[JSC] A failed check_tdz takes the name of its binding from the instruction - #1014

Reproduce

function field() { class X { name = foo } new X; const foo = 1; }
function derived() { class B { } class X extends B { name = foo } new X; const foo = 1; }
function increment() { x++; let x; }
function compound(log) { log("start"); retries -= 1; let retries; }
function pattern() { [x] = [1]; let x; }
function escaped() { a\u0062c; let abc; }
async function parameter(a = b, b) { await null; }
for (const f of [field, derived, increment, () => compound(() => { }), pattern, escaped]) {
    try { f(); } catch (e) { print(e.message); }
}
parameter().catch(e => print(e.message));
drainMicrotasks();
setTimeout(async (cfg = cfg) => { await null; }, 0);

Node v26.3.0 names the binding in every row. V8 has the name on its check too: ThrowReferenceErrorIfHole(variable->raw_name()) (deps/v8/src/interpreter/bytecode-generator.cc:4908).

History

• Add variable name to ReferenceError #56 (353aa20, June 2024) added the second operand of op_check_tdz, a string constant with the name, and a slow path that read it.
• Upstream's 300119@main (412a6c0, September 2025) gave upstream the same message another way: expression info in front of the checks of five node kinds, and the slow path that this PR removes.
• The merge fc230df (2025-09-20) took upstream's slow path. Its fork parent df8aa4c still reads the operand. From then on nothing read the operand, and every code block still made the constant.
• The same merge dropped two more behaviours of the fork. SpeculativeJIT::compileCallDOM lost its typed array and Int52 cases (188 lines before, 85 after, DFG DOMJIT: fix attemptToMakeCallDOM predicates and restore typed-array/Int52 lowering #318 restores them). The RangeError of JSValue::toIndex lost the value at its end (" cannot be negative: " before, " cannot be negative" after). This PR changes neither.
• Bun 1.2.22 prints 'foo' for the field row and 'x' for x++. Bun 1.2.23 prints '' for both.
• The crash is in Bun 1.3.10 to 1.4.2. Bun 1.3.5 rejects with 'cfg'. The outer half of an async function that awaits is a hidden frame (parser/Parser.cpp:2409).
• Upstream main has the same slow path and the same null read. Its op_check_tdz has one operand, so this change cannot go upstream as it is.

The operand

• The operand is the index of the name in the identifier table plus one. Zero is a check without a name. Only the check of this in a derived constructor has none, and slow_path_check_tdz knows that check by its register, before it reads the operand.
• Upstream's only emitter is emitTDZCheck(RegisterID*). A sync can merge a new call of it for a variable with no conflict. Such a check has operand zero and throws Cannot access uninitialized variable., as Add variable name to ReferenceError #56's slow path did for its undefined constant. With a plain index it would name identifier 0 of the code block, or read past an empty table. ASSERT(target == thisRegister()) in the emitter reports it in a build with assertions.
• No tier reads the operand on the fast path. llint_op_check_tdz, its wide16 and wide32 forms and JIT::emit_op_check_tdz: 0 lines of disassembly differ.

Measurements

The two jsc programs that CI built on the bun-webkit-linux-amd64-lto-aot lane, from 5a61071 (main) and from this branch. Instructions are user-mode instructions from perf_event_open, least of 5 runs, slope between n and 2n, concurrent JIT off.

• The bun-webkit-linux-amd64 lane has no LTO. Its jsc has 46,425,967 and 46,429,167 bytes of text (3,200 more), and slow_path_check_tdz has 418 and 321 bytes. The growth is in 28 functions of the bytecode generator that emit the check, for example AssignBracketNode::emitBytecode (344 bytes more).
• .data and .bss have the same size before and after, on both lanes.
• Calls of getBytecodeIndex for 100 failed checks: 100 on main, 0 here. Counted with a breakpoint, in two builds with symbols made here.

Bytecode of ts.transpileModule on a 6 KB source in the same two jsc programs (--dumpGeneratedBytecodes=1, 1,655 code blocks):

• The 36 new identifier entries are names of bindings that live in a register. A captured binding already has its name in the table, for resolve_scope.
• The 6 bytes are one put_by_id whose identifier index moved from 255 to 256.
• A constant removed is a slot of 8 bytes in the unlinked code block and in each linked one. 482 of the 485 also had a JSString cell of 16 bytes.
• The narrow form holds an operand up to 255. With 246 other names in front, the checks of the stress test have operands 247 to 262: five Narrow, seven Wide16. Before, the narrow form held a constant index up to 111.
• Bun's half has the same counts for four workloads in Bun (ts.transpileModule, prettier, hono, tsc --noEmit). No check changes its width in any of them.

Bytecode cache, jsc shell with JSC_diskCachePath: a payload of main is a cache miss for this branch, which compiles the source again and names the bindings. A payload of this branch is a cache hit on the next run, with the same names. The payload of a 3-line program is 1,800 bytes on main and 1,784 here.

That run isolates the revision. The first word of a payload is computeJSCBytecodeCacheVersion() xor cachedTypesFormatRevision * 0x9E3779B9 (currentCacheVersion()), and GenericCacheEntry::isUpToDate compares it before it decodes anything. The two jsc programs of that run were built here from one tree, and their words are 0x24beeb01 and 0xc6f662c8. Without the revision both are 0x83b6431f. So the payload of main is rejected for its revision alone: [Disk Cache] Cache miss for sourceCode.

In Bun the first part is a hash of WEBKIT_VERSION, so there a payload of another engine differs in both parts.

Tests

• CI of this PR: the seven Test jobs pass (linux amd64 and arm64, lto, lto-aot, lto-hardened and lto-hardened-aot lanes). On bun-webkit-linux-amd64-lto-aot, run-javascriptcore-tests reports 0 failures in more than 125,000 runs of the stress tests.
• JSTests/stress/bun-tdz-error-names-the-binding.js with the jsc that CI built on the lto-aot lane: it passes, alone and with --useAOT=1. With the jsc of main from that lane it reports 65 wrong messages and then ends with a segmentation fault, alone and with --useAOT=1.
• The same test in the 17 modes of run-jsc-stress-tests, with a jsc built here (--without-aot): all pass. It also passes with --forceDebuggerBytecodeGeneration=1, --useTypeProfiler=1, --useControlFlowProfiler=1, --useBytecodeOptimizer=0 and --showPrivateScriptsInStackTraces=1.
• JSTests/modules/bun-tdz-error-names-the-import.js: 11 modes, all pass. With the jsc of main the first wrong message is 'liasCounter)' for typeof (aliasCounter).
• JSTests/stress --quick with a jsc built here: 22,619 runs. 7 fail, none from this change. 5 are BigInt tests that pass the 600 MB of --memory-limited in my build, with the jsc of main too. 2 depend on the load of the machine (auxiliary-evacuation-with-concurrent-compiles.js, regexp-bytecode-of-deeply-nested-fixed-count-groups.js) and pass when they run alone.
• JSTests/ChakraCore.yaml, modules.yaml, es6.yaml and LayoutTests/jsc-layout-tests.yaml with --quick: 5,958 runs. 2 fail (JSON-parse-reviver.js), with the jsc of main too. No expectation of a dead zone message moved.

Order of merges

• [JSC] The function that runs class field initializers is a frame in a stack trace #1003 (draft) makes the function that runs field initializers a frame that stack traces show. Alone it repairs the field initializer rows, because the walk no longer skips that frame. It leaves the outer half of an async function hidden, so the crash and the parameter row stay, and so do the rows in visible frames (x++, x += 1, patterns, escaped names). The two changes do not depend on each other.
• Annotate an impossible 'X is not defined' with why module resolution missed #550 (draft) adds code at the getRange lines of slow_path_check_tdz that this PR removes. It has to rebase. Its dead zone half can take codeBlock->identifier(bytecode.m_identifier - 1) in place of the text.
• [JSC] getBytecodeIndex() gives a builtin frame its own bytecode index #780 lists these defects under "What stays wrong". Its paragraph about slow_path_check_tdz no longer applies after this PR.
• cachedTypesFormatRevision: [JSC] The control flow profiler counts the branches of a decision #894 and [JSC] Store the name default for an anonymous default export #950 take the same next number. Whichever lands later takes the number after it, by hand: git leaves the line outside a conflict. Bun's cache version is a hash of the WebKit commit, so no order is needed for Bun.
• Bun's half (Bump WebKit (oven-sh/WebKit#1014 preview): name the binding in a dead zone ReferenceError bun#48285) pins the preview build of this PR for its CI. Before it lands it pins a commit of main here.

Not changed

• The line and column of the error. They come from the expression info in front of the check, as before. For g(1) on line 3 and x += 1 on line 5 the error says line 3, with and without this PR. [JSC] A frame is where its token starts: a name, a member, a spread, new X(args) and a call of a name #973 touches the emitters in question.
• for (x of y) and for (x in y) with x in its dead zone emit no check, and do not throw.
• The source text that other errors quote when they are made in a hidden frame (appendSourceToErrorMessage, [JSC] getBytecodeIndex() gives a builtin frame its own bytecode index #780 and [JSC] The function that runs class field initializers is a frame in a stack trace #1003).
• A debug build of Bun turns on showPrivateScriptsInStackTraces (src/jsc/bindings/ZigGlobalObject.cpp:435 in oven-sh/bun). Its stack walk skips no frame, so it does not show the defects of hidden frames. That is why Error for accessing classes before initialization displays empty name bun#25569 was closed on a debug build. The self-review proposed to remove that default. It is a choice in Bun, and this PR does not need it: the slow path no longer walks the stack.