[robobun]

Problem

• About 450 lines have no user. Example: 66 JSC_DECLARE_HOST_FUNCTION lines in JSBuffer.cpp declare functions at global scope, but the definitions are in namespace WebCore, so the declared functions do not exist. Example: the class generator emits a <Type>__ptrOffset constant for all 94 classes, and nothing reads it.
• rustc, hawk, -Wunused-function and the --gc-sections link do not report them. They are prototypes without a definition, generator output, inline header members, type declarations, or write-only fields.

Fix

• Delete each item: 32 files, 455 lines removed, no behavior change. The Notes list every symbol.
• Correct because each name has zero references in src/, packages/, scripts/, test/ and build/debug/codegen/ outside its own definition. A clang AST pass over all 670 Bun translation units finds no reference to the removed C++ functions, template instantiations included.
• The generated code only loses lines: ZigGeneratedClasses.{h,cpp} 1322, JSSink.{h,cpp} 99, zero added. WebCoreJSBuiltins.* is byte-identical.
• Verified: bun bd, tsc (no new error), test/internal/source-lints (173 pass), and the suites in the Notes.

Background

• JSC_DECLARE_HOST_FUNCTION(name) expands to a function prototype in the current namespace. A prototype that nothing defines or calls has no effect.
• generate-classes.ts and generate-jssink.ts write the C++ wrapper classes for the native types in *.classes.ts. A symbol they emit is dead when no C++, Rust or generated file names it.
• 31 other dead-code pull requests are open. This one deletes nothing that they delete. 19 files overlap at other lines.

Notes

Class and sink generators (src/codegen)

• generate-classes.ts: extern "C" const size_t <Type>__ptrOffset and the offsetOfWrapped() member that only initialized it. rg ptrOffset hits only the generator.
• generate-classes.ts: <Type>__createWithInitialValues and <Type>__createWithValuesAndInitialValues (emitted only for ShellInterpreter). No Rust or C++ file declares them. The create(vm, global, structure, ctx, values...) overload and its constructor had no other caller. ShellBindings.cpp uses the overload that also takes jsvalueArray, which stays. <Type>__createWithValues stays (Rust calls it).
• generate-classes.ts: the onStructuredCloneTransfer Rust thunk. No C++ declares or calls __onStructuredCloneTransfer, and no type has on_structured_clone_transfer.
• generate-classes.ts: rustModuleResolver.resolveFile (never called).
• generate-jssink.ts: the JSSink_isSink declaration (no definition, no caller), createPrototype of the sink classes (prototypes come from createJSSinkPrototype, the controller createPrototype stays), the SinkID Sink constants of the constructor and controller classes (only JS<Name>Sink::Sink is read), the #if ENABLE(MEDIA_SOURCE) includes of BufferMediaSource.h and JSMediaSource.h (no such headers exist), and six commented-out lines from 2022 to 2024.
• bundle-modules.ts: #define BUN_NATIVE_MODULE_START_INDEX (no reader, a comment in InternalModuleRegistry.cpp now names the real bound) and two .replace() calls for __debug_end__ / __assert_end__, which nothing emits.
• bake-codegen.ts: bake_empty_file, written for a dependency edge of the removed CMake build.
• cppbind.ts: the write-only fields isMany and isNonNull and the code that computed them. [[ZIG_NONNULL]] is still accepted.
• bundle-functions.ts: const useThis = true and its unreachable arrow-function arm, and the "export type" comparison that the tokenizer regex can never produce. The emitted text is identical.

C++

• JSBuffer.cpp: 66 JSC_DECLARE_HOST_FUNCTION(jsBuffer...) lines. They declare ::jsBufferPrototypeFunction_*. The definitions and the hash table are WebCore::jsBufferPrototypeFunction_*, defined before their first use.
• WebSocket.cpp: static String hostName(const URL&, bool).
• EventEmitter.h: hasEventListeners() and hasEventListeners(VM&, ASCIILiteral). EventTarget.h: hasEventListeners(). Every caller passes an Identifier or AtomString.
• JSDOMExceptionHandling.h: the JSGlobalObject* overload of invokeFunctorPropagatingExceptionIfNecessary. All 13 callers pass a reference. A pointer argument does not convert to the remaining overload, so a missed caller fails to compile.
• JSDOMWrapper.h: offsetOfWrapped(). Path.cpp, ZigSourceProvider.cpp: four unused using aliases.

Built-in TS

• src/js/private.d.ts: LoaderEntry, LoaderModule (the JS module loader they describe is gone, the one type use in CommonJS.ts becomes any). src/js/builtins.d.ts: UnderlyingSource augmentation, JSCSourceCodeObject.
• src/runtime/bake/bake.private.d.ts: FileIndex, Config.roots, CommonJSModule. The Rust side writes no roots key.
• client/websocket.ts: write-only mainWebSocket (its reader left in Remove dead code from bun-uws, the native BufferList class, built-in JS, the bake dev server assets, the shell, and the SQL crates #40066). Remove dead code from the JSC bindings, the codegen scripts, the CI scripts, bun_core, and bun_jsc #40492 listed it next to the close() teardown API and kept both. Only the variable goes here, close() and Symbol.dispose stay. client/overlay.ts: write-only RuntimeError.remapped. hmr-runtime-server.ts: RequestContext.renderAbort.

packages and scripts

• packages/bun-error/bun-error.css: rules for #BunError-SourceLine-text-highlightExpression, .BunError-Indented, .BunError-divet, .BunError-error-muted. No file emits these names. index.tsx: the highlightColumnEnd prop (forwarded, never read) and let _i.
• packages/bun-debug-adapter-protocol: FramerState, state, pendingLength, sizeBuffer, sizeBufferIndex in node-socket-framer.ts (the parser is position-based), and the extraTs parameter that no caller passes.
• packages/bun-native-plugin-rs/headers/.../bundler_plugin.h: a stale committed copy (it lacks BUN_LOADER_HTML, YAML, XML). copy_headers.ts runs rm -rf headers and copies it again before bindgen, so nothing reads the committed file. headers/ is now in that package's .gitignore.
• scripts/build: ConfigureResult.ninjaFile (never read), the zig color override in tty.ts (no stream has that name), the <cache>/cargo entry in clean.ts (nothing writes that directory).

Tests run with the debug build

test/internal/source-lints/ (173 pass), test/js/node/buffer-concat.test.ts, test/js/node/buffer-jit.test.ts (11 pass, the differential fuzzer test passes its 120 s limit under ASAN in this container and runs in 1.8 s with a release build), test/js/node/events/event-emitter.test.ts, test/js/bun/shell/bunshell-instance.test.ts, test/js/bun/shell/exec.test.ts, test/js/web/websocket/websocket-blob.test.ts, test/js/web/websocket/error-event.test.ts, test/js/web/url/url.test.ts, test/js/web/abort/abort.test.ts, test/js/web/broadcastchannel/broadcast-channel.test.ts, test/bake/dev/esm.test.ts, test/bake/dev/hot.test.ts, test/js/bun/util/arraybuffersink.test.ts, test/js/bun/util/filesink.test.ts, test/js/web/workers/structured-clone.test.ts, test/js/web/structured-clone-blob-file.test.ts, test/js/bun/runtime-error.test.ts, test/js/node/module/node-module-module.test.js.

No test is added. The change only deletes code that nothing references, so there is no behavior to assert. No Rust code changes (one comment), so rust:check-all has nothing to check.

How the candidates were found

• A clang LibTooling pass over the 670 Bun translation units (per-file and unity). It records every declaration in Bun-owned files and every reference, with template instantiations visited and definitions linked to declarations by mangled name. It also records preprocessor-skipped ranges, so a name that appears in code that is not compiled on Linux is never a candidate.
• Four search passes over scripts/, packages/, src/codegen and src/js.
• A repo-wide identifier index and the diffs of the 31 open dead-code PRs, to drop anything they already delete.

Found, not deleted here

• hasExportStar in src/runtime/bake/hmr-module.ts: its only call site is a commented-out block from 2025-03. Remove dead code from the JSC bindings, the codegen scripts, the CI scripts, bun_core, and bun_jsc #40492 already left it because the comment says the check is disabled, not dropped, and dev server: register a client component without evaluating it #42934 works in the same file.
• The LIBUS_USE_WOLFSSL include arm of packages/bun-usockets/src/crypto/openssl.c: nothing defines the macro, but Remove dead code from bun-uws, bun-usockets, the require.extensions FFI, and unused Cargo dependencies #40294 left the uSockets configuration toggles alone on purpose.
• rustLinkFlags() in scripts/build/rust.ts: no caller, but a comment in bun.ts keeps it as the documented fallback.
• The logs and baseline build options: nothing reads cfg.logs or cfg.baseline except the banner. Their removal changes the build CLI (bun run build:logs), and tests pass baseline.
• The split-build upload and download code in scripts/build/ci.ts (about 235 lines) and the cpp-only / rust-only / link-only modes: ci: build C++, Rust and link in one build-bun step instead of build-cpp + build-bun #37733 left them for a follow-up decision.
• .buildkite/ci.mjs: the never-set dryRun, features, baseline fields and the constant mode parameter. CI config, not testable here.
• Generator features that no input uses today: the internal: true property option (guarded by a throw), the d.ts Statics branch, the rust ABI and the reaction shape in generate-host-exports.ts (its last user left in Bun.ModuleGraph: a context per graph for timers and I/O, per-graph CommonJS #42590), emitKeys / emitCaseInsensitive / emitIndexOf in generate-string-map.ts, the false_is_throw tag in cppbind.ts, $alwaysInline, $isPromiseFulfilled, $isPromiseRejected. They are dead for the current inputs only.
• The unreferenced static <Ctor>::call body that the class generator emits for call: true classes: Remove dead code from bun_jsc, bun_core, the bindgenv2 codegen, 15 error types, and the C++ bindings #40915 edits the same logic.
• ERR_REDIS_INVALID_DATABASE, ERR_CRYPTO_INCOMPATIBLE_KEY, ERR_TLS_PROTOCOL_VERSION_CONFLICT in ErrorCode.ts: no user. The first is next to hunks of Remove dead code from bun_css, bun_react_compiler, bun_jsc, and smaller crates #40690 and Remove dead code from bun_core, the JSC bindings, the debugger, and 24 other crates #41385. The other two are Node codes that Node's own tests expect.
• packages/bun-uws: the client-mode (isServer == false) branches of WebSocketProtocol.h, the default-upgrade arm of TemplatedApp::ws, maxLifetime (always 0) and resetIdleTimeoutOnSend (always true). They are constant only because of what the Rust side passes today.
• packages/bun-error/index.tsx: isClient is always true, so blobFileURL / maybeBlobFileURL and the !fallbackStyleSheet branches cannot run. It needs a read of the dev error page, not a grep.
• H2App::getNativeHandle() and the externals block in src/node-fallbacks/build-fallbacks.ts: dead, but each is next to a line that an open PR deletes (Remove dead code from bun-uws, bun-usockets, the require.extensions FFI, and unused Cargo dependencies #40294 / Remove dead code from the WebCore IDL converters, exception reporting, and the uws HTTP/2 shim #41195 and Remove dead code from bun_core, the JSC bindings, the debugger, and 24 other crates #41385).
• HTTPHeaderMap::indexOf(StringView): declared, never defined. It is next to a line that Remove dead code from the WebCore bindings, the JSSink codegen, and two Rust helpers #39929 deletes.
• Small API-symmetry members that the AST pass reports as uncalled: DataViewReader.u16, DataViewWriter.u8, BunBuiltinNames::publicName, ExternColumnIdentifier::isIndexedColumn, const or non-const accessor twins in AbortSignal.h, ResourceTiming.h, EventTarget.h, and several constructors in ncrypto.h.
• src/js/node/tty.ts: this.$bunNativePtr is never set on a tty.ReadStream, so the ref / unref branches and $start cannot run. It looks like a Windows setRawMode regression, not dead code.

Clean, so the next run can skip it

• Rust: the identifier index finds no function, type or constant that is named nowhere else. Every hit is a test, a #[no_mangle] export, a host_fn, or macro output.
• C++: after the open PRs, the AST pass finds no other unreferenced free function, static function or non-inline method. The rest of its report is macro-generated accessors (HTTP_HEADERS_EACH_NAME, builtin names, *_getter), IDL converter specializations, and constructors.
• src/js: no function with zero mentions, no module without a loader, every bun:internal-for-testing export has a test. No unused selector in src/runtime/bake/client/overlay.css (the log-* classes are built by concatenation).
• src/symbols.txt matches the binary. No .zig file and no CMake reference is left outside comments. Commented-out code older than 6 months: 80 lines in total, most in bun-types doc examples.

[coderabbitai]

Warning

Review paused — included plan limit reached

Keep your review moving with free on-demand reviews.

• Run this review for free

On-demand reviews are free for the next 2 days.

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Promotion and pricing details

On-demand reviews are free for the next 2 days. After that, they cost $0.25 per reviewed file.

Review limit details

Or wait 34 seconds for your next included review.

Check out review usage here.

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: oven-sh/bun/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Essentials

Run ID: 587a7d52-b25b-4fa7-9feb-db181fcd1297

📥 Commits

Reviewing files that changed from the base of the PR and between 367d939 and dc1a38f.

📒 Files selected for processing (32)

• packages/bun-debug-adapter-protocol/scripts/generate-protocol.ts
• packages/bun-debug-adapter-protocol/src/debugger/node-socket-framer.ts
• packages/bun-error/bun-error.css
• packages/bun-error/index.tsx
• packages/bun-native-plugin-rs/.gitignore
• packages/bun-native-plugin-rs/headers/bun-native-bundler-plugin-api/bundler_plugin.h
• scripts/build/clean.ts
• scripts/build/configure.ts
• scripts/build/tty.ts
• src/codegen/bake-codegen.ts
• src/codegen/bundle-functions.ts
• src/codegen/bundle-modules.ts
• src/codegen/cppbind.ts
• src/codegen/generate-classes.ts
• src/codegen/generate-jssink.ts
• src/js/builtins.d.ts
• src/js/builtins/CommonJS.ts
• src/js/private.d.ts
• src/jsc/bindings/InternalModuleRegistry.cpp
• src/jsc/bindings/JSBuffer.cpp
• src/jsc/bindings/JSDOMExceptionHandling.h
• src/jsc/bindings/JSDOMWrapper.h
• src/jsc/bindings/Path.cpp
• src/jsc/bindings/ZigSourceProvider.cpp
• src/jsc/bindings/webcore/EventEmitter.h
• src/jsc/bindings/webcore/EventTarget.h
• src/jsc/bindings/webcore/WebSocket.cpp
• src/runtime/bake/bake.private.d.ts
• src/runtime/bake/client/overlay.ts
• src/runtime/bake/client/websocket.ts
• src/runtime/bake/hmr-runtime-server.ts
• src/runtime/generated_classes.rs

---

_{Comment @coderabbitai help to get the list of available commands.}

[robobun]

^{Updated 3:32 PM PT - Sep 18th, 2026}

❌ @robobun, your commit dc1a38f has 1 failures in Build #118011 (All Failures):

• test/bake/deinitialization.test.ts - code 1: (unnamed) — expect(received).toBe(expected) on 🐧 3.23 aarch64

---

🧪   To try this PR locally:

bunx bun-pr 43378

That installs a local version of the PR into your bun-43378 executable, so you can run:

bun-43378 --bun

[robobun]

Status: needs a rebase

• Main moved 334 commits since this branch was pushed on 2026-09-18. Six files now conflict: scripts/build/clean.ts, scripts/build/configure.ts, src/js/builtins/CommonJS.ts, src/js/private.d.ts, src/jsc/bindings/webcore/WebSocket.cpp, src/runtime/bake/hmr-runtime-server.ts.
• Main already removed some of the same items: hostName in WebSocket.cpp, RequestContext.renderAbort, and the LoaderModule use in CommonJS.ts.
• The lines below describe commit dc1a38f as pushed. After a rebase, each remaining deletion needs the reference check and the build again. Comment here to ask for the rebase.

State of dc1a38f:

• Scope: deletions only. 32 files, 455 lines removed, no behavior change.
• How each item was checked: the name has zero references in src/, packages/, scripts/, test/ and build/debug/codegen/ outside its own definition. For the C++ items, a clang AST pass over all 670 Bun translation units also finds no reference, template instantiations included.
• Build: bun bd passes. The generated C++ only loses lines (ZigGeneratedClasses, JSSink), and WebCoreJSBuiltins.* is byte-identical to its base.
• Tests: test/internal/source-lints (173 pass) and the suites listed in the Notes of the description, all with the debug build.
• CI (build 118011): 180 of 181 jobs pass, including all 13 build lanes (macOS, Linux glibc, musl and ASAN, Android, FreeBSD, Windows). The one red job is test/bake/deinitialization.test.ts on Alpine aarch64. The same test failed on other open PRs at that time, and this diff does not change the code it runs.
• Overlap on 2026-09-18: none of the 31 dead-code PRs that were open deleted the same lines.
• Open: one review thread on the JSBuffer.cpp forward declarations waits for a maintainer answer (keep the deletion, move them into namespace WebCore, or restore them).

[claude]

I reviewed this PR and didn't find any bugs. Because it edits the class and sink generators (which shape every generated wrapper class) across 32 files and I could not run a full build here, a human look would still be worthwhile.

What was reviewed:

• Grepped src/, packages/, scripts/, test/ for every removed symbol (__ptrOffset, __createWithInitialValues, __createWithValuesAndInitialValues, onStructuredCloneTransfer, JSSink_isSink, BUN_NATIVE_MODULE_START_INDEX, bake_empty_file, hasEventListeners(), offsetOfWrapped, mainWebSocket, renderAbort, highlightColumnEnd, ninjaFile) — no remaining references; ShellBindings.cpp uses the surviving jsvalueArray overload and only JS<Name>Sink::Sink is read.
• Checked the 66 removed JSBuffer.cpp declarations: definitions precede first use inside namespace WebCore, and the removed lines sat at global scope before line 304.
• Checked the invokeFunctorPropagatingExceptionIfNecessary pointer-overload removal: all remaining callers pass JSGlobalObject&.
• Checked the bundler_plugin.h removal: wrapper.h is consumed only by copy_headers.ts, which regenerates headers/ before bindgen; the crate ships pre-generated src/sys.rs and has no build.rs.

Extended reasoning...

Overview

This is a pure deletion sweep: 32 files, +15/-455. It removes unused overloads, extern "C" factories and the __ptrOffset export from generate-classes.ts; unused constants, a createPrototype, a stale extern decl and dead includes from generate-jssink.ts; two never-matching regex rewrites and an unread #define from bundle-modules.ts; an unreachable useThis arrow branch and an impossible "export type" comparison from bundle-functions.ts; write-only pointer metadata from cppbind.ts; 66 global-scope JSC_DECLARE_HOST_FUNCTION prototypes from JSBuffer.cpp; an unused hostName() in WebSocket.cpp; no-arg/ASCIILiteral hasEventListeners overloads; a duplicate pointer overload in JSDOMExceptionHandling.h; unused using aliases; unused TS types in private.d.ts, builtins.d.ts, bake.private.d.ts; write-only fields in the bake client, bun-error, the debug adapter framer, and the build scripts; and a stale committed copy of bundler_plugin.h (now gitignored).

Security risks

None identified. Nothing in the diff touches auth, crypto, TLS, permissions, input parsing, or user-reachable control flow. The only runtime-JS changes are removing a write-only remapped flag and a write-only mainWebSocket singleton in the bake client, and retyping a local in CommonJS.ts from a deleted interface to any without changing the code that uses it.

Level of scrutiny

Moderate. Each removal is individually trivial, but the generator edits multiply across ~94 generated classes and all sink classes, so a single missed reference would be a link/compile failure rather than a runtime bug. I verified by grep that none of the removed C++/extern names have remaining references, that ShellBindings.cpp uses the overload that survives, that every remaining invokeFunctorPropagatingExceptionIfNecessary caller passes a reference, and that each removed JSBuffer.cpp prototype's definition appears before its first use in the hash tables. I could not run bun bd or tsc in this environment, so compile-level confirmation rests on the author's stated verification and CI; that is the main reason for deferring rather than approving.

Other factors

Behavior-preservation checks per REVIEW.md: the bundle-functions.ts useThis constant was hard-coded true, so the emitted text is unchanged; the tokenizer regex at line 105 cannot produce "export type" and no builtin file starts a line with export type; nativeStartIndex remains live for its other consumers; the Config.roots field has no Rust writer in src/runtime/bake. The bun-native-plugin crate consideration from the ruled-out list holds up: wrapper.h is only read by copy_headers.ts after it regenerates headers/, and the crate has no build.rs, so consumers of the published crate use the checked-in src/sys.rs. No tests are added, which is appropriate for a deletion-only change with no behavior to assert.

[robobun]

Thanks for the review. On the open point (no build in the review environment): CI compiled and linked this commit on all 13 build lanes (macOS x64 and arm64, Linux glibc, musl and ASAN, Android, FreeBSD, Windows x64 and arm64). A reference to a removed C++ or generated symbol that exists on only one platform would fail one of those lanes, and none did.

The one red test so far, test/bake/deinitialization.test.ts on Alpine aarch64, fails the same way on other open PRs right now (for example builds 118013, 118007 and 118003). This diff does not change the code that test exercises: bake.server.js is byte-identical to main, and the test does not run the client bundle.

[alii]

My guess is that we might as well keep these for future use

[robobun]

These prototypes cannot serve a future use as written. They are at global scope (line 110 is before namespace Bun { at line 187), so they declare ::jsBufferPrototypeFunction_*. The real functions are WebCore::jsBufferPrototypeFunction_*: every JSC_DEFINE_HOST_FUNCTION for them is inside the namespace WebCore { that opens at line 455, and the binary only has the WebCore:: symbols (nm -C shows WebCore::jsBufferPrototypeFunction_compare(...) and no global one).

So a call through one of these prototypes does not link, and an unqualified use at global scope is ambiguous because of using namespace WebCore; at line 103. The definitions also come before the hash tables that use them, so nothing needs a forward declaration today.

If you want forward declarations in this file, the form that works is inside namespace WebCore. Tell me which you prefer and I will do it: keep the deletion, move them into the namespace, or restore them unchanged.