Replace libjpeg-turbo with a JPEG codec in safe Rust

.buildkite/ci.ts

@@ -639,12 +639,12 @@ function getBuildCommand(target: Target, options: PipelineOptions): string {
  * deps + C++ + Rust + link on one agent.
  */
 function getBuildBunStep(platform: Platform, options: PipelineOptions): CommandStep {
-  const { arch } = platform;
-  // Best-effort nasm for x64 (BoringSSL win-x64, libjpeg-turbo SIMD); images bake it, and the build's own error is clearer.
+  const { os, arch } = platform;
+  // Best-effort nasm for BoringSSL's win-x64 assembly; images bake it, and the build's own error is clearer.
   const nasmSetup =
-    arch === "x64"
+    os === "windows" && arch === "x64"
       ? [
-          "which nasm || (apt-get update -qq && apt-get install -y -qq nasm) || dnf install -y -q nasm || yum install -y -q nasm || brew install nasm || true",
+          "which nasm || (apt-get update -qq && apt-get install -y -qq nasm) || dnf install -y -q nasm || yum install -y -q nasm || true",
         ]
       : [];
   return {

.github/actions/rust-lint-setup/action.yml

@@ -48,7 +48,7 @@ runs:
         wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc > /dev/null
         echo "deb http://apt.llvm.org/$(lsb_release -cs)/ llvm-toolchain-$(lsb_release -cs)-${LLVM_VERSION_MAJOR} main" | sudo tee /etc/apt/sources.list.d/llvm.list > /dev/null
         sudo apt-get update -qq
-        sudo apt-get install -y -qq --no-install-recommends cmake ninja-build nasm clang-${LLVM_VERSION_MAJOR} lld-${LLVM_VERSION_MAJOR} llvm-${LLVM_VERSION_MAJOR}
+        sudo apt-get install -y -qq --no-install-recommends cmake ninja-build clang-${LLVM_VERSION_MAJOR} lld-${LLVM_VERSION_MAJOR} llvm-${LLVM_VERSION_MAJOR}
 
     - name: Setup Rust
       if: inputs.toolchain != ''

.prettierignore

@@ -16,6 +16,9 @@ test/expected-durations.json
 # vendored, generated bundle of github.com/jarred-sumner/xmac (see its header)
 scripts/build/xmac.mjs
 
+# libjpeg-turbo's, which has to stay as it is
+src/jpeg/LICENSE.md
+
 # the output codeblocks need to stay minified
 docs/bundler/minifier.mdx
 # Prettier would reformat the code examples, and test/cli/lint/rule-docs.test.ts runs them exactly as written

Cargo.toml

@@ -8,7 +8,7 @@
   "src/bundler",
   "src/collections",
   "src/css",
   "src/errno",
   "src/glob",
   "src/http",
   "src/install",
@@ -69,6 +69,7 @@
   "src/trim/removable_features",
   "src/highway",
   "src/histogram",
+  "src/jpeg",
   "src/http_jsc",
   "src/http_types",
   "src/ini",
@@ -449,6 +450,7 @@
 bun_removable_features = { path = "src/trim/removable_features" }
 bun_highway = { path = "src/highway" }
 bun_histogram = { path = "src/histogram" }
+bun_jpeg = { path = "src/jpeg" }
 bun_http_jsc = { path = "src/http_jsc" }
 bun_http_types = { path = "src/http_types" }
 bun_ini = { path = "src/ini" }
@@ -514,6 +516,11 @@
 bun_which = { path = "src/which" }
 bun_transpiler = { path = "src/transpiler" }
 
+# The codec's loops run for every sample of an image, and at opt-level 0 they take 20 to 60 times as long.
+# The overflow checks and debug assertions stay.
+[profile.dev.package.bun_jpeg]
+opt-level = 3
+
 # Loops over every byte of an image: unoptimized, a debug build takes seconds per megapixel. Assertions and overflow
 # checks stay on. scripts/build/flags.ts does the same for highway_png.cpp.
 [profile.dev.package.bun_png]

LICENSE.md

@@ -39,7 +39,7 @@ Bun statically links these libraries:
 | [`libbase64`](https://github.com/aklomp/base64/blob/master/LICENSE) | BSD 2-Clause |
 | [`libuv`](https://github.com/libuv/libuv) (on Windows) | MIT |
 | [`libdeflate`](https://github.com/ebiggers/libdeflate) | MIT |
-| [`libjpeg-turbo`](https://github.com/libjpeg-turbo/libjpeg-turbo) | [BSD 3-Clause / IJG / zlib](https://github.com/libjpeg-turbo/libjpeg-turbo/blob/main/LICENSE.md) |
+| [`libjpeg-turbo`](https://github.com/libjpeg-turbo/libjpeg-turbo) (not linked: `src/jpeg` is derived from parts of it). This software is based in part on the work of the Independent JPEG Group | [BSD 3-Clause / IJG / zlib](src/jpeg/LICENSE.md) |
 | [`libspng`](https://github.com/randy408/libspng) (not linked: `src/png` is derived from parts of it) | BSD 2-Clause |
 | [`stb_image`](https://github.com/nothings/stb) (not linked: the PNG codec finds the Paeth predictor its way) | MIT or public domain |
 | [`libwebp`](https://github.com/webmproject/libwebp) | BSD 3-Clause |

docs/project/license.mdx

@@ -44,7 +44,7 @@ Bun statically links these libraries:
 | [`libbase64`](https://github.com/aklomp/base64/blob/master/LICENSE)                                                                              | BSD 2-Clause                                                                                 |
 | [`libuv`](https://github.com/libuv/libuv) (on Windows)                                                                                           | MIT                                                                                          |
 | [`libdeflate`](https://github.com/ebiggers/libdeflate)                                                                                           | MIT                                                                                          |
-| [`libjpeg-turbo`](https://github.com/libjpeg-turbo/libjpeg-turbo)                                                                                | BSD 3-Clause / IJG / zlib                                                                    |
+| [`libjpeg-turbo`](https://github.com/libjpeg-turbo/libjpeg-turbo) (not linked: `src/jpeg` is derived from parts of it)                           | [BSD 3-Clause / IJG / zlib](https://github.com/oven-sh/bun/blob/main/src/jpeg/LICENSE.md)    |
 | [`libspng`](https://github.com/randy408/libspng) (not linked: `src/png` is derived from parts of it)                                             | BSD 2-Clause (portions derived from libpng, PNG Reference Library License v2)                |
 | [`stb_image`](https://github.com/nothings/stb) (not linked: the PNG codec finds the Paeth predictor its way)                                     | MIT or public domain                                                                         |
 | [`libwebp`](https://github.com/webmproject/libwebp)                                                                                              | BSD 3-Clause                                                                                 |
@@ -54,6 +54,8 @@ Bun statically links these libraries:
 | A fork of [`uWebsockets`](https://github.com/jarred-sumner/uwebsockets)                                                                          | Apache 2.0 licensed                                                                          |
 | Parts of [Tigerbeetle's IO code](https://github.com/tigerbeetle/tigerbeetle/blob/532c8b70b9142c17e07737ab6d3da68d7500cbca/src/io/windows.zig#L1) | Apache 2.0 licensed                                                                          |
 
+The IJG license requires this statement: this software is based in part on the work of the Independent JPEG Group.
+
 ## Polyfills
 
 For compatibility, Bun embeds the following packages into its binary and injects them if imported.

docs/runtime/image.mdx

@@ -3,7 +3,7 @@ title: Image
 description: Decode, transform, and encode images with a fast native pipeline
 ---
 
-`Bun.Image` is a chainable image pipeline for decoding, resizing, rotating, and re-encoding JPEG, PNG, WebP, HEIC, and AVIF. It is built on libjpeg-turbo, libwebp, a built-in PNG codec, and SIMD geometry kernels, with zero npm dependencies and no native addon build step.
+`Bun.Image` is a chainable image pipeline for decoding, resizing, rotating, and re-encoding JPEG, PNG, WebP, HEIC, and AVIF. It is built on built-in JPEG and PNG codecs, libwebp, and SIMD geometry kernels, with zero npm dependencies and no native addon build step.
 
 ```ts
 await Bun.file("photo.jpg").image().resize(400, 400, { fit: "inside" }).webp({ quality: 80 }).write("thumb.webp");
@@ -29,7 +29,7 @@ Bun sniffs the format from the bytes and ignores extensions and `Content-Type`.
 
 When passing a `TypedArray`/`ArrayBuffer`, don't mutate it while a terminal is pending — decode runs off-thread and borrows the bytes. Bun refuses `SharedArrayBuffer` and resizable buffers; use `buf.slice()` to pass a fixed view.
 
-Bun decodes a damaged JPEG when libjpeg-turbo can finish the decode with only a warning. Examples are stray bytes between segments, a missing end-of-image marker, and truncated scan data. libjpeg-turbo fills the blocks that have no data with flat grey. A progressive file that is cut after its first scan has data for every block, so Bun returns the whole picture with less detail. When libjpeg-turbo cannot finish the decode, the terminal rejects with `ERR_IMAGE_DECODE_FAILED`. `metadata()` reads only the header, so it can resolve for a file that a terminal rejects.
+Bun decodes a damaged JPEG in the cases where libjpeg-turbo finishes the decode with only a warning. Examples are stray bytes between segments, a missing end-of-image marker, and truncated scan data. The blocks that have no data come back flat grey. A progressive file that is cut after its first scan has data for every block, so Bun returns the whole picture with less detail. When the decode cannot finish, the terminal rejects with `ERR_IMAGE_DECODE_FAILED`. The terminal also rejects with `ERR_IMAGE_DECODE_FAILED` for a JPEG with more than 500 scans, and for one with a scan of what an earlier scan has already coded. Encoders write about 10 scans and none of them twice. Each scan costs a pass over the whole image, however few bytes it has. `metadata()` reads only the header, so it can resolve for a file that a terminal rejects.
 
 Bun does not verify the checksums in a PNG. It skips the CRC of each chunk and the Adler-32 of the pixel data, so a file with damaged bytes can decode to different pixels. Bun reads `IDAT` chunks until one of them completes the last row, and ignores everything after the data of that chunk. When the file ends before the data of that chunk does, the terminal rejects with `ERR_IMAGE_DECODE_FAILED`. The terminal also rejects when the pixel data ends before the last row.
 
@@ -47,6 +47,8 @@ new Bun.Image(input, {
 
 A decoded image takes 4 bytes per pixel, so the default `maxPixels` allows 1 GiB for one image. A PNG of 32 KiB can decode to that size. The decode needs more memory while it runs: up to 20 bytes per pixel for a PNG that is one very wide row, which is 5 GiB at the default. For untrusted input, set `maxPixels` to the largest image your application accepts.
 
+A terminal rejects with `ERR_OUT_OF_MEMORY` when a codec reports a failed allocation. The JPEG codec reports all of its own. Elsewhere in the pipeline a failed allocation can end the process. Keep `maxPixels` within what your memory allows: Bun checks it before it allocates the pixel buffer.
+
 ## Metadata
 
 Read `width`, `height`, and `format` without decoding pixel data:
@@ -186,14 +188,14 @@ For a passive "image in clipboard, press ⌘V" hint, poll `clipboardChangeCount(
 
 ## Platform backends
 
-|                        | Linux                              | macOS               | Windows      |
-| ---------------------- | ---------------------------------- | ------------------- | ------------ |
-| JPEG / PNG / WebP      | libjpeg-turbo · built-in · libwebp | same                | same         |
-| BMP / GIF (decode)     | built-in                           | ImageIO             | WIC          |
-| TIFF (decode)          | ❌                                 | ImageIO             | WIC          |
-| Resize / rotate / flip | Highway SIMD                       | Accelerate vImage ³ | Highway SIMD |
-| HEIC / AVIF            | ❌ `ERR_IMAGE_FORMAT_UNSUPPORTED`  | ImageIO ²           | WIC ¹        |
-| Clipboard              | ❌ returns `null`                  | NSPasteboard        | Win32        |
+|                        | Linux                             | macOS               | Windows      |
+| ---------------------- | --------------------------------- | ------------------- | ------------ |
+| JPEG / PNG / WebP      | built-in · built-in · libwebp     | same                | same         |
+| BMP / GIF (decode)     | built-in                          | ImageIO             | WIC          |
+| TIFF (decode)          | ❌                                | ImageIO             | WIC          |
+| Resize / rotate / flip | Highway SIMD                      | Accelerate vImage ³ | Highway SIMD |
+| HEIC / AVIF            | ❌ `ERR_IMAGE_FORMAT_UNSUPPORTED` | ImageIO ²           | WIC ¹        |
+| Clipboard              | ❌ returns `null`                 | NSPasteboard        | Win32        |
 
 ¹ Windows requires the **HEIF Image Extensions** / **AV1 Video Extension** from the Microsoft Store.
 ² AVIF _encode_ needs an OS AV1 encoder — Apple Silicon M3+ only. Intel Mac and M1/M2 reject with `ERR_IMAGE_FORMAT_UNSUPPORTED`; AVIF _decode_ works everywhere ImageIO does (macOS 13+).

misctools/jpegdiff/.gitignore

@@ -0,0 +1,4 @@
+target*/
+Cargo.lock
+kernels
+kernels-arm64

misctools/jpegdiff/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "jpegdiff"
+version = "0.0.0"
+edition = "2024"
+
+[workspace]
+
+[dependencies]
+bun_jpeg = { path = "../../src/jpeg" }
+
+[profile.release]
+debug = "line-tables-only"
+overflow-checks = true
+debug-assertions = true
+
+[profile.fast]
+inherits = "release"
+overflow-checks = false
+debug-assertions = false

misctools/jpegdiff/README.md

@@ -0,0 +1,36 @@
+# jpegdiff
+
+Compares `src/jpeg` (`bun_jpeg`) with libjpeg-turbo 3.2.0 as Bun linked it. Temporary: it is here while the replacement
+is under review, so that whoever works on it has the same tools, and goes away before the merge.
+
+Set-up, on x86-64 Linux with clang, nasm and llvm-ar:
+
+1. `git clone https://github.com/libjpeg-turbo/libjpeg-turbo /root/ref/libjpeg-turbo` and check out
+   `c85e6b905bf237038faa936dab160ebfc5da0344`.
+2. Copy it to `/root/ref/libjpeg-turbo-patched` and apply what Bun applied, from the commit before the removal:
+   `git show 92e819d8:patches/libjpeg-turbo/<file>` for each file of `git ls-tree 92e819d8 patches/libjpeg-turbo/`
+   (`scripts/build/deps/libjpeg-turbo.ts` at that commit says how: two patches and the `jbun_stubs.c` overlay).
+3. `mkdir -p /root/ref/build && cp -r include /root/ref/build/` (the headers that the build generated), then
+   `./build-ref.sh`, which writes `/root/ref/build/libtjref.a`.
+4. `vendor/highway` has to be there, which it is after any build of Bun (`scripts/build/deps/highway.ts` has the commit and
+   two patches): `build.rs` compiles `src/jsc/bindings/highway_jpeg.cpp`, the kernels that `bun_jpeg` calls, with `clang++-23`.
+5. `cargo build --release` here. That profile keeps overflow checks and debug assertions; `--profile fast` is for timing.
+
+Programs:
+
+- `jpegdiff <file or dir>...`: decodes at every scale from 8/8 to 1/8 with both and compares pixels, size, ICC profile,
+  whether it fails, and at which stage. A stream that `bun_jpeg` refuses for a redundant scan, which libjpeg-turbo
+  decodes, is counted as `redundant-scan` and not compared.
+- `mutate <dir>... --iters N --seed S --threads T`: the same for random mutations of the files. Failures are saved to
+  `/root/ref/corpus/fail`.
+- `encfuzz --iters N --seed S --threads T --max-dim D`: encodes generated images with both and compares the bytes.
+- `encspecial`: encoder cases that random images do not reach.
+- `bench [file.jpg]...`: times both.
+- `tools/kernels.sh`: checks the kernels alone, for every target of this machine and under qemu for those of arm64.
+
+`HWY_TARGET=SSSE3` (or `AVX2`) in the environment makes any of the programs use the kernels for that target and not
+for the best one that the CPU has.
+
+`src/reference.rs` replays what `src/runtime/image/codec_jpeg.rs` did at 92e819d8. `tools/gen_corpus.sh` makes the seed
+corpus with libjpeg-turbo's `cjpeg` and `jpegtran`. `regress/` holds inputs that once differed. The reference takes
+`JSIMD_FORCENONE=1` and `JSIMD_FORCESSE2=1` in the environment.

misctools/jpegdiff/build-ref.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Builds /root/ref/build/libtjref.a from the patched libjpeg-turbo, the way scripts/build/deps/libjpeg-turbo.ts did (x64, release flags).
+set -euo pipefail
+SRC=/root/ref/libjpeg-turbo-patched
+OUT=/root/ref/build
+CC=${CC:-clang-23}
+EXTRA=${EXTRA:-}
+OBJ=$OUT/obj${SUFFIX:-}
+rm -rf "$OBJ"
+mkdir -p $OBJ
+JPEG8="jcapimin jcapistd jccoefct jccolor jcdctmgr jcdiffct jchuff jcicc jcinit jclhuff jclossls jcmainct jcmarker jcmaster jcomapi jcparam jcphuff jcprepct jcsample jctrans jdapimin jdapistd jdatadst jdatasrc jdcoefct jdcolor jddctmgr jddiffct jdhuff jdicc jdinput jdlhuff jdlossls jdmainct jdmarker jdmaster jdmerge jdphuff jdpostct jdsample jdtrans jfdctflt jfdctfst jfdctint jidctflt jidctfst jidctint jidctred jaricom jcarith jdarith jerror jmemmgr jmemnobs jquant1 jquant2 jutils jpeg_nbits"
+TJ="turbojpeg transupp jdatadst-tj jdatasrc-tj"
+SIMD="jsimdcpu jfdctflt-sse jccolor-sse2 jcgray-sse2 jchuff-sse2 jcphuff-sse2 jcsample-sse2 jdcolor-sse2 jdmerge-sse2 jdsample-sse2 jfdctfst-sse2 jfdctint-sse2 jidctflt-sse2 jidctfst-sse2 jidctint-sse2 jidctred-sse2 jquantf-sse2 jquanti-sse2 jccolor-avx2 jcgray-avx2 jcsample-avx2 jdcolor-avx2 jdmerge-avx2 jdsample-avx2 jfdctint-avx2 jidctint-avx2 jquanti-avx2"
+CFLAGS="-march=nehalem -O2 -g -fPIC -fno-omit-frame-pointer -I$SRC/src -I$OUT/include -DBUN_8BIT_ONLY -DUSE_CLZ_INTRINSIC $EXTRA"
+for f in $JPEG8 $TJ; do $CC $CFLAGS -c $SRC/src/$f.c -o $OBJ/$f.o & done
+$CC $CFLAGS -c $SRC/jbun_stubs.c -o $OBJ/jbun_stubs.o &
+$CC $CFLAGS -c $SRC/simd/jsimd.c -o $OBJ/jsimd.o &
+for f in $SIMD; do nasm -felf64 -DELF -D__x86_64__ -DPIC -I$SRC/simd/nasm/ -I$SRC/simd/x86_64/ -o $OBJ/$f.o $SRC/simd/x86_64/$f.asm & done
+failed=0
+for job in $(jobs -p); do wait "$job" || failed=1; done
+[ $failed = 0 ]
+rm -f $OUT/libtjref${SUFFIX:-}.a
+llvm-ar-23 rcs $OUT/libtjref${SUFFIX:-}.a $OBJ/*.o
+ls -la $OUT/libtjref${SUFFIX:-}.a