Upgrade WebKit to 7b485a76e9

scripts/agent.ts

@@ -91,16 +91,19 @@ interface RequestOptions {
 }
 
 /**
- * A request to the cloud's metadata or secret service. Those are not always up
- * yet when the agent starts at boot, so a failed attempt is repeated, a little
- * later each time. A 400, 404 or 422 is an answer, not a failure to repeat.
+ * A request to a cloud's service. The metadata and secret services are not
+ * always up yet when the agent starts at boot, and a connection to any of them
+ * can time out, so a failed attempt is repeated, a little later each time. A
+ * 400, 404, 409 or 422 is an answer, not a failure to repeat. `status` is that
+ * of the last response, if the last attempt got one.
  */
 export async function request(
   url: string,
   options: RequestOptions,
-): Promise<{ error: Error | undefined; body: unknown }> {
+): Promise<{ error: Error | undefined; body: unknown; status: number | undefined }> {
   const { method = "GET", headers = {}, body: input, json, attempts } = options;
   let error: Error | undefined;
+  let status: number | undefined;
   for (let attempt = 0; attempt < attempts; attempt++) {
     if (attempt > 0) {
       await new Promise(resolve => setTimeout(resolve, 1000 * (attempt + 1)));
@@ -112,17 +115,19 @@ export async function request(
       body = json && response.ok ? await response.json() : await response.text();
     } catch (cause) {
       error = new Error(`Fetch failed: ${method} ${url}`, { cause });
+      status = undefined;
       continue;
     }
+    status = response.status;
     if (response.ok) {
-      return { error: undefined, body };
+      return { error: undefined, body, status };
     }
-    error = new Error(`Fetch failed: ${method} ${url}: ${response.status} ${response.statusText}`, { cause: body });
-    if (response.status === 400 || response.status === 404 || response.status === 422) {
-      return { error, body };
+    error = new Error(`Fetch failed: ${method} ${url}: ${status} ${response.statusText}`, { cause: body });
+    if (status === 400 || status === 404 || status === 409 || status === 422) {
+      return { error, body, status };
     }
   }
-  return { error, body: undefined };
+  return { error, body: undefined, status };
 }
 
 /** The temp directory to use on this machine. */

scripts/build/deps/webkit.ts

@@ -3,7 +3,7 @@
  * for local mode. Override via `--webkit-version=<hash>` to test a branch.
  * From https://github.com/oven-sh/WebKit releases.
  */
-export const WEBKIT_VERSION = "35e8970dfd926abf6661c9d356f5d60d8f611c9b";
+export const WEBKIT_VERSION = "f20ce7744553c910bcf16a33faf976af208de091";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.

scripts/ci-image.ts

@@ -19,7 +19,7 @@ import { tmpdir } from "node:os";
 import { join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
-import { getArch, requireCommand, run } from "./agent.ts";
+import { getArch, request, requireCommand, run } from "./agent.ts";
 import {
   type WindowsImage,
   bakeDirectory,
@@ -67,6 +67,17 @@ function getLinuxImageState(name: string): ImageState {
   return states.size ? "failed" : "missing";
 }
 
+const azureAttempts = 5;
+
+/**
+ * `request()` names the URL in its error, and Azure's name the tenant or the
+ * subscription. This has the status and what came with it: the body of the
+ * response, or why there was none.
+ */
+function azureError(what: string, { error, status }: Awaited<ReturnType<typeof request>>): Error {
+  return new Error(`${what}: ${status ?? "no response"}`, { cause: error?.cause });
+}
+
 type Azure = {
   token: string;
   subscriptionId: string;
@@ -77,20 +88,25 @@ type Azure = {
 
 async function getAzure(): Promise<Azure> {
   const tenantId = getSecret("AZURE_TENANT_ID");
-  const response = await fetch(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`, {
+  const response = await request(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       grant_type: "client_credentials",
       client_id: getSecret("AZURE_CLIENT_ID"),
       client_secret: getSecret("AZURE_CLIENT_SECRET"),
       scope: "https://management.azure.com/.default",
-    }),
+    }).toString(),
+    json: true,
+    attempts: azureAttempts,
   });
-  if (!response.ok) {
-    throw new Error(`Azure auth failed: ${response.status}`);
+  if (response.error) {
+    // Without the body of a response, which can name the client.
+    throw response.status
+      ? new Error(`Azure auth failed: ${response.status}`)
+      : azureError("Azure auth failed", response);
   }
-  const { access_token: token } = (await response.json()) as { access_token: string };
+  const { access_token: token } = response.body as { access_token: string };
   return {
     token,
     subscriptionId: getSecret("AZURE_SUBSCRIPTION_ID"),
@@ -101,12 +117,13 @@ async function getAzure(): Promise<Azure> {
 }
 
 /** A request to the gallery image definition `name`, or to a path under it. */
-function galleryRequest(azure: Azure, name: string, path: string, init?: RequestInit): Promise<Response> {
+function galleryRequest(azure: Azure, name: string, path: string, init?: { method: string; body?: string }) {
   const { subscriptionId, resourceGroup, galleryName, token } = azure;
   const definition = `/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.Compute/galleries/${galleryName}/images/${name}`;
-  return fetch(`https://management.azure.com${definition}${path}?api-version=2024-03-03`, {
+  return request(`https://management.azure.com${definition}${path}?api-version=2024-03-03`, {
     ...init,
     headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" },
+    attempts: azureAttempts,
   });
 }
 
@@ -118,10 +135,10 @@ async function getWindowsImageState(azure: Azure, name: string): Promise<ImageSt
   if (response.status === 404) {
     return "missing";
   }
-  if (!response.ok) {
-    throw new Error(`Azure gallery lookup of ${name} failed: ${response.status} ${await response.text()}`);
+  if (response.error) {
+    throw azureError(`Azure gallery lookup of ${name} failed`, response);
   }
-  const { properties } = (await response.json()) as { properties: { provisioningState: string } };
+  const { properties } = JSON.parse(response.body as string) as { properties: { provisioningState: string } };
   switch (properties.provisioningState) {
     case "Succeeded":
       return "available";
@@ -226,16 +243,16 @@ async function bakeWindowsImage(key: string, name: string, timeoutMinutes: numbe
       },
     }),
   });
-  if (!definition.ok && definition.status !== 409) {
-    throw new Error(`Failed to create gallery image definition: ${definition.status} ${await definition.text()}`);
+  if (definition.error && definition.status !== 409) {
+    throw azureError("Failed to create gallery image definition", definition);
   }
 
   if (state === "failed") {
     // Packer refuses to publish over a version that exists, and this one never became an image.
     console.log(`[packer] Deleting the failed version of ${name}`);
     const deleted = await galleryRequest(azure, name, galleryVersion, { method: "DELETE" });
-    if (!deleted.ok) {
-      throw new Error(`Failed to delete the failed version of ${name}: ${deleted.status} ${await deleted.text()}`);
+    if (deleted.error) {
+      throw azureError(`Failed to delete the failed version of ${name}`, deleted);
     }
     while ((await getWindowsImageState(azure, name)) !== "missing") {
       await new Promise(done => setTimeout(done, 10_000));

scripts/verify-baseline-static/allowlist-x64.txt

@@ -442,12 +442,16 @@ ipint_simd_i8x16_relaxed_swizzle                  [AVX]
 
 
 # ----------------------------------------------------------------------------
-# JSC IPInt atomics. cmpxchg loop reloads the SIMD accumulator with vmovdqu
-# after the IPInt metadata removal in upstream ef40cabc28d2; gated behind
-# Options::useWasmSIMD().
+# JSC IPInt out-of-line slow paths. They have local labels only, so the scanner
+# counts them as part of the last global symbol in front of them. Since
+# upstream 5ad2bece76 that symbol is the out-of-line memory.atomic.wait64
+# handler (it was ipint_i64_atomic_rmw32_cmpxchg_u). The AVX instructions are
+# the splats of .simd_v128_load{8,16,32,64}_splat_slow_path, which only SIMD
+# opcodes reach. Gate: Options::useWasmSIMD(), which Options.cpp turns off
+# when isX86_64_AVX() is false.
 # (1 symbols)
 # ----------------------------------------------------------------------------
-ipint_i64_atomic_rmw32_cmpxchg_u          [AVX]
+ipint_op_memory_atomic_wait64             [AVX]
 
 
 # ----------------------------------------------------------------------------

src/codegen/bundle-functions.ts

@@ -465,7 +465,7 @@ JSC::FunctionExecutable* ${lowerBasename}${cap(fn.name)}CodeGenerator(JSC::VM& v
 
   const initializeSourceCodeFn = (fn: BundledBuiltin, basename: string) => {
     const name = `${low(basename)}${cap(fn.name)}CodeSource`;
-    return `m_${name}(SourceCode(sourceProvider.copyRef(), ${fn.sourceOffset}, ${fn.source.length + fn.sourceOffset}, 1, 1))`;
+    return `m_${name}(SourceCode(sourceProvider.copyRef(), ${fn.sourceOffset}, ${fn.source.length + fn.sourceOffset}))`;
   };
   for (const { basename, internal, functions } of files) {
     bundledCPP += `
@@ -482,8 +482,10 @@ ${basename}BuiltinsWrapper::${basename}BuiltinsWrapper(JSC::VM& vm, RefPtr<JSC::
   }
 
   bundledCPP += `
+static constexpr unsigned internalCombinedSourceStarts[] = { ${files.flatMap(({ functions }) => functions.map(fn => fn.sourceOffset)).join(", ")} };
+
 RefPtr<JSC::SourceProvider> createBuiltinsSourceProvider() {
-    return JSC::StringSourceProvider::create(StringImpl::createWithoutCopying(internalCombinedSource), SourceOrigin(), String(), SourceTaintedOrigin());
+    return JSC::BuiltinsSourceProvider::create(StringImpl::createWithoutCopying(internalCombinedSource), internalCombinedSourceStarts);
 }
 `;
 

src/codegen/generate-classes.ts

@@ -852,7 +852,7 @@ JSC_DEFINE_HOST_FUNCTION(${symbolName(typeName, name)}Callback, (JSGlobalObject
      * from a debugger */
     SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
     auto fileNameUTF8 = sourceOrigin.string().utf8();
-    const char* fileName = fileNameUTF8.data();
+    const char* fileName = fileNameUTF8.legacyCStringPointer();
     static const char* lastFileName = nullptr;
     if (lastFileName != fileName) {
       lastFileName = fileName;

src/js/internal-for-testing.ts

@@ -859,6 +859,14 @@ export const internalModulesLoadedFromBytecode: () => number = $newCppFunction(
   0,
 );
 
+// Whether the source of `fn` knows where its lines start. Before anything asked for a position in it, that means they
+// came with its code: from the parse, or out of the bytecode.
+export const sourceHasLineStarts: (fn: Function) => boolean = $newCppFunction(
+  "ZigSourceProvider.cpp",
+  "jsSourceHasLineStarts",
+  1,
+);
+
 // The bytecode `bun build --compile --bytecode` embeds for a builtin module, plus the external string table it embeds
 // beside it: internal module number `index` (null past the last), or `source` written in builtin syntax (@-intrinsics,
 // a function expression) compiled under `name`.

src/jsc/bindings/BunAnalyzeTranspiledModule.cpp

@@ -276,11 +276,15 @@ static EncodedJSValue fallbackParse(JSGlobalObject* globalObject, JSModuleLoader
         auto actual = dumpRecordInfo(resultValue);
         auto expected = dumpRecordInfo(moduleRecord);
         if (actual != expected) {
-            dataLog("\n\n\n\n\n\n\x1b[95mBEGIN analyzeTranspiledModule\x1b(B\x1b[m\n  --- module key ---\n", moduleKey.utf8().data(), "\n  --- code ---\n\n", sourceCode.toUTF8().data(), "\n");
+            dataLog("\n\n\n\n\n\n\x1b[95mBEGIN analyzeTranspiledModule\x1b(B\x1b[m\n  --- module key ---\n", moduleKey.utf8(), "\n  --- code ---\n\n", sourceCode.toUTF8(), "\n");
             dataLog("  ------", "\n");
             dataLog("  BunAnalyzeTranspiledModule:", "\n");
 
-            zig__renderDiff(expected.utf8().data(), expected.utf8().length(), actual.utf8().data(), actual.utf8().length());
+            auto expectedUTF8 = expected.utf8();
+            auto actualUTF8 = actual.utf8();
+            auto expectedBytes = byteCast<char>(expectedUTF8.span());
+            auto actualBytes = byteCast<char>(actualUTF8.span());
+            zig__renderDiff(expectedBytes.data(), expectedBytes.size(), actualBytes.data(), actualBytes.size());
 
             RELEASE_AND_RETURN(scope, JSValue::encode(rejectWithError(createError(globalObject, WTF::String::fromLatin1("Imports different between parseFromSourceCode and fallbackParse")))));
         }

src/jsc/bindings/BunClientData.cpp

@@ -168,7 +168,7 @@ void JSVMClientData::create(VM* vm, void* bunVM, WorkerMessagingProxy* worker)
     // (~VM -> lastChanceToFinalize -> delete clientData), so the capture stays
     // valid for every collection.
     vm->heap.addMarkingConstraint(makeUnique<JSC::SimpleMarkingConstraint>(
-        "Srb", "Bun StrongRootBlocks",
+        "Srb"_s, "Bun StrongRootBlocks"_s,
         MAKE_MARKING_CONSTRAINT_EXECUTOR_PAIR(([clientData](auto& visitor) {
             JSC::SetRootMarkReasonScope rootScope(visitor, JSC::RootMarkReason::StrongHandles);
             visitor.appendUnbarriered(clientData->m_strongRootBlockHead);
@@ -179,7 +179,7 @@ void JSVMClientData::create(VM* vm, void* bunVM, WorkerMessagingProxy* worker)
 
     // The common string cache: slots filled by the JS thread, read here with the world stopped (as above).
     vm->heap.addMarkingConstraint(makeUnique<JSC::SimpleMarkingConstraint>(
-        "Bcs", "Bun CommonStrings",
+        "Bcs"_s, "Bun CommonStrings"_s,
         MAKE_MARKING_CONSTRAINT_EXECUTOR_PAIR(([clientData](auto& visitor) {
             JSC::SetRootMarkReasonScope rootScope(visitor, JSC::RootMarkReason::StrongHandles);
             clientData->commonStrings.visit(visitor);

src/jsc/bindings/BunGCOutputConstraint.cpp

@@ -102,7 +102,7 @@ namespace WebCore {
 using namespace JSC;
 
 DOMGCOutputConstraint::DOMGCOutputConstraint(VM& vm, JSHeapData& heapData)
-    : MarkingConstraint("Domo", "DOM Output", ConstraintVolatility::SeldomGreyed, ConstraintConcurrency::Concurrent, ConstraintParallelism::Parallel)
+    : MarkingConstraint("Domo"_s, "DOM Output"_s, ConstraintVolatility::SeldomGreyed, ConstraintConcurrency::Concurrent, ConstraintParallelism::Parallel)
     , m_vm(vm)
     , m_heapData(heapData)
     , m_lastExecutionVersion(vm.heap.mutatorExecutionVersion())

src/jsc/bindings/BunProcess.cpp

@@ -327,7 +327,7 @@ static JSValue constructProcessReleaseObject(VM& vm, JSObject* processObject)
     auto* release = JSC::constructEmptyObject(globalObject);
 
     release->putDirect(vm, vm.propertyNames->name, jsOwnedString(vm, String("node"_s)), 0); // maybe this should be 'bun' eventually
-    putDirectNamed(vm, release, "sourceUrl"_s, jsOwnedString(vm, WTF::String(std::span { Bun__githubURL, strlen(Bun__githubURL) })));
+    putDirectNamed(vm, release, "sourceUrl"_s, jsOwnedString(vm, String::fromLatin1(Bun__githubURL)));
     putDirectNamed(vm, release, "headersUrl"_s, jsOwnedString(vm, String("https://nodejs.org/download/release/v" REPORTED_NODEJS_VERSION "/node-v" REPORTED_NODEJS_VERSION "-headers.tar.gz"_s)));
 
     RETURN_IF_EXCEPTION(scope, {});
@@ -3373,7 +3373,7 @@ static JSValue maybe_uid_by_name(JSC::ThrowScope& throwScope, JSGlobalObject* gl
     auto str = value.getString(globalObject);
     RETURN_IF_EXCEPTION(throwScope, {});
     auto utf8 = str.utf8();
-    auto name = utf8.data();
+    auto name = utf8.legacyCStringPointer();
     struct passwd pwd;
     struct passwd* pp = nullptr;
     char buf[8192];
@@ -3395,7 +3395,7 @@ static JSValue maybe_gid_by_name(JSC::ThrowScope& throwScope, JSGlobalObject* gl
     auto str = value.getString(globalObject);
     RETURN_IF_EXCEPTION(throwScope, {});
     auto utf8 = str.utf8();
-    auto name = utf8.data();
+    auto name = utf8.legacyCStringPointer();
     struct group pwd;
     struct group* pp = nullptr;
     char buf[8192];

src/jsc/bindings/BunSecureContextCache.h

@@ -24,7 +24,7 @@ class SecureContextCache {
     }
 
     JSC::JSObject* get(uint64_t key) { return m_map.get(key); }
-    void set(uint64_t key, JSC::JSObject* value) { m_map.set(key, JSC::Weak<JSC::JSObject>(value)); }
+    void set(uint64_t key, JSC::JSObject* value) { m_map.set(key, value); }
 
 private:
     JSC::WeakGCMap<uint64_t, JSC::JSObject, WTF::IntHash<uint64_t>, WTF::UnsignedWithZeroKeyHashTraits<uint64_t>> m_map;

src/jsc/bindings/CookieMap.cpp

@@ -18,7 +18,7 @@ static void CookieMap__writeFetchHeadersToUWSResponse(CookieMap* cookie_map, JSC
     // Loop over modified cookies and write Set-Cookie headers to the response
     for (auto& cookie : cookie_map->getAllChanges()) {
         auto utf8 = cookie->toString(global_this->vm()).utf8();
-        res->writeHeader("Set-Cookie", utf8.data());
+        res->writeHeader("Set-Cookie", utf8.legacyCStringPointer());
     }
 }
 extern "C" void CookieMap__write(CookieMap* cookie_map, JSC::JSGlobalObject* global_this, UWSResponseKind kind, void* arg2)

src/jsc/bindings/ErrorStackFrame.cpp

@@ -65,10 +65,12 @@ void adjustPositionBackwards(ZigStackFramePosition& pos, int amount, CodeBlock*
 ZigStackFramePosition getAdjustedPositionForBytecode(JSC::CodeBlock* code, JSC::BytecodeIndex bc)
 {
     auto expr = code->expressionInfoForBytecodeIndex(bc);
+    // Expression info has offsets only. The provider derives the line and the column from the divot.
+    auto lineColumn = code->source().provider()->documentLineColumnForOffset(expr.divot);
 
     ZigStackFramePosition pos {
-        .line_zero_based = OrdinalNumber::fromOneBasedInt(expr.lineColumn.line).zeroBasedInt(),
-        .column_zero_based = OrdinalNumber::fromOneBasedInt(expr.lineColumn.column).zeroBasedInt(),
+        .line_zero_based = OrdinalNumber::fromOneBasedInt(lineColumn.line).zeroBasedInt(),
+        .column_zero_based = OrdinalNumber::fromOneBasedInt(lineColumn.column).zeroBasedInt(),
         .byte_position = (int)expr.divot,
     };
 

src/jsc/bindings/FuzzilliREPRL.cpp

@@ -150,7 +150,7 @@ static JSC::EncodedJSValue JSC_HOST_CALL_ATTRIBUTES functionFuzzilli(JSC::JSGlob
             // the fuzzer harness).
             static FILE* f = fdopen(REPRL_DWFD, "w");
             if (f) {
-                fprintf(f, "%s\n", output.utf8().data());
+                fprintf(f, "%s\n", output.utf8().legacyCStringPointer());
                 fflush(f);
             }
         }

src/jsc/bindings/InspectorBunFrontendDevServerAgent.h

@@ -16,11 +16,14 @@ class FrontendRouter;
 class BackendDispatcher;
 class BunFrontendDevServerFrontendDispatcher;
 
-class InspectorBunFrontendDevServerAgent final : public InspectorAgentBase, public Inspector::BunFrontendDevServerBackendDispatcherHandler {
+class InspectorBunFrontendDevServerAgent final : public InspectorAgentBase, public Inspector::BunFrontendDevServerBackendDispatcherHandler, public CanMakeThreadSafeCheckedPtr<InspectorBunFrontendDevServerAgent> {
     WTF_MAKE_NONCOPYABLE(InspectorBunFrontendDevServerAgent);
     WTF_MAKE_TZONE_ALLOCATED(InspectorBunFrontendDevServerAgent);
+    WTF_OVERRIDE_DELETE_FOR_CHECKED_PTR(InspectorBunFrontendDevServerAgent);
 
 public:
+    OVERRIDE_ABSTRACT_CAN_MAKE_CHECKEDPTR(CanMakeThreadSafeCheckedPtr);
+
     InspectorBunFrontendDevServerAgent(JSC::JSGlobalObject&);
     virtual ~InspectorBunFrontendDevServerAgent() final;
 

src/jsc/bindings/InspectorHTTPServerAgent.h

@@ -19,11 +19,14 @@ enum class DisconnectReason;
 
 using AnyServerPtr = void*;
 
-class InspectorHTTPServerAgent final : public InspectorAgentBase, public Inspector::HTTPServerBackendDispatcherHandler {
+class InspectorHTTPServerAgent final : public InspectorAgentBase, public Inspector::HTTPServerBackendDispatcherHandler, public CanMakeThreadSafeCheckedPtr<InspectorHTTPServerAgent> {
     WTF_MAKE_NONCOPYABLE(InspectorHTTPServerAgent);
     WTF_MAKE_TZONE_ALLOCATED(InspectorHTTPServerAgent);
+    WTF_OVERRIDE_DELETE_FOR_CHECKED_PTR(InspectorHTTPServerAgent);
 
 public:
+    OVERRIDE_ABSTRACT_CAN_MAKE_CHECKEDPTR(CanMakeThreadSafeCheckedPtr);
+
     InspectorHTTPServerAgent(JSC::JSGlobalObject&);
     virtual ~InspectorHTTPServerAgent();