Upgrade webkit 20251007

cmake/tools/SetupWebKit.cmake

@@ -2,7 +2,7 @@ option(WEBKIT_VERSION "The version of WebKit to use")
 option(WEBKIT_LOCAL "If a local version of WebKit should be used instead of downloading")
 
 if(NOT WEBKIT_VERSION)
-  set(WEBKIT_VERSION 6d0f3aac0b817cc01a846b3754b21271adedac12)
+  set(WEBKIT_VERSION preview-pr-113-a8c96c80)
 endif()
 
 string(SUBSTRING ${WEBKIT_VERSION} 0 16 WEBKIT_VERSION_PREFIX)

src/bun.js/bindings/BunPlugin.cpp

@@ -593,15 +593,15 @@ extern "C" JSC_DEFINE_HOST_FUNCTION(JSMock__jsModuleMock, (JSC::JSGlobalObject *
 
         if (result && result.isObject()) {
             while (JSC::JSPromise* promise = jsDynamicCast<JSC::JSPromise*>(result)) {
-                switch (promise->status(vm)) {
+                switch (promise->status()) {
                 case JSC::JSPromise::Status::Rejected: {
-                    result = promise->result(vm);
+                    result = promise->result();
                     scope.throwException(globalObject, result);
                     return {};
                     break;
                 }
                 case JSC::JSPromise::Status::Fulfilled: {
-                    result = promise->result(vm);
+                    result = promise->result();
                     break;
                 }
                 // TODO: blocking wait for promise
@@ -740,13 +740,13 @@ EncodedJSValue BunPlugin::OnLoad::run(JSC::JSGlobalObject* globalObject, BunStri
     RETURN_IF_EXCEPTION(scope, {});
 
     if (auto* promise = JSC::jsDynamicCast<JSPromise*>(result)) {
-        switch (promise->status(vm)) {
+        switch (promise->status()) {
         case JSPromise::Status::Rejected:
         case JSPromise::Status::Pending: {
             return JSValue::encode(promise);
         }
         case JSPromise::Status::Fulfilled: {
-            result = promise->result(vm);
+            result = promise->result();
             break;
         }
         }
@@ -826,18 +826,18 @@ EncodedJSValue BunPlugin::OnResolve::run(JSC::JSGlobalObject* globalObject, BunS
         }
 
         if (auto* promise = JSC::jsDynamicCast<JSPromise*>(result)) {
-            switch (promise->status(vm)) {
+            switch (promise->status()) {
             case JSPromise::Status::Pending: {
                 JSC::throwTypeError(globalObject, scope, "onResolve() doesn't support pending promises yet"_s);
                 return {};
             }
             case JSPromise::Status::Rejected: {
                 promise->internalField(JSC::JSPromise::Field::Flags).set(vm, promise, jsNumber(static_cast<unsigned>(JSC::JSPromise::Status::Fulfilled)));
-                result = promise->result(vm);
+                result = promise->result();
                 return JSValue::encode(result);
             }
             case JSPromise::Status::Fulfilled: {
-                result = promise->result(vm);
+                result = promise->result();
                 break;
             }
             }
@@ -913,13 +913,13 @@ JSC::JSValue runVirtualModule(Zig::GlobalObject* globalObject, BunString* specif
         RETURN_IF_EXCEPTION(throwScope, JSC::jsUndefined());
 
         if (auto* promise = JSC::jsDynamicCast<JSPromise*>(result)) {
-            switch (promise->status(vm)) {
+            switch (promise->status()) {
             case JSPromise::Status::Rejected:
             case JSPromise::Status::Pending: {
                 return promise;
             }
             case JSPromise::Status::Fulfilled: {
-                result = promise->result(vm);
+                result = promise->result();
                 break;
             }
             }

src/bun.js/bindings/JSMockFunction.cpp

@@ -14,6 +14,7 @@
 #include <JavaScriptCore/LazyProperty.h>
 #include <JavaScriptCore/JSCJSValueInlines.h>
 #include <JavaScriptCore/JSInternalPromise.h>
+#include <JavaScriptCore/JSPromiseConstructor.h>
 #include <JavaScriptCore/LazyPropertyInlines.h>
 #include <JavaScriptCore/VMTrapsInlines.h>
 #include <JavaScriptCore/Weak.h>
@@ -965,6 +966,7 @@ JSC_DEFINE_HOST_FUNCTION(jsMockFunctionCall, (JSGlobalObject * lexicalGlobalObje
         }
         case JSMockImplementation::Kind::RejectedValue: {
             JSValue rejectedPromise = JSC::JSPromise::rejectedPromise(globalObject, impl->underlyingValue.get());
+            RETURN_IF_EXCEPTION(scope, {});
             setReturnValue(createMockResult(vm, globalObject, "return"_s, rejectedPromise));
             return JSValue::encode(rejectedPromise);
         }

src/bun.js/bindings/JSType.zig

@@ -488,48 +488,52 @@ pub const JSType = enum(u8) {
     /// Internal object used to track the state of Promise.all() resolution.
     PromiseAllContext = 77,
 
+    /// Promise reaction object for tracking promise callbacks.
+    /// Internal object used in the promise resolution mechanism.
+    PromiseReaction = 78,
+
     /// JavaScript Map object for key-value storage.
     /// ```js
     /// new Map()
     /// map.set(key, value)
     /// map.get(key)
     /// ```
-    Map = 78,
+    Map = 79,
 
     /// JavaScript Set object for unique value storage.
     /// ```js
     /// new Set()
     /// set.add(value)
     /// set.has(value)
     /// ```
-    Set = 79,
+    Set = 80,
 
     /// WeakMap for weak key-value references.
     /// ```js
     /// new WeakMap()
     /// weakMap.set(object, value)
     /// ```
-    WeakMap = 80,
+    WeakMap = 81,
 
     /// WeakSet for weak value references.
     /// ```js
     /// new WeakSet()
     /// weakSet.add(object)
     /// ```
-    WeakSet = 81,
+    WeakSet = 82,
 
-    WebAssemblyModule = 82,
-    WebAssemblyInstance = 83,
-    WebAssemblyGCObject = 84,
+    WebAssemblyModule = 83,
+    WebAssemblyInstance = 84,
+    WebAssemblyGCObject = 85,
 
     /// Boxed String object.
     /// ```js
     /// new String("hello")
     /// ```
-    StringObject = 85,
+    StringObject = 86,
 
-    DerivedStringObject = 86,
-    InternalFieldTuple = 87,
+    DerivedStringObject = 87,
+    InternalFieldTuple = 88,
 
     MaxJS = 0b11111111,
     Event = 0b11101111,

src/bun.js/bindings/ModuleLoader.cpp

@@ -676,11 +676,11 @@ JSValue fetchCommonJSModule(
                 RELEASE_AND_RETURN(scope, target);
             }
             JSPromise* promise = jsCast<JSPromise*>(promiseOrCommonJSModule);
-            switch (promise->status(vm)) {
+            switch (promise->status()) {
             case JSPromise::Status::Rejected: {
                 uint32_t promiseFlags = promise->internalField(JSPromise::Field::Flags).get().asUInt32AsAnyInt();
                 promise->internalField(JSPromise::Field::Flags).set(vm, promise, jsNumber(promiseFlags | JSPromise::isHandledFlag));
-                JSC::throwException(globalObject, scope, promise->result(vm));
+                JSC::throwException(globalObject, scope, promise->result());
                 RELEASE_AND_RETURN(scope, JSValue {});
             }
             case JSPromise::Status::Pending: {
@@ -693,7 +693,7 @@ JSValue fetchCommonJSModule(
                     RELEASE_AND_RETURN(scope, {});
                 }
                 if (!wasModuleMock) {
-                    auto* jsSourceCode = jsCast<JSSourceCode*>(promise->result(vm));
+                    auto* jsSourceCode = jsCast<JSSourceCode*>(promise->result());
                     globalObject->moduleLoader()->provideFetch(globalObject, specifierValue, jsSourceCode->sourceCode());
                     RETURN_IF_EXCEPTION(scope, {});
                 }
@@ -727,11 +727,11 @@ JSValue fetchCommonJSModule(
                 RELEASE_AND_RETURN(scope, target);
             }
             JSPromise* promise = jsCast<JSPromise*>(promiseOrCommonJSModule);
-            switch (promise->status(vm)) {
+            switch (promise->status()) {
             case JSPromise::Status::Rejected: {
                 uint32_t promiseFlags = promise->internalField(JSPromise::Field::Flags).get().asUInt32AsAnyInt();
                 promise->internalField(JSPromise::Field::Flags).set(vm, promise, jsNumber(promiseFlags | JSPromise::isHandledFlag));
-                JSC::throwException(globalObject, scope, promise->result(vm));
+                JSC::throwException(globalObject, scope, promise->result());
                 RELEASE_AND_RETURN(scope, JSValue {});
             }
             case JSPromise::Status::Pending: {
@@ -744,7 +744,7 @@ JSValue fetchCommonJSModule(
                     RELEASE_AND_RETURN(scope, {});
                 }
                 if (!wasModuleMock) {
-                    auto* jsSourceCode = jsCast<JSSourceCode*>(promise->result(vm));
+                    auto* jsSourceCode = jsCast<JSSourceCode*>(promise->result());
                     globalObject->moduleLoader()->provideFetch(globalObject, specifierValue, jsSourceCode->sourceCode());
                     RETURN_IF_EXCEPTION(scope, {});
                 }

src/bun.js/bindings/NodeVM.cpp

@@ -319,7 +319,7 @@ static JSInternalPromise* importModuleInner(JSGlobalObject* globalObject, JSStri
     promise->fulfill(globalObject, result);
     RETURN_IF_EXCEPTION(scope, nullptr);
 
-    promise = promise->then(globalObject, transformer, nullptr);
+    promise = promise->then(globalObject, transformer, globalObject->promiseEmptyOnRejectedFunction());
     RETURN_IF_EXCEPTION(scope, nullptr);
 
     RELEASE_AND_RETURN(scope, promise);

src/bun.js/bindings/ZigGlobalObject.cpp

@@ -840,6 +840,13 @@ void GlobalObject::promiseRejectionTracker(JSGlobalObject* obj, JSC::JSPromise*
 
     // Do this in C++ for now
     auto* globalObj = static_cast<GlobalObject*>(obj);
+
+    // JSInternalPromise should not be tracked through the normal promise rejection mechanism
+    // as they are internal to the engine and should not be exposed to user space.
+    // See: JSInternalPromise.h - "CAUTION: Must not leak the JSInternalPromise to the user space"
+    if (jsDynamicCast<JSC::JSInternalPromise*>(promise))
+        return;
+
     switch (operation) {
     case JSPromiseRejectionOperation::Reject:
         globalObj->m_aboutToBeNotifiedRejectedPromises.append(obj->vm(), globalObj, promise);
@@ -1047,8 +1054,9 @@ JSC_DEFINE_HOST_FUNCTION(functionQueueMicrotask,
     }
 
     // This is a JSC builtin function
-    lexicalGlobalObject->queueMicrotask(function, callback, asyncContext,
-        JSC::JSValue {}, JSC::JSValue {});
+    // BunPerformMicrotaskJob expects: performMicrotask, job, asyncContext, arg0, arg1
+    JSC::QueuedTask task { nullptr, JSC::InternalMicrotask::BunPerformMicrotaskJob, globalObject, function, callback, asyncContext };
+    globalObject->vm().queueMicrotask(WTFMove(task));
 
     return JSC::JSValue::encode(JSC::jsUndefined());
 }
@@ -2968,7 +2976,7 @@ void GlobalObject::handleRejectedPromises()
     JSC::VM& virtual_machine = vm();
     auto scope = DECLARE_CATCH_SCOPE(virtual_machine);
     while (auto* promise = m_aboutToBeNotifiedRejectedPromises.takeFirst(this)) {
-        if (promise->isHandled(virtual_machine))
+        if (promise->isHandled())
             continue;
 
         Bun__handleRejectedPromise(this, promise);
@@ -3075,7 +3083,9 @@ extern "C" void JSC__JSGlobalObject__queueMicrotaskCallback(Zig::GlobalObject* g
 #endif
 
     // Do not use JSCell* here because the GC will try to visit it.
-    globalObject->queueMicrotask(function, JSValue(std::bit_cast<double>(reinterpret_cast<uintptr_t>(ptr))), JSValue(std::bit_cast<double>(reinterpret_cast<uintptr_t>(callback))), jsUndefined(), jsUndefined());
+    // Use BunInvokeJobWithArguments to pass the two arguments (ptr and callback) to the trampoline function
+    JSC::QueuedTask task { nullptr, JSC::InternalMicrotask::BunInvokeJobWithArguments, globalObject, function, JSValue(std::bit_cast<double>(reinterpret_cast<uintptr_t>(ptr))), JSValue(std::bit_cast<double>(reinterpret_cast<uintptr_t>(callback))) };
+    globalObject->vm().queueMicrotask(WTFMove(task));
 }
 
 JSC::Identifier GlobalObject::moduleLoaderResolve(JSGlobalObject* jsGlobalObject,