Repository navigation
Conversation
…FFI wrappers Drops the inert ENABLE(BINDING_INTEGRITY) scaffolding from 19 generated-style bindings (the vtable check it existed for has been commented out since the files were imported), the EnumTraits tables for HTTPHeaderName and ExceptionCode, IDL converter specializations nothing instantiates (JSDOMConvertPromise.h and JSDOMConvertNull.h go away entirely), ExceptionOr<T&>, the unused opaque-root helpers, and a number of declarations, enumerators, macros and never-taken preprocessor branches in the JSC bindings. On the Rust side removes the unreachable Heap methods in bun_mimalloc_sys, Compressor/Decompressor::destroy in bun_libdeflate_sys, App::run/listen and their imports in bun_uws_sys, and two bun_css leftovers, plus 13 hawk.toml overrides for StatusFlag variants that no longer exist. A source lint pins the removed symbols.
Contributor
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 55 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (70)
Comment |
Collaborator
Author
|
Updated 5:49 PM PT - Aug 14th, 2026
❌ @Jarred-Sumner, your commit 791ffe9 has 2 failures in
🧪 To try this PR locally: bunx bun-pr 38005That installs a local version of the PR into your bun-38005 --bun |
Collaborator
Author
|
Status (head 791ffe9): ready for a maintainer. The
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
I reviewed this PR and didn't find any bugs. Because it removes ~1,500 lines across 71 files in core JSC/WebCore bindings and IDL converter templates, a human look would still be worthwhile before landing.
What was reviewed:
- Confirmed
toJS<IDLPromise<...>>in JSSubtleCrypto short-circuits on void functors (JSDOMConvertBase.h:180/210), so removingJSDOMConvertPromise.his safe. - Confirmed
IDLNullremains defined inIDLTypes.handConditionalConverter<.., IDLNull, false>inJSDOMConvertUnion.hnever touches the removed converter. - Confirmed
jsFunctionBakeGetAsyncLocalStorageis still reached via$newCppFunctionin BakeSSRResponse.ts; only the never-readm_bakeGetAsyncLocalStorageLazyProperty was dropped. - Spot-checked
AbortController::opaqueRoot()returnsWebCoreOpaqueRootby value (matches the sole remaining overload), and thatOnLoadResult::wasMock,m_asUint8Array,DeclarationContext::Keyframes, and the removed BunCommonStrings entries have no remaining readers (including via token pasting / codegen).
Extended reasoning...
Overview
This PR removes ~1,501 lines of unreferenced code across 71 files: inert ENABLE(BINDING_INTEGRITY) scaffolding in 19 generated-style WebCore binding .cpp files, unused IDL converter template specializations (JSDOMConvert*.h), EnumTraits tables, opaque-root helper overloads, unused BunCommonStrings entries, declarations without definitions, unreferenced accessors/fields, dead Rust FFI wrappers in mimalloc_sys/libdeflate_sys/uws_sys, one CSS enum variant, and stale hawk.toml overrides. The only non-deletion is the trailing-comma fix on the last macro entry in BunCommonStrings.h. A new source-lint test pins every removal.
Security risks
None identified. This is pure removal of never-instantiated templates, never-called functions, never-read fields, and preprocessor-dead branches. No control flow, validation, or crypto logic is altered — the RSA-PSS change just unwraps #if 1, and the OpaqueRoot removals leave the one live addWebCoreOpaqueRoot(Visitor&, WebCoreOpaqueRoot) overload intact.
Level of scrutiny
Medium-high. While every individual removal is mechanical and the compiler/linker would catch most mistakes, the change spans template-heavy IDL converters (where a missing specialization surfaces as a confusing instantiation error only when someone later adds a caller), GC opaque-root machinery, and struct-layout-affecting field removals (JSOneShotDirectSink::m_asUint8Array, OnLoadResult::wasMock). The PR description is unusually thorough — every removal is enumerated with its verification method (rg across src/packages/scripts/test/codegen, hawk cross-crate analysis, checked against open PRs). I spot-checked the four riskiest claims (IDLPromise void short-circuit, IDLNull in unions, the Bake LazyProperty, opaque-root overload resolution) and all held.
Other factors
The PR includes a source-lint test that fails on main and passes here, and the description reports a full bun bd build passing plus targeted test runs. CI is still building (#93944). I'm deferring rather than approving because 71 files across core JSC bindings is above my comfort threshold for auto-approval — a maintainer may also want to weigh in on whether any of the removed IDL converter specializations or common strings were intentionally staged for near-term work, and whether the coordination with the several open dead-code PRs (#37062, #37149, #37229, #37328, #37332) is as claimed.
Collaborator
Author
|
Thanks for the pass. On the two points left for a human:
|
This was referenced Aug 13, 2026
Jarred-Sumner
added a commit
that referenced
this pull request
Aug 14, 2026
…c_sys, and orphaned files (#38213) Scheduled dead-code sweep. Areas were chosen to avoid the 17 dead-code PRs currently open (#35437 through #38005): every file below was either untouched by those PRs or, where a file is shared, the hunks are different symbols (checked mechanically against the open PR diffs; the only shared removed lines are `level = "expect"` style TOML boilerplate in unrelated `hawk.toml` blocks). Net: 47 files, about 2.7k lines removed; the only additions are the guard test, three one-line `#[cfg]` / import adjustments, and two doc-comment fixes for functions that went away. ### Removed **WebCore streams bindings (transferable streams were never implemented)** - `m_detached` bitfields on `JSReadableStream`, `JSWritableStream`, `JSTransformStream`: never read or written. - `$bunNativeType` / `$disturbed` private-name accessors on `ReadableStream.prototype` (4 getters/setters, their installs, `m_nativeType`, the reset in `ReadableStream__detach`, the two `BunBuiltinNames.h` entries and `builtins.d.ts` declarations): no builtin, C++ or test referenced either name. `$bunNativePtr` is still used and stays. **TextEncoder** - `TextEncoder::encode` / `encodeInto` / `EncodeIntoResult` and the `convertDictionary<EncodeIntoResult>` / `convertDictionaryToJS` specializations (`TextEncoder.h`, `TextEncoder.cpp`, `JSTextEncoder.h`, `JSTextEncoder.cpp`): the wrapper implements both methods through the Rust `TextEncoder__encode*` exports and only ever calls `impl.encoding()`, which is all that is left of the impl class. **node:crypto** - `JSKeyObject::create` and `JSKeyObject::subspaceFor` plus the `m_subspaceForJSKeyObject` / `m_clientSubspaceForJSKeyObject` slots: every key object is one of the three final subclasses, each of which defines its own `create`/`subspaceFor`; the base class is only used as a downcast target. - Commented-out `switch (m_curve)` block in `CryptoKeyOKP::algorithm()` (2023). **Other bindings** - `WriteBarrierList::list()`, the `WeakRefFinalizeFn` typedef in `Weak.cpp`, `JSC_MAC_VERSION_TBA` / `JSC_IOS_VERSION_TBA` in `root.h` (unused by every JSC header in the WebKit builds we ship against). - `Bun__resolve` host export (`bun_resolve` in `BunObject.rs` + the `extern "C"` declaration in `ImportMetaObject.h`): nothing in C++ or JS called it; the `Bun__resolveSync*` family is what is used. **node:http (`src/js/node/_http_server.ts`)** - `kDeprecatedReplySymbol` is a module-private `Symbol()` in `internal/http` that nothing ever sets on a response's options, so the constructor branch that installed the fetch-`Response` based `write`/`end` was unreachable. Removed it together with everything only it reached: `ServerResponse_writeDeprecated`, `ServerResponse_finalDeprecated`, `ensureReadableStreamController`, `drainHeadersIfObservable`, `emitRequestCloseNT`, `GlobalPromise`, and the now-unused imports (`controllerSymbol`, `firstWriteSymbol`, `deferredSymbol`, `runSymbol`, `emitErrorNextTickIfErrorListenerNT`). This also stops adding an `undefined`-valued `Symbol(deprecatedReply)` own property to every `ServerResponse`. - The `isNextIncomingMessageHTTPS` save/set/restore around request dispatch: the flag's only reader was removed in c4a937c, so the calls had no effect. - A 2025 commented-out `cluster._getServer` block in `Server.prototype.listen`. **Rust** (cross-crate analysis with hawk per `tools/hawk/README.md`, then each item re-checked with `rg`; callers were confirmed to be platform-gated, e.g. `node_fs` uses `sys_uv` on Windows) - `bun_sys`: `link`, `fdatasync` and the non-Linux `sendfile` stub (both the posix and Windows arms), the Windows arms of `fchown`, `chmod`, `chown`, `fsync`, `linkat`, `fchmodat`, `lchmod`, `lchown`, `futimens`, `lutimens`, `fcntl`, `socketpair`, the Windows `Name::as_zstr`, `c::kqueue` / `c::kevent` / `c::fork` / `c::fd_t`, `linux::Errno`, `darwin::OSLog::as_ptr`, the non-macOS `clonefile` stub, the non-Windows `get_fd_path_w` stub, `posix::sysctlbyname` (the typed `sysctl_read*` helpers stay), `posix::write`; and the two helpers that became unreferenced as a result, `linux_syscall::write_raw` and the `safe_libc::fdatasync` import, plus `windows::timespec_to_filetime`. `Tag::futimens` is now `#[cfg(not(windows))]` like the other tags whose only users are posix-side (the Windows `cargo check` flagged it once its Windows user was gone). - `bun_lsquic_sys`: the `Engine` wrapper (struct, impl, `Drop`), `Conn::{raw, set_ctx, ctx, n_avail_streams, sockaddr, status}`, `global_init`, `enable_logging`, `LSQVER_I001/I002`, and the `lsquic_conn_n_avail_streams` extern. `node:quic` drives lsquic through the raw externs directly. - `bun_spawn_sys`: `PosixSpawnResult::close` and the non-Linux `pifd_from_pid` stub (the only call site is Linux-gated). The `FdExt` import that `close` was the last Windows user of is now `#[cfg(unix)]`. - `bun_tcc_sys`: `State::run` and the `tcc_run` extern. - `hawk.toml`: the six `bun_platform` `darwin::Category::*` overrides, whose variants were deleted in #36833 (hawk reports them as `unknown_item`). **Orphaned files** (zero references repo-wide, searched with `git grep` including `.github`, `.buildkite`, `.vscode`, `scripts/`, `packages/` and the generated `build/debug/codegen/`) - `misctools/gdb/std_gdb_pretty_printers.py` (Zig standard-library pretty printers; the repo has no Zig left) and the `.vscode/launch.json` line that sourced it; `misctools/mime.js` (emitted a Zig `ComptimeStringMap`; MIME types now come from `src/http_types/mime_type_list.txt`); `misctools/.gitignore` (ignored outputs of Zig programs deleted long ago). - `patches/ncrypto.patch`: a one-off diff against Node's ncrypto committed with #17692. Unlike every other file under `patches/`, no `scripts/build/deps/*.ts` applies it, and `ncrypto.cpp`/`.h` have changed many times since, so it no longer describes anything. - `meta.json` (stray `--metafile` output committed in #26441), `workspace.code-workspace` (2021 single-folder VS Code workspace with Zig settings; `.vscode/` is the live config). - `src/jsc/bindings/v8-capture-stack-fixture.cjs`, `src/jsc/bindings/webcore/EventNames.in` (WebKit `make_event_factory.pl` input; Bun's `EventNames.h` is hand-written), `src/runtime/ffi/libtcc1.a.macos-aarch64` (superseded by the embedded `libtcc1.c`). - `src/runtime/bake/client/JavaScriptSyntaxHighlighterComponent.tsx` (its header says the client never uses it) and `JavaScriptSyntaxHighlighter.css`, which only it imported. The live `JavaScriptSyntaxHighlighter.ts` is untouched. - `packages/bun-release/scripts/npm-exec.ts` (`upload-npm.ts` bundles only `npm-postinstall.ts` and ships placeholder bins), `packages/bun-usockets/misc/{manual.md,gen_test_certs.sh,layout.png}` and `packages/bun-usockets/module.modulemap` (upstream leftovers, same class as the `bun-uws/misc` files removed in #37659). ### Verification - `rg` / `git grep` for every symbol and file name above across `src/`, `scripts/`, `packages/`, `test/`, `vendor/WebKit/Source` (for the C++ symbols) and freshly regenerated `build/debug/codegen/`. - Rust items come from a hawk `dead_public` report on this tree (release profile, all 11 shipped targets), filtered to items no open PR deletes; findings that are FFI struct fields, code tables, or API added in the last week were deliberately left alone. - `bun bd` builds, and the removed symbols are absent from the resulting binary / bundled JS / `generated_host_exports.rs`. `bun bd test` passes on `test/js/web/streams/streams.test.js`, `test/js/web/encoding/text-encoder.test.js`, `test/js/node/crypto/crypto.key-objects.test.ts`, `test/js/node/fs/fs.test.ts`, `test/js/bun/resolve/import-meta*.test.*` and `test/js/node/quic/quic-stream.test.ts`; `test/js/node/http/node-http.test.ts` passes except "request via http proxy, issue#4295", which fails identically with an unmodified bun in this container (ECONNREFUSED to its local proxy). - `cargo check --workspace` on the windows-msvc, darwin, freebsd, linux-musl, android and linux-gnu targets. - `test/internal/source-lints/dead-symbols-streams-http-misctools.test.ts` pins everything above; all 40 content checks and 16 deleted-file checks fail against main and pass here. ### Left alone (probably dead, not deleted) - `src/simdutf_sys/simdutf.rs`: the whole `utf32` / big-endian wrapper tree (~150 lines, plus its externs and the matching shims in `bun-simdutf.cpp`) has no callers, but #37332 is editing the same extern block; worth a follow-up once that lands. Same story for the unused `Loop` / `uv_stat_t` / `ReturnCode` helpers in `libuv_sys`. - `src/js/internal/http.ts`: `kDeprecatedReplySymbol`, `controllerSymbol`, `runSymbol`, `deferredSymbol`, `firstWriteSymbol` and `get/setIsNextIncomingMessageHTTPS` lost their last users in this PR, but #35437 rewrites that exact region of the file. - The rest of the transferable-streams scaffolding: `JSCrossRealmTransformState` (never created; its only references are its `FOR_EACH_WEB_STREAMS_INTERNAL_STRUCTURE` entry and iso-subspace slots), `CrossRealmTransform.cpp`, and the `SourceKind::CrossRealm` / `SinkKind::CrossRealm` arms with their `case` labels. #37332 is already editing that cluster, so it is best removed as one unit once that lands. - `misctools/gen-unicode-table.ts` + `unicode-generator.ts` emit Zig source, but `src/bun_core/string/identifier.rs` still points at them as the generator to port; `misctools/generate-cli-completions.ts` + `completions/bun-cli.json` and `completions/spec.yaml` have no in-repo consumers but may have external ones. - `src/runtime/bake/{incremental,memory}_visualizer.html` (~800 lines): nothing serves them since the port, but `DevServer` still carries the message writers and stubs, so this looks like an unfinished port rather than dead code. - `packages/bun-inspector-frontend` (build script points at a path that no longer exists) and `packages/bun-build-mdx-rs` (2024 proof of concept) are unreferenced but are a product call. - `bun_shim_impl::read_without_launch` is the Windows `bunx` fast path that nothing calls any more; deleting it would drop a feature rather than a leftover. <!-- robobun:evidence:begin --> --- **[review]** gate passed · iteration 1 · 47 files touched <details><summary>fails on main (without fix)</summary> ```console ASAN without fix: 3 FAILED $ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-streams-http-misctools.test.ts bun test v1.4.0 (59bf369) test/internal/source-lints/dead-symbols-streams-http-misctools.test.ts: 71 | // The Bun__resolve host export had no C++ or JS caller (only Bun__resolveSync 72 | // and its variants are used). 73 | ["src/jsc/bindings/ImportMetaObject.h", /\bBun__resolve\(/], 74 | ["src/runtime/api/BunObject.rs", /HOST_EXPORT\(Bun__resolve,|\bfn bun_resolve\b/], 75 | ]), 76 | ).toEqual([]); ^ error: expect(received).toEqual(expected) - [] + [ + "src/jsc/bindings/webcore/streams/JSReadableStream.h: \bm_detached\b|\bm_nativeType\b", + "src/jsc/bindings/webcore/streams/JSTransformStream.h: \bm_detached\b", + "src/jsc/bindings/webcore/streams/JSWritableStream.h: \bm_detached\b", + "src/jsc/bindings/webcore/streams/JSReadableStream.cpp: bunNativeTypePrivateName|disturbedPrivateName", + "src/js/builtins/BunBuiltinNames.h: macro\((bunNativeType|disturbed)\)", + "src/jsc/bindings/webcore/TextEncoder.h: EncodeInto ... (truncated) release without fix: 3 FAILED bun test v1.4.0-canary.1 (da3851e) test/internal/source-lints/dead-symbols-streams-http-misctools.test.ts: 71 | // The Bun__resolve host export had no C++ or JS caller (only Bun__resolveSync 72 | // and its variants are used). 73 | ["src/jsc/bindings/ImportMetaObject.h", /\bBun__resolve\(/], 74 | ["src/runtime/api/BunObject.rs", /HOST_EXPORT\(Bun__resolve,|\bfn bun_resolve\b/], 75 | ]), 76 | ).toEqual([]); ^ error: expect(received).toEqual(expected) - [] + [ + "src/jsc/bindings/webcore/streams/JSReadableStream.h: \bm_detached\b|\bm_nativeType\b", + "src/jsc/bindings/webcore/streams/JSTransformStream.h: \bm_detached\b", + "src/jsc/bindings/webcore/streams/JSWritableStream.h: \bm_detached\b", + "src/jsc/bindings/webcore/streams/JSReadableStream.cpp: bunNativeTypePrivateName|disturbedPrivateName", + "src/js/builtins/BunBuiltinNames.h: macro\((bunNativeType|disturbed)\)", + "src/jsc/bindings/webcore/TextEncoder.h: EncodeIntoResult|\bencodeInto\b", + "src/jsc/bindings/webcore/TextEncoder.cpp: TextEncoder::encode(Into)?\(", + "src/jsc/bindings/webcore/JSTextEncoder.h: EncodeIntoResult", + "src/jsc/bindings/webco ... (truncated) ``` </details> <details><summary>passes on PR (with fix)</summary> ```console ASAN with fix: all passed $ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-streams-http-misctools.test.ts bun test v1.4.0 (59bf369) test/internal/source-lints/dead-symbols-streams-http-misctools.test.ts: (pass) dead stream slots and other dead C++ bindings do not reappear [33.31ms] (pass) the deprecated-reply ServerResponse path stays out of node:http [21.74ms] (pass) dead Rust wrappers do not reappear [63.04ms] (pass) orphaned files stay deleted [545.87ms] 4 pass 0 fail 4 expect() calls Ran 4 tests across 1 file. [3.00s] __F:0:S:0 release with fix: all passed $ bun scripts/build.ts --profile=release [configured] bun-profile → bun (stripped) in 662ms (unchanged) ninja: Entering directory `/workspace/bun/build/release' [1/130] gen bake.{client,server,error}.js -> bake.client.js, bake.server.js, bake.error.js [2/130] gen generated_host_exports.rs generated_host_exports.rs: 92 exports (host=3, lazy=10, generic=79, rust=0); 239 extern-C blocks audited [3/130] gen cpp.rs (cppbind) [4/130] gen JS modules (bundle-modules) Preprocess modules (9626ms) Bundle modules (50ms) Postprocesss modules (239ms) Bundle Functions (777ms) Generate Code (34ms) [10.75s] Bundled "src/js" for production 2622 kb 197 internal modules 13 native modules 91 internal functions across 17 files [4/129] cargo bun_bin → libbun_rust.a (--target x86_64-unknown-linux-gnu) nightly-2026-07-20-x86_64-unknown-linux-gnu unchanged - rustc 1.99.0-nightly (9f36de775 2026-07-19) �[1m�[92m Compiling�[0m bun_core v0.0.0 (/workspace/bun/src/bun_core) �[1m�[92m Compiling�[0m bun_errno v0.0.0 (/workspace/bun/src/errno) �[1m�[92m Compiling�[0m bun_ptr v0.0.0 (/workspace/bun/src/ptr) �[1m�[92m Compiling�[0m bun_boringssl_sys v0.0.0 (/workspace/bun/src ... (truncated) ``` </details> <details><summary>diff hotspot</summary> ``` .vscode/launch.json | 1 - hawk.toml | 48 -- meta.json | 24 - misctools/.gitignore | 10 - misctools/gdb/std_gdb_pretty_printers.py | 142 ---- misctools/mime.js | 46 -- packages/bun-release/scripts/npm-exec.ts | 13 - packages/bun-usockets/misc/gen_test_certs.sh | 51 -- packages/bun-usockets/misc/layout.png | Bin 10991 -> 0 bytes packages/bun-usockets/misc/manual.md | 180 ---- packages/bun-usockets/module.modulemap | 4 - patches/ncrypto.patch | 919 --------------------- src/js/builtins.d.ts | 2 - src/js/builtins/BunBuiltinNames.h | 2 - src/js/node/_http_server.ts | 209 ----- src/jsc/bindings/ImportMetaObject.h | 1 - src/jsc/bindings/Weak.cpp | 2 - src/jsc/bindings/WriteBarrierList.h | 5 - src/jsc/bindings/node/crypto/JSKeyObject.h | 20 - src/jsc/bindings/root.h | 3 - src/jsc/bindings/v8-capture-stack-fixture.cjs | 15 - src/jsc/bindings/webcore/DOMClientIsoSubspaces.h | 1 - src/jsc/bindings/webcore/DOMIsoSubspaces.h | 1 - src/jsc/bindings/webcore/EventNames.in | 101 --- src/jsc/bindings/webcore/JSTextEncoder.cpp | 56 -- src/jsc/bindings/webcore/JSTextEncoder.h | 4 - src/jsc/bindings/webcore/TextEncoder.cpp | 36 - src/jsc/bindings/webcore/TextEncoder.h | 9 - .../bindings/webcore/streams/JSReadableStream.cpp | 60 +- .../bindings/webcore/streams/JSReadableStream.h | 4 - .../bindings/webcore/streams/JSTransformStream.h | 2 - .../bindings/webcore/streams/JSWritableStream.h | 2 - .../bindings ... (truncated) ``` </details> **gate history** · 1 passed · 1 rejected · iteration 1 <details><summary>evidence per changed file</summary> ``` file reads edits tests .vscode/launch.json 0 0 0 hawk.toml 0 0 0 meta.json 0 0 0 misctools/.gitignore 0 0 0 misctools/gdb/std_gdb_pretty_printers.py 0 0 0 misctools/mime.js 0 0 0 packages/bun-release/scripts/npm-exec.ts 0 0 0 packages/bun-usockets/misc/gen_test_certs.sh 0 0 0 packages/bun-usockets/misc/layout.png 0 0 0 packages/bun-usockets/misc/manual.md 0 0 0 packages/bun-usockets/module.modulemap 0 0 0 patches/ncrypto.patch 0 0 0 src/js/builtins.d.ts 0 0 0 src/js/builtins/BunBuiltinNames.h 0 0 0 src/js/node/_http_server.ts 5 0 0 src/jsc/bindings/ImportMetaObject.h 0 0 0 (+ 31 more files) ``` </details> <!-- robobun:evidence:end --> --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
Jarred-Sumner
added a commit
that referenced
this pull request
Aug 16, 2026
…egen, build scripts, and misc crates (#39249) Removes 2772 lines that nothing references (136 lines of signature, import and formatting adjustments added, plus a 214-line source lint pinning the removed symbols) across the WebCrypto bindings, the node:http internal binding and the C++/Rust behind it, the class code generator, the build scripts, and four Rust crates. No behavior change. ### Problem **WebCrypto (`src/jsc/bindings/webcrypto/`, about 560 lines)** - `SubtleCrypto.cpp` has had `isRSAESPKCSWebCryptoDeprecated()` returning `true` unconditionally since 2023, so every RSAES-PKCS1-v1_5 operation is rejected with `NotSupportedError` before the algorithm class is reached. Its `encrypt`/`decrypt`/`generateKey`/`importKey`/`exportKey` overrides, the whole of `CryptoAlgorithmRSAES_PKCS1_v1_5OpenSSL.cpp`, and `JSRsaKeyGenParams.{cpp,h}` (whose only caller was the unreachable generateKey branch) were dead. `isSafeCurvesEnabled()` is the same shape: always `true`, one never-taken branch. - `CryptoAlgorithmEcdsaParams::encoding` (DER signatures) and the `padding` fields of `RsaPssParams`/`RsaOaepParams` were only ever set by the old `src/bun.js/bindings/KeyObject.cpp`, deleted in April 2025. Since then the DER branches in `CryptoAlgorithmECDSAOpenSSL.cpp`, the padding branches in the PSS/OAEP OpenSSL files, and `platformEncryptWithHash`/`platformDecryptWithHash` ran on constant inputs. The same file left behind the `ignoreExtAndKeyOps` parameter of `convertDictionaryToJS(JsonWebKey)` (no caller passes `true`) and include blocks copied verbatim into `node_crypto_binding.cpp` and `AsymmetricKeyValue.cpp` (neither file uses any of them). - `CryptoAlgorithmMlDsaParams::isolatedCopy()` has no `crossThreadCopy` instantiation, `CryptoAlgorithm::VoidCallback` has no user, `SubtleCrypto::addAuthenticatedEncryptionWarningIfNecessary` is an empty body with two calls, and `CryptoKey.cpp`/`CryptoAlgorithmX25519.cpp` carried includes nothing in the file uses. **node:http binding (`src/js/internal/http.ts`, `NodeHTTP.cpp`, and the Rust it reached, about 880 lines)** - `internal/http.ts` destructures the object returned by `createNodeHTTPInternalBinding` and re-exports the members, but no module imports `getHeader`, `setHeader`, `Headers`, `assignHeaders`, `setRequestTimeout`, `headersTuple`, `webRequestOrResponseHasBodyValue` or `getCompleteWebRequestOrResponseBodyValueAsArrayBuffer` (the last users left with the http client rewrite); `assignEventCallback`, `Request`, `Response` and `Blob` were registered but not even destructured. A few symbols (`kDeprecatedReplySymbol`, `controllerSymbol`, `runSymbol`, `deferredSymbol`, `firstWriteSymbol`, `kEmptyObject`) and `isAbortError`/`get|setIsNextIncomingMessageHTTPS` lost their last reader in earlier sweeps. - That binding object is the only way into `NodeHTTP.cpp`'s `jsHTTPAssignHeaders`, `jsHTTPAssignEventCallback`, `jsHTTPSetTimeout`, `jsHTTPGetHeader` and `jsHTTPSetHeader`, which in turn were the only callers of `assignHeadersFromFetchHeaders`, `assignHeadersFromUWebSockets` (the `...ForCall` variant used by the request path stays) and the `RequestHeaderKind` helpers: about 600 lines of C++. - Those host functions were the only callers of the Rust exports `jsFunctionRequestOrResponseHasBodyValue`, `jsFunctionGetCompleteRequestOrResponseBodyValueAsArrayBuffer` (`Response.rs`), `Request__getUWSRequest`, `Request__setInternalEventCallback`, `Request__setTimeout` (`Request.rs`) and `NodeHTTPResponse__setTimeout` (`NodeHTTPResponse.rs`). `Request__setInternalEventCallback` was the only writer of `Request::internal_event_callback`, and the JS side stopped calling it in 2024, so `InternalJSEventCallback`, the `RequestContext::on_timeout` handler, `set_timeout_handler`, the `HAS_TIMEOUT_HANDLER` flag and its three clear sites, and `AnyRequestContext::enable_timeout_events` have not been reachable since then; `Body::Value::is_definitely_empty` was only used by the removed host function. **Code generators and build scripts (about 1000 lines)** - `generate-classes.ts`/`class-definitions.ts` still emitted code for `.classes.ts` keys no class file sets: `own` (and the `ZigGeneratedClasses.lut.txt` -> `.lut.h` build step in `scripts/build/codegen.ts`, whose output was an empty header), `callbacks`, the `accessor` field variant, `supportsObjectCreate`, `custom`, `zigOnly`, `defaultValue`, plus the `ONLY_ZIG` and `BUN_SILENT` environment switches nothing sets (`git grep` over all 30 `*.classes.ts` files, and `git log -G` for the keys that ever existed). `bundle-functions.ts` handled `$nakedConstructor`, `$sloppy` and `$intrinsic` directives no file in `src/js/builtins` uses, and tracked write-only fields; `generate-jssink.ts`, `replacements.ts` (`OutOfMemoryError` rewrite, no builtin throws it) and `cppbind.ts` had smaller leftovers. `src/runtime/bake/bake.bind.ts` was 100% comments and produced an empty `GeneratedBake.h` nothing includes. - `scripts/utils.mjs` (379 lines: `downloadTarget` and its helpers, `getBuildArtifacts` and its helpers, `getChangedFiles`, `isDocumentation`, `getPullRequestRepository`, `getRepositoryOwner`, `escapeYaml`, `escapeGitHubAction`, `parseNumber`, `getUser`, `isArm64`) and `scripts/runner.node.mjs` (`listArtifactsFromBuildKite`, a local `escapeGitHubAction`) exported functions none of the 11 importers import. `glob-sources.ts` globbed two patterns that have never matched a file; `flags.ts` defined `LIBUS_USE_BORINGSSL`, which nothing in `src/`, `packages/` or `vendor/` reads; `config.ts` carried three resolved fields nothing reads (the `PartialConfig` inputs stay); `depVersionsHeader.ts` and five `deps/*.ts` emitted seven version macros with no consumer in `BunProcess.cpp`, the header's only includer. **Rust crates (about 140 lines)** - `CssModuleReference::Local`/`Global` are never constructed (only `Dependency` is) and `eql` has no caller; `bun_sys` duplicated `NT_UNC_OBJECT_PREFIX`/`_U8` (the live copies are in `bun_paths`) and two Windows send-flag constants the wrappers do not use; `cares_sys::AddrInfo::name` has no caller; `libuv_sys` kept `Loop::{ref_, unref, unref_count, run, tick_with_timeout, wakeup}`, `uv_write_t::write_raw`, `uv_async_t::send`, `Process::get_pid`, `uv_stat_t::{atime, ctime}`, `ReturnCode::from_raw`, `ReturnCodeI64::init`, five type aliases and the two externs only those methods used. These come from the workspace reachability analysis in `tools/hawk/`, run for linux-gnu, darwin and windows-msvc and then re-checked by hand; the items it reported that are used only from `debug_assertions` code (which the release-profile analysis does not see) or only on FreeBSD were kept. ### Fix - Deletes the items above. The only non-deletion edits are the ones the deletions force: the three RSAES rejections in `SubtleCrypto.cpp` become unconditional (same error strings, pinned by `test/js/web/crypto/web-crypto.test.ts`), `isSupportedExportKey` loses an unused parameter, `platformEncrypt`/`platformDecrypt` in RSA-OAEP absorb their one-line `WithHash` wrappers, `RequestContext::set_timeout` keeps its `clear_timeout()` for `0`, one `const` destructure in `internal/http.ts` is reflowed, and `generate-classes.ts` conditions that became constant are folded. - Generator changes were verified by re-running `generate-classes.ts`, `generate-jssink.ts` and `bundle-modules.ts` into a scratch directory and comparing with the output generated before the change: byte-identical except for the dropped `#include "ZigGeneratedClasses.lut.h"` line and the two deleted webcrypto files disappearing from the `NativeFilenameCPP` union. `bun scripts/build.ts --configure-only` confirms `build.ninja` no longer references `GeneratedBake.h`, the `.lut` pair, or `LIBUS_USE_BORINGSSL`, and that the C++ source list changed only by the three deleted files. - Verified: `bun bd` builds; `bun run rust:check-all` passes on all 12 target triples; `cargo fmt --check`, prettier and clang-format are clean. `bun bd test` passes on `test/js/web/crypto/web-crypto.test.ts` (94), `test/js/node/crypto/{crypto.key-objects,crypto-rsa,sign-jwk-ieee-p1363,crypto-pqc,x509}` (162), `test/js/node/http/{node-http,node-http-server-timeouts,node-http-server-abort-events,node-http-res-settimeout-unref}` (151; the one failure, the http proxy test, fails identically with the released binary in this container), `test/js/bun/http/serve.test.ts` (283; the 4 failures, requestIP v6, root-range port, #6583 and /bun:info, fail identically with the released binary here), `test/js/node/http2/node-http2.test.js`, `test/js/node/fs/fs-leak.test.js`, `test/js/bun/udp/dgram.test.ts`, `test/js/node/readline/readline.node.test.ts`, `test/bundler/css/css-modules.test.ts`, `test/js/node/process/process.test.js` (dependency version assertions pass; the `USER` env assertion fails on both binaries here), the nine `test/internal/build-*`/`bindgen`/`macos-cross-config`/`rust-*` tests, `test/js/bun/perf/linker-order.test.ts`, and all of `test/internal/source-lints/` (166). The new `dead-symbols-webcrypto-nodehttp-codegen.test.ts` fails on main and passes here. - Cross-checked against the 19 open dead-code PRs at the line level: no deleted line here is deleted by any of them, except boilerplate lines (`auto& vm = ...`) that #35437 also deletes from a different function in `NodeHTTP.cpp`. Hunks adjacent to open PRs, which will need a trivial rebase on whichever side lands second: the `internal/http.ts` destructure and `NodeHTTP.cpp` registration block (#35437 removes `setServerIdleTimeout` there), the `CryptoKey.cpp` include block (#38005 removes the neighbouring line), `CryptoAlgorithmRSA_PSSOpenSSL.cpp` (#38005's hunk still applies), `class-definitions.ts` (#37208 removes `isEventEmitter`), `generate-classes.ts` (#37149 removes four DOMJIT includes), and `c_ares.rs` (#38703 removes a method 30 lines below). ### Background - `createNodeHTTPInternalBinding` is the C++ function behind `$cpp("NodeHTTP.cpp", ...)` in `internal/http.ts`; it builds a plain object whose properties are JS functions wrapping C++ host functions. A host function registered there is reachable only if some builtin reads the property, which is why the JS import graph decides what is dead in the C++ file. - Rust functions marked `export_name`/`uws_callback(export = ...)` exist for C++ callers; `cppbind`/js2native codegen emits the glue from the sources, so once the last C++ caller is gone they are unreachable, and the workspace lints (`dead_code`/`unused_imports` are `deny`) then flag whatever only they called, which is how the `Request.rs`/`RequestContext.rs` cascade was found and bounded. - `Request::internal_event_callback` was the hook node:http used to be told about per-request timeouts and aborts; `RequestContext::set_timeout_handler` registered the uWS timeout callback only when that hook was set. With no setter, the flag was never set and the handler never registered, so removing them changes nothing at runtime; `server.timeout()` still arms the socket timeout and the abort path is untouched. - `generate-classes.ts` reads every `src/**/*.classes.ts` and emits `ZigGeneratedClasses.{h,cpp}` plus `generated_classes.rs`; a feature of the class definition format that no class uses is dead code in the generator, and its removal is checkable by diffing the generated files. - `tools/hawk/README.md` describes the workspace-wide reachability analysis used for the Rust items: rustc's per-crate `dead_code` lint treats every `pub` item of a library crate as live, so cross-crate dead `pub` items need this separate pass. <details> <summary>Found dead but deliberately left alone</summary> - `bun_shim_impl::read_without_launch` and `FromBunShellContext` (`src/install/windows-shim/bun_shim_impl.rs`) have no caller, but the `LauncherMode::ReadWithoutLaunch` mode is threaded through the launcher, so removing it cleanly means de-generifying `launcher()`; better as its own change. - The write-only `CssModule::references` map itself (this PR removes only the never-constructed variants); the `#[cfg(target_arch = "wasm32")]` branches scattered through the parser/output code (no wasm32 target is built, but earlier commits describe it as "not built yet", so that is a product call); `windows_errno::posix::{mode_t, E}` and `bun_sys::File::write` (unused, but intentional API parity with the POSIX side); `WindowsLoop::{wait, unref}` and the Windows `us_socket_t::write_fd` stub (8 and 7 lines in files three open PRs are editing). - `AnyResponse::on_timeout` / `uws_res_on_timeout` in `bun_uws_sys` lose their last caller with this PR (`set_timeout_handler` was it); left for the next pass since those files are in open PRs. - DOMJIT support in `generate-classes.ts` is disabled on purpose (`define()` strips it), not dead; the split CI build modes in `scripts/build/profiles.ts` were explicitly kept by #37733 four days ago; the `*.idl` files in webcrypto are kept as documentation as in the previous sweeps; the AES-GCM `> UINT64_MAX` checks are upstream-identical. - Every item carrying `#[allow(dead_code)]` in the tree was re-verified and is live on some platform or under `debug_assertions` (the inventory in `dead-code-escape-limits.json` is accurate), so nothing was taken from there. - `CryptoAlgorithmAKPShared.h` does not include `CryptoAlgorithmParameters.h`, so `CryptoAlgorithmMLDSA.cpp` only compiles inside its unified bundle; pre-existing and unrelated to this change. </details> --------- Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
This was referenced Aug 18, 2026
Closed
Jarred-Sumner
pushed a commit
that referenced
this pull request
Aug 18, 2026
… and misc crates (#39574) ### Problem - `src/jsc/bindings/libuv/` is only on the include path for non-Windows builds (`scripts/build/flags.ts`, "libuv stubs for unix"). `uv/win.h` (703 lines) and `uv/tree.h` (512 lines, included only by `win.h`) are never reached. - `uv/sunos.h`, `uv/os390.h`, `uv/aix.h` and `uv/posix.h` are selected by `uv/unix.h` only on Solaris, z/OS, AIX, IBM i, Cygwin, Haiku, QNX and Hurd. Bun builds for linux, macOS and FreeBSD. - `packages/bun-error` is embedded in the dev error page (`src/runtime/server/dev-error-page.html`). The page calls the function behind `Symbol.for("Bun__renderFallbackError")` and nothing else. `renderRuntimeError`, the abort state `dismissError` kept for it, and the two modules only it imported (`sourcemap.ts`, `stack-trace-parser.ts`) have no callers. #37081 lists this path as a follow-up. - `bun_zlib_sys::posix` and `bun_zlib_sys::win32` declare zlib functions that nothing calls. `bun_zlib` declares its own. The only use of the two modules was as re-exports of the types in `shared.rs`. - A set of `pub` items in other crates has no user in any crate. rustc cannot report them because `pub` items count as used. ### Fix - Delete the six libuv headers. `uv.h` now includes `uv/unix.h` directly. `uv/unix.h` keeps the linux, darwin and BSD branches. `uv-posix-polyfills.c` drops the commented-out copies of the removed branches. - Delete `renderRuntimeError`, `sourcemap.ts` and `stack-trace-parser.ts`. `dismissError` keeps the part that removes the overlay. `runtime-error.ts` stays (it has a test). - Delete `bun_zlib_sys/posix.rs` and `win32.rs`. `bun_zlib` imports the types from `bun_zlib_sys::shared`, which is where the removed modules took them from. - Delete the unused Rust items listed below, plus the trait implementations and imports that only they needed. Verification: - Every Rust item was found by making the unexported items crate-private and compiling the workspace. An item is deleted only if rustc reports it dead on x86_64 linux (dev, release, and with the `bun_debug` and `bun_asan` cfgs), aarch64 linux, x86_64 musl, x86_64 Windows and aarch64 macOS. - Each removed name was also searched in `src/codegen/`, the `*.classes.ts` files, `src/js/` and the C++ bindings. Items that a codegen template can emit were kept. - `bun run rust:check-all`: 12 of 12 targets pass. `cargo check --workspace --all-targets` passes (benches and unit tests still compile). `cargo check -p bun_shim_impl --features shim_standalone` for the Windows target passes. - `bun bd` builds. The build recompiles `uv-posix-stubs.c` and `uv-posix-polyfills.c` against the trimmed `uv.h`, and rebuilds the bun-error bundle, which no longer exports `renderRuntimeError`. - New test in `test/js/bun/http/serve.test.ts`: it takes the bun-error bundle out of a real 500 page, evaluates it outside a browser, and checks that the bundle registers the renderer and that `dismissError` is a no-op when nothing is rendered. This is the surface the `packages/bun-error` change touches. - `bun bd test` passes for `test/js/bun/http/serve.test.ts -t "dev error page"` (including the new test), `test/js/bun/runtime-error.test.ts`, `test/js/bun/util/{zstd,arraybuffersink,filesink}.test.ts`, `test/js/node/zlib/deflate-streaming.test.ts`, `test/js/web/encoding/text-{encoder,decoder}.test.*`, `test/js/workerd/html-rewriter.test.js`, `test/js/bun/css/nth-anplusb-ident.test.ts`, `test/js/web/fetch/blob.test.ts` and `test/internal/source-lints/dead-code-escapes.test.ts`. - `cargo fmt --check`, clang-format on the touched C file and prettier on the touched TypeScript files pass. <details> <summary>Removed Rust items</summary> - `bun_zlib_sys`: modules `posix` and `win32` (`struct_gz_header_s`, `gz_header`, `gz_headerp`, `in_func`, `out_func`, and the `deflate*`, `inflate*`, `compress*`, `uncompress`, `adler32`, `crc32`, `zlibVersion` declarations), `shared::voidpf`. - `bun_zlib`: declarations `compress`, `compressBound`, `uncompress`, and the `internal` module that selected between the two removed modules. - `bun_zstd`: `decompress` (every caller uses `decompress_append`). - `bun_libdeflate_sys`: `libdeflate_deflate_decompress` (the `_ex` variant is the one in use). - `bun_mimalloc_sys`: `mi_strdup`, `mi_heap_collect`, `mi_thread_set_in_threadpool`. - `bun_cares_sys`: `ares_strerror`. - `bun_windows_sys`: `SetHandleInformation`, `closesocket`. - `bun_alloc`: `default_alloc::calloc`. - `bun_core`: `GenericIndexInt::from_usize` and its macro-generated implementations. - `bun_css`: the four deprecated `to_css` methods on `GenericSelectorList`, `GenericSelector`, `GenericComponent` and `Combinator`. Their bodies were `unreachable!()`; the serializer functions replaced them. - `bun_runtime`: `JsSinkType::done` and its six overrides, `FileCloser::update` and its implementations, `ReadableStream::to_js`, `node_fs::Null::to_js`. </details> <details> <summary>Overlap with open pull requests</summary> The deletions here were checked against the open dead-code pull requests (#35437, #35775, #35880, #36115, #36237, #37012, #37149, #37181, #37208, #37301, #37454, #37659, #37788, #38005, #38900, #39319, #39561) and against #38958 and #35075. Nothing deleted here is deleted by any of them. Candidates they already cover were left out: `src/jsc/bindgen.rs` (#37149), the dead `pub use` re-exports (#39319), the simdutf big-endian and UTF-32 wrappers (#38958), and the items named in the skip lists of the others. Some files here (`bun_alloc/lib.rs`, `bun_core/util.rs`, `libdeflate.rs`, `mimalloc.rs`, `node_fs.rs`, `Blob.rs`, `FileSink.rs`, `ReadableStream.rs`, `streams.rs`, `windows_sys/externs.rs`) are also touched by open pull requests in different hunks. #36437 edits `packages/bun-error` from a base that predates #37081; it changes one import line in `stack-trace-parser.ts` and keeps `renderRuntimeError`, so it does not overlap with this deletion but will need a rebase. </details> <details> <summary>Found but not deleted (judgment calls for a maintainer)</summary> - `packages/bun-inspector-protocol/src/protocol/v8/` (about 32,600 lines): not exported by the package index since 2023 and regenerated only with the opt-in `--v8` flag of `scripts/generate-protocol.ts`. #39110 kept the flag, so this needs a decision. - `packages/h3blast` (1,468 lines) and `packages/bun-build-mdx-rs` (558 lines): nothing in the repository references them. They may be kept on purpose as a load generator and a proof of concept. - `packages/bun-error/runtime-error.ts` is unused by the page but covered by `test/js/bun/runtime-error.test.ts`. The four images in `packages/bun-error/img/` are referenced only by the source glob in `scripts/glob-sources.ts`. - `HotReloadTaskView` in `src/jsc/hot_reloader.rs`: both `reload` implementations ignore the task, and `VirtualMachine::reload` ignores its `Option<HotReloadTask>` argument. Removing the plumbing is a small refactor rather than a deletion. - `react_compiler/compile_result.rs` has constructors and fields with no users, but the file says the types are waiting to be wired up. - The streams-era private globals in `BunBuiltinNames.h` (`makeGetterTypeError`, `makeDOMException`, `addAbortAlgorithmToSignal`, `removeAbortAlgorithmFromSignal`, `isAbortSignal`, `createUninitializedArrayBuffer`, about 100 lines of `ZigGlobalObject.cpp`) have no JS callers. Both files are being edited by several open dead-code pull requests, so they were left for a later run. </details> ### Background - rustc's `dead_code` lint treats every `pub` item in a library crate as used, because another crate could import it. In this workspace every crate is an implementation detail of one binary, so a `pub` item with no importer in any crate is dead in the same sense as a private one. Making such items crate-private for one compile lets rustc report the ones with no users at all. The visibility changes themselves are not part of this pull request. - On POSIX, bun does not link libuv. Node-API addons that reference libuv symbols get `uv-posix-stubs.c` and `uv-posix-polyfills*.c`, which are compiled against the copied headers in `src/jsc/bindings/libuv/`. On Windows the real libuv is linked and that directory is not used. - `JsSinkType` is the Rust trait behind the native sink classes (`FileSink`, `ArrayBufferSink`, the HTTP response sinks). Its methods are called from the shared sink glue in `Sink.rs`; `done` was declared there but the glue never called it. <!-- robobun:evidence:begin --> --- **no test proof** · iteration 1 · Platform-specific test(s) that do not run on this machine. Deferring to CI, which covers all platforms: test/js/bun/http/serve.test.ts <!-- robobun:evidence:end -->
Collaborator
|
Closing as stale: this has merge conflicts with main. If the dead code is still present, please open a fresh PR against current main. |
This was referenced Aug 19, 2026
Jarred-Sumner
pushed a commit
that referenced
this pull request
Aug 21, 2026
…uilt-in JS, bindgen, uSockets, and 66 Cargo manifests (#39732) ### Problem - The tree carries code that nothing references: FFI shims with no caller on either side, enum variants that are never constructed, write-only fields, exports that no module imports, and Cargo dependency edges that no source file uses. - 16 dead-code PRs that removed much of this were closed as stale after merge conflicts. Their deletions were never re-applied (list in the notes). ### Fix - Re-apply the deletions that still apply to current main and add new ones in the same areas: `simdutf_sys`, `ncrypto` and the WebCore bindings, `js_parser`, `bundler`, `js_printer`, `bun_install`, built-in JS, bindgen, uSockets, and 66 Cargo manifests. 176 files, +95 / -3129 (`Cargo.lock` is -436 of that). - Every deletion was checked again with `rg` over `src/`, `packages/`, `src/codegen/` and the generated code. Items that became live again since the old PRs stay (examples in the notes). - No deletion duplicates an open dead-code PR. Deletions that need #39618 or #39697 to land first are listed as follow-ups in the notes. - Verified: `bun bd`, `bun run rust:check-all` (12 targets pass), byte-identical bindgen output, `test/internal/source-lints`, and the test files of the touched areas (list in the notes). New tests in `transpiler.test.js` and `bundler_edgecase.test.ts` pin the two diagnostics that `mark_strict_mode_feature` still emits and the class body printing that `visit_class` still does. ### Background - A Rust `extern "C"` declaration with no call site creates no link reference, so a dead FFI chain is removed on both sides at once. Three C++ definitions whose Rust side #39618 removes stay until that PR lands. - `cargo check` covers the host target only. `rust:check-all` repeats it for every shipped target, which proves the `#[cfg]`-gated deletions and the Windows-only dependency removal (`bun_sys` -> `bun_output`). - The dependency removals are manifest-only. `Cargo.lock` loses the matching entries and nothing else: no version changes. <details><summary>Notes</summary> **Closed PRs re-applied**: #35437, #35559, #35775, #35880, #36115, #36237, #37012, #37062, #37089, #37208, #37272, #37454, #37788, #38005, #38439, #38703. **Kept because they are live again on main**: `GenericIndexOptional::{get, is_some, is_none}`, the WebSocket deflate `OutOfMemory` variants, `V8Local::reinterpret`, `SystemErrno::MAX`, `MarkPopErrorOnReturn::peekError`, `ResourceTiming::populateServerTiming`, `UvHandle` in `test/parallel/Channel.rs`, the `h2::FrameType` entries that `hawk.toml` marks as a code table. **Tests run**: node-http, node-http2, fetch headers, streams, readable-stream-blob-consumed, filesink, transpiler, buffer, url, FormData, TextEncoder, MessageChannel, serve-direct-readable-stream, serve-body-leak, crypto key objects, crypto-rsa, scrypt, pbkdf2, sqlite-sql, local-sql, postgres-simple-query-pipeline, sql-helpers-validation, bun-outdated, websocket-server, test/internal (bindgen, codegen outputs, source lints). The `localhost` proxy test in node-http and the concurrent WebSocket send tests fail the same way on unmodified main in this environment (the first is a `localhost` resolution issue, the second is the 300k-message benchmark starving its concurrent neighbours in a debug build). **By kind**: C/C++ -1327, Rust -702 (+75, mostly signature updates at call sites), built-in JS/TS -130, codegen TS -75 (+13), Cargo manifests -459, `Cargo.lock` -436. **simdutf_sys** (`simdutf.rs`, `bun-simdutf.cpp`, `parsers/benches/support/simdutf_shim.cpp`): 16 shim chains with no caller, each removed as Rust wrapper + `extern` declaration + C++ definition: `simdutf__convert_utf8_to_utf16le`, `_utf16be`, `_utf16be_with_errors`, `convert_utf8_to_utf32_with_errors`, `convert_valid_utf8_to_utf32`, `convert_utf16be_to_utf8_with_errors`, `convert_valid_utf16be_to_utf8`, `convert_utf32_to_utf8_with_errors`, `convert_valid_utf32_to_utf8`, `convert_utf32_to_utf16be_with_errors`, `convert_valid_utf32_to_utf16be`, `convert_utf16be_to_utf32_with_errors`, `convert_valid_utf16be_to_utf32`, `utf8_length_from_utf16be`, `utf32_length_from_utf16be`, `utf32_length_from_utf8`, plus the now empty `utf32` modules and the `be` wrappers. **ncrypto** (`ncrypto.h/.cpp`): `BignumPointer::isOne`, `X509View::ifRsa`, `X509View::ifEc`, `BIOPointer::NewFp`, `checkScryptParams`, `scrypt`, `pbkdf2`, `EVPKeyCtxPointer::setRsaMgf1Md`, `Rsa::encrypt`, `Rsa::decrypt` and the `RSA_Cipher` template, `Cipher::ForEach` with `CipherCallbackContext`/`array_push_back`, `NCRYPTO_REQUIRE`, `NCRYPTO_VERSION` and the version enum. **JSC / WebCore bindings**: `ZigGlobalObject`: `functionFulfillModuleSync` (and the `fulfillModuleSync` builtin name plus `$fulfillModuleSync` stub), `JSDOMFileConstructor_getter/_setter`, `navigatorObject`, `functionLazyNavigatorGetter`, `GlobalObject_getPerformanceObject`, `hasNapiFinalizers`, `jsFunctionNotImplemented`, `jsFunctionCreateFunctionThatMasqueradesAsUndefined`, `Zig__GlobalObject__getModuleRegistryMap`/`resetModuleRegistryMap`, `NodeVM*ModulePrototype()` accessors, `ZIG_GLOBAL_OBJECT_DEFINED`. `BunString.cpp`: `Bun__WTFStringImpl__ref`/`deref` definitions (Rust inlines these; #39618 removes the declarations). `JSBuffer.cpp`: the `JSValue`-name `validateOffset` overload and the three unused `jsBufferConstructorAlloc*WithoutTypeChecks` JIT operations. `NodeValidator`: `validateString(JSValue name)` and `validateOneOf(span<ASCIILiteral>)`. `ScriptExecutionContext`: `ensureOnMainThread`, `executionContext`. `napi.h`: `hasFinalizers`, `currentFinalizer`, `isVMTerminating`. `IDLTypes.h`: `IDLDate`, the `NullableTypeWithLessPadding` helpers and two includes. `BunProcess.cpp`: three unused `*CodeGenerator` aliases. `c-bindings.cpp`: `HNS_PER_SEC`, `NS_PER_HNS`, `HNS_PER_US`. `BunCommonStrings.h`: `ConnectionWasClosed`, `ec`, `ed25519`, `rsa`, `rsaPss`, `jwkDsa`, `jwkG`, `systemError`, `x25519`. `BakeAdditionsToGlobalObject.h`: the never-read `m_bakeGetAsyncLocalStorage` lazy property (the function is still installed directly) and the `LazyPropertyOfGlobalObject` alias. `JSBundlerPlugin.cpp`: the `JSBundlerPlugin__onVirtualModulePlugin` declaration, which has no definition. WebCore: `DeferredPromise::whenSettled` and the `PromiseFunction`/`BindingPromiseFunction` adapters, `JSEventListener::sourceURL/sourcePosition`, `Event::receivedTarget`, `toJS(PerformanceObserverCallback)` and `callbackData()`, `jsFetchHeaders_getRawKeys` (its only caller in `internal/http.ts` is removed too), stale forward declarations in `Performance.h`/`ResourceTiming.h`, and the commented-out `BINDING_INTEGRITY` blocks in 8 generated-style files. `node/crypto`: `JSPrivateKeyObjectConstructor` and `JSPublicKeyObjectConstructor` (4 files, superseded by `JSKeyObjectConstructor`). Bake: `BakeRegisterProductionChunk`, `BakeProdSourceMap`, `BakeProduction.h`, the `IncrementalGraph` log scope. **uSockets**: `us_poll_ext`, `us_loop_iteration_number`, `us_socket_is_tls`, `us_connecting_socket_get_loop`, `us_udp_packet_buffer_local_ip` / `bsd_udp_packet_buffer_local_ip`. **Rust**: `js_parser`: the six `StrictModeFeature` variants that are never constructed (and the `can_be_transformed` branch), `FnOnlyDataVisit::{class_name_ref, should_replace_this_with_class_name_ref, is_inside_async_arrow_fn}` with the `this` substitution path that was gated on the always-false flag (the `shadow_ref` arena cell becomes a plain `Ref`). `bundler`: `Linker::{resolver, hashed_filenames}`, `IS_CACHE_ENABLED`, `InputFileFlags::IS_PLUGIN_FILE`, `parse_task::Step::ReadFile`. `js_printer`: the write-only `Options::transform_only`. `bun_install`: `CacheBehavior`/`ManifestLoad` (every caller passed `LoadFromMemoryFallbackToDisk`, so the parameter and the memory-only branch are gone from `by_name`, `by_name_hash` and `by_name_hash_allow_expired`), `pub use patch_install as patch`. `webcore`: `ReadableStream::detach_if_possible` (empty) and the `global` parameter of `done()`, `BlobExt::{on_structured_clone_transfer, get_mime_type}`, six `StartTag` variants that no sink uses. `server`: `AnyRoute::ref_`, the write-only `OPENED_BIT`. `bun_core`: `concat`, `ExternalShared::as_ptr`, `QuoteEscapeFormatFlags::ascii_only`. `bun_io`: stale `Waker`/`Closer` re-exports. `bun_sys`: `UTIME_OMIT`. `cli`: the never-read `IS_MAIN_THREAD` thread local. `css`: `DeclarationContext::Keyframes`, the empty `generated_color_conversions` module. `html_rewriter`: the `EndTag.replace` host function that `html_rewriter.classes.ts` does not expose. **Built-in JS/TS**: `internal/http.ts`: 29 unused symbol constants, `filterEnvForProxies`, `getRawKeys`, `emitCloseNTAndComplete`, `ClientRequestEmitState`. `node/http2.ts`: `kSettingNames`, three unused primordials. `internal/sql/query.ts` and `internal/repl/node-shims.js`: export entries nothing imports, and the `BuiltinModule` shim methods nothing calls. `builtins.d.ts`: 8 stubs for builtin names that no longer exist. **bindgen** (`src/codegen/bindgen*.ts`): `allFunctions`, `ArgStrategyChildItem`, `Variant.argStruct`, `Struct.namespace`/`toString`, `FuncMetadata`/`exposedOn`/`ExposedOn`, `FuncWithoutOverloads`, the dead `debug` binding, two shadowed duplicate `case` labels and an unreachable `return`. Generated output is byte-identical. **Cargo**: 459 dependency lines across 66 manifests (mostly the `strum`/`bstr`/`scopeguard`/`const_format`/`enum-map`/`enumset`/`libc`/`bitflags` boilerplate block, plus 94 `bun_*` edges such as `bun_jsc -> bun_simdutf_sys` and `bun_bundler_jsc -> 8 crates`). One dev-dependency (`bun_router -> bun_js_parser`, checked with `cargo check -p bun_router --tests`). The manifests that #39618 and #39697 already edit (`collections`, `io`, `paths`, `css`, `shell_parser`, `sql`, `sql_jsc`) were left alone. **Rebase note**: main restructured the private builtin function registration in `ZigGlobalObject::addBuiltinGlobals` into a table (#39770). The conflict was resolved by dropping the `k_fulfillModuleSync` row from the new table, which is the same registration the first version of this PR removed. #39770 also touched the two `JS*KeyObjectConstructor.h` files before this PR deletes them; they are still unreferenced on main, so the deletion stands. Re-verified after the rebase: `bun bd`, `rust:check-all` 12/12, and the test files listed above. **Follow-ups once open PRs land** (not done here to avoid duplicating them): after #39618: the C++ definitions of `URL__fromJS` (BunString.cpp) and `Bun__allocUint8ArrayForCopy` (ZigGlobalObject.cpp), the seven `<Sink>()` constructor accessors in `ZigGlobalObject.h` that only the generated `__getter` functions use, the Rust `extern` declarations of `Bun__WTFStringImpl__ref/deref`, and `BufferWriter::append_null_byte` (no writer ever sets it to true). After #39697: the root `[workspace.dependencies] typed-arena` entry. Independently of those: the `DeferredPromise::{promise, resolve(), reject(...)}` overloads and `DOMPromise::whenPromiseIsSettled` have no callers but sit next to code #39618 edits. </details> <!-- robobun:evidence:begin --> --- **no test proof** · iteration 1 · Platform-specific test(s) that do not run on this machine. Deferring to CI, which covers all platforms: test/bundler/bundler_edgecase.test.ts <!-- robobun:evidence:end -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes 1,501 lines of code nothing references (the one modified line is the tail of a macro list), across the WebCore/JSC C++ bindings, a few Rust FFI wrapper crates, and stale hawk.toml overrides. No behavior change: everything removed was either never compiled into anything, never instantiated, or written and never read.
How the candidates were found
hawkanalysis configured inhawk.toml(release profile unioned over the 11 shipped targets) run against current main. Almost all of its 1218dead_publicfindings sit in files that one of the open dead-code PRs already touches; those were left alone, and the remainder was re-checked withrg(hawk only analyzes the release profile, so e.g.ntstatus::ACCESS_DENIED, which has a debug-only reader, was kept).rgacrosssrc/,packages/,scripts/,test/and freshly regeneratedbuild/debug/codegen/, and symbol by symbol against the diffs of the open PRs that touch the same files (no overlap;JSDOMConvert.his also touched by Remove dead code from webcore bindings, watcher, node-fallbacks, and misc crates #37062, on a different include line).src/js/was scanned as well and is clean (oxlint's unused checks keep it that way); nothing from there is in this PR.Removed
ENABLE(BINDING_INTEGRITY)scaffolding in 19 generated-style bindings (536 lines)JSAbortController,JSAbortSignal,JSBroadcastChannel,JSCloseEvent,JSCustomEvent,JSDOMFormData,JSDOMURL,JSMessageChannel,JSMessageEvent,JSMessagePort,JSPerformanceMark,JSPerformanceObserver,JSPerformanceObserverEntryList,JSPerformanceServerTiming,JSPerformanceTiming,JSTextEncoder,JSWebSocket,JSWorker,JSSubtleCrypto(.cpp). TheRELEASE_ASSERT(actualVTablePointer == expectedVTablePointer)these blocks exist for has been commented out since the files were imported, so the file-scope block only declared an unused_ZTV...vtable symbol and theif constexpr (std::is_polymorphic_v<T>)body intoJSNewlyCreatedwas empty after preprocessing (its only remaining statement sits underPLATFORM(WIN), which is never true in aBUILDING_JSCONLY__build).JSURLPattern.cppstill performs the check and is untouched;JSFetchHeaders.cpp/JSPerformance.cpphave the same blocks but are claimed by open PRs.IDL conversion layer (
webcore/JSDOMConvert*.h)JSDOMConvertPromise.h(whole file) and its include inJSSubtleCrypto.cpp: everytoJS<IDLPromise<...>>call there passes avoid-returning functor, whichJSDOMConvertBase.hshort-circuits without instantiating the converter;Converter<IDLPromise>had no callers. Cascade:DOMPromise::create(),promise()and the constructor inJSDOMPromise.h(only the staticwhenPromiseIsSettledremains in use).JSDOMConvertNull.h(whole file) and its includes inJSDOMConvert.h/JSDOMConvertUnion.h: no union namesIDLNull, andConditionalConverter<.., IDLNull, false>never touches the converter.Converter/JSConverterforIDLFloatandIDLUnrestrictedFloat(codegen only emits the double variants),JSConverter<IDLByteString>,JSConverter<IDLObject>,JSConverter<IDLAtomStringAdaptor<T>>, bothIDLRequiresExistingAtomStringAdaptor<T>converters, bothIDLCallbackInterface<T>converters,JSConverter<IDLCallbackFunction<T>>and the two-argumentConverter<IDLCallbackFunction<T>>::convertoverload (the one live caller,JSPerformanceObserver.cpp, uses the global-object overload), theUncachedString/OwnedStringoverloads of the DOMString / USVString converters (nothing constructs those adaptors), andVariadicConverter<IDLAny>/VariadicConverter<IDLInterface<T>>(their consumer,convertVariadicArguments, lives in a header nothing includes).CastedThisErrorBehavior::ReturnEarly(JSDOMCastThisValue.h).Other JSC / WebCore binding helpers
WTF::EnumTraits<HTTPHeaderName>(98 lines) andEnumTraits<ExceptionCode>:EnumTraits<E>::valuesis only consumed byEnumeratedArray,OptionSetandisZeroBasedContiguousEnum, none of which is used with either enum.ExceptionOr<T&>(never instantiated), theisolatedCopy(ExceptionOr<void>&&)/isolatedCopy(Exception&&)free functions (crossThreadCopyuses the member),ExceptionOr::m_wasReleased,Exception::extra().ImplType*/ImplType&forwarding overloads ofaddWebCoreOpaqueRoot, all threecontainsWebCoreOpaqueRootoverloads, thenullptr_tconstructor, and theroot(MessagePort*)/root(CryptoKey*)functions only those overloads could reach (plus the includes / forward declarations that existed for them). The one live user,JSAbortController, passes aWebCoreOpaqueRootvalue.BunCommonStrings.h:ConnectionWasClosed,OperationFailed,OperationTimedOut,ec,ed25519,rsa,rsaPss,jwkDsa,jwkG,systemError,x25519(each one expands to aLazyProperty, accessor, initializer and GC visit; thehttp*entries are reached via token pasting and stay).EventLoopTask(Function<void()>&&)(every construction site passes aFunction<void(ScriptExecutionContext&)>),m_bakeGetAsyncLocalStorage(initialized and visited, never read) and a duplicateLazyPropertyOfGlobalObjectalias inBakeAdditionsToGlobalObject.h.TaskSource(onlyPostedMessageQueue/WebSocketare used), eight ofEventListener::Type(JSEventListeneris the only subclass).#if 1 ... #elseinCryptoAlgorithmRSA_PSSOpenSSL.cpp,#if ENABLE(OFFSCREEN_CANVAS)/#if ENABLE(MEDIA_SOURCE)includes of headers that do not exist in this tree (JSEventTargetCustom.cpp,JSDOMURL.cpp).CryptoKeyOKP::platformExportSpki/platformExportPkcs8,SecretKeyJobCtx::result(),KeyPairJobCtx::deinit(), and the never-definedtemplate<typename Visitor> visitChildrendeclarations next toDECLARE_VISIT_CHILDRENinJSNodePerformanceHooksHistogram.handJSX509Certificate.h.JSNodePerformanceHooksHistogram::histogram()(+ a commented-out declaration),NodeVMSourceTextModule::cachedExecutable(),Worker::isOnline(),OnLoadResult::wasMockand its one store,JSOneShotDirectSink::m_asUint8Arrayand its one store (the flag reaches JS throughstartOptions),expectedEnumerationValues<BufferEncodingType>(noIDLEnumeration<BufferEncodingType>anywhere),G_FALSE/G_TRUEinSecretsLinux.cpp,BUN_WRAP_FWD_VOIDinworkaround-missing-symbols.cpp.Rust
bun_mimalloc_sys:Heap::malloc/calloc/reallocand themi_heap_calloc/mi_heap_reallocimports only they used (callers go through the rawmi_heap_*functions with a*mut Heap;MimallocArenadeliberately never hands out a&Heap).bun_libdeflate_sys:Compressor::destroy/Decompressor::destroy(the RAII wrappers free directly).bun_uws_sys:App::run,App::listenand theuws_app_run/uws_app_listenimports behind them (the server listens throughlisten_with_config),uws_app_listen_config_t::new, and a duplicateNewAppalias inApp.rs(the live one is inlib.rs).bun_css:DeclarationContext::Keyframes, and the emptygenerated_color_conversionsmarker module whoseuseno longer exists.hawk.toml: 13 overrides formysql::status_flags::StatusFlag::*variants that #37229 deleted; hawk now reports them asunknown_item. (The sixbun_platformones in the same state are removed by #37328.)Verification
bun bd(full debug/ASAN build) passes with the removals;bun bd test test/internal/source-lints/passes. (The branch briefly carried a source lint pinning the removed symbols; it was dropped in 791ffe9, so the PR is now the removals only.)bun bd testpasses ontest/js/web/abort/abort.test.ts,workers/{message-channel,message-event,performance-observer-leak}.test.ts,encoding/text-encoder.test.js,html/FormData.test.ts,url/url.test.ts,broadcastchannel/broadcast-channel.test.ts,crypto/web-crypto.test.ts,streams/streams.test.js,test/js/node/perf_hooks/perf_hooks.test.ts,test/js/bun/perf_hooks/histogram.test.ts,test/js/node/crypto/x509.test.ts,test/js/node/zlib/zlib.test.js,test/js/bun/test/mock/mock-module.test.ts, and on everything intest/js/web/websocket/websocket.test.js,test/js/node/crypto/crypto.key-objects.test.ts,test/js/bun/css/color.test.tsandtest/js/web/workers/worker.test.tsexcept for tests that need the public internet or that spawn subprocesses and time out at their 5 s budget on this (heavily loaded) machine; the sevenworker.test.tsterminate() tests fail identically on a debug build withsrc/jscreset tomain, and the other timeouts hit a different subset on every run.cargo checkof the touched crates passes; the removed items had no readers in anycfg(hawk unions all 11 targets, and thergchecks are cfg-agnostic), so the per-targetcargo checkpass is left to CI.Left alone on purpose (follow-ups, not in this diff)
WorkerMessagingProxy::isOnline()is now unreferenced, but that header is touched by Remove dead code from libuv_sys, cares_sys, simdutf FFI, test_runner, and C++ bindings #37332 on the neighbouring lines.StringAdaptors.h(UncachedString/OwnedString) has no remaining construction sites, butIDLTypes.h(claimed by an open PR) still names the types.TextCodec::encodeside of the text codecs (~700 lines acrossTextCodecCJK/TextCodecSingleByte/TextCodecUserDefined/UnencodableHandling.h) is only reachable fromTextEncoding::encodeForURLParsing, which has no callers;TextEncoding.h/.cppare claimed by Remove dead code from libuv_sys, cares_sys, simdutf FFI, test_runner, and C++ bindings #37332, so this should go in one piece once that lands.DOMPromise/JSDOMPromise.cppas a whole become dead once Remove dead code from webcore bindings, watcher, node-fallbacks, and misc crates #37062 removesDeferredPromise::whenSettled.bun_install::read_without_launch(the shell-side.bunxfast path, whose caller was not carried over in the Rust port), a handful ofbun_jschelpers added four days ago in 9d519e8 (JSPromisesettle_task/resolve_task,VM::has_termination_request,LoopHandle::accepting_work/ref_keep_alive/unref_keep_alive,job.rsaccessors), andbun_sys::ErrorCase::LeakFdOnFail; these look like API surface still settling rather than leftovers, so they are not touched here.