vm), globalObject->globalScope());
-    JSFunction* peekStatus = JSFunction::create(vm, peekPeekStatusCodeGenerator(vm), globalObject->globalScope());
+    JSFunction* peekFunction = JSFunction::create(vm, globalObject, peekPeekCodeGenerator(vm), globalObject->globalScope());
+    JSFunction* peekStatus = JSFunction::create(vm, globalObject, peekPeekStatusCodeGenerator(vm), globalObject->globalScope());
     peekFunction->putDirect(vm, PropertyName(JSC::Identifier::fromString(vm, "status"_s)), peekStatus, JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontDelete | 0);
 
     return peekFunction;

src/bun.js/bindings/BunProcess.cpp

@@ -1815,7 +1815,7 @@ static JSValue constructStdioWriteStream(JSC::JSGlobalObject* globalObject, int
     auto& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    JSC::JSFunction* getStdioWriteStream = JSC::JSFunction::create(vm, processObjectInternalsGetStdioWriteStreamCodeGenerator(vm), globalObject);
+    JSC::JSFunction* getStdioWriteStream = JSC::JSFunction::create(vm, globalObject, processObjectInternalsGetStdioWriteStreamCodeGenerator(vm), globalObject);
     JSC::MarkedArgumentBuffer args;
     args.append(JSC::jsNumber(fd));
 
@@ -1870,7 +1870,7 @@ static JSValue constructStdin(VM& vm, JSObject* processObject)
 {
     auto* globalObject = Bun__getDefaultGlobalObject();
     auto scope = DECLARE_THROW_SCOPE(vm);
-    JSC::JSFunction* getStdioWriteStream = JSC::JSFunction::create(vm, processObjectInternalsGetStdinStreamCodeGenerator(vm), globalObject);
+    JSC::JSFunction* getStdioWriteStream = JSC::JSFunction::create(vm, globalObject, processObjectInternalsGetStdinStreamCodeGenerator(vm), globalObject);
     JSC::MarkedArgumentBuffer args;
     args.append(JSC::jsNumber(STDIN_FILENO));
 
@@ -2583,7 +2583,7 @@ static JSValue constructProcessNextTickFn(VM& vm, JSObject* processObject)
         nextTickQueueObject = jsCast<Bun::JSNextTickQueue*>(globalObject->m_nextTickQueue.get());
     }
 
-    JSC::JSFunction* initializer = JSC::JSFunction::create(vm, processObjectInternalsInitializeNextTickQueueCodeGenerator(vm), lexicalGlobalObject);
+    JSC::JSFunction* initializer = JSC::JSFunction::create(vm, globalObject, processObjectInternalsInitializeNextTickQueueCodeGenerator(vm), lexicalGlobalObject);
 
     JSC::MarkedArgumentBuffer args;
     args.append(processObject);

src/bun.js/bindings/BunString.cpp

@@ -7,7 +7,7 @@
 #include "JavaScriptCore/JSCJSValue.h"
 #include "JavaScriptCore/PutPropertySlot.h"
 
-#include "simdutf.h"
+#include "wtf/SIMDUTF.h"
 #include "JSDOMURL.h"
 #include "DOMURL.h"
 #include "ZigGlobalObject.h"
@@ -205,7 +205,8 @@ BunString toStringRef(WTF::StringImpl* wtfString)
     return { BunStringTag::WTFStringImpl, { .wtf = wtfString } };
 }
 
-BunString toStringView(StringView view) {
+BunString toStringView(StringView view)
+{
     return {
         BunStringTag::ZigString,
         { .zig = toZigString(view) }

src/bun.js/bindings/CommonJSModuleRecord.cpp

@@ -308,20 +308,22 @@ void RequireFunctionPrototype::finishCreation(JSC::VM& vm)
 {
     Base::finishCreation(vm);
     ASSERT(inherits(info()));
+    auto* globalObject = this->globalObject();
 
     reifyStaticProperties(vm, info(), RequireFunctionPrototypeValues, *this);
     JSC::JSFunction* requireDotMainFunction = JSFunction::create(
         vm,
+        globalObject,
         moduleMainCodeGenerator(vm),
-        globalObject()->globalScope());
+        globalObject->globalScope());
 
     this->putDirectAccessor(
-        globalObject(),
+        globalObject,
         JSC::Identifier::fromString(vm, "main"_s),
-        JSC::GetterSetter::create(vm, globalObject(), requireDotMainFunction, requireDotMainFunction),
+        JSC::GetterSetter::create(vm, globalObject, requireDotMainFunction, requireDotMainFunction),
         PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | 0);
 
-    auto extensions = constructEmptyObject(globalObject());
+    auto extensions = constructEmptyObject(globalObject);
     extensions->putDirect(vm, JSC::Identifier::fromString(vm, ".js"_s), jsBoolean(true), 0);
     extensions->putDirect(vm, JSC::Identifier::fromString(vm, ".json"_s), jsBoolean(true), 0);
     extensions->putDirect(vm, JSC::Identifier::fromString(vm, ".node"_s), jsBoolean(true), 0);

src/bun.js/bindings/DOMFormData.cpp

@@ -30,10 +30,13 @@
 
 #include "config.h"
 #include "DOMFormData.h"
+#include "wtf/DebugHeap.h"
 #include <wtf/URLParser.h>
 
 namespace WebCore {
 
+DEFINE_ALLOCATOR_WITH_HEAP_IDENTIFIER(DOMFormData);
+
 DOMFormData::DOMFormData(ScriptExecutionContext* context)
     : ContextDestructionObserver(context)
 {

src/bun.js/bindings/DOMFormData.h

@@ -40,8 +40,11 @@ namespace WebCore {
 template<typename> class ExceptionOr;
 class HTMLElement;
 class HTMLFormElement;
+DECLARE_ALLOCATOR_WITH_HEAP_IDENTIFIER(DOMFormData);
 
 class DOMFormData : public RefCounted<DOMFormData>, public ContextDestructionObserver {
+    WTF_MAKE_FAST_ALLOCATED_WITH_HEAP_IDENTIFIER(DOMFormData);
+
 public:
     using FormDataEntryValue = std::variant<String, RefPtr<Blob>>;
 

src/bun.js/bindings/ImportMetaObject.cpp

@@ -535,7 +535,7 @@ class ImportMetaObjectPrototype final : public JSC::JSNonFinalObject {
         reifyStaticProperties(vm, ImportMetaObject::info(), ImportMetaObjectPrototypeValues, *this);
         JSC_TO_STRING_TAG_WITHOUT_TRANSITION();
 
-        auto mainGetter = JSFunction::create(vm, importMetaObjectMainCodeGenerator(vm), globalObject);
+        auto mainGetter = JSFunction::create(vm, globalObject, importMetaObjectMainCodeGenerator(vm), globalObject);
 
         this->putDirectAccessor(
             this->globalObject(),

src/bun.js/bindings/InternalModuleRegistry.cpp

@@ -41,7 +41,7 @@ static void maybeAddCodeCoverage(JSC::VM& vm, const JSC::SourceCode& code)
     maybeAddCodeCoverage(vm, source);                                                       \
     JSFunction* func                                                                        \
         = JSFunction::create(                                                               \
-            vm,                                                                             \
+            vm, globalObject,                                                               \
             createBuiltinExecutable(                                                        \
                 vm, source,                                                                 \
                 Identifier(),                                                               \

src/bun.js/bindings/JSBundlerPlugin.cpp

@@ -259,7 +259,7 @@ void JSBundlerPlugin::finishCreation(JSC::VM& vm)
             auto* globalObject = init.owner->globalObject();
 
             init.set(
-                JSC::JSFunction::create(vm, WebCore::bundlerPluginRunOnLoadPluginsCodeGenerator(vm), globalObject));
+                JSC::JSFunction::create(vm, globalObject, WebCore::bundlerPluginRunOnLoadPluginsCodeGenerator(vm), globalObject));
         });
 
     this->onResolveFunction.initLater(
@@ -268,7 +268,7 @@ void JSBundlerPlugin::finishCreation(JSC::VM& vm)
             auto* globalObject = init.owner->globalObject();
 
             init.set(
-                JSC::JSFunction::create(vm, WebCore::bundlerPluginRunOnResolvePluginsCodeGenerator(vm), globalObject));
+                JSC::JSFunction::create(vm, globalObject, WebCore::bundlerPluginRunOnResolvePluginsCodeGenerator(vm), globalObject));
         });
 
     this->setupFunction.initLater(
@@ -277,7 +277,7 @@ void JSBundlerPlugin::finishCreation(JSC::VM& vm)
             auto* globalObject = init.owner->globalObject();
 
             init.set(
-                JSC::JSFunction::create(vm, WebCore::bundlerPluginRunSetupFunctionCodeGenerator(vm), globalObject));
+                JSC::JSFunction::create(vm, globalObject, WebCore::bundlerPluginRunSetupFunctionCodeGenerator(vm), globalObject));
         });
 
     this->putDirect(vm, Identifier::fromString(vm, String("onLoad"_s)), jsUndefined(), 0);

src/bun.js/bindings/JSCTaskScheduler.cpp

@@ -15,63 +15,61 @@ extern "C" void Bun__eventLoop__incrementRefConcurrently(void* bunVM, int delta)
 
 class JSCDeferredWorkTask {
 public:
-    JSCDeferredWorkTask(Ticket ticket, Task&& task)
-        : ticket(ticket)
+    JSCDeferredWorkTask(Ref<TicketData> ticket, Task&& task)
+        : ticket(WTFMove(ticket))
         , task(WTFMove(task))
     {
     }
 
-    Ticket ticket;
+    Ref<TicketData> ticket;
     Task task;
+    ~JSCDeferredWorkTask()
+    {
+    }
+
+    JSC::VM& vm() const { return ticket->scriptExecutionOwner()->vm(); }
 
     WTF_MAKE_ISO_ALLOCATED(JSCDeferredWorkTask);
 };
 
 WTF_MAKE_ISO_ALLOCATED_IMPL(JSCDeferredWorkTask);
 
-static JSC::VM& getVM(Ref<TicketData> ticket)
-{
-    return ticket->scriptExecutionOwner()->vm();
-}
-
 static JSC::VM& getVM(Ticket& ticket)
 {
     return ticket->scriptExecutionOwner()->vm();
 }
 
-void JSCTaskScheduler::onAddPendingWork(Ref<TicketData> ticket, JSC::DeferredWorkTimer::WorkKind kind)
+void JSCTaskScheduler::onAddPendingWork(WebCore::JSVMClientData* clientData, Ref<TicketData>&& ticket, JSC::DeferredWorkTimer::WorkType kind)
 {
-    JSC::VM& vm = getVM(ticket);
-    auto clientData = WebCore::clientData(vm);
     auto& scheduler = clientData->deferredWorkTimer;
     Locker<Lock> holder { scheduler.m_lock };
-    if (kind != DeferredWorkTimer::WorkKind::Other) {
-
+    if (kind == DeferredWorkTimer::WorkType::ImminentlyScheduled) {
         Bun__eventLoop__incrementRefConcurrently(clientData->bunVM, 1);
         scheduler.m_pendingTicketsKeepingEventLoopAlive.add(WTFMove(ticket));
     } else {
         scheduler.m_pendingTicketsOther.add(WTFMove(ticket));
     }
 }
-void JSCTaskScheduler::onScheduleWorkSoon(Ticket ticket, Task&& task)
+void JSCTaskScheduler::onScheduleWorkSoon(WebCore::JSVMClientData* clientData, Ticket ticket, Task&& task)
 {
-    auto* job = new JSCDeferredWorkTask(ticket, WTFMove(task));
-    Bun__queueJSCDeferredWorkTaskConcurrently(WebCore::clientData(getVM(ticket))->bunVM, job);
+    auto* job = new JSCDeferredWorkTask(*ticket, WTFMove(task));
+    Bun__queueJSCDeferredWorkTaskConcurrently(clientData->bunVM, job);
 }
 
-void JSCTaskScheduler::onCancelPendingWork(Ticket ticket)
+void JSCTaskScheduler::onCancelPendingWork(WebCore::JSVMClientData* clientData, Ticket ticket)
 {
-    auto& scheduler = WebCore::clientData(getVM(ticket))->deferredWorkTimer;
+    auto* bunVM = clientData->bunVM;
+    auto& scheduler = clientData->deferredWorkTimer;
 
     Locker<Lock> holder { scheduler.m_lock };
     bool isKeepingEventLoopAlive = scheduler.m_pendingTicketsKeepingEventLoopAlive.removeIf([ticket](auto pendingTicket) {
         return pendingTicket.ptr() == ticket;
     });
+    // -- At this point, ticket may be an invalid pointer.
 
     if (isKeepingEventLoopAlive) {
         holder.unlockEarly();
-        JSC::VM& vm = getVM(ticket);
-        Bun__eventLoop__incrementRefConcurrently(WebCore::clientData(vm)->bunVM, -1);
+        Bun__eventLoop__incrementRefConcurrently(bunVM, -1);
     } else {
         scheduler.m_pendingTicketsOther.removeIf([ticket](auto pendingTicket) {
             return pendingTicket.ptr() == ticket;
@@ -91,15 +89,15 @@ static void runPendingWork(void* bunVM, Bun::JSCTaskScheduler& scheduler, JSCDef
     holder.unlockEarly();
 
     if (pendingTicket && !pendingTicket->isCancelled()) {
-        job->task(job->ticket);
+        job->task(job->ticket.ptr());
     }
 
     delete job;
 }
 
 extern "C" void Bun__runDeferredWork(Bun::JSCDeferredWorkTask* job)
 {
-    auto& vm = getVM(job->ticket);
+    auto& vm = job->vm();
     auto clientData = WebCore::clientData(vm);
 
     runPendingWork(clientData->bunVM, clientData->deferredWorkTimer, job);

src/bun.js/bindings/JSCTaskScheduler.h

@@ -1,5 +1,9 @@
 #pragma once
 
+namespace WebCore {
+class JSVMClientData;
+}
+
 #include <JavaScriptCore/DeferredWorkTimer.h>
 
 namespace Bun {
@@ -12,9 +16,9 @@ class JSCTaskScheduler {
     {
     }
 
-    static void onAddPendingWork(Ref<JSC::DeferredWorkTimer::TicketData> ticket, JSC::DeferredWorkTimer::WorkKind kind);
-    static void onScheduleWorkSoon(JSC::DeferredWorkTimer::Ticket ticket, JSC::DeferredWorkTimer::Task&& task);
-    static void onCancelPendingWork(JSC::DeferredWorkTimer::Ticket ticket);
+    static void onAddPendingWork(WebCore::JSVMClientData* clientData, Ref<JSC::DeferredWorkTimer::TicketData>&& ticket, JSC::DeferredWorkTimer::WorkType kind);
+    static void onScheduleWorkSoon(WebCore::JSVMClientData* clientData, JSC::DeferredWorkTimer::Ticket ticket, JSC::DeferredWorkTimer::Task&& task);
+    static void onCancelPendingWork(WebCore::JSVMClientData* clientData, JSC::DeferredWorkTimer::Ticket ticket);
 
 public:
     Lock m_lock;

src/bun.js/bindings/JSEnvironmentVariableMap.cpp

@@ -348,7 +348,7 @@ JSValue createEnvironmentVariablesMap(Zig::GlobalObject* globalObject)
         Identifier::fromString(vm, BUN_CONFIG_VERBOSE_FETCH), JSC::CustomGetterSetter::create(vm, jsBunConfigVerboseFetchGetter, jsBunConfigVerboseFetchSetter), BUN_CONFIG_VERBOSE_FETCH_Attrs);
 
 #if OS(WINDOWS)
-    JSC::JSFunction* getSourceEvent = JSC::JSFunction::create(vm, processObjectInternalsWindowsEnvCodeGenerator(vm), globalObject);
+    JSC::JSFunction* getSourceEvent = JSC::JSFunction::create(vm, globalObject, processObjectInternalsWindowsEnvCodeGenerator(vm), globalObject);
     RETURN_IF_EXCEPTION(scope, {});
     JSC::MarkedArgumentBuffer args;
     args.append(object);

src/bun.js/bindings/ModuleLoader.cpp

@@ -423,6 +423,7 @@ extern "C" void Bun__onFulfillAsyncModule(
 
     if (auto entry = globalObject->esmRegistryMap()->get(globalObject, specifierValue)) {
         if (entry.isObject()) {
+
             auto* object = entry.getObject();
             if (auto state = object->getIfPropertyExists(globalObject, Bun::builtinNames(vm).statePublicName())) {
                 if (state.toInt32(globalObject) > JSC::JSModuleLoader::Status::Fetch) {