Upgrade LLVM toolchain from 21.1.8 to 22.1.8

.github/workflows/build-preview.yml

@@ -80,7 +80,7 @@ jobs:
       build_ref: ${{ needs.trigger.outputs.sha }}
       release_tag: ${{ needs.trigger.outputs.release_tag }}
       is_prerelease: true
-      llvm_version: '19'
+      llvm_version: '22'
 
   notify:
     name: Update PR Comment

.github/workflows/build-reusable.yml

@@ -1,7 +1,7 @@
 name: Build WebKit (Reusable)
 
 env:
-  LLVM_VERSION: 21
+  LLVM_VERSION: 22
 
 on:
   workflow_call:
@@ -21,7 +21,7 @@ on:
       llvm_version:
         description: 'LLVM version to use'
         type: string
-        default: '19'
+        default: '22'
     outputs:
       release_tag:
         description: 'The release tag that was created'
@@ -32,6 +32,8 @@ jobs:
     name: Linux
     runs-on: ${{matrix.os}}
     strategy:
+      # One variant's failure shouldn't cancel the others.
+      fail-fast: false
       matrix:
         include:
           - lto_flag: ""
@@ -266,8 +268,8 @@ jobs:
           scoop config use_external_7zip true
           scoop install ninja
           # Install LLVM ARM64 from official LLVM releases
-          # Use LLVM 21 for ARM64 - has better Windows ARM64 support and fixes SEH unwind bugs
-          $llvmVersion = "21.1.8"
+          # Use LLVM 22 for ARM64 - has better Windows ARM64 support and fixes SEH unwind bugs
+          $llvmVersion = "22.1.8"
           $llvmUrl = "https://github.com/llvm/llvm-project/releases/download/llvmorg-$llvmVersion/LLVM-$llvmVersion-woa64.exe"
           $llvmPath = "C:\LLVM"
           Invoke-WebRequest -Uri $llvmUrl -OutFile "$env:TEMP\llvm-arm64.exe"
@@ -305,6 +307,8 @@ jobs:
     name: Linux musl
     runs-on: ${{matrix.os}}
     strategy:
+      # One variant's failure shouldn't cancel the others.
+      fail-fast: false
       matrix:
         include:
           - lto_flag: ""
@@ -390,6 +394,8 @@ jobs:
     # mac-release.bash remains for building on a real Mac locally.
     runs-on: linux-x64-gh
     strategy:
+      # One variant's failure shouldn't cancel the others.
+      fail-fast: false
       matrix:
         include:
           - label: bun-webkit-macos-arm64
@@ -484,6 +490,8 @@ jobs:
     # so all FreeBSD targets build on x64 regardless of target arch.
     runs-on: linux-x64-gh
     strategy:
+      # One variant's failure shouldn't cancel the others.
+      fail-fast: false
       matrix:
         include:
           - label: bun-webkit-freebsd-amd64
@@ -541,6 +549,8 @@ jobs:
     # cross-compile from x64 regardless of target arch.
     runs-on: linux-x64-gh
     strategy:
+      # One variant's failure shouldn't cancel the others.
+      fail-fast: false
       matrix:
         include:
           - label: bun-webkit-linux-arm64-android

.github/workflows/build.yml

@@ -9,7 +9,7 @@ on:
     inputs:
       llvm_version:
         description: "LLVM version"
-        default: "19"
+        default: "22"
 
 jobs:
   build:
@@ -22,4 +22,4 @@ jobs:
       build_ref: ${{ github.sha }}
       release_tag: autobuild-${{ github.sha }}
       is_prerelease: false
-      llvm_version: ${{ inputs.llvm_version || '19' }}
+      llvm_version: ${{ inputs.llvm_version || '22' }}

Dockerfile

@@ -3,7 +3,7 @@ ARG WEBKIT_RELEASE_TYPE=Release
 ARG CPU=native
 ARG LTO_FLAG="-flto=thin -fno-split-lto-unit -fwhole-program-vtables -fforce-emit-vtables "
 ARG RELEASE_FLAGS="-O3 -DNDEBUG=1"
-ARG LLVM_VERSION="21"
+ARG LLVM_VERSION="22"
 ARG DEFAULT_CFLAGS="-mno-omit-leaf-frame-pointer -g -fno-omit-frame-pointer -ffunction-sections -fdata-sections -faddrsig -fno-unwind-tables -fno-asynchronous-unwind-tables -DU_STATIC_IMPLEMENTATION=1 "
 ARG ENABLE_SANITIZERS=""
 ARG USE_MIMALLOC="OFF"
@@ -31,15 +31,20 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 # Both archive.ubuntu.com and azure.archive.ubuntu.com have intermittently
 # timed out from inside the GitHub-hosted docker-buildx network at different
-# times. Prefer Azure (faster on Azure-hosted runners) but fall back to the
-# canonical mirror if `apt-get update` can't reach it. arm64 uses
-# ports.ubuntu.com which has been reachable, so leave it alone.
-RUN sed -i 's|http://archive.ubuntu.com/ubuntu|http://azure.archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list
+# times, and ports.ubuntu.com (arm64) has gone fully dark for hours at a
+# stretch. Prefer Azure on amd64 (faster on Azure-hosted runners). On any
+# failed attempt, swap to a fallback mirror before retrying: amd64 falls back
+# to the canonical archive, arm64 falls back to a Launchpad-registered
+# ubuntu-ports mirror.
+RUN sed -i 's|http://archive.ubuntu.com/ubuntu|http://azure.archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list \
+    && echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/99-retries
 
-# Install basic build dependencies
-RUN ( apt-get update || \
-      ( sed -i 's|http://azure.archive.ubuntu.com/ubuntu|http://archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list && apt-get update ) \
-    ) && apt-get install -y \
+# Install basic build dependencies. `apt-get update` exits 0 on partial index
+# fetch failure (only W:, not E:), which then makes the install fail with
+# "no installation candidate" — so retry the whole update+install, swapping
+# to a fallback mirror after the first failure.
+RUN for attempt in 1 2 3; do \
+      apt-get update && apt-get install -y \
     wget \
     curl \
     git \
@@ -52,6 +57,15 @@ RUN ( apt-get update || \
     ca-certificates \
     gnupg \
     lsb-release \
+    && break || { \
+        echo "apt attempt $attempt failed, swapping mirrors and retrying"; \
+        sed -i -e 's|http://azure.archive.ubuntu.com/ubuntu|http://archive.ubuntu.com/ubuntu|g' \
+               -e 's|http://ports.ubuntu.com/ubuntu-ports|http://mirrors.ocf.berkeley.edu/ubuntu-ports|g' \
+               /etc/apt/sources.list; \
+        sleep 15; \
+    }; \
+    done \
+    && dpkg -l wget curl git python3 ninja-build lsb-release >/dev/null \
     && rm -rf /var/lib/apt/lists/*
 
 # Install zstd (for icu/compress-data.ts). Pinned: focal's apt has 1.4.4 which
@@ -102,11 +116,65 @@ RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-13 130 \
     --slave /usr/bin/gcc-nm gcc-nm /usr/bin/gcc-nm-13 \
     --slave /usr/bin/gcc-ranlib gcc-ranlib /usr/bin/gcc-ranlib-13
 
-# Install LLVM 21
-RUN wget https://apt.llvm.org/llvm.sh \
-    && chmod +x llvm.sh \
-    && ./llvm.sh 21 all \
-    && rm llvm.sh \
+# Install LLVM 22.
+#
+# apt.llvm.org stopped publishing focal arm64 binaries for the 22 release
+# (llvm-toolchain-focal-22/main/binary-arm64 carries only the Architecture:all
+# -doc/-examples packages). The bullseye repo still has the full arm64 set and
+# is built against glibc 2.31 (same as focal), so on arm64 we pull from there
+# instead. The bullseye clang-22 package declares Depends on Debian's
+# libstdc++-10-dev/libgcc-10-dev/libobjc-10-dev, which focal doesn't name that
+# way (we use gcc-13's libstdc++ via the PPA and set its include paths below),
+# so those three are satisfied with equivs dummies before the install.
+#
+# Two more bullseye-vs-focal gaps have to be closed on arm64:
+#
+#   libz3: bullseye's libllvm22 needs libz3-4 (>= 4.8.10) and llvm-22-dev needs
+#   the matching libz3-dev; focal only has 4.8.7. equivs can't paper over this
+#   one -- libz3.so.4 is a real DT_NEEDED of libLLVM, so a dummy would make
+#   clang-22 fail to start. The two bullseye .debs are installed directly,
+#   SHA-256-pinned, rather than by adding deb.debian.org as an apt source: it
+#   keeps apt from pulling any other Debian package into the image, in
+#   particular a libc6/libstdc++6 that would move the glibc floor. Both only
+#   declare libc6 (>= 2.30) / libstdc++6 (>= 9), which focal already satisfies,
+#   so the floor stays where the base image puts it (verified: libc6 stays at
+#   2.31 and a clang++-22 -stdlib=libstdc++ binary still tops out at GLIBC_2.17).
+#
+#   lldb-22: pulls python3-lldb-22, which Depends: python3 (>= 3.9~) (<< 3.10).
+#   focal ships python3.8, so it is not installable here and would need Debian's
+#   whole python3 stack. Nothing in the build uses lldb, so arm64 omits it; the
+#   /usr/bin/lldb symlink below is left dangling, which is harmless.
+ARG LIBZ3_VERSION=4.8.10-1
+ARG LIBZ3_SHA256_arm64=ae1ea58ecfdd4b5ec53d734e60ac2df37fddb11888b7730a19335f1a9b09f489
+ARG LIBZ3_DEV_SHA256_arm64=4739e62c1f39c35f2382f15347b588245a71bd12c8628a8caa6639fdc1774b6c
+RUN wget -qO /etc/apt/trusted.gpg.d/apt.llvm.org.asc https://apt.llvm.org/llvm-snapshot.gpg.key \
+    && if [ "$TARGETARCH" = "arm64" ]; then \
+         echo "deb https://apt.llvm.org/bullseye/ llvm-toolchain-bullseye-22 main" > /etc/apt/sources.list.d/llvm.list \
+         && apt-get update \
+         && apt-get install -y --no-install-recommends equivs \
+         && for p in libstdc++-10-dev libgcc-10-dev libobjc-10-dev; do \
+              printf 'Section: misc\nPriority: optional\nStandards-Version: 3.9.2\nPackage: %s\nVersion: 99\nDescription: dummy for bullseye clang-22 dep\n' "$p" > /tmp/$p.ctl \
+              && (cd /tmp && equivs-build $p.ctl && dpkg -i ${p}_99_all.deb && rm -f $p.ctl ${p}_99_all.deb); \
+            done \
+         && curl -fsSL --retry 5 --retry-connrefused \
+              "http://deb.debian.org/debian/pool/main/z/z3/libz3-4_${LIBZ3_VERSION}_arm64.deb" -o /tmp/libz3-4.deb \
+         && curl -fsSL --retry 5 --retry-connrefused \
+              "http://deb.debian.org/debian/pool/main/z/z3/libz3-dev_${LIBZ3_VERSION}_arm64.deb" -o /tmp/libz3-dev.deb \
+         && echo "${LIBZ3_SHA256_arm64}  /tmp/libz3-4.deb" | sha256sum -c - \
+         && echo "${LIBZ3_DEV_SHA256_arm64}  /tmp/libz3-dev.deb" | sha256sum -c - \
+         && dpkg -i /tmp/libz3-4.deb /tmp/libz3-dev.deb \
+         && rm -f /tmp/libz3-4.deb /tmp/libz3-dev.deb \
+         && apt-get install -y --no-install-recommends \
+              clang-22 lld-22 llvm-22 llvm-22-dev llvm-22-tools llvm-22-runtime \
+              llvm-22-linker-tools libllvm22 libclang-cpp22 libclang1-22 \
+              libclang-common-22-dev libclang-rt-22-dev liblld-22 clangd-22; \
+       else \
+         wget https://apt.llvm.org/llvm.sh \
+         && chmod +x llvm.sh \
+         && ./llvm.sh 22 all \
+         && rm llvm.sh; \
+       fi \
+    && clang-22 --version \
     && rm -rf /var/lib/apt/lists/*
 
 # Configure library paths

Dockerfile.android

@@ -1,7 +1,7 @@
 ARG MARCH_FLAG="-march=armv8-a+crc -mtune=cortex-a78"
 ARG WEBKIT_RELEASE_TYPE=Release
 ARG LTO_FLAG=""
-ARG LLVM_VERSION="21"
+ARG LLVM_VERSION="22"
 ARG NDK_VERSION="r27c"
 ARG NDK_SHA256="59c2f6dc96743b5daf5d1626684640b20a6bd2b1d85b13156b90333741bad5cc"
 ARG ANDROID_API="28"
@@ -28,7 +28,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 # Host clang (same version Bun uses) — we cross-compile via --target/--sysroot,
 # not via the NDK's bundled clang. apt.llvm.org installs version-suffixed names
-# only (ld.lld-21, not ld.lld), so add unversioned links for -fuse-ld=lld.
+# only (ld.lld-22, not ld.lld), so add unversioned links for -fuse-ld=lld.
 RUN wget -qO- https://apt.llvm.org/llvm.sh | bash -s -- ${LLVM_VERSION} && \
     for t in clang clang++ ld.lld lld llvm-ar llvm-ranlib; do \
       ln -sf /usr/bin/${t}-${LLVM_VERSION} /usr/local/bin/${t}; \

Dockerfile.freebsd

@@ -1,7 +1,7 @@
 ARG MARCH_FLAG="-march=nehalem"
 ARG WEBKIT_RELEASE_TYPE=Release
 ARG LTO_FLAG=""
-ARG LLVM_VERSION="21"
+ARG LLVM_VERSION="22"
 ARG FREEBSD_VERSION="14.3"
 ARG FREEBSD_ARCH="x86_64"
 ARG DEFAULT_CFLAGS="-mno-omit-leaf-frame-pointer -fno-omit-frame-pointer -ffunction-sections -fdata-sections -faddrsig -fno-unwind-tables -fno-asynchronous-unwind-tables -DU_STATIC_IMPLEMENTATION=1 "

Dockerfile.macos

@@ -29,7 +29,7 @@ ARG BUN_DOWNLOAD_URL="https://pub-5e11e972747a44bf9aaf9394f185a982.r2.dev/releas
 ARG WEBKIT_RELEASE_TYPE=Release
 ARG LTO_FLAG=""
 ARG MARCH_FLAG="-mcpu=apple-m1"
-ARG LLVM_VERSION="21"
+ARG LLVM_VERSION="22"
 ARG BOOTSTRAP_CMDS_TAG="bootstrap_cmds-138"
 # Matches the native macOS lane's CMAKE_C_FLAGS (build-reusable.yml) plus -g
 # from mac-release.bash. Cross-only additions live in the build stage.
@@ -47,8 +47,8 @@ ARG ENABLE_MALLOC_HEAP_BREAKDOWN="OFF"
 ARG ENABLE_SANITIZERS=""
 ARG USE_MIMALLOC="OFF"
 ARG USE_EXTERNAL_MIMALLOC="OFF"
-ARG COMPILER_RT_DARWIN_TAG="compiler-rt-darwin-21.1.8"
-ARG COMPILER_RT_DARWIN_SHA256="f9bab8191d63873682ec69492d06cfdf0807a7335c4e9b188ef013b3cc3c9dbc"
+ARG COMPILER_RT_DARWIN_TAG="compiler-rt-darwin-22.1.8"
+ARG COMPILER_RT_DARWIN_SHA256="2a6cb08a41880f20f882205d567ee0676ced7db9aaeccfa2e26643d94eca23b7"
 
 FROM ubuntu:24.04 AS base
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
@@ -113,7 +113,7 @@ ENV MACOS_SDK=/opt/MacOSX${MACOS_SDK_VERSION}.sdk
 # in Dockerfile). Installed into clang's resource dir where the darwin
 # driver looks for libclang_rt.*_osx*.
 ADD --checksum=sha256:${COMPILER_RT_DARWIN_SHA256} \
-    https://github.com/oven-sh/WebKit/releases/download/${COMPILER_RT_DARWIN_TAG}/compiler-rt-darwin-21.1.8-arm64.tar.gz /compiler-rt-darwin.tar.gz
+    https://github.com/oven-sh/WebKit/releases/download/${COMPILER_RT_DARWIN_TAG}/compiler-rt-darwin-22.1.8-arm64.tar.gz /compiler-rt-darwin.tar.gz
 RUN tar -xzf /compiler-rt-darwin.tar.gz -C /usr/lib/llvm-${LLVM_VERSION}/lib/clang/${LLVM_VERSION}/lib/ && \
     rm /compiler-rt-darwin.tar.gz && \
     test -f /usr/lib/llvm-${LLVM_VERSION}/lib/clang/${LLVM_VERSION}/lib/darwin/libclang_rt.asan_osx_dynamic.dylib

Dockerfile.musl

@@ -2,12 +2,12 @@ ARG MARCH_FLAG=""
 ARG WEBKIT_RELEASE_TYPE=Release
 ARG CPU=native
 ARG LTO_FLAG="-flto=thin -fno-split-lto-unit -fwhole-program-vtables -fforce-emit-vtables "
-ARG LLVM_VERSION="21"
+ARG LLVM_VERSION="22"
 ARG DEFAULT_CFLAGS="-mno-omit-leaf-frame-pointer -g -fno-omit-frame-pointer -ffunction-sections -fdata-sections -faddrsig -fno-unwind-tables -fno-asynchronous-unwind-tables -DU_STATIC_IMPLEMENTATION=1 "
 ARG USE_MIMALLOC="OFF"
 ARG USE_EXTERNAL_MIMALLOC="OFF"
 
-FROM alpine:3.23 as base
+FROM alpine:3.24 as base
 
 ARG MARCH_FLAG
 ARG WEBKIT_RELEASE_TYPE
@@ -16,14 +16,19 @@ ARG LTO_FLAG
 ARG LLVM_VERSION
 ARG DEFAULT_CFLAGS
 
+# alpine 3.24 ships clang22/llvm22/lld22 at 22.1.3; edge has 22.1.8. Tag the
+# edge repo so only the llvm packages come from there (musl is the same
+# version in both, so edge's binaries run on 3.24). Everything else stays on
+# 3.24 stable.
+RUN echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/main" >> /etc/apk/repositories
 RUN apk update
-RUN apk add --no-cache cmake make clang21 clang21-static clang21-dev llvm21-dev llvm21-static musl-dev git lld libgcc gcc g++ libstdc++ build-base lld-dev llvm21-libs libc-dev xz zlib zlib-dev libxml2 libxml2-dev
+RUN apk add --no-cache cmake make clang22@edge clang22-static@edge clang22-dev@edge llvm22-dev@edge llvm22-static@edge lld22@edge lld22-dev@edge llvm22-libs@edge musl-dev git libgcc gcc g++ libstdc++ build-base libc-dev xz zlib zlib-dev libxml2 libxml2-dev
 
-ENV CXX=clang++-21
-ENV CC=clang-21
-ENV LDFLAGS='-L/usr/include -L/usr/include/llvm21'
-ENV CXXFLAGS="-I/usr/include -I/usr/include/llvm21"
-ENV PATH="/usr/bin:/usr/local/bin:/zig/bin:/usr/lib/llvm21/bin:$PATH"
+ENV CXX=clang++-22
+ENV CC=clang-22
+ENV LDFLAGS='-L/usr/include -L/usr/include/llvm22'
+ENV CXXFLAGS="-I/usr/include -I/usr/include/llvm22"
+ENV PATH="/usr/bin:/usr/local/bin:/zig/bin:/usr/lib/llvm22/bin:$PATH"
 ENV CPU=${CPU}
 ENV MARCH_FLAG=${MARCH_FLAG}
 ENV WEBKIT_OUT_DIR=/webkitbuild

Dockerfile.windows

@@ -34,7 +34,7 @@ ARG ICU_MARCH_FLAG="-march=nehalem"
 ARG ENABLE_SANITIZERS=""
 ARG USE_MIMALLOC="OFF"
 ARG USE_EXTERNAL_MIMALLOC="OFF"
-ARG LLVM_VERSION="21"
+ARG LLVM_VERSION="22"
 ARG XWIN_VERSION="0.9.0"
 ARG XWIN_SHA256="31e1033f30608ba6b821d17f1461042bd54c23424813c9b4e9ae15b6d32fa4cd"
 # Pinned MSVC CRT + Windows SDK versions. Bump deliberately; the manifest on
@@ -125,10 +125,10 @@ RUN set -e; \
 # 2.0 with LLVM exceptions; redistribution is permitted.
 # OptionsMSVC.cmake's find_library(CLANG_BUILTINS_LIBRARY) searches
 # WebKitLibraries/windows, which is symlinked to /winsdk in the build stage.
-ADD --checksum=sha256:9cff03d2c5218693b1f91efc0074957c710eeddd932d57a681c8f558b81fbe8e \
-    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.builtins-x86_64.lib /winsdk/clang_rt.builtins-x86_64.lib
-ADD --checksum=sha256:b1bfec6276dde6166aa038de10c378ec17996779786fe1747c40b833cb826e16 \
-    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.builtins-aarch64.lib /winsdk/clang_rt.builtins-aarch64.lib
+ADD --checksum=sha256:22fb8699144ab076d5e331b3deb804e591c43905ec7e0fa5c62ba28f8679d68b \
+    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.builtins-x86_64.lib /winsdk/clang_rt.builtins-x86_64.lib
+ADD --checksum=sha256:06a345ec83e1f19b62442ef6b615ea742effd2593581692fd15d38a10847f5bf \
+    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.builtins-aarch64.lib /winsdk/clang_rt.builtins-aarch64.lib
 
 # Windows ASAN/UBSan runtime for the -asan variant, mirrored from the same
 # LLVM release as the builtins above (x64 only: LLVM ships no Windows ARM64
@@ -139,14 +139,14 @@ ADD --checksum=sha256:b1bfec6276dde6166aa038de10c378ec17996779786fe1747c40b833cb
 # UBSan handlers, so -fsanitize=address,undefined needs no separate
 # ubsan_standalone libraries. A Linux LLVM install doesn't ship any of these;
 # WebKitCompilerFlags.cmake locates them via CLANG_LIB_PATH (set below).
-ADD --checksum=sha256:3dff47943143ab2c1a786a7c90c88f897bfa34e8b5a4c9382eadf8373fd19ec0 \
-    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.asan_dynamic-x86_64.lib /winsdk/clang_rt.asan_dynamic-x86_64.lib
-ADD --checksum=sha256:d4a0398ed7d2e1361674fbb2cfceec4df502052cfe17b51718b061e9fe523719 \
-    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.asan_static_runtime_thunk-x86_64.lib /winsdk/clang_rt.asan_static_runtime_thunk-x86_64.lib
-ADD --checksum=sha256:b3c1d6c988792651cc0b0b61b4114cbe513a5e2f6beb067fd54a96b98be9b328 \
-    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.asan_dynamic_runtime_thunk-x86_64.lib /winsdk/clang_rt.asan_dynamic_runtime_thunk-x86_64.lib
-ADD --checksum=sha256:14025e779d3c67c53027312d7542aea8f814e5237e59f41cfc6165666189f886 \
-    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-21.1.8/clang_rt.asan_dynamic-x86_64.dll /winsdk/clang_rt.asan_dynamic-x86_64.dll
+ADD --checksum=sha256:208ff221af5dff61be90398b1e569d1b2f3b5335066c5c87444454920c3eadb6 \
+    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.asan_dynamic-x86_64.lib /winsdk/clang_rt.asan_dynamic-x86_64.lib
+ADD --checksum=sha256:e9571b2c165e1c74475e887858ad344769bb2613547bb91cfe3ada44d378f7bb \
+    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.asan_static_runtime_thunk-x86_64.lib /winsdk/clang_rt.asan_static_runtime_thunk-x86_64.lib
+ADD --checksum=sha256:ec97ba766ff24271f7848393601fe5f3eb0c95c3c6cbedfd0913434e425c9096 \
+    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.asan_dynamic_runtime_thunk-x86_64.lib /winsdk/clang_rt.asan_dynamic_runtime_thunk-x86_64.lib
+ADD --checksum=sha256:273d06d96cf390f551b2e0ac36de3a82cf2150271ffc1f5f8b13588ee0df7482 \
+    https://github.com/oven-sh/WebKit/releases/download/compiler-rt-windows-22.1.8/clang_rt.asan_dynamic-x86_64.dll /winsdk/clang_rt.asan_dynamic-x86_64.dll
 
 # Sanity check: compile + link a PE executable for both arches.
 RUN for pair in "x86_64 x64" "aarch64 arm64"; do \

build.ts

@@ -78,10 +78,10 @@ const HAS_CCACHE = CCACHE !== null;
 // On Windows, use clang-cl for MSVC compatibility
 const CC_BASE = IS_WINDOWS
   ? findExecutable(["clang-cl.exe", "clang-cl"]) || "clang-cl"
-  : findExecutable(["clang-21", "clang"]) || "clang";
+  : findExecutable(["clang-22", "clang"]) || "clang";
 const CXX_BASE = IS_WINDOWS
   ? findExecutable(["clang-cl.exe", "clang-cl"]) || "clang-cl"
-  : findExecutable(["clang++-21", "clang++"]) || "clang++";
+  : findExecutable(["clang++-22", "clang++"]) || "clang++";
 
 const CC = HAS_CCACHE ? CCACHE : CC_BASE;
 const CXX = HAS_CCACHE ? CCACHE : CXX_BASE;