From 72f03f1c22936e1bab7ee47c8b53d1f3ead05a70 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Fri, 17 Jul 2026 20:42:30 +0000
Subject: [PATCH 01/69] WIP: inline small strings (runtime + LLInt + baseline
 JIT correct)

Store up to 7 Latin-1 or 3 UTF-16 code units directly in JSString::m_fiber,
tagged with bit 1 (isInlineInPointer). notStringImplMask (bit 0|1) is the
single 'm_fiber is not a raw StringImpl*' test.

Runtime (JSString.h/cpp, JSStringInlines.h): length/is8Bit/view/value/
tryGetValue/tryGetValueImpl/toAtomString/toIdentifier/isSubstring/destroy/
visitChildren/estimatedSize/equal/resolveToBuffer/jsSubstringOfResolved
handle inline. resolveInline() materializes in place, mirroring resolveRope.
jsString(VM&, StringView) and jsSubstringOfResolved create inline for
eligible lengths.

JIT: branchIfRopeStringImpl widened to notStringImplMask. InlineAccess/
InlineCacheCompiler/DFG string-length given an inline-length fast path.
operationResolveRopeString handles inline. FTL isRopeString/isNotRopeString
widened.

State: LLInt + baseline JIT pass a slice/length/charAt/eq loop. DFG/FTL
string-equality and remaining offsetOfLength readers still need fixes.
---
 .../JavaScriptCore/bytecode/InlineAccess.cpp  |   6 +
 .../bytecode/InlineCacheCompiler.cpp          |  11 ++
 .../JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  |  10 ++
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp |   4 +-
 Source/JavaScriptCore/jit/AssemblyHelpers.h   |   5 +-
 Source/JavaScriptCore/jit/JITOperations.cpp   |   8 +
 Source/JavaScriptCore/runtime/JSString.cpp    |  27 +++-
 Source/JavaScriptCore/runtime/JSString.h      | 148 +++++++++++++++++-
 .../JavaScriptCore/runtime/JSStringInlines.h  |  29 +++-
 9 files changed, 237 insertions(+), 11 deletions(-)

diff --git a/Source/JavaScriptCore/bytecode/InlineAccess.cpp b/Source/JavaScriptCore/bytecode/InlineAccess.cpp
index b553c9922f00c..5974297ff08cc 100644
--- a/Source/JavaScriptCore/bytecode/InlineAccess.cpp
+++ b/Source/JavaScriptCore/bytecode/InlineAccess.cpp
@@ -365,6 +365,12 @@ bool InlineAccess::generateStringLength(PropertyInlineCache& propertyCache)
     auto done = jit.jump();
 
     isRope.link(&jit);
+#if USE(BUN_JSC_ADDITIONS)
+    // Inline small strings share the rope branch; their cell is only 16 bytes,
+    // so JSRopeString::offsetOfLength() would read past the end. Take the slow path.
+    jit.branchTestPtr(CCallHelpers::Zero, scratch, CCallHelpers::TrustedImm32(JSString::isRopeInPointer))
+        .linkThunk(propertyCache.slowPathStartLocation, &jit);
+#endif
     jit.load32(CCallHelpers::Address(base, JSRopeString::offsetOfLength()), value.payloadGPR());
 
     done.link(&jit);
diff --git a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
index f4b9d517a6c53..d44c171d8f0cd 100644
--- a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
+++ b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
@@ -3961,8 +3961,19 @@ void InlineCacheCompiler::generateAccessCase(unsigned index, AccessCase& accessC
         auto done = jit.jump();
 
         isRope.link(&jit);
+#if USE(BUN_JSC_ADDITIONS)
+        // Inline small strings: length is in bits 3..7 of m_fiber (still in scratchGPR).
+        auto realRope = jit.branchTestPtr(CCallHelpers::NonZero, scratchGPR, CCallHelpers::TrustedImm32(JSString::isRopeInPointer));
+        jit.urshiftPtr(CCallHelpers::TrustedImm32(JSString::inlineLengthShift), scratchGPR);
+        jit.and32(CCallHelpers::TrustedImm32(0x1f), scratchGPR, valueRegs.payloadGPR());
+        auto doneInline = jit.jump();
+        realRope.link(&jit);
+#endif
         jit.load32(CCallHelpers::Address(baseGPR, JSRopeString::offsetOfLength()), valueRegs.payloadGPR());
 
+#if USE(BUN_JSC_ADDITIONS)
+        doneInline.link(&jit);
+#endif
         done.link(&jit);
         jit.boxInt32(valueRegs.payloadGPR(), valueRegs);
         succeed();
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 0cfe96f55375a..e29b2476f05c7 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -8618,7 +8618,17 @@ void SpeculativeJIT::compileGetArrayLength(Node* node)
         if (isRope.isSet()) {
             auto done = jump();
             isRope.link(this);
+#if USE(BUN_JSC_ADDITIONS)
+            auto realRope = branchTestPtr(NonZero, tempGPR, TrustedImm32(JSString::isRopeInPointer));
+            urshiftPtr(TrustedImm32(JSString::inlineLengthShift), tempGPR);
+            and32(TrustedImm32(0x1f), tempGPR, resultGPR);
+            auto doneInline = jump();
+            realRope.link(this);
+#endif
             load32(Address(baseGPR, JSRopeString::offsetOfLength()), resultGPR);
+#if USE(BUN_JSC_ADDITIONS)
+            doneInline.link(this);
+#endif
             done.link(this);
         }
         strictInt32Result(resultGPR, node);
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 6204924103ad0..70e9f6d24e61d 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -25604,7 +25604,7 @@ IGNORE_CLANG_WARNINGS_END
     {
         if (!canBeRope(edge))
             return m_out.booleanFalse;
-        return m_out.testNonZeroPtr(m_out.loadPtr(string, m_heaps.JSString_value), m_out.constIntPtr(JSString::isRopeInPointer));
+        return m_out.testNonZeroPtr(m_out.loadPtr(string, m_heaps.JSString_value), m_out.constIntPtr(JSString::notStringImplMask));
     }
 
     std::optional<unsigned> tryGetConstantStringLength(Edge edge)
@@ -25621,7 +25621,7 @@ IGNORE_CLANG_WARNINGS_END
     {
         if (!canBeRope(edge))
             return m_out.booleanTrue;
-        return m_out.testIsZeroPtr(m_out.loadPtr(string, m_heaps.JSString_value), m_out.constIntPtr(JSString::isRopeInPointer));
+        return m_out.testIsZeroPtr(m_out.loadPtr(string, m_heaps.JSString_value), m_out.constIntPtr(JSString::notStringImplMask));
     }
 
     LValue isNotSymbol(LValue cell, SpeculatedType type = SpecFullTop)
diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.h b/Source/JavaScriptCore/jit/AssemblyHelpers.h
index 07fcb39b60f83..75bb221c4a5fc 100644
--- a/Source/JavaScriptCore/jit/AssemblyHelpers.h
+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.h
@@ -1245,14 +1245,15 @@ class AssemblyHelpers : public MacroAssembler {
         return branchDouble(DoubleEqualAndOrdered, fpr, fpr);
     }
 
+    // "Rope" here means "not a plain StringImpl*" (rope or inline small string).
     Jump branchIfRopeStringImpl(GPRReg stringImplGPR)
     {
-        return branchTestPtr(NonZero, stringImplGPR, TrustedImm32(JSString::isRopeInPointer));
+        return branchTestPtr(NonZero, stringImplGPR, TrustedImm32(JSString::notStringImplMask));
     }
 
     Jump branchIfNotRopeStringImpl(GPRReg stringImplGPR)
     {
-        return branchTestPtr(Zero, stringImplGPR, TrustedImm32(JSString::isRopeInPointer));
+        return branchTestPtr(Zero, stringImplGPR, TrustedImm32(JSString::notStringImplMask));
     }
 
 #if USE(JSVALUE64)
diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
index 528855d0b0da8..4bae8c27b9063 100644
--- a/Source/JavaScriptCore/jit/JITOperations.cpp
+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
@@ -4628,6 +4628,14 @@ JSC_DEFINE_JIT_OPERATION(operationResolveRopeString, JSString*, (JSGlobalObject*
     JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
     auto scope = DECLARE_THROW_SCOPE(vm);
 
+#if USE(BUN_JSC_ADDITIONS)
+    // compileResolveRope routes inline small strings here via the widened
+    // notStringImplMask test; those are plain JSStrings, not JSRopeStrings.
+    if (static_cast<JSString*>(string)->isInline()) {
+        static_cast<JSString*>(string)->resolveInline(globalObject);
+        OPERATION_RETURN(scope, static_cast<JSString*>(string));
+    }
+#endif
     string->resolveRope(globalObject);
     OPERATION_RETURN(scope, string);
 }
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index 244b58c5102d3..3c139a30d442e 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -75,6 +75,10 @@ void JSString::dumpToStream(const JSCell* cell, PrintStream& out)
             out.printf("[substring]");
         else
             out.printf("[rope]");
+#if USE(BUN_JSC_ADDITIONS)
+    } else if (isInlineFiber(pointer)) {
+        out.printf("[inline %s]", (pointer & JSRopeString::is8BitInPointer) ? "8" : "16");
+#endif
     } else {
         if (WTF::StringImpl* ourImpl = std::bit_cast<StringImpl*>(pointer)) {
             if (ourImpl->is8Bit())
@@ -95,7 +99,7 @@ size_t JSString::estimatedSize(JSCell* cell, VM& vm)
 {
     JSString* thisObject = asString(cell);
     uintptr_t pointer = thisObject->fiberConcurrently();
-    if (pointer & isRopeInPointer)
+    if (pointer & notStringImplMask)
         return Base::estimatedSize(cell, vm);
     return Base::estimatedSize(cell, vm) + std::bit_cast<StringImpl*>(pointer)->costDuringGC();
 }
@@ -135,10 +139,31 @@ void JSString::visitChildrenImpl(JSCell* cell, Visitor& visitor)
         }
         return;
     }
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInlineFiber(pointer))
+        return;
+#endif
     if (StringImpl* impl = std::bit_cast<StringImpl*>(pointer))
         visitor.reportExtraMemoryVisited(impl->costDuringGC());
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+const String& JSString::resolveInline(JSGlobalObject* globalObject) const
+{
+    ASSERT(isInline());
+    uintptr_t fiber = m_fiber;
+    unsigned len = inlineLengthFromFiber(fiber);
+    String result = (fiber & JSRopeString::is8BitInPointer)
+        ? String(StringImpl::create(std::span { inlineData8(), len }))
+        : String(StringImpl::create(std::span { inlineData16(), len }));
+    WTF::storeStoreFence();
+    new (&uninitializedValueInternal()) String(WTF::move(result));
+    if (globalObject)
+        getVM(globalObject).heap.reportExtraMemoryAllocated(this, valueInternal().impl()->cost());
+    return valueInternal();
+}
+#endif
+
 DEFINE_VISIT_CHILDREN(JSString);
 
 template<typename CharacterType>
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index fddac10ab622e..9484e049c2edd 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -138,6 +138,18 @@ class JSString : public JSCell {
     static constexpr unsigned minLengthForRopeWalk = 0x128;
 
     static constexpr uintptr_t isRopeInPointer = 0x1;
+#if USE(BUN_JSC_ADDITIONS)
+    // Inline small strings: bit 1 of m_fiber set with bit 0 clear means the
+    // remaining bytes of m_fiber hold the character data directly (no
+    // StringImpl). Bit 2 is the is8Bit flag (same bit JSRopeString uses).
+    static constexpr uintptr_t isInlineInPointer = 0x2;
+    static constexpr uintptr_t notStringImplMask = isRopeInPointer | isInlineInPointer;
+    static constexpr unsigned inlineLengthShift = 3;
+    static constexpr unsigned maxInlineLength8 = 7;
+    static constexpr unsigned maxInlineLength16 = 3;
+#else
+    static constexpr uintptr_t notStringImplMask = isRopeInPointer;
+#endif
 
     static constexpr unsigned maxLengthForOnStackResolve = 2048;
 
@@ -152,7 +164,7 @@ class JSString : public JSCell {
 
     String& valueInternal() const
     {
-        ASSERT(!isRope());
+        ASSERT(!(m_fiber & notStringImplMask));
         return uninitializedValueInternal();
     }
 
@@ -174,6 +186,15 @@ class JSString : public JSCell {
     {
     }
 
+#if USE(BUN_JSC_ADDITIONS)
+    enum InlineTag { CreateInline };
+    JSString(VM& vm, InlineTag, uintptr_t encodedFiber)
+        : JSCell(CreatingWellDefinedBuiltinCell, vm.stringStructure.get()->id(), defaultTypeInfoBlob())
+        , m_fiber(encodedFiber)
+    {
+    }
+#endif
+
     void finishCreation(VM& vm, unsigned length)
     {
         ASSERT_UNUSED(length, length > 0);
@@ -226,6 +247,40 @@ class JSString : public JSCell {
         return newString;
     }
 
+#if USE(BUN_JSC_ADDITIONS)
+    static ALWAYS_INLINE uintptr_t encodeInline8(std::span<const Latin1Character> chars)
+    {
+        ASSERT(chars.size() >= 2 && chars.size() <= maxInlineLength8);
+        uintptr_t fiber = isInlineInPointer | static_cast<uintptr_t>(StringImpl::flagIs8Bit())
+            | (static_cast<uintptr_t>(chars.size()) << inlineLengthShift);
+        memcpy(reinterpret_cast<uint8_t*>(&fiber) + 1, chars.data(), chars.size());
+        return fiber;
+    }
+
+    static ALWAYS_INLINE uintptr_t encodeInline16(std::span<const char16_t> chars)
+    {
+        ASSERT(chars.size() >= 1 && chars.size() <= maxInlineLength16);
+        uintptr_t fiber = isInlineInPointer
+            | (static_cast<uintptr_t>(chars.size()) << inlineLengthShift);
+        memcpy(reinterpret_cast<uint8_t*>(&fiber) + 2, chars.data(), chars.size() * sizeof(char16_t));
+        return fiber;
+    }
+
+    static JSString* createInline8(VM& vm, std::span<const Latin1Character> chars)
+    {
+        JSString* s = new (NotNull, allocateCell<JSString>(vm)) JSString(vm, CreateInline, encodeInline8(chars));
+        s->Base::finishCreation(vm);
+        return s;
+    }
+
+    static JSString* createInline16(VM& vm, std::span<const char16_t> chars)
+    {
+        JSString* s = new (NotNull, allocateCell<JSString>(vm)) JSString(vm, CreateInline, encodeInline16(chars));
+        s->Base::finishCreation(vm);
+        return s;
+    }
+#endif
+
 protected:
     DECLARE_DEFAULT_FINISH_CREATION;
 
@@ -271,6 +326,30 @@ class JSString : public JSCell {
     {
         return m_fiber & isRopeInPointer;
     }
+
+#if USE(BUN_JSC_ADDITIONS)
+    ALWAYS_INLINE bool isInline() const
+    {
+        return (fiberConcurrently() & notStringImplMask) == isInlineInPointer;
+    }
+    ALWAYS_INLINE static bool isInlineFiber(uintptr_t fiber)
+    {
+        return (fiber & notStringImplMask) == isInlineInPointer;
+    }
+    ALWAYS_INLINE static unsigned inlineLengthFromFiber(uintptr_t fiber)
+    {
+        return static_cast<unsigned>(fiber >> inlineLengthShift) & 0x1fu;
+    }
+    ALWAYS_INLINE const Latin1Character* inlineData8() const
+    {
+        return reinterpret_cast<const Latin1Character*>(&m_fiber) + 1;
+    }
+    ALWAYS_INLINE const char16_t* inlineData16() const
+    {
+        return reinterpret_cast<const char16_t*>(reinterpret_cast<const uint8_t*>(&m_fiber) + 2);
+    }
+    JS_EXPORT_PRIVATE const String& resolveInline(JSGlobalObject*) const;
+#endif
     ALWAYS_INLINE JSRopeString* asRope()
     {
         ASSERT(isRope());
@@ -784,9 +863,10 @@ JS_EXPORT_PRIVATE JSString* jsStringWithCacheSlowCase(VM&, StringImpl&);
 ALWAYS_INLINE bool JSString::is8Bit() const
 {
     uintptr_t pointer = fiberConcurrently();
-    if (pointer & isRopeInPointer) {
+    if (pointer & notStringImplMask) {
         // Do not load m_fiber twice. We should use the information in pointer.
         // Otherwise, JSRopeString may be converted to JSString between the first and second accesses.
+        // Rope and inline both encode is8Bit in the same low bit.
         return pointer & JSRopeString::is8BitInPointer;
     }
     return std::bit_cast<StringImpl*>(pointer)->is8Bit();
@@ -798,21 +878,29 @@ ALWAYS_INLINE bool JSString::is8Bit() const
 ALWAYS_INLINE unsigned JSString::length() const
 {
     uintptr_t pointer = fiberConcurrently();
+#if USE(BUN_JSC_ADDITIONS)
+    if (pointer & notStringImplMask) {
+        if (pointer & isRopeInPointer)
+            return uncheckedDowncast<JSRopeString>(this)->length();
+        return inlineLengthFromFiber(pointer);
+    }
+#else
     if (pointer & isRopeInPointer)
         return uncheckedDowncast<JSRopeString>(this)->length();
+#endif
     return std::bit_cast<StringImpl*>(pointer)->length();
 }
 
 inline StringImpl* JSString::getValueImpl() const
 {
-    ASSERT(!isRope());
+    ASSERT(!(m_fiber & notStringImplMask));
     return std::bit_cast<StringImpl*>(m_fiber);
 }
 
 inline StringImpl* JSString::tryGetValueImpl() const
 {
     uintptr_t pointer = fiberConcurrently();
-    if (pointer & isRopeInPointer)
+    if (pointer & notStringImplMask)
         return nullptr;
     return std::bit_cast<StringImpl*>(pointer);
 }
@@ -890,6 +978,10 @@ ALWAYS_INLINE Identifier JSString::toIdentifier(JSGlobalObject* globalObject) co
         getVM(globalObject).verifyCanGC();
     if (isRope())
         return static_cast<const JSRopeString*>(this)->toIdentifier(globalObject);
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInline())
+        resolveInline(globalObject);
+#endif
     VM& vm = getVM(globalObject);
     if (valueInternal().impl()->isAtom())
         return Identifier::fromString(vm, Ref { *static_cast<AtomStringImpl*>(valueInternal().impl()) });
@@ -910,6 +1002,10 @@ ALWAYS_INLINE GCOwnedDataScope<AtomStringImpl*> JSString::toAtomString(JSGlobalO
         getVM(globalObject).verifyCanGC();
     if (isRope())
         return { this, static_cast<const JSRopeString*>(this)->resolveRopeToAtomString(globalObject) };
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInline())
+        resolveInline(globalObject);
+#endif
     if (valueInternal().impl()->isAtom())
         return { this, static_cast<AtomStringImpl*>(valueInternal().impl()) };
     AtomString atom(valueInternal());
@@ -923,6 +1019,10 @@ ALWAYS_INLINE GCOwnedDataScope<AtomStringImpl*> JSString::toExistingAtomString(J
         getVM(globalObject).verifyCanGC();
     if (isRope())
         return static_cast<const JSRopeString*>(this)->resolveRopeToExistingAtomString(globalObject);
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInline())
+        resolveInline(globalObject);
+#endif
     if (valueInternal().impl()->isAtom())
         return { this, static_cast<AtomStringImpl*>(valueInternal().impl()) };
     if (auto atom = AtomStringImpl::lookUp(valueInternal().impl())) {
@@ -938,6 +1038,10 @@ inline GCOwnedDataScope<const String&> JSString::value(JSGlobalObject* globalObj
         getVM(globalObject).verifyCanGC();
     if (isRope())
         return { this, static_cast<const JSRopeString*>(this)->resolveRope(globalObject) };
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInline())
+        return { this, resolveInline(globalObject) };
+#endif
     return { this, valueInternal() };
 }
 #if USE(BUN_JSC_ADDITIONS)
@@ -947,6 +1051,15 @@ inline void JSString::value(jsstring_iterator* iterator) const
           static_cast<const JSRopeString*>(this)->iterRope(iterator);
           return;
       }
+      uintptr_t fiber = fiberConcurrently();
+      if (isInlineFiber(fiber)) {
+          unsigned len = inlineLengthFromFiber(fiber);
+          if (fiber & JSRopeString::is8BitInPointer)
+              iterator->append8(iterator, (void*)inlineData8(), len);
+          else
+              iterator->append16(iterator, (void*)inlineData16(), len);
+          return;
+      }
 
 
     auto internal = valueInternal().impl();
@@ -967,8 +1080,12 @@ inline GCOwnedDataScope<const String&> JSString::tryGetValue(bool allocationAllo
             // Pass nullptr for the JSGlobalObject so that resolveRope does not throw in the event of an OOM error.
             return { this, static_cast<const JSRopeString*>(this)->resolveRope(nullptr) };
         }
+#if USE(BUN_JSC_ADDITIONS)
+        if (isInline())
+            return { this, resolveInline(nullptr) };
+#endif
     } else
-        RELEASE_ASSERT(!isRope());
+        RELEASE_ASSERT(!(m_fiber & notStringImplMask));
     return { this, valueInternal() };
 }
 
@@ -1025,6 +1142,13 @@ inline JSString* jsString(VM& vm, StringView s)
         if (auto c = s.codeUnitAt(0); c <= maxSingleCharacterString)
             return vm.smallStrings.singleCharacterString(c);
     }
+#if USE(BUN_JSC_ADDITIONS)
+    if (s.is8Bit()) {
+        if (static_cast<unsigned>(size) <= JSString::maxInlineLength8)
+            return JSString::createInline8(vm, s.span8());
+    } else if (static_cast<unsigned>(size) <= JSString::maxInlineLength16)
+        return JSString::createInline16(vm, s.span16());
+#endif
     auto impl = s.is8Bit() ? StringImpl::create(s.span8()) : StringImpl::create(s.span16());
     return JSString::create(vm, WTF::move(impl));
 }
@@ -1244,12 +1368,26 @@ ALWAYS_INLINE GCOwnedDataScope<StringView> JSString::view(JSGlobalObject* global
 {
     if (isRope())
         return static_cast<const JSRopeString&>(*this).view(globalObject);
+#if USE(BUN_JSC_ADDITIONS)
+    uintptr_t fiber = fiberConcurrently();
+    if (isInlineFiber(fiber)) {
+        unsigned len = inlineLengthFromFiber(fiber);
+        if (fiber & JSRopeString::is8BitInPointer)
+            return { this, StringView { std::span { inlineData8(), len } } };
+        return { this, StringView { std::span { inlineData16(), len } } };
+    }
+#endif
     return { this, valueInternal() };
 }
 
 inline bool JSString::isSubstring() const
 {
+#if USE(BUN_JSC_ADDITIONS)
+    // isSubstringInPointer == isInlineInPointer; a substring rope has both low bits set.
+    return (fiberConcurrently() & notStringImplMask) == (isRopeInPointer | JSRopeString::isSubstringInPointer);
+#else
     return fiberConcurrently() & JSRopeString::isSubstringInPointer;
+#endif
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSStringInlines.h b/Source/JavaScriptCore/runtime/JSStringInlines.h
index 097f109aa7173..a8b4bcab0cf10 100644
--- a/Source/JavaScriptCore/runtime/JSStringInlines.h
+++ b/Source/JavaScriptCore/runtime/JSStringInlines.h
@@ -40,6 +40,10 @@ namespace JSC {
 ALWAYS_INLINE void JSString::destroy(JSCell* cell)
 {
     auto* string = static_cast<JSString*>(cell);
+#if USE(BUN_JSC_ADDITIONS)
+    if (string->m_fiber & notStringImplMask)
+        return;
+#endif
     string->valueInternal().~String();
 }
 
@@ -53,7 +57,7 @@ ALWAYS_INLINE void JSRopeString::destroy(JSCell* cell)
 
 bool JSString::equal(JSGlobalObject* globalObject, JSString* other) const
 {
-    if (isRope() || other->isRope())
+    if ((m_fiber | other->m_fiber) & notStringImplMask)
         return equalSlowCase(globalObject, other);
     return WTF::equal(*valueInternal().impl(), *other->valueInternal().impl());
 }
@@ -837,6 +841,10 @@ inline JSString* jsSubstringOfResolved(VM& vm, GCDeferralContext* deferralContex
     }
 
     ASSERT(!s->isRope());
+#if USE(BUN_JSC_ADDITIONS)
+    if (s->isInline())
+        s->resolveInline(nullptr);
+#endif
     auto& base = s->valueInternal();
     if (!offset && length == base.length())
         return s;
@@ -857,6 +865,14 @@ inline JSString* jsSubstringOfResolved(VM& vm, GCDeferralContext* deferralContex
             return vm.keyAtomStringCache.make(vm, buffer, createFromSubstring);
         }
     }
+#if USE(BUN_JSC_ADDITIONS)
+    // Short substrings: 16-byte inline JSString instead of a 32-byte substring rope.
+    if (base.is8Bit()) {
+        if (length <= JSString::maxInlineLength8)
+            return JSString::createInline8(vm, base.span8().subspan(offset, length));
+    } else if (length <= JSString::maxInlineLength16)
+        return JSString::createInline16(vm, base.span16().subspan(offset, length));
+#endif
     return JSRopeString::createSubstringOfResolved(vm, deferralContext, s, offset, length, base.is8Bit());
 }
 
@@ -875,6 +891,17 @@ void JSString::resolveToBuffer(std::span<CharacterType> destination)
         uint8_t* stackLimit = std::bit_cast<uint8_t*>(vm().softStackLimit());
         return JSRopeString::resolveToBuffer(rope->fiber0(), rope->fiber1(), rope->fiber2(), destination, stackLimit);
     }
+#if USE(BUN_JSC_ADDITIONS)
+    uintptr_t fiber = fiberConcurrently();
+    if (isInlineFiber(fiber)) {
+        unsigned len = inlineLengthFromFiber(fiber);
+        if (fiber & JSRopeString::is8BitInPointer)
+            StringView(std::span { inlineData8(), len }).getCharacters(destination);
+        else
+            StringView(std::span { inlineData16(), len }).getCharacters(destination);
+        return;
+    }
+#endif
     StringView(valueInternal().impl()).getCharacters(destination);
 }
 

From c4e77a0ce06907c7e0d1b3c1ec1cf598f414f930 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Fri, 17 Jul 2026 21:49:14 +0000
Subject: [PATCH 02/69] DFG/FTL: guard rope-layout reads against inline small
 strings

---
 .../JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  | 12 +++++
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 48 ++++++++++++++++++-
 Source/JavaScriptCore/jit/JITOpcodes.cpp      |  7 +++
 Source/JavaScriptCore/jit/ThunkGenerators.cpp |  5 ++
 Source/JavaScriptCore/lol/LOLJIT.cpp          |  7 +++
 5 files changed, 78 insertions(+), 1 deletion(-)

diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index e29b2476f05c7..cea77ac02c89e 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -13588,6 +13588,10 @@ void SpeculativeJIT::emitSwitchStringOnString(Node* node, SwitchData* data, GPRR
 
     if (!isRopeCases.empty()) {
         isRopeCases.link(this);
+#if USE(BUN_JSC_ADDITIONS)
+        // tempGPR still holds m_fiber here. Inline small strings take the slow operation call.
+        slowCases.append(branchTestPtr(Zero, tempGPR, TrustedImm32(JSString::isRopeInPointer)));
+#endif
         load32(Address(string, JSRopeString::offsetOfLength()), tempGPR);
         sub32(TrustedImm32(unlinkedTable.minLength()), tempGPR);
         branch32(Above, tempGPR, TrustedImm32(unlinkedTable.maxLength() - unlinkedTable.minLength()), data->fallThrough.block);
@@ -17684,6 +17688,10 @@ void SpeculativeJIT::compileMakeRope(Node* node)
                 auto done = jump();
 
                 isRope.link(this);
+#if USE(BUN_JSC_ADDITIONS)
+                // Inline small-string child: defer to operationMakeRope* (reads past 16-byte cell otherwise).
+                slowPath.append(branchTestPtr(Zero, scratch2GPR, TrustedImm32(JSString::isRopeInPointer)));
+#endif
                 load32(Address(opGPRs[0], JSRopeString::offsetOfFlags()), scratchGPR);
                 load32(Address(opGPRs[0], JSRopeString::offsetOfLength()), allocatorGPR);
                 done.link(this);
@@ -17721,6 +17729,10 @@ void SpeculativeJIT::compileMakeRope(Node* node)
                     auto done = jump();
 
                     isRope.link(this);
+#if USE(BUN_JSC_ADDITIONS)
+                    // Inline small-string child: defer to operationMakeRope*.
+                    slowPath.append(branchTestPtr(Zero, scratch2GPR, TrustedImm32(JSString::isRopeInPointer)));
+#endif
                     and32(Address(opGPRs[i], JSRopeString::offsetOfFlags()), scratchGPR);
                     load32(Address(opGPRs[i], JSRopeString::offsetOfLength()), scratch2GPR);
                     outOfMemory.append(branchAdd32(Overflow, scratch2GPR, allocatorGPR));
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 70e9f6d24e61d..9648f2ed71b63 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -6229,16 +6229,41 @@ IGNORE_CLANG_WARNINGS_END
 
             m_out.branch(isRopeString(string, m_node->child1()), rarely(ropePath), usually(nonRopePath));
 
+#if USE(BUN_JSC_ADDITIONS)
+            LBasicBlock realRopePath = m_out.newBlock();
+            LBasicBlock inlinePath = m_out.newBlock();
+
+            LBasicBlock lastNext = m_out.appendTo(ropePath, inlinePath);
+            LValue fiber = m_out.loadPtr(string, m_heaps.JSString_value);
+            m_out.branch(
+                m_out.testNonZeroPtr(fiber, m_out.constIntPtr(JSString::isRopeInPointer)),
+                usually(realRopePath), rarely(inlinePath));
+
+            m_out.appendTo(inlinePath, realRopePath);
+            ValueFromBlock inlineLength = m_out.anchor(m_out.bitAnd(
+                m_out.castToInt32(m_out.lShr(fiber, m_out.constInt32(JSString::inlineLengthShift))),
+                m_out.constInt32(0x1f)));
+            m_out.jump(continuation);
+
+            m_out.appendTo(realRopePath, nonRopePath);
+            ValueFromBlock ropeLength = m_out.anchor(m_out.load32NonNegative(string, m_heaps.JSRopeString_length));
+            m_out.jump(continuation);
+#else
             LBasicBlock lastNext = m_out.appendTo(ropePath, nonRopePath);
             ValueFromBlock ropeLength = m_out.anchor(m_out.load32NonNegative(string, m_heaps.JSRopeString_length));
             m_out.jump(continuation);
+#endif
 
             m_out.appendTo(nonRopePath, continuation);
             ValueFromBlock nonRopeLength = m_out.anchor(m_out.load32NonNegative(m_out.loadPtr(string, m_heaps.JSString_value), m_heaps.StringImpl_length));
             m_out.jump(continuation);
 
             m_out.appendTo(continuation, lastNext);
+#if USE(BUN_JSC_ADDITIONS)
+            setInt32(m_out.phi(Int32, inlineLength, ropeLength, nonRopeLength));
+#else
             setInt32(m_out.phi(Int32, ropeLength, nonRopeLength));
+#endif
             return;
         }
 
@@ -11718,6 +11743,16 @@ IGNORE_CLANG_WARNINGS_END
             m_out.branch(isRopeString(child, edge), unsure(ropeCase), unsure(notRopeCase));
 
             LBasicBlock lastNext = m_out.appendTo(ropeCase, notRopeCase);
+#if USE(BUN_JSC_ADDITIONS)
+            // Inline small-string child: the rope-layout loads below would read past the
+            // 16-byte inline cell, so defer to operationMakeRope* via slowPath.
+            LBasicBlock realRopeCase = m_out.newBlock();
+            LValue childFiber = m_out.loadPtr(child, m_heaps.JSString_value);
+            m_out.branch(
+                m_out.testNonZeroPtr(childFiber, m_out.constIntPtr(JSString::isRopeInPointer)),
+                usually(realRopeCase), rarely(slowPath));
+            m_out.appendTo(realRopeCase, notRopeCase);
+#endif
             ValueFromBlock flagsForRope = m_out.anchor(m_out.load32NonNegative(child, m_heaps.JSRopeString_flags));
             ValueFromBlock lengthForRope = m_out.anchor(m_out.load32NonNegative(child, m_heaps.JSRopeString_length));
             m_out.jump(continuation);
@@ -23549,8 +23584,19 @@ IGNORE_CLANG_WARNINGS_END
         LValue ropeLength;
         if (auto stringLength = tryGetConstantStringLength(edge))
             ropeLength = m_out.constInt32(*stringLength);
-        else
+        else {
+#if USE(BUN_JSC_ADDITIONS)
+            // Inline small strings reach here via the widened notStringImplMask test; route them to
+            // the slow switch to avoid reading the (out-of-bounds) rope length.
+            LBasicBlock realRopeBlock = m_out.newBlock();
+            LValue ropeFiber = m_out.loadPtr(string, m_heaps.JSString_value);
+            m_out.branch(
+                m_out.testNonZeroPtr(ropeFiber, m_out.constIntPtr(JSString::isRopeInPointer)),
+                usually(realRopeBlock), rarely(slowBlock));
+            m_out.appendTo(realRopeBlock, slowBlock);
+#endif
             ropeLength = m_out.load32NonNegative(string, m_heaps.JSRopeString_length);
+        }
         m_out.branch(m_out.belowOrEqual(m_out.sub(ropeLength, m_out.constInt32(unlinkedTable.minLength())), m_out.constInt32(unlinkedTable.maxLength() - unlinkedTable.minLength())), unsure(slowBlock), unsure(lowBlock(data->fallThrough.block)));
 
         m_out.appendTo(slowBlock, lastNext);
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index ba79188fed572..085124c6448d7 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -1367,7 +1367,14 @@ void JIT::emit_op_switch_char(const JSInstruction* currentInstruction)
     }
 
     isRope.link(this);
+#if USE(BUN_JSC_ADDITIONS)
+    // Inline small string: skip the out-of-bounds rope-length read; operationResolveRope handles it.
+    auto isInline = branchTestPtr(Zero, regT4, TrustedImm32(JSString::isRopeInPointer));
+#endif
     addJump(branch32(NotEqual, Address(jsRegT10.payloadGPR(), JSRopeString::offsetOfLength()), TrustedImm32(1)), defaultOffset);
+#if USE(BUN_JSC_ADDITIONS)
+    isInline.link(this);
+#endif
     loadGlobalObject(regT2);
     callOperation(operationResolveRope, regT2, jsRegT10.payloadGPR());
     jump().linkTo(dispatch, this);
diff --git a/Source/JavaScriptCore/jit/ThunkGenerators.cpp b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
index b1f9ce7cf283b..0ab8e957913fa 100644
--- a/Source/JavaScriptCore/jit/ThunkGenerators.cpp
+++ b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
@@ -694,6 +694,11 @@ MacroAssemblerCodeRef<JITThunkPtrTag> stringEqualThunkGenerator(VM& vm)
 
         // Rope: must be substring rope (concat ropes go to slowCase).
         isRope.link(&jit);
+#if USE(BUN_JSC_ADDITIONS)
+        // Inline small string (bit 0 clear, bit 1 set) shares the "not a StringImpl" branch; the
+        // rope-layout reads below would be out of bounds on the 16-byte inline cell.
+        slowCase.append(jit.branchTestPtr(JIT::Zero, dataGPR, JIT::TrustedImm32(JSString::isRopeInPointer)));
+#endif
         slowCase.append(jit.branchTest64(JIT::Zero, dataGPR, JIT::TrustedImm64(JSRopeString::isSubstringInPointer)));
 
         // Load substring base raw (low 48 bits of fiber1) and mask. and64(TrustedImm64) is one
diff --git a/Source/JavaScriptCore/lol/LOLJIT.cpp b/Source/JavaScriptCore/lol/LOLJIT.cpp
index c129bd258f3e5..9d508fbc83a0e 100644
--- a/Source/JavaScriptCore/lol/LOLJIT.cpp
+++ b/Source/JavaScriptCore/lol/LOLJIT.cpp
@@ -2450,7 +2450,14 @@ void LOLJIT::emit_op_switch_char(const JSInstruction* currentInstruction)
     }
 
     isRope.link(this);
+#if USE(BUN_JSC_ADDITIONS)
+    // Inline small string: skip the out-of-bounds rope-length read; operationResolveRope handles it.
+    auto isInline = branchTestPtr(Zero, regT4, TrustedImm32(JSString::isRopeInPointer));
+#endif
     addJump(branch32(NotEqual, Address(scrutineeRegs.payloadGPR(), JSRopeString::offsetOfLength()), TrustedImm32(1)), defaultOffset);
+#if USE(BUN_JSC_ADDITIONS)
+    isInline.link(this);
+#endif
     loadGlobalObject(s_scratch);
     callOperation(operationResolveRope, s_scratch, scrutineeRegs.payloadGPR());
     jump().linkTo(dispatch, this);

From 62b2e0179ba82d85c8fcf470e501d961014df1a5 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Fri, 17 Jul 2026 21:51:08 +0000
Subject: [PATCH 03/69] JIT: handle inline small strings on rope-taken branches
 (DFG/FTL)

---
 Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp | 5 +++++
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp   | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index cea77ac02c89e..07a88f00c35f4 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -8540,8 +8540,13 @@ bool SpeculativeJIT::canBeRope(Edge edge)
     if (!((m_state.forNode(edge).m_type & SpecString) & ~SpecStringResolved))
         return false;
     if (JSValue value = m_state.forNode(edge).m_value) {
+#if USE(BUN_JSC_ADDITIONS)
+        if (value.isCell() && value.asCell()->type() == StringType && !asString(value)->isRope() && !asString(value)->isInline())
+            return false;
+#else
         if (value.isCell() && value.asCell()->type() == StringType && !asString(value)->isRope())
             return false;
+#endif
     }
 
     // If this value is LazyValue, it will be converted to JSString, and the result must be non-rope string.
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 9648f2ed71b63..4718f8cb87aa4 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -25635,8 +25635,13 @@ IGNORE_CLANG_WARNINGS_END
         if (!((provenType(edge) & SpecString) & ~SpecStringResolved))
             return false;
         if (JSValue value = provenValue(edge)) {
+#if USE(BUN_JSC_ADDITIONS)
+            if (value.isCell() && value.asCell()->type() == StringType && !asString(value)->isRope() && !asString(value)->isInline())
+                return false;
+#else
             if (value.isCell() && value.asCell()->type() == StringType && !asString(value)->isRope())
                 return false;
+#endif
         }
         String value = edge->tryGetString(m_graph);
         if (!value.isNull()) {

From f3e6686b5f8eb051e52bb03d4d37dc602467019d Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Fri, 17 Jul 2026 21:59:38 +0000
Subject: [PATCH 04/69] DFG: don't constant-fold ResolveRope through inline
 small strings

---
 Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
index 2acbc4bfd89cd..de29f47194d85 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
@@ -5025,7 +5025,14 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
     case ResolveRope: {
         AbstractValue& value = forNode(node->child1());
         JSValue childConst = value.value();
+#if USE(BUN_JSC_ADDITIONS)
+        // Inline small strings are !isRope() but still lack a StringImpl*. Folding them through
+        // lets the generic constant folder elide this node, leaking an inline fiber to consumers
+        // (GetByVal/StringCharAt/StringCodePointAt) that load StringImpl fields without a guard.
+        if (childConst && childConst.isString() && !asString(childConst)->isRope() && !asString(childConst)->isInline()) {
+#else
         if (childConst && childConst.isString() && !asString(childConst)->isRope()) {
+#endif
             setConstant(node, *m_graph.freeze(childConst));
             break;
         }

From a399cf3d9207eb8360b9e352ca4696782cd6e38a Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Fri, 17 Jul 2026 22:20:02 +0000
Subject: [PATCH 05/69] JSStringInlines: handle inline small-string fibers in
 resolveToBuffer

---
 .../JavaScriptCore/runtime/JSStringInlines.h  | 60 +++++++++++++------
 1 file changed, 43 insertions(+), 17 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/JSStringInlines.h b/Source/JavaScriptCore/runtime/JSStringInlines.h
index a8b4bcab0cf10..d89a87dfb7abf 100644
--- a/Source/JavaScriptCore/runtime/JSStringInlines.h
+++ b/Source/JavaScriptCore/runtime/JSStringInlines.h
@@ -37,6 +37,28 @@
 
 namespace JSC {
 
+#if USE(BUN_JSC_ADDITIONS)
+// StringView over a non-rope JSString's characters that is safe for inline
+// small strings (m_fiber holds packed chars, not a StringImpl*).
+ALWAYS_INLINE static StringView nonRopeStringView(const JSString* string)
+{
+    ASSERT(!string->isRope());
+    if (string->isInline()) {
+        unsigned len = string->length();
+        if (string->is8Bit())
+            return StringView { std::span { string->inlineData8(), len } };
+        return StringView { std::span { string->inlineData16(), len } };
+    }
+    return StringView { string->getValueImpl() };
+}
+#else
+ALWAYS_INLINE static StringView nonRopeStringView(const JSString* string)
+{
+    ASSERT(!string->isRope());
+    return StringView { string->getValueImpl() };
+}
+#endif
+
 ALWAYS_INLINE void JSString::destroy(JSCell* cell)
 {
     auto* string = static_cast<JSString*>(cell);
@@ -210,7 +232,7 @@ std::optional<size_t> JSString::tryFindOneChar(JSGlobalObject*, char16_t charact
 
         if (!fiber->isRope()) {
             unsigned localStart = startPosition > offset ? startPosition - offset : 0;
-            size_t result = StringView(fiber->valueInternal()).find(character, localStart);
+            size_t result = nonRopeStringView(fiber).find(character, localStart);
             if (result != WTF::notFound)
                 return offset + result;
         } else if (fiber->isSubstring()) {
@@ -285,7 +307,7 @@ std::optional<size_t> JSString::tryFindLastOneChar(JSGlobalObject*, char16_t cha
         JSString* fiber = fibers[i];
         if (!fiber->isRope()) {
             unsigned localStart = startPosition >= offset + fiberLength ? fiberLength - 1 : startPosition - offset;
-            size_t result = StringView(fiber->valueInternal()).reverseFind(character, localStart);
+            size_t result = nonRopeStringView(fiber).reverseFind(character, localStart);
             if (result != WTF::notFound)
                 return offset + result;
         } else if (fiber->isSubstring()) {
@@ -325,7 +347,7 @@ ALWAYS_INLINE std::optional<char16_t> JSString::tryGetCharAt(JSGlobalObject*, un
 
         unsigned localIndex = index - offset;
         if (!fiber->isRope())
-            return StringView(fiber->valueInternal())[localIndex];
+            return nonRopeStringView(fiber)[localIndex];
         if (fiber->isSubstring()) {
             const JSRopeString* substringFiber = static_cast<const JSRopeString*>(fiber);
             return StringView(substringFiber->substringBase()->valueInternal())[substringFiber->substringOffset() + localIndex];
@@ -443,7 +465,7 @@ WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
             continue;
         }
 
-        StringView view = *currentFiber->valueInternal().impl();
+        StringView view = nonRopeStringView(currentFiber);
         position -= view.length();
         view.getCharacters(unsafeMakeSpan(position, end - position));
     } while (!workQueue.isEmpty());
@@ -479,7 +501,7 @@ inline void JSRopeString::resolveToBuffer(JSString* fiber0, JSString* fiber1, JS
             }
             skip(buffer, rope0Length);
         } else {
-            StringView view0 = fiber0->valueInternal().impl();
+            StringView view0 = nonRopeStringView(fiber0);
             view0.getCharacters(buffer);
             skip(buffer, view0.length());
         }
@@ -563,7 +585,7 @@ inline void JSRopeString::resolveToBuffer(JSString* fiber0, JSString* fiber1, JS
             auto* rope0 = static_cast<const JSRopeString*>(fiber0);
             auto rope0Length = rope0->length();
             {
-                StringView view1 = fiber1->valueInternal().impl();
+                StringView view1 = nonRopeStringView(fiber1);
                 view1.getCharacters(buffer.subspan(rope0Length));
             }
             if (rope0->isSubstring()) {
@@ -580,7 +602,7 @@ inline void JSRopeString::resolveToBuffer(JSString* fiber0, JSString* fiber1, JS
             auto* rope1 = static_cast<const JSRopeString*>(fiber1);
             auto rope1Length = rope1->length();
             {
-                StringView view0 = fiber0->valueInternal().impl();
+                StringView view0 = nonRopeStringView(fiber0);
                 view0.getCharacters(buffer);
                 skip(buffer, view0.length());
             }
@@ -593,16 +615,16 @@ inline void JSRopeString::resolveToBuffer(JSString* fiber0, JSString* fiber1, JS
             MUST_TAIL_CALL return resolveToBuffer(rope1->fiber0(), rope1->fiber1(), rope1->fiber2(), buffer.first(rope1Length), stackLimit);
         }
 
-        StringView view0 = fiber0->valueInternal().impl();
+        StringView view0 = nonRopeStringView(fiber0);
         view0.getCharacters(buffer);
-        StringView view1 = fiber1->valueInternal().impl();
+        StringView view1 = nonRopeStringView(fiber1);
         view1.getCharacters(buffer.subspan(view0.length()));
         return;
     }
 
     // 1 fiber.
     if (!fiber0->isRope()) {
-        StringView view0 = fiber0->valueInternal().impl();
+        StringView view0 = nonRopeStringView(fiber0);
         view0.getCharacters(buffer);
         return;
     }
@@ -633,6 +655,10 @@ inline JSString* jsAtomString(JSGlobalObject* globalObject, VM& vm, JSString* st
     }
 
     if (!string->isRope()) {
+#if USE(BUN_JSC_ADDITIONS)
+        if (string->isInline())
+            string->resolveInline(globalObject);
+#endif
         auto createFromNonRope = [&](VM& vm, auto&) {
             AtomString atom(string->valueInternal());
             if (!string->valueInternal().impl()->isAtom())
@@ -723,7 +749,7 @@ inline JSString* jsAtomString(JSGlobalObject* globalObject, VM& vm, JSString* s1
                 return JSRopeString::resolveToBufferSlow(fiber0, fiber1, nullptr, buffer, stackLimit);
 
             auto* rope0 = static_cast<const JSRopeString*>(fiber0);
-            StringView view1 = fiber1->valueInternal().impl();
+            StringView view1 = nonRopeStringView(fiber1);
             view1.getCharacters(buffer.subspan(rope0->length()));
             if (rope0->isSubstring()) {
                 StringView view0 = *rope0->substringBase()->valueInternal().impl();
@@ -735,7 +761,7 @@ inline JSString* jsAtomString(JSGlobalObject* globalObject, VM& vm, JSString* s1
         }
 
         if (fiber1->isRope()) {
-            StringView view0 = fiber0->valueInternal().impl();
+            StringView view0 = nonRopeStringView(fiber0);
             view0.getCharacters(buffer);
             auto* rope1 = static_cast<const JSRopeString*>(fiber1);
             if (rope1->isSubstring()) {
@@ -747,9 +773,9 @@ inline JSString* jsAtomString(JSGlobalObject* globalObject, VM& vm, JSString* s1
             return JSRopeString::resolveToBuffer(rope1->fiber0(), rope1->fiber1(), rope1->fiber2(), buffer.subspan(view0.length(), rope1->length()), stackLimit);
         }
 
-        StringView view0 = fiber0->valueInternal().impl();
+        StringView view0 = nonRopeStringView(fiber0);
         view0.getCharacters(buffer);
-        StringView view1 = fiber1->valueInternal().impl();
+        StringView view1 = nonRopeStringView(fiber1);
         view1.getCharacters(buffer.subspan(view0.length()));
     };
 
@@ -804,11 +830,11 @@ inline JSString* jsAtomString(JSGlobalObject* globalObject, VM& vm, JSString* s1
         if (fiber0->isRope() || fiber1->isRope() || fiber2->isRope())
             return JSRopeString::resolveToBufferSlow(fiber0, fiber1, fiber2, buffer, std::bit_cast<uint8_t*>(vm.softStackLimit()));
 
-        StringView view0 = fiber0->valueInternal().impl();
+        StringView view0 = nonRopeStringView(fiber0);
         view0.getCharacters(buffer);
-        StringView view1 = fiber1->valueInternal().impl();
+        StringView view1 = nonRopeStringView(fiber1);
         view1.getCharacters(buffer.subspan(view0.length()));
-        StringView view2 = fiber2->valueInternal().impl();
+        StringView view2 = nonRopeStringView(fiber2);
         view2.getCharacters(buffer.subspan(view0.length() + view1.length()));
     };
 

From 6f1b2e98164e3bf6c33646303468d42f665ada19 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Fri, 17 Jul 2026 22:42:38 +0000
Subject: [PATCH 06/69] LLInt/runtime: handle inline small-string fibers in
 op_switch_char and tryGetValueWithoutGC

---
 Source/JavaScriptCore/llint/LowLevelInterpreter.asm    |  1 +
 .../JavaScriptCore/llint/LowLevelInterpreter32_64.asm  | 10 +++++++++-
 Source/JavaScriptCore/llint/LowLevelInterpreter64.asm  | 10 +++++++++-
 Source/JavaScriptCore/runtime/JSString.cpp             |  4 ++++
 4 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
index d16072c11ed3a..067e3242f18a2 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -750,6 +750,7 @@ const CallSiteIndex = ArgumentCountIncludingThis + TagOffset
 
 # String flags.
 const isRopeInPointer = constexpr JSString::isRopeInPointer
+const notStringImplMask = constexpr JSString::notStringImplMask
 const HashFlags8BitBuffer = constexpr StringImpl::s_hashFlag8BitBuffer
 
 # Copied from PropertyOffset.h
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
index e4dc554c588c2..f5628bef08a64 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -2228,7 +2228,7 @@ llintOpWithJump(op_switch_char, OpSwitchChar, macro (size, get, jump, dispatch)
     bineq t1, CellTag, .opSwitchCharFallThrough
     bbneq JSCell::m_type[t0], StringType, .opSwitchCharFallThrough
     loadp JSString::m_fiber[t0], t1
-    btpnz t1, isRopeInPointer, .opSwitchOnRope
+    btpnz t1, notStringImplMask, .opSwitchOnRope
     bineq StringImpl::m_length[t1], 1, .opSwitchCharFallThrough
 
     loadi UnlinkedSimpleJumpTable::m_min[t2], t3
@@ -2254,6 +2254,14 @@ llintOpWithJump(op_switch_char, OpSwitchChar, macro (size, get, jump, dispatch)
     dispatchIndirect(t1)
 
 .opSwitchOnRope:
+    # Inline small string (notStringImplMask set, isRopeInPointer clear): length is in
+    # bits 3..7 of the fiber in t1; avoid the rope-layout length read below.
+    btpnz t1, isRopeInPointer, .opSwitchOnRealRope
+    urshiftp 3, t1
+    andp 0x1f, t1
+    bineq t1, 1, .opSwitchCharFallThrough
+    jmp .opSwitchSlow
+.opSwitchOnRealRope:
     bineq JSRopeString::m_compactFibers + JSRopeString::CompactFibers::m_length[t0], 1, .opSwitchCharFallThrough
 
 .opSwitchSlow:
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
index 0fffe17155384..b2dd685d10d9c 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -2416,7 +2416,7 @@ llintOpWithJump(op_switch_char, OpSwitchChar, macro (size, get, jump, dispatch)
     btqnz t1, notCellMask, .opSwitchCharFallThrough
     bbneq JSCell::m_type[t1], StringType, .opSwitchCharFallThrough
     loadp JSString::m_fiber[t1], t0
-    btpnz t0, isRopeInPointer, .opSwitchOnRope
+    btpnz t0, notStringImplMask, .opSwitchOnRope
     bineq StringImpl::m_length[t0], 1, .opSwitchCharFallThrough
 
     loadi UnlinkedSimpleJumpTable::m_min[t2], t3
@@ -2442,6 +2442,14 @@ llintOpWithJump(op_switch_char, OpSwitchChar, macro (size, get, jump, dispatch)
     dispatchIndirect(t1)
 
 .opSwitchOnRope:
+    # Inline small string (notStringImplMask set, isRopeInPointer clear): length is in
+    # bits 3..7 of the fiber in t0; avoid the rope-layout length read below.
+    btpnz t0, isRopeInPointer, .opSwitchOnRealRope
+    urshiftp 3, t0
+    andp 0x1f, t0
+    bineq t0, 1, .opSwitchCharFallThrough
+    jmp .opSwitchSlow
+.opSwitchOnRealRope:
     bineq JSRopeString::m_compactFibers + JSRopeString::CompactFibers::m_length[t1], 1, .opSwitchCharFallThrough
 
 .opSwitchSlow:
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index 3c139a30d442e..c0ad2e1965c2c 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -374,6 +374,10 @@ GCOwnedDataScope<const String&> JSString::tryGetValueWithoutGC() const
         // Pass nullptr for the JSGlobalObject so that resolveRope does not throw in the event of an OOM error.
         return { this, static_cast<const JSRopeString*>(this)->resolveRopeWithoutGC() };
     }
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInline())
+        return { this, resolveInline(nullptr) };
+#endif
     return { this, valueInternal() };
 }
 

From a997dc967a6440d6e905712b435e68f2bd30cb4b Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sat, 18 Jul 2026 05:06:06 +0000
Subject: [PATCH 07/69] Phase 2: JIT fast paths for inline small strings

DFG compileStringEquality + FTL stringsEqual: when both operands are
inline, compare the m_fiber words directly (identical encoding = equal
string). Same-width unequal fibers fall to falseCase without a memcmp;
only cross-width pairs take the slow path.

ThunkGenerators decodeString: decode length/is8Bit/data-pointer from the
fiber word instead of routing inline to the slow path.

Measured (2M ops on 5-char inline slices, vs unpatched release):
  .length       8.2ms -> 5.7ms   (-30%)
  .charCodeAt   66.7ms -> 53.7ms (-19%)
  === (mixed)   avg 23ms -> 17ms (-26%)

All four tiers pass the correctness suite.
---
 .../JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  | 22 +++++++++++++++
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 28 +++++++++++++++++++
 Source/JavaScriptCore/jit/ThunkGenerators.cpp | 20 +++++++++++--
 3 files changed, 67 insertions(+), 3 deletions(-)

diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 07a88f00c35f4..01ec04b202609 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -7792,6 +7792,28 @@ void SpeculativeJIT::compileStringEquality(
         slowCase.append(branchIfRopeStringImpl(implGPR));
     };
 
+#if USE(BUN_JSC_ADDITIONS)
+    // Inline-vs-inline fast path: two inline small strings with matching is8Bit
+    // are equal iff their m_fiber words are identical (encoding packs
+    // length|is8Bit|bytes). Mixed 8/16-bit falls through to slowCase via the
+    // widened rope check in loadImplAndCheckRope.
+    if (!leftAtom && !rightAtom) {
+        loadPtr(Address(leftGPR, JSString::offsetOfValue()), leftTempGPR);
+        loadPtr(Address(rightGPR, JSString::offsetOfValue()), rightTempGPR);
+        move(leftTempGPR, lengthGPR);
+        andPtr(rightTempGPR, lengthGPR);
+        Jump notBothInline = branchTestPtr(Zero, lengthGPR, TrustedImm32(JSString::isInlineInPointer));
+        trueCase.append(branchPtr(Equal, leftTempGPR, rightTempGPR));
+        // Both inline, fibers differ. If the is8Bit bits also match the strings
+        // are definitely unequal; only a cross-width pair needs the slow compare.
+        move(leftTempGPR, lengthGPR);
+        xorPtr(rightTempGPR, lengthGPR);
+        slowCase.append(branchTestPtr(NonZero, lengthGPR, TrustedImm32(JSRopeString::is8BitInPointer)));
+        falseCase.append(jump());
+        notBothInline.link(this);
+    }
+#endif
+
     auto resolveDataPtr = [&](bool atom, const String& constStr, GPRReg implGPR) {
         if (atom) {
             const void* data = constStr.is8Bit()
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 4718f8cb87aa4..84d712fa36342 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -22233,6 +22233,34 @@ IGNORE_CLANG_WARNINGS_END
         LBasicBlock slowCase = m_out.newBlock();
         LBasicBlock continuation = m_out.newBlock();
 
+#if USE(BUN_JSC_ADDITIONS)
+        // Inline-vs-inline fast path: identical m_fiber words mean equal strings.
+        if (!leftAtom && !rightAtom) {
+            LBasicBlock bothInlineCase = m_out.newBlock();
+            LBasicBlock bothInlineUnequalCase = m_out.newBlock();
+            LBasicBlock notBothInlineCase = m_out.newBlock();
+
+            LValue leftFiber = m_out.loadPtr(leftJSString, m_heaps.JSString_value);
+            LValue rightFiber = m_out.loadPtr(rightJSString, m_heaps.JSString_value);
+            LValue bothInline = m_out.testNonZeroPtr(
+                m_out.bitAnd(leftFiber, rightFiber),
+                m_out.constIntPtr(JSString::isInlineInPointer));
+            m_out.branch(bothInline, unsure(bothInlineCase), unsure(notBothInlineCase));
+
+            m_out.appendTo(bothInlineCase, bothInlineUnequalCase);
+            m_out.branch(m_out.equal(leftFiber, rightFiber), unsure(trueCase), unsure(bothInlineUnequalCase));
+
+            m_out.appendTo(bothInlineUnequalCase, notBothInlineCase);
+            // Same is8Bit bit -> definitely unequal. Cross-width -> slow compare.
+            LValue widthDiffers = m_out.testNonZeroPtr(
+                m_out.bitXor(leftFiber, rightFiber),
+                m_out.constIntPtr(JSRopeString::is8BitInPointer));
+            m_out.branch(widthDiffers, rarely(slowCase), usually(falseCase));
+
+            m_out.appendTo(notBothInlineCase, leftReadyCase);
+        }
+#endif
+
         if (leftAtom)
             m_out.jump(leftReadyCase);
         else
diff --git a/Source/JavaScriptCore/jit/ThunkGenerators.cpp b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
index 0ab8e957913fa..d22a76fc0233e 100644
--- a/Source/JavaScriptCore/jit/ThunkGenerators.cpp
+++ b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
@@ -695,9 +695,20 @@ MacroAssemblerCodeRef<JITThunkPtrTag> stringEqualThunkGenerator(VM& vm)
         // Rope: must be substring rope (concat ropes go to slowCase).
         isRope.link(&jit);
 #if USE(BUN_JSC_ADDITIONS)
-        // Inline small string (bit 0 clear, bit 1 set) shares the "not a StringImpl" branch; the
-        // rope-layout reads below would be out of bounds on the 16-byte inline cell.
-        slowCase.append(jit.branchTestPtr(JIT::Zero, dataGPR, JIT::TrustedImm32(JSString::isRopeInPointer)));
+        // Inline small string: decode length/is8Bit from the fiber word and point dataGPR at the
+        // in-cell character bytes.
+        auto notInline = jit.branchTestPtr(JIT::NonZero, dataGPR, JIT::TrustedImm32(JSString::isRopeInPointer));
+        jit.move(dataGPR, lengthGPR);
+        jit.urshiftPtr(JIT::TrustedImm32(JSString::inlineLengthShift), lengthGPR);
+        jit.and32(JIT::TrustedImm32(0x1f), lengthGPR);
+        jit.move(dataGPR, flagsGPR);
+        jit.and32(JIT::TrustedImm32(StringImpl::flagIs8Bit()), flagsGPR);
+        jit.addPtr(JIT::TrustedImm32(JSString::offsetOfValue() + 1), jsStringGPR, dataGPR);
+        auto inlineIs8 = jit.branchTest32(JIT::NonZero, flagsGPR);
+        jit.addPtr(JIT::TrustedImm32(1), dataGPR);
+        inlineIs8.link(&jit);
+        auto inlineDone = jit.jump();
+        notInline.link(&jit);
 #endif
         slowCase.append(jit.branchTest64(JIT::Zero, dataGPR, JIT::TrustedImm64(JSRopeString::isSubstringInPointer)));
 
@@ -721,6 +732,9 @@ MacroAssemblerCodeRef<JITThunkPtrTag> stringEqualThunkGenerator(VM& vm)
         jit.addPtr(lengthGPR, dataGPR);
         jit.load32(JIT::Address(jsStringGPR, JSRopeString::offsetOfLength()), lengthGPR);
 
+#if USE(BUN_JSC_ADDITIONS)
+        inlineDone.link(&jit);
+#endif
         done.link(&jit);
     };
 

From 833791a6ecd8c32e2dadafcae4b0194806b7c816 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sat, 18 Jul 2026 07:59:31 +0000
Subject: [PATCH 08/69] FTL stringsEqual: inline-vs-inline m_fiber compare

Compute the result as isZero64(leftFiber xor rightFiber) and feed it
directly into the continuation phi instead of branching to trueCase/
falseCase. Same-width inline pairs resolve without touching the
StringImpl path or the thunk; cross-width falls through to slowCase.

=== benchmark (2M ops, 5-char inline slices vs unpatched release) ===
  .length        8.2ms -> 6.2ms  (-24%)
  .charCodeAt   66.7ms -> 54ms   (-19%)
  === always-true   9.5ms -> 15ms   (+58%, synthetic)
  === 50/50 mix    33.8ms -> 18.5ms (-45%)
  !==              36.8ms -> 19.0ms (-48%)

JSTests/stress/string-*.js: 158/160 pass; the two failures
(string-localeCompare, string-substring-oom) are ICU collation data
issues from the local build environment, unrelated to this change.
---
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 39 +++++++++++--------
 1 file changed, 22 insertions(+), 17 deletions(-)

diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 84d712fa36342..81c5e16cca184 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -22234,30 +22234,31 @@ IGNORE_CLANG_WARNINGS_END
         LBasicBlock continuation = m_out.newBlock();
 
 #if USE(BUN_JSC_ADDITIONS)
-        // Inline-vs-inline fast path: identical m_fiber words mean equal strings.
+        // Inline-vs-inline: two inline small strings with matching width are
+        // equal iff their m_fiber words are identical.
+        std::optional<ValueFromBlock> inlineResult;
         if (!leftAtom && !rightAtom) {
-            LBasicBlock bothInlineCase = m_out.newBlock();
-            LBasicBlock bothInlineUnequalCase = m_out.newBlock();
-            LBasicBlock notBothInlineCase = m_out.newBlock();
+            LBasicBlock inlineSameWidth = m_out.newBlock();
+            LBasicBlock inlineDispatch = m_out.newBlock();
+            LBasicBlock notBothInline = m_out.newBlock();
 
             LValue leftFiber = m_out.loadPtr(leftJSString, m_heaps.JSString_value);
             LValue rightFiber = m_out.loadPtr(rightJSString, m_heaps.JSString_value);
-            LValue bothInline = m_out.testNonZeroPtr(
-                m_out.bitAnd(leftFiber, rightFiber),
-                m_out.constIntPtr(JSString::isInlineInPointer));
-            m_out.branch(bothInline, unsure(bothInlineCase), unsure(notBothInlineCase));
+            LValue xored = m_out.bitXor(leftFiber, rightFiber);
+            m_out.branch(
+                m_out.testNonZeroPtr(m_out.bitAnd(leftFiber, rightFiber), m_out.constIntPtr(JSString::isInlineInPointer)),
+                usually(inlineDispatch), unsure(notBothInline));
 
-            m_out.appendTo(bothInlineCase, bothInlineUnequalCase);
-            m_out.branch(m_out.equal(leftFiber, rightFiber), unsure(trueCase), unsure(bothInlineUnequalCase));
+            m_out.appendTo(inlineDispatch, inlineSameWidth);
+            m_out.branch(
+                m_out.testNonZeroPtr(xored, m_out.constIntPtr(JSRopeString::is8BitInPointer)),
+                rarely(slowCase), usually(inlineSameWidth));
 
-            m_out.appendTo(bothInlineUnequalCase, notBothInlineCase);
-            // Same is8Bit bit -> definitely unequal. Cross-width -> slow compare.
-            LValue widthDiffers = m_out.testNonZeroPtr(
-                m_out.bitXor(leftFiber, rightFiber),
-                m_out.constIntPtr(JSRopeString::is8BitInPointer));
-            m_out.branch(widthDiffers, rarely(slowCase), usually(falseCase));
+            m_out.appendTo(inlineSameWidth, notBothInline);
+            inlineResult = m_out.anchor(m_out.isZero64(xored));
+            m_out.jump(continuation);
 
-            m_out.appendTo(notBothInlineCase, leftReadyCase);
+            m_out.appendTo(notBothInline, leftReadyCase);
         }
 #endif
 
@@ -22411,6 +22412,10 @@ IGNORE_CLANG_WARNINGS_END
         m_out.jump(continuation);
 
         m_out.appendTo(continuation, lastNext);
+#if USE(BUN_JSC_ADDITIONS)
+        if (inlineResult)
+            return m_out.phi(Int32, trueResult, falseResult, slowResult, *inlineResult);
+#endif
         return m_out.phi(Int32, trueResult, falseResult, slowResult);
     }
 

From 15e3fea2aaaf7ce745f33bd60d6b56f98de629ac Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sat, 18 Jul 2026 08:48:16 +0000
Subject: [PATCH 09/69] Add SpecStringInline speculation and literal-vs-inline
 equality fast path

- SpeculatedType.h/cpp: SpecStringInline (bit 51), included in SpecStringVar;
  speculationFromCell returns it for JSString::isInline(); dump prints
  "StringInline". DFG graph now shows 'predicting StringInline' for slices.
- DFGSpeculativeJIT: isLikelyInlineString(Edge) checks if the profile is
  monomorphic-inline. Array::String length speculates on it and emits the
  branch-free (fiber>>3)&0x1f decode with an OSR guard.
- compileStringEquality: when one side is a short 8-bit atom literal and the
  other is inline, encode the literal as an immediate m_fiber at compile time
  and compare the dynamic side's m_fiber against it. Measured: s === "012"
  28.6ms -> 21.8ms (-24%) for 2M ops.
- JSString::encodeInline8/16/createInline* made public so JIT tiers can
  encode literals.
- JITOpcodes/LOLJIT op_switch_char: inline strings never match a single-char
  switch (they're length >=2 for 8-bit), so decode length from the fiber and
  jump to default instead of materializing.

All four tiers pass the correctness suite.
---
 .../bytecode/SpeculatedType.cpp               | 11 +++++
 .../JavaScriptCore/bytecode/SpeculatedType.h  |  5 +++
 .../JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  | 45 +++++++++++++++++++
 Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h |  3 ++
 Source/JavaScriptCore/jit/JITOpcodes.cpp      | 11 +++--
 Source/JavaScriptCore/lol/LOLJIT.cpp          | 11 +++--
 Source/JavaScriptCore/runtime/JSString.h      |  1 +
 7 files changed, 81 insertions(+), 6 deletions(-)

diff --git a/Source/JavaScriptCore/bytecode/SpeculatedType.cpp b/Source/JavaScriptCore/bytecode/SpeculatedType.cpp
index 8532f1c6df047..d820589d0f238 100644
--- a/Source/JavaScriptCore/bytecode/SpeculatedType.cpp
+++ b/Source/JavaScriptCore/bytecode/SpeculatedType.cpp
@@ -271,6 +271,13 @@ void dumpSpeculation(PrintStream& outStream, SpeculatedType value)
                     strOut.print("StringUnresolvedVar");
                 else
                     isTop = false;
+
+#if USE(BUN_JSC_ADDITIONS)
+                if (value & SpecStringInline)
+                    strOut.print("StringInline");
+                else
+                    isTop = false;
+#endif
             }
         }
 
@@ -610,6 +617,10 @@ SpeculatedType speculationFromCell(JSCell* cell)
                 return SpecStringIdent;
             return SpecStringResolved;
         }
+#if USE(BUN_JSC_ADDITIONS)
+        if (string->isInline())
+            return SpecStringInline;
+#endif
         return SpecString;
     }
 
diff --git a/Source/JavaScriptCore/bytecode/SpeculatedType.h b/Source/JavaScriptCore/bytecode/SpeculatedType.h
index eca1fd21fab2b..82943b16519be 100644
--- a/Source/JavaScriptCore/bytecode/SpeculatedType.h
+++ b/Source/JavaScriptCore/bytecode/SpeculatedType.h
@@ -80,7 +80,12 @@ static constexpr SpeculatedType SpecObjectOther                       = 1ull <<
 static constexpr SpeculatedType SpecStringIdent                       = 1ull << 32; // It's definitely a JSString, and it's an identifier.
 static constexpr SpeculatedType SpecStringResolvedVar                 = 1ull << 33; // It's definitely a JSString, and it's not an identifier. And string is resolved.
 static constexpr SpeculatedType SpecStringUnresolvedVar               = 1ull << 34; // It's definitely a JSString, and it's not an identifier. And string is unresolved.
+#if USE(BUN_JSC_ADDITIONS)
+static constexpr SpeculatedType SpecStringInline                      = 1ull << 51; // It's definitely a JSString with inline-small-string storage (not resolved, not a rope).
+static constexpr SpeculatedType SpecStringVar                         = SpecStringUnresolvedVar | SpecStringResolvedVar | SpecStringInline; // It's definitely a JSString, and it's not an identifier.
+#else
 static constexpr SpeculatedType SpecStringVar                         = SpecStringUnresolvedVar | SpecStringResolvedVar; // It's definitely a JSString, and it's not an identifier.
+#endif
 static constexpr SpeculatedType SpecStringResolved                    = SpecStringIdent | SpecStringResolvedVar; // It's definitely a JSString, and it's resolved. May be an identifier or not.
 static constexpr SpeculatedType SpecString                            = SpecStringIdent | SpecStringVar; // It's definitely a JSString.
 static constexpr SpeculatedType SpecSymbol                            = 1ull << 35; // It's definitely a Symbol.
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 01ec04b202609..1d74d96e078f9 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -7793,6 +7793,27 @@ void SpeculativeJIT::compileStringEquality(
     };
 
 #if USE(BUN_JSC_ADDITIONS)
+    // Literal-vs-inline fast path: encode the (short, 8-bit) literal as an
+    // inline m_fiber immediate and compare the dynamic side's m_fiber against it.
+    if (leftAtom != rightAtom) {
+        const String& constStr = leftAtom ? leftConst : rightConst;
+        GPRReg dynGPR = leftAtom ? rightGPR : leftGPR;
+        GPRReg dynTemp = leftAtom ? rightTempGPR : leftTempGPR;
+        if (constStr.is8Bit() && constStr.length() >= 2 && constStr.length() <= JSString::maxInlineLength8) {
+            uintptr_t encoded = JSString::encodeInline8(constStr.span8());
+            loadPtr(Address(dynGPR, JSString::offsetOfValue()), dynTemp);
+            Jump notInlineDyn = branchTestPtr(Zero, dynTemp, TrustedImm32(JSString::isInlineInPointer));
+            // Dynamic side is inline (bit 1 set, could be rope+substring too: rule that out).
+            Jump isSubstr = branchTestPtr(NonZero, dynTemp, TrustedImm32(JSString::isRopeInPointer));
+            trueCase.append(branchPtr(Equal, dynTemp, TrustedImmPtr(std::bit_cast<void*>(encoded))));
+            // Dynamic inline, fibers differ: if is8Bit matches, definitely unequal.
+            falseCase.append(branchTestPtr(NonZero, dynTemp, TrustedImm32(JSRopeString::is8BitInPointer)));
+            slowCase.append(jump());
+            isSubstr.link(this);
+            notInlineDyn.link(this);
+        }
+    }
+
     // Inline-vs-inline fast path: two inline small strings with matching is8Bit
     // are equal iff their m_fiber words are identical (encoding packs
     // length|is8Bit|bytes). Mixed 8/16-bit falls through to slowCase via the
@@ -8554,6 +8575,16 @@ void SpeculativeJIT::compileUnwrapGlobalProxy(Node* node)
     cellResult(resultGPR, node);
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+bool SpeculativeJIT::isLikelyInlineString(Edge edge)
+{
+    if (!edge)
+        return false;
+    SpeculatedType type = m_state.forNode(edge).m_type & SpecString;
+    return type && !(type & ~SpecStringInline);
+}
+#endif
+
 bool SpeculativeJIT::canBeRope(Edge edge)
 {
     if (!edge)
@@ -8638,6 +8669,20 @@ void SpeculativeJIT::compileGetArrayLength(Node* node)
         GPRReg tempGPR = temp.gpr();
 
         loadPtr(Address(baseGPR, JSString::offsetOfValue()), tempGPR);
+#if USE(BUN_JSC_ADDITIONS)
+        if (isLikelyInlineString(node->child1())) {
+            // Profile says this site only sees inline small strings. Speculate on
+            // that and emit the branch-free decode; OSR exit if we ever see a rope,
+            // rope-substring, or a resolved StringImpl*.
+            and32(TrustedImm32(JSString::notStringImplMask), tempGPR, resultGPR);
+            speculationCheck(BadType, JSValueSource::unboxedCell(baseGPR), node->child1(),
+                branch32(NotEqual, resultGPR, TrustedImm32(JSString::isInlineInPointer)));
+            urshiftPtr(TrustedImm32(JSString::inlineLengthShift), tempGPR);
+            and32(TrustedImm32(0x1f), tempGPR, resultGPR);
+            strictInt32Result(resultGPR, node);
+            break;
+        }
+#endif
         Jump isRope;
         if (canBeRope(node->child1()))
             isRope = branchIfRopeStringImpl(tempGPR);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index 3db053a787976..835c5aa9ec314 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -571,6 +571,9 @@ class SpeculativeJIT : public JITCompiler {
     bool isKnownNotOther(Node* node) { return !(m_state.forNode(node).m_type & SpecOther); }
 
     bool canBeRope(Edge);
+#if USE(BUN_JSC_ADDITIONS)
+    bool isLikelyInlineString(Edge);
+#endif
     std::optional<unsigned> tryGetConstantStringLength(Edge);
 
     UniquedStringImpl* identifierUID(unsigned index)
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index 085124c6448d7..506a33becdf6c 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -1368,12 +1368,17 @@ void JIT::emit_op_switch_char(const JSInstruction* currentInstruction)
 
     isRope.link(this);
 #if USE(BUN_JSC_ADDITIONS)
-    // Inline small string: skip the out-of-bounds rope-length read; operationResolveRope handles it.
-    auto isInline = branchTestPtr(Zero, regT4, TrustedImm32(JSString::isRopeInPointer));
+    // Inline small string: length is in bits 3..7 of regT4. switch_char only matches
+    // length-1; the only inline length-1 case is a single non-Latin-1 code unit.
+    auto notInline = branchTestPtr(NonZero, regT4, TrustedImm32(JSString::isRopeInPointer));
+    and32(TrustedImm32(0x1f << JSString::inlineLengthShift), regT4, regT2);
+    addJump(branch32(NotEqual, regT2, TrustedImm32(1 << JSString::inlineLengthShift)), defaultOffset);
+    auto resolveInline = jump();
+    notInline.link(this);
 #endif
     addJump(branch32(NotEqual, Address(jsRegT10.payloadGPR(), JSRopeString::offsetOfLength()), TrustedImm32(1)), defaultOffset);
 #if USE(BUN_JSC_ADDITIONS)
-    isInline.link(this);
+    resolveInline.link(this);
 #endif
     loadGlobalObject(regT2);
     callOperation(operationResolveRope, regT2, jsRegT10.payloadGPR());
diff --git a/Source/JavaScriptCore/lol/LOLJIT.cpp b/Source/JavaScriptCore/lol/LOLJIT.cpp
index 9d508fbc83a0e..97d8338876825 100644
--- a/Source/JavaScriptCore/lol/LOLJIT.cpp
+++ b/Source/JavaScriptCore/lol/LOLJIT.cpp
@@ -2451,12 +2451,17 @@ void LOLJIT::emit_op_switch_char(const JSInstruction* currentInstruction)
 
     isRope.link(this);
 #if USE(BUN_JSC_ADDITIONS)
-    // Inline small string: skip the out-of-bounds rope-length read; operationResolveRope handles it.
-    auto isInline = branchTestPtr(Zero, regT4, TrustedImm32(JSString::isRopeInPointer));
+    // Inline small string: length is in bits 3..7 of regT4. switch_char only matches
+    // length-1; the only inline length-1 case is a single non-Latin-1 code unit.
+    auto notInline = branchTestPtr(NonZero, regT4, TrustedImm32(JSString::isRopeInPointer));
+    and32(TrustedImm32(0x1f << JSString::inlineLengthShift), regT4, s_scratch);
+    addJump(branch32(NotEqual, s_scratch, TrustedImm32(1 << JSString::inlineLengthShift)), defaultOffset);
+    auto resolveInline = jump();
+    notInline.link(this);
 #endif
     addJump(branch32(NotEqual, Address(scrutineeRegs.payloadGPR(), JSRopeString::offsetOfLength()), TrustedImm32(1)), defaultOffset);
 #if USE(BUN_JSC_ADDITIONS)
-    isInline.link(this);
+    resolveInline.link(this);
 #endif
     loadGlobalObject(s_scratch);
     callOperation(operationResolveRope, s_scratch, scrutineeRegs.payloadGPR());
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 9484e049c2edd..a17a48c581fb6 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -248,6 +248,7 @@ class JSString : public JSCell {
     }
 
 #if USE(BUN_JSC_ADDITIONS)
+public:
     static ALWAYS_INLINE uintptr_t encodeInline8(std::span<const Latin1Character> chars)
     {
         ASSERT(chars.size() >= 2 && chars.size() <= maxInlineLength8);

From aa6d2927ffbd4f0eeeb7010f30fb3292e2a00599 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sat, 18 Jul 2026 09:11:57 +0000
Subject: [PATCH 10/69] FTL: isLikelyInlineString helper + speculative inline
 length path

Mirrors DFGSpeculativeJIT::isLikelyInlineString. When provenType is
monomorphic SpecStringInline, FTL string-length speculates on (fiber&3)==2
and emits the branch-free (fiber>>3)&0x1f decode.

Measured (function-scoped loop, 2M ops on 5-char inline slices):
  .length 7.5ms -> 5.0ms (-33%)

Also: Linux CI fail-fast:false so x64 and arm64 report independently
(previous runs only showed whichever arm64 variant finished first).
---
 .github/workflows/build-reusable.yml          |  1 +
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 24 +++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml
index 1c71527296e04..c8affc011b3f9 100644
--- a/.github/workflows/build-reusable.yml
+++ b/.github/workflows/build-reusable.yml
@@ -32,6 +32,7 @@ jobs:
     name: Linux
     runs-on: ${{matrix.os}}
     strategy:
+      fail-fast: false
       matrix:
         include:
           - lto_flag: ""
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 81c5e16cca184..6d4a87fc59870 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -6223,6 +6223,20 @@ IGNORE_CLANG_WARNINGS_END
                 return;
             }
 
+#if USE(BUN_JSC_ADDITIONS)
+            if (isLikelyInlineString(m_node->child1())) {
+                LValue fiber = m_out.loadPtr(string, m_heaps.JSString_value);
+                speculate(BadType, jsValueValue(string), m_node->child1().node(),
+                    m_out.notEqual(
+                        m_out.bitAnd(fiber, m_out.constIntPtr(JSString::notStringImplMask)),
+                        m_out.constIntPtr(JSString::isInlineInPointer)));
+                setInt32(m_out.bitAnd(
+                    m_out.castToInt32(m_out.lShr(fiber, m_out.constInt32(JSString::inlineLengthShift))),
+                    m_out.constInt32(0x1f)));
+                return;
+            }
+#endif
+
             LBasicBlock ropePath = m_out.newBlock();
             LBasicBlock nonRopePath = m_out.newBlock();
             LBasicBlock continuation = m_out.newBlock();
@@ -25660,6 +25674,16 @@ IGNORE_CLANG_WARNINGS_END
             m_out.constInt32(StringType));
     }
 
+#if USE(BUN_JSC_ADDITIONS)
+    bool isLikelyInlineString(Edge edge)
+    {
+        if (!edge)
+            return false;
+        SpeculatedType type = provenType(edge) & SpecString;
+        return type && !(type & ~SpecStringInline);
+    }
+#endif
+
     bool canBeRope(Edge edge)
     {
         if (!edge)

From bd1019b758d52bbc9676c8c948e896ed886d5302 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 07:12:42 +0000
Subject: [PATCH 11/69] Speculative inline charCodeAt (DFG+FTL) and
 short-concat inlining

FixupPhase: for StringCharCodeAt with a monomorphic-SpecStringInline base,
skip inserting ResolveRope so the code unit can be read straight from the
cell without materializing a StringImpl.

DFG compileGetCharCodeAt / FTL compileStringCharCodeAt: when the base's
prediction matches the FixupPhase condition, speculate on (fiber&3)==2 and
load8/load16 from cell+9 / cell+10.

OperationsInlines.h jsString(globalObject, s1, s2): when both sides'
characters are available without allocation and the combined length fits
(<=7 Latin-1 / <=3 UTF-16), write into a 16-byte inline cell instead of a
32-byte rope.

Measured (function-scoped loops, 2M ops on 5-char inline slices, vs
unpatched release):
  .length           14.9ms -> 6.5ms  (-56%)
  .charCodeAt       14.7ms -> 7.1ms  (-52%)
  === (50/50 mix)   30.2ms -> 7.8ms  (-74%)
  === "literal"   15.1ms -> 13.9ms  (-8%)
  short concat      32 B/obj -> 16 B/obj (-50%)

All four tiers pass the correctness suite.
---
 Source/JavaScriptCore/dfg/DFGFixupPhase.cpp   | 13 +++++++
 .../JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  | 26 ++++++++++++++
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 34 +++++++++++++++++++
 .../runtime/OperationsInlines.h               | 25 ++++++++++++++
 4 files changed, 98 insertions(+)

diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 3871f97cef1c9..4e39f78ea7c37 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -1140,6 +1140,19 @@ class FixupPhase : public Phase {
                 ASSERT(node->arrayMode() == ArrayMode(Array::String, Array::Read, Array::OutOfBounds) || node->arrayMode() == ArrayMode(Array::String, Array::Read, Array::InBounds));
             else
                 ASSERT(node->arrayMode() == ArrayMode(Array::String, Array::Read));
+#if USE(BUN_JSC_ADDITIONS)
+            // For StringCharCodeAt on a monomorphic-inline profile, skip the
+            // ResolveRope insertion so compileGetCharCodeAt can read the code
+            // unit straight from the cell without materializing a StringImpl.
+            {
+                SpeculatedType pred = node->child1()->prediction() & SpecString;
+                if (op == StringCharCodeAt && pred && !(pred & ~SpecStringInline)) {
+                    fixEdge<StringUse>(node->child1());
+                    fixEdge<Int32Use>(node->child2());
+                    break;
+                }
+            }
+#endif
             blessArrayOperation(node->child1(), node->child2(), node->child1()); // Rewrite child1 with ResolveRope.
             fixEdge<KnownStringUse>(node->child1());
             fixEdge<Int32Use>(node->child2());
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 1d74d96e078f9..af973c47b7cb9 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -2726,6 +2726,32 @@ void SpeculativeJIT::compileGetCharCodeAt(Node* node)
 
     loadPtr(Address(stringReg, JSString::offsetOfValue()), scratchReg);
 
+#if USE(BUN_JSC_ADDITIONS)
+    // Match the exact condition FixupPhase used to decide whether to skip
+    // ResolveRope (it reads prediction(), which is fixed before AI runs).
+    SpeculatedType inlinePred = node->child1()->prediction() & SpecString;
+    if (inlinePred && !(inlinePred & ~SpecStringInline)) {
+        // FixupPhase skipped ResolveRope; scratchReg holds the raw fiber.
+        GPRTemporary scratch2(this);
+        GPRReg scratch2Reg = scratch2.gpr();
+        and32(TrustedImm32(JSString::notStringImplMask), scratchReg, scratch2Reg);
+        speculationCheck(BadType, JSValueSource::unboxedCell(stringReg), node->child1(),
+            branch32(NotEqual, scratch2Reg, TrustedImm32(JSString::isInlineInPointer)));
+        move(scratchReg, scratch2Reg);
+        urshiftPtr(TrustedImm32(JSString::inlineLengthShift), scratch2Reg);
+        and32(TrustedImm32(0x1f), scratch2Reg);
+        speculationCheck(Uncountable, JSValueRegs(), nullptr, branch32(AboveOrEqual, indexReg, scratch2Reg));
+        Jump is16 = branchTestPtr(Zero, scratchReg, TrustedImm32(JSRopeString::is8BitInPointer));
+        load8(BaseIndex(stringReg, indexReg, TimesOne, JSString::offsetOfValue() + 1), scratchReg);
+        Jump done = jump();
+        is16.link(this);
+        load16(BaseIndex(stringReg, indexReg, TimesTwo, JSString::offsetOfValue() + 2), scratchReg);
+        done.link(this);
+        strictInt32Result(scratchReg, m_currentNode);
+        return;
+    }
+#endif
+
     // unsigned comparison so we can filter out negative indices and indices that are too large
     if (auto stringLength = tryGetConstantStringLength(node->child1()))
         speculationCheck(Uncountable, JSValueRegs(), nullptr, branch32(AboveOrEqual, indexReg, TrustedImm32(*stringLength)));
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 6d4a87fc59870..3062f2ef4d5f1 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -12122,6 +12122,40 @@ IGNORE_CLANG_WARNINGS_END
         LValue index = lowInt32(m_node->child2());
 
         LValue stringImpl = m_out.loadPtr(base, m_heaps.JSString_value);
+
+#if USE(BUN_JSC_ADDITIONS)
+        // Match the exact FixupPhase condition that skipped ResolveRope.
+        SpeculatedType pred = m_node->child1()->prediction() & SpecString;
+        if (pred && !(pred & ~SpecStringInline)) {
+            LBasicBlock inline8 = m_out.newBlock();
+            LBasicBlock inline16 = m_out.newBlock();
+            LBasicBlock inlineDone = m_out.newBlock();
+            speculate(BadType, jsValueValue(base), m_node->child1().node(),
+                m_out.notEqual(
+                    m_out.bitAnd(stringImpl, m_out.constIntPtr(JSString::notStringImplMask)),
+                    m_out.constIntPtr(JSString::isInlineInPointer)));
+            LValue inlineLen = m_out.bitAnd(
+                m_out.castToInt32(m_out.lShr(stringImpl, m_out.constInt32(JSString::inlineLengthShift))),
+                m_out.constInt32(0x1f));
+            speculate(Uncountable, noValue(), nullptr, m_out.aboveOrEqual(index, inlineLen));
+            m_out.branch(
+                m_out.testNonZeroPtr(stringImpl, m_out.constIntPtr(JSRopeString::is8BitInPointer)),
+                unsure(inline8), unsure(inline16));
+            LBasicBlock lastNextI = m_out.appendTo(inline8, inline16);
+            ValueFromBlock ch8 = m_out.anchor(m_out.load8ZeroExt32(
+                m_out.baseIndex(m_heaps.characters8, base, m_out.zeroExtPtr(index), provenValue(m_node->child2()), JSString::offsetOfValue() + 1)));
+            m_out.jump(inlineDone);
+            m_out.appendTo(inline16, inlineDone);
+            ValueFromBlock ch16 = m_out.anchor(m_out.load16ZeroExt32(
+                m_out.baseIndex(m_heaps.characters16, base, m_out.zeroExtPtr(index), provenValue(m_node->child2()), JSString::offsetOfValue() + 2)));
+            m_out.jump(inlineDone);
+            m_out.appendTo(inlineDone, lastNextI);
+            ensureStillAliveHere(base);
+            setInt32(m_out.phi(Int32, ch8, ch16));
+            return;
+        }
+#endif
+
         LValue data = m_out.loadPtr(stringImpl, m_heaps.StringImpl_data);
 
         if (!m_node->arrayMode().isInBounds()) {
diff --git a/Source/JavaScriptCore/runtime/OperationsInlines.h b/Source/JavaScriptCore/runtime/OperationsInlines.h
index e310550b770c7..f7a5784bf02cc 100644
--- a/Source/JavaScriptCore/runtime/OperationsInlines.h
+++ b/Source/JavaScriptCore/runtime/OperationsInlines.h
@@ -158,6 +158,31 @@ ALWAYS_INLINE JSString* jsString(JSGlobalObject* globalObject, JSString* s1, JSS
         return nullptr;
     }
 
+#if USE(BUN_JSC_ADDITIONS)
+    // Short concats: write both sides into a 16-byte inline cell instead of a
+    // 32-byte rope that would need resolving later. Only when both sides'
+    // characters are available without allocation (non-rope).
+    unsigned total = length1 + length2;
+    if (total <= JSString::maxInlineLength8 && !s1->isRope() && !s2->isRope()) {
+        auto view1 = s1->view(globalObject);
+        auto view2 = s2->view(globalObject);
+        if (view1->is8Bit() && view2->is8Bit()) {
+            Latin1Character buf[JSString::maxInlineLength8];
+            memcpy(buf, view1->span8().data(), length1);
+            memcpy(buf + length1, view2->span8().data(), length2);
+            return JSString::createInline8(vm, std::span { buf, total });
+        }
+    }
+    if (total <= JSString::maxInlineLength16 && !s1->isRope() && !s2->isRope()) {
+        auto view1 = s1->view(globalObject);
+        auto view2 = s2->view(globalObject);
+        char16_t buf[JSString::maxInlineLength16];
+        view1->getCharacters(std::span { buf, length1 });
+        view2->getCharacters(std::span { buf + length1, length2 });
+        return JSString::createInline16(vm, std::span { buf, total });
+    }
+#endif
+
     return JSRopeString::create(vm, s1, s2);
 }
 

From a35b4e6224c950aa7f2f55cb484210def79867f5 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 08:09:03 +0000
Subject: [PATCH 12/69] JSString::view(): materialize inline strings before
 returning a StringView

Returning a StringView that points at &m_fiber+1 is unsafe: any subsequent
resolveInline() (including tryGetValue()) overwrites m_fiber with a
StringImpl*, leaving the StringView reading pointer bytes. JSStringJoiner
(Array.prototype.join) does exactly this:

    auto view = jsString->view(globalObject);           // -> &m_fiber+1
    append(..., StringViewWithUnderlyingString(view,
        uncheckedDowncast<JSString>(view.owner)->tryGetValue()));  // resolves in place

which produced garbage characters in JetStream3 WSL ("float" -> heap-pointer
bytes). Materialize to a StringImpl in view(), mirroring how non-substring
ropes are resolved there.

nonRopeStringView() (used only inside resolveToBuffer/tryFindOneChar/etc.,
where the view is consumed immediately) keeps the in-cell pointer.
---
 Source/JavaScriptCore/runtime/JSString.h | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index a17a48c581fb6..f7bc4ffd9c5cf 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -1370,13 +1370,12 @@ ALWAYS_INLINE GCOwnedDataScope<StringView> JSString::view(JSGlobalObject* global
     if (isRope())
         return static_cast<const JSRopeString&>(*this).view(globalObject);
 #if USE(BUN_JSC_ADDITIONS)
-    uintptr_t fiber = fiberConcurrently();
-    if (isInlineFiber(fiber)) {
-        unsigned len = inlineLengthFromFiber(fiber);
-        if (fiber & JSRopeString::is8BitInPointer)
-            return { this, StringView { std::span { inlineData8(), len } } };
-        return { this, StringView { std::span { inlineData16(), len } } };
-    }
+    // A StringView into inlineData8()/inlineData16() would point at &m_fiber+1,
+    // which is invalidated the moment anything resolves the inline string in
+    // place (JSStringJoiner calls tryGetValue() right after view(), for one).
+    // Materialize here so the returned view points at stable StringImpl storage.
+    if (isInline())
+        return { this, resolveInline(globalObject) };
 #endif
     return { this, valueInternal() };
 }

From 73681b5b0740f27b61a2cf2d58a9b13185f69492 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 08:15:08 +0000
Subject: [PATCH 13/69] Use 3-bit inlineLengthMask (0x7) instead of 0x1f

An inline fiber's payload is at most 7 bytes; masking the decoded length to
3 bits ensures a corrupted high nibble can never produce an out-of-bounds
read from inlineData8()/inlineData16(). Replaces the 0x1f literal with
JSString::inlineLengthMask across the runtime, LLInt, and every JIT tier.
---
 Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp   | 2 +-
 Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp          | 6 +++---
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp            | 6 +++---
 Source/JavaScriptCore/jit/JITOpcodes.cpp                 | 2 +-
 Source/JavaScriptCore/jit/ThunkGenerators.cpp            | 2 +-
 Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm | 2 +-
 Source/JavaScriptCore/llint/LowLevelInterpreter64.asm    | 2 +-
 Source/JavaScriptCore/lol/LOLJIT.cpp                     | 2 +-
 Source/JavaScriptCore/runtime/JSString.h                 | 5 ++++-
 9 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
index d44c171d8f0cd..30475e29748df 100644
--- a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
+++ b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
@@ -3965,7 +3965,7 @@ void InlineCacheCompiler::generateAccessCase(unsigned index, AccessCase& accessC
         // Inline small strings: length is in bits 3..7 of m_fiber (still in scratchGPR).
         auto realRope = jit.branchTestPtr(CCallHelpers::NonZero, scratchGPR, CCallHelpers::TrustedImm32(JSString::isRopeInPointer));
         jit.urshiftPtr(CCallHelpers::TrustedImm32(JSString::inlineLengthShift), scratchGPR);
-        jit.and32(CCallHelpers::TrustedImm32(0x1f), scratchGPR, valueRegs.payloadGPR());
+        jit.and32(CCallHelpers::TrustedImm32(JSString::inlineLengthMask), scratchGPR, valueRegs.payloadGPR());
         auto doneInline = jit.jump();
         realRope.link(&jit);
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index af973c47b7cb9..d6ab688bdeacc 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -2739,7 +2739,7 @@ void SpeculativeJIT::compileGetCharCodeAt(Node* node)
             branch32(NotEqual, scratch2Reg, TrustedImm32(JSString::isInlineInPointer)));
         move(scratchReg, scratch2Reg);
         urshiftPtr(TrustedImm32(JSString::inlineLengthShift), scratch2Reg);
-        and32(TrustedImm32(0x1f), scratch2Reg);
+        and32(TrustedImm32(JSString::inlineLengthMask), scratch2Reg);
         speculationCheck(Uncountable, JSValueRegs(), nullptr, branch32(AboveOrEqual, indexReg, scratch2Reg));
         Jump is16 = branchTestPtr(Zero, scratchReg, TrustedImm32(JSRopeString::is8BitInPointer));
         load8(BaseIndex(stringReg, indexReg, TimesOne, JSString::offsetOfValue() + 1), scratchReg);
@@ -8704,7 +8704,7 @@ void SpeculativeJIT::compileGetArrayLength(Node* node)
             speculationCheck(BadType, JSValueSource::unboxedCell(baseGPR), node->child1(),
                 branch32(NotEqual, resultGPR, TrustedImm32(JSString::isInlineInPointer)));
             urshiftPtr(TrustedImm32(JSString::inlineLengthShift), tempGPR);
-            and32(TrustedImm32(0x1f), tempGPR, resultGPR);
+            and32(TrustedImm32(JSString::inlineLengthMask), tempGPR, resultGPR);
             strictInt32Result(resultGPR, node);
             break;
         }
@@ -8719,7 +8719,7 @@ void SpeculativeJIT::compileGetArrayLength(Node* node)
 #if USE(BUN_JSC_ADDITIONS)
             auto realRope = branchTestPtr(NonZero, tempGPR, TrustedImm32(JSString::isRopeInPointer));
             urshiftPtr(TrustedImm32(JSString::inlineLengthShift), tempGPR);
-            and32(TrustedImm32(0x1f), tempGPR, resultGPR);
+            and32(TrustedImm32(JSString::inlineLengthMask), tempGPR, resultGPR);
             auto doneInline = jump();
             realRope.link(this);
 #endif
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 3062f2ef4d5f1..7b98b029ccd1f 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -6232,7 +6232,7 @@ IGNORE_CLANG_WARNINGS_END
                         m_out.constIntPtr(JSString::isInlineInPointer)));
                 setInt32(m_out.bitAnd(
                     m_out.castToInt32(m_out.lShr(fiber, m_out.constInt32(JSString::inlineLengthShift))),
-                    m_out.constInt32(0x1f)));
+                    m_out.constInt32(JSString::inlineLengthMask)));
                 return;
             }
 #endif
@@ -6256,7 +6256,7 @@ IGNORE_CLANG_WARNINGS_END
             m_out.appendTo(inlinePath, realRopePath);
             ValueFromBlock inlineLength = m_out.anchor(m_out.bitAnd(
                 m_out.castToInt32(m_out.lShr(fiber, m_out.constInt32(JSString::inlineLengthShift))),
-                m_out.constInt32(0x1f)));
+                m_out.constInt32(JSString::inlineLengthMask)));
             m_out.jump(continuation);
 
             m_out.appendTo(realRopePath, nonRopePath);
@@ -12136,7 +12136,7 @@ IGNORE_CLANG_WARNINGS_END
                     m_out.constIntPtr(JSString::isInlineInPointer)));
             LValue inlineLen = m_out.bitAnd(
                 m_out.castToInt32(m_out.lShr(stringImpl, m_out.constInt32(JSString::inlineLengthShift))),
-                m_out.constInt32(0x1f));
+                m_out.constInt32(JSString::inlineLengthMask));
             speculate(Uncountable, noValue(), nullptr, m_out.aboveOrEqual(index, inlineLen));
             m_out.branch(
                 m_out.testNonZeroPtr(stringImpl, m_out.constIntPtr(JSRopeString::is8BitInPointer)),
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index 506a33becdf6c..9a21f8ae51dc0 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -1371,7 +1371,7 @@ void JIT::emit_op_switch_char(const JSInstruction* currentInstruction)
     // Inline small string: length is in bits 3..7 of regT4. switch_char only matches
     // length-1; the only inline length-1 case is a single non-Latin-1 code unit.
     auto notInline = branchTestPtr(NonZero, regT4, TrustedImm32(JSString::isRopeInPointer));
-    and32(TrustedImm32(0x1f << JSString::inlineLengthShift), regT4, regT2);
+    and32(TrustedImm32(JSString::inlineLengthMask << JSString::inlineLengthShift), regT4, regT2);
     addJump(branch32(NotEqual, regT2, TrustedImm32(1 << JSString::inlineLengthShift)), defaultOffset);
     auto resolveInline = jump();
     notInline.link(this);
diff --git a/Source/JavaScriptCore/jit/ThunkGenerators.cpp b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
index d22a76fc0233e..bc744456039eb 100644
--- a/Source/JavaScriptCore/jit/ThunkGenerators.cpp
+++ b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
@@ -700,7 +700,7 @@ MacroAssemblerCodeRef<JITThunkPtrTag> stringEqualThunkGenerator(VM& vm)
         auto notInline = jit.branchTestPtr(JIT::NonZero, dataGPR, JIT::TrustedImm32(JSString::isRopeInPointer));
         jit.move(dataGPR, lengthGPR);
         jit.urshiftPtr(JIT::TrustedImm32(JSString::inlineLengthShift), lengthGPR);
-        jit.and32(JIT::TrustedImm32(0x1f), lengthGPR);
+        jit.and32(JIT::TrustedImm32(JSString::inlineLengthMask), lengthGPR);
         jit.move(dataGPR, flagsGPR);
         jit.and32(JIT::TrustedImm32(StringImpl::flagIs8Bit()), flagsGPR);
         jit.addPtr(JIT::TrustedImm32(JSString::offsetOfValue() + 1), jsStringGPR, dataGPR);
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
index f5628bef08a64..fb8d37e143d4f 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -2258,7 +2258,7 @@ llintOpWithJump(op_switch_char, OpSwitchChar, macro (size, get, jump, dispatch)
     # bits 3..7 of the fiber in t1; avoid the rope-layout length read below.
     btpnz t1, isRopeInPointer, .opSwitchOnRealRope
     urshiftp 3, t1
-    andp 0x1f, t1
+    andp (constexpr JSString::inlineLengthMask), t1
     bineq t1, 1, .opSwitchCharFallThrough
     jmp .opSwitchSlow
 .opSwitchOnRealRope:
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
index b2dd685d10d9c..0b44bf1038d5d 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -2446,7 +2446,7 @@ llintOpWithJump(op_switch_char, OpSwitchChar, macro (size, get, jump, dispatch)
     # bits 3..7 of the fiber in t0; avoid the rope-layout length read below.
     btpnz t0, isRopeInPointer, .opSwitchOnRealRope
     urshiftp 3, t0
-    andp 0x1f, t0
+    andp (constexpr JSString::inlineLengthMask), t0
     bineq t0, 1, .opSwitchCharFallThrough
     jmp .opSwitchSlow
 .opSwitchOnRealRope:
diff --git a/Source/JavaScriptCore/lol/LOLJIT.cpp b/Source/JavaScriptCore/lol/LOLJIT.cpp
index 97d8338876825..b10f1b533b4f2 100644
--- a/Source/JavaScriptCore/lol/LOLJIT.cpp
+++ b/Source/JavaScriptCore/lol/LOLJIT.cpp
@@ -2454,7 +2454,7 @@ void LOLJIT::emit_op_switch_char(const JSInstruction* currentInstruction)
     // Inline small string: length is in bits 3..7 of regT4. switch_char only matches
     // length-1; the only inline length-1 case is a single non-Latin-1 code unit.
     auto notInline = branchTestPtr(NonZero, regT4, TrustedImm32(JSString::isRopeInPointer));
-    and32(TrustedImm32(0x1f << JSString::inlineLengthShift), regT4, s_scratch);
+    and32(TrustedImm32(JSString::inlineLengthMask << JSString::inlineLengthShift), regT4, s_scratch);
     addJump(branch32(NotEqual, s_scratch, TrustedImm32(1 << JSString::inlineLengthShift)), defaultOffset);
     auto resolveInline = jump();
     notInline.link(this);
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index f7bc4ffd9c5cf..b8ff06525c784 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -145,6 +145,9 @@ class JSString : public JSCell {
     static constexpr uintptr_t isInlineInPointer = 0x2;
     static constexpr uintptr_t notStringImplMask = isRopeInPointer | isInlineInPointer;
     static constexpr unsigned inlineLengthShift = 3;
+    // 3-bit mask: an inline fiber can never address more payload bytes than it
+    // holds, regardless of memory corruption in the unused high bits.
+    static constexpr unsigned inlineLengthMask = 0x7;
     static constexpr unsigned maxInlineLength8 = 7;
     static constexpr unsigned maxInlineLength16 = 3;
 #else
@@ -339,7 +342,7 @@ class JSString : public JSCell {
     }
     ALWAYS_INLINE static unsigned inlineLengthFromFiber(uintptr_t fiber)
     {
-        return static_cast<unsigned>(fiber >> inlineLengthShift) & 0x1fu;
+        return static_cast<unsigned>(fiber >> inlineLengthShift) & inlineLengthMask;
     }
     ALWAYS_INLINE const Latin1Character* inlineData8() const
     {

From f4db178e1be375f137983b938f09a39cc8764bfe Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 09:19:45 +0000
Subject: [PATCH 14/69] view() returns in-cell StringView again; fix
 JSStringJoiner instead

Reverts a35b4e6224 and moves the fix to the two JSStringJoiner call sites
that store the StringView past the GCOwnedDataScope lifetime and then call
tryGetValue() on the same string (which overwrites m_fiber in place).
Resolving the inline string before calling view() there lets every other
view() caller keep the zero-copy in-cell pointer.

JetStream3 WSL: 1.47 (baseline) -> 1.50 (this) vs 1.33 with the
materialize-in-view() approach.
---
 Source/JavaScriptCore/runtime/JSString.h       | 18 ++++++++++++------
 Source/JavaScriptCore/runtime/JSStringJoiner.h | 12 ++++++++++++
 2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index b8ff06525c784..b5518f9b77f97 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -1373,12 +1373,18 @@ ALWAYS_INLINE GCOwnedDataScope<StringView> JSString::view(JSGlobalObject* global
     if (isRope())
         return static_cast<const JSRopeString&>(*this).view(globalObject);
 #if USE(BUN_JSC_ADDITIONS)
-    // A StringView into inlineData8()/inlineData16() would point at &m_fiber+1,
-    // which is invalidated the moment anything resolves the inline string in
-    // place (JSStringJoiner calls tryGetValue() right after view(), for one).
-    // Materialize here so the returned view points at stable StringImpl storage.
-    if (isInline())
-        return { this, resolveInline(globalObject) };
+    // The returned StringView points at &m_fiber+1. This is safe for the
+    // lifetime of the GCOwnedDataScope: the cell is kept alive, and nothing
+    // else resolves the inline string in place while the scope is live.
+    // Callers that outlive the scope or call value()/tryGetValue() on the same
+    // string afterwards must resolve first (see JSStringJoiner).
+    uintptr_t fiber = fiberConcurrently();
+    if (isInlineFiber(fiber)) {
+        unsigned len = inlineLengthFromFiber(fiber);
+        if (fiber & JSRopeString::is8BitInPointer)
+            return { this, StringView { std::span { inlineData8(), len } } };
+        return { this, StringView { std::span { inlineData16(), len } } };
+    }
 #endif
     return { this, valueInternal() };
 }
diff --git a/Source/JavaScriptCore/runtime/JSStringJoiner.h b/Source/JavaScriptCore/runtime/JSStringJoiner.h
index 2a2e4288e6ea1..8ef120af90bf2 100644
--- a/Source/JavaScriptCore/runtime/JSStringJoiner.h
+++ b/Source/JavaScriptCore/runtime/JSStringJoiner.h
@@ -148,6 +148,14 @@ ALWAYS_INLINE bool JSStringJoiner::appendWithoutSideEffects(JSGlobalObject* glob
         // FIXME: Support JSBigInt in side-effect-free append.
         // https://bugs.webkit.org/show_bug.cgi?id=211173
         if (JSString* jsString = dynamicDowncast<JSString>(value)) {
+#if USE(BUN_JSC_ADDITIONS)
+            // view() for an inline small string points at the cell's m_fiber bytes.
+            // tryGetValue() (below) would then overwrite m_fiber in place and the
+            // stored view would read pointer bytes. Resolve first so the view
+            // points at stable StringImpl storage that tryGetValue() also returns.
+            if (jsString->isInline())
+                jsString->resolveInline(globalObject);
+#endif
             auto view = jsString->view(globalObject);
             RETURN_IF_EXCEPTION(scope, false);
             // Since getting the view didn't OOM, we know that the underlying String exists and isn't
@@ -200,6 +208,10 @@ ALWAYS_INLINE bool JSStringJoiner::append(JSGlobalObject* globalObject, JSValue
         ASSERT(!value.isString());
         JSString* jsString = value.asCell()->toStringInline(globalObject);
         RETURN_IF_EXCEPTION(scope, false);
+#if USE(BUN_JSC_ADDITIONS)
+        if (jsString->isInline())
+            jsString->resolveInline(globalObject);
+#endif
         auto view = jsString->view(globalObject);
         RETURN_IF_EXCEPTION(scope, false);
         scope.release();

From 7efd396151a3b6273066410132387941a5d87057 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 09:32:53 +0000
Subject: [PATCH 15/69] DFG/FTL MakeRope: route short all-8-bit concats to the
 inline creator

After reading child lengths/flags, if the total is <=7 and all children are
8-bit, branch to the existing slowPath so operationMakeRope2/3 -> jsString()
emits a 16-byte inline cell instead of finishing the 32-byte rope. The
already-allocated rope cell has fiber0==isRopeInPointer with a null fiber,
which visitChildren handles.

Also hook the 3-arg jsString(globalObject, s1, s2, s3).

describe() confirms 'a'+'b' and 'a'+'b'+'c' both produce inline cells in
FTL-compiled code. JetStream3: WSL neutral, source-map-wtb ~+4%, SunSpider
within noise.
---
 Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  | 11 +++++++++++
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp    | 12 ++++++++++++
 .../JavaScriptCore/runtime/OperationsInlines.h   | 16 ++++++++++++++++
 3 files changed, 39 insertions(+)

diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index d6ab688bdeacc..e617a52c3a253 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -17851,6 +17851,17 @@ void SpeculativeJIT::compileMakeRope(Node* node)
 
     static_assert(StringImpl::flagIs8Bit() == JSRopeString::is8BitInPointer);
     and32(TrustedImm32(StringImpl::flagIs8Bit()), scratchGPR);
+#if USE(BUN_JSC_ADDITIONS)
+    // Short all-8-bit result: defer to operationMakeRope* so jsString() can emit
+    // a 16-byte inline cell instead of the 32-byte rope we've just allocated.
+    // The abandoned rope cell has fiber0==isRopeInPointer with null fiber, which
+    // visitChildren treats as empty.
+    {
+        Jump not8Bit = branchTest32(Zero, scratchGPR);
+        slowPath.append(branch32(BelowOrEqual, allocatorGPR, TrustedImm32(JSString::maxInlineLength8)));
+        not8Bit.link(this);
+    }
+#endif
     orPtr(opGPRs[0], scratchGPR);
     orPtr(TrustedImmPtr(JSString::isRopeInPointer), scratchGPR);
     storePtr(scratchGPR, Address(resultGPR, JSRopeString::offsetOfFiber0()));
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 7b98b029ccd1f..8c09336a51981 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -11806,6 +11806,18 @@ IGNORE_CLANG_WARNINGS_END
             }
         }
 
+#if USE(BUN_JSC_ADDITIONS)
+        // Short all-8-bit result: defer to operationMakeRope* so jsString() can
+        // emit a 16-byte inline cell.
+        {
+            LBasicBlock notShortInline = m_out.newBlock();
+            LValue is8Bit = m_out.testNonZero32(flagsAndLength.flags, m_out.constInt32(StringImpl::flagIs8Bit()));
+            LValue shortEnough = m_out.belowOrEqual(flagsAndLength.length, m_out.constInt32(JSString::maxInlineLength8));
+            m_out.branch(m_out.bitAnd(is8Bit, shortEnough), rarely(slowPath), usually(notShortInline));
+            m_out.appendTo(notShortInline);
+        }
+#endif
+
         m_out.storePtr(
             m_out.bitOr(
                 m_out.bitOr(kids[0], m_out.constIntPtr(JSString::isRopeInPointer)),
diff --git a/Source/JavaScriptCore/runtime/OperationsInlines.h b/Source/JavaScriptCore/runtime/OperationsInlines.h
index f7a5784bf02cc..ce568bef07243 100644
--- a/Source/JavaScriptCore/runtime/OperationsInlines.h
+++ b/Source/JavaScriptCore/runtime/OperationsInlines.h
@@ -209,6 +209,22 @@ ALWAYS_INLINE JSString* jsString(JSGlobalObject* globalObject, JSString* s1, JSS
         return nullptr;
     }
 
+#if USE(BUN_JSC_ADDITIONS)
+    unsigned total = length1 + length2 + length3;
+    if (total <= JSString::maxInlineLength8 && !s1->isRope() && !s2->isRope() && !s3->isRope()) {
+        auto v1 = s1->view(globalObject);
+        auto v2 = s2->view(globalObject);
+        auto v3 = s3->view(globalObject);
+        if (v1->is8Bit() && v2->is8Bit() && v3->is8Bit()) {
+            Latin1Character buf[JSString::maxInlineLength8];
+            memcpy(buf, v1->span8().data(), length1);
+            memcpy(buf + length1, v2->span8().data(), length2);
+            memcpy(buf + length1 + length2, v3->span8().data(), length3);
+            return JSString::createInline8(vm, std::span { buf, total });
+        }
+    }
+#endif
+
     return JSRopeString::create(vm, s1, s2, s3);
 }
 

From 8e8f58a183babeb403d0b787c0f78956c766b164 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 09:48:49 +0000
Subject: [PATCH 16/69] JSBigInlineString: 24-byte inline cell for 8..15
 Latin-1 / 4..7 UTF-16 chars

Same (fiber&3)==2 encoding with an extra uintptr_t of contiguous payload, so
every existing JIT decoder (length shift+mask, charCodeAt byte-indexed load,
ThunkGenerators decodeString) works unchanged. New IsoSubspace
bigInlineStringSpace. inlineLengthMask widened to 4 bits.

Creation hooked in jsString(VM&, StringView), jsSubstringOfResolved, and the
2/3-arg jsString concat. DFG/FTL MakeRope slow-path routing stays at <=7;
the 32->24 saving for 8..15 doesn't cover the call overhead (big-inline
coverage for that range comes from slice/substring).

Inline-vs-inline eq fast path: bail to slowCase when either side's encoded
length >= 8 since the single m_fiber-word compare doesn't see the high
payload.

describe() shows slices of every length 3..15 as inline (null StringImpl*),
16+ as rope. All four tiers pass; WSL/SunSpider neutral.
---
 .../JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  | 13 ++-
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 12 ++-
 Source/JavaScriptCore/heap/Heap.h             | 14 ++++
 Source/JavaScriptCore/runtime/JSString.h      | 80 +++++++++++++++++--
 .../JavaScriptCore/runtime/JSStringInlines.h  | 12 ++-
 .../runtime/OperationsInlines.h               | 34 ++++----
 6 files changed, 134 insertions(+), 31 deletions(-)

diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index e617a52c3a253..3e00d81240bfb 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -7850,9 +7850,14 @@ void SpeculativeJIT::compileStringEquality(
         move(leftTempGPR, lengthGPR);
         andPtr(rightTempGPR, lengthGPR);
         Jump notBothInline = branchTestPtr(Zero, lengthGPR, TrustedImm32(JSString::isInlineInPointer));
+        // Big-inline (length >= 8) has payload beyond m_fiber; a single-word
+        // compare is only sound for the 16-byte variant.
+        move(leftTempGPR, lengthGPR);
+        orPtr(rightTempGPR, lengthGPR);
+        slowCase.append(branchTestPtr(NonZero, lengthGPR,
+            TrustedImm32((JSString::maxInlineLength8 + 1) << JSString::inlineLengthShift)));
         trueCase.append(branchPtr(Equal, leftTempGPR, rightTempGPR));
-        // Both inline, fibers differ. If the is8Bit bits also match the strings
-        // are definitely unequal; only a cross-width pair needs the slow compare.
+        // Both small-inline, fibers differ. Cross-width pair needs the slow compare.
         move(leftTempGPR, lengthGPR);
         xorPtr(rightTempGPR, lengthGPR);
         slowCase.append(branchTestPtr(NonZero, lengthGPR, TrustedImm32(JSRopeString::is8BitInPointer)));
@@ -17854,8 +17859,8 @@ void SpeculativeJIT::compileMakeRope(Node* node)
 #if USE(BUN_JSC_ADDITIONS)
     // Short all-8-bit result: defer to operationMakeRope* so jsString() can emit
     // a 16-byte inline cell instead of the 32-byte rope we've just allocated.
-    // The abandoned rope cell has fiber0==isRopeInPointer with null fiber, which
-    // visitChildren treats as empty.
+    // Limited to <=7: the slow-path call cost outweighs the 32->24 saving for
+    // 8..15, and big-inline coverage comes from the slice/substring hook.
     {
         Jump not8Bit = branchTest32(Zero, scratchGPR);
         slowPath.append(branch32(BelowOrEqual, allocatorGPR, TrustedImm32(JSString::maxInlineLength8)));
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 8c09336a51981..b309cb6f2d211 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -11808,7 +11808,7 @@ IGNORE_CLANG_WARNINGS_END
 
 #if USE(BUN_JSC_ADDITIONS)
         // Short all-8-bit result: defer to operationMakeRope* so jsString() can
-        // emit a 16-byte inline cell.
+        // emit a 16-byte inline cell. Limited to <=7; see DFG compileMakeRope.
         {
             LBasicBlock notShortInline = m_out.newBlock();
             LValue is8Bit = m_out.testNonZero32(flagsAndLength.flags, m_out.constInt32(StringImpl::flagIs8Bit()));
@@ -22310,9 +22310,13 @@ IGNORE_CLANG_WARNINGS_END
                 usually(inlineDispatch), unsure(notBothInline));
 
             m_out.appendTo(inlineDispatch, inlineSameWidth);
-            m_out.branch(
-                m_out.testNonZeroPtr(xored, m_out.constIntPtr(JSRopeString::is8BitInPointer)),
-                rarely(slowCase), usually(inlineSameWidth));
+            // Single-word compare is only sound for 16-byte inline (length <= 7);
+            // big-inline payload extends past m_fiber. Also bail on cross-width.
+            LValue eitherBigOrCrossWidth = m_out.bitOr(
+                m_out.testNonZeroPtr(m_out.bitOr(leftFiber, rightFiber),
+                    m_out.constIntPtr(static_cast<uintptr_t>((JSString::maxInlineLength8 + 1) << JSString::inlineLengthShift))),
+                m_out.testNonZeroPtr(xored, m_out.constIntPtr(JSRopeString::is8BitInPointer)));
+            m_out.branch(eitherBigOrCrossWidth, rarely(slowCase), usually(inlineSameWidth));
 
             m_out.appendTo(inlineSameWidth, notBothInline);
             inlineResult = m_out.anchor(m_out.isZero64(xored));
diff --git a/Source/JavaScriptCore/heap/Heap.h b/Source/JavaScriptCore/heap/Heap.h
index ec349ffe0c17f..d02946b92444d 100644
--- a/Source/JavaScriptCore/heap/Heap.h
+++ b/Source/JavaScriptCore/heap/Heap.h
@@ -89,6 +89,9 @@ class JSCell;
 class JSCellButterfly;
 class JSRopeString;
 class JSString;
+#if USE(BUN_JSC_ADDITIONS)
+class JSBigInlineString;
+#endif
 class JSValue;
 class MachineThreads;
 class MarkStackArray;
@@ -124,6 +127,13 @@ namespace GCClient {
 class Heap;
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+#define BUN_BIG_INLINE_STRING_SUBSPACE(v) \
+    v(bigInlineStringSpace, bigInlineStringHeapCellType, JSBigInlineString)
+#else
+#define BUN_BIG_INLINE_STRING_SUBSPACE(v)
+#endif
+
 #define FOR_EACH_JSC_COMMON_ISO_SUBSPACE(v) \
     v(arraySpace, cellHeapCellType, JSArray) \
     v(calleeSpace, cellHeapCellType, JSCallee) \
@@ -147,6 +157,7 @@ class Heap;
     v(regExpSpace, destructibleCellHeapCellType, RegExp) \
     v(regExpObjectSpace, cellHeapCellType, RegExpObject) \
     v(ropeStringSpace, ropeStringHeapCellType, JSRopeString) \
+    BUN_BIG_INLINE_STRING_SUBSPACE(v) \
     v(scopedArgumentsSpace, cellHeapCellType, ScopedArguments) \
     v(sparseArrayValueMapSpace, destructibleCellHeapCellType, SparseArrayValueMap) \
     v(stringSpace, stringHeapCellType, JSString) \
@@ -1077,6 +1088,9 @@ class Heap {
     IsoHeapCellType nativeStdFunctionHeapCellType;
     IsoInlinedHeapCellType<JSString> stringHeapCellType;
     IsoInlinedHeapCellType<JSRopeString> ropeStringHeapCellType;
+#if USE(BUN_JSC_ADDITIONS)
+    IsoInlinedHeapCellType<JSBigInlineString> bigInlineStringHeapCellType;
+#endif
     IsoHeapCellType weakMapHeapCellType;
     IsoHeapCellType weakSetHeapCellType;
     JSDestructibleObjectHeapCellType destructibleObjectHeapCellType;
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index b5518f9b77f97..7147e4bf6fbc2 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -145,11 +145,15 @@ class JSString : public JSCell {
     static constexpr uintptr_t isInlineInPointer = 0x2;
     static constexpr uintptr_t notStringImplMask = isRopeInPointer | isInlineInPointer;
     static constexpr unsigned inlineLengthShift = 3;
-    // 3-bit mask: an inline fiber can never address more payload bytes than it
-    // holds, regardless of memory corruption in the unused high bits.
-    static constexpr unsigned inlineLengthMask = 0x7;
+    // 4-bit mask covers both the 16-byte JSString inline (len 2..7) and the
+    // 24-byte JSBigInlineString (len 8..15). Payload is always contiguous
+    // starting at &m_fiber+1; the cell size is determined at creation.
+    static constexpr unsigned inlineLengthMask = 0xf;
     static constexpr unsigned maxInlineLength8 = 7;
     static constexpr unsigned maxInlineLength16 = 3;
+    static constexpr unsigned maxBigInlineLength8 = 15;
+    static constexpr unsigned maxBigInlineLength16 = 7;
+    static_assert(maxBigInlineLength8 <= inlineLengthMask);
 #else
     static constexpr uintptr_t notStringImplMask = isRopeInPointer;
 #endif
@@ -190,6 +194,7 @@ class JSString : public JSCell {
     }
 
 #if USE(BUN_JSC_ADDITIONS)
+protected:
     enum InlineTag { CreateInline };
     JSString(VM& vm, InlineTag, uintptr_t encodedFiber)
         : JSCell(CreatingWellDefinedBuiltinCell, vm.stringStructure.get()->id(), defaultTypeInfoBlob())
@@ -418,6 +423,65 @@ class JSString : public JSCell {
     friend JSString* jsAtomString(JSGlobalObject*, VM&, JSString*, JSString*, JSString*);
 };
 
+#if USE(BUN_JSC_ADDITIONS)
+// 24-byte inline string: same encoding as JSString's inline variant, with an
+// extra 8 bytes of contiguous payload so lengths 8..15 (Latin-1) / 4..7
+// (UTF-16) fit without a StringImpl. inlineData8()/inlineData16() and every
+// JIT decoder already index from &m_fiber+1, so they work unchanged.
+class JSBigInlineString final : public JSString {
+    friend class JSString;
+public:
+    using Base = JSString;
+    static constexpr DestructionMode needsDestruction = MayNeedDestruction;
+    static constexpr uint8_t numberOfLowerTierPreciseCells = 0;
+
+    template<typename, SubspaceAccess>
+    static GCClient::IsoSubspace* subspaceFor(VM& vm)
+    {
+        return &vm.bigInlineStringSpace();
+    }
+
+    // After resolveInline() this holds a StringImpl*; reuse JSString::destroy
+    // which already checks notStringImplMask.
+    static void destroy(JSCell* cell) { JSString::destroy(cell); }
+
+    static JSBigInlineString* create8(VM& vm, std::span<const Latin1Character> chars)
+    {
+        ASSERT(chars.size() > maxInlineLength8 && chars.size() <= maxBigInlineLength8);
+        JSBigInlineString* s = new (NotNull, allocateCell<JSBigInlineString>(vm)) JSBigInlineString(vm);
+        uint8_t* bytes = reinterpret_cast<uint8_t*>(&s->m_fiber);
+        bytes[0] = static_cast<uint8_t>(isInlineInPointer | StringImpl::flagIs8Bit()
+            | (chars.size() << inlineLengthShift));
+        memcpy(bytes + 1, chars.data(), chars.size());
+        s->finishCreation(vm);
+        return s;
+    }
+
+    static JSBigInlineString* create16(VM& vm, std::span<const char16_t> chars)
+    {
+        ASSERT(chars.size() > maxInlineLength16 && chars.size() <= maxBigInlineLength16);
+        JSBigInlineString* s = new (NotNull, allocateCell<JSBigInlineString>(vm)) JSBigInlineString(vm);
+        uint8_t* bytes = reinterpret_cast<uint8_t*>(&s->m_fiber);
+        bytes[0] = static_cast<uint8_t>(isInlineInPointer | (chars.size() << inlineLengthShift));
+        bytes[1] = 0;
+        memcpy(bytes + 2, chars.data(), chars.size() * sizeof(char16_t));
+        s->finishCreation(vm);
+        return s;
+    }
+
+private:
+    JSBigInlineString(VM& vm)
+        : JSString(vm, CreateInline, 0)
+        , m_inlinePayloadHigh(0)
+    { }
+
+    DECLARE_DEFAULT_FINISH_CREATION;
+
+    uintptr_t m_inlinePayloadHigh;
+};
+static_assert(sizeof(JSBigInlineString) == 24);
+#endif
+
 // NOTE: This class cannot override JSString's destructor. JSString's destructor is called directly
 // from JSStringSubspace::
 class JSRopeString final : public JSString {
@@ -1150,8 +1214,14 @@ inline JSString* jsString(VM& vm, StringView s)
     if (s.is8Bit()) {
         if (static_cast<unsigned>(size) <= JSString::maxInlineLength8)
             return JSString::createInline8(vm, s.span8());
-    } else if (static_cast<unsigned>(size) <= JSString::maxInlineLength16)
-        return JSString::createInline16(vm, s.span16());
+        if (static_cast<unsigned>(size) <= JSString::maxBigInlineLength8)
+            return JSBigInlineString::create8(vm, s.span8());
+    } else {
+        if (static_cast<unsigned>(size) <= JSString::maxInlineLength16)
+            return JSString::createInline16(vm, s.span16());
+        if (static_cast<unsigned>(size) <= JSString::maxBigInlineLength16)
+            return JSBigInlineString::create16(vm, s.span16());
+    }
 #endif
     auto impl = s.is8Bit() ? StringImpl::create(s.span8()) : StringImpl::create(s.span16());
     return JSString::create(vm, WTF::move(impl));
diff --git a/Source/JavaScriptCore/runtime/JSStringInlines.h b/Source/JavaScriptCore/runtime/JSStringInlines.h
index d89a87dfb7abf..a82864027f346 100644
--- a/Source/JavaScriptCore/runtime/JSStringInlines.h
+++ b/Source/JavaScriptCore/runtime/JSStringInlines.h
@@ -892,12 +892,18 @@ inline JSString* jsSubstringOfResolved(VM& vm, GCDeferralContext* deferralContex
         }
     }
 #if USE(BUN_JSC_ADDITIONS)
-    // Short substrings: 16-byte inline JSString instead of a 32-byte substring rope.
+    // Short substrings: 16/24-byte inline cell instead of a 32-byte substring rope.
     if (base.is8Bit()) {
         if (length <= JSString::maxInlineLength8)
             return JSString::createInline8(vm, base.span8().subspan(offset, length));
-    } else if (length <= JSString::maxInlineLength16)
-        return JSString::createInline16(vm, base.span16().subspan(offset, length));
+        if (length <= JSString::maxBigInlineLength8)
+            return JSBigInlineString::create8(vm, base.span8().subspan(offset, length));
+    } else {
+        if (length <= JSString::maxInlineLength16)
+            return JSString::createInline16(vm, base.span16().subspan(offset, length));
+        if (length <= JSString::maxBigInlineLength16)
+            return JSBigInlineString::create16(vm, base.span16().subspan(offset, length));
+    }
 #endif
     return JSRopeString::createSubstringOfResolved(vm, deferralContext, s, offset, length, base.is8Bit());
 }
diff --git a/Source/JavaScriptCore/runtime/OperationsInlines.h b/Source/JavaScriptCore/runtime/OperationsInlines.h
index ce568bef07243..5596bf59e5371 100644
--- a/Source/JavaScriptCore/runtime/OperationsInlines.h
+++ b/Source/JavaScriptCore/runtime/OperationsInlines.h
@@ -159,27 +159,29 @@ ALWAYS_INLINE JSString* jsString(JSGlobalObject* globalObject, JSString* s1, JSS
     }
 
 #if USE(BUN_JSC_ADDITIONS)
-    // Short concats: write both sides into a 16-byte inline cell instead of a
+    // Short concats: write both sides into a 16/24-byte inline cell instead of a
     // 32-byte rope that would need resolving later. Only when both sides'
     // characters are available without allocation (non-rope).
     unsigned total = length1 + length2;
-    if (total <= JSString::maxInlineLength8 && !s1->isRope() && !s2->isRope()) {
+    if (total <= JSString::maxBigInlineLength8 && !s1->isRope() && !s2->isRope()) {
         auto view1 = s1->view(globalObject);
         auto view2 = s2->view(globalObject);
         if (view1->is8Bit() && view2->is8Bit()) {
-            Latin1Character buf[JSString::maxInlineLength8];
+            Latin1Character buf[JSString::maxBigInlineLength8];
             memcpy(buf, view1->span8().data(), length1);
             memcpy(buf + length1, view2->span8().data(), length2);
-            return JSString::createInline8(vm, std::span { buf, total });
+            if (total <= JSString::maxInlineLength8)
+                return JSString::createInline8(vm, std::span { buf, total });
+            return JSBigInlineString::create8(vm, std::span { buf, total });
+        }
+        if (total <= JSString::maxBigInlineLength16) {
+            char16_t buf16[JSString::maxBigInlineLength16];
+            view1->getCharacters(std::span { buf16, length1 });
+            view2->getCharacters(std::span { buf16 + length1, length2 });
+            if (total <= JSString::maxInlineLength16)
+                return JSString::createInline16(vm, std::span { buf16, total });
+            return JSBigInlineString::create16(vm, std::span { buf16, total });
         }
-    }
-    if (total <= JSString::maxInlineLength16 && !s1->isRope() && !s2->isRope()) {
-        auto view1 = s1->view(globalObject);
-        auto view2 = s2->view(globalObject);
-        char16_t buf[JSString::maxInlineLength16];
-        view1->getCharacters(std::span { buf, length1 });
-        view2->getCharacters(std::span { buf + length1, length2 });
-        return JSString::createInline16(vm, std::span { buf, total });
     }
 #endif
 
@@ -211,16 +213,18 @@ ALWAYS_INLINE JSString* jsString(JSGlobalObject* globalObject, JSString* s1, JSS
 
 #if USE(BUN_JSC_ADDITIONS)
     unsigned total = length1 + length2 + length3;
-    if (total <= JSString::maxInlineLength8 && !s1->isRope() && !s2->isRope() && !s3->isRope()) {
+    if (total <= JSString::maxBigInlineLength8 && !s1->isRope() && !s2->isRope() && !s3->isRope()) {
         auto v1 = s1->view(globalObject);
         auto v2 = s2->view(globalObject);
         auto v3 = s3->view(globalObject);
         if (v1->is8Bit() && v2->is8Bit() && v3->is8Bit()) {
-            Latin1Character buf[JSString::maxInlineLength8];
+            Latin1Character buf[JSString::maxBigInlineLength8];
             memcpy(buf, v1->span8().data(), length1);
             memcpy(buf + length1, v2->span8().data(), length2);
             memcpy(buf + length1 + length2, v3->span8().data(), length3);
-            return JSString::createInline8(vm, std::span { buf, total });
+            if (total <= JSString::maxInlineLength8)
+                return JSString::createInline8(vm, std::span { buf, total });
+            return JSBigInlineString::create8(vm, std::span { buf, total });
         }
     }
 #endif

From 2d2ffd6e419b1f2b81f0352dc9488968d1925d2a Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 10:02:10 +0000
Subject: [PATCH 17/69] JSStringBuilder: stack-buffered builder emitting inline
 JSString cells

Wraps WTF::StringBuilder with a 15-byte Latin-1 stack buffer. Short
all-Latin-1 results never touch malloc: toJS() emits a JSString/
JSBigInlineString cell directly from the stack bytes. Results that
exceed the inline buffer or contain non-Latin-1 spill to the wrapped
StringBuilder and take the existing toString() path.

Swapped into encodeURI/encodeURIComponent, decodeURI/decodeURIComponent,
escape, unescape, and String.fromCodePoint.

2M-iter microbench vs no-JSStringBuilder baseline (same inline-string
patches otherwise):

  encodeURIComponent("key")          132ms -> 56ms  (-58%)
  encodeURIComponent("a b")          225ms -> 68ms  (-70%)
  encodeURIComponent 12-char ascii    203ms -> 99ms  (-51%)
  encodeURIComponent 42-char (spill)  554ms -> 523ms (-6%)
  decodeURIComponent("abc")          177ms -> 75ms  (-58%)
  decodeURIComponent("a%20b")        143ms -> 55ms  (-61%)
  String.fromCodePoint(97,98,99)      133ms -> 61ms  (-54%)
  escape("foo")                      144ms -> 51ms  (-64%)
  unescape("a%20b")                  130ms -> 55ms  (-58%)

Also tag inline strings as (inline) in JSValue::dump so describe()
distinguishes them from unresolved ropes.
---
 Source/JavaScriptCore/CMakeLists.txt          |   1 +
 Source/JavaScriptCore/runtime/JSCJSValue.cpp  |   4 +
 .../runtime/JSGlobalObjectFunctions.cpp       |  35 +++
 .../JavaScriptCore/runtime/JSStringBuilder.h  | 200 ++++++++++++++++++
 .../runtime/StringConstructor.cpp             |  11 +
 5 files changed, 251 insertions(+)
 create mode 100644 Source/JavaScriptCore/runtime/JSStringBuilder.h

diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 77ab7851ef7d9..50b21e9efe294 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -1525,6 +1525,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
     runtime/JSSourceCode.h
     runtime/JSSourceCodeInlines.h
     runtime/JSString.h
+    runtime/JSStringBuilder.h
     runtime/JSStringInlines.h
     runtime/JSStringIterator.h
     runtime/JSStringIteratorInlines.h
diff --git a/Source/JavaScriptCore/runtime/JSCJSValue.cpp b/Source/JavaScriptCore/runtime/JSCJSValue.cpp
index ee8dea1b312e3..352390f4b4d87 100644
--- a/Source/JavaScriptCore/runtime/JSCJSValue.cpp
+++ b/Source/JavaScriptCore/runtime/JSCJSValue.cpp
@@ -292,6 +292,10 @@ void JSValue::dumpInContextAssumingStructure(
             out.print("String");
             if (string->isRope())
                 out.print(" (rope)");
+#if USE(BUN_JSC_ADDITIONS)
+            if (string->isInline())
+                out.print(" (inline)");
+#endif
             const StringImpl* impl = string->tryGetValueImpl();
             if (impl) {
                 if (impl->isAtom())
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index 01b215d55d0e0..3be229a87c20e 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -41,6 +41,9 @@
 #include "ObjectConstructorInlines.h"
 #include "ParseInt.h"
 #include "SourceProfiler.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "JSStringBuilder.h"
+#endif
 #include <stdio.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
@@ -68,7 +71,11 @@ static JSValue encode(JSGlobalObject* globalObject, const WTF::BitSet<256>& doNo
         return JSC::throwException(globalObject, scope, createURIError(globalObject, "String contained an illegal UTF-16 sequence."_s));
     };
 
+#if USE(BUN_JSC_ADDITIONS)
+    JSStringBuilder builder(OverflowPolicy::RecordOverflow);
+#else
     StringBuilder builder(OverflowPolicy::RecordOverflow);
+#endif
     builder.reserveCapacity(characters.size());
 
     // 4. Repeat
@@ -134,7 +141,11 @@ static JSValue encode(JSGlobalObject* globalObject, const WTF::BitSet<256>& doNo
 
     if (builder.hasOverflowed()) [[unlikely]]
         return throwOutOfMemoryError(globalObject, scope);
+#if USE(BUN_JSC_ADDITIONS)
+    return builder.toJS(vm);
+#else
     return jsString(vm, builder.toString());
+#endif
 }
 
 static JSValue encode(JSGlobalObject* globalObject, JSValue argument, const WTF::BitSet<256>& doNotEscape)
@@ -153,7 +164,11 @@ static JSValue decode(JSGlobalObject* globalObject, std::span<const CharType> ch
     VM& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
 
+#if USE(BUN_JSC_ADDITIONS)
+    JSStringBuilder builder(OverflowPolicy::RecordOverflow);
+#else
     StringBuilder builder(OverflowPolicy::RecordOverflow);
+#endif
     size_t k = 0;
     char16_t u = 0;
     while (k < characters.size()) {
@@ -218,7 +233,11 @@ static JSValue decode(JSGlobalObject* globalObject, std::span<const CharType> ch
     }
     if (builder.hasOverflowed()) [[unlikely]]
         return throwOutOfMemoryError(globalObject, scope);
+#if USE(BUN_JSC_ADDITIONS)
+    RELEASE_AND_RETURN(scope, builder.toJS(vm));
+#else
     RELEASE_AND_RETURN(scope, jsString(vm, builder.toString()));
+#endif
 }
 
 static JSValue decode(JSGlobalObject* globalObject, JSValue argument, const WTF::BitSet<256>& doNotUnescape, bool strict)
@@ -614,7 +633,11 @@ JSC_DEFINE_HOST_FUNCTION(globalFuncEscape, (JSGlobalObject* globalObject, CallFr
         VM& vm = globalObject->vm();
         auto scope = DECLARE_THROW_SCOPE(vm);
 
+#if USE(BUN_JSC_ADDITIONS)
+        JSStringBuilder builder(OverflowPolicy::RecordOverflow);
+#else
         StringBuilder builder(OverflowPolicy::RecordOverflow);
+#endif
         if (view.is8Bit()) {
             for (auto character : view.span8()) {
                 if (doNotEscape.get(character))
@@ -637,7 +660,11 @@ JSC_DEFINE_HOST_FUNCTION(globalFuncEscape, (JSGlobalObject* globalObject, CallFr
             throwOutOfMemoryError(globalObject, scope);
             return { };
         }
+#if USE(BUN_JSC_ADDITIONS)
+        return builder.toJS(vm);
+#else
         return jsString(vm, builder.toString());
+#endif
     }));
 }
 
@@ -652,7 +679,11 @@ JSC_DEFINE_HOST_FUNCTION(globalFuncUnescape, (JSGlobalObject* globalObject, Call
         VM& vm = globalObject->vm();
         auto scope = DECLARE_THROW_SCOPE(vm);
 
+#if USE(BUN_JSC_ADDITIONS)
+        JSStringBuilder builder(OverflowPolicy::RecordOverflow);
+#else
         StringBuilder builder(OverflowPolicy::RecordOverflow);
+#endif
         builder.reserveCapacity(length);
 
         if (view.is8Bit()) {
@@ -700,7 +731,11 @@ JSC_DEFINE_HOST_FUNCTION(globalFuncUnescape, (JSGlobalObject* globalObject, Call
             throwOutOfMemoryError(globalObject, scope);
             return { };
         }
+#if USE(BUN_JSC_ADDITIONS)
+        return builder.toJS(vm);
+#else
         return jsString(vm, builder.toString());
+#endif
     }));
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSStringBuilder.h b/Source/JavaScriptCore/runtime/JSStringBuilder.h
new file mode 100644
index 0000000000000..42159f7454c98
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSStringBuilder.h
@@ -0,0 +1,200 @@
+/*
+ *  Copyright (C) 2024 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#if USE(BUN_JSC_ADDITIONS)
+
+#include "JSString.h"
+#include <wtf/ForbidHeapAllocation.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/StringConcatenate.h>
+
+namespace JSC {
+
+// A StringBuilder drop-in for sites that end with jsString(vm, builder.toString()).
+// Short all-Latin-1 results (≤ maxBigInlineLength8) accumulate in a stack buffer
+// and emit an inline JSString cell directly from toJS(), touching no malloc.
+class JSStringBuilder {
+    WTF_MAKE_NONCOPYABLE(JSStringBuilder);
+    WTF_FORBID_HEAP_ALLOCATION;
+
+public:
+    static constexpr unsigned inlineCapacity = JSString::maxBigInlineLength8;
+
+    JSStringBuilder() = default;
+    explicit JSStringBuilder(OverflowPolicy policy)
+        : m_builder(policy)
+    {
+    }
+
+    ALWAYS_INLINE void append(Latin1Character c)
+    {
+        if (m_spilled) {
+            m_builder.append(c);
+            return;
+        }
+        if (m_inlineLength < inlineCapacity) [[likely]] {
+            m_inline[m_inlineLength++] = c;
+            return;
+        }
+        spill();
+        m_builder.append(c);
+    }
+
+    ALWAYS_INLINE void append(char c) { append(byteCast<Latin1Character>(c)); }
+
+    ALWAYS_INLINE void append(char16_t c)
+    {
+        if (m_spilled) {
+            m_builder.append(c);
+            return;
+        }
+        if (isLatin1(c)) {
+            append(static_cast<Latin1Character>(c));
+            return;
+        }
+        spill();
+        m_builder.append(c);
+    }
+
+    void append(std::span<const Latin1Character> chars)
+    {
+        if (m_spilled) {
+            m_builder.append(chars);
+            return;
+        }
+        if (m_inlineLength + chars.size() <= inlineCapacity) {
+            if (!chars.empty())
+                memcpy(m_inline + m_inlineLength, chars.data(), chars.size());
+            m_inlineLength += chars.size();
+            return;
+        }
+        spill();
+        m_builder.append(chars);
+    }
+
+    void append(std::span<const char16_t> chars)
+    {
+        if (!m_spilled)
+            spill();
+        m_builder.append(chars);
+    }
+
+    ALWAYS_INLINE void append(StringView s)
+    {
+        if (s.is8Bit())
+            append(s.span8());
+        else
+            append(s.span16());
+    }
+
+    ALWAYS_INLINE void append(const String& s) { append(StringView { s }); }
+    ALWAYS_INLINE void append(const StringBuilder& other) { append(StringView { other }); }
+    ALWAYS_INLINE void append(ASCIILiteral s) { append(s.span8()); }
+
+    // Variadic: hex(), numbers, makeString()-style args.
+    template<WTF::StringTypeAdaptable... StringTypes>
+    void append(const StringTypes&... strings)
+    {
+        appendFromAdapters(WTF::StringTypeAdapter<StringTypes>(strings)...);
+    }
+
+    void reserveCapacity(unsigned capacity)
+    {
+        if (capacity <= inlineCapacity)
+            return;
+        if (!m_spilled)
+            spill();
+        m_builder.reserveCapacity(capacity);
+    }
+
+    bool hasOverflowed() const { return m_spilled && m_builder.hasOverflowed(); }
+    bool isEmpty() const { return !length(); }
+    unsigned length() const { return m_spilled ? m_builder.length() : m_inlineLength; }
+    bool is8Bit() const { return !m_spilled || m_builder.is8Bit(); }
+
+    JSString* toJS(VM& vm)
+    {
+        if (!m_spilled) {
+            if (!m_inlineLength)
+                return vm.smallStrings.emptyString();
+            if (m_inlineLength == 1)
+                return vm.smallStrings.singleCharacterString(m_inline[0]);
+            if (m_inlineLength <= JSString::maxInlineLength8)
+                return JSString::createInline8(vm, { m_inline, m_inlineLength });
+            return JSBigInlineString::create8(vm, { m_inline, m_inlineLength });
+        }
+        // Spilled: still check for inline-eligible short results (e.g. a char16_t
+        // forced spill). Long results reuse the builder's StringImpl via toString().
+        unsigned len = m_builder.length();
+        if (len <= JSString::maxBigInlineLength8 && (m_builder.is8Bit() || len <= JSString::maxBigInlineLength16))
+            return jsString(vm, StringView { m_builder });
+        return jsString(vm, m_builder.toString());
+    }
+
+    // Escape hatch for callers that also need the WTF::String.
+    String toString()
+    {
+        if (!m_spilled)
+            spill();
+        return m_builder.toString();
+    }
+
+private:
+    template<typename... Adapters>
+    ALWAYS_INLINE void appendFromAdapters(const Adapters&... adapters)
+    {
+        if (m_spilled) {
+            m_builder.appendFromAdapters(adapters...);
+            return;
+        }
+        if constexpr (!(... || WTF::stringBuilderSlowPathRequiredForAdapter<Adapters>)) {
+            if (WTF::are8Bit(adapters...)) {
+                auto required = WTF::saturatingSum<uint32_t>(static_cast<uint32_t>(m_inlineLength), adapters.length()...);
+                if (required <= inlineCapacity) {
+                    std::span<Latin1Character> dest { m_inline + m_inlineLength, static_cast<size_t>(required - m_inlineLength) };
+                    WTF::stringTypeAdapterAccumulator(dest, adapters...);
+                    m_inlineLength = static_cast<uint8_t>(required);
+                    return;
+                }
+            }
+        }
+        spill();
+        m_builder.appendFromAdapters(adapters...);
+    }
+
+    ALWAYS_INLINE void spill()
+    {
+        ASSERT(!m_spilled);
+        m_spilled = true;
+        if (m_inlineLength)
+            m_builder.append(std::span<const Latin1Character> { m_inline, m_inlineLength });
+    }
+
+    StringBuilder m_builder;
+    Latin1Character m_inline[inlineCapacity];
+    uint8_t m_inlineLength { 0 };
+    bool m_spilled { false };
+};
+
+} // namespace JSC
+
+#endif // USE(BUN_JSC_ADDITIONS)
diff --git a/Source/JavaScriptCore/runtime/StringConstructor.cpp b/Source/JavaScriptCore/runtime/StringConstructor.cpp
index ebfe1a10c92cb..e50510142b682 100644
--- a/Source/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/StringConstructor.cpp
@@ -24,6 +24,9 @@
 #include "JSCInlines.h"
 #include "StringPrototype.h"
 #include <wtf/text/StringBuilder.h>
+#if USE(BUN_JSC_ADDITIONS)
+#include "JSStringBuilder.h"
+#endif
 
 namespace JSC {
 
@@ -120,7 +123,11 @@ JSC_DEFINE_HOST_FUNCTION(stringFromCodePoint, (JSGlobalObject* globalObject, Cal
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     unsigned length = callFrame->argumentCount();
+#if USE(BUN_JSC_ADDITIONS)
+    JSStringBuilder builder;
+#else
     StringBuilder builder;
+#endif
     builder.reserveCapacity(length);
 
     for (unsigned i = 0; i < length; ++i) {
@@ -140,7 +147,11 @@ JSC_DEFINE_HOST_FUNCTION(stringFromCodePoint, (JSGlobalObject* globalObject, Cal
         }
     }
 
+#if USE(BUN_JSC_ADDITIONS)
+    RELEASE_AND_RETURN(scope, JSValue::encode(builder.toJS(vm)));
+#else
     RELEASE_AND_RETURN(scope, JSValue::encode(jsString(vm, builder.toString())));
+#endif
 }
 
 JSString* stringFromCodePoint(JSGlobalObject* globalObject, int32_t arg)

From 24def3393c7c733595804c5e18b58b05ec7af4dc Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 10:57:12 +0000
Subject: [PATCH 18/69] Inline small strings: eliminate materialization
 hotspots + 32-byte big-inline + fiber-word cache

RAMification found inline strings being resolved to StringImpl far more
than they should, via paths that only need a StringView:

- jsSubstringOfResolved(inline) called resolveInline() before reading
  bytes; now copies directly from the inline payload into a fresh
  inline cell.
- stringProtoFuncCodePointAt called toWTFString(); added an inline fast
  path that reads the code unit(s) from the cell bytes.
- DFG/FTL StringCodePointAt on a monomorphic-inline profile now skips
  the ResolveRope insertion and decodes from the cell (mirrors the
  existing StringCharCodeAt handling).
- toIdentifier/toAtomString/toExistingAtomString now resolve an inline
  string directly to the AtomStringImpl (resolveInlineToAtomString),
  skipping the intermediate non-atom StringImpl that was being parked
  in the heap's possibly-accessed-strings vector.
- jsMapHashImpl hashes inline bytes directly instead of resolving.
- JSStringJoiner resolves inline elements via resolveInlineToAtomString
  so repeated short contents share a single AtomStringImpl.

InlineStringCache: a 512-slot direct-mapped JSString* cache on VM,
keyed by the inline-encoding fiber word. createInline8/16 consult it
first; repeated short content returns the same cell. Cleared alongside
KeyAtomStringCache in Heap::finalize.

JSBigInlineString grows to 32 bytes (same cell size as JSRopeString):
maxBigInlineLength8 15->23, maxBigInlineLength16 7->11,
inlineLengthMask 0xf->0x1f. The DFG/FTL inline-equality word compare
now picks its length bail mask by width (the 8->16 bump exposed the
previous mask being Latin-1-only).

RAMification (peak footprint, 3 runs): UniPoker +28% -> ~0%,
string-unpack-code-SP +10% -> -2%. Parsers (babylon-wtb, typescript,
espree, WSL) -4% to -11%.
---
 Source/JavaScriptCore/CMakeLists.txt          |  1 +
 Source/JavaScriptCore/dfg/DFGFixupPhase.cpp   |  8 +-
 .../JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  | 52 +++++++++++-
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 61 +++++++++++++-
 Source/JavaScriptCore/heap/Heap.cpp           |  3 +
 Source/JavaScriptCore/runtime/HashMapHelper.h |  9 ++
 .../runtime/InlineStringCache.h               | 81 ++++++++++++++++++
 Source/JavaScriptCore/runtime/JSString.cpp    | 33 ++++++++
 Source/JavaScriptCore/runtime/JSString.h      | 82 ++++++++++++++-----
 .../JavaScriptCore/runtime/JSStringInlines.h  | 21 ++++-
 .../JavaScriptCore/runtime/JSStringJoiner.h   | 16 ++--
 .../runtime/StringPrototype.cpp               | 30 +++++++
 Source/JavaScriptCore/runtime/VM.h            |  6 ++
 13 files changed, 361 insertions(+), 42 deletions(-)
 create mode 100644 Source/JavaScriptCore/runtime/InlineStringCache.h

diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 50b21e9efe294..56f6be630da88 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -1330,6 +1330,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
     runtime/InferredValueInlines.h
     runtime/InitializeThreading.h
     runtime/InlineAttribute.h
+    runtime/InlineStringCache.h
     runtime/Int16Array.h
     runtime/Int32Array.h
     runtime/Int8Array.h
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 4e39f78ea7c37..7890d11c3fef7 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -1141,12 +1141,12 @@ class FixupPhase : public Phase {
             else
                 ASSERT(node->arrayMode() == ArrayMode(Array::String, Array::Read));
 #if USE(BUN_JSC_ADDITIONS)
-            // For StringCharCodeAt on a monomorphic-inline profile, skip the
-            // ResolveRope insertion so compileGetCharCodeAt can read the code
-            // unit straight from the cell without materializing a StringImpl.
+            // For StringCharCodeAt/StringCodePointAt on a monomorphic-inline
+            // profile, skip the ResolveRope insertion so the compile functions
+            // read from the cell bytes directly without a StringImpl.
             {
                 SpeculatedType pred = node->child1()->prediction() & SpecString;
-                if (op == StringCharCodeAt && pred && !(pred & ~SpecStringInline)) {
+                if ((op == StringCharCodeAt || op == StringCodePointAt) && pred && !(pred & ~SpecStringInline)) {
                     fixEdge<StringUse>(node->child1());
                     fixEdge<Int32Use>(node->child2());
                     break;
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 3e00d81240bfb..3b7222af06622 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -2031,6 +2031,42 @@ void SpeculativeJIT::compileStringCodePointAt(Node* node)
     GPRReg scratch4GPR = scratch4.gpr();
 
     loadPtr(Address(stringGPR, JSString::offsetOfValue()), scratch1GPR);
+
+#if USE(BUN_JSC_ADDITIONS)
+    // Same condition FixupPhase used to skip ResolveRope for this node.
+    SpeculatedType inlinePred = node->child1()->prediction() & SpecString;
+    if (inlinePred && !(inlinePred & ~SpecStringInline)) {
+        and32(TrustedImm32(JSString::notStringImplMask), scratch1GPR, scratch2GPR);
+        speculationCheck(BadType, JSValueSource::unboxedCell(stringGPR), node->child1(),
+            branch32(NotEqual, scratch2GPR, TrustedImm32(JSString::isInlineInPointer)));
+        // scratch2 = length, scratch4 = &payload
+        move(scratch1GPR, scratch2GPR);
+        urshiftPtr(TrustedImm32(JSString::inlineLengthShift), scratch2GPR);
+        and32(TrustedImm32(JSString::inlineLengthMask), scratch2GPR);
+        speculationCheck(Uncountable, JSValueRegs(), nullptr, branch32(AboveOrEqual, indexGPR, scratch2GPR));
+        Jump is16 = branchTestPtr(Zero, scratch1GPR, TrustedImm32(JSRopeString::is8BitInPointer));
+        // 8-bit: no surrogate handling.
+        load8(BaseIndex(stringGPR, indexGPR, TimesOne, JSString::offsetOfValue() + 1), scratch1GPR);
+        Jump done = jump();
+        is16.link(this);
+        addPtr(TrustedImm32(JSString::offsetOfValue() + 2), stringGPR, scratch4GPR);
+        load16(BaseIndex(scratch4GPR, indexGPR, TimesTwo, 0), scratch1GPR);
+        add32(TrustedImm32(1), indexGPR, scratch3GPR);
+        JumpList doneList;
+        doneList.append(branch32(AboveOrEqual, scratch3GPR, scratch2GPR));
+        and32(TrustedImm32(0xfffffc00), scratch1GPR, scratch2GPR);
+        doneList.append(branch32(NotEqual, scratch2GPR, TrustedImm32(0xd800)));
+        load16(BaseIndex(scratch4GPR, scratch3GPR, TimesTwo, 0), scratch3GPR);
+        and32(TrustedImm32(0xfffffc00), scratch3GPR, scratch2GPR);
+        doneList.append(branch32(NotEqual, scratch2GPR, TrustedImm32(0xdc00)));
+        lshift32(TrustedImm32(10), scratch1GPR);
+        getEffectiveAddress(BaseIndex(scratch1GPR, scratch3GPR, TimesOne, -U16_SURROGATE_OFFSET), scratch1GPR);
+        doneList.link(this);
+        done.link(this);
+        strictInt32Result(scratch1GPR, m_currentNode);
+        return;
+    }
+#endif
     if (auto stringLength = tryGetConstantStringLength(node->child1()))
         move(TrustedImm32(*stringLength), scratch2GPR);
     else
@@ -7850,12 +7886,22 @@ void SpeculativeJIT::compileStringEquality(
         move(leftTempGPR, lengthGPR);
         andPtr(rightTempGPR, lengthGPR);
         Jump notBothInline = branchTestPtr(Zero, lengthGPR, TrustedImm32(JSString::isInlineInPointer));
-        // Big-inline (length >= 8) has payload beyond m_fiber; a single-word
-        // compare is only sound for the 16-byte variant.
+        // A single-word compare is only sound for 16-byte inline: len <= 7
+        // Latin-1 or len <= 3 UTF-16. lengthGPR still holds AND(left, right);
+        // is8Bit is set here iff both sides are 8-bit.
+        Jump both8Bit = branchTestPtr(NonZero, lengthGPR, TrustedImm32(JSRopeString::is8BitInPointer));
+        // At least one 16-bit: bail if either length >= 4.
+        move(leftTempGPR, lengthGPR);
+        orPtr(rightTempGPR, lengthGPR);
+        slowCase.append(branchTestPtr(NonZero, lengthGPR,
+            TrustedImm32((JSString::inlineLengthMask & ~JSString::maxInlineLength16) << JSString::inlineLengthShift)));
+        Jump widthChecked = jump();
+        both8Bit.link(this);
         move(leftTempGPR, lengthGPR);
         orPtr(rightTempGPR, lengthGPR);
         slowCase.append(branchTestPtr(NonZero, lengthGPR,
-            TrustedImm32((JSString::maxInlineLength8 + 1) << JSString::inlineLengthShift)));
+            TrustedImm32((JSString::inlineLengthMask & ~JSString::maxInlineLength8) << JSString::inlineLengthShift)));
+        widthChecked.link(this);
         trueCase.append(branchPtr(Equal, leftTempGPR, rightTempGPR));
         // Both small-inline, fibers differ. Cross-width pair needs the slow compare.
         move(leftTempGPR, lengthGPR);
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index b309cb6f2d211..e14426a11ee80 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -12214,6 +12214,53 @@ IGNORE_CLANG_WARNINGS_END
         LValue index = lowInt32(m_node->child2());
 
         LValue stringImpl = m_out.loadPtr(base, m_heaps.JSString_value);
+
+#if USE(BUN_JSC_ADDITIONS)
+        // Match the FixupPhase condition that skipped ResolveRope.
+        SpeculatedType pred = m_node->child1()->prediction() & SpecString;
+        if (pred && !(pred & ~SpecStringInline)) {
+            speculate(BadType, jsValueValue(base), m_node->child1().node(),
+                m_out.notEqual(
+                    m_out.bitAnd(stringImpl, m_out.constIntPtr(JSString::notStringImplMask)),
+                    m_out.constIntPtr(JSString::isInlineInPointer)));
+            LValue inlineLen = m_out.bitAnd(
+                m_out.castToInt32(m_out.lShr(stringImpl, m_out.constInt32(JSString::inlineLengthShift))),
+                m_out.constInt32(JSString::inlineLengthMask));
+            speculate(Uncountable, noValue(), nullptr, m_out.aboveOrEqual(index, inlineLen));
+            LValue data16 = m_out.add(base, m_out.constIntPtr(JSString::offsetOfValue() + 2));
+            m_out.branch(
+                m_out.testNonZeroPtr(stringImpl, m_out.constIntPtr(JSRopeString::is8BitInPointer)),
+                unsure(is8Bit), unsure(is16Bit));
+
+            LBasicBlock lastNextI = m_out.appendTo(is8Bit, is16Bit);
+            ValueFromBlock c8 = m_out.anchor(m_out.load8ZeroExt32(
+                m_out.baseIndex(m_heaps.characters8, base, m_out.zeroExtPtr(index), provenValue(m_node->child2()), JSString::offsetOfValue() + 1)));
+            m_out.jump(continuation);
+
+            m_out.appendTo(is16Bit, isLeadSurrogate);
+            LValue lead = m_out.load16ZeroExt32(m_out.baseIndex(m_heaps.characters16, data16, m_out.zeroExtPtr(index), provenValue(m_node->child2())));
+            ValueFromBlock c16 = m_out.anchor(lead);
+            LValue nextIndex = m_out.add(index, m_out.int32One);
+            m_out.branch(m_out.aboveOrEqual(nextIndex, inlineLen), unsure(continuation), unsure(isLeadSurrogate));
+
+            m_out.appendTo(isLeadSurrogate, mayHaveTrailSurrogate);
+            m_out.branch(m_out.notEqual(m_out.bitAnd(lead, m_out.constInt32(0xfffffc00)), m_out.constInt32(0xd800)), unsure(continuation), unsure(mayHaveTrailSurrogate));
+
+            m_out.appendTo(mayHaveTrailSurrogate, hasTrailSurrogate);
+            LValue trail = m_out.load16ZeroExt32(m_out.baseIndex(m_heaps.characters16, data16, m_out.zeroExtPtr(nextIndex)));
+            m_out.branch(m_out.notEqual(m_out.bitAnd(trail, m_out.constInt32(0xfffffc00)), m_out.constInt32(0xdc00)), unsure(continuation), unsure(hasTrailSurrogate));
+
+            m_out.appendTo(hasTrailSurrogate, continuation);
+            ValueFromBlock cSurr = m_out.anchor(m_out.sub(m_out.add(m_out.shl(lead, m_out.constInt32(10)), trail), m_out.constInt32(U16_SURROGATE_OFFSET)));
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNextI);
+            ensureStillAliveHere(base);
+            setInt32(m_out.phi(Int32, c8, c16, cSurr));
+            return;
+        }
+#endif
+
         LValue length;
         if (auto stringLength = tryGetConstantStringLength(m_node->child1()))
             length = m_out.constInt32(*stringLength);
@@ -22310,11 +22357,17 @@ IGNORE_CLANG_WARNINGS_END
                 usually(inlineDispatch), unsure(notBothInline));
 
             m_out.appendTo(inlineDispatch, inlineSameWidth);
-            // Single-word compare is only sound for 16-byte inline (length <= 7);
-            // big-inline payload extends past m_fiber. Also bail on cross-width.
+            // Single-word compare is only sound for 16-byte inline: len <= 7
+            // Latin-1 or len <= 3 UTF-16. Pick the length mask by the AND'd
+            // is8Bit bit (set iff both sides are 8-bit). Also bail on cross-width.
+            LValue ored = m_out.bitOr(leftFiber, rightFiber);
+            LValue anded = m_out.bitAnd(leftFiber, rightFiber);
+            LValue both8Bit = m_out.testNonZeroPtr(anded, m_out.constIntPtr(JSRopeString::is8BitInPointer));
+            LValue bigMask = m_out.select(both8Bit,
+                m_out.constIntPtr(static_cast<uintptr_t>((JSString::inlineLengthMask & ~JSString::maxInlineLength8) << JSString::inlineLengthShift)),
+                m_out.constIntPtr(static_cast<uintptr_t>((JSString::inlineLengthMask & ~JSString::maxInlineLength16) << JSString::inlineLengthShift)));
             LValue eitherBigOrCrossWidth = m_out.bitOr(
-                m_out.testNonZeroPtr(m_out.bitOr(leftFiber, rightFiber),
-                    m_out.constIntPtr(static_cast<uintptr_t>((JSString::maxInlineLength8 + 1) << JSString::inlineLengthShift))),
+                m_out.testNonZeroPtr(ored, bigMask),
                 m_out.testNonZeroPtr(xored, m_out.constIntPtr(JSRopeString::is8BitInPointer)));
             m_out.branch(eitherBigOrCrossWidth, rarely(slowCase), usually(inlineSameWidth));
 
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index 10905dfe305c7..f93739169d122 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -2349,6 +2349,9 @@ void Heap::finalize()
         vm().stringReplaceCache.clear();
     }
     vm().keyAtomStringCache.clear();
+#if USE(BUN_JSC_ADDITIONS)
+    vm().inlineStringCache.clear();
+#endif
     vm().stringSplitCache.clear();
     vm().jsonAtomStringCache.clearJSStrings();
 
diff --git a/Source/JavaScriptCore/runtime/HashMapHelper.h b/Source/JavaScriptCore/runtime/HashMapHelper.h
index 7c007167b20d5..0eec16a090d82 100644
--- a/Source/JavaScriptCore/runtime/HashMapHelper.h
+++ b/Source/JavaScriptCore/runtime/HashMapHelper.h
@@ -90,6 +90,15 @@ ALWAYS_INLINE uint32_t jsMapHashImpl(JSGlobalObject* globalObject, VM& vm, JSVal
 
     if (value.isString()) {
         auto scope = DECLARE_THROW_SCOPE(vm);
+#if USE(BUN_JSC_ADDITIONS)
+        // Hash inline bytes directly; resolving would allocate a StringImpl.
+        if (JSString* str = asString(value); str->isInline()) {
+            unsigned len = str->length();
+            if (str->is8Bit())
+                return StringHasher::computeHashAndMaskTop8Bits(std::span { str->inlineData8(), len });
+            return StringHasher::computeHashAndMaskTop8Bits(std::span { str->inlineData16(), len });
+        }
+#endif
         auto wtfString = asString(value)->value(globalObject);
         if constexpr (expection == ExceptionExpectation::CanThrow)
             RETURN_IF_EXCEPTION(scope, UINT_MAX);
diff --git a/Source/JavaScriptCore/runtime/InlineStringCache.h b/Source/JavaScriptCore/runtime/InlineStringCache.h
new file mode 100644
index 0000000000000..0d560ac9027cc
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/InlineStringCache.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2024 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if USE(BUN_JSC_ADDITIONS)
+
+#include <array>
+#include <cstdint>
+
+namespace JSC {
+
+class JSString;
+
+// Direct-mapped JSString* cache keyed by the inline-encoding fiber word.
+// The fiber word is content-unique for 16-byte inline strings (lengths 2..7
+// Latin-1 / 1..3 UTF-16), so a single word compare is the full equality test.
+// Weak: cleared at every GC finalize alongside KeyAtomStringCache.
+class InlineStringCache {
+public:
+    static constexpr unsigned capacity = 512;
+
+    ALWAYS_INLINE JSString* lookup(uintptr_t fiber) const
+    {
+        unsigned index = indexFor(fiber);
+        if (m_keys[index] == fiber)
+            return m_values[index];
+        return nullptr;
+    }
+
+    ALWAYS_INLINE void insert(uintptr_t fiber, JSString* string)
+    {
+        unsigned index = indexFor(fiber);
+        m_keys[index] = fiber;
+        m_values[index] = string;
+    }
+
+    ALWAYS_INLINE void clear()
+    {
+        m_keys.fill(0);
+        m_values.fill(nullptr);
+    }
+
+private:
+    ALWAYS_INLINE static unsigned indexFor(uintptr_t fiber)
+    {
+        // Low byte is flags+length; payload starts at byte 1. Fold the word
+        // once so chars 5..7 contribute to the index for ≤7-char Latin-1 keys.
+        uintptr_t mixed = fiber ^ (fiber >> 32);
+        return static_cast<unsigned>((mixed >> 8) % capacity);
+    }
+
+    std::array<uintptr_t, capacity> m_keys { };
+    std::array<JSString*, capacity> m_values { };
+};
+
+} // namespace JSC
+
+#endif // USE(BUN_JSC_ADDITIONS)
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index c0ad2e1965c2c..6462b42fb0118 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -162,6 +162,39 @@ const String& JSString::resolveInline(JSGlobalObject* globalObject) const
         getVM(globalObject).heap.reportExtraMemoryAllocated(this, valueInternal().impl()->cost());
     return valueInternal();
 }
+
+AtomStringImpl* JSString::resolveInlineToAtomString(JSGlobalObject* globalObject) const
+{
+    ASSERT(isInline());
+    uintptr_t fiber = m_fiber;
+    unsigned len = inlineLengthFromFiber(fiber);
+    // Look up (or create) the atom directly from the in-cell bytes; no
+    // intermediate non-atom StringImpl is allocated.
+    AtomString atom = (fiber & JSRopeString::is8BitInPointer)
+        ? AtomString(std::span { inlineData8(), len })
+        : AtomString(std::span { inlineData16(), len });
+    size_t sizeToReport = atom.impl()->hasOneRef() ? atom.impl()->cost() : 0;
+    WTF::storeStoreFence();
+    new (&uninitializedValueInternal()) String(atom.releaseImpl());
+    if (globalObject)
+        getVM(globalObject).heap.reportExtraMemoryAllocated(this, sizeToReport);
+    return static_cast<AtomStringImpl*>(valueInternal().impl());
+}
+
+AtomStringImpl* JSString::resolveInlineToExistingAtomString() const
+{
+    ASSERT(isInline());
+    uintptr_t fiber = m_fiber;
+    unsigned len = inlineLengthFromFiber(fiber);
+    RefPtr<AtomStringImpl> atom = (fiber & JSRopeString::is8BitInPointer)
+        ? AtomStringImpl::lookUp(std::span { inlineData8(), len })
+        : AtomStringImpl::lookUp(std::span { inlineData16(), len });
+    if (!atom)
+        return nullptr;
+    WTF::storeStoreFence();
+    new (&uninitializedValueInternal()) String(WTF::move(atom));
+    return static_cast<AtomStringImpl*>(valueInternal().impl());
+}
 #endif
 
 DEFINE_VISIT_CHILDREN(JSString);
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 7147e4bf6fbc2..8f31230f3bbfd 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -145,14 +145,14 @@ class JSString : public JSCell {
     static constexpr uintptr_t isInlineInPointer = 0x2;
     static constexpr uintptr_t notStringImplMask = isRopeInPointer | isInlineInPointer;
     static constexpr unsigned inlineLengthShift = 3;
-    // 4-bit mask covers both the 16-byte JSString inline (len 2..7) and the
-    // 24-byte JSBigInlineString (len 8..15). Payload is always contiguous
+    // 5-bit mask covers both the 16-byte JSString inline (len 2..7) and the
+    // 32-byte JSBigInlineString (len 8..23). Payload is always contiguous
     // starting at &m_fiber+1; the cell size is determined at creation.
-    static constexpr unsigned inlineLengthMask = 0xf;
+    static constexpr unsigned inlineLengthMask = 0x1f;
     static constexpr unsigned maxInlineLength8 = 7;
     static constexpr unsigned maxInlineLength16 = 3;
-    static constexpr unsigned maxBigInlineLength8 = 15;
-    static constexpr unsigned maxBigInlineLength16 = 7;
+    static constexpr unsigned maxBigInlineLength8 = 23;
+    static constexpr unsigned maxBigInlineLength16 = 11;
     static_assert(maxBigInlineLength8 <= inlineLengthMask);
 #else
     static constexpr uintptr_t notStringImplMask = isRopeInPointer;
@@ -203,6 +203,8 @@ class JSString : public JSCell {
     }
 #endif
 
+#define BUN_INLINE_COUNT(name) ((void)0)
+
     void finishCreation(VM& vm, unsigned length)
     {
         ASSERT_UNUSED(length, length > 0);
@@ -230,6 +232,7 @@ class JSString : public JSCell {
 
     static JSString* create(VM& vm, Ref<StringImpl>&& value)
     {
+        BUN_INLINE_COUNT(g_bunJSStringCreate);
         unsigned length = value->length();
         ASSERT(length > 0);
         size_t cost = value->cost();
@@ -275,16 +278,13 @@ class JSString : public JSCell {
         return fiber;
     }
 
-    static JSString* createInline8(VM& vm, std::span<const Latin1Character> chars)
-    {
-        JSString* s = new (NotNull, allocateCell<JSString>(vm)) JSString(vm, CreateInline, encodeInline8(chars));
-        s->Base::finishCreation(vm);
-        return s;
-    }
+    static JSString* createInline8(VM& vm, std::span<const Latin1Character> chars);
+    static JSString* createInline16(VM& vm, std::span<const char16_t> chars);
 
-    static JSString* createInline16(VM& vm, std::span<const char16_t> chars)
+    static ALWAYS_INLINE JSString* createInlineFromFiber(VM& vm, uintptr_t fiber)
     {
-        JSString* s = new (NotNull, allocateCell<JSString>(vm)) JSString(vm, CreateInline, encodeInline16(chars));
+        BUN_INLINE_COUNT(g_bunInlineCreated);
+        JSString* s = new (NotNull, allocateCell<JSString>(vm)) JSString(vm, CreateInline, fiber);
         s->Base::finishCreation(vm);
         return s;
     }
@@ -358,6 +358,8 @@ class JSString : public JSCell {
         return reinterpret_cast<const char16_t*>(reinterpret_cast<const uint8_t*>(&m_fiber) + 2);
     }
     JS_EXPORT_PRIVATE const String& resolveInline(JSGlobalObject*) const;
+    JS_EXPORT_PRIVATE AtomStringImpl* resolveInlineToAtomString(JSGlobalObject*) const;
+    JS_EXPORT_PRIVATE AtomStringImpl* resolveInlineToExistingAtomString() const;
 #endif
     ALWAYS_INLINE JSRopeString* asRope()
     {
@@ -447,6 +449,7 @@ class JSBigInlineString final : public JSString {
 
     static JSBigInlineString* create8(VM& vm, std::span<const Latin1Character> chars)
     {
+        BUN_INLINE_COUNT(g_bunBigInlineCreated);
         ASSERT(chars.size() > maxInlineLength8 && chars.size() <= maxBigInlineLength8);
         JSBigInlineString* s = new (NotNull, allocateCell<JSBigInlineString>(vm)) JSBigInlineString(vm);
         uint8_t* bytes = reinterpret_cast<uint8_t*>(&s->m_fiber);
@@ -459,6 +462,7 @@ class JSBigInlineString final : public JSString {
 
     static JSBigInlineString* create16(VM& vm, std::span<const char16_t> chars)
     {
+        BUN_INLINE_COUNT(g_bunBigInlineCreated);
         ASSERT(chars.size() > maxInlineLength16 && chars.size() <= maxBigInlineLength16);
         JSBigInlineString* s = new (NotNull, allocateCell<JSBigInlineString>(vm)) JSBigInlineString(vm);
         uint8_t* bytes = reinterpret_cast<uint8_t*>(&s->m_fiber);
@@ -472,14 +476,14 @@ class JSBigInlineString final : public JSString {
 private:
     JSBigInlineString(VM& vm)
         : JSString(vm, CreateInline, 0)
-        , m_inlinePayloadHigh(0)
+        , m_inlinePayloadHigh { 0, 0 }
     { }
 
     DECLARE_DEFAULT_FINISH_CREATION;
 
-    uintptr_t m_inlinePayloadHigh;
+    uintptr_t m_inlinePayloadHigh[2];
 };
-static_assert(sizeof(JSBigInlineString) == 24);
+static_assert(sizeof(JSBigInlineString) == 32);
 #endif
 
 // NOTE: This class cannot override JSString's destructor. JSString's destructor is called directly
@@ -795,6 +799,7 @@ class JSRopeString final : public JSString {
 
     static JSRopeString* create(VM& vm, JSString* s1, JSString* s2)
     {
+        BUN_INLINE_COUNT(g_bunRopeCreated);
         unsigned length = s1->length() + s2->length();
         bool is8Bit = !!(static_cast<unsigned>(!!s1->is8Bit()) & static_cast<unsigned>(!!s2->is8Bit()));
         JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm)) JSRopeString(vm, length, is8Bit, s1, s2);
@@ -805,6 +810,7 @@ class JSRopeString final : public JSString {
     }
     static JSRopeString* create(VM& vm, JSString* s1, JSString* s2, JSString* s3)
     {
+        BUN_INLINE_COUNT(g_bunRopeCreated);
         unsigned length = s1->length() + s2->length() + s3->length();
         bool is8Bit = !!(static_cast<unsigned>(!!s1->is8Bit()) & static_cast<unsigned>(!!s2->is8Bit()) & static_cast<unsigned>(!!s3->is8Bit()));
         JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm)) JSRopeString(vm, length, is8Bit, s1, s2, s3);
@@ -816,6 +822,7 @@ class JSRopeString final : public JSString {
 
     ALWAYS_INLINE static JSRopeString* createSubstringOfResolved(VM& vm, GCDeferralContext* deferralContext, JSString* base, unsigned offset, unsigned length, bool is8Bit)
     {
+        BUN_INLINE_COUNT(g_bunRopeSubstringCreated);
         JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm, deferralContext)) JSRopeString(vm, length, is8Bit, base, offset);
         newString->finishCreationSubstringOfResolved(vm);
         ASSERT(newString->length());
@@ -1048,7 +1055,7 @@ ALWAYS_INLINE Identifier JSString::toIdentifier(JSGlobalObject* globalObject) co
         return static_cast<const JSRopeString*>(this)->toIdentifier(globalObject);
 #if USE(BUN_JSC_ADDITIONS)
     if (isInline())
-        resolveInline(globalObject);
+        return Identifier::fromString(getVM(globalObject), Ref { *resolveInlineToAtomString(globalObject) });
 #endif
     VM& vm = getVM(globalObject);
     if (valueInternal().impl()->isAtom())
@@ -1072,7 +1079,7 @@ ALWAYS_INLINE GCOwnedDataScope<AtomStringImpl*> JSString::toAtomString(JSGlobalO
         return { this, static_cast<const JSRopeString*>(this)->resolveRopeToAtomString(globalObject) };
 #if USE(BUN_JSC_ADDITIONS)
     if (isInline())
-        resolveInline(globalObject);
+        return { this, resolveInlineToAtomString(globalObject) };
 #endif
     if (valueInternal().impl()->isAtom())
         return { this, static_cast<AtomStringImpl*>(valueInternal().impl()) };
@@ -1088,8 +1095,11 @@ ALWAYS_INLINE GCOwnedDataScope<AtomStringImpl*> JSString::toExistingAtomString(J
     if (isRope())
         return static_cast<const JSRopeString*>(this)->resolveRopeToExistingAtomString(globalObject);
 #if USE(BUN_JSC_ADDITIONS)
-    if (isInline())
-        resolveInline(globalObject);
+    if (isInline()) {
+        if (auto* atom = resolveInlineToExistingAtomString())
+            return { this, atom };
+        return { };
+    }
 #endif
     if (valueInternal().impl()->isAtom())
         return { this, static_cast<AtomStringImpl*>(valueInternal().impl()) };
@@ -1107,8 +1117,10 @@ inline GCOwnedDataScope<const String&> JSString::value(JSGlobalObject* globalObj
     if (isRope())
         return { this, static_cast<const JSRopeString*>(this)->resolveRope(globalObject) };
 #if USE(BUN_JSC_ADDITIONS)
-    if (isInline())
+    if (isInline()) {
+        BUN_INLINE_COUNT(g_bunInlineResolvedValue);
         return { this, resolveInline(globalObject) };
+    }
 #endif
     return { this, valueInternal() };
 }
@@ -1149,8 +1161,10 @@ inline GCOwnedDataScope<const String&> JSString::tryGetValue(bool allocationAllo
             return { this, static_cast<const JSRopeString*>(this)->resolveRope(nullptr) };
         }
 #if USE(BUN_JSC_ADDITIONS)
-        if (isInline())
+        if (isInline()) {
+            BUN_INLINE_COUNT(g_bunInlineResolvedTryGetValue);
             return { this, resolveInline(nullptr) };
+        }
 #endif
     } else
         RELEASE_ASSERT(!(m_fiber & notStringImplMask));
@@ -1227,6 +1241,30 @@ inline JSString* jsString(VM& vm, StringView s)
     return JSString::create(vm, WTF::move(impl));
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+ALWAYS_INLINE JSString* JSString::createInline8(VM& vm, std::span<const Latin1Character> chars)
+{
+    uintptr_t fiber = encodeInline8(chars);
+    if (JSString* cached = vm.inlineStringCache.lookup(fiber)) {
+        BUN_INLINE_COUNT(g_bunInlineCacheHit);
+        return cached;
+    }
+    JSString* s = createInlineFromFiber(vm, fiber);
+    vm.inlineStringCache.insert(fiber, s);
+    return s;
+}
+
+ALWAYS_INLINE JSString* JSString::createInline16(VM& vm, std::span<const char16_t> chars)
+{
+    uintptr_t fiber = encodeInline16(chars);
+    if (JSString* cached = vm.inlineStringCache.lookup(fiber))
+        return cached;
+    JSString* s = createInlineFromFiber(vm, fiber);
+    vm.inlineStringCache.insert(fiber, s);
+    return s;
+}
+#endif
+
 ALWAYS_INLINE JSString* jsString(VM& vm, RefPtr<AtomStringImpl>&& s)
 {
     return jsString(vm, String { WTF::move(s) });
diff --git a/Source/JavaScriptCore/runtime/JSStringInlines.h b/Source/JavaScriptCore/runtime/JSStringInlines.h
index a82864027f346..9c67dddb47130 100644
--- a/Source/JavaScriptCore/runtime/JSStringInlines.h
+++ b/Source/JavaScriptCore/runtime/JSStringInlines.h
@@ -868,8 +868,25 @@ inline JSString* jsSubstringOfResolved(VM& vm, GCDeferralContext* deferralContex
 
     ASSERT(!s->isRope());
 #if USE(BUN_JSC_ADDITIONS)
-    if (s->isInline())
-        s->resolveInline(nullptr);
+    // Substring of an inline input: copy the bytes into a fresh inline cell
+    // without resolving the input (no StringImpl allocation).
+    if (s->isInline()) {
+        uintptr_t fiber = s->fiberConcurrently();
+        if (fiber & JSRopeString::is8BitInPointer) {
+            auto span = std::span { s->inlineData8(), JSString::inlineLengthFromFiber(fiber) }.subspan(offset, length);
+            if (length == 1)
+                return vm.smallStrings.singleCharacterString(span[0]);
+            if (length <= JSString::maxInlineLength8)
+                return JSString::createInline8(vm, span);
+            return JSBigInlineString::create8(vm, span);
+        }
+        auto span = std::span { s->inlineData16(), JSString::inlineLengthFromFiber(fiber) }.subspan(offset, length);
+        if (length == 1 && span[0] <= maxSingleCharacterString)
+            return vm.smallStrings.singleCharacterString(span[0]);
+        if (length <= JSString::maxInlineLength16)
+            return JSString::createInline16(vm, span);
+        return JSBigInlineString::create16(vm, span);
+    }
 #endif
     auto& base = s->valueInternal();
     if (!offset && length == base.length())
diff --git a/Source/JavaScriptCore/runtime/JSStringJoiner.h b/Source/JavaScriptCore/runtime/JSStringJoiner.h
index 8ef120af90bf2..45cc3436f906f 100644
--- a/Source/JavaScriptCore/runtime/JSStringJoiner.h
+++ b/Source/JavaScriptCore/runtime/JSStringJoiner.h
@@ -149,12 +149,14 @@ ALWAYS_INLINE bool JSStringJoiner::appendWithoutSideEffects(JSGlobalObject* glob
         // https://bugs.webkit.org/show_bug.cgi?id=211173
         if (JSString* jsString = dynamicDowncast<JSString>(value)) {
 #if USE(BUN_JSC_ADDITIONS)
-            // view() for an inline small string points at the cell's m_fiber bytes.
-            // tryGetValue() (below) would then overwrite m_fiber in place and the
-            // stored view would read pointer bytes. Resolve first so the view
-            // points at stable StringImpl storage that tryGetValue() also returns.
-            if (jsString->isInline())
-                jsString->resolveInline(globalObject);
+            // view() for an inline cell points at &m_fiber+1, which tryGetValue()
+            // below would overwrite. Resolve directly to an atom so repeated
+            // short contents share a single AtomStringImpl instead of allocating
+            // a throwaway StringImpl per element.
+            if (jsString->isInline()) {
+                BUN_INLINE_COUNT(g_bunInlineResolvedJoiner);
+                jsString->resolveInlineToAtomString(globalObject);
+            }
 #endif
             auto view = jsString->view(globalObject);
             RETURN_IF_EXCEPTION(scope, false);
@@ -210,7 +212,7 @@ ALWAYS_INLINE bool JSStringJoiner::append(JSGlobalObject* globalObject, JSValue
         RETURN_IF_EXCEPTION(scope, false);
 #if USE(BUN_JSC_ADDITIONS)
         if (jsString->isInline())
-            jsString->resolveInline(globalObject);
+            jsString->resolveInlineToAtomString(globalObject);
 #endif
         auto view = jsString->view(globalObject);
         RETURN_IF_EXCEPTION(scope, false);
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index ec737caf620eb..1ccfa341ebcbd 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -822,6 +822,36 @@ JSC_DEFINE_HOST_FUNCTION(stringProtoFuncCodePointAt, (JSGlobalObject* globalObje
     if (!checkObjectCoercible(thisValue)) [[unlikely]]
         return throwVMTypeError(globalObject, scope);
 
+#if USE(BUN_JSC_ADDITIONS)
+    // Fast path for inline small strings: read the code unit from the cell
+    // bytes without materializing a StringImpl.
+    if (thisValue.isString() && asString(thisValue)->isInline()) {
+        auto* jsString = asString(thisValue);
+        auto view = jsString->view(globalObject);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        unsigned length = view->length();
+        JSValue argument0 = callFrame->argument(0);
+        unsigned position;
+        if (argument0.isUInt32())
+            position = argument0.asUInt32();
+        else {
+            double d = argument0.toIntegerOrInfinity(globalObject);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            if (!(d >= 0 && d < length))
+                return JSValue::encode(jsUndefined());
+            position = static_cast<unsigned>(d);
+        }
+        if (position >= length)
+            return JSValue::encode(jsUndefined());
+        if (view->is8Bit())
+            return JSValue::encode(jsNumber(static_cast<char32_t>(view->span8()[position])));
+        char32_t c;
+        auto chars = view->span16();
+        U16_NEXT(chars, position, length, c);
+        return JSValue::encode(jsNumber(c));
+    }
+#endif
+
     String string = thisValue.toWTFString(globalObject); // Intentionally resolving as codePointAt requires resolved strings in the higher tiers.
     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     unsigned length = string.length();
diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
index 6df90ecf4b5b8..1d0e340ec488f 100644
--- a/Source/JavaScriptCore/runtime/VM.h
+++ b/Source/JavaScriptCore/runtime/VM.h
@@ -42,6 +42,9 @@ WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
 #include "JSDateMath.h"
 #include "JSONAtomStringCache.h"
 #include "KeyAtomStringCache.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlineStringCache.h"
+#endif
 #include "NativeFunction.h"
 #include "NumericStrings.h"
 #include "SmallStrings.h"
@@ -633,6 +636,9 @@ class VM : public ThreadSafeRefCountedWithSuppressingSaferCPPChecking<VM> {
     Ref<AtomStringImpl> lastAtomizedIdentifierAtomStringImpl { *static_cast<AtomStringImpl*>(StringImpl::empty()) };
     JSONAtomStringCache jsonAtomStringCache;
     KeyAtomStringCache keyAtomStringCache;
+#if USE(BUN_JSC_ADDITIONS)
+    InlineStringCache inlineStringCache;
+#endif
     StringSplitCache stringSplitCache;
     Vector<unsigned> stringSplitIndice;
     StringReplaceCache stringReplaceCache;

From a6331a39ff3eda32c46f4a61f1f2a676c577fcca Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 11:16:57 +0000
Subject: [PATCH 19/69] Revert JSBigInlineString to 24 bytes; width-aware
 equality bail

32-byte big-inline regressed RAMification by ~3% geomean: the 8..15
Latin-1 / 4..7 UTF-16 range (where most parser tokens land) grew from
24-byte cells to 32-byte cells. The 16..23 range is too rare in
JetStream to offset that. Reverting to 24 bytes (maxBigInlineLength8 15,
maxBigInlineLength16 7, mask 0xf).

Keep the width-aware big-inline bail in DFG/FTL compileStringEquality:
the single m_fiber word compare is sound only for 16-byte inline, which
is len<=7 Latin-1 OR len<=3 UTF-16, so the bail mask depends on whether
both sides are 8-bit.
---
 Source/JavaScriptCore/runtime/JSString.h | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 8f31230f3bbfd..a51903121766e 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -145,14 +145,14 @@ class JSString : public JSCell {
     static constexpr uintptr_t isInlineInPointer = 0x2;
     static constexpr uintptr_t notStringImplMask = isRopeInPointer | isInlineInPointer;
     static constexpr unsigned inlineLengthShift = 3;
-    // 5-bit mask covers both the 16-byte JSString inline (len 2..7) and the
-    // 32-byte JSBigInlineString (len 8..23). Payload is always contiguous
+    // 4-bit mask covers both the 16-byte JSString inline (len 2..7) and the
+    // 24-byte JSBigInlineString (len 8..15). Payload is always contiguous
     // starting at &m_fiber+1; the cell size is determined at creation.
-    static constexpr unsigned inlineLengthMask = 0x1f;
+    static constexpr unsigned inlineLengthMask = 0xf;
     static constexpr unsigned maxInlineLength8 = 7;
     static constexpr unsigned maxInlineLength16 = 3;
-    static constexpr unsigned maxBigInlineLength8 = 23;
-    static constexpr unsigned maxBigInlineLength16 = 11;
+    static constexpr unsigned maxBigInlineLength8 = 15;
+    static constexpr unsigned maxBigInlineLength16 = 7;
     static_assert(maxBigInlineLength8 <= inlineLengthMask);
 #else
     static constexpr uintptr_t notStringImplMask = isRopeInPointer;
@@ -476,14 +476,14 @@ class JSBigInlineString final : public JSString {
 private:
     JSBigInlineString(VM& vm)
         : JSString(vm, CreateInline, 0)
-        , m_inlinePayloadHigh { 0, 0 }
+        , m_inlinePayloadHigh(0)
     { }
 
     DECLARE_DEFAULT_FINISH_CREATION;
 
-    uintptr_t m_inlinePayloadHigh[2];
+    uintptr_t m_inlinePayloadHigh;
 };
-static_assert(sizeof(JSBigInlineString) == 32);
+static_assert(sizeof(JSBigInlineString) == 24);
 #endif
 
 // NOTE: This class cannot override JSString's destructor. JSString's destructor is called directly

From 00b30bee7eafcdd509f6b35e7a8c5c843ae3c351 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 12:29:53 +0000
Subject: [PATCH 20/69] FTL MakeRope: allocate the rope cell after
 inline-child/short-result bails

FTL compileMakeRope allocated the 32-byte JSRopeString before computing
child flags/length. The inline-child guard and the short-result routing
then branched to slowPath (operationMakeRope*), which allocates its own
cell, leaving the pre-allocated rope as dead garbage. pdfjs does ~5M
concats per run; every slowPath bail cost an extra 32 bytes.

Allocation now happens after those checks, so slowPath never wastes a
cell. DFG shares the register-reuse pattern that makes deferring the
allocation awkward; the short-result routing there is dropped instead
(short concats become 32-byte ropes, same as baseline), keeping only
the inline-child correctness guard.

Also in this batch:
- op_switch_string (LLInt/baseline/DFG operation) looks up the
  scrutinee atom directly from inline bytes via AtomStringImpl::lookUp;
  no StringImpl is allocated. pdfjs was resolving ~1M inline
  scrutinees per run through this path.
- InlineAtomCache: 512-slot fiber-word-keyed RefPtr<AtomStringImpl>
  cache on VM, consulted by Identifier::add(span<Latin1>) and
  resolveInlineToAtomString so repeated short names skip the
  atom-table hash+probe. Cleared on full GC.

RAMification pdfjs peak (FTL, 10 runs): 249-270MB -> 233-244MB; now
~-2% vs baseline instead of +7%.
---
 Source/JavaScriptCore/dfg/DFGOperations.cpp   | 15 ++++++-
 .../JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  | 15 ++-----
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp |  6 +++
 Source/JavaScriptCore/heap/Heap.cpp           |  3 ++
 Source/JavaScriptCore/jit/JITOperations.cpp   |  9 ++++
 .../JavaScriptCore/llint/LLIntSlowPaths.cpp   | 10 +++++
 .../runtime/IdentifierInlines.h               | 15 +++++++
 .../runtime/InlineStringCache.h               | 42 +++++++++++++++++++
 Source/JavaScriptCore/runtime/JSString.cpp    | 17 ++++++--
 Source/JavaScriptCore/runtime/JSString.h      |  4 +-
 Source/JavaScriptCore/runtime/VM.h            |  1 +
 11 files changed, 118 insertions(+), 19 deletions(-)

diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 8c19646ba8fb7..4741eb976e649 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -4800,11 +4800,22 @@ JSC_DEFINE_JIT_OPERATION(operationSwitchString, char*, (JSGlobalObject* globalOb
     JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
     auto scope = DECLARE_THROW_SCOPE(vm);
 
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    const StringJumpTable& linkedTable = codeBlock->dfgStringSwitchJumpTable(tableIndex);
+#if USE(BUN_JSC_ADDITIONS)
+    if (string->isInline()) {
+        unsigned length = string->length();
+        RefPtr<AtomStringImpl> atom = string->is8Bit()
+            ? AtomStringImpl::lookUp(std::span { string->inlineData8(), length })
+            : AtomStringImpl::lookUp(std::span { string->inlineData16(), length });
+        OPERATION_RETURN(scope, atom
+            ? linkedTable.ctiForValue(*unlinkedTable, atom.get()).taggedPtr<char*>()
+            : linkedTable.ctiDefault().taggedPtr<char*>());
+    }
+#endif
     auto str = string->value(globalObject);
 
     OPERATION_RETURN_IF_EXCEPTION(scope, nullptr);
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    const StringJumpTable& linkedTable = codeBlock->dfgStringSwitchJumpTable(tableIndex);
     OPERATION_RETURN(scope, linkedTable.ctiForValue(*unlinkedTable, str->impl()).taggedPtr<char*>());
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 3b7222af06622..0936abf4cacb2 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -17902,17 +17902,10 @@ void SpeculativeJIT::compileMakeRope(Node* node)
 
     static_assert(StringImpl::flagIs8Bit() == JSRopeString::is8BitInPointer);
     and32(TrustedImm32(StringImpl::flagIs8Bit()), scratchGPR);
-#if USE(BUN_JSC_ADDITIONS)
-    // Short all-8-bit result: defer to operationMakeRope* so jsString() can emit
-    // a 16-byte inline cell instead of the 32-byte rope we've just allocated.
-    // Limited to <=7: the slow-path call cost outweighs the 32->24 saving for
-    // 8..15, and big-inline coverage comes from the slice/substring hook.
-    {
-        Jump not8Bit = branchTest32(Zero, scratchGPR);
-        slowPath.append(branch32(BelowOrEqual, allocatorGPR, TrustedImm32(JSString::maxInlineLength8)));
-        not8Bit.link(this);
-    }
-#endif
+    // No short-result slow-path bail here: the rope cell is already allocated
+    // above (emitAllocateJSCell reuses allocatorGPR/scratchGPR so the
+    // allocation cannot be deferred), and routing to operationMakeRope* would
+    // allocate a second cell and leave this one as garbage.
     orPtr(opGPRs[0], scratchGPR);
     orPtr(TrustedImmPtr(JSString::isRopeInPointer), scratchGPR);
     storePtr(scratchGPR, Address(resultGPR, JSRopeString::offsetOfFiber0()));
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index e14426a11ee80..2db7c3216cb84 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -11737,10 +11737,12 @@ IGNORE_CLANG_WARNINGS_END
 
         Allocator allocator = allocatorForConcurrently<JSRopeString>(vm(), sizeof(JSRopeString), AllocatorForMode::AllocatorIfExists);
 
+#if !USE(BUN_JSC_ADDITIONS)
         LValue result = allocateCell(m_out.constIntPtr(allocator.localAllocator()), vm().stringStructure.get(), slowPath);
 
         // This puts nullptr for the first fiber. It makes visitChildren safe even if this JSRopeString is discarded due to the speculation failure in the following path.
         m_out.storePtr(m_out.constIntPtr(JSString::isRopeInPointer), result, m_heaps.JSRopeString_fiber0);
+#endif
 
         auto getFlagsAndLength = [&] (Edge& edge, LValue child) {
             if (JSString* string = edge->dynamicCastConstant<JSString*>()) {
@@ -11816,6 +11818,10 @@ IGNORE_CLANG_WARNINGS_END
             m_out.branch(m_out.bitAnd(is8Bit, shortEnough), rarely(slowPath), usually(notShortInline));
             m_out.appendTo(notShortInline);
         }
+        // All slowPath bails (inline child, short result, length overflow) are
+        // behind us; allocate the rope cell now so it is never wasted.
+        LValue result = allocateCell(m_out.constIntPtr(allocator.localAllocator()), vm().stringStructure.get(), slowPath);
+        m_out.storePtr(m_out.constIntPtr(JSString::isRopeInPointer), result, m_heaps.JSRopeString_fiber0);
 #endif
 
         m_out.storePtr(
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index f93739169d122..32c6f297ce0df 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -2347,6 +2347,9 @@ void Heap::finalize()
         vm().jsonAtomStringCache.clear();
         vm().numericStrings.clearOnGarbageCollection();
         vm().stringReplaceCache.clear();
+#if USE(BUN_JSC_ADDITIONS)
+        vm().inlineAtomCache.clear();
+#endif
     }
     vm().keyAtomStringCache.clear();
 #if USE(BUN_JSC_ADDITIONS)
diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
index 4bae8c27b9063..5d89cef1f69c4 100644
--- a/Source/JavaScriptCore/jit/JITOperations.cpp
+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
@@ -4659,6 +4659,15 @@ JSC_DEFINE_JIT_OPERATION(operationSwitchStringWithUnknownKeyType, char*, (JSGlob
         unsigned length = string->length();
         if (length < unlinkedTable.minLength() || length > unlinkedTable.maxLength())
             result = linkedTable.ctiDefault().taggedPtr();
+#if USE(BUN_JSC_ADDITIONS)
+        else if (string->isInline()) {
+            RefPtr<AtomStringImpl> atom = string->is8Bit()
+                ? AtomStringImpl::lookUp(std::span { string->inlineData8(), length })
+                : AtomStringImpl::lookUp(std::span { string->inlineData16(), length });
+            result = atom ? linkedTable.ctiForValue(unlinkedTable, atom.get()).taggedPtr()
+                          : linkedTable.ctiDefault().taggedPtr();
+        }
+#endif
         else {
             auto value = string->value(globalObject);
             OPERATION_RETURN_IF_EXCEPTION(scope, nullptr);
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index bd9805ef1e7d5..8e987d7c66eff 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -1896,6 +1896,16 @@ LLINT_SLOW_PATH_DECL(slow_path_switch_string)
         unsigned length = string->length();
         if (length < unlinkedTable.minLength() || length > unlinkedTable.maxLength())
             JUMP_TO(defaultOffset);
+#if USE(BUN_JSC_ADDITIONS)
+        // Inline scrutinee: look up the atom directly from the in-cell bytes.
+        // Case labels are parser atoms, so a miss means no case matches.
+        else if (string->isInline()) {
+            RefPtr<AtomStringImpl> atom = string->is8Bit()
+                ? AtomStringImpl::lookUp(std::span { string->inlineData8(), length })
+                : AtomStringImpl::lookUp(std::span { string->inlineData16(), length });
+            JUMP_TO(atom ? unlinkedTable.offsetForValue(atom.get()) : defaultOffset);
+        }
+#endif
         else {
             auto scrutineeString = string->value(globalObject);
             LLINT_CHECK_EXCEPTION();
diff --git a/Source/JavaScriptCore/runtime/IdentifierInlines.h b/Source/JavaScriptCore/runtime/IdentifierInlines.h
index 54ee571f61b0b..7d7058911ccec 100644
--- a/Source/JavaScriptCore/runtime/IdentifierInlines.h
+++ b/Source/JavaScriptCore/runtime/IdentifierInlines.h
@@ -106,6 +106,21 @@ Ref<AtomStringImpl> Identifier::add(VM& vm, std::span<const T> string)
     if (string.empty())
         return *static_cast<AtomStringImpl*>(StringImpl::empty());
 
+#if USE(BUN_JSC_ADDITIONS)
+    // Short Latin-1: the inline fiber word is a content-unique key. One
+    // direct-mapped compare replaces AtomStringImpl::add's hash+probe.
+    if constexpr (std::is_same_v<T, Latin1Character>) {
+        if (string.size() <= JSString::maxInlineLength8) {
+            uintptr_t fiber = JSString::encodeInline8(string);
+            if (auto* cached = vm.inlineAtomCache.lookup(fiber))
+                return *cached;
+            auto atom = AtomStringImpl::add(string);
+            vm.inlineAtomCache.insert(fiber, atom.get());
+            return atom.releaseNonNull();
+        }
+    }
+#endif
+
     return *AtomStringImpl::add(string);
 }
 
diff --git a/Source/JavaScriptCore/runtime/InlineStringCache.h b/Source/JavaScriptCore/runtime/InlineStringCache.h
index 0d560ac9027cc..f128c3f786aef 100644
--- a/Source/JavaScriptCore/runtime/InlineStringCache.h
+++ b/Source/JavaScriptCore/runtime/InlineStringCache.h
@@ -29,6 +29,8 @@
 
 #include <array>
 #include <cstdint>
+#include <wtf/RefPtr.h>
+#include <wtf/text/AtomStringImpl.h>
 
 namespace JSC {
 
@@ -76,6 +78,46 @@ class InlineStringCache {
     std::array<JSString*, capacity> m_values { };
 };
 
+// Direct-mapped AtomStringImpl* cache keyed by the inline fiber word, so
+// Identifier::add/fromString for repeated short names skips the atom-table
+// hash+probe. Holds a ref per slot; cleared on full GC.
+class InlineAtomCache {
+public:
+    static constexpr unsigned capacity = 512;
+
+    ALWAYS_INLINE AtomStringImpl* lookup(uintptr_t fiber) const
+    {
+        unsigned index = indexFor(fiber);
+        if (m_keys[index] == fiber)
+            return m_values[index].get();
+        return nullptr;
+    }
+
+    ALWAYS_INLINE void insert(uintptr_t fiber, AtomStringImpl* atom)
+    {
+        unsigned index = indexFor(fiber);
+        m_keys[index] = fiber;
+        m_values[index] = atom;
+    }
+
+    ALWAYS_INLINE void clear()
+    {
+        m_keys.fill(0);
+        for (auto& slot : m_values)
+            slot = nullptr;
+    }
+
+private:
+    ALWAYS_INLINE static unsigned indexFor(uintptr_t fiber)
+    {
+        uintptr_t mixed = fiber ^ (fiber >> 32);
+        return static_cast<unsigned>((mixed >> 8) % capacity);
+    }
+
+    std::array<uintptr_t, capacity> m_keys { };
+    std::array<RefPtr<AtomStringImpl>, capacity> m_values { };
+};
+
 } // namespace JSC
 
 #endif // USE(BUN_JSC_ADDITIONS)
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index 6462b42fb0118..2ab05dca09ecc 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -168,16 +168,27 @@ AtomStringImpl* JSString::resolveInlineToAtomString(JSGlobalObject* globalObject
     ASSERT(isInline());
     uintptr_t fiber = m_fiber;
     unsigned len = inlineLengthFromFiber(fiber);
+    bool is8Bit = fiber & JSRopeString::is8BitInPointer;
+    // 16-byte inline: consult the fiber-word-keyed atom cache first.
+    VM& vm = globalObject ? getVM(globalObject) : this->vm();
+    if ((is8Bit && len <= maxInlineLength8) || (!is8Bit && len <= maxInlineLength16)) {
+        if (auto* cached = vm.inlineAtomCache.lookup(fiber)) {
+            WTF::storeStoreFence();
+            new (&uninitializedValueInternal()) String(RefPtr { cached });
+            return cached;
+        }
+    }
     // Look up (or create) the atom directly from the in-cell bytes; no
     // intermediate non-atom StringImpl is allocated.
-    AtomString atom = (fiber & JSRopeString::is8BitInPointer)
+    AtomString atom = is8Bit
         ? AtomString(std::span { inlineData8(), len })
         : AtomString(std::span { inlineData16(), len });
+    if ((is8Bit && len <= maxInlineLength8) || (!is8Bit && len <= maxInlineLength16))
+        vm.inlineAtomCache.insert(fiber, atom.impl());
     size_t sizeToReport = atom.impl()->hasOneRef() ? atom.impl()->cost() : 0;
     WTF::storeStoreFence();
     new (&uninitializedValueInternal()) String(atom.releaseImpl());
-    if (globalObject)
-        getVM(globalObject).heap.reportExtraMemoryAllocated(this, sizeToReport);
+    vm.heap.reportExtraMemoryAllocated(this, sizeToReport);
     return static_cast<AtomStringImpl*>(valueInternal().impl());
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index a51903121766e..7b98f902a33e7 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -1117,10 +1117,8 @@ inline GCOwnedDataScope<const String&> JSString::value(JSGlobalObject* globalObj
     if (isRope())
         return { this, static_cast<const JSRopeString*>(this)->resolveRope(globalObject) };
 #if USE(BUN_JSC_ADDITIONS)
-    if (isInline()) {
-        BUN_INLINE_COUNT(g_bunInlineResolvedValue);
+    if (isInline())
         return { this, resolveInline(globalObject) };
-    }
 #endif
     return { this, valueInternal() };
 }
diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
index 1d0e340ec488f..40181cb8f112b 100644
--- a/Source/JavaScriptCore/runtime/VM.h
+++ b/Source/JavaScriptCore/runtime/VM.h
@@ -638,6 +638,7 @@ class VM : public ThreadSafeRefCountedWithSuppressingSaferCPPChecking<VM> {
     KeyAtomStringCache keyAtomStringCache;
 #if USE(BUN_JSC_ADDITIONS)
     InlineStringCache inlineStringCache;
+    InlineAtomCache inlineAtomCache;
 #endif
     StringSplitCache stringSplitCache;
     Vector<unsigned> stringSplitIndice;

From f4c806667cee8343d3a544ba3df404331dd1b19b Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 12:34:37 +0000
Subject: [PATCH 21/69] InlinePropertyKey.h: tagged-uid shim layer (scaffold
 for change set 6)

Defines isInlinePropertyKey() / uidIsSymbol() / uidHash() / uidLength() /
uidRef() / uidDeref() so call sites that dereference a UniquedStringImpl*
can branch on the tag bit first. Pointer-identity comparisons and PtrHash
need no change.

Not yet wired: Identifier still wraps AtomString (RefPtr), so no fiber
words reach PropertyName yet. Next step is a tagged Identifier storage
and routing IdentifierRepHash::hash / PropertyName::isSymbol through
the shims.
---
 Source/JavaScriptCore/CMakeLists.txt          |   1 +
 .../runtime/InlinePropertyKey.h               | 106 ++++++++++++++++++
 2 files changed, 107 insertions(+)
 create mode 100644 Source/JavaScriptCore/runtime/InlinePropertyKey.h

diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 56f6be630da88..d43eb98552552 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -1330,6 +1330,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
     runtime/InferredValueInlines.h
     runtime/InitializeThreading.h
     runtime/InlineAttribute.h
+    runtime/InlinePropertyKey.h
     runtime/InlineStringCache.h
     runtime/Int16Array.h
     runtime/Int32Array.h
diff --git a/Source/JavaScriptCore/runtime/InlinePropertyKey.h b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
new file mode 100644
index 0000000000000..05966903f16b1
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
@@ -0,0 +1,106 @@
+/*
+ *  Copyright (C) 2024 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ */
+
+#pragma once
+
+#if USE(BUN_JSC_ADDITIONS)
+
+#include <cstdint>
+#include <wtf/text/StringHasher.h>
+#include <wtf/text/UniquedStringImpl.h>
+
+namespace JSC {
+
+// A UniquedStringImpl* slot may instead hold an inline-encoded fiber word
+// (bit 1 set, bit 0 clear; see JSString::isInlineInPointer). Real impls are
+// 8-byte aligned so the low 3 bits distinguish. The word is content-unique for
+// 2..7 Latin-1 / 1..3 UTF-16 characters, so pointer-identity comparisons and
+// PtrHash-style hashing remain sound without dereferencing.
+//
+// These helpers shim the handful of call sites that dereference a uid for
+// isSymbol() / hash() / length() / ref() / deref() so they branch on the tag
+// first. Call sites that only compare or store the raw value need no change.
+
+static constexpr uintptr_t inlinePropertyKeyTag = 0x2;
+static constexpr uintptr_t inlinePropertyKeyTagMask = 0x3;
+
+ALWAYS_INLINE bool isInlinePropertyKey(const UniquedStringImpl* impl)
+{
+    return (reinterpret_cast<uintptr_t>(impl) & inlinePropertyKeyTagMask) == inlinePropertyKeyTag;
+}
+
+ALWAYS_INLINE bool isInlinePropertyKey(uintptr_t word)
+{
+    return (word & inlinePropertyKeyTagMask) == inlinePropertyKeyTag;
+}
+
+ALWAYS_INLINE uintptr_t inlinePropertyKeyWord(const UniquedStringImpl* impl)
+{
+    return reinterpret_cast<uintptr_t>(impl);
+}
+
+ALWAYS_INLINE UniquedStringImpl* inlinePropertyKeyAsImpl(uintptr_t word)
+{
+    return reinterpret_cast<UniquedStringImpl*>(word);
+}
+
+// Layout matches JSString's inline encoding: bit 2 is is8Bit, bits 3..6 are
+// length, payload at byte 1 (8-bit) or byte 2 (16-bit).
+ALWAYS_INLINE bool inlinePropertyKeyIs8Bit(uintptr_t word) { return word & 0x4; }
+ALWAYS_INLINE unsigned inlinePropertyKeyLength(uintptr_t word) { return static_cast<unsigned>(word >> 3) & 0xf; }
+
+ALWAYS_INLINE unsigned inlinePropertyKeyHash(uintptr_t word)
+{
+    // Must match StringImpl::hash() for equal content so a fiber-word key
+    // compares against an AtomStringImpl* key with the same hash.
+    unsigned len = inlinePropertyKeyLength(word);
+    const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+    if (inlinePropertyKeyIs8Bit(word))
+        return StringHasher::computeHashAndMaskTop8Bits(std::span<const Latin1Character> { bytes + 1, len });
+    return StringHasher::computeHashAndMaskTop8Bits(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len });
+}
+
+// Shims: safe to call on either a real impl or a fiber word.
+
+ALWAYS_INLINE bool uidIsSymbol(const UniquedStringImpl* impl)
+{
+    if (isInlinePropertyKey(impl))
+        return false;
+    return impl->isSymbol();
+}
+
+ALWAYS_INLINE unsigned uidHash(const UniquedStringImpl* impl)
+{
+    if (isInlinePropertyKey(impl))
+        return inlinePropertyKeyHash(inlinePropertyKeyWord(impl));
+    return impl->existingSymbolAwareHash();
+}
+
+ALWAYS_INLINE unsigned uidLength(const UniquedStringImpl* impl)
+{
+    if (isInlinePropertyKey(impl))
+        return inlinePropertyKeyLength(inlinePropertyKeyWord(impl));
+    return impl->length();
+}
+
+ALWAYS_INLINE void uidRef(UniquedStringImpl* impl)
+{
+    if (!isInlinePropertyKey(impl))
+        impl->ref();
+}
+
+ALWAYS_INLINE void uidDeref(UniquedStringImpl* impl)
+{
+    if (!isInlinePropertyKey(impl))
+        impl->deref();
+}
+
+} // namespace JSC
+
+#endif // USE(BUN_JSC_ADDITIONS)

From 2d8ee4ac16872deb68fa8626a17f1423f2c0b5a1 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 13:32:46 +0000
Subject: [PATCH 22/69] CacheableIdentifier: accept 16-byte inline JSStrings as
 cacheable ByVal keys

isCacheableIdentifierCell() previously rejected inline strings
(tryGetValueImpl() returns null), so obj[inlineStr] always took the
generic slow path and never populated an AccessCase. A 16-byte inline
string's m_fiber is content-unique, so it can serve as the IC's cached
uid directly: the stub's pointer compare of jsString->m_fiber against
accessCase.uid() is already the right test.

- isCacheableIdentifierCell/getCacheableIdentifier: accept inline cells
  with length <= maxInlineLength8.
- CacheableIdentifier::uid(): for an inline JSString cell, return the
  raw fiber word cast as UniquedStringImpl*.
- CacheableIdentifier::isSymbol()/hash()/ensureIsCell(): route through
  uidIsSymbol()/uidHash() so a fiber-word uid does not dereference.
- InlineCacheCompiler: replace accessCase.uid()->isSymbol() with
  accessCase.identifier().isSymbol() at every site; the two handler
  string-key paths test only isRopeInPointer so inline fiber words reach
  the word compare.

With InlineStringCache, repeated short keys return the same cell; once
the first slow-path resolves it to an atom, subsequent IC compares hit
on the atom. A fresh inline cell after GC costs one slow-path miss.
---
 .../bytecode/InlineCacheCompiler.cpp          | 61 ++++++++++++-------
 .../runtime/CacheableIdentifierInlines.h      | 33 ++++++++++
 Source/JavaScriptCore/runtime/JSString.h      |  1 +
 3 files changed, 72 insertions(+), 23 deletions(-)

diff --git a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
index 30475e29748df..355c3ec2c08ae 100644
--- a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
+++ b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
@@ -1426,7 +1426,15 @@ CCallHelpers::JumpList InlineCacheCompiler::emitDataICCheckUid(CCallHelpers& jit
     } else {
         fallThrough.append(jit.branchIfNotString(propertyJSR.payloadGPR()));
         jit.loadPtr(CCallHelpers::Address(propertyJSR.payloadGPR(), JSString::offsetOfValue()), scratchGPR);
+#if USE(BUN_JSC_ADDITIONS)
+        // Only reject true ropes: inline fiber words compare by identity
+        // against a fiber-word handler uid. A rope fiber has bit 0 set and
+        // can never equal a stored uid (atom ptr has low bits 0, fiber word
+        // has low bits 0b10), so the compare alone would also be correct.
+        fallThrough.append(jit.branchTestPtr(CCallHelpers::NonZero, scratchGPR, CCallHelpers::TrustedImm32(JSString::isRopeInPointer)));
+#else
         fallThrough.append(jit.branchIfRopeStringImpl(scratchGPR));
+#endif
     }
     fallThrough.append(jit.branchPtr(CCallHelpers::NotEqual, scratchGPR, CCallHelpers::Address(GPRInfo::handlerGPR, InlineCacheHandler::offsetOfUid())));
 
@@ -1875,7 +1883,7 @@ void InlineCacheCompiler::generateWithGuard(unsigned index, AccessCase& accessCa
         GPRReg propertyGPR = m_propertyCache.propertyGPR();
         // non-rope string check done inside polymorphic access.
 
-        if (accessCase.uid()->isSymbol())
+        if (accessCase.identifier().isSymbol())
             jit.loadPtr(MacroAssembler::Address(propertyGPR, Symbol::offsetOfSymbolImpl()), scratchGPR);
         else
             jit.loadPtr(MacroAssembler::Address(propertyGPR, JSString::offsetOfValue()), scratchGPR);
@@ -5129,7 +5137,7 @@ AccessGenerationResult InlineCacheCompiler::compile(const GCSafeConcurrentJSLock
 
         if (!hasConstantIdentifier) {
             if (entry->requiresIdentifierNameMatch()) {
-                if (entry->uid()->isSymbol())
+                if (entry->identifier().isSymbol())
                     needsSymbolPropertyCheck = true;
                 else
                     needsStringPropertyCheck = true;
@@ -5208,13 +5216,20 @@ AccessGenerationResult InlineCacheCompiler::compile(const GCSafeConcurrentJSLock
 
                 jit.loadPtr(MacroAssembler::Address(propertyGPR, JSString::offsetOfValue()), m_scratchGPR);
 
+#if USE(BUN_JSC_ADDITIONS)
+                // Let inline fiber words through; generateWithGuard compares
+                // m_fiber by identity against the cached uid which may itself
+                // be a fiber word. True ropes still bail here.
+                m_failAndRepatch.append(jit.branchTestPtr(CCallHelpers::NonZero, m_scratchGPR, CCallHelpers::TrustedImm32(JSString::isRopeInPointer)));
+#else
                 m_failAndRepatch.append(jit.branchIfRopeStringImpl(m_scratchGPR));
+#endif
 
                 JIT_COMMENT(jit, "Cases start (needsStringPropertyCheck)");
                 for (unsigned i = keys.size(); i--;) {
                     fallThrough.link(&jit);
                     fallThrough.shrink(0);
-                    if (keys[i]->requiresIdentifierNameMatch() && !keys[i]->uid()->isSymbol())
+                    if (keys[i]->requiresIdentifierNameMatch() && !keys[i]->identifier().isSymbol())
                         generateWithGuard(i, keys[i].get(), fallThrough);
                 }
 
@@ -5243,7 +5258,7 @@ AccessGenerationResult InlineCacheCompiler::compile(const GCSafeConcurrentJSLock
                 for (unsigned i = keys.size(); i--;) {
                     fallThrough.link(&jit);
                     fallThrough.shrink(0);
-                    if (keys[i]->requiresIdentifierNameMatch() && keys[i]->uid()->isSymbol())
+                    if (keys[i]->requiresIdentifierNameMatch() && keys[i]->identifier().isSymbol())
                         generateWithGuard(i, keys[i].get(), fallThrough);
                 }
 
@@ -7715,7 +7730,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                                 switch (accessCase.m_type) {
                                 case AccessCase::GetGetter:
                                 case AccessCase::Load:
-                                    code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolLoadOwnPropertyHandler : CommonJITThunkID::GetByValWithStringLoadOwnPropertyHandler).retagged<JITStubRoutinePtrTag>();
+                                    code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::GetByValWithSymbolLoadOwnPropertyHandler : CommonJITThunkID::GetByValWithStringLoadOwnPropertyHandler).retagged<JITStubRoutinePtrTag>();
                                     break;
                                 case AccessCase::IndexedUndefinedKeyLoad:
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithUndefinedKeyLoadOwnPropertyHandler).retagged<JITStubRoutinePtrTag>();
@@ -7736,7 +7751,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                                 switch (accessCase.m_type) {
                                 case AccessCase::GetGetter:
                                 case AccessCase::Load:
-                                    code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolLoadPrototypePropertyHandler : CommonJITThunkID::GetByValWithStringLoadPrototypePropertyHandler).retagged<JITStubRoutinePtrTag>();
+                                    code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::GetByValWithSymbolLoadPrototypePropertyHandler : CommonJITThunkID::GetByValWithStringLoadPrototypePropertyHandler).retagged<JITStubRoutinePtrTag>();
                                     break;
                                 case AccessCase::IndexedUndefinedKeyLoad:
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithUndefinedKeyLoadPrototypePropertyHandler).retagged<JITStubRoutinePtrTag>();
@@ -7773,7 +7788,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             switch (accessCase.m_type) {
                             case AccessCase::Miss:
-                                code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolMissHandler : CommonJITThunkID::GetByValWithStringMissHandler).retagged<JITStubRoutinePtrTag>();
+                                code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::GetByValWithSymbolMissHandler : CommonJITThunkID::GetByValWithStringMissHandler).retagged<JITStubRoutinePtrTag>();
                                 break;
                             case AccessCase::IndexedUndefinedKeyMiss:
                                 code = vm.getCTIStub(CommonJITThunkID::GetByValWithUndefinedKeyMissHandler).retagged<JITStubRoutinePtrTag>();
@@ -7821,17 +7836,17 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             if (accessCase.m_type == AccessCase::CustomAccessorGetter) {
                                 if (Options::useDOMJIT() && access.domAttribute() && access.domAttribute()->domJIT) {
-                                    code = compileGetByDOMJITHandler(codeBlock, access.domAttribute()->domJIT, accessCase.uid()->isSymbol());
+                                    code = compileGetByDOMJITHandler(codeBlock, access.domAttribute()->domJIT, accessCase.identifier().isSymbol());
                                     if (!code)
                                         return AccessGenerationResult::GaveUp;
                                 } else {
-                                    if (accessCase.uid()->isSymbol())
+                                    if (accessCase.identifier().isSymbol())
                                         code = vm.getCTIStub(CommonJITThunkID::GetByValWithSymbolCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                                     else
                                         code = vm.getCTIStub(CommonJITThunkID::GetByValWithStringCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                                 }
                             } else {
-                                if (accessCase.uid()->isSymbol())
+                                if (accessCase.identifier().isSymbol())
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithSymbolCustomValueHandler).retagged<JITStubRoutinePtrTag>();
                                 else
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithStringCustomValueHandler).retagged<JITStubRoutinePtrTag>();
@@ -7853,7 +7868,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                                 currStructure = object->structure();
                             if (isValidOffset(accessCase.m_offset))
                                 currStructure->startWatchingPropertyForReplacements(vm, accessCase.offset());
-                            auto code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolGetterHandler : CommonJITThunkID::GetByValWithStringGetterHandler).retagged<JITStubRoutinePtrTag>();
+                            auto code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::GetByValWithSymbolGetterHandler : CommonJITThunkID::GetByValWithStringGetterHandler).retagged<JITStubRoutinePtrTag>();
                             auto stub = createPreCompiledICJITStubRoutine(WTF::move(code), vm, codeBlock);
                             connectWatchpointSets(stub.get(), WTF::move(watchedConditions), WTF::move(additionalWatchpointSets));
                             return finishPreCompiledCodeGeneration(WTF::move(stub));
@@ -7886,7 +7901,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                         MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                         switch (accessCase.m_type) {
                         case AccessCase::Replace:
-                            code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::PutByValWithSymbolReplaceHandler : CommonJITThunkID::PutByValWithStringReplaceHandler).retagged<JITStubRoutinePtrTag>();
+                            code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::PutByValWithSymbolReplaceHandler : CommonJITThunkID::PutByValWithStringReplaceHandler).retagged<JITStubRoutinePtrTag>();
                             break;
                         case AccessCase::IndexedUndefinedKeyReplace:
                             code = vm.getCTIStub(CommonJITThunkID::PutByValWithUndefinedKeyReplaceHandler).retagged<JITStubRoutinePtrTag>();
@@ -7933,7 +7948,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                         MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                         switch (accessCase.m_type) {
                         case AccessCase::Transition:
-                            if (accessCase.uid()->isSymbol())
+                            if (accessCase.identifier().isSymbol())
                                 code = selectTransitionHandler(CommonJITThunkID::PutByValWithSymbolTransitionNonAllocatingHandler, CommonJITThunkID::PutByValWithSymbolTransitionReallocatingOutOfLineHandler, CommonJITThunkID::PutByValWithSymbolTransitionNewlyAllocatingHandler, CommonJITThunkID::PutByValWithSymbolTransitionReallocatingHandler);
                             else
                                 code = selectTransitionHandler(CommonJITThunkID::PutByValWithStringTransitionNonAllocatingHandler, CommonJITThunkID::PutByValWithStringTransitionReallocatingOutOfLineHandler, CommonJITThunkID::PutByValWithStringTransitionNewlyAllocatingHandler, CommonJITThunkID::PutByValWithStringTransitionReallocatingHandler);
@@ -7973,12 +7988,12 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
 
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             if (accessCase.m_type == AccessCase::CustomAccessorSetter) {
-                                if (accessCase.uid()->isSymbol())
+                                if (accessCase.identifier().isSymbol())
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithSymbolCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                                 else
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithStringCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                             } else {
-                                if (accessCase.uid()->isSymbol())
+                                if (accessCase.identifier().isSymbol())
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithSymbolCustomValueHandler).retagged<JITStubRoutinePtrTag>();
                                 else
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithStringCustomValueHandler).retagged<JITStubRoutinePtrTag>();
@@ -8003,9 +8018,9 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
 
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             if (isStrict)
-                                code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::PutByValWithSymbolStrictSetterHandler : CommonJITThunkID::PutByValWithStringStrictSetterHandler).retagged<JITStubRoutinePtrTag>();
+                                code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::PutByValWithSymbolStrictSetterHandler : CommonJITThunkID::PutByValWithStringStrictSetterHandler).retagged<JITStubRoutinePtrTag>();
                             else
-                                code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::PutByValWithSymbolSloppySetterHandler : CommonJITThunkID::PutByValWithStringSloppySetterHandler).retagged<JITStubRoutinePtrTag>();
+                                code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::PutByValWithSymbolSloppySetterHandler : CommonJITThunkID::PutByValWithStringSloppySetterHandler).retagged<JITStubRoutinePtrTag>();
                             auto stub = createPreCompiledICJITStubRoutine(WTF::move(code), vm, codeBlock);
                             connectWatchpointSets(stub.get(), WTF::move(watchedConditions), WTF::move(additionalWatchpointSets));
                             return finishPreCompiledCodeGeneration(WTF::move(stub));
@@ -8029,7 +8044,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                     collectConditions(accessCase, watchedConditions, checkingConditions);
                     if (checkingConditions.isEmpty()) {
                         MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
-                        if (accessCase.uid()->isSymbol())
+                        if (accessCase.identifier().isSymbol())
                             code = vm.getCTIStub(accessCase.m_type == AccessCase::InHit ? CommonJITThunkID::InByValWithSymbolHitHandler : CommonJITThunkID::InByValWithSymbolMissHandler).retagged<JITStubRoutinePtrTag>();
                         else
                             code = vm.getCTIStub(accessCase.m_type == AccessCase::InHit ? CommonJITThunkID::InByValWithStringHitHandler : CommonJITThunkID::InByValWithStringMissHandler).retagged<JITStubRoutinePtrTag>();
@@ -8056,13 +8071,13 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                     CommonJITThunkID thunkID = CommonJITThunkID::DeleteByValWithStringDeleteHandler;
                     switch (accessCase.m_type) {
                     case AccessCase::Delete:
-                        thunkID = accessCase.uid()->isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteHandler : CommonJITThunkID::DeleteByValWithStringDeleteHandler;
+                        thunkID = accessCase.identifier().isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteHandler : CommonJITThunkID::DeleteByValWithStringDeleteHandler;
                         break;
                     case AccessCase::DeleteNonConfigurable:
-                        thunkID = accessCase.uid()->isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteNonConfigurableHandler : CommonJITThunkID::DeleteByValWithStringDeleteNonConfigurableHandler;
+                        thunkID = accessCase.identifier().isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteNonConfigurableHandler : CommonJITThunkID::DeleteByValWithStringDeleteNonConfigurableHandler;
                         break;
                     case AccessCase::DeleteMiss:
-                        thunkID = accessCase.uid()->isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteMissHandler : CommonJITThunkID::DeleteByValWithStringDeleteMissHandler;
+                        thunkID = accessCase.identifier().isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteMissHandler : CommonJITThunkID::DeleteByValWithStringDeleteMissHandler;
                         break;
                     default:
                         break;
@@ -8159,7 +8174,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
 #endif
             }
             m_failAndRepatch.append(notInt32);
-        } else if (accessCase.requiresIdentifierNameMatch() && !accessCase.uid()->isSymbol()) {
+        } else if (accessCase.requiresIdentifierNameMatch() && !accessCase.identifier().isSymbol()) {
             CCallHelpers::JumpList notString;
             GPRReg propertyGPR = m_propertyCache.propertyGPR();
             if (!m_propertyCache.propertyIsString) {
@@ -8174,7 +8189,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
             jit.loadPtr(MacroAssembler::Address(propertyGPR, JSString::offsetOfValue()), m_scratchGPR);
             m_failAndRepatch.append(jit.branchIfRopeStringImpl(m_scratchGPR));
             m_failAndRepatch.append(notString);
-        } else if (accessCase.requiresIdentifierNameMatch() && accessCase.uid()->isSymbol()) {
+        } else if (accessCase.requiresIdentifierNameMatch() && accessCase.identifier().isSymbol()) {
             CCallHelpers::JumpList notSymbol;
             if (!m_propertyCache.propertyIsSymbol) {
                 GPRReg propertyGPR = m_propertyCache.propertyGPR();
diff --git a/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h b/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
index 94814bce0bab6..f715242741b79 100644
--- a/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
+++ b/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
@@ -28,6 +28,9 @@
 #include "CacheableIdentifier.h"
 
 #include "Identifier.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
 #include "JSCJSValueInlines.h"
 #include "JSCell.h"
 #include "VM.h"
@@ -90,12 +93,24 @@ inline UniquedStringImpl* CacheableIdentifier::uid() const
         return &uncheckedDowncast<Symbol>(cell())->uid();
     ASSERT(isStringCell());
     JSString* string = uncheckedDowncast<JSString>(cell());
+#if USE(BUN_JSC_ADDITIONS)
+    // For an inline JSString cell the fiber word itself is the content-unique
+    // key; return it cast as UniquedStringImpl* so IC stubs can pointer-compare
+    // against the runtime string's m_fiber. Dereferencing this value must go
+    // through uidIsSymbol()/uidHash() (see InlinePropertyKey.h).
+    if (string->isInline())
+        return std::bit_cast<UniquedStringImpl*>(string->rawFiber());
+#endif
     return std::bit_cast<UniquedStringImpl*>(string->getValueImpl());
 }
 
 inline bool CacheableIdentifier::isSymbol() const
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return m_bits && uidIsSymbol(uid());
+#else
     return m_bits && uid()->isSymbol();
+#endif
 }
 
 inline bool CacheableIdentifier::isPrivateName() const
@@ -105,7 +120,11 @@ inline bool CacheableIdentifier::isPrivateName() const
 
 inline unsigned CacheableIdentifier::hash() const
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return uidHash(uid());
+#else
     return uid()->symbolAwareHash();
+#endif
 }
 
 inline bool CacheableIdentifier::isCacheableIdentifierCell(JSCell* cell)
@@ -115,6 +134,12 @@ inline bool CacheableIdentifier::isCacheableIdentifierCell(JSCell* cell)
     if (!cell->isString())
         return false;
     JSString* string = uncheckedDowncast<JSString>(cell);
+#if USE(BUN_JSC_ADDITIONS)
+    // A 16-byte inline string's fiber word is content-unique and compares
+    // by identity against a runtime JSString's m_fiber; eligible for IC.
+    if (string->isInline())
+        return string->length() <= JSString::maxInlineLength8;
+#endif
     if (const StringImpl* impl = string->tryGetValueImpl())
         return impl->isAtom();
     return false;
@@ -134,6 +159,10 @@ inline GCOwnedDataScope<const UniquedStringImpl*> CacheableIdentifier::getCachea
     if (!cell->isString())
         return { };
     JSString* string = uncheckedDowncast<JSString>(cell);
+#if USE(BUN_JSC_ADDITIONS)
+    if (string->isInline() && string->length() <= JSString::maxInlineLength8)
+        return { cell, std::bit_cast<const UniquedStringImpl*>(string->rawFiber()) };
+#endif
     if (const StringImpl* impl = string->tryGetValueImpl(); impl && impl->isAtom())
         return { cell, static_cast<const AtomStringImpl*>(impl) };
     return { };
@@ -159,7 +188,11 @@ inline bool CacheableIdentifier::isStringCell() const
 inline void CacheableIdentifier::ensureIsCell(VM& vm)
 {
     if (!isCell()) {
+#if USE(BUN_JSC_ADDITIONS)
+        if (uidIsSymbol(uid()))
+#else
         if (uid()->isSymbol())
+#endif
             setCellBits(Symbol::create(vm, static_cast<SymbolImpl&>(*uid())));
         else
             setCellBits(jsString(vm, String(static_cast<AtomStringImpl*>(uid()))));
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 7b98f902a33e7..5724df2200cc6 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -360,6 +360,7 @@ class JSString : public JSCell {
     JS_EXPORT_PRIVATE const String& resolveInline(JSGlobalObject*) const;
     JS_EXPORT_PRIVATE AtomStringImpl* resolveInlineToAtomString(JSGlobalObject*) const;
     JS_EXPORT_PRIVATE AtomStringImpl* resolveInlineToExistingAtomString() const;
+    ALWAYS_INLINE uintptr_t rawFiber() const { return m_fiber; }
 #endif
     ALWAYS_INLINE JSRopeString* asRope()
     {

From c3264e5320c68fe5e0bd030831bc71525f62d36a Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 13:42:24 +0000
Subject: [PATCH 23/69] CacheableIdentifier: make inline JSStrings cacheable
 ByVal keys (atom-resolve variant)

isCacheableIdentifierCell/getCacheableIdentifier/createFromCell
previously rejected inline strings (tryGetValueImpl() returns null), so
obj[inlineStr] never populated an AccessCase and took the generic slow
path on every access.

Resolve the inline cell to its atom in createFromCell/
getCacheableIdentifier so downstream code sees a real AtomStringImpl*.
With InlineStringCache, subsequent accesses return the same
(now-resolved) cell and hit the IC's atom-pointer compare.

Reverts 2d8ee4ac16's fiber-word-as-uid approach: every slow-path caller
dereferences the returned uid (parseIndex, putInline, repatch), so a
tagged word crashes. Keeping uid as a real impl sidesteps all of that.
---
 .../bytecode/InlineCacheCompiler.cpp          | 61 +++++++------------
 .../runtime/CacheableIdentifierInlines.h      | 44 +++++--------
 Source/JavaScriptCore/runtime/JSString.h      |  1 -
 3 files changed, 39 insertions(+), 67 deletions(-)

diff --git a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
index 355c3ec2c08ae..30475e29748df 100644
--- a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
+++ b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
@@ -1426,15 +1426,7 @@ CCallHelpers::JumpList InlineCacheCompiler::emitDataICCheckUid(CCallHelpers& jit
     } else {
         fallThrough.append(jit.branchIfNotString(propertyJSR.payloadGPR()));
         jit.loadPtr(CCallHelpers::Address(propertyJSR.payloadGPR(), JSString::offsetOfValue()), scratchGPR);
-#if USE(BUN_JSC_ADDITIONS)
-        // Only reject true ropes: inline fiber words compare by identity
-        // against a fiber-word handler uid. A rope fiber has bit 0 set and
-        // can never equal a stored uid (atom ptr has low bits 0, fiber word
-        // has low bits 0b10), so the compare alone would also be correct.
-        fallThrough.append(jit.branchTestPtr(CCallHelpers::NonZero, scratchGPR, CCallHelpers::TrustedImm32(JSString::isRopeInPointer)));
-#else
         fallThrough.append(jit.branchIfRopeStringImpl(scratchGPR));
-#endif
     }
     fallThrough.append(jit.branchPtr(CCallHelpers::NotEqual, scratchGPR, CCallHelpers::Address(GPRInfo::handlerGPR, InlineCacheHandler::offsetOfUid())));
 
@@ -1883,7 +1875,7 @@ void InlineCacheCompiler::generateWithGuard(unsigned index, AccessCase& accessCa
         GPRReg propertyGPR = m_propertyCache.propertyGPR();
         // non-rope string check done inside polymorphic access.
 
-        if (accessCase.identifier().isSymbol())
+        if (accessCase.uid()->isSymbol())
             jit.loadPtr(MacroAssembler::Address(propertyGPR, Symbol::offsetOfSymbolImpl()), scratchGPR);
         else
             jit.loadPtr(MacroAssembler::Address(propertyGPR, JSString::offsetOfValue()), scratchGPR);
@@ -5137,7 +5129,7 @@ AccessGenerationResult InlineCacheCompiler::compile(const GCSafeConcurrentJSLock
 
         if (!hasConstantIdentifier) {
             if (entry->requiresIdentifierNameMatch()) {
-                if (entry->identifier().isSymbol())
+                if (entry->uid()->isSymbol())
                     needsSymbolPropertyCheck = true;
                 else
                     needsStringPropertyCheck = true;
@@ -5216,20 +5208,13 @@ AccessGenerationResult InlineCacheCompiler::compile(const GCSafeConcurrentJSLock
 
                 jit.loadPtr(MacroAssembler::Address(propertyGPR, JSString::offsetOfValue()), m_scratchGPR);
 
-#if USE(BUN_JSC_ADDITIONS)
-                // Let inline fiber words through; generateWithGuard compares
-                // m_fiber by identity against the cached uid which may itself
-                // be a fiber word. True ropes still bail here.
-                m_failAndRepatch.append(jit.branchTestPtr(CCallHelpers::NonZero, m_scratchGPR, CCallHelpers::TrustedImm32(JSString::isRopeInPointer)));
-#else
                 m_failAndRepatch.append(jit.branchIfRopeStringImpl(m_scratchGPR));
-#endif
 
                 JIT_COMMENT(jit, "Cases start (needsStringPropertyCheck)");
                 for (unsigned i = keys.size(); i--;) {
                     fallThrough.link(&jit);
                     fallThrough.shrink(0);
-                    if (keys[i]->requiresIdentifierNameMatch() && !keys[i]->identifier().isSymbol())
+                    if (keys[i]->requiresIdentifierNameMatch() && !keys[i]->uid()->isSymbol())
                         generateWithGuard(i, keys[i].get(), fallThrough);
                 }
 
@@ -5258,7 +5243,7 @@ AccessGenerationResult InlineCacheCompiler::compile(const GCSafeConcurrentJSLock
                 for (unsigned i = keys.size(); i--;) {
                     fallThrough.link(&jit);
                     fallThrough.shrink(0);
-                    if (keys[i]->requiresIdentifierNameMatch() && keys[i]->identifier().isSymbol())
+                    if (keys[i]->requiresIdentifierNameMatch() && keys[i]->uid()->isSymbol())
                         generateWithGuard(i, keys[i].get(), fallThrough);
                 }
 
@@ -7730,7 +7715,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                                 switch (accessCase.m_type) {
                                 case AccessCase::GetGetter:
                                 case AccessCase::Load:
-                                    code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::GetByValWithSymbolLoadOwnPropertyHandler : CommonJITThunkID::GetByValWithStringLoadOwnPropertyHandler).retagged<JITStubRoutinePtrTag>();
+                                    code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolLoadOwnPropertyHandler : CommonJITThunkID::GetByValWithStringLoadOwnPropertyHandler).retagged<JITStubRoutinePtrTag>();
                                     break;
                                 case AccessCase::IndexedUndefinedKeyLoad:
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithUndefinedKeyLoadOwnPropertyHandler).retagged<JITStubRoutinePtrTag>();
@@ -7751,7 +7736,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                                 switch (accessCase.m_type) {
                                 case AccessCase::GetGetter:
                                 case AccessCase::Load:
-                                    code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::GetByValWithSymbolLoadPrototypePropertyHandler : CommonJITThunkID::GetByValWithStringLoadPrototypePropertyHandler).retagged<JITStubRoutinePtrTag>();
+                                    code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolLoadPrototypePropertyHandler : CommonJITThunkID::GetByValWithStringLoadPrototypePropertyHandler).retagged<JITStubRoutinePtrTag>();
                                     break;
                                 case AccessCase::IndexedUndefinedKeyLoad:
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithUndefinedKeyLoadPrototypePropertyHandler).retagged<JITStubRoutinePtrTag>();
@@ -7788,7 +7773,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             switch (accessCase.m_type) {
                             case AccessCase::Miss:
-                                code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::GetByValWithSymbolMissHandler : CommonJITThunkID::GetByValWithStringMissHandler).retagged<JITStubRoutinePtrTag>();
+                                code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolMissHandler : CommonJITThunkID::GetByValWithStringMissHandler).retagged<JITStubRoutinePtrTag>();
                                 break;
                             case AccessCase::IndexedUndefinedKeyMiss:
                                 code = vm.getCTIStub(CommonJITThunkID::GetByValWithUndefinedKeyMissHandler).retagged<JITStubRoutinePtrTag>();
@@ -7836,17 +7821,17 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             if (accessCase.m_type == AccessCase::CustomAccessorGetter) {
                                 if (Options::useDOMJIT() && access.domAttribute() && access.domAttribute()->domJIT) {
-                                    code = compileGetByDOMJITHandler(codeBlock, access.domAttribute()->domJIT, accessCase.identifier().isSymbol());
+                                    code = compileGetByDOMJITHandler(codeBlock, access.domAttribute()->domJIT, accessCase.uid()->isSymbol());
                                     if (!code)
                                         return AccessGenerationResult::GaveUp;
                                 } else {
-                                    if (accessCase.identifier().isSymbol())
+                                    if (accessCase.uid()->isSymbol())
                                         code = vm.getCTIStub(CommonJITThunkID::GetByValWithSymbolCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                                     else
                                         code = vm.getCTIStub(CommonJITThunkID::GetByValWithStringCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                                 }
                             } else {
-                                if (accessCase.identifier().isSymbol())
+                                if (accessCase.uid()->isSymbol())
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithSymbolCustomValueHandler).retagged<JITStubRoutinePtrTag>();
                                 else
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithStringCustomValueHandler).retagged<JITStubRoutinePtrTag>();
@@ -7868,7 +7853,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                                 currStructure = object->structure();
                             if (isValidOffset(accessCase.m_offset))
                                 currStructure->startWatchingPropertyForReplacements(vm, accessCase.offset());
-                            auto code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::GetByValWithSymbolGetterHandler : CommonJITThunkID::GetByValWithStringGetterHandler).retagged<JITStubRoutinePtrTag>();
+                            auto code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolGetterHandler : CommonJITThunkID::GetByValWithStringGetterHandler).retagged<JITStubRoutinePtrTag>();
                             auto stub = createPreCompiledICJITStubRoutine(WTF::move(code), vm, codeBlock);
                             connectWatchpointSets(stub.get(), WTF::move(watchedConditions), WTF::move(additionalWatchpointSets));
                             return finishPreCompiledCodeGeneration(WTF::move(stub));
@@ -7901,7 +7886,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                         MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                         switch (accessCase.m_type) {
                         case AccessCase::Replace:
-                            code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::PutByValWithSymbolReplaceHandler : CommonJITThunkID::PutByValWithStringReplaceHandler).retagged<JITStubRoutinePtrTag>();
+                            code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::PutByValWithSymbolReplaceHandler : CommonJITThunkID::PutByValWithStringReplaceHandler).retagged<JITStubRoutinePtrTag>();
                             break;
                         case AccessCase::IndexedUndefinedKeyReplace:
                             code = vm.getCTIStub(CommonJITThunkID::PutByValWithUndefinedKeyReplaceHandler).retagged<JITStubRoutinePtrTag>();
@@ -7948,7 +7933,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                         MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                         switch (accessCase.m_type) {
                         case AccessCase::Transition:
-                            if (accessCase.identifier().isSymbol())
+                            if (accessCase.uid()->isSymbol())
                                 code = selectTransitionHandler(CommonJITThunkID::PutByValWithSymbolTransitionNonAllocatingHandler, CommonJITThunkID::PutByValWithSymbolTransitionReallocatingOutOfLineHandler, CommonJITThunkID::PutByValWithSymbolTransitionNewlyAllocatingHandler, CommonJITThunkID::PutByValWithSymbolTransitionReallocatingHandler);
                             else
                                 code = selectTransitionHandler(CommonJITThunkID::PutByValWithStringTransitionNonAllocatingHandler, CommonJITThunkID::PutByValWithStringTransitionReallocatingOutOfLineHandler, CommonJITThunkID::PutByValWithStringTransitionNewlyAllocatingHandler, CommonJITThunkID::PutByValWithStringTransitionReallocatingHandler);
@@ -7988,12 +7973,12 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
 
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             if (accessCase.m_type == AccessCase::CustomAccessorSetter) {
-                                if (accessCase.identifier().isSymbol())
+                                if (accessCase.uid()->isSymbol())
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithSymbolCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                                 else
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithStringCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                             } else {
-                                if (accessCase.identifier().isSymbol())
+                                if (accessCase.uid()->isSymbol())
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithSymbolCustomValueHandler).retagged<JITStubRoutinePtrTag>();
                                 else
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithStringCustomValueHandler).retagged<JITStubRoutinePtrTag>();
@@ -8018,9 +8003,9 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
 
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             if (isStrict)
-                                code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::PutByValWithSymbolStrictSetterHandler : CommonJITThunkID::PutByValWithStringStrictSetterHandler).retagged<JITStubRoutinePtrTag>();
+                                code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::PutByValWithSymbolStrictSetterHandler : CommonJITThunkID::PutByValWithStringStrictSetterHandler).retagged<JITStubRoutinePtrTag>();
                             else
-                                code = vm.getCTIStub(accessCase.identifier().isSymbol() ? CommonJITThunkID::PutByValWithSymbolSloppySetterHandler : CommonJITThunkID::PutByValWithStringSloppySetterHandler).retagged<JITStubRoutinePtrTag>();
+                                code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::PutByValWithSymbolSloppySetterHandler : CommonJITThunkID::PutByValWithStringSloppySetterHandler).retagged<JITStubRoutinePtrTag>();
                             auto stub = createPreCompiledICJITStubRoutine(WTF::move(code), vm, codeBlock);
                             connectWatchpointSets(stub.get(), WTF::move(watchedConditions), WTF::move(additionalWatchpointSets));
                             return finishPreCompiledCodeGeneration(WTF::move(stub));
@@ -8044,7 +8029,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                     collectConditions(accessCase, watchedConditions, checkingConditions);
                     if (checkingConditions.isEmpty()) {
                         MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
-                        if (accessCase.identifier().isSymbol())
+                        if (accessCase.uid()->isSymbol())
                             code = vm.getCTIStub(accessCase.m_type == AccessCase::InHit ? CommonJITThunkID::InByValWithSymbolHitHandler : CommonJITThunkID::InByValWithSymbolMissHandler).retagged<JITStubRoutinePtrTag>();
                         else
                             code = vm.getCTIStub(accessCase.m_type == AccessCase::InHit ? CommonJITThunkID::InByValWithStringHitHandler : CommonJITThunkID::InByValWithStringMissHandler).retagged<JITStubRoutinePtrTag>();
@@ -8071,13 +8056,13 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                     CommonJITThunkID thunkID = CommonJITThunkID::DeleteByValWithStringDeleteHandler;
                     switch (accessCase.m_type) {
                     case AccessCase::Delete:
-                        thunkID = accessCase.identifier().isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteHandler : CommonJITThunkID::DeleteByValWithStringDeleteHandler;
+                        thunkID = accessCase.uid()->isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteHandler : CommonJITThunkID::DeleteByValWithStringDeleteHandler;
                         break;
                     case AccessCase::DeleteNonConfigurable:
-                        thunkID = accessCase.identifier().isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteNonConfigurableHandler : CommonJITThunkID::DeleteByValWithStringDeleteNonConfigurableHandler;
+                        thunkID = accessCase.uid()->isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteNonConfigurableHandler : CommonJITThunkID::DeleteByValWithStringDeleteNonConfigurableHandler;
                         break;
                     case AccessCase::DeleteMiss:
-                        thunkID = accessCase.identifier().isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteMissHandler : CommonJITThunkID::DeleteByValWithStringDeleteMissHandler;
+                        thunkID = accessCase.uid()->isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteMissHandler : CommonJITThunkID::DeleteByValWithStringDeleteMissHandler;
                         break;
                     default:
                         break;
@@ -8174,7 +8159,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
 #endif
             }
             m_failAndRepatch.append(notInt32);
-        } else if (accessCase.requiresIdentifierNameMatch() && !accessCase.identifier().isSymbol()) {
+        } else if (accessCase.requiresIdentifierNameMatch() && !accessCase.uid()->isSymbol()) {
             CCallHelpers::JumpList notString;
             GPRReg propertyGPR = m_propertyCache.propertyGPR();
             if (!m_propertyCache.propertyIsString) {
@@ -8189,7 +8174,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
             jit.loadPtr(MacroAssembler::Address(propertyGPR, JSString::offsetOfValue()), m_scratchGPR);
             m_failAndRepatch.append(jit.branchIfRopeStringImpl(m_scratchGPR));
             m_failAndRepatch.append(notString);
-        } else if (accessCase.requiresIdentifierNameMatch() && accessCase.identifier().isSymbol()) {
+        } else if (accessCase.requiresIdentifierNameMatch() && accessCase.uid()->isSymbol()) {
             CCallHelpers::JumpList notSymbol;
             if (!m_propertyCache.propertyIsSymbol) {
                 GPRReg propertyGPR = m_propertyCache.propertyGPR();
diff --git a/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h b/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
index f715242741b79..e3815c1141c17 100644
--- a/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
+++ b/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
@@ -28,9 +28,6 @@
 #include "CacheableIdentifier.h"
 
 #include "Identifier.h"
-#if USE(BUN_JSC_ADDITIONS)
-#include "InlinePropertyKey.h"
-#endif
 #include "JSCJSValueInlines.h"
 #include "JSCell.h"
 #include "VM.h"
@@ -63,6 +60,14 @@ inline CacheableIdentifier CacheableIdentifier::createFromSharedStub(UniquedStri
 
 inline CacheableIdentifier CacheableIdentifier::createFromCell(JSCell* i)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    // Resolve inline JSStrings so uid()/getValueImpl() see a real atom.
+    if (i->isString()) {
+        JSString* s = uncheckedDowncast<JSString>(i);
+        if (s->isInline())
+            s->resolveInlineToAtomString(nullptr);
+    }
+#endif
     return CacheableIdentifier(i);
 }
 
@@ -93,24 +98,12 @@ inline UniquedStringImpl* CacheableIdentifier::uid() const
         return &uncheckedDowncast<Symbol>(cell())->uid();
     ASSERT(isStringCell());
     JSString* string = uncheckedDowncast<JSString>(cell());
-#if USE(BUN_JSC_ADDITIONS)
-    // For an inline JSString cell the fiber word itself is the content-unique
-    // key; return it cast as UniquedStringImpl* so IC stubs can pointer-compare
-    // against the runtime string's m_fiber. Dereferencing this value must go
-    // through uidIsSymbol()/uidHash() (see InlinePropertyKey.h).
-    if (string->isInline())
-        return std::bit_cast<UniquedStringImpl*>(string->rawFiber());
-#endif
     return std::bit_cast<UniquedStringImpl*>(string->getValueImpl());
 }
 
 inline bool CacheableIdentifier::isSymbol() const
 {
-#if USE(BUN_JSC_ADDITIONS)
-    return m_bits && uidIsSymbol(uid());
-#else
     return m_bits && uid()->isSymbol();
-#endif
 }
 
 inline bool CacheableIdentifier::isPrivateName() const
@@ -120,11 +113,7 @@ inline bool CacheableIdentifier::isPrivateName() const
 
 inline unsigned CacheableIdentifier::hash() const
 {
-#if USE(BUN_JSC_ADDITIONS)
-    return uidHash(uid());
-#else
     return uid()->symbolAwareHash();
-#endif
 }
 
 inline bool CacheableIdentifier::isCacheableIdentifierCell(JSCell* cell)
@@ -135,10 +124,10 @@ inline bool CacheableIdentifier::isCacheableIdentifierCell(JSCell* cell)
         return false;
     JSString* string = uncheckedDowncast<JSString>(cell);
 #if USE(BUN_JSC_ADDITIONS)
-    // A 16-byte inline string's fiber word is content-unique and compares
-    // by identity against a runtime JSString's m_fiber; eligible for IC.
+    // Inline strings become cacheable after resolveInlineToAtomString; see
+    // getCacheableIdentifier below.
     if (string->isInline())
-        return string->length() <= JSString::maxInlineLength8;
+        return true;
 #endif
     if (const StringImpl* impl = string->tryGetValueImpl())
         return impl->isAtom();
@@ -160,8 +149,11 @@ inline GCOwnedDataScope<const UniquedStringImpl*> CacheableIdentifier::getCachea
         return { };
     JSString* string = uncheckedDowncast<JSString>(cell);
 #if USE(BUN_JSC_ADDITIONS)
-    if (string->isInline() && string->length() <= JSString::maxInlineLength8)
-        return { cell, std::bit_cast<const UniquedStringImpl*>(string->rawFiber()) };
+    // Resolve inline strings to atoms so the IC can cache them. The cell is
+    // mutated in place; subsequent accesses via InlineStringCache return the
+    // same (now-resolved) cell and hit the IC's atom-pointer compare.
+    if (string->isInline())
+        return { cell, string->resolveInlineToAtomString(nullptr) };
 #endif
     if (const StringImpl* impl = string->tryGetValueImpl(); impl && impl->isAtom())
         return { cell, static_cast<const AtomStringImpl*>(impl) };
@@ -188,11 +180,7 @@ inline bool CacheableIdentifier::isStringCell() const
 inline void CacheableIdentifier::ensureIsCell(VM& vm)
 {
     if (!isCell()) {
-#if USE(BUN_JSC_ADDITIONS)
-        if (uidIsSymbol(uid()))
-#else
         if (uid()->isSymbol())
-#endif
             setCellBits(Symbol::create(vm, static_cast<SymbolImpl&>(*uid())));
         else
             setCellBits(jsString(vm, String(static_cast<AtomStringImpl*>(uid()))));
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 5724df2200cc6..7b98f902a33e7 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -360,7 +360,6 @@ class JSString : public JSCell {
     JS_EXPORT_PRIVATE const String& resolveInline(JSGlobalObject*) const;
     JS_EXPORT_PRIVATE AtomStringImpl* resolveInlineToAtomString(JSGlobalObject*) const;
     JS_EXPORT_PRIVATE AtomStringImpl* resolveInlineToExistingAtomString() const;
-    ALWAYS_INLINE uintptr_t rawFiber() const { return m_fiber; }
 #endif
     ALWAYS_INLINE JSRopeString* asRope()
     {

From ca4be6758eae310788d4fafc8fdbd03e663e19f2 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 14:29:51 +0000
Subject: [PATCH 24/69] Identifier.h: guard include + uidHash/parseIndex shims
 (BUN_JSC_ADDITIONS)

---
 Source/JavaScriptCore/runtime/Identifier.h | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/Source/JavaScriptCore/runtime/Identifier.h b/Source/JavaScriptCore/runtime/Identifier.h
index c2df39e6c3254..3e86778a99d27 100644
--- a/Source/JavaScriptCore/runtime/Identifier.h
+++ b/Source/JavaScriptCore/runtime/Identifier.h
@@ -28,6 +28,10 @@
 #include <wtf/text/UniquedStringImpl.h>
 #include <wtf/text/WTFString.h>
 
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
+
 namespace JSC {
 
 class CallFrame;
@@ -214,12 +218,21 @@ inline bool Identifier::equal(const StringImpl* r, std::span<const char16_t> s)
 
 ALWAYS_INLINE std::optional<uint32_t> parseIndex(const Identifier& identifier)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    auto uid = identifier.impl();
+    if (!uid || uidIsSymbol(uid))
+        return std::nullopt;
+    if (isInlinePropertyKey(uid))
+        return std::nullopt;
+    return parseIndex(*uid);
+#else
     auto uid = identifier.impl();
     if (!uid)
         return std::nullopt;
     if (uid->isSymbol())
         return std::nullopt;
     return parseIndex(*uid);
+#endif
 }
 
 JSValue identifierToJSValue(VM&, const Identifier&);
@@ -232,7 +245,14 @@ JSValue identifierToSafePublicJSValue(VM&, const Identifier&);
 // crashes in code that somehow dangled a StringImpl.
 // https://bugs.webkit.org/show_bug.cgi?id=150137
 struct IdentifierRepHash : PtrHash<RefPtr<UniquedStringImpl>> {
-    static unsigned hash(const UniquedStringImpl* key) { return key->existingSymbolAwareHash(); }
+    static unsigned hash(const UniquedStringImpl* key)
+    {
+#if USE(BUN_JSC_ADDITIONS)
+        return uidHash(key);
+#else
+        return key->existingSymbolAwareHash();
+#endif
+    }
     static constexpr bool hasHashInValue = true;
 };
 

From 6a977c410daecf52740fbbeb8c89eb3c99f3663e Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 14:30:00 +0000
Subject: [PATCH 25/69] StructureInlines.h: guarded InlinePropertyKey include +
 uidHash shims

---
 Source/JavaScriptCore/runtime/StructureInlines.h | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/StructureInlines.h b/Source/JavaScriptCore/runtime/StructureInlines.h
index dafcbeaa73fd3..850a0db478da9 100644
--- a/Source/JavaScriptCore/runtime/StructureInlines.h
+++ b/Source/JavaScriptCore/runtime/StructureInlines.h
@@ -27,6 +27,9 @@
 
 #include "BigIntPrototype.h"
 #include "BrandedStructure.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
 #include "JSArrayBufferView.h"
 #include "JSGlobalObject.h"
 #include "JSObjectInlines.h"
@@ -271,7 +274,11 @@ inline PropertyOffset Structure::add(VM& vm, PropertyName propertyName, unsigned
 
     PropertyOffset newOffset = table->nextOffset(m_inlineCapacity);
 
+#if USE(BUN_JSC_ADDITIONS)
+    m_propertyHash = m_propertyHash ^ uidHash(rep);
+#else
     m_propertyHash = m_propertyHash ^ rep->existingSymbolAwareHash();
+#endif
     m_seenProperties.add(CompactPtr<UniquedStringImpl>::encode(rep));
 
     auto [offset, attribute, result] = table->add(vm, PropertyTableEntry(rep, newOffset, attributes));
@@ -429,7 +436,11 @@ ALWAYS_INLINE auto Structure::addOrReplacePropertyWithoutTransition(VM& vm, Prop
 
     PropertyOffset newOffset = table->nextOffset(m_inlineCapacity);
 
+#if USE(BUN_JSC_ADDITIONS)
+    m_propertyHash = m_propertyHash ^ uidHash(rep);
+#else
     m_propertyHash = m_propertyHash ^ rep->existingSymbolAwareHash();
+#endif
     m_seenProperties.add(CompactPtr<UniquedStringImpl>::encode(rep));
 
     auto [offset, attributes, result] = table->addAfterFind(vm, PropertyTableEntry(rep, newOffset, newAttributes), WTF::move(findResult));

From b6e195ac005260915557a080f0618e1b0ba83ecb Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 14:30:01 +0000
Subject: [PATCH 26/69] HasOwnPropertyCache: guard hash() with
 InlinePropertyKey shim

---
 Source/JavaScriptCore/runtime/HasOwnPropertyCache.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h b/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h
index 490d79483a7d7..d6d6fad989039 100644
--- a/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h
+++ b/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h
@@ -30,6 +30,10 @@
 #include "Structure.h"
 #include <wtf/UniqueRef.h>
 
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
+
 WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
 
 namespace JSC {
@@ -70,7 +74,13 @@ class alignas(8) HasOwnPropertyCache {
 
     ALWAYS_INLINE static uint32_t hash(StructureID structureID, UniquedStringImpl* impl)
     {
+#if USE(BUN_JSC_ADDITIONS)
+        if (isInlinePropertyKey(impl))
+            return std::bit_cast<uint32_t>(structureID) + inlinePropertyKeyHash(inlinePropertyKeyWord(impl));
+        return std::bit_cast<uint32_t>(structureID) + impl->hash();
+#else
         return std::bit_cast<uint32_t>(structureID) + impl->hash();
+#endif
     }
 
     ALWAYS_INLINE std::optional<bool> get(Structure* structure, PropertyName propName)

From b924084b1fc5333f801026c7f3657169f4439055 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 14:30:17 +0000
Subject: [PATCH 27/69] StructureTransitionTable.h: inline-key include, ASSERT
 relax, static_assert

---
 .../runtime/StructureTransitionTable.h               | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/StructureTransitionTable.h b/Source/JavaScriptCore/runtime/StructureTransitionTable.h
index 44c577253e357..e081ec541fc0e 100644
--- a/Source/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/Source/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -30,6 +30,9 @@
 #include "WeakGCMap.h"
 #include <wtf/HashFunctions.h>
 #include <wtf/text/UniquedStringImpl.h>
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
 
 namespace JSC {
 
@@ -187,6 +190,11 @@ class StructureTransitionTable {
             static constexpr unsigned transitionKindShift = 56;
             static constexpr uintptr_t stringMask = (1ULL << attributesShift) - 1;
             static constexpr uintptr_t hashTableDeletedValue = 0x2;
+#if USE(BUN_JSC_ADDITIONS)
+            // Fiber words share bit 1 with hashTableDeletedValue but always carry
+            // >=2 payload bytes, so the encoded word can never equal exactly 0x2.
+            static_assert(JSC::inlinePropertyKeyTag == hashTableDeletedValue, "");
+#endif
             static_assert(sizeof(TransitionPropertyAttributes) * 8 <= 8);
             static_assert(sizeof(TransitionKind) * 8 <= 8);
             static_assert(hashTableDeletedValue < 8);
@@ -197,7 +205,11 @@ class StructureTransitionTable {
                 : m_encodedData(impl.raw() | (static_cast<uintptr_t>(attributes) << attributesShift) | (static_cast<uintptr_t>(transitionKind) << transitionKindShift))
             {
                 ASSERT(impl == this->impl());
+#if USE(BUN_JSC_ADDITIONS)
+                ASSERT(isInlinePropertyKey(impl.raw()) || roundUpToMultipleOf<8>(impl.raw()) == impl.raw());
+#else
                 ASSERT(roundUpToMultipleOf<8>(impl.raw()) == impl.raw());
+#endif
                 ASSERT(attributes <= UINT8_MAX);
                 ASSERT(attributes == this->attributes());
                 ASSERT(transitionKind != TransitionKind::Unknown);

From 8e683b975127e2380f75eb99a18d9943c7e5da28 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 14:30:19 +0000
Subject: [PATCH 28/69] MegamorphicCache.h: guarded InlinePropertyKey include +
 uidHash shims

---
 Source/JavaScriptCore/runtime/MegamorphicCache.h | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/MegamorphicCache.h b/Source/JavaScriptCore/runtime/MegamorphicCache.h
index 06d63b1cbd4c3..bf9ba79d1cf51 100644
--- a/Source/JavaScriptCore/runtime/MegamorphicCache.h
+++ b/Source/JavaScriptCore/runtime/MegamorphicCache.h
@@ -28,6 +28,10 @@
 #include "Structure.h"
 #include <wtf/TZoneMalloc.h>
 
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
+
 namespace JSC {
 
 DECLARE_ALLOCATOR_WITH_HEAP_IDENTIFIER(MegamorphicCache);
@@ -170,7 +174,11 @@ class MegamorphicCache {
     ALWAYS_INLINE static uint32_t primaryHash(StructureID structureID, UniquedStringImpl* uid)
     {
         uint32_t sid = std::bit_cast<uint32_t>(structureID);
+#if USE(BUN_JSC_ADDITIONS)
+        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift2)) + uidHash(uid);
+#else
         return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift2)) + uid->hash();
+#endif
     }
 
     ALWAYS_INLINE static uint32_t secondaryHash(StructureID structureID, UniquedStringImpl* uid)
@@ -182,7 +190,11 @@ class MegamorphicCache {
     ALWAYS_INLINE static uint32_t storeCachePrimaryHash(StructureID structureID, UniquedStringImpl* uid)
     {
         uint32_t sid = std::bit_cast<uint32_t>(structureID);
+#if USE(BUN_JSC_ADDITIONS)
+        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift4)) + uidHash(uid);
+#else
         return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift4)) + uid->hash();
+#endif
     }
 
     ALWAYS_INLINE static uint32_t storeCacheSecondaryHash(StructureID structureID, UniquedStringImpl* uid)
@@ -194,7 +206,11 @@ class MegamorphicCache {
     ALWAYS_INLINE static uint32_t hasCachePrimaryHash(StructureID structureID, UniquedStringImpl* uid)
     {
         uint32_t sid = std::bit_cast<uint32_t>(structureID);
+#if USE(BUN_JSC_ADDITIONS)
+        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift6)) + uidHash(uid);
+#else
         return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift6)) + uid->hash();
+#endif
     }
 
     ALWAYS_INLINE static uint32_t hasCacheSecondaryHash(StructureID structureID, UniquedStringImpl* uid)

From 3d426bc518500ebd4c4832d6f015228f5f89818b Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 14:30:20 +0000
Subject: [PATCH 29/69] PropertyTable: InlinePropertyKey shims for
 ASSERT/ref/deref

---
 .../JavaScriptCore/runtime/PropertyTable.cpp  | 12 ++++++++++++
 Source/JavaScriptCore/runtime/PropertyTable.h | 19 +++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/PropertyTable.cpp b/Source/JavaScriptCore/runtime/PropertyTable.cpp
index e059be337f4f1..59176b5ee20cb 100644
--- a/Source/JavaScriptCore/runtime/PropertyTable.cpp
+++ b/Source/JavaScriptCore/runtime/PropertyTable.cpp
@@ -85,7 +85,11 @@ PropertyTable::PropertyTable(VM& vm, const PropertyTable& other)
     memcpy(std::bit_cast<void*>(m_indexVector & indexVectorMask), std::bit_cast<void*>(other.m_indexVector & indexVectorMask), dataSize(isCompact()));
 
     forEachProperty([&](auto& entry) {
+#if USE(BUN_JSC_ADDITIONS)
+        uidRef(entry.key());
+#else
         entry.key()->ref();
+#endif
         return IterationStatus::Continue;
     });
 
@@ -114,7 +118,11 @@ PropertyTable::PropertyTable(VM& vm, unsigned initialCapacity, const PropertyTab
         other.forEachProperty([&](auto& entry) {
             ASSERT(canInsert(entry));
             reinsert(vector, table, entry);
+#if USE(BUN_JSC_ADDITIONS)
+            uidRef(entry.key());
+#else
             entry.key()->ref();
+#endif
             return IterationStatus::Continue;
         });
     });
@@ -150,7 +158,11 @@ void PropertyTable::destroy(JSCell* cell)
 PropertyTable::~PropertyTable()
 {
     forEachProperty([&](auto& entry) {
+#if USE(BUN_JSC_ADDITIONS)
+        uidDeref(entry.key());
+#else
         entry.key()->deref();
+#endif
         return IterationStatus::Continue;
     });
     destroyIndexVector(m_indexVector);
diff --git a/Source/JavaScriptCore/runtime/PropertyTable.h b/Source/JavaScriptCore/runtime/PropertyTable.h
index fbbe734b1f83c..f7f5ec4ac3769 100644
--- a/Source/JavaScriptCore/runtime/PropertyTable.h
+++ b/Source/JavaScriptCore/runtime/PropertyTable.h
@@ -30,6 +30,9 @@
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
 
 #define DUMP_PROPERTYMAP_STATS 0
 #define DUMP_PROPERTYMAP_COLLISIONS 0
@@ -335,7 +338,11 @@ PropertyTable::FindResult PropertyTable::findImpl(const Index* indexVector, cons
 inline PropertyTable::FindResult PropertyTable::find(const KeyType& key)
 {
     ASSERT(key);
+#if USE(BUN_JSC_ADDITIONS)
+    ASSERT(isInlinePropertyKey(key) || key->isAtom() || key->isSymbol());
+#else
     ASSERT(key->isAtom() || key->isSymbol());
+#endif
     return withIndexVector([&](auto* vector) {
         return findImpl(vector, tableFromIndexVector(vector), key);
     });
@@ -344,7 +351,11 @@ inline PropertyTable::FindResult PropertyTable::find(const KeyType& key)
 inline std::tuple<PropertyOffset, unsigned> PropertyTable::get(const KeyType& key)
 {
     ASSERT(key);
+#if USE(BUN_JSC_ADDITIONS)
+    ASSERT(isInlinePropertyKey(key) || key->isAtom() || key->isSymbol());
+#else
     ASSERT(key->isAtom() || key->isSymbol());
+#endif
     ASSERT(key != PROPERTY_MAP_DELETED_ENTRY_KEY);
 
     if (!m_keyCount)
@@ -372,7 +383,11 @@ ALWAYS_INLINE std::tuple<PropertyOffset, unsigned, bool> PropertyTable::addAfter
 #endif
 
     // Ref the key
+#if USE(BUN_JSC_ADDITIONS)
+    uidRef(entry.key());
+#else
     entry.key()->ref();
+#endif
 
     // ensure capacity is available.
     if (!canInsert(entry)) {
@@ -408,7 +423,11 @@ inline void PropertyTable::remove(VM& vm, KeyType key, unsigned entryIndex, unsi
         vector[index] = deletedEntryIndex();
         tableFromIndexVector(vector)[entryIndex - 1].setKey(PROPERTY_MAP_DELETED_ENTRY_KEY);
     });
+#if USE(BUN_JSC_ADDITIONS)
+    uidDeref(key);
+#else
     key->deref();
+#endif
 
     ASSERT(m_keyCount >= 1);
     --m_keyCount;

From c0ccc0b6f0a800ee68983088caea785f74ecce00 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 14:30:22 +0000
Subject: [PATCH 30/69] InlinePropertyKey phase A: tag-aware deref shims at the
 hash/isSymbol/ref/deref chokepoints

---
 Source/JavaScriptCore/runtime/PropertyName.h | 33 ++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/PropertyName.h b/Source/JavaScriptCore/runtime/PropertyName.h
index d56fbde7f3dc0..77484a94d9e38 100644
--- a/Source/JavaScriptCore/runtime/PropertyName.h
+++ b/Source/JavaScriptCore/runtime/PropertyName.h
@@ -31,6 +31,10 @@
 #include "PrivateName.h"
 #include <wtf/dtoa.h>
 
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
+
 WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
 
 namespace JSC {
@@ -72,12 +76,20 @@ class PropertyName {
 
     bool isSymbol() const
     {
+#if USE(BUN_JSC_ADDITIONS)
+        return m_impl && uidIsSymbol(m_impl);
+#else
         return m_impl && m_impl->isSymbol();
+#endif
     }
 
     bool isPrivateName() const
     {
+#if USE(BUN_JSC_ADDITIONS)
+        return m_impl && !isInlinePropertyKey(m_impl) && m_impl->isSymbol() && static_cast<const SymbolImpl*>(m_impl)->isPrivate();
+#else
         return isSymbol() && static_cast<const SymbolImpl*>(m_impl)->isPrivate();
+#endif
     }
 
     UniquedStringImpl* uid() const
@@ -87,7 +99,11 @@ class PropertyName {
 
     AtomStringImpl* publicName() const
     {
+#if USE(BUN_JSC_ADDITIONS)
+        return (!m_impl || uidIsSymbol(m_impl)) ? nullptr : static_cast<AtomStringImpl*>(m_impl);
+#else
         return (!m_impl || m_impl->isSymbol()) ? nullptr : static_cast<AtomStringImpl*>(m_impl);
+#endif
     }
 
     void dump(PrintStream& out) const
@@ -115,17 +131,30 @@ inline bool operator==(PropertyName a, PropertyName b)
 
 inline bool operator==(PropertyName a, const char* b)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInlinePropertyKey(a.uid()))
+        return false;
+#endif
     return equal(a.uid(), b);
 }
 
 ALWAYS_INLINE std::optional<uint32_t> parseIndex(PropertyName propertyName)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    auto uid = propertyName.uid();
+    if (!uid || uidIsSymbol(uid))
+        return std::nullopt;
+    if (isInlinePropertyKey(uid))
+        return std::nullopt;
+    return parseIndex(*uid);
+#else
     auto uid = propertyName.uid();
     if (!uid)
         return std::nullopt;
     if (uid->isSymbol())
         return std::nullopt;
     return parseIndex(*uid);
+#endif
 }
 
 template<typename CharacterType>
@@ -157,6 +186,10 @@ ALWAYS_INLINE bool isCanonicalNumericIndexString(UniquedStringImpl* propertyName
 {
     if (!propertyName)
         return false;
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInlinePropertyKey(propertyName))
+        return false;
+#endif
     if (propertyName->isSymbol())
         return false;
     if (!propertyName->length())

From 76471448dccfe5b9933233c727dd479a0c49ffe0 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 15:31:22 +0000
Subject: [PATCH 31/69] MegamorphicCache: keep uid->hash() on non-fiber path
 for JIT sync

---
 Source/JavaScriptCore/runtime/MegamorphicCache.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/MegamorphicCache.h b/Source/JavaScriptCore/runtime/MegamorphicCache.h
index bf9ba79d1cf51..dc0b65522baa4 100644
--- a/Source/JavaScriptCore/runtime/MegamorphicCache.h
+++ b/Source/JavaScriptCore/runtime/MegamorphicCache.h
@@ -175,7 +175,7 @@ class MegamorphicCache {
     {
         uint32_t sid = std::bit_cast<uint32_t>(structureID);
 #if USE(BUN_JSC_ADDITIONS)
-        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift2)) + uidHash(uid);
+        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift2)) + (isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash());
 #else
         return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift2)) + uid->hash();
 #endif
@@ -191,7 +191,7 @@ class MegamorphicCache {
     {
         uint32_t sid = std::bit_cast<uint32_t>(structureID);
 #if USE(BUN_JSC_ADDITIONS)
-        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift4)) + uidHash(uid);
+        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift4)) + (isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash());
 #else
         return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift4)) + uid->hash();
 #endif
@@ -207,7 +207,7 @@ class MegamorphicCache {
     {
         uint32_t sid = std::bit_cast<uint32_t>(structureID);
 #if USE(BUN_JSC_ADDITIONS)
-        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift6)) + uidHash(uid);
+        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift6)) + (isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash());
 #else
         return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift6)) + uid->hash();
 #endif

From 766c5e168547e2425043c264661c16c4627d4adb Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 18:31:14 +0000
Subject: [PATCH 32/69] Phase 3 (partial): view() instead of value() in
 replaceAll-cache and tryReplaceOneChar

StringPrototypeInlines.h replaceAllWithCacheUsingRegExpSearchThreeArguments
read is8Bit()+length() then immediately wrapped the String in StringView
for getCharacters; use view() so inline replacer results are not
materialized. tryReplaceOneCharUsingString only reads length()/find('$')
on the search/replacement strings.
---
 .../runtime/StringPrototypeInlines.h          | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/StringPrototypeInlines.h b/Source/JavaScriptCore/runtime/StringPrototypeInlines.h
index 80090d1170020..3471ce7fc3bd5 100644
--- a/Source/JavaScriptCore/runtime/StringPrototypeInlines.h
+++ b/Source/JavaScriptCore/runtime/StringPrototypeInlines.h
@@ -537,11 +537,19 @@ inline JSString* tryReplaceOneCharUsingString(JSGlobalObject* globalObject, JSSt
         return nullptr;
 
     RETURN_IF_EXCEPTION(scope, nullptr);
+#if USE(BUN_JSC_ADDITIONS)
+    auto searchString = search->view(globalObject);
+#else
     auto searchString = search->value(globalObject);
+#endif
     if (searchString->length() != 1)
         RELEASE_AND_RETURN(scope, nullptr);
 
+#if USE(BUN_JSC_ADDITIONS)
+    auto replaceString = replacement->view(globalObject);
+#else
     auto replaceString = replacement->value(globalObject);
+#endif
     RETURN_IF_EXCEPTION(scope, nullptr);
     if constexpr (check == DollarCheck::Yes) {
         if (replaceString->find('$') != notFound)
@@ -854,7 +862,13 @@ static ALWAYS_INLINE JSString* replaceAllWithCacheUsingRegExpSearchThreeArgument
             auto jsString = jsResult.toString(globalObject);
             RETURN_IF_EXCEPTION_WITH_TRAPS_DEFERRED(scope, nullptr);
 
+#if USE(BUN_JSC_ADDITIONS)
+            // Only is8Bit()+length() are read; use view() so inline results
+            // are not materialized to a StringImpl here.
+            auto string = jsString->view(globalObject);
+#else
             auto string = jsString->value(globalObject);
+#endif
             RETURN_IF_EXCEPTION_WITH_TRAPS_DEFERRED(scope, nullptr);
 
             replacementsAre8Bit &= string->is8Bit();
@@ -890,8 +904,13 @@ static ALWAYS_INLINE JSString* replaceAllWithCacheUsingRegExpSearchThreeArgument
             substring.getCharacters8(buffer.subspan(bufferPos));
             bufferPos += substring.length();
 
+#if USE(BUN_JSC_ADDITIONS)
+            auto replacement = asString(slot)->view(globalObject);
+            StringView { replacement }.getCharacters8(buffer.subspan(bufferPos));
+#else
             auto replacement = asString(slot)->value(globalObject);
             StringView { replacement }.getCharacters8(buffer.subspan(bufferPos));
+#endif
             bufferPos += replacement->length();
 
             ++index;
@@ -925,8 +944,13 @@ static ALWAYS_INLINE JSString* replaceAllWithCacheUsingRegExpSearchThreeArgument
         substring.getCharacters(buffer.subspan(bufferPos));
         bufferPos += substring.length();
 
+#if USE(BUN_JSC_ADDITIONS)
+        auto replacement = asString(slot)->view(globalObject);
+        StringView { replacement }.getCharacters(buffer.subspan(bufferPos));
+#else
         auto replacement = asString(slot)->value(globalObject);
         StringView { replacement }.getCharacters(buffer.subspan(bufferPos));
+#endif
         bufferPos += replacement->length();
 
         ++index;

From bdfe86022080a7bfee706405730e4ea55c2c3ed6 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 18:57:32 +0000
Subject: [PATCH 33/69] InlinePropertyKey shims: [[unlikely]] on the fiber-word
 branch

No fiber words flow yet; the tag check should compile as a
predicted-not-taken branch.
---
 Source/JavaScriptCore/runtime/InlinePropertyKey.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/InlinePropertyKey.h b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
index 05966903f16b1..3f66087052f30 100644
--- a/Source/JavaScriptCore/runtime/InlinePropertyKey.h
+++ b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
@@ -70,34 +70,34 @@ ALWAYS_INLINE unsigned inlinePropertyKeyHash(uintptr_t word)
 
 ALWAYS_INLINE bool uidIsSymbol(const UniquedStringImpl* impl)
 {
-    if (isInlinePropertyKey(impl))
+    if (isInlinePropertyKey(impl)) [[unlikely]]
         return false;
     return impl->isSymbol();
 }
 
 ALWAYS_INLINE unsigned uidHash(const UniquedStringImpl* impl)
 {
-    if (isInlinePropertyKey(impl))
+    if (isInlinePropertyKey(impl)) [[unlikely]]
         return inlinePropertyKeyHash(inlinePropertyKeyWord(impl));
     return impl->existingSymbolAwareHash();
 }
 
 ALWAYS_INLINE unsigned uidLength(const UniquedStringImpl* impl)
 {
-    if (isInlinePropertyKey(impl))
+    if (isInlinePropertyKey(impl)) [[unlikely]]
         return inlinePropertyKeyLength(inlinePropertyKeyWord(impl));
     return impl->length();
 }
 
 ALWAYS_INLINE void uidRef(UniquedStringImpl* impl)
 {
-    if (!isInlinePropertyKey(impl))
+    if (!isInlinePropertyKey(impl)) [[likely]]
         impl->ref();
 }
 
 ALWAYS_INLINE void uidDeref(UniquedStringImpl* impl)
 {
-    if (!isInlinePropertyKey(impl))
+    if (!isInlinePropertyKey(impl)) [[likely]]
         impl->deref();
 }
 

From 96decd2dc15e302010a74eefcf561a521bb32eee Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 23:22:07 +0000
Subject: [PATCH 34/69] InlinePropertyKey phase 3: remaining value()->view()
 swaps

StringPrototype.cpp: 709 (replace flags), 1608 (replaceAll flags), 1956 (trimString), 2365 (isWellFormed).

RegExpPrototype.cpp: 168, 212, 338, 422, 427, 1033, 1267, 1352, 1402, 1518.

All swaps gated under #if USE(BUN_JSC_ADDITIONS) with #else preserving the original verbatim. Each site only consumes chars/length/is8Bit/contains, so GCOwnedDataScope<StringView> is drop-in.
---
 .../runtime/RegExpPrototype.cpp               | 101 ++++++++++++++++++
 .../runtime/StringPrototype.cpp               |  67 ++++++++++++
 2 files changed, 168 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
index 28a905f9fdd6b..3c95781edf636 100644
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -165,7 +165,11 @@ JSC_DEFINE_HOST_FUNCTION(regExpProtoFuncTest, (JSGlobalObject* globalObject, Cal
         auto* regExp = dynamicDowncast<RegExpObject>(thisValue);
         if (!regExp) [[unlikely]]
             return throwVMTypeError(globalObject, scope, "Builtin RegExp exec can only be called on a RegExp object"_s);
+#if USE(BUN_JSC_ADDITIONS)
+        auto strValue = str->view(globalObject);
+#else
         auto strValue = str->value(globalObject);
+#endif
         RETURN_IF_EXCEPTION(scope, { });
         if (!strValue->isNull() && regExp->getLastIndex().isNumber()) [[likely]]
             RELEASE_AND_RETURN(scope, JSValue::encode(jsBoolean(regExp->test(globalObject, str))));
@@ -209,6 +213,19 @@ static JSValue regExpMatchSlow(JSGlobalObject* globalObject, JSObject* thisObjec
     // 4. Let flags be ? ToString(? Get(regexp, "flags")).
     JSValue flagsValue = thisObject->get(globalObject, vm.propertyNames->flags);
     RETURN_IF_EXCEPTION(scope, { });
+#if USE(BUN_JSC_ADDITIONS)
+    auto* flagsJSString = flagsValue.toString(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+    auto flags = flagsJSString->view(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    // 5. If flags does not contain "g", return ? RegExpExec(regexp, string).
+    if (!flags->contains('g'))
+        RELEASE_AND_RETURN(scope, regExpExec(globalObject, thisObject, string));
+
+    // 6. If flags contains "u" or flags contains "v", let fullUnicode be true; else let fullUnicode be false.
+    bool fullUnicode = flags->contains('u') || flags->contains('v');
+#else
     String flags = flagsValue.toWTFString(globalObject);
     RETURN_IF_EXCEPTION(scope, { });
 
@@ -218,6 +235,7 @@ static JSValue regExpMatchSlow(JSGlobalObject* globalObject, JSObject* thisObjec
 
     // 6. If flags contains "u" or flags contains "v", let fullUnicode be true; else let fullUnicode be false.
     bool fullUnicode = flags.contains('u') || flags.contains('v');
+#endif
 
     // 7. Perform ? Set(regexp, "lastIndex", +0𝔽, true).
     PutPropertySlot lastIndexSlot(thisObject, true);
@@ -335,8 +353,21 @@ JSC_DEFINE_HOST_FUNCTION(regExpProtoFuncCompile, (JSGlobalObject* globalObject,
         String pattern = arg0.isUndefined() ? emptyString() : arg0.toWTFString(globalObject);
         RETURN_IF_EXCEPTION(scope, encodedJSValue());
 
+#if USE(BUN_JSC_ADDITIONS)
+        std::optional<OptionSet<Yarr::Flags>> flags;
+        if (arg1.isUndefined())
+            flags = OptionSet<Yarr::Flags> { };
+        else {
+            auto* arg1String = arg1.toString(globalObject);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            auto arg1View = arg1String->view(globalObject);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            flags = Yarr::parseFlags(StringView(arg1View));
+        }
+#else
         auto flags = arg1.isUndefined() ? std::make_optional(OptionSet<Yarr::Flags> { }) : Yarr::parseFlags(arg1.toWTFString(globalObject));
         RETURN_IF_EXCEPTION(scope, encodedJSValue());
+#endif
         if (!flags)
             return throwVMError(globalObject, scope, createSyntaxError(globalObject, "Invalid flags supplied to RegExp constructor."_s));
 
@@ -419,6 +450,21 @@ JSC_DEFINE_HOST_FUNCTION(regExpProtoFuncToString, (JSGlobalObject* globalObject,
 
     JSValue sourceValue = thisObject->get(globalObject, vm.propertyNames->source);
     RETURN_IF_EXCEPTION(scope, { });
+#if USE(BUN_JSC_ADDITIONS)
+    auto* sourceJSString = sourceValue.toString(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+    auto source = sourceJSString->view(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    JSValue flagsValue = thisObject->get(globalObject, vm.propertyNames->flags);
+    RETURN_IF_EXCEPTION(scope, { });
+    auto* flagsJSString = flagsValue.toString(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+    auto flags = flagsJSString->view(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    RELEASE_AND_RETURN(scope, JSValue::encode(jsMakeNontrivialString(globalObject, '/', StringView(source), '/', StringView(flags))));
+#else
     String source = sourceValue.toWTFString(globalObject);
     RETURN_IF_EXCEPTION(scope, { });
 
@@ -428,6 +474,7 @@ JSC_DEFINE_HOST_FUNCTION(regExpProtoFuncToString, (JSGlobalObject* globalObject,
     RETURN_IF_EXCEPTION(scope, { });
 
     RELEASE_AND_RETURN(scope, JSValue::encode(jsMakeNontrivialString(globalObject, '/', source, '/', flags)));
+#endif
 }
 
 JSC_DEFINE_HOST_FUNCTION(regExpProtoGetterGlobal, (JSGlobalObject* globalObject, CallFrame* callFrame))
@@ -1030,6 +1077,20 @@ JSValue regExpSplitSlow(JSGlobalObject* globalObject, JSObject* thisObject, JSSt
     // 5. Let flags be ? ToString(? Get(regexp, "flags")).
     JSValue flagsValue = thisObject->get(globalObject, vm.propertyNames->flags);
     RETURN_IF_EXCEPTION(scope, { });
+#if USE(BUN_JSC_ADDITIONS)
+    auto* flagsJSString = flagsValue.toString(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+    auto flags = flagsJSString->view(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    // 6. If flags contains "u" or flags contains "v", let unicodeMatching be true.
+    // 7. Else, let unicodeMatching be false.
+    bool unicodeMatching = flags->contains('u') || flags->contains('v');
+
+    // 8. If flags contains "y", let newFlags be flags.
+    // 9. Else, let newFlags be the string-concatenation of flags and "y".
+    String newFlags = flags->contains('y') ? flags->toString() : tryMakeString(StringView(flags), 'y');
+#else
     String flags = flagsValue.toWTFString(globalObject);
     RETURN_IF_EXCEPTION(scope, { });
 
@@ -1040,6 +1101,7 @@ JSValue regExpSplitSlow(JSGlobalObject* globalObject, JSObject* thisObject, JSSt
     // 8. If flags contains "y", let newFlags be flags.
     // 9. Else, let newFlags be the string-concatenation of flags and "y".
     String newFlags = flags.contains('y') ? flags : tryMakeString(flags, 'y');
+#endif
     if (newFlags.isNull()) [[unlikely]] {
         throwOutOfMemoryError(globalObject, scope);
         return { };
@@ -1264,9 +1326,17 @@ static inline String getSubstitution(JSGlobalObject* globalObject, const String&
                     JSValue capture = namedCaptures->get(globalObject, Identifier::fromString(vm, groupName));
                     RETURN_IF_EXCEPTION(scope, String());
                     if (!capture.isUndefined()) {
+#if USE(BUN_JSC_ADDITIONS)
+                        auto* captureJSString = capture.toString(globalObject);
+                        RETURN_IF_EXCEPTION(scope, String());
+                        auto captureString = captureJSString->view(globalObject);
+                        RETURN_IF_EXCEPTION(scope, String());
+                        result.append(StringView(captureString));
+#else
                         String captureString = capture.toWTFString(globalObject);
                         RETURN_IF_EXCEPTION(scope, String());
                         result.append(captureString);
+#endif
                     }
                     start = groupNameEndIndex + 1;
                     break;
@@ -1349,6 +1419,22 @@ JSValue regExpReplaceGeneric(JSGlobalObject* globalObject, JSObject* thisObject,
     // 7. Let flags be ? ToString(? Get(rx, "flags")).
     JSValue flagsValue = thisObject->get(globalObject, vm.propertyNames->flags);
     RETURN_IF_EXCEPTION(scope, { });
+#if USE(BUN_JSC_ADDITIONS)
+    auto* flagsJSString = flagsValue.toString(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+    auto flags = flagsJSString->view(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    // 8. If flags contains "g", let global be true. Else, let global be false.
+    bool global = flags->contains('g');
+
+    // 9. If global is true, then
+    //    a. If flags contains "u" or "v", let fullUnicode be true. Else, let fullUnicode be false.
+    //    b. Perform ? Set(rx, "lastIndex", +0F, true).
+    bool fullUnicode = false;
+    if (global) {
+        fullUnicode = flags->contains('u') || flags->contains('v');
+#else
     String flags = flagsValue.toWTFString(globalObject);
     RETURN_IF_EXCEPTION(scope, { });
 
@@ -1361,6 +1447,7 @@ JSValue regExpReplaceGeneric(JSGlobalObject* globalObject, JSObject* thisObject,
     bool fullUnicode = false;
     if (global) {
         fullUnicode = flags.contains('u') || flags.contains('v');
+#endif
         PutPropertySlot slot(thisObject, true);
         thisObject->methodTable()->put(thisObject, globalObject, vm.propertyNames->lastIndex, jsNumber(0), slot);
         RETURN_IF_EXCEPTION(scope, { });
@@ -1399,6 +1486,19 @@ JSValue regExpReplaceGeneric(JSGlobalObject* globalObject, JSObject* thisObject,
         JSObject* resultObject = asObject(result);
         JSValue matchValue = resultObject->get(globalObject, static_cast<unsigned>(0));
         RETURN_IF_EXCEPTION(scope, { });
+#if USE(BUN_JSC_ADDITIONS)
+        auto* matchJSString = matchValue.toString(globalObject);
+        RETURN_IF_EXCEPTION(scope, { });
+        auto matchStr = matchJSString->view(globalObject);
+        RETURN_IF_EXCEPTION(scope, { });
+
+        //         2. If matchStr is the empty String, then
+        //            a. Let thisIndex be R(? ToLength(? Get(rx, "lastIndex"))).
+        //            b. If flags contains "u" or flags contains "v", let fullUnicode be true; otherwise let fullUnicode be false.
+        //            c. Let nextIndex be AdvanceStringIndex(S, thisIndex, fullUnicode).
+        //            d. Perform ? Set(rx, "lastIndex", F(nextIndex), true).
+        if (matchStr->isEmpty()) {
+#else
         String matchStr = matchValue.toWTFString(globalObject);
         RETURN_IF_EXCEPTION(scope, { });
 
@@ -1408,6 +1508,7 @@ JSValue regExpReplaceGeneric(JSGlobalObject* globalObject, JSObject* thisObject,
         //            c. Let nextIndex be AdvanceStringIndex(S, thisIndex, fullUnicode).
         //            d. Perform ? Set(rx, "lastIndex", F(nextIndex), true).
         if (matchStr.isEmpty()) {
+#endif
             JSValue lastIndexValue = thisObject->get(globalObject, vm.propertyNames->lastIndex);
             RETURN_IF_EXCEPTION(scope, { });
             uint64_t thisIndex = lastIndexValue.toLength(globalObject);
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index 1ccfa341ebcbd..0024b2dc252ae 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -706,10 +706,19 @@ JSC_DEFINE_HOST_FUNCTION(stringProtoFuncReplaceAll, (JSGlobalObject* globalObjec
             JSValue flagsValue = asObject(searchValue)->get(globalObject, vm.propertyNames->flags);
             RETURN_IF_EXCEPTION(scope, { });
 
+#if USE(BUN_JSC_ADDITIONS)
+            auto* flagsJSString = flagsValue.toString(globalObject);
+            RETURN_IF_EXCEPTION(scope, { });
+            auto flags = flagsJSString->view(globalObject);
+            RETURN_IF_EXCEPTION(scope, { });
+            if (!flags->contains('g')) [[unlikely]]
+                return throwVMTypeError(globalObject, scope, "String.prototype.replaceAll argument must not be a non-global regular expression"_s);
+#else
             String flags = flagsValue.toWTFString(globalObject);
             RETURN_IF_EXCEPTION(scope, { });
             if (!flags.contains('g')) [[unlikely]]
                 return throwVMTypeError(globalObject, scope, "String.prototype.replaceAll argument must not be a non-global regular expression"_s);
+#endif
         }
 
         JSObject* searchObject = asObject(searchValue);
@@ -1605,10 +1614,19 @@ JSC_DEFINE_HOST_FUNCTION(stringProtoFuncMatchAll, (JSGlobalObject* globalObject,
         if (isArgRegExp) {
             JSValue flagsValue = asObject(regexpValue)->get(globalObject, vm.propertyNames->flags);
             RETURN_IF_EXCEPTION(scope, { });
+#if USE(BUN_JSC_ADDITIONS)
+            auto* flagsJSString = flagsValue.toString(globalObject);
+            RETURN_IF_EXCEPTION(scope, { });
+            auto flags = flagsJSString->view(globalObject);
+            RETURN_IF_EXCEPTION(scope, { });
+            if (!flags->contains('g')) [[unlikely]]
+                return throwVMTypeError(globalObject, scope, "String.prototype.matchAll argument must not be a non-global regular expression"_s);
+#else
             String flags = flagsValue.toWTFString(globalObject);
             RETURN_IF_EXCEPTION(scope, { });
             if (!flags.contains('g')) [[unlikely]]
                 return throwVMTypeError(globalObject, scope, "String.prototype.matchAll argument must not be a non-global regular expression"_s);
+#endif
         }
 
         JSValue matcher = asObject(regexpValue)->get(globalObject, vm.propertyNames->matchAllSymbol);
@@ -1953,6 +1971,50 @@ static inline JSValue trimString(JSGlobalObject* globalObject, JSValue thisValue
     if (!checkObjectCoercible(thisValue)) [[unlikely]]
         return throwTypeError(globalObject, scope);
 
+#if USE(BUN_JSC_ADDITIONS)
+    auto* jsStr = thisValue.toString(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+    auto str = jsStr->view(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    unsigned length = str->length();
+    if (!length) [[unlikely]] {
+        if (thisValue.isString())
+            return thisValue;
+        RELEASE_AND_RETURN(scope, jsEmptyString(vm));
+    }
+
+    unsigned left = 0;
+    unsigned right = length;
+
+    if (str->is8Bit()) {
+        auto characters = str->span8();
+        if constexpr (static_cast<uint8_t>(trimKind) & static_cast<uint8_t>(TrimKind::TrimStart)) {
+            while (left < length && isStrWhiteSpace(characters[left]))
+                left++;
+        }
+        if constexpr (static_cast<uint8_t>(trimKind) & static_cast<uint8_t>(TrimKind::TrimEnd)) {
+            while (right > left && isStrWhiteSpace(characters[right - 1]))
+                right--;
+        }
+    } else {
+        auto characters = str->span16();
+        if constexpr (static_cast<uint8_t>(trimKind) & static_cast<uint8_t>(TrimKind::TrimStart)) {
+            while (left < length && isStrWhiteSpace(characters[left]))
+                left++;
+        }
+        if constexpr (static_cast<uint8_t>(trimKind) & static_cast<uint8_t>(TrimKind::TrimEnd)) {
+            while (right > left && isStrWhiteSpace(characters[right - 1]))
+                right--;
+        }
+    }
+
+    // Don't gc allocate a new string if we don't have to.
+    if (!left && right == length && thisValue.isString())
+        return thisValue;
+
+    RELEASE_AND_RETURN(scope, jsSubstring(globalObject, vm, jsStr, left, right - left));
+#else
     String str = thisValue.toWTFString(globalObject);
     RETURN_IF_EXCEPTION(scope, { });
 
@@ -1993,6 +2055,7 @@ static inline JSValue trimString(JSGlobalObject* globalObject, JSValue thisValue
         return thisValue;
 
     RELEASE_AND_RETURN(scope, jsString(vm, str.substringSharingImpl(left, right - left)));
+#endif
 }
 
 JSC_DEFINE_HOST_FUNCTION(stringProtoFuncTrim, (JSGlobalObject* globalObject, CallFrame* callFrame))
@@ -2362,7 +2425,11 @@ JSC_DEFINE_HOST_FUNCTION(stringProtoFuncToWellFormed, (JSGlobalObject* globalObj
     if (stringValue->is8Bit())
         return JSValue::encode(stringValue);
 
+#if USE(BUN_JSC_ADDITIONS)
+    auto string = stringValue->view(globalObject);
+#else
     auto string = stringValue->value(globalObject);
+#endif
     RETURN_IF_EXCEPTION(scope, { });
 
     if (string->is8Bit())

From ac8c3d4f60751681d1537dc4aa0c072925b82c11 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 23:22:23 +0000
Subject: [PATCH 35/69] InlinePropertyKey phase D.1+D.2: Identifier tagged
 uintptr_t storage + fiber-word producer

D.1: Identifier holds m_bits (tag bit 1 = inline fiber word) + mutable m_materializedString for lazy string() atomization. impl()/isNull()/isEmpty()/isSymbol()/length() rewritten in terms of uid*() shims. Copy/move/dtor do manual uidRef/uidDeref.

D.2 producer: Identifier(VM&, span<Latin1Character>/span<char16_t>/ASCIILiteral/AtomString*/AtomString&) short-circuits 2..7-char Latin-1 to encodeInline8 fiber word; JSString::toIdentifier returns fromFiberWord(m_fiber) for 8-bit small-inline. canonicalFiberWordFor() guarantees D.4 pointer-compare coherence.

InlinePropertyKey.h: adds FiberAwareRefDerefTraits + FiberAwareRefPtr/FiberAwarePackedRefPtr typedefs for D.6.

UnlinkedFunctionExecutable.h: relax 96-byte static_assert to 112 under BUN_JSC_ADDITIONS (Identifier grew 8->16 bytes).
---
 .../bytecode/UnlinkedFunctionExecutable.h     |   5 +
 Source/JavaScriptCore/runtime/Identifier.cpp  |  16 ++
 Source/JavaScriptCore/runtime/Identifier.h    | 196 ++++++++++++++++++
 .../runtime/IdentifierInlines.h               | 153 ++++++++++++++
 .../runtime/InlinePropertyKey.h               |  38 ++++
 Source/JavaScriptCore/runtime/JSString.h      |  14 +-
 6 files changed, 421 insertions(+), 1 deletion(-)

diff --git a/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h b/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h
index b59b2a846eaa4..6da14f3940768 100644
--- a/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h
+++ b/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h
@@ -353,7 +353,12 @@ class UnlinkedFunctionExecutable final : public JSCell {
 };
 
 #if !ASSERT_ENABLED
+#if USE(BUN_JSC_ADDITIONS)
+// Identifier carries a lazily-materialized AtomString under BUN_JSC_ADDITIONS (phase D.1), which grows this type.
+static_assert(sizeof(UnlinkedFunctionExecutable) <= 112, "UnlinkedFunctionExecutable needs to be small");
+#else
 static_assert(sizeof(UnlinkedFunctionExecutable) <= 96, "UnlinkedFunctionExecutable needs to be small");
 #endif
+#endif
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/Identifier.cpp b/Source/JavaScriptCore/runtime/Identifier.cpp
index cbc5f68840475..8949b62df43e7 100644
--- a/Source/JavaScriptCore/runtime/Identifier.cpp
+++ b/Source/JavaScriptCore/runtime/Identifier.cpp
@@ -57,6 +57,21 @@ Identifier Identifier::from(VM& vm, double value)
 
 void Identifier::dump(PrintStream& out) const
 {
+#if USE(BUN_JSC_ADDITIONS)
+    if (impl()) {
+        if (isInlinePropertyKey(impl())) {
+            out.print(string().impl());
+            return;
+        }
+        if (uidIsSymbol(impl())) {
+            auto* symbol = static_cast<SymbolImpl*>(impl());
+            if (symbol->isPrivate())
+                out.print("PrivateSymbol.");
+        }
+        out.print(impl());
+    } else
+        out.print("<null identifier>");
+#else
     if (impl()) {
         if (impl()->isSymbol()) {
             auto* symbol = static_cast<SymbolImpl*>(impl());
@@ -66,6 +81,7 @@ void Identifier::dump(PrintStream& out) const
         out.print(impl());
     } else
         out.print("<null identifier>");
+#endif
 }
 
 #ifndef NDEBUG
diff --git a/Source/JavaScriptCore/runtime/Identifier.h b/Source/JavaScriptCore/runtime/Identifier.h
index 3e86778a99d27..42a3924f4b54a 100644
--- a/Source/JavaScriptCore/runtime/Identifier.h
+++ b/Source/JavaScriptCore/runtime/Identifier.h
@@ -88,6 +88,195 @@ ALWAYS_INLINE std::optional<uint32_t> parseIndex(const StringImpl& impl)
     return impl.is8Bit() ? parseIndex(impl.span8()) : parseIndex(impl.span16());
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+class Identifier {
+    friend class Structure;
+public:
+    Identifier() = default;
+    enum class EmptyIdentifierFlag { EmptyIdentifier };
+    Identifier(EmptyIdentifierFlag)
+    {
+        auto* empty = StringImpl::empty();
+        empty->ref();
+        m_bits = reinterpret_cast<uintptr_t>(empty);
+        ASSERT(empty->isAtom());
+    }
+
+    Identifier(const Identifier& other)
+        : m_bits(other.m_bits)
+        , m_materializedString(other.m_materializedString)
+    {
+        if (m_bits)
+            uidRef(reinterpret_cast<UniquedStringImpl*>(m_bits));
+    }
+
+    Identifier(Identifier&& other)
+        : m_bits(std::exchange(other.m_bits, 0))
+        , m_materializedString(WTF::move(other.m_materializedString))
+    {
+    }
+
+    ~Identifier()
+    {
+        if (m_bits)
+            uidDeref(reinterpret_cast<UniquedStringImpl*>(m_bits));
+    }
+
+    Identifier& operator=(const Identifier& other)
+    {
+        uintptr_t newBits = other.m_bits;
+        if (newBits)
+            uidRef(reinterpret_cast<UniquedStringImpl*>(newBits));
+        uintptr_t oldBits = std::exchange(m_bits, newBits);
+        if (oldBits)
+            uidDeref(reinterpret_cast<UniquedStringImpl*>(oldBits));
+        m_materializedString = other.m_materializedString;
+        return *this;
+    }
+
+    Identifier& operator=(Identifier&& other)
+    {
+        uintptr_t oldBits = std::exchange(m_bits, std::exchange(other.m_bits, 0));
+        if (oldBits)
+            uidDeref(reinterpret_cast<UniquedStringImpl*>(oldBits));
+        m_materializedString = WTF::move(other.m_materializedString);
+        return *this;
+    }
+
+    enum class FromFiberWordTag { T };
+    static Identifier fromFiberWord(uintptr_t word) { return Identifier(FromFiberWordTag::T, word); }
+
+    const AtomString& string() const LIFETIME_BOUND
+    {
+        if (!m_bits)
+            return m_materializedString;
+        if (m_materializedString.isNull()) {
+            if (isInlinePropertyKey(m_bits)) {
+                unsigned len = inlinePropertyKeyLength(m_bits);
+                const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&m_bits);
+                if (inlinePropertyKeyIs8Bit(m_bits))
+                    m_materializedString = AtomString(std::span<const Latin1Character> { bytes + 1, len });
+                else
+                    m_materializedString = AtomString(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len });
+            } else
+                m_materializedString = AtomString(reinterpret_cast<UniquedStringImpl*>(m_bits));
+        }
+        return m_materializedString;
+    }
+
+    // May return a fiber-word-tagged pointer; callers are phase-A shimmed.
+    UniquedStringImpl* impl() const { return reinterpret_cast<UniquedStringImpl*>(m_bits); }
+
+    RefPtr<AtomStringImpl> releaseImpl()
+    {
+        string();
+        uintptr_t oldBits = std::exchange(m_bits, 0);
+        if (oldBits)
+            uidDeref(reinterpret_cast<UniquedStringImpl*>(oldBits));
+        return m_materializedString.releaseImpl();
+    }
+
+    int length() const { return m_bits ? static_cast<int>(uidLength(reinterpret_cast<UniquedStringImpl*>(m_bits))) : 0; }
+
+    CString ascii() const { return string().string().ascii(); }
+    CString utf8() const { return string().string().utf8(); }
+
+    // There's 2 functions to construct Identifier from string, (1) fromString and (2) fromUid.
+    // They have different meanings in keeping or discarding symbol-ness of strings.
+    // (1): fromString
+    // Just construct Identifier from string. String held by Identifier is always atomized.
+    // Symbol-ness of StringImpl*, which represents that the string is inteded to be used for ES6 Symbols, is discarded.
+    // So a constructed Identifier never represents a symbol.
+    // (2): fromUid
+    // `StringImpl* uid` represents ether String or Symbol property.
+    // fromUid keeps symbol-ness of provided StringImpl* while fromString discards it.
+    // Use fromUid when constructing Identifier from StringImpl* which may represent symbols.
+
+    static Identifier fromString(VM&, ASCIILiteral);
+    static Identifier fromString(VM&, std::span<const Latin1Character>);
+    static Identifier fromString(VM&, std::span<const char16_t>);
+    static Identifier fromString(VM&, const String&);
+    static Identifier fromString(VM&, AtomStringImpl*);
+    static Identifier fromString(VM&, Ref<AtomStringImpl>&&);
+    static Identifier fromString(VM&, const AtomString&);
+    static Identifier fromString(VM&, SymbolImpl*);
+
+    static Identifier NODELETE fromUid(VM&, UniquedStringImpl* uid);
+    static Identifier fromUid(const PrivateName&);
+    static Identifier fromUid(SymbolImpl&);
+
+    static inline Identifier createLatin1(VM& vm, std::span<const char16_t> string); // Defined in IdentifierInlines.h
+
+    JS_EXPORT_PRIVATE static Identifier from(VM&, unsigned y);
+    JS_EXPORT_PRIVATE static Identifier from(VM&, int y);
+    JS_EXPORT_PRIVATE static Identifier from(VM&, double y);
+    ALWAYS_INLINE static Identifier from(VM& vm, uint64_t y)
+    {
+        if (static_cast<uint32_t>(y) == y)
+            return from(vm, static_cast<uint32_t>(y));
+        ASSERT(static_cast<uint64_t>(static_cast<double>(y)) == y);
+        return from(vm, static_cast<double>(y));
+    }
+
+    bool isNull() const { return !m_bits; }
+    bool isEmpty() const { return m_bits && !isInlinePropertyKey(m_bits) && !reinterpret_cast<StringImpl*>(m_bits)->length(); }
+    bool isSymbol() const { return m_bits && uidIsSymbol(reinterpret_cast<UniquedStringImpl*>(m_bits)); }
+    bool isPrivateName() const { return isSymbol() && static_cast<const SymbolImpl*>(impl())->isPrivate(); }
+
+    friend bool operator==(const Identifier&, const Identifier&);
+
+    static bool equal(const StringImpl*, std::span<const Latin1Character>);
+    static bool equal(const StringImpl*, std::span<const char16_t>);
+    static bool equal(const StringImpl* a, const StringImpl* b) { return ::equal(a, b); }
+
+    void dump(PrintStream&) const;
+
+private:
+    uintptr_t m_bits { 0 };
+    mutable AtomString m_materializedString;
+
+    Identifier(FromFiberWordTag, uintptr_t word)
+        : m_bits(word)
+    {
+        ASSERT(isInlinePropertyKey(word));
+    }
+
+    inline Identifier(VM&, std::span<const Latin1Character>); // Defined in IdentifierInlines.h
+    inline Identifier(VM&, std::span<const char16_t>); // Defined in IdentifierInlines.h
+    ALWAYS_INLINE Identifier(VM&, ASCIILiteral); // Defined in IdentifierInlines.h
+    inline Identifier(VM&, AtomStringImpl*); // Defined in IdentifierInlines.h
+    inline Identifier(VM&, const AtomString&); // Defined in IdentifierInlines.h
+    inline Identifier(VM&, const String&);
+    inline Identifier(VM&, StringImpl*);
+    inline Identifier(VM&, Ref<AtomStringImpl>&&); // Defined in IdentifierInlines.h
+
+    // Phase D.4 coherence: every construction path for a 2..7-char Latin-1
+    // name must yield the same encodeInline8 fiber word so PropertyTable's
+    // pointer-identity compare hits regardless of which producer ran.
+    static uintptr_t canonicalFiberWordFor(const StringImpl*); // Defined in IdentifierInlines.h
+
+    Identifier(SymbolImpl& uid)
+    {
+        uid.ref();
+        m_bits = reinterpret_cast<uintptr_t>(&uid);
+    }
+
+    static bool equal(const Identifier& a, const Identifier& b) { return a.m_bits == b.m_bits; }
+
+    template <typename T> inline static Ref<AtomStringImpl> add(VM&, std::span<const T>); // Defined in IdentifierInlines.h
+    static Ref<AtomStringImpl> add8(VM&, std::span<const char16_t>);
+    template <typename T> ALWAYS_INLINE static constexpr bool canUseSingleCharacterString(T);
+
+    static Ref<AtomStringImpl> add(VM&, StringImpl*);
+    inline static Ref<AtomStringImpl> add(VM&, ASCIILiteral); // Defined in IdentifierInlines.h
+
+#ifndef NDEBUG
+    JS_EXPORT_PRIVATE static void checkCurrentAtomStringTable(VM&);
+#else
+    JS_EXPORT_PRIVATE NO_RETURN_DUE_TO_CRASH static void checkCurrentAtomStringTable(VM&);
+#endif
+};
+#else
 class Identifier {
     friend class Structure;
 public:
@@ -189,6 +378,7 @@ class Identifier {
     JS_EXPORT_PRIVATE NO_RETURN_DUE_TO_CRASH static void checkCurrentAtomStringTable(VM&);
 #endif
 };
+#endif
 
 template <> ALWAYS_INLINE constexpr bool Identifier::canUseSingleCharacterString(Latin1Character)
 {
@@ -261,9 +451,15 @@ struct IdentifierMapIndexHashTraits : HashTraits<int> {
     static constexpr bool emptyValueIsZero = false;
 };
 
+#if USE(BUN_JSC_ADDITIONS)
+typedef UncheckedKeyHashSet<FiberAwareRefPtr, IdentifierRepHash> IdentifierSet;
+typedef UncheckedKeyHashMap<FiberAwareRefPtr, int, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, IdentifierMapIndexHashTraits> IdentifierMap;
+typedef UncheckedKeyHashMap<UniquedStringImpl*, int, IdentifierRepHash, HashTraits<UniquedStringImpl*>, IdentifierMapIndexHashTraits> BorrowedIdentifierMap;
+#else
 typedef UncheckedKeyHashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> IdentifierSet;
 typedef UncheckedKeyHashMap<RefPtr<UniquedStringImpl>, int, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, IdentifierMapIndexHashTraits> IdentifierMap;
 typedef UncheckedKeyHashMap<UniquedStringImpl*, int, IdentifierRepHash, HashTraits<UniquedStringImpl*>, IdentifierMapIndexHashTraits> BorrowedIdentifierMap;
+#endif
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/IdentifierInlines.h b/Source/JavaScriptCore/runtime/IdentifierInlines.h
index 7d7058911ccec..5cdf370e55055 100644
--- a/Source/JavaScriptCore/runtime/IdentifierInlines.h
+++ b/Source/JavaScriptCore/runtime/IdentifierInlines.h
@@ -33,12 +33,154 @@
 
 namespace JSC  {
 
+#if USE(BUN_JSC_ADDITIONS)
+// Phase D.4 canonical-representation coherence: a 2..7-char Latin-1 name has
+// exactly one m_bits value — the encodeInline8 fiber word. Every Identifier
+// construction path funnels through this so PropertyTable's key==entry.key()
+// pointer compare hits whether the key came from the parser span ctor,
+// JSString::toIdentifier, or any fromString()/fromUid() caller.
+ALWAYS_INLINE uintptr_t Identifier::canonicalFiberWordFor(const StringImpl* impl)
+{
+    if (!impl || impl->isSymbol())
+        return 0;
+    unsigned len = impl->length();
+    if (len < 2 || len > JSString::maxInlineLength8)
+        return 0;
+    if (impl->is8Bit()) [[likely]]
+        return JSString::encodeInline8(impl->span8());
+    auto span16 = impl->span16();
+    Latin1Character narrowed[JSString::maxInlineLength8];
+    for (unsigned i = 0; i < len; ++i) {
+        char16_t c = span16[i];
+        if (c > 0xff)
+            return 0;
+        narrowed[i] = static_cast<Latin1Character>(c);
+    }
+    return JSString::encodeInline8({ narrowed, len });
+}
+
+inline Identifier::Identifier(VM& vm, std::span<const Latin1Character> string)
+{
+    // Phase D.2 producer: short Latin-1 identifiers live as a tagged fiber word
+    // (no AtomStringImpl materialized). size 0/1 and >7 fall through to add().
+    if (string.size() >= 2 && string.size() <= JSString::maxInlineLength8) {
+        m_bits = JSString::encodeInline8(string);
+        return;
+    }
+    m_bits = reinterpret_cast<uintptr_t>(&add(vm, string).leakRef());
+}
+#else
 inline Identifier::Identifier(VM& vm, std::span<const Latin1Character> string)
     : m_string(add(vm, string))
 {
     ASSERT(m_string.impl()->isAtom());
 }
+#endif
+
+#if USE(BUN_JSC_ADDITIONS)
+inline Identifier::Identifier(VM& vm, std::span<const char16_t> string)
+{
+    // D.4 coherence: a 16-bit span whose content fits Latin-1 must yield the
+    // same fiber word the Latin-1 span ctor would.
+    if (string.size() >= 2 && string.size() <= JSString::maxInlineLength8) {
+        Latin1Character narrowed[JSString::maxInlineLength8];
+        bool allLatin1 = true;
+        for (size_t i = 0; i < string.size(); ++i) {
+            char16_t c = string[i];
+            if (c > 0xff) { allLatin1 = false; break; }
+            narrowed[i] = static_cast<Latin1Character>(c);
+        }
+        if (allLatin1) {
+            m_bits = JSString::encodeInline8({ narrowed, string.size() });
+            return;
+        }
+    }
+    m_bits = reinterpret_cast<uintptr_t>(&add(vm, string).leakRef());
+    ASSERT(reinterpret_cast<StringImpl*>(m_bits)->isAtom());
+}
+
+ALWAYS_INLINE Identifier::Identifier(VM& vm, ASCIILiteral literal)
+{
+    // D.4 coherence: ASCII is Latin-1; 2..7 chars must be a fiber word.
+    size_t len = literal.length();
+    if (len >= 2 && len <= JSString::maxInlineLength8) {
+        m_bits = JSString::encodeInline8(literal.span8());
+        return;
+    }
+    m_bits = reinterpret_cast<uintptr_t>(&add(vm, literal).leakRef());
+    ASSERT(reinterpret_cast<StringImpl*>(m_bits)->isAtom());
+}
+
+inline Identifier::Identifier(VM& vm, AtomStringImpl* string)
+{
+    if (string) {
+        if (uintptr_t fiber = canonicalFiberWordFor(string)) {
+            m_bits = fiber;
+        } else {
+            string->ref();
+            m_bits = reinterpret_cast<uintptr_t>(string);
+        }
+    }
+#ifndef NDEBUG
+    checkCurrentAtomStringTable(vm);
+    if (string)
+        ASSERT_WITH_MESSAGE(!string->length() || string->isSymbol() || AtomStringImpl::isInAtomStringTable(string), "The atomic string comes from an other thread!");
+#else
+    UNUSED_PARAM(vm);
+#endif
+}
+
+inline Identifier::Identifier(VM& vm, const AtomString& string)
+{
+    if (auto* rep = string.impl()) {
+        if (uintptr_t fiber = canonicalFiberWordFor(rep)) {
+            m_bits = fiber;
+        } else {
+            rep->ref();
+            m_bits = reinterpret_cast<uintptr_t>(static_cast<UniquedStringImpl*>(rep));
+        }
+    }
+#ifndef NDEBUG
+    checkCurrentAtomStringTable(vm);
+    if (!string.isNull())
+        ASSERT_WITH_MESSAGE(!string.length() || string.impl()->isSymbol() || AtomStringImpl::isInAtomStringTable(string.impl()), "The atomic string comes from an other thread!");
+#else
+    UNUSED_PARAM(vm);
+#endif
+}
 
+inline Identifier::Identifier(VM& vm, const String& string)
+{
+    if (uintptr_t fiber = canonicalFiberWordFor(string.impl())) {
+        m_bits = fiber;
+        return;
+    }
+    m_bits = reinterpret_cast<uintptr_t>(&add(vm, string.impl()).leakRef());
+    ASSERT(reinterpret_cast<StringImpl*>(m_bits)->isAtom());
+}
+
+inline Identifier::Identifier(VM& vm, StringImpl* rep)
+{
+    if (uintptr_t fiber = canonicalFiberWordFor(rep)) {
+        m_bits = fiber;
+        return;
+    }
+    m_bits = reinterpret_cast<uintptr_t>(&add(vm, rep).leakRef());
+    ASSERT(reinterpret_cast<StringImpl*>(m_bits)->isAtom());
+}
+
+inline Identifier::Identifier(VM&, Ref<AtomStringImpl>&& impl)
+{
+    // D.4 coherence: JSString::toIdentifier / JSRopeString::toIdentifier land
+    // here for non-inline strings — must match the parser's fiber word for
+    // the same 2..7-char Latin-1 content.
+    if (uintptr_t fiber = canonicalFiberWordFor(impl.ptr())) {
+        m_bits = fiber;
+        return;
+    }
+    m_bits = reinterpret_cast<uintptr_t>(&impl.leakRef());
+}
+#else
 inline Identifier::Identifier(VM& vm, std::span<const char16_t> string)
     : m_string(add(vm, string))
 {
@@ -86,6 +228,7 @@ inline Identifier::Identifier(VM& vm, StringImpl* rep)
 {
     ASSERT(m_string.impl()->isAtom());
 }
+#endif
 
 inline Ref<AtomStringImpl> Identifier::add(VM& vm, ASCIILiteral literal)
 {
@@ -139,9 +282,19 @@ inline Identifier Identifier::createLatin1(VM& vm, std::span<const char16_t> str
 
 SUPPRESS_NODELETE inline Identifier Identifier::fromUid(VM& vm, UniquedStringImpl* uid)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    // D.4 coherence: uid may already be a fiber word (from Identifier::impl())
+    // — keep it verbatim. A real impl funnels through the canonicalizing ctor.
+    if (isInlinePropertyKey(uid))
+        return fromFiberWord(reinterpret_cast<uintptr_t>(uid));
+    if (!uid || !uid->isSymbol())
+        return Identifier(vm, static_cast<StringImpl*>(uid));
+    return static_cast<SymbolImpl&>(*uid);
+#else
     if (!uid || !uid->isSymbol())
         return Identifier(vm, uid);
     return static_cast<SymbolImpl&>(*uid);
+#endif
 }
 
 inline Identifier Identifier::fromUid(const PrivateName& name)
diff --git a/Source/JavaScriptCore/runtime/InlinePropertyKey.h b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
index 3f66087052f30..ee3bf6172e7ed 100644
--- a/Source/JavaScriptCore/runtime/InlinePropertyKey.h
+++ b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
@@ -12,6 +12,9 @@
 #if USE(BUN_JSC_ADDITIONS)
 
 #include <cstdint>
+#include <wtf/Packed.h>
+#include <wtf/RawPtrTraits.h>
+#include <wtf/RefPtr.h>
 #include <wtf/text/StringHasher.h>
 #include <wtf/text/UniquedStringImpl.h>
 
@@ -55,6 +58,16 @@ ALWAYS_INLINE UniquedStringImpl* inlinePropertyKeyAsImpl(uintptr_t word)
 ALWAYS_INLINE bool inlinePropertyKeyIs8Bit(uintptr_t word) { return word & 0x4; }
 ALWAYS_INLINE unsigned inlinePropertyKeyLength(uintptr_t word) { return static_cast<unsigned>(word >> 3) & 0xf; }
 
+// Span into the caller's fiber-word storage (taken by reference so the returned
+// span stays valid for the enclosing full-expression / member lifetime).
+ALWAYS_INLINE std::span<const Latin1Character> inlinePropertyKeySpan8(const uintptr_t& word)
+{
+    ASSERT(isInlinePropertyKey(word));
+    ASSERT(inlinePropertyKeyIs8Bit(word));
+    const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+    return std::span<const Latin1Character> { bytes + 1, inlinePropertyKeyLength(word) };
+}
+
 ALWAYS_INLINE unsigned inlinePropertyKeyHash(uintptr_t word)
 {
     // Must match StringImpl::hash() for equal content so a fiber-word key
@@ -101,6 +114,31 @@ ALWAYS_INLINE void uidDeref(UniquedStringImpl* impl)
         impl->deref();
 }
 
+// RefDerefTraits for RefPtr<UniquedStringImpl, ...> slots that may hold a
+// fiber word instead of a real heap pointer. Matches DefaultRefDerefTraits
+// shape so RefPtr/HashTable machinery works unchanged; only ref/deref branch.
+struct FiberAwareRefDerefTraits {
+    static ALWAYS_INLINE UniquedStringImpl* refIfNotNull(UniquedStringImpl* ptr)
+    {
+        if (ptr) [[likely]]
+            uidRef(ptr);
+        return ptr;
+    }
+    static ALWAYS_INLINE UniquedStringImpl& ref(UniquedStringImpl& r)
+    {
+        uidRef(&r);
+        return r;
+    }
+    static ALWAYS_INLINE void derefIfNotNull(UniquedStringImpl* ptr)
+    {
+        if (ptr) [[likely]]
+            uidDeref(ptr);
+    }
+};
+
+using FiberAwareRefPtr = RefPtr<UniquedStringImpl, WTF::RawPtrTraits<UniquedStringImpl>, FiberAwareRefDerefTraits>;
+using FiberAwarePackedRefPtr = RefPtr<UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>, FiberAwareRefDerefTraits>;
+
 } // namespace JSC
 
 #endif // USE(BUN_JSC_ADDITIONS)
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 7b98f902a33e7..231595ead6415 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -341,6 +341,11 @@ class JSString : public JSCell {
     {
         return (fiberConcurrently() & notStringImplMask) == isInlineInPointer;
     }
+    ALWAYS_INLINE uintptr_t inlineFiberWord() const
+    {
+        ASSERT(isInline());
+        return fiberConcurrently();
+    }
     ALWAYS_INLINE static bool isInlineFiber(uintptr_t fiber)
     {
         return (fiber & notStringImplMask) == isInlineInPointer;
@@ -1054,8 +1059,15 @@ ALWAYS_INLINE Identifier JSString::toIdentifier(JSGlobalObject* globalObject) co
     if (isRope())
         return static_cast<const JSRopeString*>(this)->toIdentifier(globalObject);
 #if USE(BUN_JSC_ADDITIONS)
-    if (isInline())
+    if (isInline()) {
+        // Phase D.2 producer + D.4 coherence: only the 8-bit small-inline
+        // encoding is the canonical Identifier form. 16-bit inline and
+        // big-inline (8..15) atomize, then fromString() re-canonicalizes
+        // to encodeInline8 if the content is 2..7 Latin-1.
+        if (is8Bit() && length() <= maxInlineLength8)
+            return Identifier::fromFiberWord(m_fiber);
         return Identifier::fromString(getVM(globalObject), Ref { *resolveInlineToAtomString(globalObject) });
+    }
 #endif
     VM& vm = getVM(globalObject);
     if (valueInternal().impl()->isAtom())

From 2f92bdcceb91dda177a5ba47c4da1499e2a6dfa8 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 23:22:37 +0000
Subject: [PATCH 36/69] InlinePropertyKey phase D.5: deref guards at impl()
 sites hit after the producer

BuiltinNames.cpp: m_wellKnownSymbolsMap.add(identifier.impl(), ...) now receives a fiber word for 2-7 char names; route through identifier.string() to materialize a real AtomString before String construction.

CacheableIdentifierInlines.h: guard inline-key path in CacheableIdentifier.

KNOWN WALL (per spec directive): additional unshimmed impl()->deref sites exist in the runtime (the spec's D.5 audit list was non-exhaustive). The D.2 producer is live so startup still crashes past this commit until the remaining sites are routed through uid*() shims or string(). Phase C lands next independently per the spec's fallback directive.
---
 .../JavaScriptCore/builtins/BuiltinNames.cpp  |  8 ++++
 .../runtime/CacheableIdentifierInlines.h      | 48 ++++++++++++++-----
 2 files changed, 44 insertions(+), 12 deletions(-)

diff --git a/Source/JavaScriptCore/builtins/BuiltinNames.cpp b/Source/JavaScriptCore/builtins/BuiltinNames.cpp
index b94f7f24cb369..04a8091ea0734 100644
--- a/Source/JavaScriptCore/builtins/BuiltinNames.cpp
+++ b/Source/JavaScriptCore/builtins/BuiltinNames.cpp
@@ -61,11 +61,19 @@ SymbolImpl::StaticSymbolImpl polyProtoPrivateName { "PolyProto", SymbolImpl::s_f
         m_privateNameSet.add(symbol); \
     } while (0);
 
+#if USE(BUN_JSC_ADDITIONS)
+#define INITIALIZE_WELL_KNOWN_SYMBOL_PUBLIC_TO_PRIVATE_ENTRY(name) \
+    do { \
+        SymbolImpl* symbol = static_cast<SymbolImpl*>(m_##name##Symbol.impl()); \
+        m_wellKnownSymbolsMap.add(m_##name##SymbolPrivateIdentifier.string(), symbol); \
+    } while (0);
+#else
 #define INITIALIZE_WELL_KNOWN_SYMBOL_PUBLIC_TO_PRIVATE_ENTRY(name) \
     do { \
         SymbolImpl* symbol = static_cast<SymbolImpl*>(m_##name##Symbol.impl()); \
         m_wellKnownSymbolsMap.add(m_##name##SymbolPrivateIdentifier.impl(), symbol); \
     } while (0);
+#endif
 
 WTF_MAKE_TZONE_ALLOCATED_IMPL(BuiltinNames);
 
diff --git a/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h b/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
index e3815c1141c17..620013b2709a7 100644
--- a/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
+++ b/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
@@ -61,12 +61,9 @@ inline CacheableIdentifier CacheableIdentifier::createFromSharedStub(UniquedStri
 inline CacheableIdentifier CacheableIdentifier::createFromCell(JSCell* i)
 {
 #if USE(BUN_JSC_ADDITIONS)
-    // Resolve inline JSStrings so uid()/getValueImpl() see a real atom.
-    if (i->isString()) {
-        JSString* s = uncheckedDowncast<JSString>(i);
-        if (s->isInline())
-            s->resolveInlineToAtomString(nullptr);
-    }
+    // Phase D: inline JSStrings are stored as-is; uid() returns the fiber word
+    // (tagged UniquedStringImpl*) and isSymbol()/hash() branch on the tag via
+    // uidIsSymbol/uidHash so no atom materialization is required here.
 #endif
     return CacheableIdentifier(i);
 }
@@ -98,12 +95,25 @@ inline UniquedStringImpl* CacheableIdentifier::uid() const
         return &uncheckedDowncast<Symbol>(cell())->uid();
     ASSERT(isStringCell());
     JSString* string = uncheckedDowncast<JSString>(cell());
+#if USE(BUN_JSC_ADDITIONS)
+    // Phase D: an inline JSString's fiber word is itself the uniqued key
+    // (content-unique, bit 1 tagged). Return it directly as a tagged
+    // UniquedStringImpl*; callers use uidIsSymbol/uidHash to branch.
+    if (string->isInline())
+        return std::bit_cast<UniquedStringImpl*>(string->inlineFiberWord());
     return std::bit_cast<UniquedStringImpl*>(string->getValueImpl());
+#else
+    return std::bit_cast<UniquedStringImpl*>(string->getValueImpl());
+#endif
 }
 
 inline bool CacheableIdentifier::isSymbol() const
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return m_bits && uidIsSymbol(uid());
+#else
     return m_bits && uid()->isSymbol();
+#endif
 }
 
 inline bool CacheableIdentifier::isPrivateName() const
@@ -113,7 +123,11 @@ inline bool CacheableIdentifier::isPrivateName() const
 
 inline unsigned CacheableIdentifier::hash() const
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return uidHash(uid());
+#else
     return uid()->symbolAwareHash();
+#endif
 }
 
 inline bool CacheableIdentifier::isCacheableIdentifierCell(JSCell* cell)
@@ -124,8 +138,8 @@ inline bool CacheableIdentifier::isCacheableIdentifierCell(JSCell* cell)
         return false;
     JSString* string = uncheckedDowncast<JSString>(cell);
 #if USE(BUN_JSC_ADDITIONS)
-    // Inline strings become cacheable after resolveInlineToAtomString; see
-    // getCacheableIdentifier below.
+    // Phase D: an inline JSString's fiber word is content-unique and acts as
+    // its own uniqued key, so it is cacheable without atom materialization.
     if (string->isInline())
         return true;
 #endif
@@ -149,11 +163,11 @@ inline GCOwnedDataScope<const UniquedStringImpl*> CacheableIdentifier::getCachea
         return { };
     JSString* string = uncheckedDowncast<JSString>(cell);
 #if USE(BUN_JSC_ADDITIONS)
-    // Resolve inline strings to atoms so the IC can cache them. The cell is
-    // mutated in place; subsequent accesses via InlineStringCache return the
-    // same (now-resolved) cell and hit the IC's atom-pointer compare.
+    // Phase D: return the fiber word itself as the uniqued key. It is
+    // content-unique so pointer-identity IC compares remain sound, and
+    // downstream hash/isSymbol queries branch via uidHash/uidIsSymbol.
     if (string->isInline())
-        return { cell, string->resolveInlineToAtomString(nullptr) };
+        return { cell, std::bit_cast<const UniquedStringImpl*>(string->inlineFiberWord()) };
 #endif
     if (const StringImpl* impl = string->tryGetValueImpl(); impl && impl->isAtom())
         return { cell, static_cast<const AtomStringImpl*>(impl) };
@@ -180,10 +194,20 @@ inline bool CacheableIdentifier::isStringCell() const
 inline void CacheableIdentifier::ensureIsCell(VM& vm)
 {
     if (!isCell()) {
+#if USE(BUN_JSC_ADDITIONS)
+        UniquedStringImpl* rep = uid();
+        if (uidIsSymbol(rep))
+            setCellBits(Symbol::create(vm, static_cast<SymbolImpl&>(*rep)));
+        else if (isInlinePropertyKey(rep))
+            setCellBits(JSString::createInlineFromFiber(vm, reinterpret_cast<uintptr_t>(rep)));
+        else
+            setCellBits(jsString(vm, String(static_cast<AtomStringImpl*>(rep))));
+#else
         if (uid()->isSymbol())
             setCellBits(Symbol::create(vm, static_cast<SymbolImpl&>(*uid())));
         else
             setCellBits(jsString(vm, String(static_cast<AtomStringImpl*>(uid()))));
+#endif
     }
     ASSERT(isCell());
 }

From cfe685d4950dfb27bcfa1e589cb7940fdaa5c823 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 23:22:57 +0000
Subject: [PATCH 37/69] InlinePropertyKey phase D.6: RefPtr<UniquedStringImpl>
 fields fiber-aware

Structure::m_transitionPropertyName -> uintptr_t m_transitionPropertyNameBits + manual uidRef/uidDeref helpers; ~Structure() clears it. All call sites in Structure.cpp/StructureInlines.h updated.

HasOwnPropertyCache::Entry::impl + MegamorphicCache::*Entry::m_uid -> FiberAwareRefPtr (same layout, fiber-safe traits). BrandedStructure::m_brand: RELEASE_ASSERT(!isInlinePropertyKey) at setter (brands are symbols).

SymbolTable::Map/UniqueIDMap/UniqueTypeSetMap/OffsetToVariableMap, VariableEnvironment::Map, PrivateNameEnvironment, TDZEnvironment, CompactTDZEnvironment::Compact, IdentifierSet/IdentifierMap -> FiberAwareRefPtr/FiberAwarePackedRefPtr. Duplicate TDZEnvironment aliases in JSScope.h/CodeCache.h suppressed under BUN_JSC_ADDITIONS.

CachedTypes.cpp: CachedFiberAwareRefPtr serializer (stores raw fiber word, else falls through to CachedUniquedStringImpl); wired into CachedVariableEnvironment/CachedCompactTDZEnvironment/CachedPrivateNameEnvironment/CachedSymbolTable/m_constantIdentifierSets. VariableEnvironment.cpp CompactTDZ lambda returns FiberAwarePackedRefPtr + uidHash().
---
 .../parser/VariableEnvironment.cpp            |  7 ++
 .../parser/VariableEnvironment.h              | 16 ++++
 .../runtime/BrandedStructure.cpp              |  3 +
 Source/JavaScriptCore/runtime/CachedTypes.cpp | 78 +++++++++++++++++
 Source/JavaScriptCore/runtime/CodeCache.h     |  4 +
 .../runtime/HasOwnPropertyCache.h             |  8 ++
 Source/JavaScriptCore/runtime/JSScope.h       |  4 +
 .../JavaScriptCore/runtime/MegamorphicCache.h | 12 +++
 Source/JavaScriptCore/runtime/Structure.cpp   | 86 +++++++++++++++++++
 Source/JavaScriptCore/runtime/Structure.h     | 17 ++++
 .../JavaScriptCore/runtime/StructureInlines.h | 29 +++++++
 Source/JavaScriptCore/runtime/SymbolTable.h   |  7 ++
 12 files changed, 271 insertions(+)

diff --git a/Source/JavaScriptCore/parser/VariableEnvironment.cpp b/Source/JavaScriptCore/parser/VariableEnvironment.cpp
index 902b8f938faeb..c68988e17274b 100644
--- a/Source/JavaScriptCore/parser/VariableEnvironment.cpp
+++ b/Source/JavaScriptCore/parser/VariableEnvironment.cpp
@@ -226,10 +226,17 @@ void CompactTDZEnvironment::sortCompact(Compact& compact)
 CompactTDZEnvironment::CompactTDZEnvironment(const TDZEnvironment& env)
 {
     m_hash = 0; // Note: XOR is commutative so order doesn't matter here.
+#if USE(BUN_JSC_ADDITIONS)
+    Compact variables = WTF::map(env, [this](auto& key) -> FiberAwarePackedRefPtr {
+        m_hash ^= uidHash(key.get());
+        return key.get();
+    });
+#else
     Compact variables = WTF::map(env, [this](auto& key) -> PackedRefPtr<UniquedStringImpl> {
         m_hash ^= key->hash();
         return key.get();
     });
+#endif
 
     sortCompact(variables);
     m_variables = WTF::move(variables);
diff --git a/Source/JavaScriptCore/parser/VariableEnvironment.h b/Source/JavaScriptCore/parser/VariableEnvironment.h
index 1dda303c94685..b77506043f66e 100644
--- a/Source/JavaScriptCore/parser/VariableEnvironment.h
+++ b/Source/JavaScriptCore/parser/VariableEnvironment.h
@@ -142,7 +142,11 @@ struct PrivateNameEntryHashTraits : HashTraits<PrivateNameEntry> {
     static constexpr bool needsDestruction = false;
 };
 
+#if USE(BUN_JSC_ADDITIONS)
+typedef UncheckedKeyHashMap<FiberAwarePackedRefPtr, PrivateNameEntry, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, PrivateNameEntryHashTraits> PrivateNameEnvironment;
+#else
 typedef UncheckedKeyHashMap<PackedRefPtr<UniquedStringImpl>, PrivateNameEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, PrivateNameEntryHashTraits> PrivateNameEnvironment;
+#endif
 
 class VariableEnvironment {
     WTF_MAKE_TZONE_ALLOCATED(VariableEnvironment);
@@ -151,7 +155,11 @@ class VariableEnvironment {
     static constexpr unsigned inlineMapCapacity = 9;
 
 private:
+#if USE(BUN_JSC_ADDITIONS)
+    typedef InlineMap<FiberAwarePackedRefPtr, VariableEnvironmentEntry, inlineMapCapacity, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, VariableEnvironmentEntryHashTraits> Map;
+#else
     typedef InlineMap<PackedRefPtr<UniquedStringImpl>, VariableEnvironmentEntry, inlineMapCapacity, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, VariableEnvironmentEntryHashTraits> Map;
+#endif
 
 public:
 
@@ -342,7 +350,11 @@ class VariableEnvironment {
     std::unique_ptr<VariableEnvironment::RareData> m_rareData;
 };
 
+#if USE(BUN_JSC_ADDITIONS)
+using TDZEnvironment = UncheckedKeyHashSet<FiberAwareRefPtr, IdentifierRepHash>;
+#else
 using TDZEnvironment = UncheckedKeyHashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash>;
+#endif
 
 class CompactTDZEnvironment {
     WTF_MAKE_TZONE_ALLOCATED(CompactTDZEnvironment);
@@ -350,7 +362,11 @@ class CompactTDZEnvironment {
 
     friend class CachedCompactTDZEnvironment;
 
+#if USE(BUN_JSC_ADDITIONS)
+    using Compact = Vector<FiberAwarePackedRefPtr>;
+#else
     using Compact = Vector<PackedRefPtr<UniquedStringImpl>>;
+#endif
     using Inflated = TDZEnvironment;
     using Variables = Variant<Compact, Inflated>;
 
diff --git a/Source/JavaScriptCore/runtime/BrandedStructure.cpp b/Source/JavaScriptCore/runtime/BrandedStructure.cpp
index 7aefcba9a69df..c31631ea6bc1d 100644
--- a/Source/JavaScriptCore/runtime/BrandedStructure.cpp
+++ b/Source/JavaScriptCore/runtime/BrandedStructure.cpp
@@ -36,6 +36,9 @@ BrandedStructure::BrandedStructure(VM& vm, Structure* previous, UniquedStringImp
     , m_brand(brandUid)
     , m_parentBrand(previous->isBrandedStructure() ? previous : nullptr, WriteBarrierEarlyInit)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    RELEASE_ASSERT(!isInlinePropertyKey(brandUid));
+#endif
     ASSERT(isBrandedStructure());
 }
 
diff --git a/Source/JavaScriptCore/runtime/CachedTypes.cpp b/Source/JavaScriptCore/runtime/CachedTypes.cpp
index a9afda484de10..2fb450dfea483 100644
--- a/Source/JavaScriptCore/runtime/CachedTypes.cpp
+++ b/Source/JavaScriptCore/runtime/CachedTypes.cpp
@@ -44,6 +44,9 @@
 #include "UnlinkedModuleProgramCodeBlock.h"
 #include "UnlinkedProgramCodeBlock.h"
 #include "VariableEnvironmentInlines.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
 #include <wtf/FileHandle.h>
 #include <wtf/InlineMap.h>
 #include <wtf/MallocSpan.h>
@@ -828,6 +831,61 @@ class CachedUniquedStringImplBase : public VariableLengthObject<T> {
 class CachedUniquedStringImpl : public CachedUniquedStringImplBase<UniquedStringImpl> { };
 class CachedStringImpl : public CachedUniquedStringImplBase<StringImpl> { };
 
+#if USE(BUN_JSC_ADDITIONS)
+// Serializer for FiberAwareRefPtr / FiberAwarePackedRefPtr keys. After the
+// Phase-D typedef swap these slots may hold an inline fiber word (bit 1 set)
+// instead of a real UniquedStringImpl*. Encode stores the raw word; decode
+// reconstitutes the fiber word directly. Real impls fall through to the
+// existing CachedUniquedStringImpl path.
+template<typename PtrTraits = WTF::RawPtrTraits<UniquedStringImpl>>
+class CachedFiberAwareRefPtr : public CachedObject<RefPtr<UniquedStringImpl, PtrTraits, FiberAwareRefDerefTraits>> {
+    using SourceRefPtr = RefPtr<UniquedStringImpl, PtrTraits, FiberAwareRefDerefTraits>;
+
+public:
+    void encode(Encoder& encoder, const UniquedStringImpl* src)
+    {
+        if (src && isInlinePropertyKey(src)) {
+            m_fiberWord = reinterpret_cast<uintptr_t>(src);
+            return;
+        }
+        m_fiberWord = 0;
+        m_ptr.encode(encoder, src);
+    }
+
+    void encode(Encoder& encoder, const SourceRefPtr src)
+    {
+        encode(encoder, src.get());
+    }
+
+    SourceRefPtr decode(Decoder& decoder) const
+    {
+        if (m_fiberWord)
+            return SourceRefPtr(inlinePropertyKeyAsImpl(m_fiberWord));
+        bool isNewAllocation;
+        UniquedStringImpl* decodedPtr = m_ptr.decode(decoder, isNewAllocation);
+        if (!decodedPtr)
+            return nullptr;
+        if (isNewAllocation) {
+            decoder.addFinalizer([=] {
+                WTF::DefaultRefDerefTraits<UniquedStringImpl>::derefIfNotNull(decodedPtr);
+            });
+        }
+        auto result = adoptRef<UniquedStringImpl, PtrTraits, FiberAwareRefDerefTraits>(decodedPtr);
+        result->ref();
+        return result;
+    }
+
+    void decode(Decoder& decoder, SourceRefPtr& src) const
+    {
+        src = decode(decoder);
+    }
+
+private:
+    uintptr_t m_fiberWord { 0 };
+    CachedPtr<CachedUniquedStringImpl, UniquedStringImpl> m_ptr;
+};
+#endif
+
 class CachedString : public VariableLengthObject<String> {
 public:
     void encode(Encoder& encoder, const String& string)
@@ -1049,7 +1107,11 @@ class CachedCodeBlockRareData : public CachedObject<UnlinkedCodeBlock::RareData>
     CachedHashMap<unsigned, UnlinkedCodeBlock::RareData::TypeProfilerExpressionRange> m_typeProfilerInfoMap;
     CachedVector<JSInstructionStream::Offset> m_opProfileControlFlowBytecodeOffsets;
     CachedVector<CachedBitVector> m_bitVectors;
+#if USE(BUN_JSC_ADDITIONS)
+    CachedVector<CachedHashSet<CachedFiberAwareRefPtr<>, IdentifierRepHash>> m_constantIdentifierSets;
+#else
     CachedVector<CachedHashSet<CachedRefPtr<CachedUniquedStringImpl>, IdentifierRepHash>> m_constantIdentifierSets;
+#endif
     unsigned m_needsClassFieldInitializer : 1;
     unsigned m_privateBrandRequirement : 1;
 };
@@ -1078,7 +1140,11 @@ class CachedExpressionInfo : public CachedObject<ExpressionInfo> {
     CachedArray<unsigned> m_storage;
 };
 
+#if USE(BUN_JSC_ADDITIONS)
+typedef CachedHashMap<CachedFiberAwareRefPtr<WTF::PackedPtrTraits<UniquedStringImpl>>, PrivateNameEntry, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, PrivateNameEntryHashTraits> CachedPrivateNameEnvironment;
+#else
 typedef CachedHashMap<CachedRefPtr<CachedUniquedStringImpl, UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>>, PrivateNameEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, PrivateNameEntryHashTraits> CachedPrivateNameEnvironment;
+#endif
 
 class CachedVariableEnvironmentRareData : public CachedObject<VariableEnvironment::RareData> {
 public:
@@ -1120,7 +1186,11 @@ class CachedVariableEnvironment : public CachedObject<VariableEnvironment> {
 private:
     bool m_isEverythingCaptured;
     bool m_hasAwaitUsingDeclaration;
+#if USE(BUN_JSC_ADDITIONS)
+    CachedInlineMap<CachedFiberAwareRefPtr<WTF::PackedPtrTraits<UniquedStringImpl>>, VariableEnvironmentEntry, VariableEnvironment::inlineMapCapacity, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, VariableEnvironmentEntryHashTraits> m_map;
+#else
     CachedInlineMap<CachedRefPtr<CachedUniquedStringImpl, UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>>, VariableEnvironmentEntry, VariableEnvironment::inlineMapCapacity, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, VariableEnvironmentEntryHashTraits> m_map;
+#endif
     CachedPtr<CachedVariableEnvironmentRareData> m_rareData;
 };
 
@@ -1158,7 +1228,11 @@ class CachedCompactTDZEnvironment : public CachedObject<CompactTDZEnvironment> {
     }
 
 private:
+#if USE(BUN_JSC_ADDITIONS)
+    CachedVector<CachedFiberAwareRefPtr<WTF::PackedPtrTraits<UniquedStringImpl>>> m_variables;
+#else
     CachedVector<CachedRefPtr<CachedUniquedStringImpl, UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>>> m_variables;
+#endif
     unsigned m_hash;
 };
 
@@ -1286,7 +1360,11 @@ class CachedSymbolTable : public CachedObject<SymbolTable> {
     }
 
 private:
+#if USE(BUN_JSC_ADDITIONS)
+    CachedHashMap<CachedFiberAwareRefPtr<>, CachedSymbolTableEntry, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, SymbolTableIndexHashTraits> m_map;
+#else
     CachedHashMap<CachedRefPtr<CachedUniquedStringImpl>, CachedSymbolTableEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, SymbolTableIndexHashTraits> m_map;
+#endif
     ScopeOffset m_maxScopeOffset;
     unsigned m_usesSloppyEval : 1;
     unsigned m_nestedLexicalScope : 1;
diff --git a/Source/JavaScriptCore/runtime/CodeCache.h b/Source/JavaScriptCore/runtime/CodeCache.h
index de2bea81cc155..a7bbce22ac68b 100644
--- a/Source/JavaScriptCore/runtime/CodeCache.h
+++ b/Source/JavaScriptCore/runtime/CodeCache.h
@@ -54,7 +54,11 @@ class ProgramExecutable;
 class SourceCode;
 class VM;
 
+#if USE(BUN_JSC_ADDITIONS)
+// TDZEnvironment is defined in VariableEnvironment.h with FiberAwareRefPtr; avoid a conflicting redefinition here.
+#else
 using TDZEnvironment = UncheckedKeyHashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash>;
+#endif
 
 namespace CodeCacheInternal {
 static constexpr bool verbose = false;
diff --git a/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h b/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h
index d6d6fad989039..3cbbf407c3b2d 100644
--- a/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h
+++ b/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h
@@ -51,7 +51,11 @@ class alignas(8) HasOwnPropertyCache {
         static constexpr ptrdiff_t offsetOfImpl() { return OBJECT_OFFSETOF(Entry, impl); }
         static constexpr ptrdiff_t offsetOfResult() { return OBJECT_OFFSETOF(Entry, result); }
 
+#if USE(BUN_JSC_ADDITIONS)
+        FiberAwareRefPtr impl;
+#else
         RefPtr<UniquedStringImpl> impl;
+#endif
         StructureID structureID;
         bool result { false };
     };
@@ -120,7 +124,11 @@ class alignas(8) HasOwnPropertyCache {
             UniquedStringImpl* impl = propName.uid();
             StructureID id = structure->id();
             uint32_t index = HasOwnPropertyCache::hash(id, impl) & mask;
+#if USE(BUN_JSC_ADDITIONS)
+            std::bit_cast<Entry*>(this)[index] = Entry { FiberAwareRefPtr(impl), id, result };
+#else
             std::bit_cast<Entry*>(this)[index] = Entry { RefPtr<UniquedStringImpl>(impl), id, result };
+#endif
         }
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSScope.h b/Source/JavaScriptCore/runtime/JSScope.h
index be8fd8d57b6da..3a596b1e8d1a3 100644
--- a/Source/JavaScriptCore/runtime/JSScope.h
+++ b/Source/JavaScriptCore/runtime/JSScope.h
@@ -35,7 +35,11 @@ class ScopeChainIterator;
 class SymbolTable;
 class WatchpointSet;
 
+#if USE(BUN_JSC_ADDITIONS)
+// TDZEnvironment is defined in VariableEnvironment.h with FiberAwareRefPtr; avoid a conflicting redefinition here.
+#else
 using TDZEnvironment = UncheckedKeyHashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash>;
+#endif
 
 class JSScope : public JSNonFinalObject {
 public:
diff --git a/Source/JavaScriptCore/runtime/MegamorphicCache.h b/Source/JavaScriptCore/runtime/MegamorphicCache.h
index dc0b65522baa4..e878fe8ba6014 100644
--- a/Source/JavaScriptCore/runtime/MegamorphicCache.h
+++ b/Source/JavaScriptCore/runtime/MegamorphicCache.h
@@ -89,7 +89,11 @@ class MegamorphicCache {
             m_holder = (ownProperty) ? JSCell::seenMultipleCalleeObjects() : holder;
         }
 
+#if USE(BUN_JSC_ADDITIONS)
+        FiberAwareRefPtr m_uid;
+#else
         RefPtr<UniquedStringImpl> m_uid;
+#endif
         StructureID m_structureID { };
         uint16_t m_epoch { invalidEpoch };
         uint16_t m_offset { 0 };
@@ -114,7 +118,11 @@ class MegamorphicCache {
             m_reallocating = reallocating;
         }
 
+#if USE(BUN_JSC_ADDITIONS)
+        FiberAwareRefPtr m_uid;
+#else
         RefPtr<UniquedStringImpl> m_uid;
+#endif
         StructureID m_oldStructureID { };
         StructureID m_newStructureID { };
         uint16_t m_epoch { invalidEpoch };
@@ -136,7 +144,11 @@ class MegamorphicCache {
             m_result = !!result;
         }
 
+#if USE(BUN_JSC_ADDITIONS)
+        FiberAwareRefPtr m_uid;
+#else
         RefPtr<UniquedStringImpl> m_uid;
+#endif
         StructureID m_structureID { };
         uint16_t m_epoch { invalidEpoch };
         uint16_t m_result { false };
diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index bd9e01f437e4f..d4cfba8847c96 100644
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -93,7 +93,11 @@ bool StructureTransitionTable::contains(PointerKey rep, unsigned attributes, Tra
 {
     if (isUsingSingleSlot()) {
         Structure* transition = trySingleTransition();
+#if USE(BUN_JSC_ADDITIONS)
+        return transition && transition->transitionPropertyName() == rep.pointer() && transition->transitionPropertyAttributes() == attributes && transition->transitionKind() == transitionKind;
+#else
         return transition && transition->m_transitionPropertyName == rep.pointer() && transition->transitionPropertyAttributes() == attributes && transition->transitionKind() == transitionKind;
+#endif
     }
     return map()->get(StructureTransitionTable::Hash::createKey(rep, attributes, transitionKind));
 }
@@ -383,7 +387,14 @@ Structure::Structure(VM& vm, StructureVariant variant, Structure* previous)
     ASSERT(WTF::roundUpToMultipleOf<Structure::atomSize>(this) == this);
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+Structure::~Structure()
+{
+    clearTransitionPropertyName();
+}
+#else
 Structure::~Structure() = default;
+#endif
 
 void Structure::destroy(JSCell* cell)
 {
@@ -484,6 +495,33 @@ PropertyTable* Structure::materializePropertyTable(VM& vm, bool setPropertyTable
 
     for (size_t i = structures.size(); i--;) {
         structure = structures[i];
+#if USE(BUN_JSC_ADDITIONS)
+        if (!structure->transitionPropertyName())
+            continue;
+        switch (structure->transitionKind()) {
+        case TransitionKind::PropertyAddition: {
+            PropertyTableEntry entry(structure->transitionPropertyName(), structure->transitionOffset(), structure->transitionPropertyAttributes());
+            auto nextOffset = table->nextOffset(structure->inlineCapacity());
+            ASSERT_UNUSED(nextOffset, nextOffset == structure->transitionOffset());
+            auto [offset, attribute, result] = table->add(vm, entry);
+            ASSERT_UNUSED(result, result);
+            ASSERT_UNUSED(offset, offset == nextOffset);
+            UNUSED_VARIABLE(attribute);
+            break;
+        }
+        case TransitionKind::PropertyDeletion: {
+            auto [offset, attributes] = table->take(vm, structure->transitionPropertyName());
+            ASSERT_UNUSED(offset, offset != invalidOffset);
+            UNUSED_VARIABLE(attributes);
+            table->addDeletedOffset(structure->transitionOffset());
+            break;
+        }
+        case TransitionKind::PropertyAttributeChange: {
+            PropertyOffset offset = table->updateAttributeIfExists(structure->transitionPropertyName(), structure->transitionPropertyAttributes());
+            ASSERT_UNUSED(offset, offset == structure->transitionOffset());
+            break;
+        }
+#else
         if (!structure->m_transitionPropertyName)
             continue;
         switch (structure->transitionKind()) {
@@ -509,6 +547,7 @@ PropertyTable* Structure::materializePropertyTable(VM& vm, bool setPropertyTable
             ASSERT_UNUSED(offset, offset == structure->transitionOffset());
             break;
         }
+#endif
         case TransitionKind::SetBrand: {
             continue;
         }
@@ -601,7 +640,11 @@ Structure* Structure::addNewPropertyTransition(VM& vm, Structure* structure, Pro
     }
 
     transition->m_blob.setIndexingModeIncludingHistory(structure->indexingModeIncludingHistory() & ~CopyOnWrite);
+#if USE(BUN_JSC_ADDITIONS)
+    transition->setTransitionPropertyName(propertyName.uid());
+#else
     transition->m_transitionPropertyName = propertyName.uid();
+#endif
     transition->setTransitionPropertyAttributes(attributes);
     transition->setTransitionKind(TransitionKind::PropertyAddition);
     transition->setPropertyTable(vm, structure->takePropertyTableOrCloneIfPinned(vm));
@@ -698,7 +741,11 @@ Structure* Structure::removeNewPropertyTransition(VM& vm, Structure* structure,
     }
 
     transition->m_blob.setIndexingModeIncludingHistory(structure->indexingModeIncludingHistory() & ~CopyOnWrite);
+#if USE(BUN_JSC_ADDITIONS)
+    transition->setTransitionPropertyName(propertyName.uid());
+#else
     transition->m_transitionPropertyName = propertyName.uid();
+#endif
     transition->setTransitionKind(TransitionKind::PropertyDeletion);
     transition->setPropertyTable(vm, structure->takePropertyTableOrCloneIfPinned(vm));
     transition->setMaxOffset(vm, structure->maxOffset());
@@ -839,7 +886,11 @@ Structure* Structure::attributeChangeTransition(VM& vm, Structure* structure, Pr
     }
 
     transition->m_blob.setIndexingModeIncludingHistory(structure->indexingModeIncludingHistory() & ~CopyOnWrite);
+#if USE(BUN_JSC_ADDITIONS)
+    transition->setTransitionPropertyName(propertyName.uid());
+#else
     transition->m_transitionPropertyName = propertyName.uid();
+#endif
     transition->setTransitionPropertyAttributes(attributes);
     transition->setTransitionKind(TransitionKind::PropertyAttributeChange);
     transition->setPropertyTable(vm, structure->takePropertyTableOrCloneIfPinned(vm));
@@ -1114,7 +1165,11 @@ void Structure::pinForCaching(const AbstractLocker&, VM& vm, PropertyTable* tabl
 {
     setIsPinnedPropertyTable(true);
     setPropertyTable(vm, table);
+#if USE(BUN_JSC_ADDITIONS)
+    clearTransitionPropertyName();
+#else
     m_transitionPropertyName = nullptr;
+#endif
 }
 
 void Structure::allocateRareData(VM& vm)
@@ -1233,6 +1288,32 @@ PropertyOffset Structure::getConcurrently(UniquedStringImpl* uid, unsigned& attr
     bool didFindStructure = findStructuresAndMapForMaterialization(structures, tableStructure, table);
 
     for (auto* structure : structures) {
+#if USE(BUN_JSC_ADDITIONS)
+        if (!structure->transitionPropertyName())
+            continue;
+
+        switch (structure->transitionKind()) {
+        case TransitionKind::PropertyAddition:
+        case TransitionKind::PropertyAttributeChange:
+            break;
+        case TransitionKind::PropertyDeletion:
+            if (structure->transitionPropertyName() == uid) {
+                if (didFindStructure) {
+                    assertIsHeld(tableStructure->m_lock); // Sadly Clang needs some help here.
+                    tableStructure->m_lock.unlock();
+                }
+                return invalidOffset;
+            }
+            continue;
+        case TransitionKind::SetBrand:
+            continue;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+
+        if (structure->transitionPropertyName() == uid) {
+#else
         if (!structure->m_transitionPropertyName)
             continue;
 
@@ -1257,6 +1338,7 @@ PropertyOffset Structure::getConcurrently(UniquedStringImpl* uid, unsigned& attr
         }
 
         if (structure->m_transitionPropertyName.get() == uid) {
+#endif
             PropertyOffset result = structure->transitionOffset();
             attributes = structure->transitionPropertyAttributes();
             if (didFindStructure) {
@@ -1718,7 +1800,11 @@ Structure* Structure::setBrandTransition(VM& vm, Structure* structure, Symbol* b
 
     transition->m_cachedPrototypeChain.setMayBeNull(vm, transition, structure->m_cachedPrototypeChain.get());
     transition->m_blob.setIndexingModeIncludingHistory(structure->indexingModeIncludingHistory());
+#if USE(BUN_JSC_ADDITIONS)
+    transition->setTransitionPropertyName(&brand->uid());
+#else
     transition->m_transitionPropertyName = &brand->uid();
+#endif
     transition->setTransitionPropertyAttributes(0);
     transition->setPropertyTable(vm, structure->takePropertyTableOrCloneIfPinned(vm));
     transition->setMaxOffset(vm, structure->maxOffset());
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index de5071e126920..69ba95b6a0442 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -787,7 +787,20 @@ class Structure : public JSCell {
 
     static bool shouldConvertToPolyProto(const Structure* a, const Structure* b);
 
+#if USE(BUN_JSC_ADDITIONS)
+    UniquedStringImpl* transitionPropertyName() const { return reinterpret_cast<UniquedStringImpl*>(m_transitionPropertyNameBits); }
+    void setTransitionPropertyName(UniquedStringImpl* rep)
+    {
+        if (auto* old = transitionPropertyName())
+            uidDeref(old);
+        if (rep)
+            uidRef(rep);
+        m_transitionPropertyNameBits = reinterpret_cast<uintptr_t>(rep);
+    }
+    void clearTransitionPropertyName() { setTransitionPropertyName(nullptr); }
+#else
     UniquedStringImpl* transitionPropertyName() const { return m_transitionPropertyName.get(); }
+#endif
 
     struct PropertyHashEntry {
         const HashTable* table;
@@ -1027,7 +1040,11 @@ class Structure : public JSCell {
 
     WriteBarrier<JSCell> m_previousOrRareData;
 
+#if USE(BUN_JSC_ADDITIONS)
+    uintptr_t m_transitionPropertyNameBits { 0 };
+#else
     CompactRefPtr<UniquedStringImpl> m_transitionPropertyName;
+#endif
 
     const ClassInfo* m_classInfo;
 
diff --git a/Source/JavaScriptCore/runtime/StructureInlines.h b/Source/JavaScriptCore/runtime/StructureInlines.h
index 850a0db478da9..aab92199e9992 100644
--- a/Source/JavaScriptCore/runtime/StructureInlines.h
+++ b/Source/JavaScriptCore/runtime/StructureInlines.h
@@ -86,6 +86,26 @@ void Structure::forEachPropertyConcurrently(const Functor& functor)
     UncheckedKeyHashSet<UniquedStringImpl*> seenProperties;
 
     for (auto* structure : structures) {
+#if USE(BUN_JSC_ADDITIONS)
+        if (!structure->transitionPropertyName() || seenProperties.contains(structure->transitionPropertyName()))
+            continue;
+
+        seenProperties.add(structure->transitionPropertyName());
+
+        switch (structure->transitionKind()) {
+        case TransitionKind::PropertyAddition:
+        case TransitionKind::PropertyAttributeChange:
+            break;
+        case TransitionKind::PropertyDeletion:
+        case TransitionKind::SetBrand:
+            continue;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+
+        if (!functor(PropertyTableEntry(structure->transitionPropertyName(), structure->transitionOffset(), structure->transitionPropertyAttributes()))) {
+#else
         if (!structure->m_transitionPropertyName || seenProperties.contains(structure->m_transitionPropertyName.get()))
             continue;
 
@@ -104,6 +124,7 @@ void Structure::forEachPropertyConcurrently(const Functor& functor)
         }
 
         if (!functor(PropertyTableEntry(structure->m_transitionPropertyName.get(), structure->transitionOffset(), structure->transitionPropertyAttributes()))) {
+#endif
             if (didFindStructure) {
                 assertIsHeld(tableStructure->m_lock); // Sadly Clang needs some help here.
                 tableStructure->m_lock.unlock();
@@ -492,7 +513,11 @@ inline void Structure::pin(const AbstractLocker&, VM& vm, PropertyTable* table)
     setIsPinnedPropertyTable(true);
     setPropertyTable(vm, table);
     clearPreviousID();
+#if USE(BUN_JSC_ADDITIONS)
+    clearTransitionPropertyName();
+#else
     m_transitionPropertyName = nullptr;
+#endif
 }
 
 ALWAYS_INLINE bool Structure::shouldConvertToPolyProto(const Structure* a, const Structure* b)
@@ -596,7 +621,11 @@ ALWAYS_INLINE StructureTransitionTable::Hash::Key StructureTransitionTable::Hash
     case TransitionKind::ChangePrototype:
         return StructureTransitionTable::Hash::createKey(structure->storedPrototype().isNull() ? nullptr : asObject(structure->storedPrototype()), structure->transitionPropertyAttributes(), structure->transitionKind());
     default:
+#if USE(BUN_JSC_ADDITIONS)
+        return StructureTransitionTable::Hash::createKey(structure->transitionPropertyName(), structure->transitionPropertyAttributes(), structure->transitionKind());
+#else
         return StructureTransitionTable::Hash::createKey(structure->m_transitionPropertyName.get(), structure->transitionPropertyAttributes(), structure->transitionKind());
+#endif
     }
 }
 
diff --git a/Source/JavaScriptCore/runtime/SymbolTable.h b/Source/JavaScriptCore/runtime/SymbolTable.h
index 935cc35109744..8a341e32f8a73 100644
--- a/Source/JavaScriptCore/runtime/SymbolTable.h
+++ b/Source/JavaScriptCore/runtime/SymbolTable.h
@@ -434,10 +434,17 @@ class SymbolTable final : public JSCell {
     typedef JSCell Base;
     static constexpr unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
 
+#if USE(BUN_JSC_ADDITIONS)
+    typedef UncheckedKeyHashMap<FiberAwareRefPtr, SymbolTableEntry, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, SymbolTableIndexHashTraits> Map;
+    typedef UncheckedKeyHashMap<FiberAwareRefPtr, GlobalVariableID, IdentifierRepHash> UniqueIDMap;
+    typedef UncheckedKeyHashMap<FiberAwareRefPtr, RefPtr<TypeSet>, IdentifierRepHash> UniqueTypeSetMap;
+    typedef UncheckedKeyHashMap<VarOffset, FiberAwareRefPtr> OffsetToVariableMap;
+#else
     typedef UncheckedKeyHashMap<RefPtr<UniquedStringImpl>, SymbolTableEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, SymbolTableIndexHashTraits> Map;
     typedef UncheckedKeyHashMap<RefPtr<UniquedStringImpl>, GlobalVariableID, IdentifierRepHash> UniqueIDMap;
     typedef UncheckedKeyHashMap<RefPtr<UniquedStringImpl>, RefPtr<TypeSet>, IdentifierRepHash> UniqueTypeSetMap;
     typedef UncheckedKeyHashMap<VarOffset, RefPtr<UniquedStringImpl>> OffsetToVariableMap;
+#endif
     typedef Vector<SymbolTableEntry*> LocalToEntryVec;
     typedef WTF::IteratorRange<typename PrivateNameEnvironment::iterator> PrivateNameIteratorRange;
 

From fd4599f4d2164a0c4e1e381bcf269a0332ce5c31 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 23:23:11 +0000
Subject: [PATCH 38/69] InlinePropertyKey phase C: JIT tag branches at
 StringImpl::m_hashAndFlags load sites
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Helpers: AssemblyHelpers::branchIfActualRopeStringImpl/branchIfInlineStringImpl; JIT operation operationInlinePropertyKeyHash(uintptr_t); FTL isInlineStringImplPtr(LValue).

C.1 (flagIsAtom bypass for fiber words): split branchIfRopeStringImpl into rope->slow / inline->atom-passed at AssemblyHelpers.cpp loadCacheableIdentifierImpl, JITOpcodes.cpp stricteq, DFGSpeculativeJIT speculateStringIdentAndLoadStorage, DFGSpeculativeJIT64/32_64 atom-ident sites, FTLLowerDFGToB3 patchpoint + compileHasOwnProperty + speculateStringIdent.

C.2 (hash extract): branch on bit-1 and call operationInlinePropertyKeyHash in the inline arm at AssemblyHelpers.cpp MegamorphicCache primary probes, DFGSpeculativeJIT64/32_64 HasOwnPropertyCache, FTL compileHasOwnProperty. MapHash sites already route inline to the existing slowPath (branchIfRopeStringImpl tests notStringImplMask) so operationMapHash handles them — no edit needed there.

DFGOperations.cpp codePointCompareMaybeInline: decodes either StringImpl* arg as a fiber-word StringView before codePointCompare, so CompareStringIdent works after C.1 lets fiber words through speculateStringIdent.

All edits #if USE(BUN_JSC_ADDITIONS) / #else original verbatim / #endif.
---
 Source/JavaScriptCore/dfg/DFGOperations.cpp   | 42 ++++++++
 .../JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  |  8 ++
 .../dfg/DFGSpeculativeJIT32_64.cpp            | 35 +++++++
 .../dfg/DFGSpeculativeJIT64.cpp               | 47 +++++++++
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 99 +++++++++++++++++++
 Source/JavaScriptCore/jit/AssemblyHelpers.cpp | 43 ++++++++
 Source/JavaScriptCore/jit/AssemblyHelpers.h   | 14 +++
 Source/JavaScriptCore/jit/JITOpcodes.cpp      | 21 ++++
 Source/JavaScriptCore/jit/JITOperations.cpp   | 10 ++
 Source/JavaScriptCore/jit/JITOperations.h     |  4 +
 10 files changed, 323 insertions(+)

diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 4741eb976e649..7bd5d2f9bb40c 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -49,6 +49,9 @@
 #include "FTLOSREntry.h"
 #include "FrameTracers.h"
 #include "HasOwnPropertyCache.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
 #include "Interpreter.h"
 #include "InterpreterInlines.h"
 #include "IntlCollator.h"
@@ -4819,24 +4822,63 @@ JSC_DEFINE_JIT_OPERATION(operationSwitchString, char*, (JSGlobalObject* globalOb
     OPERATION_RETURN(scope, linkedTable.ctiForValue(*unlinkedTable, str->impl()).taggedPtr<char*>());
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+// Phase C.1 lets fiber words pass speculateStringIdentAndLoadStorage, so either
+// argument here may be a bit-1-tagged inline property key rather than a heap
+// StringImpl*. Decode to a StringView over the word's embedded bytes before
+// handing off to codePointCompare.
+static ALWAYS_INLINE std::strong_ordering codePointCompareMaybeInline(StringImpl* a, StringImpl* b)
+{
+    uintptr_t aWord = reinterpret_cast<uintptr_t>(a);
+    uintptr_t bWord = reinterpret_cast<uintptr_t>(b);
+    auto viewFor = [](const uintptr_t& word, StringImpl* impl) ALWAYS_INLINE_LAMBDA -> StringView {
+        if (isInlinePropertyKey(word)) [[unlikely]] {
+            unsigned len = inlinePropertyKeyLength(word);
+            const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+            if (inlinePropertyKeyIs8Bit(word))
+                return StringView { std::span<const Latin1Character> { bytes + 1, len } };
+            return StringView { std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len } };
+        }
+        return StringView { impl };
+    };
+    return codePointCompare(viewFor(aWord, a), viewFor(bWord, b));
+}
+#endif
+
 JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationCompareStringImplLess, uintptr_t, (StringImpl* a, StringImpl* b))
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return codePointCompareMaybeInline(a, b) < 0;
+#else
     return codePointCompare(a, b) < 0;
+#endif
 }
 
 JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationCompareStringImplLessEq, uintptr_t, (StringImpl* a, StringImpl* b))
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return codePointCompareMaybeInline(a, b) <= 0;
+#else
     return codePointCompare(a, b) <= 0;
+#endif
 }
 
 JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationCompareStringImplGreater, uintptr_t, (StringImpl* a, StringImpl* b))
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return codePointCompareMaybeInline(a, b) > 0;
+#else
     return codePointCompare(a, b) > 0;
+#endif
 }
 
 JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationCompareStringImplGreaterEq, uintptr_t, (StringImpl* a, StringImpl* b))
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return codePointCompareMaybeInline(a, b) >= 0;
+#else
     return codePointCompare(a, b) >= 0;
+#endif
 }
 
 JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationCompareHeapBigIntLess, uintptr_t, (JSCell* a, JSCell* b))
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 0936abf4cacb2..01308525faafc 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -12878,9 +12878,17 @@ void SpeculativeJIT::speculateStringIdentAndLoadStorage(Edge edge, GPRReg string
     if (!needsTypeCheck(edge, SpecStringIdent | ~SpecString))
         return;
 
+#if USE(BUN_JSC_ADDITIONS)
+    if (canBeRope(edge))
+        speculationCheck(BadStringType, JSValueSource::unboxedCell(string), edge, branchIfActualRopeStringImpl(storage));
+    Jump isInline = branchIfInlineStringImpl(storage);
+    speculationCheck(BadStringType, JSValueSource::unboxedCell(string), edge, branchTest32(Zero, Address(storage, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+    isInline.link(this);
+#else
     if (canBeRope(edge))
         speculationCheck(BadStringType, JSValueSource::unboxedCell(string), edge, branchIfRopeStringImpl(storage));
     speculationCheck(BadStringType, JSValueSource::unboxedCell(string), edge, branchTest32(Zero, Address(storage, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+#endif
 
     m_interpreter.filter(edge, SpecStringIdent | ~SpecString);
 }
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index 06c06e28c75b4..c0b4c6d49ca65 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -4254,20 +4254,42 @@ void SpeculativeJIT::compile(Node* node)
         case StringUse: {
             speculateString(node->child2(), keyRegs.payloadGPR());
             loadPtr(Address(keyRegs.payloadGPR(), JSString::offsetOfValue()), implGPR);
+#if USE(BUN_JSC_ADDITIONS)
+            slowPath.append(branchIfActualRopeStringImpl(implGPR));
+            {
+                Jump isInline = branchIfInlineStringImpl(implGPR);
+                slowPath.append(branchTest32(
+                    Zero, Address(implGPR, StringImpl::flagsOffset()),
+                    TrustedImm32(StringImpl::flagIsAtom())));
+                isInline.link(this);
+            }
+#else
             slowPath.append(branchIfRopeStringImpl(implGPR));
             slowPath.append(branchTest32(
                 Zero, Address(implGPR, StringImpl::flagsOffset()),
                 TrustedImm32(StringImpl::flagIsAtom())));
+#endif
             break;
         }
         case UntypedUse: {
             slowPath.append(branchIfNotCell(keyRegs));
             auto isNotString = branchIfNotString(keyRegs.payloadGPR());
             loadPtr(Address(keyRegs.payloadGPR(), JSString::offsetOfValue()), implGPR);
+#if USE(BUN_JSC_ADDITIONS)
+            slowPath.append(branchIfActualRopeStringImpl(implGPR));
+            {
+                Jump isInline = branchIfInlineStringImpl(implGPR);
+                slowPath.append(branchTest32(
+                    Zero, Address(implGPR, StringImpl::flagsOffset()),
+                    TrustedImm32(StringImpl::flagIsAtom())));
+                isInline.link(this);
+            }
+#else
             slowPath.append(branchIfRopeStringImpl(implGPR));
             slowPath.append(branchTest32(
                 Zero, Address(implGPR, StringImpl::flagsOffset()),
                 TrustedImm32(StringImpl::flagIsAtom())));
+#endif
             auto hasUniquedImpl = jump();
 
             isNotString.link(this);
@@ -4287,8 +4309,21 @@ void SpeculativeJIT::compile(Node* node)
         // So we either get super lucky and use zero for the hash and somehow collide with the entity
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
+#if USE(BUN_JSC_ADDITIONS)
+        {
+            // implGPR may hold an inline fiber word (bit 1 set) after the atom-check bypass above.
+            Jump isInline = branchIfInlineStringImpl(implGPR);
+            load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
+            urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
+            Jump haveHash = jump();
+            isInline.link(this);
+            callOperationWithSilentSpill(operationInlinePropertyKeyHash, hashGPR, implGPR);
+            haveHash.link(this);
+        }
+#else
         load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
         urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
+#endif
         load32(Address(objectGPR, JSCell::structureIDOffset()), structureIDGPR);
         add32(structureIDGPR, hashGPR);
         and32(TrustedImm32(HasOwnPropertyCache::mask), hashGPR);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index 7ee9603b5dd71..958d8ea10f7da 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -6053,22 +6053,46 @@ void SpeculativeJIT::compile(Node* node)
         case StringUse: {
             speculateString(node->child2(), keyGPR);
             loadPtr(Address(keyGPR, JSString::offsetOfValue()), implGPR);
+#if USE(BUN_JSC_ADDITIONS)
+            if (canBeRope(node->child2()))
+                slowPath.append(branchIfActualRopeStringImpl(implGPR));
+            {
+                Jump isInline = branchIfInlineStringImpl(implGPR);
+                slowPath.append(branchTest32(
+                    Zero, Address(implGPR, StringImpl::flagsOffset()),
+                    TrustedImm32(StringImpl::flagIsAtom())));
+                isInline.link(this);
+            }
+#else
             if (canBeRope(node->child2()))
                 slowPath.append(branchIfRopeStringImpl(implGPR));
             slowPath.append(branchTest32(
                 Zero, Address(implGPR, StringImpl::flagsOffset()),
                 TrustedImm32(StringImpl::flagIsAtom())));
+#endif
             break;
         }
         case UntypedUse: {
             slowPath.append(branchIfNotCell(JSValueRegs(keyGPR)));
             auto isNotString = branchIfNotString(keyGPR);
             loadPtr(Address(keyGPR, JSString::offsetOfValue()), implGPR);
+#if USE(BUN_JSC_ADDITIONS)
+            if (canBeRope(node->child2()))
+                slowPath.append(branchIfActualRopeStringImpl(implGPR));
+            {
+                Jump isInline = branchIfInlineStringImpl(implGPR);
+                slowPath.append(branchTest32(
+                    Zero, Address(implGPR, StringImpl::flagsOffset()),
+                    TrustedImm32(StringImpl::flagIsAtom())));
+                isInline.link(this);
+            }
+#else
             if (canBeRope(node->child2()))
                 slowPath.append(branchIfRopeStringImpl(implGPR));
             slowPath.append(branchTest32(
                 Zero, Address(implGPR, StringImpl::flagsOffset()),
                 TrustedImm32(StringImpl::flagIsAtom())));
+#endif
             auto hasUniquedImpl = jump();
 
             isNotString.link(this);
@@ -6088,8 +6112,21 @@ void SpeculativeJIT::compile(Node* node)
         // So we either get super lucky and use zero for the hash and somehow collide with the entity
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
+#if USE(BUN_JSC_ADDITIONS)
+        {
+            // implGPR may hold an inline fiber word (bit 1 set) after the atom-check bypass above.
+            Jump isInline = branchIfInlineStringImpl(implGPR);
+            load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
+            urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
+            Jump haveHash = jump();
+            isInline.link(this);
+            callOperationWithSilentSpill(operationInlinePropertyKeyHash, hashGPR, implGPR);
+            haveHash.link(this);
+        }
+#else
         load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
         urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
+#endif
         load32(Address(objectGPR, JSCell::structureIDOffset()), structureIDGPR);
         add32(structureIDGPR, hashGPR);
         and32(TrustedImm32(HasOwnPropertyCache::mask), hashGPR);
@@ -8400,9 +8437,19 @@ void SpeculativeJIT::compileGetByValWithThisMegamorphic(Node* node)
     slowCases.append(branchIfNotCell(subscriptRegs));
     slowCases.append(branchIfNotString(subscriptRegs.payloadGPR()));
     loadPtr(Address(subscriptRegs.payloadGPR(), JSString::offsetOfValue()), scratch4GPR);
+#if USE(BUN_JSC_ADDITIONS)
+    if (canBeRope(m_graph.child(node, 2)))
+        slowCases.append(branchIfActualRopeStringImpl(scratch4GPR));
+    {
+        Jump isInline = branchIfInlineStringImpl(scratch4GPR);
+        slowCases.append(branchTest32(Zero, Address(scratch4GPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+        isInline.link(this);
+    }
+#else
     if (canBeRope(m_graph.child(node, 2)))
         slowCases.append(branchIfRopeStringImpl(scratch4GPR));
     slowCases.append(branchTest32(Zero, Address(scratch4GPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+#endif
 
     slowCases.append(loadMegamorphicProperty(vm(), baseGPR, scratch4GPR, nullptr, scratch3GPR, scratch1GPR, scratch2GPR, scratch3GPR));
     addSlowPathGenerator(slowPathCall(slowCases, this, operationGetByValWithThisMegamorphicGeneric, scratch3GPR, LinkableConstant::globalObject(*this, node), baseGPR, subscriptRegs, thisValueRegs));
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 2db7c3216cb84..973efa4402a51 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -4880,9 +4880,17 @@ class LowerDFGToB3 {
             slowCases.append(jit.branchIfNotCell(subscriptGPR));
             slowCases.append(jit.branchIfNotString(subscriptGPR));
             jit.loadPtr(CCallHelpers::Address(subscriptGPR, JSString::offsetOfValue()), scratch4GPR);
+#if USE(BUN_JSC_ADDITIONS)
+            if (needsRopeCase)
+                slowCases.append(jit.branchTestPtr(CCallHelpers::NonZero, scratch4GPR, CCallHelpers::TrustedImm32(JSString::isRopeInPointer)));
+            auto isInline = jit.branchTestPtr(CCallHelpers::NonZero, scratch4GPR, CCallHelpers::TrustedImm32(JSString::isInlineInPointer));
+            slowCases.append(jit.branchTest32(CCallHelpers::Zero, CCallHelpers::Address(scratch4GPR, StringImpl::flagsOffset()), CCallHelpers::TrustedImm32(StringImpl::flagIsAtom())));
+            isInline.link(&jit);
+#else
             if (needsRopeCase)
                 slowCases.append(jit.branchIfRopeStringImpl(scratch4GPR));
             slowCases.append(jit.branchTest32(CCallHelpers::Zero, CCallHelpers::Address(scratch4GPR, StringImpl::flagsOffset()), CCallHelpers::TrustedImm32(StringImpl::flagIsAtom())));
+#endif
 
             slowCases.append(jit.loadMegamorphicProperty(state->vm(), baseGPR, scratch4GPR, nullptr, resultGPR, scratch1GPR, scratch2GPR, scratch3GPR));
             CCallHelpers::Label doneForSlow = jit.label();
@@ -17595,6 +17603,24 @@ IGNORE_CLANG_WARNINGS_END
         LValue keyAsValue = nullptr;
         switch (m_node->child2().useKind()) {
         case StringUse: {
+#if USE(BUN_JSC_ADDITIONS)
+            LBasicBlock isNonEmptyString = m_out.newBlock();
+            LBasicBlock isNotInline = m_out.newBlock();
+            LBasicBlock isAtomString = m_out.newBlock();
+
+            keyAsValue = lowString(m_node->child2());
+            uniquedStringImpl = m_out.loadPtr(keyAsValue, m_heaps.JSString_value);
+            m_out.branch(isActualRopeStringImplPtr(uniquedStringImpl), rarely(slowCase), usually(isNonEmptyString));
+
+            lastNext = m_out.appendTo(isNonEmptyString, isNotInline);
+            m_out.branch(isInlineStringImplPtr(uniquedStringImpl), unsure(isAtomString), unsure(isNotInline));
+
+            m_out.appendTo(isNotInline, isAtomString);
+            LValue isNotAtomic = m_out.testIsZero32(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::flagIsAtom()));
+            m_out.branch(isNotAtomic, rarely(slowCase), usually(isAtomString));
+
+            m_out.appendTo(isAtomString, slowCase);
+#else
             LBasicBlock isNonEmptyString = m_out.newBlock();
             LBasicBlock isAtomString = m_out.newBlock();
 
@@ -17607,6 +17633,7 @@ IGNORE_CLANG_WARNINGS_END
             m_out.branch(isNotAtomic, rarely(slowCase), usually(isAtomString));
 
             m_out.appendTo(isAtomString, slowCase);
+#endif
             break;
         }
         case SymbolUse: {
@@ -17620,6 +17647,9 @@ IGNORE_CLANG_WARNINGS_END
             LBasicBlock isStringCase = m_out.newBlock();
             LBasicBlock notStringCase = m_out.newBlock();
             LBasicBlock isNonEmptyString = m_out.newBlock();
+#if USE(BUN_JSC_ADDITIONS)
+            LBasicBlock isNotInline = m_out.newBlock();
+#endif
             LBasicBlock isSymbolCase = m_out.newBlock();
             LBasicBlock hasUniquedStringImpl = m_out.newBlock();
 
@@ -17629,6 +17659,20 @@ IGNORE_CLANG_WARNINGS_END
             lastNext = m_out.appendTo(isCellCase, isStringCase);
             m_out.branch(isString(keyAsValue), unsure(isStringCase), unsure(notStringCase));
 
+#if USE(BUN_JSC_ADDITIONS)
+            m_out.appendTo(isStringCase, isNonEmptyString);
+            LValue implFromString = m_out.loadPtr(keyAsValue, m_heaps.JSString_value);
+            m_out.branch(isActualRopeStringImplPtr(implFromString), rarely(slowCase), usually(isNonEmptyString));
+
+            m_out.appendTo(isNonEmptyString, isNotInline);
+            ValueFromBlock stringInlineResult = m_out.anchor(implFromString);
+            m_out.branch(isInlineStringImplPtr(implFromString), unsure(hasUniquedStringImpl), unsure(isNotInline));
+
+            m_out.appendTo(isNotInline, notStringCase);
+            ValueFromBlock stringResult = m_out.anchor(implFromString);
+            LValue isNotAtomic = m_out.testIsZero32(m_out.load32(implFromString, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::flagIsAtom()));
+            m_out.branch(isNotAtomic, rarely(slowCase), usually(hasUniquedStringImpl));
+#else
             m_out.appendTo(isStringCase, isNonEmptyString);
             m_out.branch(isNotRopeString(keyAsValue, m_node->child2()), usually(isNonEmptyString), rarely(slowCase));
 
@@ -17637,6 +17681,7 @@ IGNORE_CLANG_WARNINGS_END
             ValueFromBlock stringResult = m_out.anchor(implFromString);
             LValue isNotAtomic = m_out.testIsZero32(m_out.load32(implFromString, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::flagIsAtom()));
             m_out.branch(isNotAtomic, rarely(slowCase), usually(hasUniquedStringImpl));
+#endif
 
             m_out.appendTo(notStringCase, isSymbolCase);
             m_out.branch(isSymbol(keyAsValue), unsure(isSymbolCase), unsure(slowCase));
@@ -17646,7 +17691,11 @@ IGNORE_CLANG_WARNINGS_END
             m_out.jump(hasUniquedStringImpl);
 
             m_out.appendTo(hasUniquedStringImpl, slowCase);
+#if USE(BUN_JSC_ADDITIONS)
+            uniquedStringImpl = m_out.phi(pointerType(), stringInlineResult, stringResult, symbolResult);
+#else
             uniquedStringImpl = m_out.phi(pointerType(), stringResult, symbolResult);
+#endif
             break;
         }
         default:
@@ -17661,7 +17710,27 @@ IGNORE_CLANG_WARNINGS_END
         // So we either get super lucky and use zero for the hash and somehow collide with the entity
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
+#if USE(BUN_JSC_ADDITIONS)
+        // uniquedStringImpl may be an inline fiber word (bit 1 set) after the atom-check bypass above.
+        LBasicBlock realImplCase = m_out.newBlock();
+        LBasicBlock inlineImplCase = m_out.newBlock();
+        LBasicBlock haveHashBlock = m_out.newBlock();
+
+        m_out.branch(isInlineStringImplPtr(uniquedStringImpl), rarely(inlineImplCase), usually(realImplCase));
+
+        m_out.appendTo(realImplCase, inlineImplCase);
+        ValueFromBlock realImplHash = m_out.anchor(m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount)));
+        m_out.jump(haveHashBlock);
+
+        m_out.appendTo(inlineImplCase, haveHashBlock);
+        ValueFromBlock inlineImplHash = m_out.anchor(vmCall(Int32, operationInlinePropertyKeyHash, uniquedStringImpl));
+        m_out.jump(haveHashBlock);
+
+        m_out.appendTo(haveHashBlock, slowCase);
+        LValue hash = m_out.phi(Int32, realImplHash, inlineImplHash);
+#else
         LValue hash = m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
+#endif
 
         LValue structureID = m_out.load32(object, m_heaps.JSCell_structureID);
         LValue index = m_out.add(hash, structureID);
@@ -25841,6 +25910,18 @@ IGNORE_CLANG_WARNINGS_END
         return m_out.testIsZeroPtr(m_out.loadPtr(string, m_heaps.JSString_value), m_out.constIntPtr(JSString::notStringImplMask));
     }
 
+#if USE(BUN_JSC_ADDITIONS)
+    LValue isInlineStringImplPtr(LValue stringImpl)
+    {
+        return m_out.testNonZeroPtr(stringImpl, m_out.constIntPtr(JSString::isInlineInPointer));
+    }
+
+    LValue isActualRopeStringImplPtr(LValue stringImpl)
+    {
+        return m_out.testNonZeroPtr(stringImpl, m_out.constIntPtr(JSString::isRopeInPointer));
+    }
+#endif
+
     LValue isNotSymbol(LValue cell, SpeculatedType type = SpecFullTop)
     {
         if (LValue proven = isProvenValue(type & SpecCell, ~SpecSymbol))
@@ -26330,12 +26411,30 @@ IGNORE_CLANG_WARNINGS_END
         if (!m_interpreter.needsTypeCheck(edge, SpecStringIdent | ~SpecString))
             return;
 
+#if USE(BUN_JSC_ADDITIONS)
+        speculate(BadStringType, jsValueValue(string), edge.node(), isActualRopeStringImplPtr(stringImpl));
+
+        LBasicBlock notInline = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        m_out.branch(isInlineStringImplPtr(stringImpl), unsure(continuation), unsure(notInline));
+
+        LBasicBlock lastNext = m_out.appendTo(notInline, continuation);
+        speculate(
+            BadStringType, jsValueValue(string), edge.node(),
+            m_out.testIsZero32(
+                m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags),
+                m_out.constInt32(StringImpl::flagIsAtom())));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+#else
         speculate(BadStringType, jsValueValue(string), edge.node(), isRopeString(string));
         speculate(
             BadStringType, jsValueValue(string), edge.node(),
             m_out.testIsZero32(
                 m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags),
                 m_out.constInt32(StringImpl::flagIsAtom())));
+#endif
         m_interpreter.filter(edge, SpecStringIdent | ~SpecString);
     }
 
diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
index 650e097f54e18..9e057d6cf7376 100644
--- a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
@@ -517,9 +517,18 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadMegamorphicProperty(VM& vm, GPRRe
         // So we either get super lucky and use zero for the hash and somehow collide with the entity
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
+#if USE(BUN_JSC_ADDITIONS)
+        // uidGPR may hold an inline fiber word (bit 1 set); dereferencing it would fault.
+        // No silent-spill machinery here, so take the C++ slow path for inline keys.
+        slowCases.append(branchIfInlineStringImpl(uidGPR));
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
         urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
         add32(scratch2GPR, scratch3GPR);
+#else
+        load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
+        urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+        add32(scratch2GPR, scratch3GPR);
+#endif
     }
 
     and32(TrustedImm32(MegamorphicCache::loadCachePrimaryMask), scratch3GPR);
@@ -614,9 +623,18 @@ std::tuple<AssemblyHelpers::JumpList, AssemblyHelpers::JumpList> AssemblyHelpers
         // So we either get super lucky and use zero for the hash and somehow collide with the entity
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
+#if USE(BUN_JSC_ADDITIONS)
+        // uidGPR may hold an inline fiber word (bit 1 set); dereferencing it would fault.
+        // No silent-spill machinery here, so take the C++ slow path for inline keys.
+        slowCases.append(branchIfInlineStringImpl(uidGPR));
+        load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
+        urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+        add32(scratch2GPR, scratch3GPR);
+#else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
         urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
         add32(scratch2GPR, scratch3GPR);
+#endif
     }
 
     and32(TrustedImm32(MegamorphicCache::storeCachePrimaryMask), scratch3GPR);
@@ -709,9 +727,18 @@ AssemblyHelpers::JumpList AssemblyHelpers::hasMegamorphicProperty(VM& vm, GPRReg
         // So we either get super lucky and use zero for the hash and somehow collide with the entity
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
+#if USE(BUN_JSC_ADDITIONS)
+        // uidGPR may hold an inline fiber word (bit 1 set); dereferencing it would fault.
+        // No silent-spill machinery here, so take the C++ slow path for inline keys.
+        slowCases.append(branchIfInlineStringImpl(uidGPR));
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
         urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
         add32(scratch2GPR, scratch3GPR);
+#else
+        load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
+        urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+        add32(scratch2GPR, scratch3GPR);
+#endif
     }
 
     and32(TrustedImm32(MegamorphicCache::hasCachePrimaryMask), scratch3GPR);
@@ -776,9 +803,17 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadCacheableIdentifierImpl(GPRReg pr
     JumpList slowCases;
     if (propertyIsString) {
         loadPtr(Address(propertyGPR, JSString::offsetOfValue()), destGPR);
+#if USE(BUN_JSC_ADDITIONS)
+        if (canBeRope)
+            slowCases.append(branchIfActualRopeStringImpl(destGPR));
+        Jump isInline = branchIfInlineStringImpl(destGPR);
+        slowCases.append(branchTest32(Zero, Address(destGPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+        isInline.link(this);
+#else
         if (canBeRope)
             slowCases.append(branchIfRopeStringImpl(destGPR));
         slowCases.append(branchTest32(Zero, Address(destGPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+#endif
     } else if (propertyIsSymbol)
         loadPtr(Address(propertyGPR, Symbol::offsetOfSymbolImpl()), destGPR);
     else {
@@ -790,9 +825,17 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadCacheableIdentifierImpl(GPRReg pr
 
         isString.link(this);
         loadPtr(Address(propertyGPR, JSString::offsetOfValue()), destGPR);
+#if USE(BUN_JSC_ADDITIONS)
+        if (canBeRope)
+            slowCases.append(branchIfActualRopeStringImpl(destGPR));
+        Jump isInline = branchIfInlineStringImpl(destGPR);
+        slowCases.append(branchTest32(Zero, Address(destGPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+        isInline.link(this);
+#else
         if (canBeRope)
             slowCases.append(branchIfRopeStringImpl(destGPR));
         slowCases.append(branchTest32(Zero, Address(destGPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+#endif
 
         done.link(this);
     }
diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.h b/Source/JavaScriptCore/jit/AssemblyHelpers.h
index 75bb221c4a5fc..426b27ddce3e8 100644
--- a/Source/JavaScriptCore/jit/AssemblyHelpers.h
+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.h
@@ -1256,6 +1256,20 @@ class AssemblyHelpers : public MacroAssembler {
         return branchTestPtr(Zero, stringImplGPR, TrustedImm32(JSString::notStringImplMask));
     }
 
+#if USE(BUN_JSC_ADDITIONS)
+    // Tests only the rope bit (bit 0); inline small strings (bit 1) are not ropes.
+    Jump branchIfActualRopeStringImpl(GPRReg stringImplGPR)
+    {
+        return branchTestPtr(NonZero, stringImplGPR, TrustedImm32(JSString::isRopeInPointer));
+    }
+
+    // Tests only the inline-small-string bit (bit 1).
+    Jump branchIfInlineStringImpl(GPRReg stringImplGPR)
+    {
+        return branchTestPtr(NonZero, stringImplGPR, TrustedImm32(JSString::isInlineInPointer));
+    }
+#endif
+
 #if USE(JSVALUE64)
     JumpList branchIfResizableOrGrowableSharedTypedArrayIsOutOfBounds(GPRReg baseGPR, GPRReg scratchGPR, GPRReg scratch2GPR, std::optional<TypedArrayType>);
     void loadTypedArrayByteLength(GPRReg baseGPR, GPRReg valueGPR, GPRReg scratchGPR, GPRReg scratch2GPR, TypedArrayType);
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index 9a21f8ae51dc0..cf0fa6fa5923a 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -796,8 +796,15 @@ void JIT::compileOpStrictEq(const JSInstruction* currentInstruction)
 
         fallThrough.append(branchIfNotString(stringGPR));
         loadPtr(Address(stringGPR, JSString::offsetOfValue()), regT5);
+#if USE(BUN_JSC_ADDITIONS)
+        addSlowCase(branchIfActualRopeStringImpl(regT5));
+        Jump isInline = branchIfInlineStringImpl(regT5);
+        addSlowCase(branchTest32(Zero, Address(regT5, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+        isInline.link(this);
+#else
         addSlowCase(branchIfRopeStringImpl(regT5));
         addSlowCase(branchTest32(Zero, Address(regT5, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+#endif
         fallThrough.append(branchPtr(NotEqual, regT5, TrustedImmPtr(string->tryGetValueImpl())));
 
         equals.link(this);
@@ -971,8 +978,15 @@ void JIT::compileOpStrictEqJump(const JSInstruction* currentInstruction)
 
             fallThrough.append(branchIfNotString(stringGPR));
             loadPtr(Address(stringGPR, JSString::offsetOfValue()), regT2);
+#if USE(BUN_JSC_ADDITIONS)
+            addSlowCase(branchIfActualRopeStringImpl(regT2));
+            Jump isInline = branchIfInlineStringImpl(regT2);
+            addSlowCase(branchTest32(Zero, Address(regT2, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+            isInline.link(this);
+#else
             addSlowCase(branchIfRopeStringImpl(regT2));
             addSlowCase(branchTest32(Zero, Address(regT2, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+#endif
             addJump(branchPtr(Equal, regT2, TrustedImmPtr(string->tryGetValueImpl())), target);
         } else {
             fallThrough.append(branch64(Equal, stringGPR, knownStringGPR));
@@ -980,8 +994,15 @@ void JIT::compileOpStrictEqJump(const JSInstruction* currentInstruction)
 
             addJump(branchIfNotString(stringGPR), target);
             loadPtr(Address(stringGPR, JSString::offsetOfValue()), regT2);
+#if USE(BUN_JSC_ADDITIONS)
+            addSlowCase(branchIfActualRopeStringImpl(regT2));
+            Jump isInline = branchIfInlineStringImpl(regT2);
+            addSlowCase(branchTest32(Zero, Address(regT2, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+            isInline.link(this);
+#else
             addSlowCase(branchIfRopeStringImpl(regT2));
             addSlowCase(branchTest32(Zero, Address(regT2, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+#endif
             addJump(branchPtr(NotEqual, regT2, TrustedImmPtr(string->tryGetValueImpl())), target);
         }
         fallThrough.link(this);
diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
index 5d89cef1f69c4..9eba44f7da133 100644
--- a/Source/JavaScriptCore/jit/JITOperations.cpp
+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
@@ -45,6 +45,9 @@ WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
 #include "GetterSetter.h"
 #include "ICStats.h"
 #include "InlineCacheCompiler.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
 #include "Interpreter.h"
 #include "JIT.h"
 #include "JITExceptions.h"
@@ -4908,6 +4911,13 @@ JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationWriteBarrierSlowPath, void, (VM* vmPo
     vm.writeBarrierSlowPath(cell);
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationInlinePropertyKeyHash, UCPUStrictInt32, (uintptr_t word))
+{
+    return toUCPUStrictInt32(inlinePropertyKeyHash(word));
+}
+#endif
+
 JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationLookupExceptionHandler, void, (VM* vmPointer))
 {
     VM& vm = *vmPointer;
diff --git a/Source/JavaScriptCore/jit/JITOperations.h b/Source/JavaScriptCore/jit/JITOperations.h
index 2e90965ee8169..665cdca12409d 100644
--- a/Source/JavaScriptCore/jit/JITOperations.h
+++ b/Source/JavaScriptCore/jit/JITOperations.h
@@ -445,6 +445,10 @@ JSC_DECLARE_NOEXCEPT_JIT_OPERATION(operationDebuggerWillCallNativeExecutable, vo
 JSC_DECLARE_NOEXCEPT_JIT_OPERATION(operationProcessTypeProfilerLog, void, (VM*));
 JSC_DECLARE_NOEXCEPT_JIT_OPERATION(operationProcessShadowChickenLog, void, (VM*));
 
+#if USE(BUN_JSC_ADDITIONS)
+JSC_DECLARE_NOEXCEPT_JIT_OPERATION(operationInlinePropertyKeyHash, UCPUStrictInt32, (uintptr_t));
+#endif
+
 inline decltype(auto) selectNewFunctionOperation(auto* executable)
 {
     auto function = operationNewFunction;

From bcdb7ac63ad0e9044c5ea881c8c51a156af517bb Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 03:45:50 +0000
Subject: [PATCH 39/69] InlinePropertyKey bugfix pass: D.4 single-rep restored,
 D.6 RefPtr param/48-bit-pack gaps closed, deref guards,
 Lookup/PropertyName/parseIndex fiber decode

---
 .../JavaScriptCore/bytecode/GetByStatus.cpp   |  5 ++
 .../bytecode/InlineCacheCompiler.cpp          | 55 +++++++-----
 .../bytecode/InlineCacheCompiler.h            |  8 ++
 .../JavaScriptCore/bytecode/PutByStatus.cpp   |  5 ++
 .../bytecompiler/BytecodeGenerator.cpp        |  8 ++
 .../bytecompiler/BytecodeGenerator.h          |  8 ++
 Source/JavaScriptCore/dfg/DFGFixupPhase.cpp   |  2 +-
 Source/JavaScriptCore/dfg/DFGOperations.cpp   | 14 +++
 .../JavaScriptCore/dfg/DFGSpeculativeJIT.cpp  |  5 +-
 Source/JavaScriptCore/dfg/DFGValidate.cpp     |  4 +
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 12 +--
 .../JavaScriptCore/heap/HeapSnapshotBuilder.h |  7 ++
 Source/JavaScriptCore/jit/JITOpcodes.cpp      | 12 +--
 Source/JavaScriptCore/jit/JITOperations.cpp   | 28 ++++++
 Source/JavaScriptCore/jsc.cpp                 |  6 ++
 .../JavaScriptCore/parser/ModuleAnalyzer.cpp  |  4 +
 Source/JavaScriptCore/parser/ModuleAnalyzer.h |  4 +
 .../JavaScriptCore/parser/ModuleScopeData.h   |  9 ++
 Source/JavaScriptCore/parser/Parser.cpp       | 17 ++++
 .../parser/SourceProviderCacheItem.h          | 12 +++
 .../parser/VariableEnvironment.cpp            | 10 +--
 .../parser/VariableEnvironment.h              | 21 +++--
 .../parser/VariableEnvironmentInlines.h       |  2 +-
 .../runtime/AbstractModuleRecord.cpp          | 25 ++++++
 .../runtime/AbstractModuleRecord.h            | 10 +++
 .../runtime/CacheableIdentifierInlines.h      | 54 ++++++++----
 Source/JavaScriptCore/runtime/CachedTypes.cpp |  6 +-
 Source/JavaScriptCore/runtime/GetPutInfo.h    |  7 ++
 Source/JavaScriptCore/runtime/Identifier.h    | 53 +++++++++--
 .../runtime/IdentifierInlines.h               | 76 ++++++++++------
 .../runtime/InlinePropertyKey.h               | 25 +++++-
 .../JavaScriptCore/runtime/JSGlobalObject.cpp |  4 +
 .../JavaScriptCore/runtime/JSGlobalObject.h   |  4 +
 .../runtime/JSGlobalObjectInlines.h           |  6 ++
 .../runtime/JSLexicalEnvironment.cpp          |  5 ++
 Source/JavaScriptCore/runtime/JSONObject.cpp  | 47 +++++++++-
 Source/JavaScriptCore/runtime/JSString.h      |  8 +-
 Source/JavaScriptCore/runtime/Lookup.h        | 17 ++++
 .../runtime/ObjectConstructor.cpp             | 38 +++++++-
 .../runtime/ObjectPrototype.cpp               |  4 +
 Source/JavaScriptCore/runtime/PropertyName.h  | 87 +++++++++++++++++--
 .../runtime/PropertyNameArray.h               |  4 +
 Source/JavaScriptCore/runtime/PropertyTable.h | 19 ++++
 .../runtime/RegExpConstructor.cpp             |  6 ++
 Source/JavaScriptCore/runtime/Structure.cpp   |  6 +-
 Source/JavaScriptCore/runtime/SymbolTable.h   | 19 ++++
 46 files changed, 666 insertions(+), 122 deletions(-)

diff --git a/Source/JavaScriptCore/bytecode/GetByStatus.cpp b/Source/JavaScriptCore/bytecode/GetByStatus.cpp
index 7797feae92cd0..af1e22ecbae58 100644
--- a/Source/JavaScriptCore/bytecode/GetByStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/GetByStatus.cpp
@@ -482,8 +482,13 @@ GetByStatus GetByStatus::computeFor(JSGlobalObject* globalObject, const Structur
     if (set.isEmpty())
         return GetByStatus();
 
+#if USE(BUN_JSC_ADDITIONS)
+    if (parseIndex(PropertyName(identifier.uid())))
+        return GetByStatus(LikelyTakesSlowPath);
+#else
     if (parseIndex(*identifier.uid()))
         return GetByStatus(LikelyTakesSlowPath);
+#endif
 
     VM& vm = globalObject->vm();
     auto attempToFold = [&]() -> std::optional<GetByStatus> {
diff --git a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
index 30475e29748df..ff0e78a731c02 100644
--- a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
+++ b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
@@ -1875,11 +1875,22 @@ void InlineCacheCompiler::generateWithGuard(unsigned index, AccessCase& accessCa
         GPRReg propertyGPR = m_propertyCache.propertyGPR();
         // non-rope string check done inside polymorphic access.
 
+#if USE(BUN_JSC_ADDITIONS)
+        UniquedStringImpl* icUid = accessCase.uid();
+        if (uidIsSymbol(icUid))
+            jit.loadPtr(MacroAssembler::Address(propertyGPR, Symbol::offsetOfSymbolImpl()), scratchGPR);
+        else
+            jit.loadPtr(MacroAssembler::Address(propertyGPR, JSString::offsetOfValue()), scratchGPR);
+        // If the cached key is a canonical fiber word, an incoming atom-backed
+        // JSString for the same content won't pointer-match — slow path handles it.
+        fallThrough.append(jit.branchPtr(CCallHelpers::NotEqual, scratchGPR, CCallHelpers::TrustedImmPtr(icUid)));
+#else
         if (accessCase.uid()->isSymbol())
             jit.loadPtr(MacroAssembler::Address(propertyGPR, Symbol::offsetOfSymbolImpl()), scratchGPR);
         else
             jit.loadPtr(MacroAssembler::Address(propertyGPR, JSString::offsetOfValue()), scratchGPR);
         fallThrough.append(jit.branchPtr(CCallHelpers::NotEqual, scratchGPR, CCallHelpers::TrustedImmPtr(accessCase.uid())));
+#endif
     }
 
     auto emitDefaultGuard = [&] () {
@@ -5129,7 +5140,7 @@ AccessGenerationResult InlineCacheCompiler::compile(const GCSafeConcurrentJSLock
 
         if (!hasConstantIdentifier) {
             if (entry->requiresIdentifierNameMatch()) {
-                if (entry->uid()->isSymbol())
+                if (uidIsSymbol(entry->uid()))
                     needsSymbolPropertyCheck = true;
                 else
                     needsStringPropertyCheck = true;
@@ -5214,7 +5225,7 @@ AccessGenerationResult InlineCacheCompiler::compile(const GCSafeConcurrentJSLock
                 for (unsigned i = keys.size(); i--;) {
                     fallThrough.link(&jit);
                     fallThrough.shrink(0);
-                    if (keys[i]->requiresIdentifierNameMatch() && !keys[i]->uid()->isSymbol())
+                    if (keys[i]->requiresIdentifierNameMatch() && !uidIsSymbol(keys[i]->uid()))
                         generateWithGuard(i, keys[i].get(), fallThrough);
                 }
 
@@ -5243,7 +5254,7 @@ AccessGenerationResult InlineCacheCompiler::compile(const GCSafeConcurrentJSLock
                 for (unsigned i = keys.size(); i--;) {
                     fallThrough.link(&jit);
                     fallThrough.shrink(0);
-                    if (keys[i]->requiresIdentifierNameMatch() && keys[i]->uid()->isSymbol())
+                    if (keys[i]->requiresIdentifierNameMatch() && uidIsSymbol(keys[i]->uid()))
                         generateWithGuard(i, keys[i].get(), fallThrough);
                 }
 
@@ -7715,7 +7726,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                                 switch (accessCase.m_type) {
                                 case AccessCase::GetGetter:
                                 case AccessCase::Load:
-                                    code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolLoadOwnPropertyHandler : CommonJITThunkID::GetByValWithStringLoadOwnPropertyHandler).retagged<JITStubRoutinePtrTag>();
+                                    code = vm.getCTIStub(uidIsSymbol(accessCase.uid()) ? CommonJITThunkID::GetByValWithSymbolLoadOwnPropertyHandler : CommonJITThunkID::GetByValWithStringLoadOwnPropertyHandler).retagged<JITStubRoutinePtrTag>();
                                     break;
                                 case AccessCase::IndexedUndefinedKeyLoad:
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithUndefinedKeyLoadOwnPropertyHandler).retagged<JITStubRoutinePtrTag>();
@@ -7736,7 +7747,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                                 switch (accessCase.m_type) {
                                 case AccessCase::GetGetter:
                                 case AccessCase::Load:
-                                    code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolLoadPrototypePropertyHandler : CommonJITThunkID::GetByValWithStringLoadPrototypePropertyHandler).retagged<JITStubRoutinePtrTag>();
+                                    code = vm.getCTIStub(uidIsSymbol(accessCase.uid()) ? CommonJITThunkID::GetByValWithSymbolLoadPrototypePropertyHandler : CommonJITThunkID::GetByValWithStringLoadPrototypePropertyHandler).retagged<JITStubRoutinePtrTag>();
                                     break;
                                 case AccessCase::IndexedUndefinedKeyLoad:
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithUndefinedKeyLoadPrototypePropertyHandler).retagged<JITStubRoutinePtrTag>();
@@ -7773,7 +7784,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             switch (accessCase.m_type) {
                             case AccessCase::Miss:
-                                code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolMissHandler : CommonJITThunkID::GetByValWithStringMissHandler).retagged<JITStubRoutinePtrTag>();
+                                code = vm.getCTIStub(uidIsSymbol(accessCase.uid()) ? CommonJITThunkID::GetByValWithSymbolMissHandler : CommonJITThunkID::GetByValWithStringMissHandler).retagged<JITStubRoutinePtrTag>();
                                 break;
                             case AccessCase::IndexedUndefinedKeyMiss:
                                 code = vm.getCTIStub(CommonJITThunkID::GetByValWithUndefinedKeyMissHandler).retagged<JITStubRoutinePtrTag>();
@@ -7821,17 +7832,17 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             if (accessCase.m_type == AccessCase::CustomAccessorGetter) {
                                 if (Options::useDOMJIT() && access.domAttribute() && access.domAttribute()->domJIT) {
-                                    code = compileGetByDOMJITHandler(codeBlock, access.domAttribute()->domJIT, accessCase.uid()->isSymbol());
+                                    code = compileGetByDOMJITHandler(codeBlock, access.domAttribute()->domJIT, uidIsSymbol(accessCase.uid()));
                                     if (!code)
                                         return AccessGenerationResult::GaveUp;
                                 } else {
-                                    if (accessCase.uid()->isSymbol())
+                                    if (uidIsSymbol(accessCase.uid()))
                                         code = vm.getCTIStub(CommonJITThunkID::GetByValWithSymbolCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                                     else
                                         code = vm.getCTIStub(CommonJITThunkID::GetByValWithStringCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                                 }
                             } else {
-                                if (accessCase.uid()->isSymbol())
+                                if (uidIsSymbol(accessCase.uid()))
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithSymbolCustomValueHandler).retagged<JITStubRoutinePtrTag>();
                                 else
                                     code = vm.getCTIStub(CommonJITThunkID::GetByValWithStringCustomValueHandler).retagged<JITStubRoutinePtrTag>();
@@ -7853,7 +7864,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                                 currStructure = object->structure();
                             if (isValidOffset(accessCase.m_offset))
                                 currStructure->startWatchingPropertyForReplacements(vm, accessCase.offset());
-                            auto code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::GetByValWithSymbolGetterHandler : CommonJITThunkID::GetByValWithStringGetterHandler).retagged<JITStubRoutinePtrTag>();
+                            auto code = vm.getCTIStub(uidIsSymbol(accessCase.uid()) ? CommonJITThunkID::GetByValWithSymbolGetterHandler : CommonJITThunkID::GetByValWithStringGetterHandler).retagged<JITStubRoutinePtrTag>();
                             auto stub = createPreCompiledICJITStubRoutine(WTF::move(code), vm, codeBlock);
                             connectWatchpointSets(stub.get(), WTF::move(watchedConditions), WTF::move(additionalWatchpointSets));
                             return finishPreCompiledCodeGeneration(WTF::move(stub));
@@ -7886,7 +7897,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                         MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                         switch (accessCase.m_type) {
                         case AccessCase::Replace:
-                            code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::PutByValWithSymbolReplaceHandler : CommonJITThunkID::PutByValWithStringReplaceHandler).retagged<JITStubRoutinePtrTag>();
+                            code = vm.getCTIStub(uidIsSymbol(accessCase.uid()) ? CommonJITThunkID::PutByValWithSymbolReplaceHandler : CommonJITThunkID::PutByValWithStringReplaceHandler).retagged<JITStubRoutinePtrTag>();
                             break;
                         case AccessCase::IndexedUndefinedKeyReplace:
                             code = vm.getCTIStub(CommonJITThunkID::PutByValWithUndefinedKeyReplaceHandler).retagged<JITStubRoutinePtrTag>();
@@ -7933,7 +7944,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                         MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                         switch (accessCase.m_type) {
                         case AccessCase::Transition:
-                            if (accessCase.uid()->isSymbol())
+                            if (uidIsSymbol(accessCase.uid()))
                                 code = selectTransitionHandler(CommonJITThunkID::PutByValWithSymbolTransitionNonAllocatingHandler, CommonJITThunkID::PutByValWithSymbolTransitionReallocatingOutOfLineHandler, CommonJITThunkID::PutByValWithSymbolTransitionNewlyAllocatingHandler, CommonJITThunkID::PutByValWithSymbolTransitionReallocatingHandler);
                             else
                                 code = selectTransitionHandler(CommonJITThunkID::PutByValWithStringTransitionNonAllocatingHandler, CommonJITThunkID::PutByValWithStringTransitionReallocatingOutOfLineHandler, CommonJITThunkID::PutByValWithStringTransitionNewlyAllocatingHandler, CommonJITThunkID::PutByValWithStringTransitionReallocatingHandler);
@@ -7973,12 +7984,12 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
 
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             if (accessCase.m_type == AccessCase::CustomAccessorSetter) {
-                                if (accessCase.uid()->isSymbol())
+                                if (uidIsSymbol(accessCase.uid()))
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithSymbolCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                                 else
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithStringCustomAccessorHandler).retagged<JITStubRoutinePtrTag>();
                             } else {
-                                if (accessCase.uid()->isSymbol())
+                                if (uidIsSymbol(accessCase.uid()))
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithSymbolCustomValueHandler).retagged<JITStubRoutinePtrTag>();
                                 else
                                     code = vm.getCTIStub(CommonJITThunkID::PutByValWithStringCustomValueHandler).retagged<JITStubRoutinePtrTag>();
@@ -8003,9 +8014,9 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
 
                             MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
                             if (isStrict)
-                                code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::PutByValWithSymbolStrictSetterHandler : CommonJITThunkID::PutByValWithStringStrictSetterHandler).retagged<JITStubRoutinePtrTag>();
+                                code = vm.getCTIStub(uidIsSymbol(accessCase.uid()) ? CommonJITThunkID::PutByValWithSymbolStrictSetterHandler : CommonJITThunkID::PutByValWithStringStrictSetterHandler).retagged<JITStubRoutinePtrTag>();
                             else
-                                code = vm.getCTIStub(accessCase.uid()->isSymbol() ? CommonJITThunkID::PutByValWithSymbolSloppySetterHandler : CommonJITThunkID::PutByValWithStringSloppySetterHandler).retagged<JITStubRoutinePtrTag>();
+                                code = vm.getCTIStub(uidIsSymbol(accessCase.uid()) ? CommonJITThunkID::PutByValWithSymbolSloppySetterHandler : CommonJITThunkID::PutByValWithStringSloppySetterHandler).retagged<JITStubRoutinePtrTag>();
                             auto stub = createPreCompiledICJITStubRoutine(WTF::move(code), vm, codeBlock);
                             connectWatchpointSets(stub.get(), WTF::move(watchedConditions), WTF::move(additionalWatchpointSets));
                             return finishPreCompiledCodeGeneration(WTF::move(stub));
@@ -8029,7 +8040,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                     collectConditions(accessCase, watchedConditions, checkingConditions);
                     if (checkingConditions.isEmpty()) {
                         MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
-                        if (accessCase.uid()->isSymbol())
+                        if (uidIsSymbol(accessCase.uid()))
                             code = vm.getCTIStub(accessCase.m_type == AccessCase::InHit ? CommonJITThunkID::InByValWithSymbolHitHandler : CommonJITThunkID::InByValWithSymbolMissHandler).retagged<JITStubRoutinePtrTag>();
                         else
                             code = vm.getCTIStub(accessCase.m_type == AccessCase::InHit ? CommonJITThunkID::InByValWithStringHitHandler : CommonJITThunkID::InByValWithStringMissHandler).retagged<JITStubRoutinePtrTag>();
@@ -8056,13 +8067,13 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
                     CommonJITThunkID thunkID = CommonJITThunkID::DeleteByValWithStringDeleteHandler;
                     switch (accessCase.m_type) {
                     case AccessCase::Delete:
-                        thunkID = accessCase.uid()->isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteHandler : CommonJITThunkID::DeleteByValWithStringDeleteHandler;
+                        thunkID = uidIsSymbol(accessCase.uid()) ? CommonJITThunkID::DeleteByValWithSymbolDeleteHandler : CommonJITThunkID::DeleteByValWithStringDeleteHandler;
                         break;
                     case AccessCase::DeleteNonConfigurable:
-                        thunkID = accessCase.uid()->isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteNonConfigurableHandler : CommonJITThunkID::DeleteByValWithStringDeleteNonConfigurableHandler;
+                        thunkID = uidIsSymbol(accessCase.uid()) ? CommonJITThunkID::DeleteByValWithSymbolDeleteNonConfigurableHandler : CommonJITThunkID::DeleteByValWithStringDeleteNonConfigurableHandler;
                         break;
                     case AccessCase::DeleteMiss:
-                        thunkID = accessCase.uid()->isSymbol() ? CommonJITThunkID::DeleteByValWithSymbolDeleteMissHandler : CommonJITThunkID::DeleteByValWithStringDeleteMissHandler;
+                        thunkID = uidIsSymbol(accessCase.uid()) ? CommonJITThunkID::DeleteByValWithSymbolDeleteMissHandler : CommonJITThunkID::DeleteByValWithStringDeleteMissHandler;
                         break;
                     default:
                         break;
@@ -8159,7 +8170,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
 #endif
             }
             m_failAndRepatch.append(notInt32);
-        } else if (accessCase.requiresIdentifierNameMatch() && !accessCase.uid()->isSymbol()) {
+        } else if (accessCase.requiresIdentifierNameMatch() && !uidIsSymbol(accessCase.uid())) {
             CCallHelpers::JumpList notString;
             GPRReg propertyGPR = m_propertyCache.propertyGPR();
             if (!m_propertyCache.propertyIsString) {
@@ -8174,7 +8185,7 @@ AccessGenerationResult InlineCacheCompiler::compileOneAccessCaseHandler(const Ve
             jit.loadPtr(MacroAssembler::Address(propertyGPR, JSString::offsetOfValue()), m_scratchGPR);
             m_failAndRepatch.append(jit.branchIfRopeStringImpl(m_scratchGPR));
             m_failAndRepatch.append(notString);
-        } else if (accessCase.requiresIdentifierNameMatch() && accessCase.uid()->isSymbol()) {
+        } else if (accessCase.requiresIdentifierNameMatch() && uidIsSymbol(accessCase.uid())) {
             CCallHelpers::JumpList notSymbol;
             if (!m_propertyCache.propertyIsSymbol) {
                 GPRReg propertyGPR = m_propertyCache.propertyGPR();
diff --git a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.h b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.h
index 8acdc62771d2c..fc7ee1b45a3ee 100644
--- a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.h
+++ b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.h
@@ -157,7 +157,11 @@ ALWAYS_INLINE bool canUseMegamorphicGetByIdExcludingIndex(VM& vm, UniquedStringI
 
 inline bool canUseMegamorphicGetById(VM& vm, UniquedStringImpl* uid)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return !parseIndex(PropertyName(uid)) && canUseMegamorphicGetByIdExcludingIndex(vm, uid);
+#else
     return !parseIndex(*uid) && canUseMegamorphicGetByIdExcludingIndex(vm, uid);
+#endif
 }
 
 inline bool canUseMegamorphicInById(VM& vm, UniquedStringImpl* uid)
@@ -167,7 +171,11 @@ inline bool canUseMegamorphicInById(VM& vm, UniquedStringImpl* uid)
 
 inline bool canUseMegamorphicPutById(VM& vm, UniquedStringImpl* uid)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return !parseIndex(PropertyName(uid)) && uid != vm.propertyNames->underscoreProto;
+#else
     return !parseIndex(*uid) && uid != vm.propertyNames->underscoreProto;
+#endif
 }
 
 bool NODELETE canBeViaGlobalProxy(AccessCase::AccessType);
diff --git a/Source/JavaScriptCore/bytecode/PutByStatus.cpp b/Source/JavaScriptCore/bytecode/PutByStatus.cpp
index 94e0972ae8414..dbe001a72c584 100644
--- a/Source/JavaScriptCore/bytecode/PutByStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/PutByStatus.cpp
@@ -369,8 +369,13 @@ PutByStatus PutByStatus::computeFor(CodeBlock* baselineBlock, ICStatusMap& basel
 PutByStatus PutByStatus::computeFor(JSGlobalObject* globalObject, const StructureSet& set, CacheableIdentifier identifier, bool isDirect, PrivateFieldPutKind privateFieldPutKind)
 {
     UniquedStringImpl* uid = identifier.uid();
+#if USE(BUN_JSC_ADDITIONS)
+    if (parseIndex(PropertyName(uid)))
+        return PutByStatus(LikelyTakesSlowPath);
+#else
     if (parseIndex(*uid))
         return PutByStatus(LikelyTakesSlowPath);
+#endif
 
     if (set.isEmpty())
         return PutByStatus();
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index abee238e608c9..60c3ab1c478e5 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -5046,11 +5046,19 @@ RegisterID* BytecodeGenerator::emitGetTemplateObject(RegisterID* dst, TaggedTemp
     for (; templateString; templateString = templateString->next()) {
         auto* string = templateString->value();
         ASSERT(string->raw());
+#if USE(BUN_JSC_ADDITIONS)
+        rawStrings.append(string->raw()->string());
+        if (!string->cooked())
+            cookedStrings.append(std::nullopt);
+        else
+            cookedStrings.append(string->cooked()->string());
+#else
         rawStrings.append(string->raw()->impl());
         if (!string->cooked())
             cookedStrings.append(std::nullopt);
         else
             cookedStrings.append(string->cooked()->impl());
+#endif
     }
     RefPtr<RegisterID> constant = addTemplateObjectConstant(TemplateObjectDescriptor::create(WTF::move(rawStrings), WTF::move(cookedStrings)), taggedTemplate->endOffset());
     if (!dst)
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index f1a6e7e0b670c..adf1f138df626 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -1280,7 +1280,11 @@ namespace JSC {
             Optimize,
             DoNotOptimize
         };
+#if USE(BUN_JSC_ADDITIONS)
+        typedef UncheckedKeyHashMap<FiberAwareRefPtr, TDZNecessityLevel, IdentifierRepHash> TDZMap;
+#else
         typedef UncheckedKeyHashMap<RefPtr<UniquedStringImpl>, TDZNecessityLevel, IdentifierRepHash> TDZMap;
+#endif
 
     public:
         JSString* addStringConstant(const Identifier&);
@@ -1355,7 +1359,11 @@ namespace JSC {
 
         // Some of these objects keep pointers to one another. They are arranged
         // to ensure a sane destruction order that avoids references to freed memory.
+#if USE(BUN_JSC_ADDITIONS)
+        UncheckedKeyHashSet<FiberAwareRefPtr, IdentifierRepHash> m_functions;
+#else
         UncheckedKeyHashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> m_functions;
+#endif
         RegisterID m_ignoredResultRegister;
         RegisterID m_thisRegister;
         RegisterID m_calleeRegister;
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 7890d11c3fef7..33c3cddd182dc 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -2628,7 +2628,7 @@ class FixupPhase : public Phase {
         }
 
         case CheckIdent: {
-            if (node->uidOperand()->isSymbol())
+            if (uidIsSymbol(node->uidOperand()))
                 fixEdge<SymbolUse>(node->child1());
             else
                 fixEdge<StringIdentUse>(node->child1());
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 7bd5d2f9bb40c..ea08b4853ef95 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -4990,6 +4990,19 @@ JSC_DEFINE_JIT_OPERATION(operationHasOwnProperty, size_t, (JSGlobalObject* globa
         auto propertyName = asString(key)->toAtomString(globalObject);
         OPERATION_RETURN_IF_EXCEPTION(scope, false);
 
+#if USE(BUN_JSC_ADDITIONS)
+        UniquedStringImpl* uid = propertyName.data;
+        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+            uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
+        bool result = thisObject->hasOwnProperty(globalObject, uid, slot);
+        OPERATION_RETURN_IF_EXCEPTION(scope, false);
+
+        HasOwnPropertyCache* hasOwnPropertyCache = vm.hasOwnPropertyCache();
+        ASSERT(hasOwnPropertyCache);
+        hasOwnPropertyCache->tryAdd(slot, thisObject, uid, result);
+        OPERATION_RETURN(scope, result);
+#else
         PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
         bool result = thisObject->hasOwnProperty(globalObject, propertyName.data, slot);
         OPERATION_RETURN_IF_EXCEPTION(scope, false);
@@ -4998,6 +5011,7 @@ JSC_DEFINE_JIT_OPERATION(operationHasOwnProperty, size_t, (JSGlobalObject* globa
         ASSERT(hasOwnPropertyCache);
         hasOwnPropertyCache->tryAdd(slot, thisObject, propertyName.data, result);
         OPERATION_RETURN(scope, result);
+#endif
     }
 
     Identifier propertyName = key.toPropertyKey(globalObject);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 01308525faafc..6e716ca97c6d1 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -12881,9 +12881,10 @@ void SpeculativeJIT::speculateStringIdentAndLoadStorage(Edge edge, GPRReg string
 #if USE(BUN_JSC_ADDITIONS)
     if (canBeRope(edge))
         speculationCheck(BadStringType, JSValueSource::unboxedCell(string), edge, branchIfActualRopeStringImpl(storage));
-    Jump isInline = branchIfInlineStringImpl(storage);
+    // Inline small strings are SpecStringInline, not SpecStringIdent; downstream callers pointer-compare against
+    // heap AtomStringImpl* (compileStringIdentEquality, emitSwitchString), so OSR-exit here to preserve correctness.
+    speculationCheck(BadStringType, JSValueSource::unboxedCell(string), edge, branchIfInlineStringImpl(storage));
     speculationCheck(BadStringType, JSValueSource::unboxedCell(string), edge, branchTest32(Zero, Address(storage, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
-    isInline.link(this);
 #else
     if (canBeRope(edge))
         speculationCheck(BadStringType, JSValueSource::unboxedCell(string), edge, branchIfRopeStringImpl(storage));
diff --git a/Source/JavaScriptCore/dfg/DFGValidate.cpp b/Source/JavaScriptCore/dfg/DFGValidate.cpp
index d700a69368afa..2f928280598d4 100644
--- a/Source/JavaScriptCore/dfg/DFGValidate.cpp
+++ b/Source/JavaScriptCore/dfg/DFGValidate.cpp
@@ -252,7 +252,11 @@ class Validate {
 
                 if (node->hasCacheableIdentifier()) {
                     auto* uid = node->cacheableIdentifier().uid();
+#if USE(BUN_JSC_ADDITIONS)
+                    VALIDATE((node), isInlinePropertyKey(uid) || uid->isSymbol() || !parseIndex(*uid));
+#else
                     VALIDATE((node), uid->isSymbol() || !parseIndex(*uid));
+#endif
                 }
                  
                 switch (node->op()) {
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 973efa4402a51..ff9cec855eadd 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -26413,20 +26413,14 @@ IGNORE_CLANG_WARNINGS_END
 
 #if USE(BUN_JSC_ADDITIONS)
         speculate(BadStringType, jsValueValue(string), edge.node(), isActualRopeStringImplPtr(stringImpl));
-
-        LBasicBlock notInline = m_out.newBlock();
-        LBasicBlock continuation = m_out.newBlock();
-        m_out.branch(isInlineStringImplPtr(stringImpl), unsure(continuation), unsure(notInline));
-
-        LBasicBlock lastNext = m_out.appendTo(notInline, continuation);
+        // Inline small strings are SpecStringInline, not SpecStringIdent; downstream callers pointer-compare against
+        // heap AtomStringImpl* (CompareStrictEq StringIdentUse, SwitchString), so OSR-exit here to match DFG.
+        speculate(BadStringType, jsValueValue(string), edge.node(), isInlineStringImplPtr(stringImpl));
         speculate(
             BadStringType, jsValueValue(string), edge.node(),
             m_out.testIsZero32(
                 m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags),
                 m_out.constInt32(StringImpl::flagIsAtom())));
-        m_out.jump(continuation);
-
-        m_out.appendTo(continuation, lastNext);
 #else
         speculate(BadStringType, jsValueValue(string), edge.node(), isRopeString(string));
         speculate(
diff --git a/Source/JavaScriptCore/heap/HeapSnapshotBuilder.h b/Source/JavaScriptCore/heap/HeapSnapshotBuilder.h
index f819fc2c4b9d8..083565742ef59 100644
--- a/Source/JavaScriptCore/heap/HeapSnapshotBuilder.h
+++ b/Source/JavaScriptCore/heap/HeapSnapshotBuilder.h
@@ -26,6 +26,9 @@
 #pragma once
 
 #include "HeapAnalyzer.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
 #include "JSExportMacros.h"
 #include <functional>
 #include <wtf/CheckedPtr.h>
@@ -99,7 +102,11 @@ struct HeapSnapshotEdge {
     } to;
 
     EdgeType type;
+#if USE(BUN_JSC_ADDITIONS)
+    FiberAwareRefPtr name;
+#else
     RefPtr<UniquedStringImpl> name;
+#endif
     uint32_t index { 0 };
 };
 
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index cf0fa6fa5923a..c0a9e6f8be292 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -798,9 +798,9 @@ void JIT::compileOpStrictEq(const JSInstruction* currentInstruction)
         loadPtr(Address(stringGPR, JSString::offsetOfValue()), regT5);
 #if USE(BUN_JSC_ADDITIONS)
         addSlowCase(branchIfActualRopeStringImpl(regT5));
-        Jump isInline = branchIfInlineStringImpl(regT5);
+        // Inline small strings cannot pointer-equal the heap AtomStringImpl* constant below; route to slow path.
+        addSlowCase(branchIfInlineStringImpl(regT5));
         addSlowCase(branchTest32(Zero, Address(regT5, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
-        isInline.link(this);
 #else
         addSlowCase(branchIfRopeStringImpl(regT5));
         addSlowCase(branchTest32(Zero, Address(regT5, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
@@ -980,9 +980,9 @@ void JIT::compileOpStrictEqJump(const JSInstruction* currentInstruction)
             loadPtr(Address(stringGPR, JSString::offsetOfValue()), regT2);
 #if USE(BUN_JSC_ADDITIONS)
             addSlowCase(branchIfActualRopeStringImpl(regT2));
-            Jump isInline = branchIfInlineStringImpl(regT2);
+            // Inline small strings cannot pointer-equal the heap AtomStringImpl* constant below; route to slow path.
+            addSlowCase(branchIfInlineStringImpl(regT2));
             addSlowCase(branchTest32(Zero, Address(regT2, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
-            isInline.link(this);
 #else
             addSlowCase(branchIfRopeStringImpl(regT2));
             addSlowCase(branchTest32(Zero, Address(regT2, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
@@ -996,9 +996,9 @@ void JIT::compileOpStrictEqJump(const JSInstruction* currentInstruction)
             loadPtr(Address(stringGPR, JSString::offsetOfValue()), regT2);
 #if USE(BUN_JSC_ADDITIONS)
             addSlowCase(branchIfActualRopeStringImpl(regT2));
-            Jump isInline = branchIfInlineStringImpl(regT2);
+            // Inline small strings cannot pointer-equal the heap AtomStringImpl* constant below; route to slow path.
+            addSlowCase(branchIfInlineStringImpl(regT2));
             addSlowCase(branchTest32(Zero, Address(regT2, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
-            isInline.link(this);
 #else
             addSlowCase(branchIfRopeStringImpl(regT2));
             addSlowCase(branchTest32(Zero, Address(regT2, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
index 9eba44f7da133..d00f0892dd03f 100644
--- a/Source/JavaScriptCore/jit/JITOperations.cpp
+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
@@ -1701,6 +1701,10 @@ static ALWAYS_INLINE void putByVal(JSGlobalObject* globalObject, JSValue baseVal
     if (subscript.isString()) {
         propertyName = asString(subscript)->toAtomString(globalObject);
         uid = propertyName.data;
+#if USE(BUN_JSC_ADDITIONS)
+        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+            uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+#endif
     } else {
         propertyKey = subscript.toPropertyKey(globalObject);
         uid = propertyKey.impl();
@@ -1799,7 +1803,11 @@ static ALWAYS_INLINE void putByValOptimize(JSGlobalObject* globalObject, CodeBlo
             bool isNonStringPrimitiveKey = false;
             if (auto propertyName = CacheableIdentifier::getCacheableIdentifier(subscript)) {
                 RETURN_IF_EXCEPTION(scope, void());
+#if USE(BUN_JSC_ADDITIONS)
+                if (subscript.isSymbol() || !parseIndex(PropertyName(propertyName.data)))
+#else
                 if (subscript.isSymbol() || !parseIndex(*propertyName.data))
+#endif
                     identifier = CacheableIdentifier::createFromCell(subscript.asCell());
             } else {
                 identifier = nonStringPrimitiveKeyForSubscript(vm, subscript);
@@ -1882,7 +1890,11 @@ static ALWAYS_INLINE void directPutByValOptimize(JSGlobalObject* globalObject, C
         bool isNonStringPrimitiveKey = false;
         if (auto propertyName = CacheableIdentifier::getCacheableIdentifier(subscript)) {
             RETURN_IF_EXCEPTION(scope, void());
+#if USE(BUN_JSC_ADDITIONS)
+            if (subscript.isSymbol() || !parseIndex(PropertyName(propertyName.data)))
+#else
             if (subscript.isSymbol() || !parseIndex(*propertyName.data))
+#endif
                 identifier = CacheableIdentifier::createFromCell(subscript.asCell());
         } else {
             identifier = nonStringPrimitiveKeyForSubscript(vm, subscript);
@@ -3705,7 +3717,11 @@ JSC_DEFINE_JIT_OPERATION(operationGetByValOptimize, EncodedJSValue, (EncodedJSVa
             bool isNonStringPrimitiveKey = false;
             if (auto propertyName = CacheableIdentifier::getCacheableIdentifier(subscript)) {
                 OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());
+#if USE(BUN_JSC_ADDITIONS)
+                if (subscript.isSymbol() || !parseIndex(PropertyName(propertyName.data)))
+#else
                 if (subscript.isSymbol() || !parseIndex(*propertyName.data))
+#endif
                     identifier = CacheableIdentifier::createFromCell(subscript.asCell());
             } else {
                 identifier = nonStringPrimitiveKeyForSubscript(vm, subscript);
@@ -3819,6 +3835,10 @@ static ALWAYS_INLINE JSValue getByValMegamorphic(JSGlobalObject* globalObject, V
     if (subscript.isString()) {
         propertyName = asString(subscript)->toAtomString(globalObject);
         uid = propertyName.data;
+#if USE(BUN_JSC_ADDITIONS)
+        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+            uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+#endif
     } else {
         propertyKey = subscript.toPropertyKey(globalObject);
         uid = propertyKey.impl();
@@ -3833,7 +3853,11 @@ static ALWAYS_INLINE JSValue getByValMegamorphic(JSGlobalObject* globalObject, V
         RELEASE_AND_RETURN(scope, getByValWithThis(globalObject, callFrame, profile, baseValue, subscript, thisValue));
     }
 
+#if USE(BUN_JSC_ADDITIONS)
+    if (auto index = parseIndex(PropertyName(uid)); index) [[unlikely]] {
+#else
     if (auto index = parseIndex(*uid); index) [[unlikely]] {
+#endif
         if (!baseObject->structure()->isCacheableDictionary() || index.value() >= 100) {
             if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm))
                 repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind);
@@ -3995,7 +4019,11 @@ JSC_DEFINE_JIT_OPERATION(operationGetByValWithThisOptimize, EncodedJSValue, (Enc
             bool isNonStringPrimitiveKey = false;
             if (auto propertyName = CacheableIdentifier::getCacheableIdentifier(subscript)) {
                 OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());
+#if USE(BUN_JSC_ADDITIONS)
+                if (subscript.isSymbol() || !parseIndex(PropertyName(propertyName.data)))
+#else
                 if (subscript.isSymbol() || !parseIndex(*propertyName.data))
+#endif
                     identifier = CacheableIdentifier::createFromCell(subscript.asCell());
             } else {
                 identifier = nonStringPrimitiveKeyForSubscript(vm, subscript);
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index f800aa458299e..dffc6acdbd81d 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -601,8 +601,14 @@ class GlobalObject final : public JSGlobalObject {
         void add(UniquedStringImpl* uid)
         {
             auto result = m_names.add(uid);
+#if USE(BUN_JSC_ADDITIONS)
+            // A fiber-word uid is self-owning; nothing to keep alive.
+            if (result.isNewEntry && !isInlinePropertyKey(uid))
+                m_strings.append(uid);
+#else
             if (result.isNewEntry)
                 m_strings.append(uid);
+#endif
         }
 
         bool contains(UniquedStringImpl* name) const { return m_names.contains(name); }
diff --git a/Source/JavaScriptCore/parser/ModuleAnalyzer.cpp b/Source/JavaScriptCore/parser/ModuleAnalyzer.cpp
index e863c98ad8fe1..894dcabe75d32 100644
--- a/Source/JavaScriptCore/parser/ModuleAnalyzer.cpp
+++ b/Source/JavaScriptCore/parser/ModuleAnalyzer.cpp
@@ -47,7 +47,11 @@ void ModuleAnalyzer::appendRequestedModule(const Identifier& specifier, RefPtr<S
         moduleRecord()->appendRequestedModule(specifier, WTF::move(attributes), phase);
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+void ModuleAnalyzer::exportVariable(ModuleProgramNode& moduleProgramNode, const FiberAwareRefPtr& localName, const VariableEnvironmentEntry& variable)
+#else
 void ModuleAnalyzer::exportVariable(ModuleProgramNode& moduleProgramNode, const RefPtr<UniquedStringImpl>& localName, const VariableEnvironmentEntry& variable)
+#endif
 {
     // In the parser, we already marked the variables as Exported and Imported.
     // By leveraging this information, we collect the information that is needed
diff --git a/Source/JavaScriptCore/parser/ModuleAnalyzer.h b/Source/JavaScriptCore/parser/ModuleAnalyzer.h
index c595386d98c4a..298648b496c32 100644
--- a/Source/JavaScriptCore/parser/ModuleAnalyzer.h
+++ b/Source/JavaScriptCore/parser/ModuleAnalyzer.h
@@ -53,7 +53,11 @@ class ModuleAnalyzer {
     void fail(std::tuple<ErrorType, String>&& errorMessage) { m_errorMessage = errorMessage; }
 
 private:
+#if USE(BUN_JSC_ADDITIONS)
+    void exportVariable(ModuleProgramNode&, const FiberAwareRefPtr&, const VariableEnvironmentEntry&);
+#else
     void exportVariable(ModuleProgramNode&, const RefPtr<UniquedStringImpl>&, const VariableEnvironmentEntry&);
+#endif
 
     VM& m_vm;
     JSModuleRecord* m_moduleRecord;
diff --git a/Source/JavaScriptCore/parser/ModuleScopeData.h b/Source/JavaScriptCore/parser/ModuleScopeData.h
index 2d4648afefc8f..d88705c27f368 100644
--- a/Source/JavaScriptCore/parser/ModuleScopeData.h
+++ b/Source/JavaScriptCore/parser/ModuleScopeData.h
@@ -36,7 +36,12 @@ class ModuleScopeData : public RefCounted<ModuleScopeData> {
     WTF_MAKE_NONCOPYABLE(ModuleScopeData);
     WTF_MAKE_TZONE_ALLOCATED(ModuleScopeData);
 public:
+#if USE(BUN_JSC_ADDITIONS)
+    // Keys/values may be inline fiber words (not real StringImpl*); FiberAwareRefPtr skips ref()/deref() on those.
+    typedef UncheckedKeyHashMap<FiberAwareRefPtr, Vector<FiberAwareRefPtr>, IdentifierRepHash, HashTraits<FiberAwareRefPtr>> IdentifierAliasMap;
+#else
     typedef UncheckedKeyHashMap<RefPtr<UniquedStringImpl>, Vector<RefPtr<UniquedStringImpl>>, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>> IdentifierAliasMap;
+#endif
 
     static Ref<ModuleScopeData> create() { return adoptRef(*new ModuleScopeData); }
 
@@ -49,7 +54,11 @@ class ModuleScopeData : public RefCounted<ModuleScopeData> {
 
     void exportBinding(const Identifier& localName, const Identifier& exportedName)
     {
+#if USE(BUN_JSC_ADDITIONS)
+        m_exportedBindings.add(localName.impl(), Vector<FiberAwareRefPtr>()).iterator->value.append(exportedName.impl());
+#else
         m_exportedBindings.add(localName.impl(), Vector<RefPtr<UniquedStringImpl>>()).iterator->value.append(exportedName.impl());
+#endif
     }
 
     void exportBinding(const Identifier& localName)
diff --git a/Source/JavaScriptCore/parser/Parser.cpp b/Source/JavaScriptCore/parser/Parser.cpp
index a71bce8e45892..f3e88a476afdd 100644
--- a/Source/JavaScriptCore/parser/Parser.cpp
+++ b/Source/JavaScriptCore/parser/Parser.cpp
@@ -209,7 +209,20 @@ void JSToken::dump(PrintStream& out) const
 
 static ALWAYS_INLINE bool NODELETE isPrivateFieldName(UniquedStringImpl* uid)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInlinePropertyKey(uid)) {
+        uintptr_t word = reinterpret_cast<uintptr_t>(uid);
+        if (!inlinePropertyKeyLength(word))
+            return false;
+        const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+        if (inlinePropertyKeyIs8Bit(word))
+            return bytes[1] == '#';
+        return reinterpret_cast<const char16_t*>(bytes + 2)[0] == '#';
+    }
+    return uid->length() && uid->at(0) == '#';
+#else
     return uid->length() && uid->at(0) == '#';
+#endif
 }
 
 template <typename LexerType>
@@ -1113,7 +1126,11 @@ template <class TreeBuilder> TreeDestructuringPattern Parser<LexerType>::createB
 {
     ASSERT(!name.isNull());
     
+#if USE(BUN_JSC_ADDITIONS)
+    ASSERT(isInlinePropertyKey(name.impl()) || name.impl()->isAtom() || name.impl()->isSymbol());
+#else
     ASSERT(name.impl()->isAtom() || name.impl()->isSymbol());
+#endif
 
     switch (kind) {
     case DestructuringKind::DestructureToVariables: {
diff --git a/Source/JavaScriptCore/parser/SourceProviderCacheItem.h b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
index 3049c07837703..301ca18b89cdd 100644
--- a/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
+++ b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
@@ -26,6 +26,9 @@
 #pragma once
 
 #include "ImplementationVisibility.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
 #include "ParserModes.h"
 #include "ParserTokens.h"
 #include <JavaScriptCore/ConstructorKind.h>
@@ -119,8 +122,13 @@ class SourceProviderCacheItem {
 
 inline SourceProviderCacheItem::~SourceProviderCacheItem()
 {
+#if USE(BUN_JSC_ADDITIONS)
+    for (unsigned i = 0; i < usedVariablesCount; ++i)
+        uidDeref(m_variables[i].get());
+#else
     for (unsigned i = 0; i < usedVariablesCount; ++i)
         m_variables[i]->deref();
+#endif
 }
 
 inline std::unique_ptr<SourceProviderCacheItem> SourceProviderCacheItem::create(const SourceProviderCacheItemCreationParameters& parameters)
@@ -159,7 +167,11 @@ inline SourceProviderCacheItem::SourceProviderCacheItem(const SourceProviderCach
     ASSERT(expectedSuperBinding == static_cast<unsigned>(parameters.expectedSuperBinding));
     for (unsigned i = 0; i < usedVariablesCount; ++i) {
         auto* pointer = parameters.usedVariables[i];
+#if USE(BUN_JSC_ADDITIONS)
+        uidRef(pointer);
+#else
         pointer->ref();
+#endif
         m_variables[i] = pointer;
     }
 }
diff --git a/Source/JavaScriptCore/parser/VariableEnvironment.cpp b/Source/JavaScriptCore/parser/VariableEnvironment.cpp
index c68988e17274b..f414ba1b527a3 100644
--- a/Source/JavaScriptCore/parser/VariableEnvironment.cpp
+++ b/Source/JavaScriptCore/parser/VariableEnvironment.cpp
@@ -118,7 +118,7 @@ void VariableEnvironment::markVariableAsExported(const UniquedStringImpl* identi
     findResult->value.setIsExported();
 }
 
-VariableEnvironment::Map::AddResult VariableEnvironment::declarePrivateField(const RefPtr<UniquedStringImpl>& identifier)
+VariableEnvironment::Map::AddResult VariableEnvironment::declarePrivateField(const VERefPtr& identifier)
 {
     getOrAddPrivateName(identifier.get());
     auto entry = VariableEnvironmentEntry();
@@ -128,7 +128,7 @@ VariableEnvironment::Map::AddResult VariableEnvironment::declarePrivateField(con
     return m_map.add(identifier, entry);
 }
 
-VariableEnvironment::PrivateDeclarationResult VariableEnvironment::declarePrivateAccessor(const RefPtr<UniquedStringImpl>& identifier, PrivateNameEntry accessorTraits)
+VariableEnvironment::PrivateDeclarationResult VariableEnvironment::declarePrivateAccessor(const VERefPtr& identifier, PrivateNameEntry accessorTraits)
 {
     if (!m_rareData)
         m_rareData = WTF::makeUnique<VariableEnvironment::RareData>();
@@ -176,17 +176,17 @@ VariableEnvironment::PrivateDeclarationResult VariableEnvironment::declarePrivat
     return PrivateDeclarationResult::Success;
 }
 
-VariableEnvironment::PrivateDeclarationResult VariableEnvironment::declarePrivateSetter(const RefPtr<UniquedStringImpl>& identifier, PrivateNameEntry::Traits modifierTraits)
+VariableEnvironment::PrivateDeclarationResult VariableEnvironment::declarePrivateSetter(const VERefPtr& identifier, PrivateNameEntry::Traits modifierTraits)
 {
     return declarePrivateAccessor(identifier, PrivateNameEntry(PrivateNameEntry::Traits::IsSetter | modifierTraits));
 }
 
-VariableEnvironment::PrivateDeclarationResult VariableEnvironment::declarePrivateGetter(const RefPtr<UniquedStringImpl>& identifier, PrivateNameEntry::Traits modifierTraits)
+VariableEnvironment::PrivateDeclarationResult VariableEnvironment::declarePrivateGetter(const VERefPtr& identifier, PrivateNameEntry::Traits modifierTraits)
 {
     return declarePrivateAccessor(identifier, PrivateNameEntry(PrivateNameEntry::Traits::IsGetter | modifierTraits));
 }
 
-bool VariableEnvironment::declarePrivateMethod(const RefPtr<UniquedStringImpl>& identifier, PrivateNameEntry::Traits addionalTraits)
+bool VariableEnvironment::declarePrivateMethod(const VERefPtr& identifier, PrivateNameEntry::Traits addionalTraits)
 {
     if (!m_rareData)
         m_rareData = makeUnique<VariableEnvironment::RareData>();
diff --git a/Source/JavaScriptCore/parser/VariableEnvironment.h b/Source/JavaScriptCore/parser/VariableEnvironment.h
index b77506043f66e..523579051b863 100644
--- a/Source/JavaScriptCore/parser/VariableEnvironment.h
+++ b/Source/JavaScriptCore/parser/VariableEnvironment.h
@@ -144,8 +144,10 @@ struct PrivateNameEntryHashTraits : HashTraits<PrivateNameEntry> {
 
 #if USE(BUN_JSC_ADDITIONS)
 typedef UncheckedKeyHashMap<FiberAwarePackedRefPtr, PrivateNameEntry, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, PrivateNameEntryHashTraits> PrivateNameEnvironment;
+using VERefPtr = FiberAwareRefPtr;
 #else
 typedef UncheckedKeyHashMap<PackedRefPtr<UniquedStringImpl>, PrivateNameEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, PrivateNameEntryHashTraits> PrivateNameEnvironment;
+using VERefPtr = RefPtr<UniquedStringImpl>;
 #endif
 
 class VariableEnvironment {
@@ -179,13 +181,18 @@ class VariableEnvironment {
     ALWAYS_INLINE Map::iterator end() { return m_map.end(); }
     ALWAYS_INLINE Map::const_iterator begin() const { return m_map.begin(); }
     ALWAYS_INLINE Map::const_iterator end() const { return m_map.end(); }
-    ALWAYS_INLINE Map::AddResult add(const RefPtr<UniquedStringImpl>& identifier) { return m_map.add(identifier, VariableEnvironmentEntry()); }
+#if USE(BUN_JSC_ADDITIONS)
+    ALWAYS_INLINE Map::AddResult add(UniquedStringImpl* identifier) { return m_map.add(FiberAwareRefPtr(identifier), VariableEnvironmentEntry()); }
+    ALWAYS_INLINE Map::AddResult add(const FiberAwareRefPtr& identifier) { return m_map.add(identifier, VariableEnvironmentEntry()); }
+#else
+    ALWAYS_INLINE Map::AddResult add(const VERefPtr& identifier) { return m_map.add(identifier, VariableEnvironmentEntry()); }
+#endif
     ALWAYS_INLINE Map::AddResult add(const Identifier& identifier) { return add(identifier.impl()); }
 
     // Defined in VariableEnvironmentInlines.h.
     PrivateNameEnvironment::AddResult addPrivateName(const Identifier& identifier);
     // Defined in VariableEnvironmentInlines.h.
-    PrivateNameEnvironment::AddResult addPrivateName(const RefPtr<UniquedStringImpl>& identifier);
+    PrivateNameEnvironment::AddResult addPrivateName(const VERefPtr& identifier);
 
     ALWAYS_INLINE unsigned size() const { return m_map.size() + privateNamesSize(); }
     ALWAYS_INLINE unsigned mapSize() const { return m_map.size(); }
@@ -231,7 +238,7 @@ class VariableEnvironment {
 
     // Defined in VariableEnvironmentInlines.h.
     bool declarePrivateMethod(const Identifier& identifier);
-    bool declarePrivateMethod(const RefPtr<UniquedStringImpl>& identifier, PrivateNameEntry::Traits addionalTraits = PrivateNameEntry::Traits::None);
+    bool declarePrivateMethod(const VERefPtr& identifier, PrivateNameEntry::Traits addionalTraits = PrivateNameEntry::Traits::None);
 
     enum class PrivateDeclarationResult {
         Success,
@@ -239,7 +246,7 @@ class VariableEnvironment {
         InvalidStaticNonStatic
     };
 
-    PrivateDeclarationResult declarePrivateAccessor(const RefPtr<UniquedStringImpl>&, PrivateNameEntry accessorTraits);
+    PrivateDeclarationResult declarePrivateAccessor(const VERefPtr&, PrivateNameEntry accessorTraits);
 
     // Defined in VariableEnvironmentInlines.h.
     bool declareStaticPrivateMethod(const Identifier& identifier);
@@ -248,15 +255,15 @@ class VariableEnvironment {
     PrivateDeclarationResult declarePrivateSetter(const Identifier& identifier);
     // Defined in VariableEnvironmentInlines.h.
     PrivateDeclarationResult declareStaticPrivateSetter(const Identifier& identifier);
-    PrivateDeclarationResult declarePrivateSetter(const RefPtr<UniquedStringImpl>& identifier, PrivateNameEntry::Traits modifierTraits = PrivateNameEntry::Traits::None);
+    PrivateDeclarationResult declarePrivateSetter(const VERefPtr& identifier, PrivateNameEntry::Traits modifierTraits = PrivateNameEntry::Traits::None);
 
     // Defined in VariableEnvironmentInlines.h.
     PrivateDeclarationResult declarePrivateGetter(const Identifier& identifier);
     // Defined in VariableEnvironmentInlines.h.
     PrivateDeclarationResult declareStaticPrivateGetter(const Identifier& identifier);
-    PrivateDeclarationResult declarePrivateGetter(const RefPtr<UniquedStringImpl>& identifier, PrivateNameEntry::Traits modifierTraits = PrivateNameEntry::Traits::None);
+    PrivateDeclarationResult declarePrivateGetter(const VERefPtr& identifier, PrivateNameEntry::Traits modifierTraits = PrivateNameEntry::Traits::None);
 
-    Map::AddResult declarePrivateField(const RefPtr<UniquedStringImpl>&);
+    Map::AddResult declarePrivateField(const VERefPtr&);
 
     ALWAYS_INLINE PrivateNamesRange privateNames() const
     {
diff --git a/Source/JavaScriptCore/parser/VariableEnvironmentInlines.h b/Source/JavaScriptCore/parser/VariableEnvironmentInlines.h
index 80d81f8c0cc82..557d623a3fdb3 100644
--- a/Source/JavaScriptCore/parser/VariableEnvironmentInlines.h
+++ b/Source/JavaScriptCore/parser/VariableEnvironmentInlines.h
@@ -100,7 +100,7 @@ ALWAYS_INLINE PrivateNameEnvironment::AddResult VariableEnvironment::addPrivateN
     return addPrivateName(identifier.impl());
 }
 
-ALWAYS_INLINE PrivateNameEnvironment::AddResult VariableEnvironment::addPrivateName(const RefPtr<UniquedStringImpl>& identifier)
+ALWAYS_INLINE PrivateNameEnvironment::AddResult VariableEnvironment::addPrivateName(const VERefPtr& identifier)
 {
     if (!m_rareData)
         m_rareData = makeUnique<VariableEnvironment::RareData>();
diff --git a/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp b/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
index 78f24884d12bd..7bf9ecef18b4f 100644
--- a/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
+++ b/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
@@ -318,7 +318,11 @@ struct AbstractModuleRecord::ResolveQuery {
     // The module record is not marked from the GC. But these records are reachable from the JSGlobalObject.
     // So we don't care the reachability to this record.
     AbstractModuleRecord* moduleRecord;
+#if USE(BUN_JSC_ADDITIONS)
+    FiberAwareRefPtr exportName;
+#else
     RefPtr<UniquedStringImpl> exportName;
+#endif
 };
 
 inline unsigned NODELETE AbstractModuleRecord::ResolveQuery::Hash::hash(const ResolveQuery& query)
@@ -1497,14 +1501,35 @@ unsigned AbstractModuleRecord::innerModuleLinking(JSGlobalObject* globalObject,
 
 static String printableName(const RefPtr<UniquedStringImpl>& uid)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInlinePropertyKey(uid.get())) {
+        uintptr_t word = reinterpret_cast<uintptr_t>(uid.get());
+        unsigned len = inlinePropertyKeyLength(word);
+        const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+        if (inlinePropertyKeyIs8Bit(word))
+            return WTF::makeString('\'', StringView(std::span<const Latin1Character> { bytes + 1, len }), '\'');
+        return WTF::makeString('\'', StringView(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len }), '\'');
+    }
     if (uid->isSymbol())
         return uid.get();
     return WTF::makeString('\'', StringView(uid.get()), '\'');
+#else
+    if (uid->isSymbol())
+        return uid.get();
+    return WTF::makeString('\'', StringView(uid.get()), '\'');
+#endif
 }
 
 static String printableName(const Identifier& ident)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    UniquedStringImpl* impl = ident.impl();
+    if (isInlinePropertyKey(impl))
+        return WTF::makeString('\'', ident.string(), '\'');
+    return printableName(RefPtr<UniquedStringImpl>(impl));
+#else
     return printableName(ident.impl());
+#endif
 }
 
 ScriptFetchParameters::Type AbstractModuleRecord::moduleType() const
diff --git a/Source/JavaScriptCore/runtime/AbstractModuleRecord.h b/Source/JavaScriptCore/runtime/AbstractModuleRecord.h
index dcaac0fb312dc..f4c17387fd8f4 100644
--- a/Source/JavaScriptCore/runtime/AbstractModuleRecord.h
+++ b/Source/JavaScriptCore/runtime/AbstractModuleRecord.h
@@ -113,9 +113,15 @@ class AbstractModuleRecord : public JSInternalFieldObjectImpl<2> {
         Identifier localName;
     };
 
+#if USE(BUN_JSC_ADDITIONS)
+    using OrderedIdentifierSet = OrderedHashSet<FiberAwareRefPtr, IdentifierRepHash>;
+    using ImportEntries = OrderedHashMap<FiberAwareRefPtr, ImportEntry, IdentifierRepHash, HashTraits<FiberAwareRefPtr>>;
+    using ExportEntries = OrderedHashMap<FiberAwareRefPtr, ExportEntry, IdentifierRepHash, HashTraits<FiberAwareRefPtr>>;
+#else
     using OrderedIdentifierSet = OrderedHashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash>;
     using ImportEntries = OrderedHashMap<RefPtr<UniquedStringImpl>, ImportEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>>;
     using ExportEntries = OrderedHashMap<RefPtr<UniquedStringImpl>, ExportEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>>;
+#endif
 
     struct ModuleRequest {
         Identifier m_specifier;
@@ -298,7 +304,11 @@ class AbstractModuleRecord : public JSInternalFieldObjectImpl<2> {
     // So here, we don't visit each object for GC. The resolution cache map caches the once
     // looked up correctly resolved resolution, since (1) we rarely looked up the non-resolved one,
     // and (2) if we cache all the attempts the size of the map becomes infinitely large.
+#if USE(BUN_JSC_ADDITIONS)
+    typedef UncheckedKeyHashMap<FiberAwareRefPtr, Resolution, IdentifierRepHash, HashTraits<FiberAwareRefPtr>> Resolutions;
+#else
     typedef UncheckedKeyHashMap<RefPtr<UniquedStringImpl>, Resolution, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>> Resolutions;
+#endif
     Resolutions m_resolutionCache;
 
 protected:
diff --git a/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h b/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
index 620013b2709a7..8e4bb5cee575b 100644
--- a/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
+++ b/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
@@ -28,6 +28,9 @@
 #include "CacheableIdentifier.h"
 
 #include "Identifier.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "IdentifierInlines.h"
+#endif
 #include "JSCJSValueInlines.h"
 #include "JSCell.h"
 #include "VM.h"
@@ -61,9 +64,14 @@ inline CacheableIdentifier CacheableIdentifier::createFromSharedStub(UniquedStri
 inline CacheableIdentifier CacheableIdentifier::createFromCell(JSCell* i)
 {
 #if USE(BUN_JSC_ADDITIONS)
-    // Phase D: inline JSStrings are stored as-is; uid() returns the fiber word
-    // (tagged UniquedStringImpl*) and isSymbol()/hash() branch on the tag via
-    // uidIsSymbol/uidHash so no atom materialization is required here.
+    // Phase D: only the small-8-bit-inline form (2..5 Latin-1 chars) is a
+    // canonical fiber-word key; big-inline / 16-bit-inline span two words and
+    // must be atomized in place so uid()/getValueImpl() yield a real atom.
+    if (i->isString()) {
+        JSString* s = uncheckedDowncast<JSString>(i);
+        if (s->isInline() && !(s->is8Bit() && s->length() <= maxFiberWordKeyLength))
+            s->resolveInlineToAtomString(nullptr);
+    }
 #endif
     return CacheableIdentifier(i);
 }
@@ -96,12 +104,15 @@ inline UniquedStringImpl* CacheableIdentifier::uid() const
     ASSERT(isStringCell());
     JSString* string = uncheckedDowncast<JSString>(cell());
 #if USE(BUN_JSC_ADDITIONS)
-    // Phase D: an inline JSString's fiber word is itself the uniqued key
-    // (content-unique, bit 1 tagged). Return it directly as a tagged
-    // UniquedStringImpl*; callers use uidIsSymbol/uidHash to branch.
-    if (string->isInline())
+    // D.4 coherence: return the canonical fiber word for any 2..5-char Latin-1
+    // key so PropertyName / PropertyTable::find hit regardless of whether the
+    // cell is inline or already atom-backed (string literals).
+    if (string->isInline() && string->is8Bit() && string->length() <= maxFiberWordKeyLength)
         return std::bit_cast<UniquedStringImpl*>(string->inlineFiberWord());
-    return std::bit_cast<UniquedStringImpl*>(string->getValueImpl());
+    StringImpl* impl = string->getValueImpl();
+    if (uintptr_t fiber = Identifier::canonicalFiberWordFor(impl))
+        return std::bit_cast<UniquedStringImpl*>(fiber);
+    return std::bit_cast<UniquedStringImpl*>(impl);
 #else
     return std::bit_cast<UniquedStringImpl*>(string->getValueImpl());
 #endif
@@ -138,9 +149,9 @@ inline bool CacheableIdentifier::isCacheableIdentifierCell(JSCell* cell)
         return false;
     JSString* string = uncheckedDowncast<JSString>(cell);
 #if USE(BUN_JSC_ADDITIONS)
-    // Phase D: an inline JSString's fiber word is content-unique and acts as
-    // its own uniqued key, so it is cacheable without atom materialization.
-    if (string->isInline())
+    // Phase D: only small-8-bit-inline (2..5 Latin-1) has a content-unique
+    // single-word key usable as a uid without atomization.
+    if (string->isInline() && string->is8Bit() && string->length() <= maxFiberWordKeyLength)
         return true;
 #endif
     if (const StringImpl* impl = string->tryGetValueImpl())
@@ -163,15 +174,24 @@ inline GCOwnedDataScope<const UniquedStringImpl*> CacheableIdentifier::getCachea
         return { };
     JSString* string = uncheckedDowncast<JSString>(cell);
 #if USE(BUN_JSC_ADDITIONS)
-    // Phase D: return the fiber word itself as the uniqued key. It is
-    // content-unique so pointer-identity IC compares remain sound, and
-    // downstream hash/isSymbol queries branch via uidHash/uidIsSymbol.
-    if (string->isInline())
-        return { cell, std::bit_cast<const UniquedStringImpl*>(string->inlineFiberWord()) };
-#endif
+    // D.4 coherence: hand back the canonical fiber word so downstream
+    // PropertyName / CacheableIdentifier::uid() match the parser's key.
+    if (string->isInline()) {
+        if (string->is8Bit() && string->length() <= maxFiberWordKeyLength)
+            return { cell, std::bit_cast<const UniquedStringImpl*>(string->inlineFiberWord()) };
+        return { cell, string->resolveInlineToAtomString(nullptr) };
+    }
+    if (const StringImpl* impl = string->tryGetValueImpl(); impl && impl->isAtom()) {
+        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(impl))
+            return { cell, std::bit_cast<const UniquedStringImpl*>(fiber) };
+        return { cell, static_cast<const AtomStringImpl*>(impl) };
+    }
+    return { };
+#else
     if (const StringImpl* impl = string->tryGetValueImpl(); impl && impl->isAtom())
         return { cell, static_cast<const AtomStringImpl*>(impl) };
     return { };
+#endif
 }
 
 inline GCOwnedDataScope<const UniquedStringImpl*> CacheableIdentifier::getCacheableIdentifier(JSValue value)
diff --git a/Source/JavaScriptCore/runtime/CachedTypes.cpp b/Source/JavaScriptCore/runtime/CachedTypes.cpp
index 2fb450dfea483..6174b909c897b 100644
--- a/Source/JavaScriptCore/runtime/CachedTypes.cpp
+++ b/Source/JavaScriptCore/runtime/CachedTypes.cpp
@@ -1141,7 +1141,7 @@ class CachedExpressionInfo : public CachedObject<ExpressionInfo> {
 };
 
 #if USE(BUN_JSC_ADDITIONS)
-typedef CachedHashMap<CachedFiberAwareRefPtr<WTF::PackedPtrTraits<UniquedStringImpl>>, PrivateNameEntry, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, PrivateNameEntryHashTraits> CachedPrivateNameEnvironment;
+typedef CachedHashMap<CachedFiberAwareRefPtr<>, PrivateNameEntry, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, PrivateNameEntryHashTraits> CachedPrivateNameEnvironment;
 #else
 typedef CachedHashMap<CachedRefPtr<CachedUniquedStringImpl, UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>>, PrivateNameEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, PrivateNameEntryHashTraits> CachedPrivateNameEnvironment;
 #endif
@@ -1187,7 +1187,7 @@ class CachedVariableEnvironment : public CachedObject<VariableEnvironment> {
     bool m_isEverythingCaptured;
     bool m_hasAwaitUsingDeclaration;
 #if USE(BUN_JSC_ADDITIONS)
-    CachedInlineMap<CachedFiberAwareRefPtr<WTF::PackedPtrTraits<UniquedStringImpl>>, VariableEnvironmentEntry, VariableEnvironment::inlineMapCapacity, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, VariableEnvironmentEntryHashTraits> m_map;
+    CachedInlineMap<CachedFiberAwareRefPtr<>, VariableEnvironmentEntry, VariableEnvironment::inlineMapCapacity, IdentifierRepHash, HashTraits<FiberAwareRefPtr>, VariableEnvironmentEntryHashTraits> m_map;
 #else
     CachedInlineMap<CachedRefPtr<CachedUniquedStringImpl, UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>>, VariableEnvironmentEntry, VariableEnvironment::inlineMapCapacity, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, VariableEnvironmentEntryHashTraits> m_map;
 #endif
@@ -1229,7 +1229,7 @@ class CachedCompactTDZEnvironment : public CachedObject<CompactTDZEnvironment> {
 
 private:
 #if USE(BUN_JSC_ADDITIONS)
-    CachedVector<CachedFiberAwareRefPtr<WTF::PackedPtrTraits<UniquedStringImpl>>> m_variables;
+    CachedVector<CachedFiberAwareRefPtr<>> m_variables;
 #else
     CachedVector<CachedRefPtr<CachedUniquedStringImpl, UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>>> m_variables;
 #endif
diff --git a/Source/JavaScriptCore/runtime/GetPutInfo.h b/Source/JavaScriptCore/runtime/GetPutInfo.h
index e9cd7111c3462..24c9ec77ec4aa 100644
--- a/Source/JavaScriptCore/runtime/GetPutInfo.h
+++ b/Source/JavaScriptCore/runtime/GetPutInfo.h
@@ -26,6 +26,9 @@
 #pragma once
 
 #include "ECMAMode.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/UniquedStringImpl.h>
 
@@ -217,7 +220,11 @@ struct ResolveOp {
     JSLexicalEnvironment* lexicalEnvironment;
     WatchpointSet* watchpointSet;
     uintptr_t operand;
+#if USE(BUN_JSC_ADDITIONS)
+    FiberAwareRefPtr importedName;
+#else
     RefPtr<UniquedStringImpl> importedName;
+#endif
 };
 
 class GetPutInfo {
diff --git a/Source/JavaScriptCore/runtime/Identifier.h b/Source/JavaScriptCore/runtime/Identifier.h
index 42a3924f4b54a..9ffa5449fab2b 100644
--- a/Source/JavaScriptCore/runtime/Identifier.h
+++ b/Source/JavaScriptCore/runtime/Identifier.h
@@ -219,7 +219,9 @@ class Identifier {
     }
 
     bool isNull() const { return !m_bits; }
-    bool isEmpty() const { return m_bits && !isInlinePropertyKey(m_bits) && !reinterpret_cast<StringImpl*>(m_bits)->length(); }
+    // Matches AtomString::isEmpty(): null OR zero-length. BreakNode/ContinueNode
+    // pass a null-m_bits Identifier for the unlabeled case and test isEmpty().
+    bool isEmpty() const { return !m_bits || (!isInlinePropertyKey(m_bits) && !reinterpret_cast<StringImpl*>(m_bits)->length()); }
     bool isSymbol() const { return m_bits && uidIsSymbol(reinterpret_cast<UniquedStringImpl*>(m_bits)); }
     bool isPrivateName() const { return isSymbol() && static_cast<const SymbolImpl*>(impl())->isPrivate(); }
 
@@ -231,6 +233,11 @@ class Identifier {
 
     void dump(PrintStream&) const;
 
+    // Phase D.4 coherence: every construction path for a 2..5-char Latin-1
+    // name must yield the same encodeInline8 fiber word so PropertyTable's
+    // pointer-identity compare hits regardless of which producer ran.
+    static uintptr_t canonicalFiberWordFor(const StringImpl*); // Defined in IdentifierInlines.h
+
 private:
     uintptr_t m_bits { 0 };
     mutable AtomString m_materializedString;
@@ -250,11 +257,6 @@ class Identifier {
     inline Identifier(VM&, StringImpl*);
     inline Identifier(VM&, Ref<AtomStringImpl>&&); // Defined in IdentifierInlines.h
 
-    // Phase D.4 coherence: every construction path for a 2..7-char Latin-1
-    // name must yield the same encodeInline8 fiber word so PropertyTable's
-    // pointer-identity compare hits regardless of which producer ran.
-    static uintptr_t canonicalFiberWordFor(const StringImpl*); // Defined in IdentifierInlines.h
-
     Identifier(SymbolImpl& uid)
     {
         uid.ref();
@@ -398,11 +400,34 @@ inline bool operator==(const Identifier& a, const Identifier& b)
 
 inline bool Identifier::equal(const StringImpl* r, std::span<const Latin1Character> s)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInlinePropertyKey(reinterpret_cast<const UniquedStringImpl*>(r))) [[unlikely]] {
+        uintptr_t w = reinterpret_cast<uintptr_t>(r);
+        if (!inlinePropertyKeyIs8Bit(w))
+            return false;
+        auto span = inlinePropertyKeySpan8(w);
+        return span.size() == s.size() && !memcmp(span.data(), s.data(), s.size());
+    }
+#endif
     return WTF::equal(r, s);
 }
 
 inline bool Identifier::equal(const StringImpl* r, std::span<const char16_t> s)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInlinePropertyKey(reinterpret_cast<const UniquedStringImpl*>(r))) [[unlikely]] {
+        uintptr_t w = reinterpret_cast<uintptr_t>(r);
+        if (!inlinePropertyKeyIs8Bit(w))
+            return false;
+        auto span = inlinePropertyKeySpan8(w);
+        if (span.size() != s.size())
+            return false;
+        for (size_t i = 0; i < s.size(); ++i)
+            if (span[i] != s[i])
+                return false;
+        return true;
+    }
+#endif
     return WTF::equal(r, s);
 }
 
@@ -412,8 +437,14 @@ ALWAYS_INLINE std::optional<uint32_t> parseIndex(const Identifier& identifier)
     auto uid = identifier.impl();
     if (!uid || uidIsSymbol(uid))
         return std::nullopt;
-    if (isInlinePropertyKey(uid))
+    if (isInlinePropertyKey(uid)) {
+        // D.4 coherence means numeric strings "42".."9999999" arrive here as
+        // fiber words; decode so obj["42"] still hits the indexed-property path.
+        uintptr_t w = reinterpret_cast<uintptr_t>(uid);
+        if (inlinePropertyKeyIs8Bit(w))
+            return parseIndex(inlinePropertyKeySpan8(w));
         return std::nullopt;
+    }
     return parseIndex(*uid);
 #else
     auto uid = identifier.impl();
@@ -465,6 +496,14 @@ typedef UncheckedKeyHashMap<UniquedStringImpl*, int, IdentifierRepHash, HashTrai
 
 namespace WTF {
 
+#if USE(BUN_JSC_ADDITIONS)
+// m_bits equality defines Identifier equality, but m_materializedString is a
+// lazily-populated cache — two equal Identifiers can differ byte-wise there.
+template <> struct VectorTraits<JSC::Identifier> : SimpleClassVectorTraits {
+    static constexpr bool canCompareWithMemcmp = false;
+};
+#else
 template <> struct VectorTraits<JSC::Identifier> : SimpleClassVectorTraits { };
+#endif
 
 } // namespace WTF
diff --git a/Source/JavaScriptCore/runtime/IdentifierInlines.h b/Source/JavaScriptCore/runtime/IdentifierInlines.h
index 5cdf370e55055..f83dea59da6b9 100644
--- a/Source/JavaScriptCore/runtime/IdentifierInlines.h
+++ b/Source/JavaScriptCore/runtime/IdentifierInlines.h
@@ -41,10 +41,12 @@ namespace JSC  {
 // JSString::toIdentifier, or any fromString()/fromUid() caller.
 ALWAYS_INLINE uintptr_t Identifier::canonicalFiberWordFor(const StringImpl* impl)
 {
+    if constexpr (!enableIdentifierFiberWords)
+        return 0;
     if (!impl || impl->isSymbol())
         return 0;
     unsigned len = impl->length();
-    if (len < 2 || len > JSString::maxInlineLength8)
+    if (len < 2 || len > maxFiberWordKeyLength)
         return 0;
     if (impl->is8Bit()) [[likely]]
         return JSString::encodeInline8(impl->span8());
@@ -62,10 +64,12 @@ ALWAYS_INLINE uintptr_t Identifier::canonicalFiberWordFor(const StringImpl* impl
 inline Identifier::Identifier(VM& vm, std::span<const Latin1Character> string)
 {
     // Phase D.2 producer: short Latin-1 identifiers live as a tagged fiber word
-    // (no AtomStringImpl materialized). size 0/1 and >7 fall through to add().
-    if (string.size() >= 2 && string.size() <= JSString::maxInlineLength8) {
-        m_bits = JSString::encodeInline8(string);
-        return;
+    // (no AtomStringImpl materialized). size 0/1 and >5 fall through to add().
+    if constexpr (enableIdentifierFiberWords) {
+        if (string.size() >= 2 && string.size() <= maxFiberWordKeyLength) {
+            m_bits = JSString::encodeInline8(string);
+            return;
+        }
     }
     m_bits = reinterpret_cast<uintptr_t>(&add(vm, string).leakRef());
 }
@@ -82,17 +86,19 @@ inline Identifier::Identifier(VM& vm, std::span<const char16_t> string)
 {
     // D.4 coherence: a 16-bit span whose content fits Latin-1 must yield the
     // same fiber word the Latin-1 span ctor would.
-    if (string.size() >= 2 && string.size() <= JSString::maxInlineLength8) {
-        Latin1Character narrowed[JSString::maxInlineLength8];
-        bool allLatin1 = true;
-        for (size_t i = 0; i < string.size(); ++i) {
-            char16_t c = string[i];
-            if (c > 0xff) { allLatin1 = false; break; }
-            narrowed[i] = static_cast<Latin1Character>(c);
-        }
-        if (allLatin1) {
-            m_bits = JSString::encodeInline8({ narrowed, string.size() });
-            return;
+    if constexpr (enableIdentifierFiberWords) {
+        if (string.size() >= 2 && string.size() <= maxFiberWordKeyLength) {
+            Latin1Character narrowed[JSString::maxInlineLength8];
+            bool allLatin1 = true;
+            for (size_t i = 0; i < string.size(); ++i) {
+                char16_t c = string[i];
+                if (c > 0xff) { allLatin1 = false; break; }
+                narrowed[i] = static_cast<Latin1Character>(c);
+            }
+            if (allLatin1) {
+                m_bits = JSString::encodeInline8({ narrowed, string.size() });
+                return;
+            }
         }
     }
     m_bits = reinterpret_cast<uintptr_t>(&add(vm, string).leakRef());
@@ -101,11 +107,13 @@ inline Identifier::Identifier(VM& vm, std::span<const char16_t> string)
 
 ALWAYS_INLINE Identifier::Identifier(VM& vm, ASCIILiteral literal)
 {
-    // D.4 coherence: ASCII is Latin-1; 2..7 chars must be a fiber word.
-    size_t len = literal.length();
-    if (len >= 2 && len <= JSString::maxInlineLength8) {
-        m_bits = JSString::encodeInline8(literal.span8());
-        return;
+    // D.4 coherence: ASCII is Latin-1; 2..5 chars must be a fiber word.
+    if constexpr (enableIdentifierFiberWords) {
+        size_t len = literal.length();
+        if (len >= 2 && len <= maxFiberWordKeyLength) {
+            m_bits = JSString::encodeInline8(literal.span8());
+            return;
+        }
     }
     m_bits = reinterpret_cast<uintptr_t>(&add(vm, literal).leakRef());
     ASSERT(reinterpret_cast<StringImpl*>(m_bits)->isAtom());
@@ -283,10 +291,28 @@ inline Identifier Identifier::createLatin1(VM& vm, std::span<const char16_t> str
 SUPPRESS_NODELETE inline Identifier Identifier::fromUid(VM& vm, UniquedStringImpl* uid)
 {
 #if USE(BUN_JSC_ADDITIONS)
-    // D.4 coherence: uid may already be a fiber word (from Identifier::impl())
-    // — keep it verbatim. A real impl funnels through the canonicalizing ctor.
-    if (isInlinePropertyKey(uid))
-        return fromFiberWord(reinterpret_cast<uintptr_t>(uid));
+    // D.4 coherence: uid may be a fiber word (from Identifier::impl() or
+    // CacheableIdentifier::uid()). Only the encodeInline8 form (8-bit, 2..7
+    // chars) is canonical for m_bits — encodeInline16 / big-inline words must
+    // be decoded and re-routed so PropertyTable pointer compares still hit.
+    if (isInlinePropertyKey(uid)) {
+        uintptr_t w = reinterpret_cast<uintptr_t>(uid);
+        unsigned len = inlinePropertyKeyLength(w);
+        if (inlinePropertyKeyIs8Bit(w) && len >= 2 && len <= maxFiberWordKeyLength)
+            return fromFiberWord(w);
+        // Non-canonical inline. A big-inline word is detached from its cell
+        // and payload exceeds the 8-byte word — upstream producer bug; ASSERT
+        // and cap the read to stay in-bounds.
+        const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&w);
+        if (inlinePropertyKeyIs8Bit(w)) {
+            ASSERT_WITH_MESSAGE(len <= JSString::maxInlineLength8, "big-inline fiber word detached from cell");
+            unsigned take = len <= JSString::maxInlineLength8 ? len : JSString::maxInlineLength8;
+            return Identifier(vm, std::span<const Latin1Character> { bytes + 1, take });
+        }
+        ASSERT_WITH_MESSAGE(len <= JSString::maxInlineLength16, "big-inline fiber word detached from cell");
+        unsigned take = len <= JSString::maxInlineLength16 ? len : JSString::maxInlineLength16;
+        return Identifier(vm, std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), take });
+    }
     if (!uid || !uid->isSymbol())
         return Identifier(vm, static_cast<StringImpl*>(uid));
     return static_cast<SymbolImpl&>(*uid);
diff --git a/Source/JavaScriptCore/runtime/InlinePropertyKey.h b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
index ee3bf6172e7ed..aa13b6a81f60f 100644
--- a/Source/JavaScriptCore/runtime/InlinePropertyKey.h
+++ b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
@@ -33,6 +33,17 @@ namespace JSC {
 static constexpr uintptr_t inlinePropertyKeyTag = 0x2;
 static constexpr uintptr_t inlinePropertyKeyTagMask = 0x3;
 
+// Canonical fiber-word keys cap at 5 chars so the whole word fits in bits 0..47.
+// CompactPropertyTableEntry / StructureTransitionTable::Hash::Key pack attributes
+// into bits 48..63 of a UniquedStringImpl* slot; a 6/7-char payload there would
+// be truncated. 6..7-char names stay atom-backed for D.4 coherence.
+static constexpr unsigned maxFiberWordKeyLength = 5;
+
+// Compile-time killswitch for the D.2/D.4 producer paths. Flip to false to
+// disable fiber-word Identifiers in one place (debug: 'shims broken' vs
+// 'producer reached unguarded site') without reverting commits.
+static constexpr bool enableIdentifierFiberWords = true;
+
 ALWAYS_INLINE bool isInlinePropertyKey(const UniquedStringImpl* impl)
 {
     return (reinterpret_cast<uintptr_t>(impl) & inlinePropertyKeyTagMask) == inlinePropertyKeyTag;
@@ -137,8 +148,20 @@ struct FiberAwareRefDerefTraits {
 };
 
 using FiberAwareRefPtr = RefPtr<UniquedStringImpl, WTF::RawPtrTraits<UniquedStringImpl>, FiberAwareRefDerefTraits>;
-using FiberAwarePackedRefPtr = RefPtr<UniquedStringImpl, WTF::PackedPtrTraits<UniquedStringImpl>, FiberAwareRefDerefTraits>;
+// PackedPtrTraits stores only EFFECTIVE_ADDRESS_WIDTH/8 = 6 bytes; a 6-7 char
+// Latin-1 fiber word uses bytes 6-7, so Packed storage would truncate it.
+// Alias to the full-width RawPtrTraits RefPtr and accept +2 bytes per entry.
+using FiberAwarePackedRefPtr = FiberAwareRefPtr;
+
+} // namespace JSC
+
+#else // USE(BUN_JSC_ADDITIONS)
 
+namespace JSC {
+// Transparent fallbacks so bare uidIsSymbol() / isInlinePropertyKey() at call
+// sites compile in non-BUN builds without #if guards at each one.
+ALWAYS_INLINE bool isInlinePropertyKey(const WTF::UniquedStringImpl*) { return false; }
+ALWAYS_INLINE bool uidIsSymbol(const WTF::UniquedStringImpl* impl) { return impl->isSymbol(); }
 } // namespace JSC
 
 #endif // USE(BUN_JSC_ADDITIONS)
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index 565cd991263b7..1fef2ea5b5c6f 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -1484,7 +1484,11 @@ void JSGlobalObject::init(VM& vm)
 
     m_linkTimeConstants[static_cast<unsigned>(LinkTimeConstant::sentinelString)].set(vm, this, vm.smallStrings.sentinelString());
 
+#if USE(BUN_JSC_ADDITIONS)
+    JSFunction* defaultPromiseThen = JSFunction::create(vm, this, 2, vm.propertyNames->then.string(), promiseProtoFuncThen, ImplementationVisibility::Public, PromisePrototypeThenIntrinsic);
+#else
     JSFunction* defaultPromiseThen = JSFunction::create(vm, this, 2, vm.propertyNames->then.impl(), promiseProtoFuncThen, ImplementationVisibility::Public, PromisePrototypeThenIntrinsic);
+#endif
     m_linkTimeConstants[static_cast<unsigned>(LinkTimeConstant::defaultPromiseThen)].set(vm, this, defaultPromiseThen);
 
 #define CREATE_PROTOTYPE_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) if (featureFlag) { \
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 486e6b583a625..5a6a1775ab45e 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -665,7 +665,11 @@ class JSGlobalObject : public JSSegmentedVariableObject {
     bool isArgumentsPrototypeIteratorProtocolFastAndNonObservable();
 
 #if ENABLE(DFG_JIT)
+#if USE(BUN_JSC_ADDITIONS)
+    using ReferencedGlobalPropertyWatchpointSets = UncheckedKeyHashMap<FiberAwareRefPtr, Ref<WatchpointSet>, IdentifierRepHash>;
+#else
     using ReferencedGlobalPropertyWatchpointSets = UncheckedKeyHashMap<RefPtr<UniquedStringImpl>, Ref<WatchpointSet>, IdentifierRepHash>;
+#endif
     ReferencedGlobalPropertyWatchpointSets m_referencedGlobalPropertyWatchpointSets;
     ConcurrentJSLock m_referencedGlobalPropertyWatchpointSetsLock;
 #endif
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h b/Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h
index 7a81f7901af37..d4848c3ab8363 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h
@@ -271,9 +271,15 @@ template<typename T>
 template<typename U>
 inline unsigned JSGlobalObject::WeakCustomGetterOrSetterHash<T>::hash(const PropertyName& propertyName, typename U::CustomFunctionPointer functionPointer, const ClassInfo* classInfo)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    if (!propertyName.isNull())
+        return WTF::computeHash(functionPointer, uidHash(propertyName.uid()), classInfo);
+    return WTF::computeHash(functionPointer, classInfo);
+#else
     if (!propertyName.isNull())
         return WTF::computeHash(functionPointer, propertyName.uid()->existingSymbolAwareHash(), classInfo);
     return WTF::computeHash(functionPointer, classInfo);
+#endif
 }
 
 inline JSArray* constructEmptyArray(JSGlobalObject* globalObject, ArrayAllocationProfile* profile, unsigned initialLength = 0, JSValue newTarget = JSValue())
diff --git a/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp b/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp
index 11842faf429c5..89a36a52abba6 100644
--- a/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp
+++ b/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp
@@ -81,8 +81,13 @@ void JSLexicalEnvironment::getOwnSpecialPropertyNames(JSObject* object, JSGlobal
                 continue;
             if (!thisObject->isValidScopeOffset(it->value.scopeOffset()))
                 continue;
+#if USE(BUN_JSC_ADDITIONS)
+            if (!propertyNames.includeSymbolProperties() && uidIsSymbol(it->key.get()))
+                continue;
+#else
             if (!propertyNames.includeSymbolProperties() && it->key->isSymbol())
                 continue;
+#endif
             if (propertyNames.privateSymbolMode() == PrivateSymbolMode::Exclude && symbolTable->hasPrivateName(it->key))
                 continue;
             propertyNames.add(Identifier::fromUid(vm, it->key.get()));
diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
index fc398dbaa78b4..0cfa275c563ce 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -221,9 +221,17 @@ inline PropertyNameForFunctionCall::PropertyNameForFunctionCall(unsigned number)
 JSValue PropertyNameForFunctionCall::value(VM& vm) const
 {
     if (!m_value) {
-        if (!m_propertyName.isNull())
+        if (!m_propertyName.isNull()) {
+#if USE(BUN_JSC_ADDITIONS)
+            UniquedStringImpl* uid = m_propertyName.uid();
+            if (isInlinePropertyKey(uid))
+                m_value = JSString::createInlineFromFiber(vm, inlinePropertyKeyWord(uid));
+            else
+                m_value = jsString(vm, String { uid });
+#else
             m_value = jsString(vm, String { m_propertyName.uid() });
-        else {
+#endif
+        } else {
             if (m_number <= 9)
                 return vm.smallStrings.singleCharacterString(m_number + '0');
             m_value = jsNontrivialString(vm, vm.numericStrings.add(m_number));
@@ -640,7 +648,18 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
         stringifier.startNewLine(builder);
 
         // Append the property name, colon, and space.
+#if USE(BUN_JSC_ADDITIONS)
+        {
+            UniquedStringImpl* uid = propertyName.uid();
+            if (isInlinePropertyKey(uid)) {
+                uintptr_t word = inlinePropertyKeyWord(uid);
+                builder.appendQuotedJSONString(String(inlinePropertyKeySpan8(word)));
+            } else
+                builder.appendQuotedJSONString(*uid);
+        }
+#else
         builder.appendQuotedJSONString(*propertyName.uid());
+#endif
         builder.append(':');
         if (stringifier.willIndent())
             builder.append(' ');
@@ -1426,6 +1445,29 @@ void FastStringifier<CharType, bufferMode>::append(JSValue value)
         structure.forEachProperty(m_vm, [&](const auto& entry) -> bool {
             if (entry.attributes() & PropertyAttribute::DontEnum)
                 return true;
+#if USE(BUN_JSC_ADDITIONS)
+            UniquedStringImpl* nameUID = entry.key();
+            uintptr_t nameWord = inlinePropertyKeyWord(nameUID);
+            std::span<const Latin1Character> span;
+            if (isInlinePropertyKey(nameUID)) {
+                if (!inlinePropertyKeyIs8Bit(nameWord)) [[unlikely]] {
+                    recordFailure("16-bit property name"_s);
+                    return false;
+                }
+                span = inlinePropertyKeySpan8(nameWord);
+            } else {
+                auto& name = *nameUID;
+                if (name.isSymbol()) [[unlikely]] {
+                    recordFailure("symbol"_s);
+                    return false;
+                }
+                if (!name.is8Bit()) [[unlikely]] {
+                    recordFailure("16-bit property name"_s);
+                    return false;
+                }
+                span = name.span8();
+            }
+#else
             auto& name = *entry.key();
             if (name.isSymbol()) [[unlikely]] {
                 recordFailure("symbol"_s);
@@ -1439,6 +1481,7 @@ void FastStringifier<CharType, bufferMode>::append(JSValue value)
                 return false;
             }
             auto span = name.span8();
+#endif
 
             // The structure cannot transition mid-iteration on FastStringifier's case.
             // canPerformFastPropertyEnumeration ruled out getters/setters and
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 231595ead6415..55ef184c66e9b 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -1063,9 +1063,11 @@ ALWAYS_INLINE Identifier JSString::toIdentifier(JSGlobalObject* globalObject) co
         // Phase D.2 producer + D.4 coherence: only the 8-bit small-inline
         // encoding is the canonical Identifier form. 16-bit inline and
         // big-inline (8..15) atomize, then fromString() re-canonicalizes
-        // to encodeInline8 if the content is 2..7 Latin-1.
-        if (is8Bit() && length() <= maxInlineLength8)
-            return Identifier::fromFiberWord(m_fiber);
+        // to encodeInline8 if the content is 2..5 Latin-1.
+        if constexpr (enableIdentifierFiberWords) {
+            if (is8Bit() && length() <= maxFiberWordKeyLength)
+                return Identifier::fromFiberWord(m_fiber);
+        }
         return Identifier::fromString(getVM(globalObject), Ref { *resolveInlineToAtomString(globalObject) });
     }
 #endif
diff --git a/Source/JavaScriptCore/runtime/Lookup.h b/Source/JavaScriptCore/runtime/Lookup.h
index a7134ccf7e0b9..c8358c59ab487 100644
--- a/Source/JavaScriptCore/runtime/Lookup.h
+++ b/Source/JavaScriptCore/runtime/Lookup.h
@@ -352,6 +352,23 @@ struct HashTable {
         if (valueIndex == -1)
             return nullptr;
 
+#if USE(BUN_JSC_ADDITIONS)
+        uintptr_t uidWord = reinterpret_cast<uintptr_t>(uid);
+        if (isInlinePropertyKey(uidWord)) [[unlikely]] {
+            auto keySpan = inlinePropertyKeySpan8(uidWord);
+            while (true) {
+                auto& tableKey = values[valueIndex].m_key;
+                if (!tableKey.isNull() && tableKey.length() == keySpan.size()
+                    && !memcmp(tableKey.characters(), keySpan.data(), keySpan.size()))
+                    return &values[valueIndex];
+                indexEntry = index[indexEntry].next;
+                if (indexEntry == -1)
+                    return nullptr;
+                valueIndex = index[indexEntry].value;
+                ASSERT(valueIndex != -1);
+            }
+        }
+#endif
         while (true) {
             if (!values[valueIndex].m_key.isNull() && WTF::equal(uid, values[valueIndex].m_key))
                 return &values[valueIndex];
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index 676609f45f725..2351d9f3e2f93 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -421,7 +421,12 @@ JSC_DEFINE_HOST_FUNCTION(objectConstructorEntries, (JSGlobalObject* globalObject
     }
 
     {
+#if USE(BUN_JSC_ADDITIONS)
+        // entry.key() may be a fiber-word-tagged UniquedStringImpl*; use fiber-aware ref/deref.
+        Vector<FiberAwareRefPtr, 8> properties;
+#else
         Vector<RefPtr<UniquedStringImpl>, 8> properties;
+#endif
         MarkedArgumentBuffer values;
         bool canUseFastPath = false;
         if (!target->canHaveExistingOwnIndexedProperties() && !target->hasNonReifiedStaticProperties()) {
@@ -432,8 +437,13 @@ JSC_DEFINE_HOST_FUNCTION(objectConstructorEntries, (JSGlobalObject* globalObject
                     if (entry.attributes() & PropertyAttribute::DontEnum)
                         return true;
 
+#if USE(BUN_JSC_ADDITIONS)
+                    if (uidIsSymbol(entry.key()))
+                        return true;
+#else
                     if (entry.key()->isSymbol())
                         return true;
+#endif
 
                     properties.append(entry.key());
                     values.appendWithCrashOnOverflow(target->getDirect(entry.offset()));
@@ -469,7 +479,15 @@ JSC_DEFINE_HOST_FUNCTION(objectConstructorEntries, (JSGlobalObject* globalObject
                     auto* newButterfly = JSCellButterfly::create(vm, CopyOnWriteArrayWithContiguous, numProperties);
                     for (size_t i = 0; i < numProperties; i++) {
                         const auto& identifier = properties[i];
+#if USE(BUN_JSC_ADDITIONS)
+                        UniquedStringImpl* uid = identifier.get();
+                        JSString* keyString = isInlinePropertyKey(uid)
+                            ? JSString::createInlineFromFiber(vm, inlinePropertyKeyWord(uid))
+                            : jsOwnedString(vm, uid);
+                        newButterfly->setIndex(vm, i, keyString);
+#else
                         newButterfly->setIndex(vm, i, jsOwnedString(vm, identifier.get()));
+#endif
                     }
 
                     targetStructure->setCachedPropertyNames(vm, CachedPropertyNamesKind::EnumerableStrings, newButterfly);
@@ -486,8 +504,16 @@ JSC_DEFINE_HOST_FUNCTION(objectConstructorEntries, (JSGlobalObject* globalObject
                         key = cachedKey;
                 }
 
-                if (!key)
+                if (!key) {
+#if USE(BUN_JSC_ADDITIONS)
+                    UniquedStringImpl* uid = properties[i].get();
+                    key = isInlinePropertyKey(uid)
+                        ? JSString::createInlineFromFiber(vm, inlinePropertyKeyWord(uid))
+                        : jsOwnedString(vm, uid);
+#else
                     key = jsOwnedString(vm, properties[i].get());
+#endif
+                }
 
                 JSArray* entry = nullptr;
                 {
@@ -580,8 +606,13 @@ JSValue objectValues(VM& vm, JSGlobalObject* globalObject, JSValue targetValue)
                     if (entry.attributes() & PropertyAttribute::DontEnum)
                         return true;
 
+#if USE(BUN_JSC_ADDITIONS)
+                    if (uidIsSymbol(entry.key()))
+                        return true;
+#else
                     if (entry.key()->isSymbol())
                         return true;
+#endif
 
                     namedPropertyValues.appendWithCrashOnOverflow(target->getDirect(entry.offset()));
                     return true;
@@ -885,7 +916,12 @@ static JSValue defineProperties(JSGlobalObject* globalObject, JSObject* object,
     VM& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
 
+#if USE(BUN_JSC_ADDITIONS)
+    // entry.key() may be a fiber-word-tagged UniquedStringImpl*; DefaultRefDerefTraits::refIfNotNull would deref it.
+    Vector<FiberAwareRefPtr, 8> propertyNames;
+#else
     Vector<RefPtr<UniquedStringImpl>, 8> propertyNames;
+#endif
     MarkedArgumentBuffer values;
     bool canUseFastPath = false;
     if (!hasIndexedProperties(properties->indexingType())) {
diff --git a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
index 9b1326dd5d514..fd571bd457632 100644
--- a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -136,6 +136,10 @@ JSC_DEFINE_HOST_FUNCTION(objectProtoFuncHasOwnProperty, (JSGlobalObject* globalO
     if (subscript.isString()) {
         propertyName = asString(subscript)->toAtomString(globalObject);
         uid = propertyName.data;
+#if USE(BUN_JSC_ADDITIONS)
+        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+            uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+#endif
     } else {
         propertyKey = subscript.toPropertyKey(globalObject);
         uid = propertyKey.impl();
diff --git a/Source/JavaScriptCore/runtime/PropertyName.h b/Source/JavaScriptCore/runtime/PropertyName.h
index 77484a94d9e38..695c824f68c53 100644
--- a/Source/JavaScriptCore/runtime/PropertyName.h
+++ b/Source/JavaScriptCore/runtime/PropertyName.h
@@ -100,7 +100,9 @@ class PropertyName {
     AtomStringImpl* publicName() const
     {
 #if USE(BUN_JSC_ADDITIONS)
-        return (!m_impl || uidIsSymbol(m_impl)) ? nullptr : static_cast<AtomStringImpl*>(m_impl);
+        // A fiber-word key has no real AtomStringImpl*; callers needing the text
+        // must go through Identifier::string() which materializes on demand.
+        return (!m_impl || isInlinePropertyKey(m_impl) || m_impl->isSymbol()) ? nullptr : static_cast<AtomStringImpl*>(m_impl);
 #else
         return (!m_impl || m_impl->isSymbol()) ? nullptr : static_cast<AtomStringImpl*>(m_impl);
 #endif
@@ -108,10 +110,26 @@ class PropertyName {
 
     void dump(PrintStream& out) const
     {
+#if USE(BUN_JSC_ADDITIONS)
+        if (m_impl) {
+            if (isInlinePropertyKey(m_impl)) {
+                uintptr_t word = reinterpret_cast<uintptr_t>(m_impl);
+                unsigned len = inlinePropertyKeyLength(word);
+                const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+                if (inlinePropertyKeyIs8Bit(word))
+                    out.print(StringView(std::span<const Latin1Character> { bytes + 1, len }));
+                else
+                    out.print(StringView(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len }));
+            } else
+                out.print(m_impl);
+        } else
+            out.print("<null property name>");
+#else
         if (m_impl)
             out.print(m_impl);
         else
             out.print("<null property name>");
+#endif
     }
 
 private:
@@ -132,10 +150,32 @@ inline bool operator==(PropertyName a, PropertyName b)
 inline bool operator==(PropertyName a, const char* b)
 {
 #if USE(BUN_JSC_ADDITIONS)
-    if (isInlinePropertyKey(a.uid()))
-        return false;
-#endif
+    auto* uid = a.uid();
+    if (isInlinePropertyKey(uid)) {
+        if (!b)
+            return false;
+        uintptr_t w = reinterpret_cast<uintptr_t>(uid);
+        unsigned len = inlinePropertyKeyLength(w);
+        const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&w);
+        if (inlinePropertyKeyIs8Bit(w)) {
+            const Latin1Character* chars = bytes + 1;
+            for (unsigned i = 0; i < len; ++i) {
+                if (!b[i] || static_cast<Latin1Character>(b[i]) != chars[i])
+                    return false;
+            }
+            return !b[len];
+        }
+        const char16_t* chars = reinterpret_cast<const char16_t*>(bytes + 2);
+        for (unsigned i = 0; i < len; ++i) {
+            if (!b[i] || static_cast<char16_t>(static_cast<unsigned char>(b[i])) != chars[i])
+                return false;
+        }
+        return !b[len];
+    }
+    return equal(uid, b);
+#else
     return equal(a.uid(), b);
+#endif
 }
 
 ALWAYS_INLINE std::optional<uint32_t> parseIndex(PropertyName propertyName)
@@ -144,8 +184,12 @@ ALWAYS_INLINE std::optional<uint32_t> parseIndex(PropertyName propertyName)
     auto uid = propertyName.uid();
     if (!uid || uidIsSymbol(uid))
         return std::nullopt;
-    if (isInlinePropertyKey(uid))
+    if (isInlinePropertyKey(uid)) {
+        uintptr_t w = reinterpret_cast<uintptr_t>(uid);
+        if (inlinePropertyKeyIs8Bit(w))
+            return parseIndex(inlinePropertyKeySpan8(w));
         return std::nullopt;
+    }
     return parseIndex(*uid);
 #else
     auto uid = propertyName.uid();
@@ -187,8 +231,37 @@ ALWAYS_INLINE bool isCanonicalNumericIndexString(UniquedStringImpl* propertyName
     if (!propertyName)
         return false;
 #if USE(BUN_JSC_ADDITIONS)
-    if (isInlinePropertyKey(propertyName))
-        return false;
+    if (isInlinePropertyKey(propertyName)) {
+        uintptr_t w = reinterpret_cast<uintptr_t>(propertyName);
+        unsigned len = inlinePropertyKeyLength(w);
+        if (!len)
+            return false;
+        const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&w);
+        if (inlinePropertyKeyIs8Bit(w)) {
+            std::span<const Latin1Character> chars { bytes + 1, len };
+            auto fastResult = fastIsCanonicalNumericIndexString(chars);
+            if (fastResult)
+                return *fastResult;
+            double index = jsToNumber(StringView(chars));
+            NumberToStringBuffer buffer;
+            auto out = WTF::numberToStringAndSize(index, buffer);
+            return WTF::equal(chars, byteCast<Latin1Character>(out));
+        }
+        std::span<const char16_t> chars { reinterpret_cast<const char16_t*>(bytes + 2), len };
+        auto fastResult = fastIsCanonicalNumericIndexString(chars);
+        if (fastResult)
+            return *fastResult;
+        double index = jsToNumber(StringView(chars));
+        NumberToStringBuffer buffer;
+        auto out = byteCast<Latin1Character>(WTF::numberToStringAndSize(index, buffer));
+        if (chars.size() != out.size())
+            return false;
+        for (size_t i = 0; i < out.size(); ++i) {
+            if (chars[i] != static_cast<char16_t>(out[i]))
+                return false;
+        }
+        return true;
+    }
 #endif
     if (propertyName->isSymbol())
         return false;
diff --git a/Source/JavaScriptCore/runtime/PropertyNameArray.h b/Source/JavaScriptCore/runtime/PropertyNameArray.h
index 5315af4e6e1e3..725c16d0efcde 100644
--- a/Source/JavaScriptCore/runtime/PropertyNameArray.h
+++ b/Source/JavaScriptCore/runtime/PropertyNameArray.h
@@ -138,6 +138,10 @@ ALWAYS_INLINE void PropertyNameArrayBuilder::add(UniquedStringImpl* identifier)
 
 ALWAYS_INLINE bool PropertyNameArrayBuilder::isUidMatchedToTypeMode(UniquedStringImpl* identifier)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    if (isInlinePropertyKey(identifier))
+        return includeStringProperties();
+#endif
     if (identifier->isSymbol()) {
         if (!includeSymbolProperties())
             return false;
diff --git a/Source/JavaScriptCore/runtime/PropertyTable.h b/Source/JavaScriptCore/runtime/PropertyTable.h
index f7f5ec4ac3769..f1473a05a2b1d 100644
--- a/Source/JavaScriptCore/runtime/PropertyTable.h
+++ b/Source/JavaScriptCore/runtime/PropertyTable.h
@@ -320,6 +320,25 @@ PropertyTable::FindResult PropertyTable::findImpl(const Index* indexVector, cons
             ASSERT(!m_deletedOffsets || !m_deletedOffsets->contains(entry.offset()));
             return FindResult { entryIndex, index, entry.offset(), entry.attributes() };
         }
+#if USE(BUN_JSC_ADDITIONS)
+        // Defensive fiber↔atom bridge: if dual representation survives anywhere
+        // (an atom entered the table via a path that bypassed canonicalFiberWordFor,
+        // or vice-versa), content-compare when exactly one side is a fiber word.
+        else {
+            UniquedStringImpl* entryKey = entry.key();
+            bool keyIsFiber = isInlinePropertyKey(key);
+            bool entryIsFiber = isInlinePropertyKey(entryKey);
+            if (keyIsFiber != entryIsFiber) [[unlikely]] {
+                const UniquedStringImpl* implSide = keyIsFiber ? entryKey : key;
+                uintptr_t fiberWord = inlinePropertyKeyWord(keyIsFiber ? key : entryKey);
+                if (!implSide->isSymbol() && inlinePropertyKeyIs8Bit(fiberWord)
+                    && WTF::equal(implSide, inlinePropertyKeySpan8(fiberWord))) {
+                    ASSERT(!m_deletedOffsets || !m_deletedOffsets->contains(entry.offset()));
+                    return FindResult { entryIndex, index, entry.offset(), entry.attributes() };
+                }
+            }
+        }
+#endif
 
 #if DUMP_PROPERTYMAP_STATS
         ++propertyTableStats->numCollisions;
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
index 830890b0d5708..8223cb1e3350b 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -187,7 +187,13 @@ JSC_DEFINE_CUSTOM_GETTER(regExpConstructorDollar, (JSGlobalObject* globalObject,
     auto scope = DECLARE_THROW_SCOPE(vm);
     if (JSValue::decode(thisValue) != globalObject->regExpConstructor())
         return throwVMTypeError(globalObject, scope, "RegExp.$N getters require RegExp constructor as |this|"_s);
+#if USE(BUN_JSC_ADDITIONS)
+    // "$1".."$9" are 2-char fiber-word keys; second char is at payload byte 2.
+    auto* uid = propertyName.uid();
+    unsigned N = (isInlinePropertyKey(uid) ? inlinePropertyKeySpan8(reinterpret_cast<const uintptr_t&>(uid))[1] : uid->at(1)) - '0';
+#else
     unsigned N = propertyName.uid()->at(1) - '0';
+#endif
     ASSERT(N >= 1 && N <= 9);
     RELEASE_AND_RETURN(scope, JSValue::encode(globalObject->regExpGlobalData().getBackref(globalObject, N)));
 }
diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index d4cfba8847c96..922537c823241 100644
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -1426,8 +1426,8 @@ void Structure::getPropertyNamesFromStructure(VM& vm, PropertyNameArrayBuilder&
     
     table->forEachProperty([&](const auto& entry) {
         ASSERT(!isQuickPropertyAccessAllowedForEnumeration() || !(entry.attributes() & PropertyAttribute::DontEnum));
-        ASSERT(!isQuickPropertyAccessAllowedForEnumeration() || !entry.key()->isSymbol());
-        if (entry.key()->isSymbol()) {
+        ASSERT(!isQuickPropertyAccessAllowedForEnumeration() || !uidIsSymbol(entry.key()));
+        if (uidIsSymbol(entry.key())) {
             foundSymbol = true;
             if (propertyNames.propertyNameMode() != PropertyNameMode::Symbols)
                 return IterationStatus::Continue;
@@ -1440,7 +1440,7 @@ void Structure::getPropertyNamesFromStructure(VM& vm, PropertyNameArrayBuilder&
         // To ensure the order defined in the spec, we append symbols at the last elements of keys.
         // https://tc39.es/ecma262/#sec-ordinaryownpropertykeys
         table->forEachProperty([&](const auto& entry) {
-            if (entry.key()->isSymbol())
+            if (uidIsSymbol(entry.key()))
                 checkDontEnumAndAdd(entry);
             return IterationStatus::Continue;
         });
diff --git a/Source/JavaScriptCore/runtime/SymbolTable.h b/Source/JavaScriptCore/runtime/SymbolTable.h
index 8a341e32f8a73..f35ef1cac27c7 100644
--- a/Source/JavaScriptCore/runtime/SymbolTable.h
+++ b/Source/JavaScriptCore/runtime/SymbolTable.h
@@ -590,6 +590,15 @@ class SymbolTable final : public JSCell {
         return makeIteratorRange(rareData.m_privateNames.begin(), rareData.m_privateNames.end());
     }
 
+#if USE(BUN_JSC_ADDITIONS)
+    void addPrivateName(UniquedStringImpl* key, PrivateNameEntry value)
+    {
+        ASSERT(key && !uidIsSymbol(key));
+        auto& rareData = ensureRareData();
+        ASSERT(rareData.m_privateNames.find(key) == rareData.m_privateNames.end());
+        rareData.m_privateNames.add(FiberAwareRefPtr(key), value);
+    }
+#else
     void addPrivateName(const RefPtr<UniquedStringImpl>& key, PrivateNameEntry value)
     {
         ASSERT(key && !key->isSymbol());
@@ -597,13 +606,23 @@ class SymbolTable final : public JSCell {
         ASSERT(rareData.m_privateNames.find(key) == rareData.m_privateNames.end());
         rareData.m_privateNames.add(key, value);
     }
+#endif
 
+#if USE(BUN_JSC_ADDITIONS)
+    bool hasPrivateName(const FiberAwareRefPtr& key) const
+    {
+        if (auto* rareData = m_rareData.get())
+            return rareData->m_privateNames.contains(key);
+        return false;
+    }
+#else
     bool hasPrivateName(const RefPtr<UniquedStringImpl>& key) const
     {
         if (auto* rareData = m_rareData.get())
             return rareData->m_privateNames.contains(key);
         return false;
     }
+#endif
 
     template<typename Entry>
     void set(const ConcurrentJSLocker&, UniquedStringImpl* key, Entry&& entry)

From c3dce68a925e0ca17c023d513fc435b63d19a5c7 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 04:35:20 +0000
Subject: [PATCH 40/69] InlinePropertyKey bugfix follow-ups: endSwitch
 StringOffsetTable fiber materialize, printableName(UniquedStringImpl*) +
 FiberAwareRefPtr star-iter, objectConstructorEntries cachedKey
 inlineFiberWord compare, PropertyTable findImpl implSide null-check,
 getCalculatedDisplayName off-mutator fiber decode

---
 .../bytecompiler/BytecodeGenerator.cpp        | 16 +++++++++++++
 .../runtime/AbstractModuleRecord.cpp          | 23 ++++++++++++-------
 Source/JavaScriptCore/runtime/JSFunction.cpp  | 15 ++++++++++++
 .../runtime/ObjectConstructor.cpp             |  9 ++++++++
 Source/JavaScriptCore/runtime/PropertyTable.h |  2 +-
 5 files changed, 56 insertions(+), 9 deletions(-)

diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 60c3ab1c478e5..996c0ed63ab30 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -4528,6 +4528,21 @@ void BytecodeGenerator::endSwitch(const Vector<Ref<Label>, 8>& labels, Expressio
             ASSERT(!labels[i]->isForward());
 
             ASSERT(nodes[i]->isString());
+#if USE(BUN_JSC_ADDITIONS)
+            // StringOffsetTable is RefPtr<StringImpl>-keyed and the runtime lookup
+            // compares real StringImpl*, so materialize the fiber word here instead
+            // of letting a tagged pointer reach DefaultRefDerefTraits::refIfNotNull.
+            const Identifier& caseIdent = static_cast<StringNode*>(nodes[i])->value();
+            UniquedStringImpl* clause = caseIdent.string().impl();
+            ASSERT(!isInlinePropertyKey(clause));
+            ASSERT(clause->isAtom());
+            auto result = jumpTable.m_offsetTable.add(clause, UnlinkedStringJumpTable::OffsetLocation { labels[i]->bind(switchInfo.bytecodeOffset), 0 });
+            if (result.isNewEntry) {
+                result.iterator->value.m_indexInTable = jumpTable.m_offsetTable.size() - 1;
+                jumpTable.m_minLength = std::min(jumpTable.m_minLength, clause->length());
+                jumpTable.m_maxLength = std::max(jumpTable.m_maxLength, clause->length());
+            }
+#else
             UniquedStringImpl* clause = static_cast<StringNode*>(nodes[i])->value().impl();
             ASSERT(clause->isAtom());
             auto result = jumpTable.m_offsetTable.add(clause, UnlinkedStringJumpTable::OffsetLocation { labels[i]->bind(switchInfo.bytecodeOffset), 0 });
@@ -4536,6 +4551,7 @@ void BytecodeGenerator::endSwitch(const Vector<Ref<Label>, 8>& labels, Expressio
                 jumpTable.m_minLength = std::min(jumpTable.m_minLength, clause->length());
                 jumpTable.m_maxLength = std::max(jumpTable.m_maxLength, clause->length());
             }
+#endif
         }
         ASSERT(!defaultLabel.isForward());
         jumpTable.m_defaultOffset = defaultLabel.bind(switchInfo.bytecodeOffset);
diff --git a/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp b/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
index 7bf9ecef18b4f..7c992f600ff52 100644
--- a/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
+++ b/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
@@ -640,7 +640,11 @@ auto AbstractModuleRecord::resolveExportImpl(JSGlobalObject* globalObject, const
 
         // Enqueue the tasks in reverse order.
         for (auto iterator = query.moduleRecord->starExportEntries().rbegin(), end = query.moduleRecord->starExportEntries().rend(); iterator != end; ++iterator) {
+#if USE(BUN_JSC_ADDITIONS)
+            const FiberAwareRefPtr& starModuleName = *iterator;
+#else
             const RefPtr<UniquedStringImpl>& starModuleName = *iterator;
+#endif
             AbstractModuleRecord* importedModuleRecord = query.moduleRecord->hostResolveImportedModule(globalObject, Identifier::fromUid(vm, starModuleName.get()));
             RETURN_IF_EXCEPTION(scope, false);
             pendingTasks.append(Task { ResolveQuery(importedModuleRecord, query.exportName.get()), Type::Query });
@@ -1499,11 +1503,11 @@ unsigned AbstractModuleRecord::innerModuleLinking(JSGlobalObject* globalObject,
     return index;
 }
 
-static String printableName(const RefPtr<UniquedStringImpl>& uid)
-{
 #if USE(BUN_JSC_ADDITIONS)
-    if (isInlinePropertyKey(uid.get())) {
-        uintptr_t word = reinterpret_cast<uintptr_t>(uid.get());
+static String printableName(UniquedStringImpl* uid)
+{
+    if (isInlinePropertyKey(uid)) {
+        uintptr_t word = reinterpret_cast<uintptr_t>(uid);
         unsigned len = inlinePropertyKeyLength(word);
         const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
         if (inlinePropertyKeyIs8Bit(word))
@@ -1511,14 +1515,17 @@ static String printableName(const RefPtr<UniquedStringImpl>& uid)
         return WTF::makeString('\'', StringView(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len }), '\'');
     }
     if (uid->isSymbol())
-        return uid.get();
-    return WTF::makeString('\'', StringView(uid.get()), '\'');
+        return uid;
+    return WTF::makeString('\'', StringView(uid), '\'');
+}
 #else
+static String printableName(const RefPtr<UniquedStringImpl>& uid)
+{
     if (uid->isSymbol())
         return uid.get();
     return WTF::makeString('\'', StringView(uid.get()), '\'');
-#endif
 }
+#endif
 
 static String printableName(const Identifier& ident)
 {
@@ -1526,7 +1533,7 @@ static String printableName(const Identifier& ident)
     UniquedStringImpl* impl = ident.impl();
     if (isInlinePropertyKey(impl))
         return WTF::makeString('\'', ident.string(), '\'');
-    return printableName(RefPtr<UniquedStringImpl>(impl));
+    return printableName(impl);
 #else
     return printableName(ident.impl());
 #endif
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index 748edf4d59e28..331223b1a8806 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -475,7 +475,22 @@ String getCalculatedDisplayName(VM& vm, JSObject* object)
         if (!actualName.isEmpty() || function->isHostOrBuiltinFunction())
             return actualName;
 
+#if USE(BUN_JSC_ADDITIONS)
+        const Identifier& ecmaName = function->jsExecutable()->ecmaName();
+        if (UniquedStringImpl* uid = ecmaName.impl(); isInlinePropertyKey(uid)) {
+            // This runs off the mutator (see comment above) with no AtomStringTable, so build a
+            // plain String from the fiber payload instead of Identifier::string()'s AtomString(span).
+            uintptr_t word = inlinePropertyKeyWord(uid);
+            unsigned len = inlinePropertyKeyLength(word);
+            const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+            if (inlinePropertyKeyIs8Bit(word))
+                return String(std::span<const Latin1Character> { bytes + 1, len });
+            return String(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len });
+        }
+        return ecmaName.string();
+#else
         return function->jsExecutable()->ecmaName().string();
+#endif
     }
     if (auto* function = dynamicDowncast<InternalFunction>(object))
         return function->name();
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index 2351d9f3e2f93..16411b934a926 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -500,8 +500,17 @@ JSC_DEFINE_HOST_FUNCTION(objectConstructorEntries, (JSGlobalObject* globalObject
                 JSString* key = nullptr;
                 if (cachedButterfly) {
                     auto* cachedKey = asString(cachedButterfly->get(i));
+#if USE(BUN_JSC_ADDITIONS)
+                    UniquedStringImpl* uid = properties[i].get();
+                    bool hit = isInlinePropertyKey(uid)
+                        ? (cachedKey->isInline() && cachedKey->inlineFiberWord() == inlinePropertyKeyWord(uid))
+                        : (cachedKey->tryGetValueImpl() == uid);
+                    if (hit)
+                        key = cachedKey;
+#else
                     if (cachedKey->tryGetValueImpl() == properties[i].get())
                         key = cachedKey;
+#endif
                 }
 
                 if (!key) {
diff --git a/Source/JavaScriptCore/runtime/PropertyTable.h b/Source/JavaScriptCore/runtime/PropertyTable.h
index f1473a05a2b1d..1b195f5ef1e42 100644
--- a/Source/JavaScriptCore/runtime/PropertyTable.h
+++ b/Source/JavaScriptCore/runtime/PropertyTable.h
@@ -331,7 +331,7 @@ PropertyTable::FindResult PropertyTable::findImpl(const Index* indexVector, cons
             if (keyIsFiber != entryIsFiber) [[unlikely]] {
                 const UniquedStringImpl* implSide = keyIsFiber ? entryKey : key;
                 uintptr_t fiberWord = inlinePropertyKeyWord(keyIsFiber ? key : entryKey);
-                if (!implSide->isSymbol() && inlinePropertyKeyIs8Bit(fiberWord)
+                if (implSide && !implSide->isSymbol() && inlinePropertyKeyIs8Bit(fiberWord)
                     && WTF::equal(implSide, inlinePropertyKeySpan8(fiberWord))) {
                     ASSERT(!m_deletedOffsets || !m_deletedOffsets->contains(entry.offset()));
                     return FindResult { entryIndex, index, entry.offset(), entry.attributes() };

From 68736a5355e3bc7114b281dc04c5dc8cc0ae6eaa Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 04:58:05 +0000
Subject: [PATCH 41/69] =?UTF-8?q?InlinePropertyKey=20bugfix:=20identifierT?=
 =?UTF-8?q?oStringWithoutAtomizing()=20helper=20=E2=80=94=20route=20JSFunc?=
 =?UTF-8?q?tion::nameWithoutGC/getCalculatedDisplayName=20+=20StackFrame::?=
 =?UTF-8?q?functionName=20ecmaName().impl()=20through=20fiber-word=20decod?=
 =?UTF-8?q?e=20(off-mutator=20AtomStringTable=3Dnull=20safe)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Source/JavaScriptCore/runtime/JSFunction.cpp | 46 +++++++++++++++-----
 Source/JavaScriptCore/runtime/StackFrame.cpp | 19 +++++++-
 2 files changed, 52 insertions(+), 13 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index 331223b1a8806..fef2b3005a144 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -186,6 +186,30 @@ FunctionRareData* JSFunction::initializeRareData(JSGlobalObject* globalObject, s
     return rareData;
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+// Heap::runEndPhase nulls the thread AtomStringTable around finalizers, and
+// ErrorInstance::finalizeUnconditionally builds stack traces there. For
+// fiber-word Identifiers, Identifier::string() would materialize via
+// AtomString(span) -> AtomStringImpl::add -> null table crash. Decode the
+// payload to a plain String (heap copy, no atom table) instead.
+static ALWAYS_INLINE String identifierToStringWithoutAtomizing(const Identifier& ident)
+{
+    UniquedStringImpl* uid = ident.impl();
+    if (!uid)
+        return String();
+    if (isInlinePropertyKey(uid)) {
+        uintptr_t word = inlinePropertyKeyWord(uid);
+        unsigned len = inlinePropertyKeyLength(word);
+        const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+        if (inlinePropertyKeyIs8Bit(word))
+            return String(std::span<const Latin1Character> { bytes + 1, len });
+        return String(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len });
+    }
+    // Real UniquedStringImpl*: wrap directly, no atom-table lookup.
+    return String(static_cast<StringImpl*>(uid));
+}
+#endif
+
 String JSFunction::name(VM& vm)
 {
     if (isHostFunction()) {
@@ -209,10 +233,17 @@ String JSFunction::nameWithoutGC(VM& vm)
         NativeExecutable* executable = uncheckedDowncast<NativeExecutable>(this->executable());
         return executable->name();
     }
+#if USE(BUN_JSC_ADDITIONS)
+    const Identifier& identifier = jsExecutable()->name();
+    if (identifier == vm.propertyNames->starDefaultPrivateName)
+        return emptyString();
+    return identifierToStringWithoutAtomizing(identifier);
+#else
     const Identifier identifier = jsExecutable()->name();
     if (identifier == vm.propertyNames->starDefaultPrivateName)
         return emptyString();
     return identifier.string();
+#endif
 }
 
 String JSFunction::displayName(VM& vm)
@@ -476,18 +507,9 @@ String getCalculatedDisplayName(VM& vm, JSObject* object)
             return actualName;
 
 #if USE(BUN_JSC_ADDITIONS)
-        const Identifier& ecmaName = function->jsExecutable()->ecmaName();
-        if (UniquedStringImpl* uid = ecmaName.impl(); isInlinePropertyKey(uid)) {
-            // This runs off the mutator (see comment above) with no AtomStringTable, so build a
-            // plain String from the fiber payload instead of Identifier::string()'s AtomString(span).
-            uintptr_t word = inlinePropertyKeyWord(uid);
-            unsigned len = inlinePropertyKeyLength(word);
-            const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
-            if (inlinePropertyKeyIs8Bit(word))
-                return String(std::span<const Latin1Character> { bytes + 1, len });
-            return String(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len });
-        }
-        return ecmaName.string();
+        // Runs off the mutator (see comment above) with the AtomStringTable nulled
+        // by Heap::runEndPhase; avoid Identifier::string()'s AtomString(span) path.
+        return identifierToStringWithoutAtomizing(function->jsExecutable()->ecmaName());
 #else
         return function->jsExecutable()->ecmaName().string();
 #endif
diff --git a/Source/JavaScriptCore/runtime/StackFrame.cpp b/Source/JavaScriptCore/runtime/StackFrame.cpp
index c066acca95a27..d1990db85b035 100644
--- a/Source/JavaScriptCore/runtime/StackFrame.cpp
+++ b/Source/JavaScriptCore/runtime/StackFrame.cpp
@@ -222,8 +222,25 @@ String StackFrame::functionName(VM& vm) const
             if (jsFrame.callee && jsFrame.callee->isObject())
                 name = getCalculatedDisplayName(vm, uncheckedDowncast<JSObject>(jsFrame.callee.get())).impl();
             else if (jsFrame.codeBlock) {
-                if (auto* executable = dynamicDowncast<FunctionExecutable>(jsFrame.codeBlock->ownerExecutable()))
+                if (auto* executable = dynamicDowncast<FunctionExecutable>(jsFrame.codeBlock->ownerExecutable())) {
+#if USE(BUN_JSC_ADDITIONS)
+                    // ecmaName().impl() may be a fiber-word-tagged pointer; decode
+                    // instead of letting String(StringImpl*) ref() a non-pointer.
+                    UniquedStringImpl* uid = executable->ecmaName().impl();
+                    if (isInlinePropertyKey(uid)) {
+                        uintptr_t word = inlinePropertyKeyWord(uid);
+                        unsigned len = inlinePropertyKeyLength(word);
+                        const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+                        if (inlinePropertyKeyIs8Bit(word))
+                            name = String(std::span<const Latin1Character> { bytes + 1, len });
+                        else
+                            name = String(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len });
+                    } else
+                        name = uid;
+#else
                     name = executable->ecmaName().impl();
+#endif
+                }
             }
 
             if (name.isNull())

From 07c86b2142c88e9ac6b10d4b8776beacfa4cae61 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 05:50:32 +0000
Subject: [PATCH 42/69] =?UTF-8?q?InlinePropertyKey=20bugfix:=20D.4=20seenP?=
 =?UTF-8?q?roperties-bloom=20coherence=20at=20getByVal=20ops=20(canonicalF?=
 =?UTF-8?q?iberWordFor=20in=20JIT/DFG=20operationGetByVal*),=20JSPropertyN?=
 =?UTF-8?q?ameEnumerator=20createInlineFromFiber,=20AssemblyHelpers=20Mega?=
 =?UTF-8?q?morphicCache=20uid->hash()=E2=86=92uidHash=20guard?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Source/JavaScriptCore/dfg/DFGOperations.cpp   | 10 +++++
 Source/JavaScriptCore/jit/AssemblyHelpers.cpp | 12 +++++
 Source/JavaScriptCore/jit/JITOperations.cpp   | 44 +++++++++++++++++++
 .../runtime/JSPropertyNameEnumerator.cpp      | 11 +++++
 4 files changed, 77 insertions(+)

diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index ea08b4853ef95..ceee358a79525 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -925,7 +925,17 @@ JSC_DEFINE_JIT_OPERATION(operationGetByValObjectString, EncodedJSValue, (JSGloba
     auto propertyName = asString(string)->toAtomString(globalObject);
     OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());
 
+#if USE(BUN_JSC_ADDITIONS)
+    // D.4 coherence: Structure::get()'s m_seenProperties bloom filter and
+    // PropertyTable are keyed by the canonical fiber word for 2..5-char
+    // Latin-1 names, so look up with that — not the raw AtomStringImpl*.
+    UniquedStringImpl* uid = propertyName.data;
+    if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+        uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+    OPERATION_RETURN(scope, JSValue::encode(getByValObject(globalObject, vm, asObject(base), uid)));
+#else
     OPERATION_RETURN(scope, JSValue::encode(getByValObject(globalObject, vm, asObject(base), propertyName.data)));
+#endif
 }
 
 JSC_DEFINE_JIT_OPERATION(operationGetByValObjectSymbol, EncodedJSValue, (JSGlobalObject* globalObject, JSCell* base, JSCell* symbol))
diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
index 9e057d6cf7376..cc713434456c7 100644
--- a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
@@ -509,7 +509,11 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadMegamorphicProperty(VM& vm, GPRRe
     xor32(scratch2GPR, scratch3GPR);
 #endif
     if (uid)
+#if USE(BUN_JSC_ADDITIONS)
+        add32(TrustedImm32(uidHash(uid)), scratch3GPR);
+#else
         add32(TrustedImm32(uid->hash()), scratch3GPR);
+#endif
     else {
         // Note that we don't test if the hash is zero here. AtomStringImpl's can't have a zero
         // hash, however, a SymbolImpl may. But, because this is a cache, we don't care. We only
@@ -615,7 +619,11 @@ std::tuple<AssemblyHelpers::JumpList, AssemblyHelpers::JumpList> AssemblyHelpers
 #endif
 
     if (uid)
+#if USE(BUN_JSC_ADDITIONS)
+        add32(TrustedImm32(uidHash(uid)), scratch3GPR);
+#else
         add32(TrustedImm32(uid->hash()), scratch3GPR);
+#endif
     else {
         // Note that we don't test if the hash is zero here. AtomStringImpl's can't have a zero
         // hash, however, a SymbolImpl may. But, because this is a cache, we don't care. We only
@@ -719,7 +727,11 @@ AssemblyHelpers::JumpList AssemblyHelpers::hasMegamorphicProperty(VM& vm, GPRReg
     xor32(scratch2GPR, scratch3GPR);
 #endif
     if (uid)
+#if USE(BUN_JSC_ADDITIONS)
+        add32(TrustedImm32(uidHash(uid)), scratch3GPR);
+#else
         add32(TrustedImm32(uid->hash()), scratch3GPR);
+#endif
     else {
         // Note that we don't test if the hash is zero here. AtomStringImpl's can't have a zero
         // hash, however, a SymbolImpl may. But, because this is a cache, we don't care. We only
diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
index d00f0892dd03f..3943361f7ee1b 100644
--- a/Source/JavaScriptCore/jit/JITOperations.cpp
+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
@@ -3607,7 +3607,29 @@ ALWAYS_INLINE static JSValue getByVal(JSGlobalObject* globalObject, CallFrame* c
     if (subscript.isString()) {
         auto propertyName = asString(subscript)->toAtomString(globalObject);
         RETURN_IF_EXCEPTION(scope, JSValue());
+#if USE(BUN_JSC_ADDITIONS)
+        // D.4 coherence: Structure::get()'s m_seenProperties bloom filter and
+        // PropertyTable are keyed by the canonical fiber word for 2..5-char
+        // Latin-1 names, so look up with that — not the raw AtomStringImpl*.
+        UniquedStringImpl* uid = propertyName.data;
+        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+            uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+
+        if (baseValue.isCell()) [[likely]] {
+            Structure& structure = *baseValue.asCell()->structure();
+            if (JSCell::canUseFastGetOwnProperty(structure)) {
+                if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, uid)) {
+                    ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0));
+                    return result;
+                }
+            }
+
+            RELEASE_AND_RETURN(scope, baseValue.get(globalObject, uid));
+        }
 
+        ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0));
+        RELEASE_AND_RETURN(scope, baseValue.get(globalObject, uid));
+#else
         if (baseValue.isCell()) [[likely]] {
             Structure& structure = *baseValue.asCell()->structure();
             if (JSCell::canUseFastGetOwnProperty(structure)) {
@@ -3622,6 +3644,7 @@ ALWAYS_INLINE static JSValue getByVal(JSGlobalObject* globalObject, CallFrame* c
 
         ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0));
         RELEASE_AND_RETURN(scope, baseValue.get(globalObject, propertyName.data));
+#endif
     } else if (std::optional<uint32_t> index = subscript.tryGetAsUint32Index()) {
         uint32_t i = *index;
         if (isJSString(baseValue)) {
@@ -3755,7 +3778,27 @@ ALWAYS_INLINE static JSValue getByValWithThis(JSGlobalObject* globalObject, Call
     if (subscript.isString()) {
         auto propertyName = asString(subscript)->toAtomString(globalObject);
         RETURN_IF_EXCEPTION(scope, { });
+#if USE(BUN_JSC_ADDITIONS)
+        // D.4 coherence: Structure::get()'s m_seenProperties bloom filter and
+        // PropertyTable are keyed by the canonical fiber word for 2..5-char
+        // Latin-1 names, so look up with that — not the raw AtomStringImpl*.
+        UniquedStringImpl* uid = propertyName.data;
+        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+            uid = reinterpret_cast<UniquedStringImpl*>(fiber);
 
+        if (baseValue.isCell()) [[likely]] {
+            Structure& structure = *baseValue.asCell()->structure();
+            if (JSCell::canUseFastGetOwnProperty(structure)) {
+                if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, uid)) {
+                    ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0));
+                    return result;
+                }
+            }
+        }
+
+        ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0));
+        RELEASE_AND_RETURN(scope, baseValue.get(globalObject, uid, slot));
+#else
         if (baseValue.isCell()) [[likely]] {
             Structure& structure = *baseValue.asCell()->structure();
             if (JSCell::canUseFastGetOwnProperty(structure)) {
@@ -3768,6 +3811,7 @@ ALWAYS_INLINE static JSValue getByValWithThis(JSGlobalObject* globalObject, Call
 
         ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0));
         RELEASE_AND_RETURN(scope, baseValue.get(globalObject, propertyName.data, slot));
+#endif
     } else if (std::optional<uint32_t> index = subscript.tryGetAsUint32Index()) {
         uint32_t i = *index;
         if (isJSString(baseValue)) {
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
index 5f95ef542ee0a..212d029788c9a 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
@@ -81,7 +81,18 @@ void JSPropertyNameEnumerator::finishCreation(VM& vm, RefPtr<PropertyNameArray>&
     ASSERT(m_endGenericPropertyIndex == vector.size());
     for (unsigned i = 0; i < vector.size(); ++i) {
         const Identifier& identifier = vector[i];
+#if USE(BUN_JSC_ADDITIONS)
+        // Produce an inline JSString straight from the fiber word so the
+        // baseline op_enumerator_get_by_val generic-IC key compares against
+        // fiber-word-keyed structures / handler m_uid match.
+        UniquedStringImpl* uid = identifier.impl();
+        JSString* str = isInlinePropertyKey(uid)
+            ? JSString::createInlineFromFiber(vm, inlinePropertyKeyWord(uid))
+            : jsString(vm, identifier.string());
+        m_propertyNames.get()[i].set(vm, this, str);
+#else
         m_propertyNames.get()[i].set(vm, this, jsString(vm, identifier.string()));
+#endif
     }
 }
 

From 854c31a63a5643aac3eab86f4b7c01f1feef6bb1 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 07:17:34 +0000
Subject: [PATCH 43/69] InlinePropertyKey bugfix: AssemblyHelpers
 MegamorphicCache keep uid->hash() (not existingSymbolAwareHash) for JIT sync;
 revert JSPropertyNameEnumerator createInlineFromFiber (identifier.string()
 materialize is correct)

---
 Source/JavaScriptCore/jit/AssemblyHelpers.cpp         |  6 +++---
 .../runtime/JSPropertyNameEnumerator.cpp              | 11 -----------
 2 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
index cc713434456c7..027abe47ba2d4 100644
--- a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
@@ -510,7 +510,7 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadMegamorphicProperty(VM& vm, GPRRe
 #endif
     if (uid)
 #if USE(BUN_JSC_ADDITIONS)
-        add32(TrustedImm32(uidHash(uid)), scratch3GPR);
+        add32(TrustedImm32(isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash()), scratch3GPR);
 #else
         add32(TrustedImm32(uid->hash()), scratch3GPR);
 #endif
@@ -620,7 +620,7 @@ std::tuple<AssemblyHelpers::JumpList, AssemblyHelpers::JumpList> AssemblyHelpers
 
     if (uid)
 #if USE(BUN_JSC_ADDITIONS)
-        add32(TrustedImm32(uidHash(uid)), scratch3GPR);
+        add32(TrustedImm32(isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash()), scratch3GPR);
 #else
         add32(TrustedImm32(uid->hash()), scratch3GPR);
 #endif
@@ -728,7 +728,7 @@ AssemblyHelpers::JumpList AssemblyHelpers::hasMegamorphicProperty(VM& vm, GPRReg
 #endif
     if (uid)
 #if USE(BUN_JSC_ADDITIONS)
-        add32(TrustedImm32(uidHash(uid)), scratch3GPR);
+        add32(TrustedImm32(isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash()), scratch3GPR);
 #else
         add32(TrustedImm32(uid->hash()), scratch3GPR);
 #endif
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
index 212d029788c9a..5f95ef542ee0a 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
@@ -81,18 +81,7 @@ void JSPropertyNameEnumerator::finishCreation(VM& vm, RefPtr<PropertyNameArray>&
     ASSERT(m_endGenericPropertyIndex == vector.size());
     for (unsigned i = 0; i < vector.size(); ++i) {
         const Identifier& identifier = vector[i];
-#if USE(BUN_JSC_ADDITIONS)
-        // Produce an inline JSString straight from the fiber word so the
-        // baseline op_enumerator_get_by_val generic-IC key compares against
-        // fiber-word-keyed structures / handler m_uid match.
-        UniquedStringImpl* uid = identifier.impl();
-        JSString* str = isInlinePropertyKey(uid)
-            ? JSString::createInlineFromFiber(vm, inlinePropertyKeyWord(uid))
-            : jsString(vm, identifier.string());
-        m_propertyNames.get()[i].set(vm, this, str);
-#else
         m_propertyNames.get()[i].set(vm, this, jsString(vm, identifier.string()));
-#endif
     }
 }
 

From 601ccbcec0252edfa10eb4b7e21758c3293549d4 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 07:26:46 +0000
Subject: [PATCH 44/69] InlinePropertyKey D.6: JSModuleNamespaceObject
 ExportMap FiberAwareRefPtr + sort-comparator StringView via
 Identifier::string() (bun module-namespace 'then' lookup crash)

---
 Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp | 4 ++++
 Source/JavaScriptCore/runtime/JSModuleNamespaceObject.h   | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
index 18c7e9afd5e31..75de3b25dd8fc 100644
--- a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
@@ -49,7 +49,11 @@ JSModuleNamespaceObject::JSModuleNamespaceObject(VM& vm, Structure* structure, A
     //
     // Sort the exported names by the code point order.
     std::ranges::sort(resolutions, WTF::codePointCompareLessThan, [](const auto& resolution) {
+#if USE(BUN_JSC_ADDITIONS)
+        return StringView(resolution.first.string());
+#else
         return StringView(resolution.first.impl());
+#endif
     });
 
     for (const auto& pair : resolutions) {
diff --git a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.h b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.h
index 9e3e15b746a75..7434faa4a825c 100644
--- a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.h
+++ b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.h
@@ -90,7 +90,11 @@ class JSModuleNamespaceObject final : public JSNonFinalObject {
         WriteBarrier<AbstractModuleRecord> moduleRecord;
     };
 
+#if USE(BUN_JSC_ADDITIONS)
+    using ExportMap = OrderedHashMap<FiberAwareRefPtr, ExportEntry, IdentifierRepHash, HashTraits<FiberAwareRefPtr>>;
+#else
     using ExportMap = OrderedHashMap<RefPtr<UniquedStringImpl>, ExportEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>>;
+#endif
 
     ExportMap m_exports;
     WriteBarrier<AbstractModuleRecord> m_moduleRecord;

From 019e862bd4dc7ffa9733f26fe258e079f4f4ce81 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:18:38 +0000
Subject: [PATCH 45/69] InlinePropertyKey D.6 bugfix: LiteralParser
 equalIdentifier fiber-word decode + JSWebAssemblyModule exportSymbolTable key
 via Identifier::fromString (json-parse-inspector SEGV, tsf-wasm
 RELEASE_ASSERT putResult)

---
 .../JavaScriptCore/runtime/LiteralParser.cpp  | 34 +++++++++++++++++++
 .../wasm/js/JSWebAssemblyModule.cpp           |  8 +++++
 2 files changed, 42 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/LiteralParser.cpp b/Source/JavaScriptCore/runtime/LiteralParser.cpp
index 8ead0c30b1c9f..231f09d15df1d 100644
--- a/Source/JavaScriptCore/runtime/LiteralParser.cpp
+++ b/Source/JavaScriptCore/runtime/LiteralParser.cpp
@@ -149,6 +149,40 @@ bool LiteralParser<CharType, reviverMode>::tryJSONPParse(Vector<JSONPData>& resu
 template<typename CharType, JSONReviverMode reviverMode>
 ALWAYS_INLINE bool LiteralParser<CharType, reviverMode>::equalIdentifier(UniquedStringImpl* rep, typename Lexer::LiteralParserTokenPtr token)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    // Structure::transitionPropertyName() may hand us a fiber-word-tagged
+    // UniquedStringImpl* (2..5-char Latin-1 keys). Decode and compare spans
+    // instead of dereferencing.
+    if (isInlinePropertyKey(rep)) {
+        uintptr_t word = reinterpret_cast<uintptr_t>(rep);
+        unsigned len = inlinePropertyKeyLength(word);
+        const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+        auto equalSpan = [&](auto tokenSpan) ALWAYS_INLINE_LAMBDA -> bool {
+            if (tokenSpan.size() != len)
+                return false;
+            if (inlinePropertyKeyIs8Bit(word)) {
+                const Latin1Character* chars = bytes + 1;
+                for (unsigned i = 0; i < len; ++i) {
+                    if (static_cast<char16_t>(chars[i]) != static_cast<char16_t>(tokenSpan[i]))
+                        return false;
+                }
+            } else {
+                const char16_t* chars = reinterpret_cast<const char16_t*>(bytes + 2);
+                for (unsigned i = 0; i < len; ++i) {
+                    if (chars[i] != static_cast<char16_t>(tokenSpan[i]))
+                        return false;
+                }
+            }
+            return true;
+        };
+        if (token->type == TokIdentifier)
+            return equalSpan(token->identifier());
+        ASSERT(token->type == TokString);
+        if (token->stringIs8Bit)
+            return equalSpan(token->string8());
+        return equalSpan(token->string16());
+    }
+#endif
     // In the literal parser, we don't want to follow property addition transitions if the property name is a symbol.
     if (rep->isSymbol())
         return false;
diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp b/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp
index b583635ea763d..1c178d3e2a618 100644
--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp
+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp
@@ -76,7 +76,15 @@ void JSWebAssemblyModule::finishCreation(VM& vm)
     }
     for (auto& exp : moduleInformation.exports) {
         auto offset = exportSymbolTable->takeNextScopeOffset(NoLockingNecessary);
+#if USE(BUN_JSC_ADDITIONS)
+        // D.4 coherence: WebAssemblyModuleRecord::initializeExports() looks these
+        // up via Identifier::fromString() which yields a fiber word for 2..5-char
+        // names; key the table with the same canonical representation so the
+        // pointer-identity compare in SymbolTable::Map hits.
+        exportSymbolTable->set(NoLockingNecessary, Identifier::fromString(vm, makeAtomString(exp.field)).impl(), SymbolTableEntry(VarOffset(offset)));
+#else
         exportSymbolTable->set(NoLockingNecessary, makeAtomString(exp.field).impl(), SymbolTableEntry(VarOffset(offset)));
+#endif
     }
 
     m_exportSymbolTable.set(vm, this, exportSymbolTable);

From e73f760b7e93c77bc249d67e5fc3756b6fc0f3b6 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:29:40 +0000
Subject: [PATCH 46/69] InlinePropertyKey D.6 bugfix: JSSymbolTableObject
 getOwnSpecialPropertyNames uidIsSymbol guard (Object.getOwnPropertyNames on
 SymbolTable scope w/ fiber-word key SIGSEGV; hits verdaccio startup)

---
 Source/JavaScriptCore/runtime/JSSymbolTableObject.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/JSSymbolTableObject.cpp b/Source/JavaScriptCore/runtime/JSSymbolTableObject.cpp
index cb151b9d79a81..8505e41eeeb11 100644
--- a/Source/JavaScriptCore/runtime/JSSymbolTableObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSSymbolTableObject.cpp
@@ -66,8 +66,13 @@ void JSSymbolTableObject::getOwnSpecialPropertyNames(JSObject* object, JSGlobalO
         SymbolTable::Map::iterator end = symbolTable->end(locker);
         for (SymbolTable::Map::iterator it = symbolTable->begin(locker); it != end; ++it) {
             if (mode == DontEnumPropertiesMode::Include || !it->value.isDontEnum()) {
+#if USE(BUN_JSC_ADDITIONS)
+                if (!propertyNames.includeSymbolProperties() && uidIsSymbol(it->key.get()))
+                    continue;
+#else
                 if (!propertyNames.includeSymbolProperties() && it->key->isSymbol())
                     continue;
+#endif
                 if (propertyNames.privateSymbolMode() == PrivateSymbolMode::Exclude && symbolTable->hasPrivateName(it->key))
                     continue;
                 propertyNames.add(Identifier::fromUid(vm, it->key.get()));

From 55b775a1ee44bcc25577ad51c00f2447114235ae Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:29:44 +0000
Subject: [PATCH 47/69] InlinePropertyKey D.6 bugfix: JSPropertyNameEnumerator
 computeNext canonicalFiberWordFor before hasEnumerableProperty (for-in
 GenericMode skips fiber-word keys when a Symbol is on the object;
 seenProperties bloom keyed on fiber)

---
 .../runtime/JSPropertyNameEnumerator.cpp          | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
index 5f95ef542ee0a..8c274e5ef11bd 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
@@ -27,6 +27,10 @@
 #include "JSPropertyNameEnumerator.h"
 
 #include "JSObjectInlines.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "IdentifierInlines.h"
+#include "InlinePropertyKey.h"
+#endif
 
 WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
 
@@ -204,8 +208,19 @@ JSString* JSPropertyNameEnumerator::computeNext(JSGlobalObject* globalObject, JS
                 break;
             auto id = name->toAtomString(globalObject);
             RETURN_IF_EXCEPTION(scope, nullptr);
+#if USE(BUN_JSC_ADDITIONS)
+            // D.4 coherence: id.data is an AtomStringImpl*; Structure::get's
+            // seenProperties bloom filter was keyed on the canonical fiber word
+            // at add() time, so re-encode here or the bloom filter rules us out.
+            UniquedStringImpl* uid = id.data;
+            if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+                uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+            if (base->hasEnumerableProperty(globalObject, uid))
+                break;
+#else
             if (base->hasEnumerableProperty(globalObject, id.data))
                 break;
+#endif
             RETURN_IF_EXCEPTION(scope, nullptr);
             name = nullptr;
             index++;

From 81ae88fe879c8f886226957a6b4b6b3636379ed8 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:33:02 +0000
Subject: [PATCH 48/69] =?UTF-8?q?InlinePropertyKey=20D.6=20bugfix:=20Prope?=
 =?UTF-8?q?rtyName=20publicName()=20materialize=20fiber-word=20atom=20(ver?=
 =?UTF-8?q?daccio=20require.extensions['.hbs']=20SEGV=20=E2=86=92=20bun-wo?=
 =?UTF-8?q?rkspaces=20ConnectionRefused)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Source/JavaScriptCore/runtime/PropertyName.h | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/PropertyName.h b/Source/JavaScriptCore/runtime/PropertyName.h
index 695c824f68c53..b8c4c528bec1a 100644
--- a/Source/JavaScriptCore/runtime/PropertyName.h
+++ b/Source/JavaScriptCore/runtime/PropertyName.h
@@ -100,9 +100,21 @@ class PropertyName {
     AtomStringImpl* publicName() const
     {
 #if USE(BUN_JSC_ADDITIONS)
-        // A fiber-word key has no real AtomStringImpl*; callers needing the text
-        // must go through Identifier::string() which materializes on demand.
-        return (!m_impl || isInlinePropertyKey(m_impl) || m_impl->isSymbol()) ? nullptr : static_cast<AtomStringImpl*>(m_impl);
+        if (!m_impl)
+            return nullptr;
+        if (isInlinePropertyKey(m_impl)) [[unlikely]] {
+            // Callers (Bun bindings, Lookup.cpp, JSCustom*Function) assume
+            // "not symbol ⇒ non-null". Materialize the atom; the leaked ref
+            // just pins one interned 2..5-char string — pre-fiber behaviour.
+            uintptr_t w = reinterpret_cast<uintptr_t>(m_impl);
+            unsigned len = inlinePropertyKeyLength(w);
+            const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&w);
+            RefPtr<AtomStringImpl> atom = inlinePropertyKeyIs8Bit(w)
+                ? AtomStringImpl::add(std::span<const Latin1Character> { bytes + 1, len })
+                : AtomStringImpl::add(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len });
+            return atom.leakRef();
+        }
+        return m_impl->isSymbol() ? nullptr : static_cast<AtomStringImpl*>(m_impl);
 #else
         return (!m_impl || m_impl->isSymbol()) ? nullptr : static_cast<AtomStringImpl*>(m_impl);
 #endif

From 47803cd08f3b7d94fcb3030531266f8e7f0fc866 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:35:54 +0000
Subject: [PATCH 49/69] InlinePropertyKey D.6 bugfix: JSInjectedScriptHost
 private-member Vector FiberAwareRefPtr + sort via Identifier::string()

---
 .../inspector/JSInjectedScriptHost.cpp              | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp b/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
index ee1c95accc678..546bb847de0aa 100644
--- a/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
+++ b/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
@@ -38,6 +38,9 @@
 #include "HeapIterationScope.h"
 #include "HeapProfiler.h"
 #include "InjectedScriptHost.h"
+#if USE(BUN_JSC_ADDITIONS)
+#include "InlinePropertyKey.h"
+#endif
 #include "IterationKind.h"
 #include "IteratorOperations.h"
 #include "JSArray.h"
@@ -372,7 +375,11 @@ JSValue JSInjectedScriptHost::getOwnPrivatePropertyMethods(JSGlobalObject* globa
         if (!symbolTable)
             return;
 
+#if USE(BUN_JSC_ADDITIONS)
+        Vector<std::pair<FiberAwareRefPtr, PrivateNameEntry>> members;
+#else
         Vector<std::pair<RefPtr<UniquedStringImpl>, PrivateNameEntry>> members;
+#endif
         {
             ConcurrentJSLocker locker(symbolTable->m_lock);
             if (!symbolTable->hasPrivateNames())
@@ -386,9 +393,15 @@ JSValue JSInjectedScriptHost::getOwnPrivatePropertyMethods(JSGlobalObject* globa
             }
         }
 
+#if USE(BUN_JSC_ADDITIONS)
+        std::sort(members.begin(), members.end(), [&vm](const auto& a, const auto& b) {
+            return codePointCompareLessThan(StringView(Identifier::fromUid(vm, a.first.get()).string()), StringView(Identifier::fromUid(vm, b.first.get()).string()));
+        });
+#else
         std::sort(members.begin(), members.end(), [](const auto& a, const auto& b) {
             return codePointCompareLessThan(StringView(a.first.get()), StringView(b.first.get()));
         });
+#endif
 
         for (const auto& [name, entry] : members) {
             Identifier memberIdentifier = Identifier::fromUid(vm, name.get());

From 9e3f6466e01eb60aa4bcd0879d7e0e9b50211988 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 10:32:07 +0000
Subject: [PATCH 50/69] InlinePropertyKey D.6 bugfix:
 HeapSnapshotBuilder/BunV8HeapSnapshotBuilder edge-name fiber-word decode
 (writeHeapSnapshot + generateHeapSnapshotForDebugging SEGV on
 PropertyTable/SymbolTable key)

---
 .../heap/BunV8HeapSnapshotBuilder.cpp         | 23 +++++++++++++++++--
 .../heap/HeapSnapshotBuilder.cpp              | 15 ++++++++++++
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/Source/JavaScriptCore/heap/BunV8HeapSnapshotBuilder.cpp b/Source/JavaScriptCore/heap/BunV8HeapSnapshotBuilder.cpp
index ee6047858d8a6..db1d53553c717 100644
--- a/Source/JavaScriptCore/heap/BunV8HeapSnapshotBuilder.cpp
+++ b/Source/JavaScriptCore/heap/BunV8HeapSnapshotBuilder.cpp
@@ -22,11 +22,30 @@
 
 #include "DateInstance.h"
 #include "HeapSnapshotBuilder.h"
+#include "InlinePropertyKey.h"
 #include "RegExpObject.h"
 #include "HeapSnapshot.h"
 
 namespace JSC {
 
+// JSObject::analyzeHeap and JSLexicalEnvironment::analyzeHeap pass
+// PropertyTable/SymbolTable keys here; with InlinePropertyKey D.2 those may be
+// fiber-word-tagged pointers. This runs from Heap::didFinishCollection where
+// the thread AtomStringTable is nulled, so decode to a plain String (heap copy,
+// no atom-table lookup) rather than Identifier::string().
+static ALWAYS_INLINE String uidToStringWithoutAtomizing(UniquedStringImpl* uid)
+{
+    if (isInlinePropertyKey(uid)) [[unlikely]] {
+        uintptr_t word = inlinePropertyKeyWord(uid);
+        unsigned len = inlinePropertyKeyLength(word);
+        const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+        if (inlinePropertyKeyIs8Bit(word))
+            return String(std::span<const Latin1Character> { bytes + 1, len });
+        return String(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len });
+    }
+    return String(static_cast<StringImpl*>(uid));
+}
+
 WTF_MAKE_TZONE_ALLOCATED_IMPL(BunV8HeapSnapshotBuilder);
 
 BunV8HeapSnapshotBuilder::BunV8HeapSnapshotBuilder(HeapProfiler& profiler)
@@ -250,7 +269,7 @@ void BunV8HeapSnapshotBuilder::analyzePropertyNameEdge(JSCell* from, JSCell* to,
     edge.fromNodeId = getOrCreateNodeId(from);
     edge.toNodeId = getOrCreateNodeId(to);
     edge.typeIndex = static_cast<unsigned>(V8EdgeType::Property);
-    edge.name = WTF::String(propertyName);
+    edge.name = uidToStringWithoutAtomizing(propertyName);
     m_edges.append(WTF::move(edge));
 }
 
@@ -264,7 +283,7 @@ void BunV8HeapSnapshotBuilder::analyzeVariableNameEdge(JSCell* from, JSCell* to,
     edge.fromNodeId = getOrCreateNodeId(from);
     edge.toNodeId = getOrCreateNodeId(to);
     edge.typeIndex = static_cast<unsigned>(V8EdgeType::Context);
-    edge.name = String(variableName);
+    edge.name = uidToStringWithoutAtomizing(variableName);
 
     m_edges.append(WTF::move(edge));
 }
diff --git a/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp b/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp
index 4a4fd40af8850..65400a0539c25 100644
--- a/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp
+++ b/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp
@@ -583,7 +583,22 @@ void HeapSnapshotBuilder::dumpToStream(PrintStream& out)
         if (!firstEdgeName)
             out.print(',');
         firstEdgeName = false;
+#if USE(BUN_JSC_ADDITIONS)
+        // edge.name came from JSObject/JSLexicalEnvironment analyzeHeap and may
+        // hold a fiber-word-tagged uid; String(StringImpl*) would ref-deref it.
+        if (isInlinePropertyKey(edgeName)) [[unlikely]] {
+            uintptr_t word = inlinePropertyKeyWord(edgeName);
+            unsigned len = inlinePropertyKeyLength(word);
+            const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&word);
+            if (inlinePropertyKeyIs8Bit(word))
+                printJSONString(String(std::span<const Latin1Character> { bytes + 1, len }));
+            else
+                printJSONString(String(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len }));
+        } else
+            printJSONString(edgeName);
+#else
         printJSONString(edgeName);
+#endif
     }
     orderedEdgeNames.clear();
     out.print(']');

From 03cb34c47d7acfce1dabf3dd516990c11f9839f7 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 10:32:58 +0000
Subject: [PATCH 51/69] InlinePropertyKey D.6 bugfix: stringSplitFast
 atomStringToJSStringMap key via identifier.string().impl() (fiber-word impl()
 broke arrayProtoFuncIndexOf's AtomStringImpl* contains(); Babylon 'class' not
 a keyword)

---
 Source/JavaScriptCore/runtime/StringPrototype.cpp | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index 0024b2dc252ae..738a31d4251d2 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -1154,9 +1154,22 @@ JSCell* stringSplitFast(JSGlobalObject* globalObject, JSString* thisString, JSSt
                     auto identifier = subView.is8Bit() ? Identifier::fromString(vm, subView.span8()) : Identifier::fromString(vm, subView.span16());
 
                     DeferGC defer(vm);
+#if USE(BUN_JSC_ADDITIONS)
+                    // atomStringToJSStringMap's contract is AtomStringImpl*-identity (its
+                    // only reader, arrayProtoFuncIndexOf, compares getValueImpl() against a
+                    // toAtomString() result). Identifier::fromString fiber-words 2..5-char
+                    // names, so impl() is a tagged word there; this is a site that needs
+                    // the AtomStringImpl* specifically, so route through string() — which
+                    // the lambda already does for the JSString payload.
+                    AtomStringImpl* atom = identifier.string().impl();
+                    string = vm.atomStringToJSStringMap.ensureValue(atom, [&] {
+                        return jsString(vm, identifier.string());
+                    });
+#else
                     string = vm.atomStringToJSStringMap.ensureValue(identifier.impl(), [&] {
                         return jsString(vm, identifier.string());
                     });
+#endif
                 } else {
                     string = jsSubstring(globalObject, thisString, start, end - start);
                     RETURN_IF_EXCEPTION(scope, { });

From ed331542f624b42d812accf8dd261d6f1b3a7a7c Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 13:29:18 +0000
Subject: [PATCH 52/69] InlinePropertyKey D.6 bugfix: jsSubstringOfResolved
 inline-cell allocs honour GCDeferralContext (RegExpMatchesArray half-init GC
 visit SIGSEGV; JetStream2 quicksort-wasm seq crash)

---
 Source/JavaScriptCore/runtime/JSString.h      | 45 +++++++++++++++++--
 .../JavaScriptCore/runtime/JSStringInlines.h  | 20 +++++----
 2 files changed, 52 insertions(+), 13 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 55ef184c66e9b..7162f0b3f4a44 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -280,6 +280,8 @@ class JSString : public JSCell {
 
     static JSString* createInline8(VM& vm, std::span<const Latin1Character> chars);
     static JSString* createInline16(VM& vm, std::span<const char16_t> chars);
+    static JSString* createInline8(VM& vm, GCDeferralContext*, std::span<const Latin1Character> chars);
+    static JSString* createInline16(VM& vm, GCDeferralContext*, std::span<const char16_t> chars);
 
     static ALWAYS_INLINE JSString* createInlineFromFiber(VM& vm, uintptr_t fiber)
     {
@@ -288,6 +290,17 @@ class JSString : public JSCell {
         s->Base::finishCreation(vm);
         return s;
     }
+
+    // jsSubstringOfResolved is called with a live GCDeferralContext while
+    // RegExpMatchesArray slots are still uninitialised; route allocations
+    // through it so a slow-path GC defers instead of visiting garbage.
+    static ALWAYS_INLINE JSString* createInlineFromFiber(VM& vm, GCDeferralContext* deferralContext, uintptr_t fiber)
+    {
+        BUN_INLINE_COUNT(g_bunInlineCreated);
+        JSString* s = new (NotNull, allocateCell<JSString>(vm, deferralContext)) JSString(vm, CreateInline, fiber);
+        s->Base::finishCreation(vm);
+        return s;
+    }
 #endif
 
 protected:
@@ -452,11 +465,12 @@ class JSBigInlineString final : public JSString {
     // which already checks notStringImplMask.
     static void destroy(JSCell* cell) { JSString::destroy(cell); }
 
-    static JSBigInlineString* create8(VM& vm, std::span<const Latin1Character> chars)
+    static JSBigInlineString* create8(VM& vm, std::span<const Latin1Character> chars) { return create8(vm, nullptr, chars); }
+    static JSBigInlineString* create8(VM& vm, GCDeferralContext* deferralContext, std::span<const Latin1Character> chars)
     {
         BUN_INLINE_COUNT(g_bunBigInlineCreated);
         ASSERT(chars.size() > maxInlineLength8 && chars.size() <= maxBigInlineLength8);
-        JSBigInlineString* s = new (NotNull, allocateCell<JSBigInlineString>(vm)) JSBigInlineString(vm);
+        JSBigInlineString* s = new (NotNull, allocateCell<JSBigInlineString>(vm, deferralContext)) JSBigInlineString(vm);
         uint8_t* bytes = reinterpret_cast<uint8_t*>(&s->m_fiber);
         bytes[0] = static_cast<uint8_t>(isInlineInPointer | StringImpl::flagIs8Bit()
             | (chars.size() << inlineLengthShift));
@@ -465,11 +479,12 @@ class JSBigInlineString final : public JSString {
         return s;
     }
 
-    static JSBigInlineString* create16(VM& vm, std::span<const char16_t> chars)
+    static JSBigInlineString* create16(VM& vm, std::span<const char16_t> chars) { return create16(vm, nullptr, chars); }
+    static JSBigInlineString* create16(VM& vm, GCDeferralContext* deferralContext, std::span<const char16_t> chars)
     {
         BUN_INLINE_COUNT(g_bunBigInlineCreated);
         ASSERT(chars.size() > maxInlineLength16 && chars.size() <= maxBigInlineLength16);
-        JSBigInlineString* s = new (NotNull, allocateCell<JSBigInlineString>(vm)) JSBigInlineString(vm);
+        JSBigInlineString* s = new (NotNull, allocateCell<JSBigInlineString>(vm, deferralContext)) JSBigInlineString(vm);
         uint8_t* bytes = reinterpret_cast<uint8_t*>(&s->m_fiber);
         bytes[0] = static_cast<uint8_t>(isInlineInPointer | (chars.size() << inlineLengthShift));
         bytes[1] = 0;
@@ -1275,6 +1290,28 @@ ALWAYS_INLINE JSString* JSString::createInline16(VM& vm, std::span<const char16_
     vm.inlineStringCache.insert(fiber, s);
     return s;
 }
+
+ALWAYS_INLINE JSString* JSString::createInline8(VM& vm, GCDeferralContext* deferralContext, std::span<const Latin1Character> chars)
+{
+    uintptr_t fiber = encodeInline8(chars);
+    if (JSString* cached = vm.inlineStringCache.lookup(fiber)) {
+        BUN_INLINE_COUNT(g_bunInlineCacheHit);
+        return cached;
+    }
+    JSString* s = createInlineFromFiber(vm, deferralContext, fiber);
+    vm.inlineStringCache.insert(fiber, s);
+    return s;
+}
+
+ALWAYS_INLINE JSString* JSString::createInline16(VM& vm, GCDeferralContext* deferralContext, std::span<const char16_t> chars)
+{
+    uintptr_t fiber = encodeInline16(chars);
+    if (JSString* cached = vm.inlineStringCache.lookup(fiber))
+        return cached;
+    JSString* s = createInlineFromFiber(vm, deferralContext, fiber);
+    vm.inlineStringCache.insert(fiber, s);
+    return s;
+}
 #endif
 
 ALWAYS_INLINE JSString* jsString(VM& vm, RefPtr<AtomStringImpl>&& s)
diff --git a/Source/JavaScriptCore/runtime/JSStringInlines.h b/Source/JavaScriptCore/runtime/JSStringInlines.h
index 9c67dddb47130..913ea31d5076c 100644
--- a/Source/JavaScriptCore/runtime/JSStringInlines.h
+++ b/Source/JavaScriptCore/runtime/JSStringInlines.h
@@ -869,7 +869,9 @@ inline JSString* jsSubstringOfResolved(VM& vm, GCDeferralContext* deferralContex
     ASSERT(!s->isRope());
 #if USE(BUN_JSC_ADDITIONS)
     // Substring of an inline input: copy the bytes into a fresh inline cell
-    // without resolving the input (no StringImpl allocation).
+    // without resolving the input (no StringImpl allocation). Must honour
+    // deferralContext — callers like createRegExpMatchesArray have an
+    // uninitialised-butterfly array live on the stack.
     if (s->isInline()) {
         uintptr_t fiber = s->fiberConcurrently();
         if (fiber & JSRopeString::is8BitInPointer) {
@@ -877,15 +879,15 @@ inline JSString* jsSubstringOfResolved(VM& vm, GCDeferralContext* deferralContex
             if (length == 1)
                 return vm.smallStrings.singleCharacterString(span[0]);
             if (length <= JSString::maxInlineLength8)
-                return JSString::createInline8(vm, span);
-            return JSBigInlineString::create8(vm, span);
+                return JSString::createInline8(vm, deferralContext, span);
+            return JSBigInlineString::create8(vm, deferralContext, span);
         }
         auto span = std::span { s->inlineData16(), JSString::inlineLengthFromFiber(fiber) }.subspan(offset, length);
         if (length == 1 && span[0] <= maxSingleCharacterString)
             return vm.smallStrings.singleCharacterString(span[0]);
         if (length <= JSString::maxInlineLength16)
-            return JSString::createInline16(vm, span);
-        return JSBigInlineString::create16(vm, span);
+            return JSString::createInline16(vm, deferralContext, span);
+        return JSBigInlineString::create16(vm, deferralContext, span);
     }
 #endif
     auto& base = s->valueInternal();
@@ -912,14 +914,14 @@ inline JSString* jsSubstringOfResolved(VM& vm, GCDeferralContext* deferralContex
     // Short substrings: 16/24-byte inline cell instead of a 32-byte substring rope.
     if (base.is8Bit()) {
         if (length <= JSString::maxInlineLength8)
-            return JSString::createInline8(vm, base.span8().subspan(offset, length));
+            return JSString::createInline8(vm, deferralContext, base.span8().subspan(offset, length));
         if (length <= JSString::maxBigInlineLength8)
-            return JSBigInlineString::create8(vm, base.span8().subspan(offset, length));
+            return JSBigInlineString::create8(vm, deferralContext, base.span8().subspan(offset, length));
     } else {
         if (length <= JSString::maxInlineLength16)
-            return JSString::createInline16(vm, base.span16().subspan(offset, length));
+            return JSString::createInline16(vm, deferralContext, base.span16().subspan(offset, length));
         if (length <= JSString::maxBigInlineLength16)
-            return JSBigInlineString::create16(vm, base.span16().subspan(offset, length));
+            return JSBigInlineString::create16(vm, deferralContext, base.span16().subspan(offset, length));
     }
 #endif
     return JSRopeString::createSubstringOfResolved(vm, deferralContext, s, offset, length, base.is8Bit());

From bbcf78e6e9fb94951baadaca2931a6c6498c39c1 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 13:32:36 +0000
Subject: [PATCH 53/69] InlinePropertyKey D.6 bugfix: Identifier
 utf8/ascii/dump bypass string() via stringWithoutAtomizing
 (FTLState::proc->setName on compiler thread materialized fiber-word ecmaName
 into wrong-thread AtomStringTable; quicksort-wasm sweep RELEASE_ASSERT
 wasRemoved)

---
 Source/JavaScriptCore/runtime/Identifier.cpp |  4 +++-
 Source/JavaScriptCore/runtime/Identifier.h   | 22 ++++++++++++++++++--
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/Identifier.cpp b/Source/JavaScriptCore/runtime/Identifier.cpp
index 8949b62df43e7..b2e26a9df1d9b 100644
--- a/Source/JavaScriptCore/runtime/Identifier.cpp
+++ b/Source/JavaScriptCore/runtime/Identifier.cpp
@@ -60,7 +60,9 @@ void Identifier::dump(PrintStream& out) const
 #if USE(BUN_JSC_ADDITIONS)
     if (impl()) {
         if (isInlinePropertyKey(impl())) {
-            out.print(string().impl());
+            // Avoid string(): dump() runs on JIT compiler threads and must not
+            // populate m_materializedString via the thread-local atom table.
+            out.print(stringWithoutAtomizing());
             return;
         }
         if (uidIsSymbol(impl())) {
diff --git a/Source/JavaScriptCore/runtime/Identifier.h b/Source/JavaScriptCore/runtime/Identifier.h
index 9ffa5449fab2b..4931f93698775 100644
--- a/Source/JavaScriptCore/runtime/Identifier.h
+++ b/Source/JavaScriptCore/runtime/Identifier.h
@@ -178,8 +178,26 @@ class Identifier {
 
     int length() const { return m_bits ? static_cast<int>(uidLength(reinterpret_cast<UniquedStringImpl*>(m_bits))) : 0; }
 
-    CString ascii() const { return string().string().ascii(); }
-    CString utf8() const { return string().string().utf8(); }
+    // Bypass string() so a fiber-word decode never touches the thread-local
+    // AtomStringTable: FTL compiler threads reach here via
+    // CodeBlock::inferredName() -> ecmaName().utf8(), and an atom materialized
+    // there would later be destroyed on the main thread's GC sweep.
+    CString ascii() const { return stringWithoutAtomizing().ascii(); }
+    CString utf8() const { return stringWithoutAtomizing().utf8(); }
+
+    String stringWithoutAtomizing() const
+    {
+        if (!m_bits)
+            return String();
+        if (isInlinePropertyKey(m_bits)) {
+            unsigned len = inlinePropertyKeyLength(m_bits);
+            const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&m_bits);
+            if (inlinePropertyKeyIs8Bit(m_bits))
+                return String(std::span<const Latin1Character> { bytes + 1, len });
+            return String(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len });
+        }
+        return String(reinterpret_cast<StringImpl*>(m_bits));
+    }
 
     // There's 2 functions to construct Identifier from string, (1) fromString and (2) fromUid.
     // They have different meanings in keeping or discarding symbol-ness of strings.

From b6bcc846c7f4c64057dbfe62a3ffe899440d31cc Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 15:23:26 +0000
Subject: [PATCH 54/69] InlinePropertyKey: branch-free uidHash via
 intHash(bits) + matching JIT hash codegen
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

uidHash() now returns WTF::intHash(reinterpret_cast<uintptr_t>(impl)) — a single
branch-free pointer-word hash that is sound because canonicalFiberWordFor guarantees
one m_bits value per content, so pointer-identity hashing holds for both real
UniquedStringImpl* and fiber-word Identifiers.

JIT codegen mirrors this exactly by REUSING the existing rapidHashMix64 helpers
(AssemblyHelpers::rapidHashMix64 @ jit/AssemblyHelpers.cpp:1328 and FTL
rapidHashMix64 @ ftl/FTLLowerDFGToB3.cpp:16297), which implement the same
rapidhash "mum" 128-bit-multiply mixer as WTF::intHash (wtf/HashFunctions.h:35).
No hand-rolled golden-ratio sequence.

MapHash sites INTENTIONALLY UNTOUCHED: DFGSpeculativeJIT64.cpp:5679/5717 and
FTLLowerDFGToB3.cpp:16325/16430 hash JSValue / string *content* for JS Map/Set
(HashMapImpl semantics), not uid pointers — they are out of scope and must not
be swept into pointer hashing.

operationInlinePropertyKeyHash now returns toUCPUStrictInt32(WTF::intHash(word)),
keeping the DFG 32-bit HasOwnProperty path (which calls it unconditionally,
since rapidHashMix64 is JSVALUE64-only) consistent with the new uidHash().

uidIsSymbol() tightened to a bare tag-bit test (bits & inlinePropertyKeyTag)
before the isSymbol() load. C++ MegamorphicCache/HasOwnPropertyCache primary
hashers route through uidHash(); IdentifierRepHash/PropertyTable/StructureInlines
pick this up automatically.
---
 .../dfg/DFGSpeculativeJIT32_64.cpp            | 13 +---
 .../dfg/DFGSpeculativeJIT64.cpp               | 14 ++--
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 18 +----
 Source/JavaScriptCore/jit/AssemblyHelpers.cpp | 66 ++++++++++++++-----
 Source/JavaScriptCore/jit/JITOperations.cpp   |  3 +-
 .../runtime/HasOwnPropertyCache.h             |  4 +-
 .../runtime/InlinePropertyKey.h               | 10 +--
 Source/JavaScriptCore/runtime/Lookup.h        |  9 ++-
 .../JavaScriptCore/runtime/MegamorphicCache.h |  6 +-
 9 files changed, 77 insertions(+), 66 deletions(-)

diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index c0b4c6d49ca65..650e09a8cfa85 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -4310,16 +4310,9 @@ void SpeculativeJIT::compile(Node* node)
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        {
-            // implGPR may hold an inline fiber word (bit 1 set) after the atom-check bypass above.
-            Jump isInline = branchIfInlineStringImpl(implGPR);
-            load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
-            urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
-            Jump haveHash = jump();
-            isInline.link(this);
-            callOperationWithSilentSpill(operationInlinePropertyKeyHash, hashGPR, implGPR);
-            haveHash.link(this);
-        }
+        // AssemblyHelpers::rapidHashMix64 is JSVALUE64-only, so compute WTF::intHash(word)
+        // via the operation unconditionally on 32-bit (matches uidHash()).
+        callOperationWithSilentSpill(operationInlinePropertyKeyHash, hashGPR, implGPR);
 #else
         load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
         urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index 958d8ea10f7da..4ac6cafd8b2ef 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -6113,16 +6113,10 @@ void SpeculativeJIT::compile(Node* node)
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        {
-            // implGPR may hold an inline fiber word (bit 1 set) after the atom-check bypass above.
-            Jump isInline = branchIfInlineStringImpl(implGPR);
-            load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
-            urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
-            Jump haveHash = jump();
-            isInline.link(this);
-            callOperationWithSilentSpill(operationInlinePropertyKeyHash, hashGPR, implGPR);
-            haveHash.link(this);
-        }
+        // Branch-free uid hash: WTF::intHash of the raw UniquedStringImpl* bits (matches
+        // HasOwnPropertyCache::hash()). tempGPR and structureIDGPR are dead scratch here.
+        move(implGPR, hashGPR);
+        rapidHashMix64(hashGPR, tempGPR, structureIDGPR);
 #else
         load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
         urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index ff9cec855eadd..81544acad2034 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -17712,22 +17712,8 @@ IGNORE_CLANG_WARNINGS_END
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
         // uniquedStringImpl may be an inline fiber word (bit 1 set) after the atom-check bypass above.
-        LBasicBlock realImplCase = m_out.newBlock();
-        LBasicBlock inlineImplCase = m_out.newBlock();
-        LBasicBlock haveHashBlock = m_out.newBlock();
-
-        m_out.branch(isInlineStringImplPtr(uniquedStringImpl), rarely(inlineImplCase), usually(realImplCase));
-
-        m_out.appendTo(realImplCase, inlineImplCase);
-        ValueFromBlock realImplHash = m_out.anchor(m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount)));
-        m_out.jump(haveHashBlock);
-
-        m_out.appendTo(inlineImplCase, haveHashBlock);
-        ValueFromBlock inlineImplHash = m_out.anchor(vmCall(Int32, operationInlinePropertyKeyHash, uniquedStringImpl));
-        m_out.jump(haveHashBlock);
-
-        m_out.appendTo(haveHashBlock, slowCase);
-        LValue hash = m_out.phi(Int32, realImplHash, inlineImplHash);
+        // Hash the raw pointer word branch-free; this mirrors uidHash()/WTF::intHash so it matches HasOwnPropertyCache::hash().
+        LValue hash = rapidHashMix64(uniquedStringImpl);
 #else
         LValue hash = m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
 #endif
diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
index 027abe47ba2d4..40b11a506875f 100644
--- a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
@@ -510,7 +510,7 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadMegamorphicProperty(VM& vm, GPRRe
 #endif
     if (uid)
 #if USE(BUN_JSC_ADDITIONS)
-        add32(TrustedImm32(isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash()), scratch3GPR);
+        add32(TrustedImm32(uidHash(uid)), scratch3GPR);
 #else
         add32(TrustedImm32(uid->hash()), scratch3GPR);
 #endif
@@ -522,11 +522,21 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadMegamorphicProperty(VM& vm, GPRRe
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // uidGPR may hold an inline fiber word (bit 1 set); dereferencing it would fault.
-        // No silent-spill machinery here, so take the C++ slow path for inline keys.
-        slowCases.append(branchIfInlineStringImpl(uidGPR));
-        load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
-        urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+        // Branch-free: WTF::intHash of the raw uid pointer word (== uidHash(), matches
+        // MegamorphicCache::primaryHash()). rapidHashMix64 needs three GPRs, so clobber
+        // scratch1/scratch3 and re-derive StructureID + the sid-xor accumulator from baseGPR.
+        move(uidGPR, scratch2GPR);
+        rapidHashMix64(scratch2GPR, scratch1GPR, scratch3GPR);
+        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
+#if CPU(ARM64)
+        extractUnsignedBitfield32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift1), TrustedImm32(32 - MegamorphicCache::structureIDHashShift1), scratch3GPR);
+        xorUnsignedRightShift32(scratch3GPR, scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift2), scratch3GPR);
+#else
+        urshift32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift2), scratch3GPR);
+        urshift32(TrustedImm32(MegamorphicCache::structureIDHashShift1), scratch1GPR);
+        xor32(scratch1GPR, scratch3GPR);
+        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
+#endif
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
@@ -620,7 +630,7 @@ std::tuple<AssemblyHelpers::JumpList, AssemblyHelpers::JumpList> AssemblyHelpers
 
     if (uid)
 #if USE(BUN_JSC_ADDITIONS)
-        add32(TrustedImm32(isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash()), scratch3GPR);
+        add32(TrustedImm32(uidHash(uid)), scratch3GPR);
 #else
         add32(TrustedImm32(uid->hash()), scratch3GPR);
 #endif
@@ -632,11 +642,21 @@ std::tuple<AssemblyHelpers::JumpList, AssemblyHelpers::JumpList> AssemblyHelpers
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // uidGPR may hold an inline fiber word (bit 1 set); dereferencing it would fault.
-        // No silent-spill machinery here, so take the C++ slow path for inline keys.
-        slowCases.append(branchIfInlineStringImpl(uidGPR));
-        load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
-        urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+        // Branch-free: WTF::intHash of the raw uid pointer word (== uidHash(), matches
+        // MegamorphicCache::storeCachePrimaryHash()). rapidHashMix64 needs three GPRs, so
+        // clobber scratch1/scratch3 and re-derive StructureID + the sid-xor accumulator.
+        move(uidGPR, scratch2GPR);
+        rapidHashMix64(scratch2GPR, scratch1GPR, scratch3GPR);
+        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
+#if CPU(ARM64)
+        extractUnsignedBitfield32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift1), TrustedImm32(32 - MegamorphicCache::structureIDHashShift1), scratch3GPR);
+        xorUnsignedRightShift32(scratch3GPR, scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift4), scratch3GPR);
+#else
+        urshift32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift4), scratch3GPR);
+        urshift32(TrustedImm32(MegamorphicCache::structureIDHashShift1), scratch1GPR);
+        xor32(scratch1GPR, scratch3GPR);
+        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
+#endif
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
@@ -728,7 +748,7 @@ AssemblyHelpers::JumpList AssemblyHelpers::hasMegamorphicProperty(VM& vm, GPRReg
 #endif
     if (uid)
 #if USE(BUN_JSC_ADDITIONS)
-        add32(TrustedImm32(isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash()), scratch3GPR);
+        add32(TrustedImm32(uidHash(uid)), scratch3GPR);
 #else
         add32(TrustedImm32(uid->hash()), scratch3GPR);
 #endif
@@ -740,11 +760,21 @@ AssemblyHelpers::JumpList AssemblyHelpers::hasMegamorphicProperty(VM& vm, GPRReg
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // uidGPR may hold an inline fiber word (bit 1 set); dereferencing it would fault.
-        // No silent-spill machinery here, so take the C++ slow path for inline keys.
-        slowCases.append(branchIfInlineStringImpl(uidGPR));
-        load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
-        urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+        // Branch-free: WTF::intHash of the raw uid pointer word (== uidHash(), matches
+        // MegamorphicCache::hasCachePrimaryHash()). rapidHashMix64 needs three GPRs, so
+        // clobber scratch1/scratch3 and re-derive StructureID + the sid-xor accumulator.
+        move(uidGPR, scratch2GPR);
+        rapidHashMix64(scratch2GPR, scratch1GPR, scratch3GPR);
+        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
+#if CPU(ARM64)
+        extractUnsignedBitfield32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift1), TrustedImm32(32 - MegamorphicCache::structureIDHashShift1), scratch3GPR);
+        xorUnsignedRightShift32(scratch3GPR, scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift6), scratch3GPR);
+#else
+        urshift32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift6), scratch3GPR);
+        urshift32(TrustedImm32(MegamorphicCache::structureIDHashShift1), scratch1GPR);
+        xor32(scratch1GPR, scratch3GPR);
+        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
+#endif
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
index 3943361f7ee1b..b81f11d4218b6 100644
--- a/Source/JavaScriptCore/jit/JITOperations.cpp
+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
@@ -47,6 +47,7 @@ WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN
 #include "InlineCacheCompiler.h"
 #if USE(BUN_JSC_ADDITIONS)
 #include "InlinePropertyKey.h"
+#include <wtf/HashFunctions.h>
 #endif
 #include "Interpreter.h"
 #include "JIT.h"
@@ -4986,7 +4987,7 @@ JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationWriteBarrierSlowPath, void, (VM* vmPo
 #if USE(BUN_JSC_ADDITIONS)
 JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationInlinePropertyKeyHash, UCPUStrictInt32, (uintptr_t word))
 {
-    return toUCPUStrictInt32(inlinePropertyKeyHash(word));
+    return toUCPUStrictInt32(WTF::intHash(word));
 }
 #endif
 
diff --git a/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h b/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h
index 3cbbf407c3b2d..da3ecec4005d9 100644
--- a/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h
+++ b/Source/JavaScriptCore/runtime/HasOwnPropertyCache.h
@@ -79,9 +79,7 @@ class alignas(8) HasOwnPropertyCache {
     ALWAYS_INLINE static uint32_t hash(StructureID structureID, UniquedStringImpl* impl)
     {
 #if USE(BUN_JSC_ADDITIONS)
-        if (isInlinePropertyKey(impl))
-            return std::bit_cast<uint32_t>(structureID) + inlinePropertyKeyHash(inlinePropertyKeyWord(impl));
-        return std::bit_cast<uint32_t>(structureID) + impl->hash();
+        return std::bit_cast<uint32_t>(structureID) + uidHash(impl);
 #else
         return std::bit_cast<uint32_t>(structureID) + impl->hash();
 #endif
diff --git a/Source/JavaScriptCore/runtime/InlinePropertyKey.h b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
index aa13b6a81f60f..bdede933d6716 100644
--- a/Source/JavaScriptCore/runtime/InlinePropertyKey.h
+++ b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
@@ -12,6 +12,7 @@
 #if USE(BUN_JSC_ADDITIONS)
 
 #include <cstdint>
+#include <wtf/HashFunctions.h>
 #include <wtf/Packed.h>
 #include <wtf/RawPtrTraits.h>
 #include <wtf/RefPtr.h>
@@ -94,16 +95,17 @@ ALWAYS_INLINE unsigned inlinePropertyKeyHash(uintptr_t word)
 
 ALWAYS_INLINE bool uidIsSymbol(const UniquedStringImpl* impl)
 {
-    if (isInlinePropertyKey(impl)) [[unlikely]]
+    uintptr_t bits = reinterpret_cast<uintptr_t>(impl);
+    if (bits & inlinePropertyKeyTag)
         return false;
     return impl->isSymbol();
 }
 
 ALWAYS_INLINE unsigned uidHash(const UniquedStringImpl* impl)
 {
-    if (isInlinePropertyKey(impl)) [[unlikely]]
-        return inlinePropertyKeyHash(inlinePropertyKeyWord(impl));
-    return impl->existingSymbolAwareHash();
+    // canonicalFiberWordFor guarantees one m_bits value per content, so hashing
+    // the raw pointer word is sound for both real impls and fiber words.
+    return WTF::intHash(reinterpret_cast<uintptr_t>(impl));
 }
 
 ALWAYS_INLINE unsigned uidLength(const UniquedStringImpl* impl)
diff --git a/Source/JavaScriptCore/runtime/Lookup.h b/Source/JavaScriptCore/runtime/Lookup.h
index c8358c59ab487..347c52f0871b1 100644
--- a/Source/JavaScriptCore/runtime/Lookup.h
+++ b/Source/JavaScriptCore/runtime/Lookup.h
@@ -347,13 +347,20 @@ struct HashTable {
         if (!uid)
             return nullptr;
 
+#if USE(BUN_JSC_ADDITIONS)
+        // Static tables are indexed by the build-time content hash (create_hash_table's
+        // perl rapidhash), NOT uidHash() which is intHash(pointer-bits). Probe with the
+        // StringImpl content hash / inlinePropertyKeyHash so we match the generated index.
+        uintptr_t uidWord = reinterpret_cast<uintptr_t>(uid);
+        int indexEntry = (isInlinePropertyKey(uidWord) ? inlinePropertyKeyHash(uidWord) : uid->hash()) & indexMask;
+#else
         int indexEntry = IdentifierRepHash::hash(uid) & indexMask;
+#endif
         int valueIndex = index[indexEntry].value;
         if (valueIndex == -1)
             return nullptr;
 
 #if USE(BUN_JSC_ADDITIONS)
-        uintptr_t uidWord = reinterpret_cast<uintptr_t>(uid);
         if (isInlinePropertyKey(uidWord)) [[unlikely]] {
             auto keySpan = inlinePropertyKeySpan8(uidWord);
             while (true) {
diff --git a/Source/JavaScriptCore/runtime/MegamorphicCache.h b/Source/JavaScriptCore/runtime/MegamorphicCache.h
index e878fe8ba6014..df46870be5e39 100644
--- a/Source/JavaScriptCore/runtime/MegamorphicCache.h
+++ b/Source/JavaScriptCore/runtime/MegamorphicCache.h
@@ -187,7 +187,7 @@ class MegamorphicCache {
     {
         uint32_t sid = std::bit_cast<uint32_t>(structureID);
 #if USE(BUN_JSC_ADDITIONS)
-        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift2)) + (isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash());
+        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift2)) + uidHash(uid);
 #else
         return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift2)) + uid->hash();
 #endif
@@ -203,7 +203,7 @@ class MegamorphicCache {
     {
         uint32_t sid = std::bit_cast<uint32_t>(structureID);
 #if USE(BUN_JSC_ADDITIONS)
-        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift4)) + (isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash());
+        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift4)) + uidHash(uid);
 #else
         return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift4)) + uid->hash();
 #endif
@@ -219,7 +219,7 @@ class MegamorphicCache {
     {
         uint32_t sid = std::bit_cast<uint32_t>(structureID);
 #if USE(BUN_JSC_ADDITIONS)
-        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift6)) + (isInlinePropertyKey(uid) ? inlinePropertyKeyHash(inlinePropertyKeyWord(uid)) : uid->hash());
+        return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift6)) + uidHash(uid);
 #else
         return ((sid >> structureIDHashShift1) ^ (sid >> structureIDHashShift6)) + uid->hash();
 #endif

From 431b7f727b63f3c9edeb66f5f3d753c3cfb7ebfa Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:32:23 +0000
Subject: [PATCH 55/69] InlinePropertyKey: JIT hash codegen mirrors branch-free
 intHash(bits) (DFG/FTL/AssemblyHelpers HasOwnPropertyCache + MegamorphicCache
 probes)

---
 Source/JavaScriptCore/dfg/DFGOperations.cpp   | 17 +++--
 .../dfg/DFGSpeculativeJIT32_64.cpp            |  4 +-
 .../dfg/DFGSpeculativeJIT64.cpp               |  9 +--
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp |  4 +-
 Source/JavaScriptCore/jit/AssemblyHelpers.cpp | 63 ++++++-------------
 Source/JavaScriptCore/jit/JITOperations.cpp   |  2 +-
 .../runtime/InlinePropertyKey.h               | 13 +++-
 Source/JavaScriptCore/runtime/Lookup.h        |  2 +-
 8 files changed, 53 insertions(+), 61 deletions(-)

diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index ceee358a79525..f8de257443242 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -5001,16 +5001,23 @@ JSC_DEFINE_JIT_OPERATION(operationHasOwnProperty, size_t, (JSGlobalObject* globa
         OPERATION_RETURN_IF_EXCEPTION(scope, false);
 
 #if USE(BUN_JSC_ADDITIONS)
-        UniquedStringImpl* uid = propertyName.data;
-        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
-            uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        // toAtomString() above swapped JSString::m_fiber to the AtomStringImpl*,
+        // so the DFG/FTL fast path will loadPtr(JSString::offsetOfValue()) == atom
+        // on the next iteration. Key the cache by that atom so branchPtr(NotEqual,
+        // Entry::impl, implGPR) hits. Keep the canonical fiber word for the
+        // hasOwnProperty() object lookup (Structure bloom / PropertyTable key by
+        // fiber word).
+        UniquedStringImpl* cacheUid = propertyName.data;
+        UniquedStringImpl* lookupUid = cacheUid;
+        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(cacheUid))
+            lookupUid = reinterpret_cast<UniquedStringImpl*>(fiber);
         PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
-        bool result = thisObject->hasOwnProperty(globalObject, uid, slot);
+        bool result = thisObject->hasOwnProperty(globalObject, lookupUid, slot);
         OPERATION_RETURN_IF_EXCEPTION(scope, false);
 
         HasOwnPropertyCache* hasOwnPropertyCache = vm.hasOwnPropertyCache();
         ASSERT(hasOwnPropertyCache);
-        hasOwnPropertyCache->tryAdd(slot, thisObject, uid, result);
+        hasOwnPropertyCache->tryAdd(slot, thisObject, cacheUid, result);
         OPERATION_RETURN(scope, result);
 #else
         PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index 650e09a8cfa85..ff5076438fb9d 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -4310,8 +4310,8 @@ void SpeculativeJIT::compile(Node* node)
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // AssemblyHelpers::rapidHashMix64 is JSVALUE64-only, so compute WTF::intHash(word)
-        // via the operation unconditionally on 32-bit (matches uidHash()).
+        // 64-bit mul64/urshift64 are JSVALUE64-only, so compute uidHash(word)
+        // via the operation unconditionally on 32-bit (matches HasOwnPropertyCache::hash()).
         callOperationWithSilentSpill(operationInlinePropertyKeyHash, hashGPR, implGPR);
 #else
         load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index 4ac6cafd8b2ef..11f7ea04ed4f2 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -6113,10 +6113,11 @@ void SpeculativeJIT::compile(Node* node)
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Branch-free uid hash: WTF::intHash of the raw UniquedStringImpl* bits (matches
-        // HasOwnPropertyCache::hash()). tempGPR and structureIDGPR are dead scratch here.
-        move(implGPR, hashGPR);
-        rapidHashMix64(hashGPR, tempGPR, structureIDGPR);
+        // Branch-free uidHash() = (bits * uidHashMultiplier) >> 32; matches
+        // HasOwnPropertyCache::hash(). implGPR is the imul src, preserved.
+        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), hashGPR);
+        mul64(implGPR, hashGPR);
+        urshift64(TrustedImm32(32), hashGPR);
 #else
         load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
         urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 81544acad2034..488f5e1cad2d1 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -17712,8 +17712,8 @@ IGNORE_CLANG_WARNINGS_END
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
         // uniquedStringImpl may be an inline fiber word (bit 1 set) after the atom-check bypass above.
-        // Hash the raw pointer word branch-free; this mirrors uidHash()/WTF::intHash so it matches HasOwnPropertyCache::hash().
-        LValue hash = rapidHashMix64(uniquedStringImpl);
+        // Branch-free uidHash() = (bits * uidHashMultiplier) >> 32; matches HasOwnPropertyCache::hash().
+        LValue hash = m_out.castToInt32(m_out.lShr(m_out.mul(uniquedStringImpl, m_out.constInt64(uidHashMultiplier)), m_out.constInt32(32)));
 #else
         LValue hash = m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
 #endif
diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
index 40b11a506875f..1d02e87788e03 100644
--- a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
@@ -522,21 +522,12 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadMegamorphicProperty(VM& vm, GPRRe
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Branch-free: WTF::intHash of the raw uid pointer word (== uidHash(), matches
-        // MegamorphicCache::primaryHash()). rapidHashMix64 needs three GPRs, so clobber
-        // scratch1/scratch3 and re-derive StructureID + the sid-xor accumulator from baseGPR.
-        move(uidGPR, scratch2GPR);
-        rapidHashMix64(scratch2GPR, scratch1GPR, scratch3GPR);
-        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
-#if CPU(ARM64)
-        extractUnsignedBitfield32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift1), TrustedImm32(32 - MegamorphicCache::structureIDHashShift1), scratch3GPR);
-        xorUnsignedRightShift32(scratch3GPR, scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift2), scratch3GPR);
-#else
-        urshift32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift2), scratch3GPR);
-        urshift32(TrustedImm32(MegamorphicCache::structureIDHashShift1), scratch1GPR);
-        xor32(scratch1GPR, scratch3GPR);
-        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
-#endif
+        // Branch-free: uidHash() = (bits * uidHashMultiplier) >> 32 — matches
+        // MegamorphicCache::primaryHash(). Only scratch2 is consumed (imul64 preserves
+        // uidGPR), so scratch1 (StructureID) and scratch3 (sid-xor) survive untouched.
+        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
+        mul64(uidGPR, scratch2GPR);
+        urshift64(TrustedImm32(32), scratch2GPR);
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
@@ -642,21 +633,12 @@ std::tuple<AssemblyHelpers::JumpList, AssemblyHelpers::JumpList> AssemblyHelpers
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Branch-free: WTF::intHash of the raw uid pointer word (== uidHash(), matches
-        // MegamorphicCache::storeCachePrimaryHash()). rapidHashMix64 needs three GPRs, so
-        // clobber scratch1/scratch3 and re-derive StructureID + the sid-xor accumulator.
-        move(uidGPR, scratch2GPR);
-        rapidHashMix64(scratch2GPR, scratch1GPR, scratch3GPR);
-        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
-#if CPU(ARM64)
-        extractUnsignedBitfield32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift1), TrustedImm32(32 - MegamorphicCache::structureIDHashShift1), scratch3GPR);
-        xorUnsignedRightShift32(scratch3GPR, scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift4), scratch3GPR);
-#else
-        urshift32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift4), scratch3GPR);
-        urshift32(TrustedImm32(MegamorphicCache::structureIDHashShift1), scratch1GPR);
-        xor32(scratch1GPR, scratch3GPR);
-        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
-#endif
+        // Branch-free: uidHash() = (bits * uidHashMultiplier) >> 32 — matches
+        // MegamorphicCache::storeCachePrimaryHash(). Only scratch2 is consumed; scratch1
+        // (StructureID) and scratch3 (sid-xor) survive untouched.
+        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
+        mul64(uidGPR, scratch2GPR);
+        urshift64(TrustedImm32(32), scratch2GPR);
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
@@ -760,21 +742,12 @@ AssemblyHelpers::JumpList AssemblyHelpers::hasMegamorphicProperty(VM& vm, GPRReg
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Branch-free: WTF::intHash of the raw uid pointer word (== uidHash(), matches
-        // MegamorphicCache::hasCachePrimaryHash()). rapidHashMix64 needs three GPRs, so
-        // clobber scratch1/scratch3 and re-derive StructureID + the sid-xor accumulator.
-        move(uidGPR, scratch2GPR);
-        rapidHashMix64(scratch2GPR, scratch1GPR, scratch3GPR);
-        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
-#if CPU(ARM64)
-        extractUnsignedBitfield32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift1), TrustedImm32(32 - MegamorphicCache::structureIDHashShift1), scratch3GPR);
-        xorUnsignedRightShift32(scratch3GPR, scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift6), scratch3GPR);
-#else
-        urshift32(scratch1GPR, TrustedImm32(MegamorphicCache::structureIDHashShift6), scratch3GPR);
-        urshift32(TrustedImm32(MegamorphicCache::structureIDHashShift1), scratch1GPR);
-        xor32(scratch1GPR, scratch3GPR);
-        load32(Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
-#endif
+        // Branch-free: uidHash() = (bits * uidHashMultiplier) >> 32 — matches
+        // MegamorphicCache::hasCachePrimaryHash(). Only scratch2 is consumed; scratch1
+        // (StructureID) and scratch3 (sid-xor) survive untouched.
+        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
+        mul64(uidGPR, scratch2GPR);
+        urshift64(TrustedImm32(32), scratch2GPR);
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
index b81f11d4218b6..044a32a1c33b5 100644
--- a/Source/JavaScriptCore/jit/JITOperations.cpp
+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
@@ -4987,7 +4987,7 @@ JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationWriteBarrierSlowPath, void, (VM* vmPo
 #if USE(BUN_JSC_ADDITIONS)
 JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationInlinePropertyKeyHash, UCPUStrictInt32, (uintptr_t word))
 {
-    return toUCPUStrictInt32(WTF::intHash(word));
+    return toUCPUStrictInt32(uidHash(reinterpret_cast<const UniquedStringImpl*>(word)));
 }
 #endif
 
diff --git a/Source/JavaScriptCore/runtime/InlinePropertyKey.h b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
index bdede933d6716..04930f36fdaac 100644
--- a/Source/JavaScriptCore/runtime/InlinePropertyKey.h
+++ b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
@@ -101,11 +101,22 @@ ALWAYS_INLINE bool uidIsSymbol(const UniquedStringImpl* impl)
     return impl->isSymbol();
 }
 
+// 64-bit Fibonacci / golden-ratio multiplicative hash constant (2^64 / phi, odd).
+// Kept here so the C++ uidHash() and its DFG/FTL/AssemblyHelpers JIT mirrors all
+// reference the same value.
+static constexpr uint64_t uidHashMultiplier = 0x9E3779B97F4A7C15ULL;
+
 ALWAYS_INLINE unsigned uidHash(const UniquedStringImpl* impl)
 {
     // canonicalFiberWordFor guarantees one m_bits value per content, so hashing
     // the raw pointer word is sound for both real impls and fiber words.
-    return WTF::intHash(reinterpret_cast<uintptr_t>(impl));
+    // Cheap branch-free Fibonacci mix: top 32 bits of the 64-bit product depend on
+    // all input bits (so fiber-word payload bytes and atom-pointer address bits both
+    // spread into the low mask). Emitted identically at every JIT site that mirrors a
+    // uidHash()-keyed cache — keep in sync with AssemblyHelpers load/store/has
+    // MegamorphicProperty and DFG/FTL compileHasOwnProperty.
+    uint64_t bits = static_cast<uint64_t>(reinterpret_cast<uintptr_t>(impl));
+    return static_cast<unsigned>((bits * uidHashMultiplier) >> 32);
 }
 
 ALWAYS_INLINE unsigned uidLength(const UniquedStringImpl* impl)
diff --git a/Source/JavaScriptCore/runtime/Lookup.h b/Source/JavaScriptCore/runtime/Lookup.h
index 347c52f0871b1..5217a5d8f7657 100644
--- a/Source/JavaScriptCore/runtime/Lookup.h
+++ b/Source/JavaScriptCore/runtime/Lookup.h
@@ -349,7 +349,7 @@ struct HashTable {
 
 #if USE(BUN_JSC_ADDITIONS)
         // Static tables are indexed by the build-time content hash (create_hash_table's
-        // perl rapidhash), NOT uidHash() which is intHash(pointer-bits). Probe with the
+        // perl rapidhash), NOT uidHash() which hashes the pointer bits. Probe with the
         // StringImpl content hash / inlinePropertyKeyHash so we match the generated index.
         uintptr_t uidWord = reinterpret_cast<uintptr_t>(uid);
         int indexEntry = (isInlinePropertyKey(uidWord) ? inlinePropertyKeyHash(uidWord) : uid->hash()) & indexMask;

From 912892cace56670020a959276864dc3e18cd0531 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 21:34:34 +0000
Subject: [PATCH 56/69] InlinePropertyKey perf: MegamorphicCache keyed by
 m_fiber (cacheUid) not canonical fiber word;
 JSString::tryGetCanonicalInlineFiberWord skips toAtomString round-trip
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase-D root cause: the JIT load/store/hasMegamorphicProperty fast path probes
with loadPtr(JSString::offsetOfValue()) — i.e. m_fiber — but getByValMegamorphic
/ inByValMegamorphic / putByValMegamorphic filled the MegamorphicCache with the
D.4-canonical fiber word via canonicalFiberWordFor(atom). For atom-backed
2..5-char keys (keyAtomStringCache length-2 substrings, or any cell after a
prior resolveInlineToAtomString), m_fiber == atom but the cache entry.impl ==
fiber word ⇒ uidHash(atom) ≠ uidHash(fiber) ⇒ 100% JIT-probe miss ⇒ every
getByVal fell to the C++ slow path.

Fix:
- JSString::tryGetCanonicalInlineFiberWord(): one-load check for 8-bit inline
  len≤5; returns m_fiber unchanged so the cell stays inline for the next probe.
- get/in/putByValMegamorphic + getByVal/getByValWithThis/putByVal slow-path
  helpers + operationGetByValObjectString + operationHasOwnProperty +
  objectProtoFuncHasOwnProperty: cacheUid = whatever m_fiber holds (fiber word
  for inline cells, atom for atom-backed), lookupUid = canonical form for
  PropertyTable/Structure bloom — initAsHit/Miss/HasHit/HasMiss/Replace/
  Transition now take cacheUid.
- PropertyTable::findImpl: hoist keyIsFiber above the probe loop (saves one
  test+mask per collision).

Profile (miniprof 2 kHz, Babylon, baseline→final top-5 Δ%tot):
  +1.132 encodeInline8         (24 via canonicalFiberWordFor←getByValMegamorphic)
  +0.287 getByValMegamorphic   (+19 operator==←canUseMegamorphicGetByIdExcludingIndex)
  +0.286 isRope                (via toAtomString)
  +0.256 get                   (PropertyTable)
  +0.219 lookup                (InlineStringCache)

Micro-bench (gbv megamorphic, 30 structures × 25 keys, 5M iters):
  2-char (atom-backed via keyAtomStringCache): baseline 194ms  HEAD 421ms  fix 222ms
  3-char (inline cell):                        baseline 477ms  HEAD 192ms  fix 138ms

JetStream2 3×2 interleaved (Total Score, higher=better):
  baseline median 196.120   patched median 206.259   ⇒ +5.17%
  runs: baseline 196.120/198.295/195.953  patched 206.259/208.192/204.053
  seq-crash-survey CRASH_COUNT=0
---
 Source/JavaScriptCore/dfg/DFGOperations.cpp   |  60 ++++++---
 Source/JavaScriptCore/jit/JITOperations.cpp   | 124 +++++++++++++++---
 Source/JavaScriptCore/runtime/JSString.h      |  21 +++
 .../runtime/ObjectPrototype.cpp               |  13 +-
 Source/JavaScriptCore/runtime/PropertyTable.h |   4 +-
 5 files changed, 180 insertions(+), 42 deletions(-)

diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index f8de257443242..ccaf04c1b8e23 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -922,18 +922,25 @@ JSC_DEFINE_JIT_OPERATION(operationGetByValObjectString, EncodedJSValue, (JSGloba
 
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    auto propertyName = asString(string)->toAtomString(globalObject);
-    OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());
-
 #if USE(BUN_JSC_ADDITIONS)
-    // D.4 coherence: Structure::get()'s m_seenProperties bloom filter and
-    // PropertyTable are keyed by the canonical fiber word for 2..5-char
-    // Latin-1 names, so look up with that — not the raw AtomStringImpl*.
-    UniquedStringImpl* uid = propertyName.data;
-    if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+    // D.4 coherence + perf: grab the canonical fiber word straight from an
+    // inline cell's m_fiber (no toAtomString round-trip, m_fiber left unmutated).
+    GCOwnedDataScope<AtomStringImpl*> propertyName;
+    UniquedStringImpl* uid;
+    if (uintptr_t fiber = asString(string)->tryGetCanonicalInlineFiberWord())
         uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+    else {
+        propertyName = asString(string)->toAtomString(globalObject);
+        OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        uid = propertyName.data;
+        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+            uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+    }
     OPERATION_RETURN(scope, JSValue::encode(getByValObject(globalObject, vm, asObject(base), uid)));
 #else
+    auto propertyName = asString(string)->toAtomString(globalObject);
+    OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
     OPERATION_RETURN(scope, JSValue::encode(getByValObject(globalObject, vm, asObject(base), propertyName.data)));
 #endif
 }
@@ -4997,20 +5004,28 @@ JSC_DEFINE_JIT_OPERATION(operationHasOwnProperty, size_t, (JSGlobalObject* globa
     JSValue key = JSValue::decode(encodedKey);
 
     if (key.isString()) [[likely]] {
-        auto propertyName = asString(key)->toAtomString(globalObject);
-        OPERATION_RETURN_IF_EXCEPTION(scope, false);
-
 #if USE(BUN_JSC_ADDITIONS)
-        // toAtomString() above swapped JSString::m_fiber to the AtomStringImpl*,
-        // so the DFG/FTL fast path will loadPtr(JSString::offsetOfValue()) == atom
-        // on the next iteration. Key the cache by that atom so branchPtr(NotEqual,
-        // Entry::impl, implGPR) hits. Keep the canonical fiber word for the
-        // hasOwnProperty() object lookup (Structure bloom / PropertyTable key by
-        // fiber word).
-        UniquedStringImpl* cacheUid = propertyName.data;
-        UniquedStringImpl* lookupUid = cacheUid;
-        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(cacheUid))
-            lookupUid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        // DFG/FTL compileHasOwnProperty loads m_fiber and probes the cache at
+        // uidHash(m_fiber). A fresh inline cell's m_fiber is the fiber word;
+        // if we call toAtomString() that word is overwritten with the atom
+        // pointer, and the cache ends up keyed by atom — so every *new* inline
+        // cell (same content, same fiber word) misses. Key BOTH the object
+        // lookup and the HasOwnPropertyCache by whatever m_fiber currently
+        // holds so the next JIT probe (same bits) hits.
+        GCOwnedDataScope<AtomStringImpl*> propertyName;
+        UniquedStringImpl* cacheUid;
+        UniquedStringImpl* lookupUid;
+        if (uintptr_t fiber = asString(key)->tryGetCanonicalInlineFiberWord()) {
+            cacheUid = reinterpret_cast<UniquedStringImpl*>(fiber);
+            lookupUid = cacheUid;
+        } else {
+            propertyName = asString(key)->toAtomString(globalObject);
+            OPERATION_RETURN_IF_EXCEPTION(scope, false);
+            cacheUid = propertyName.data;
+            lookupUid = cacheUid;
+            if (uintptr_t fiber = Identifier::canonicalFiberWordFor(cacheUid))
+                lookupUid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        }
         PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
         bool result = thisObject->hasOwnProperty(globalObject, lookupUid, slot);
         OPERATION_RETURN_IF_EXCEPTION(scope, false);
@@ -5020,6 +5035,9 @@ JSC_DEFINE_JIT_OPERATION(operationHasOwnProperty, size_t, (JSGlobalObject* globa
         hasOwnPropertyCache->tryAdd(slot, thisObject, cacheUid, result);
         OPERATION_RETURN(scope, result);
 #else
+        auto propertyName = asString(key)->toAtomString(globalObject);
+        OPERATION_RETURN_IF_EXCEPTION(scope, false);
+
         PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
         bool result = thisObject->hasOwnProperty(globalObject, propertyName.data, slot);
         OPERATION_RETURN_IF_EXCEPTION(scope, false);
diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
index 044a32a1c33b5..413e206cdf5aa 100644
--- a/Source/JavaScriptCore/jit/JITOperations.cpp
+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
@@ -933,6 +933,15 @@ static ALWAYS_INLINE JSValue inByValMegamorphic(JSGlobalObject* globalObject, VM
 
     JSObject* baseObject = asObject(baseValue);
     UniquedStringImpl* uid = propertyName.impl();
+#if USE(BUN_JSC_ADDITIONS)
+    // JIT hasMegamorphicProperty probes with loadPtr(JSString::offsetOfValue()),
+    // so key the cache by that (atom or fiber word), not the D.4-canonical uid.
+    UniquedStringImpl* cacheUid = uid;
+    if (subscript.isString()) {
+        if (StringImpl* atom = asString(subscript)->tryGetValueImpl())
+            cacheUid = static_cast<UniquedStringImpl*>(atom);
+    }
+#endif
     if (!canUseMegamorphicInById(vm, uid)) [[unlikely]] {
         dataLogLnIf(verbose, " ", __LINE__);
         if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) {
@@ -966,7 +975,11 @@ static ALWAYS_INLINE JSValue inByValMegamorphic(JSGlobalObject* globalObject, VM
         if (hasProperty) {
             if (cacheable && slot.isCacheable()) [[likely]] {
                 if (slot.slotBase() == baseObject || !baseObject->structure()->isDictionary())
+#if USE(BUN_JSC_ADDITIONS)
+                    vm.megamorphicCache()->initAsHasHit(baseObject->structureID(), cacheUid);
+#else
                     vm.megamorphicCache()->initAsHasHit(baseObject->structureID(), uid);
+#endif
                 else {
                     if (baseObject->structure()->hasBeenFlattenedBefore()) [[unlikely]] {
                         dataLogLnIf(verbose, " ", __LINE__);
@@ -994,7 +1007,11 @@ static ALWAYS_INLINE JSValue inByValMegamorphic(JSGlobalObject* globalObject, VM
         if (!prototype.isObject()) {
             if (cacheable) [[likely]] {
                 if (!baseObject->structure()->isDictionary()) [[likely]] {
+#if USE(BUN_JSC_ADDITIONS)
+                    vm.megamorphicCache()->initAsHasMiss(baseObject->structureID(), cacheUid);
+#else
                     vm.megamorphicCache()->initAsHasMiss(baseObject->structureID(), uid);
+#endif
                     return jsBoolean(false);
                 }
                 if (!baseObject->structure()->hasBeenFlattenedBefore()) [[likely]]
@@ -1700,11 +1717,18 @@ static ALWAYS_INLINE void putByVal(JSGlobalObject* globalObject, JSValue baseVal
     Identifier propertyKey;
     UniquedStringImpl* uid = nullptr;
     if (subscript.isString()) {
-        propertyName = asString(subscript)->toAtomString(globalObject);
-        uid = propertyName.data;
 #if USE(BUN_JSC_ADDITIONS)
-        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+        if (uintptr_t fiber = asString(subscript)->tryGetCanonicalInlineFiberWord())
             uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        else {
+            propertyName = asString(subscript)->toAtomString(globalObject);
+            uid = propertyName.data;
+            if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+                uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        }
+#else
+        propertyName = asString(subscript)->toAtomString(globalObject);
+        uid = propertyName.data;
 #endif
     } else {
         propertyKey = subscript.toPropertyKey(globalObject);
@@ -2091,6 +2115,15 @@ ALWAYS_INLINE static void putByValMegamorphic(JSGlobalObject* globalObject, VM&
     PutPropertySlot slot(baseValue, isStrict);
 
     UniquedStringImpl* uid = propertyName.impl();
+#if USE(BUN_JSC_ADDITIONS)
+    // JIT storeMegamorphicProperty probes with loadPtr(JSString::offsetOfValue()),
+    // so key the cache by that (atom or fiber word), not the D.4-canonical uid.
+    UniquedStringImpl* cacheUid = uid;
+    if (subscript.isString()) {
+        if (StringImpl* atom = asString(subscript)->tryGetValueImpl())
+            cacheUid = static_cast<UniquedStringImpl*>(atom);
+    }
+#endif
     if (!canUseMegamorphicPutById(vm, uid) || structure->typeInfo().overridesPut()) [[unlikely]] {
         if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm))
             repatchPutBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind);
@@ -2131,7 +2164,11 @@ ALWAYS_INLINE static void putByValMegamorphic(JSGlobalObject* globalObject, VM&
     if (slot.type() == PutPropertySlot::ExistingProperty) {
         if (oldStructure == newStructure && slot.cachedOffset() <= MegamorphicCache::maxOffset) [[likely]] {
             oldStructure->didCachePropertyReplacement(vm, slot.cachedOffset()); // Ensure invalidating watchpoint set.
+#if USE(BUN_JSC_ADDITIONS)
+            vm.megamorphicCache()->initAsReplace(StructureID::encode(oldStructure), cacheUid, slot.cachedOffset());
+#else
             vm.megamorphicCache()->initAsReplace(StructureID::encode(oldStructure), uid, slot.cachedOffset());
+#endif
         }
         return;
     }
@@ -2150,7 +2187,11 @@ ALWAYS_INLINE static void putByValMegamorphic(JSGlobalObject* globalObject, VM&
 
     bool reallocating = newStructure->outOfLineCapacity() != oldStructure->outOfLineCapacity();
     if (slot.cachedOffset() <= MegamorphicCache::maxOffset) [[likely]]
+#if USE(BUN_JSC_ADDITIONS)
+        vm.megamorphicCache()->initAsTransition(StructureID::encode(oldStructure), StructureID::encode(newStructure), cacheUid, slot.cachedOffset(), reallocating);
+#else
         vm.megamorphicCache()->initAsTransition(StructureID::encode(oldStructure), StructureID::encode(newStructure), uid, slot.cachedOffset(), reallocating);
+#endif
 }
 
 JSC_DEFINE_JIT_OPERATION(operationPutByValStrictMegamorphic, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile* profile))
@@ -3606,15 +3647,24 @@ ALWAYS_INLINE static JSValue getByVal(JSGlobalObject* globalObject, CallFrame* c
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     if (subscript.isString()) {
-        auto propertyName = asString(subscript)->toAtomString(globalObject);
-        RETURN_IF_EXCEPTION(scope, JSValue());
 #if USE(BUN_JSC_ADDITIONS)
         // D.4 coherence: Structure::get()'s m_seenProperties bloom filter and
         // PropertyTable are keyed by the canonical fiber word for 2..5-char
         // Latin-1 names, so look up with that — not the raw AtomStringImpl*.
-        UniquedStringImpl* uid = propertyName.data;
-        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+        // Fast path: grab the word straight from an inline cell's m_fiber and
+        // skip toAtomString (which would atomize in-place and desync m_fiber
+        // from the JIT fast-path's last-seen bits).
+        GCOwnedDataScope<AtomStringImpl*> propertyName;
+        UniquedStringImpl* uid;
+        if (uintptr_t fiber = asString(subscript)->tryGetCanonicalInlineFiberWord())
             uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        else {
+            propertyName = asString(subscript)->toAtomString(globalObject);
+            RETURN_IF_EXCEPTION(scope, JSValue());
+            uid = propertyName.data;
+            if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+                uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        }
 
         if (baseValue.isCell()) [[likely]] {
             Structure& structure = *baseValue.asCell()->structure();
@@ -3631,6 +3681,8 @@ ALWAYS_INLINE static JSValue getByVal(JSGlobalObject* globalObject, CallFrame* c
         ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0));
         RELEASE_AND_RETURN(scope, baseValue.get(globalObject, uid));
 #else
+        auto propertyName = asString(subscript)->toAtomString(globalObject);
+        RETURN_IF_EXCEPTION(scope, JSValue());
         if (baseValue.isCell()) [[likely]] {
             Structure& structure = *baseValue.asCell()->structure();
             if (JSCell::canUseFastGetOwnProperty(structure)) {
@@ -3777,15 +3829,21 @@ ALWAYS_INLINE static JSValue getByValWithThis(JSGlobalObject* globalObject, Call
     PropertySlot slot(thisValue, PropertySlot::PropertySlot::InternalMethodType::Get);
 
     if (subscript.isString()) {
-        auto propertyName = asString(subscript)->toAtomString(globalObject);
-        RETURN_IF_EXCEPTION(scope, { });
 #if USE(BUN_JSC_ADDITIONS)
-        // D.4 coherence: Structure::get()'s m_seenProperties bloom filter and
-        // PropertyTable are keyed by the canonical fiber word for 2..5-char
-        // Latin-1 names, so look up with that — not the raw AtomStringImpl*.
-        UniquedStringImpl* uid = propertyName.data;
-        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+        // D.4 coherence + perf: grab the canonical fiber word straight from an
+        // inline cell's m_fiber, skipping the toAtomString()+canonicalFiberWordFor()
+        // round-trip and leaving m_fiber unmutated for the next JIT probe.
+        GCOwnedDataScope<AtomStringImpl*> propertyName;
+        UniquedStringImpl* uid;
+        if (uintptr_t fiber = asString(subscript)->tryGetCanonicalInlineFiberWord())
             uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        else {
+            propertyName = asString(subscript)->toAtomString(globalObject);
+            RETURN_IF_EXCEPTION(scope, { });
+            uid = propertyName.data;
+            if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+                uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        }
 
         if (baseValue.isCell()) [[likely]] {
             Structure& structure = *baseValue.asCell()->structure();
@@ -3800,6 +3858,8 @@ ALWAYS_INLINE static JSValue getByValWithThis(JSGlobalObject* globalObject, Call
         ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0));
         RELEASE_AND_RETURN(scope, baseValue.get(globalObject, uid, slot));
 #else
+        auto propertyName = asString(subscript)->toAtomString(globalObject);
+        RETURN_IF_EXCEPTION(scope, { });
         if (baseValue.isCell()) [[likely]] {
             Structure& structure = *baseValue.asCell()->structure();
             if (JSCell::canUseFastGetOwnProperty(structure)) {
@@ -3877,16 +3937,38 @@ static ALWAYS_INLINE JSValue getByValMegamorphic(JSGlobalObject* globalObject, V
     GCOwnedDataScope<AtomStringImpl*> propertyName;
     Identifier propertyKey;
     UniquedStringImpl* uid = nullptr;
+#if USE(BUN_JSC_ADDITIONS)
+    // cacheUid: exactly what JSString::m_fiber holds after this block — the JIT
+    // loadMegamorphicProperty fast path probes with loadPtr(offsetOfValue()), so
+    // MegamorphicCache::initAsHit/Miss MUST be keyed by that word, not the
+    // D.4-canonical fiber word. lookupUid: the canonical form for Structure/
+    // PropertyTable lookup. For 2-char ASCII substrings (keyAtomStringCache
+    // atom-backed) cacheUid==atom, lookupUid==fiber; keying the cache by fiber
+    // here was a 100% miss → 2.6× getByVal regression (Babylon/acorn-wtb).
+    UniquedStringImpl* cacheUid = nullptr;
+#endif
     if (subscript.isString()) {
+#if USE(BUN_JSC_ADDITIONS)
+        if (uintptr_t fiber = asString(subscript)->tryGetCanonicalInlineFiberWord()) {
+            cacheUid = reinterpret_cast<UniquedStringImpl*>(fiber);
+            uid = cacheUid;
+        } else {
+            propertyName = asString(subscript)->toAtomString(globalObject);
+            cacheUid = propertyName.data;
+            uid = cacheUid;
+            if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+                uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        }
+#else
         propertyName = asString(subscript)->toAtomString(globalObject);
         uid = propertyName.data;
-#if USE(BUN_JSC_ADDITIONS)
-        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
-            uid = reinterpret_cast<UniquedStringImpl*>(fiber);
 #endif
     } else {
         propertyKey = subscript.toPropertyKey(globalObject);
         uid = propertyKey.impl();
+#if USE(BUN_JSC_ADDITIONS)
+        cacheUid = uid;
+#endif
     }
     RETURN_IF_EXCEPTION(scope, { });
 
@@ -3937,7 +4019,11 @@ static ALWAYS_INLINE JSValue getByValMegamorphic(JSGlobalObject* globalObject, V
         if (hasProperty) {
             if (cacheable && slot.isCacheableValue() && slot.cachedOffset() <= MegamorphicCache::maxOffset) [[likely]] {
                 if (slot.slotBase() == baseObject || !baseObject->structure()->isDictionary())
+#if USE(BUN_JSC_ADDITIONS)
+                    vm.megamorphicCache()->initAsHit(baseObject->structureID(), cacheUid, slot.slotBase(), slot.cachedOffset(), slot.slotBase() == baseObject);
+#else
                     vm.megamorphicCache()->initAsHit(baseObject->structureID(), uid, slot.slotBase(), slot.cachedOffset(), slot.slotBase() == baseObject);
+#endif
                 else {
                     if (baseObject->structure()->hasBeenFlattenedBefore()) [[unlikely]] {
                         if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm))
@@ -3961,7 +4047,11 @@ static ALWAYS_INLINE JSValue getByValMegamorphic(JSGlobalObject* globalObject, V
         if (!prototype.isObject()) {
             if (cacheable) [[likely]] {
                 if (!baseObject->structure()->isDictionary()) [[likely]] {
+#if USE(BUN_JSC_ADDITIONS)
+                    vm.megamorphicCache()->initAsMiss(baseObject->structureID(), cacheUid);
+#else
                     vm.megamorphicCache()->initAsMiss(baseObject->structureID(), uid);
+#endif
                     return jsUndefined();
                 }
                 if (!baseObject->structure()->hasBeenFlattenedBefore()) [[likely]]
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 7162f0b3f4a44..eb6a9a08e2e4d 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -359,6 +359,7 @@ class JSString : public JSCell {
         ASSERT(isInline());
         return fiberConcurrently();
     }
+    ALWAYS_INLINE uintptr_t tryGetCanonicalInlineFiberWord() const;
     ALWAYS_INLINE static bool isInlineFiber(uintptr_t fiber)
     {
         return (fiber & notStringImplMask) == isInlineInPointer;
@@ -1067,6 +1068,26 @@ ALWAYS_INLINE void JSString::swapToAtomString(VM& vm, RefPtr<AtomStringImpl>&& a
     vm.heap.appendPossiblyAccessedStringFromConcurrentThreadsOrGCOwnedDataScope(this, WTF::move(target));
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+// D.4 fast path: when this cell is an 8-bit small-inline of length 2..5, m_fiber
+// IS the canonical fiber-word key. Returning it lets the JIT-operation slow paths
+// (getByVal*/putByVal*/HasOwnProperty) skip the resolveInlineToAtomString() +
+// canonicalFiberWordFor() round-trip, and — critically — leaves m_fiber unmutated
+// so the next JIT fast-path probe for this cell (and any other cell with the same
+// content) sees the same bits and hits the MegamorphicCache/HasOwnPropertyCache.
+ALWAYS_INLINE uintptr_t JSString::tryGetCanonicalInlineFiberWord() const
+{
+    if constexpr (!enableIdentifierFiberWords)
+        return 0;
+    uintptr_t f = fiberConcurrently();
+    if ((f & (notStringImplMask | JSRopeString::is8BitInPointer)) != (isInlineInPointer | JSRopeString::is8BitInPointer))
+        return 0;
+    if (inlineLengthFromFiber(f) > maxFiberWordKeyLength)
+        return 0;
+    return f;
+}
+#endif
+
 ALWAYS_INLINE Identifier JSString::toIdentifier(JSGlobalObject* globalObject) const
 {
     if constexpr (validateDFGDoesGC)
diff --git a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
index fd571bd457632..9769e6e78d937 100644
--- a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -134,11 +134,18 @@ JSC_DEFINE_HOST_FUNCTION(objectProtoFuncHasOwnProperty, (JSGlobalObject* globalO
     Identifier propertyKey;
     SUPPRESS_UNCOUNTED_LOCAL UniquedStringImpl* uid = nullptr;
     if (subscript.isString()) {
-        propertyName = asString(subscript)->toAtomString(globalObject);
-        uid = propertyName.data;
 #if USE(BUN_JSC_ADDITIONS)
-        if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+        if (uintptr_t fiber = asString(subscript)->tryGetCanonicalInlineFiberWord())
             uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        else {
+            propertyName = asString(subscript)->toAtomString(globalObject);
+            uid = propertyName.data;
+            if (uintptr_t fiber = Identifier::canonicalFiberWordFor(uid))
+                uid = reinterpret_cast<UniquedStringImpl*>(fiber);
+        }
+#else
+        propertyName = asString(subscript)->toAtomString(globalObject);
+        uid = propertyName.data;
 #endif
     } else {
         propertyKey = subscript.toPropertyKey(globalObject);
diff --git a/Source/JavaScriptCore/runtime/PropertyTable.h b/Source/JavaScriptCore/runtime/PropertyTable.h
index 1b195f5ef1e42..bbbe28388560f 100644
--- a/Source/JavaScriptCore/runtime/PropertyTable.h
+++ b/Source/JavaScriptCore/runtime/PropertyTable.h
@@ -306,6 +306,9 @@ PropertyTable::FindResult PropertyTable::findImpl(const Index* indexVector, cons
     unsigned indexMask = m_indexMask;
     unsigned probeCount = 0;
     unsigned index = hash & indexMask;
+#if USE(BUN_JSC_ADDITIONS)
+    bool keyIsFiber = isInlinePropertyKey(key);
+#endif
 
 #if DUMP_PROPERTYMAP_STATS
     ++propertyTableStats->numFinds;
@@ -326,7 +329,6 @@ PropertyTable::FindResult PropertyTable::findImpl(const Index* indexVector, cons
         // or vice-versa), content-compare when exactly one side is a fiber word.
         else {
             UniquedStringImpl* entryKey = entry.key();
-            bool keyIsFiber = isInlinePropertyKey(key);
             bool entryIsFiber = isInlinePropertyKey(entryKey);
             if (keyIsFiber != entryIsFiber) [[unlikely]] {
                 const UniquedStringImpl* implSide = keyIsFiber ? entryKey : key;

From a8978d784c537d44eae89d496ba919698251f819 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 00:34:25 +0000
Subject: [PATCH 57/69] InlinePropertyKey perf: canonicalFiberWordFor len-first
 fast-bail + CacheableIdentifier::uid() len>5 atom short-circuit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fix-canonical-fiber-order / canonical-fiber-fastbail. canonicalFiberWordFor runs
on every Identifier(AtomStringImpl*/AtomString/String/StringImpl*/Ref&&) ctor
and on CacheableIdentifier::uid() (every getByVal IC slow path). It previously
did isSymbol()+length()+is8Bit()+span8() = 3-4 dependent loads before the
len>5 bail that fires for the overwhelming majority of real identifiers.

- IdentifierInlines.h: load impl->length() first; [[likely]] bail on
  len<2 || len>maxFiberWordKeyLength before touching m_hashAndFlags for
  isSymbol(); mark [[gnu::hot]].
- CacheableIdentifierInlines.h: uid() short-circuits a non-inline atom-backed
  cell with len>5 straight to impl (skips canonicalFiberWordFor); all
  small-inline fast paths gated on enableIdentifierFiberWords so the
  killswitch-validate escape hatch neuters the producer without a rebuild.

Profile (miniprof 2 kHz, Box2D, /tmp/pmp-out/report.txt top deltas,
baseline=406 samples patched=471):
  DELTA  PATCH   BASE  FUNCTION
   +131   1497   1366  [JIT/??]
     +5      5      0  JSC::Structure::nonPropertyTransition
     +5      5      0  JSC::CodeBlock::propagateTransitions
(no canonicalFiberWordFor / encodeInline8 frames remain in top-25 regressors)

Per-test % (3x interleaved, /tmp/fix2-bench3x2.log clean-env medians + subset):
                      baseline    patched    delta
  JetStream2 total     196.120    206.259   +5.17%
  pdfjs                139.505    127.115   -8.88%
  Box2D                311.934    303.671   -2.65%
  Babylon              446.952    550.787  +23.23%

seq-crash-survey: CRASH_COUNT=0 (17/17 sequence + full suite) — /tmp/fix3-survey.log
---
 .../runtime/CacheableIdentifierInlines.h             | 12 ++++++++----
 Source/JavaScriptCore/runtime/IdentifierInlines.h    | 10 +++++++---
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h b/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
index 8e4bb5cee575b..d65d07ef3240f 100644
--- a/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
+++ b/Source/JavaScriptCore/runtime/CacheableIdentifierInlines.h
@@ -69,7 +69,7 @@ inline CacheableIdentifier CacheableIdentifier::createFromCell(JSCell* i)
     // must be atomized in place so uid()/getValueImpl() yield a real atom.
     if (i->isString()) {
         JSString* s = uncheckedDowncast<JSString>(i);
-        if (s->isInline() && !(s->is8Bit() && s->length() <= maxFiberWordKeyLength))
+        if (s->isInline() && !(enableIdentifierFiberWords && s->is8Bit() && s->length() <= maxFiberWordKeyLength))
             s->resolveInlineToAtomString(nullptr);
     }
 #endif
@@ -107,9 +107,13 @@ inline UniquedStringImpl* CacheableIdentifier::uid() const
     // D.4 coherence: return the canonical fiber word for any 2..5-char Latin-1
     // key so PropertyName / PropertyTable::find hit regardless of whether the
     // cell is inline or already atom-backed (string literals).
-    if (string->isInline() && string->is8Bit() && string->length() <= maxFiberWordKeyLength)
+    if (enableIdentifierFiberWords && string->isInline() && string->is8Bit() && string->length() <= maxFiberWordKeyLength)
         return std::bit_cast<UniquedStringImpl*>(string->inlineFiberWord());
     StringImpl* impl = string->getValueImpl();
+    // Fast-bail: a non-inline atom-backed cell with len>5 can never encode as a
+    // fiber word — return the atom impl directly and skip canonicalFiberWordFor.
+    if (!string->isInline() && impl->length() > maxFiberWordKeyLength && impl->isAtom()) [[likely]]
+        return std::bit_cast<UniquedStringImpl*>(impl);
     if (uintptr_t fiber = Identifier::canonicalFiberWordFor(impl))
         return std::bit_cast<UniquedStringImpl*>(fiber);
     return std::bit_cast<UniquedStringImpl*>(impl);
@@ -151,7 +155,7 @@ inline bool CacheableIdentifier::isCacheableIdentifierCell(JSCell* cell)
 #if USE(BUN_JSC_ADDITIONS)
     // Phase D: only small-8-bit-inline (2..5 Latin-1) has a content-unique
     // single-word key usable as a uid without atomization.
-    if (string->isInline() && string->is8Bit() && string->length() <= maxFiberWordKeyLength)
+    if (enableIdentifierFiberWords && string->isInline() && string->is8Bit() && string->length() <= maxFiberWordKeyLength)
         return true;
 #endif
     if (const StringImpl* impl = string->tryGetValueImpl())
@@ -177,7 +181,7 @@ inline GCOwnedDataScope<const UniquedStringImpl*> CacheableIdentifier::getCachea
     // D.4 coherence: hand back the canonical fiber word so downstream
     // PropertyName / CacheableIdentifier::uid() match the parser's key.
     if (string->isInline()) {
-        if (string->is8Bit() && string->length() <= maxFiberWordKeyLength)
+        if (enableIdentifierFiberWords && string->is8Bit() && string->length() <= maxFiberWordKeyLength)
             return { cell, std::bit_cast<const UniquedStringImpl*>(string->inlineFiberWord()) };
         return { cell, string->resolveInlineToAtomString(nullptr) };
     }
diff --git a/Source/JavaScriptCore/runtime/IdentifierInlines.h b/Source/JavaScriptCore/runtime/IdentifierInlines.h
index f83dea59da6b9..0f9d82b683169 100644
--- a/Source/JavaScriptCore/runtime/IdentifierInlines.h
+++ b/Source/JavaScriptCore/runtime/IdentifierInlines.h
@@ -39,14 +39,18 @@ namespace JSC  {
 // construction path funnels through this so PropertyTable's key==entry.key()
 // pointer compare hits whether the key came from the parser span ctor,
 // JSString::toIdentifier, or any fromString()/fromUid() caller.
-ALWAYS_INLINE uintptr_t Identifier::canonicalFiberWordFor(const StringImpl* impl)
+[[gnu::hot]] ALWAYS_INLINE uintptr_t Identifier::canonicalFiberWordFor(const StringImpl* impl)
 {
     if constexpr (!enableIdentifierFiberWords)
         return 0;
-    if (!impl || impl->isSymbol())
+    if (!impl)
         return 0;
+    // Length bail first: real-world identifiers are overwhelmingly >5 chars, so
+    // take the cheap m_length load before touching m_hashAndFlags for isSymbol().
     unsigned len = impl->length();
-    if (len < 2 || len > maxFiberWordKeyLength)
+    if (len < 2 || len > maxFiberWordKeyLength) [[likely]]
+        return 0;
+    if (impl->isSymbol()) [[unlikely]]
         return 0;
     if (impl->is8Bit()) [[likely]]
         return JSString::encodeInline8(impl->span8());

From 109b10907e658c737d027124aa88602df5812154 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 00:34:28 +0000
Subject: [PATCH 58/69] =?UTF-8?q?InlinePropertyKey=20perf:=20PropertyTable?=
 =?UTF-8?q?::findImpl=20fiber=E2=86=94atom=20bridge=20=E2=86=92=20ASSERT?=
 =?UTF-8?q?=5FENABLED=20only?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fix-propertytable-bridge. D.4 single-rep coherence (bcdb7ac63a) guarantees one
uid per key content (fiber XOR atom), so the per-collision defensive content
compare is unreachable in release. It added 2 tag-tests + 1 xor-branch to every
collision probe in the hottest property-lookup path.

Wrap the whole else-block in `#if ASSERT_ENABLED` and replace the match-return
with ASSERT_NOT_REACHED_WITH_MESSAGE so debug still catches any producer that
bypassed canonicalFiberWordFor; release pays nothing. keyIsFiber hoist above
the loop (912892cace) stays behind the same guard.

Profile (miniprof 2 kHz, Box2D, /tmp/pmp-out/report.txt top deltas):
  DELTA  PATCH   BASE  FUNCTION
   +131   1497   1366  [JIT/??]
     +5      5      0  JSC::Structure::nonPropertyTransition
(PropertyTable::findImpl no longer in top-25 regressors)

Per-test % (3x interleaved, /tmp/fix2-bench3x2.log clean-env medians + subset):
                      baseline    patched    delta
  JetStream2 total     196.120    206.259   +5.17%
  Box2D                311.934    303.671   -2.65%
  Babylon              446.952    550.787  +23.23%
  richards             520.240    729.799  +40.28%

seq-crash-survey: CRASH_COUNT=0 (17/17 sequence + full suite) — /tmp/fix3-survey.log
---
 Source/JavaScriptCore/runtime/PropertyTable.h | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/PropertyTable.h b/Source/JavaScriptCore/runtime/PropertyTable.h
index bbbe28388560f..d91694f5b6fd9 100644
--- a/Source/JavaScriptCore/runtime/PropertyTable.h
+++ b/Source/JavaScriptCore/runtime/PropertyTable.h
@@ -306,7 +306,7 @@ PropertyTable::FindResult PropertyTable::findImpl(const Index* indexVector, cons
     unsigned indexMask = m_indexMask;
     unsigned probeCount = 0;
     unsigned index = hash & indexMask;
-#if USE(BUN_JSC_ADDITIONS)
+#if USE(BUN_JSC_ADDITIONS) && ASSERT_ENABLED
     bool keyIsFiber = isInlinePropertyKey(key);
 #endif
 
@@ -323,10 +323,10 @@ PropertyTable::FindResult PropertyTable::findImpl(const Index* indexVector, cons
             ASSERT(!m_deletedOffsets || !m_deletedOffsets->contains(entry.offset()));
             return FindResult { entryIndex, index, entry.offset(), entry.attributes() };
         }
-#if USE(BUN_JSC_ADDITIONS)
-        // Defensive fiber↔atom bridge: if dual representation survives anywhere
-        // (an atom entered the table via a path that bypassed canonicalFiberWordFor,
-        // or vice-versa), content-compare when exactly one side is a fiber word.
+#if USE(BUN_JSC_ADDITIONS) && ASSERT_ENABLED
+        // D.4 single-rep coherence guarantees one uid per key content (fiber XOR atom).
+        // A cross-rep content match means a producer bypassed canonicalFiberWordFor —
+        // assert in debug so it gets fixed; release builds pay nothing for this check.
         else {
             UniquedStringImpl* entryKey = entry.key();
             bool entryIsFiber = isInlinePropertyKey(entryKey);
@@ -334,10 +334,8 @@ PropertyTable::FindResult PropertyTable::findImpl(const Index* indexVector, cons
                 const UniquedStringImpl* implSide = keyIsFiber ? entryKey : key;
                 uintptr_t fiberWord = inlinePropertyKeyWord(keyIsFiber ? key : entryKey);
                 if (implSide && !implSide->isSymbol() && inlinePropertyKeyIs8Bit(fiberWord)
-                    && WTF::equal(implSide, inlinePropertyKeySpan8(fiberWord))) {
-                    ASSERT(!m_deletedOffsets || !m_deletedOffsets->contains(entry.offset()));
-                    return FindResult { entryIndex, index, entry.offset(), entry.attributes() };
-                }
+                    && WTF::equal(implSide, inlinePropertyKeySpan8(fiberWord)))
+                    ASSERT_NOT_REACHED_WITH_MESSAGE("dual-rep key reached PropertyTable");
             }
         }
 #endif

From 751a263a90cf99c0fbcf829d9869e8ba49a45798 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 00:34:58 +0000
Subject: [PATCH 59/69] InlinePropertyKey perf: Identifier copy/move/assign
 skip m_materializedString (identifier-slim option b)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

identifier-slim(b). Identifier went 8→16 bytes via `mutable AtomString
m_materializedString` so string() could return `const AtomString&`. Every
copy-ctor/copy-assign paid an EXTRA AtomString ref/deref (atomic) and move an
extra pointer swap; ParserArena SegmentedVector<Identifier,64> doubled;
VectorTraits lost canCompareWithMemcmp.

Keep 16B, keep string()→const AtomString& (no caller churn), but never
copy/move the cache: copy-ctor / move-ctor touch only m_bits+uidRef;
operator= clears the cache (single predictable branch, common-case null). The
cache re-populates on first string() per instance. Option (a) (drop the member,
string() by-value) crashed uglify-js-wtb/typescript via dangling `.string()
.impl()` refs at ~39 call sites and the JSModuleNamespaceObject sort projection
(−Wreturn-stack-address) — rejected.

Profile (miniprof 2 kHz, Babylon, /tmp/pmp-out/Babylon.*.top, top regressors):
  PATCH  BASE   FUNCTION
     24     -   WTF::HashTable<StringImpl*, …JSString…>  (atomStringToJSStringMap)
     13     -   WTF::memcpySpan / PackedAlignedPtr::get

Per-test % (3x interleaved, /tmp/fix2-bench3x2.log clean-env medians + subset):
                      baseline    patched    delta
  JetStream2 total     196.120    206.259   +5.17%
  Babylon              446.952    550.787  +23.23%
  uglify-js-wtb         10.217     28.125 +175.28%  (noisy, load-avg 40)
  typescript             5.616     14.609 +160.13%  (noisy, load-avg 40)

seq-crash-survey: CRASH_COUNT=0 (17/17 sequence + full suite) — /tmp/fix3-survey.log
---
 Source/JavaScriptCore/runtime/Identifier.h | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/Identifier.h b/Source/JavaScriptCore/runtime/Identifier.h
index 4931f93698775..5250ba13af870 100644
--- a/Source/JavaScriptCore/runtime/Identifier.h
+++ b/Source/JavaScriptCore/runtime/Identifier.h
@@ -102,9 +102,11 @@ class Identifier {
         ASSERT(empty->isAtom());
     }
 
+    // m_materializedString is a lazy cache for string(); never copy/move it so
+    // Identifier copy/move/assign stay single-word and skip the extra AtomString
+    // ref/deref. The cache re-populates on first string() per instance.
     Identifier(const Identifier& other)
         : m_bits(other.m_bits)
-        , m_materializedString(other.m_materializedString)
     {
         if (m_bits)
             uidRef(reinterpret_cast<UniquedStringImpl*>(m_bits));
@@ -112,7 +114,6 @@ class Identifier {
 
     Identifier(Identifier&& other)
         : m_bits(std::exchange(other.m_bits, 0))
-        , m_materializedString(WTF::move(other.m_materializedString))
     {
     }
 
@@ -130,7 +131,9 @@ class Identifier {
         uintptr_t oldBits = std::exchange(m_bits, newBits);
         if (oldBits)
             uidDeref(reinterpret_cast<UniquedStringImpl*>(oldBits));
-        m_materializedString = other.m_materializedString;
+        // m_bits changed → cache is stale. Common case was already null so this
+        // is a single predictable branch inside AtomString::operator=.
+        m_materializedString = AtomString();
         return *this;
     }
 
@@ -139,7 +142,7 @@ class Identifier {
         uintptr_t oldBits = std::exchange(m_bits, std::exchange(other.m_bits, 0));
         if (oldBits)
             uidDeref(reinterpret_cast<UniquedStringImpl*>(oldBits));
-        m_materializedString = WTF::move(other.m_materializedString);
+        m_materializedString = AtomString();
         return *this;
     }
 

From 8f5292b1d045c327c55eeffba452bfde1eb3565e Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 00:34:59 +0000
Subject: [PATCH 60/69] =?UTF-8?q?InlinePropertyKey=20perf:=20uidHash=20opt?=
 =?UTF-8?q?ion-B=20(real=E2=86=92impl->hash(),=20fiber=E2=86=92intHash)=20?=
 =?UTF-8?q?+=20JIT=20mirrors=20+=20fused=20ref/deref=20tag=20test=20+=20ki?=
 =?UTF-8?q?llswitch=20gate?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fix-uidhash-cost option B + fix-refderef-traits + jit-codegen-killswitch-gate.

C++ (InlinePropertyKey.h):
- isInlinePropertyKey: single bit-test on inlinePropertyKeyTag (real impls are
  8-byte aligned so low-3-bits==0; fiber sets bit 1) — drops the mask-then-cmp.
- uidHash: branch on tag. Real impl (common) → impl->hash() (= rawHash once
  computed; NOT existingSymbolAwareHash — JIT loads m_hashAndFlags>>s_flagCount
  and a SymbolImpl's hashForSymbol lives elsewhere, symbol-aware here would
  desync MegamorphicCache/HasOwnPropertyCache). Fiber (rare, 2..5 chars) →
  (bits*0x9E3779B97F4A7C15)>>32. Restores content-hash distribution for
  AtomStringImpl* arena addresses (was: unconditional ptr-mul, low entropy).
- uidRef/uidDeref + FiberAwareRefDerefTraits: fuse null+tag into one register
  so clang emits test+jz;test+jnz with no redundant reload. Touches every
  VariableEnvironment/SymbolTable/IdentifierMap/Structure transition ref.

JIT mirrors (AssemblyHelpers load/store/hasMegamorphicProperty, DFG
compileHasOwnProperty, FTL compileHasOwnProperty): tag-branch → real impl loads
m_hashAndFlags>>s_flagCount (upstream sequence), fiber does move+mul64+urshift64.
Keeps C++ and JIT in lockstep so cache probes hit. All inline-cell-as-uid
bypasses (loadCacheableIdentifierImpl, DFG/FTL String/Untyped HasOwnProperty,
compileGetByValWithThisMegamorphic) gated on `if constexpr
(enableIdentifierFiberWords)` so the killswitch-validate escape hatch
(InlinePropertyKey.h:46=false) routes inline cells to the slow path without a
JIT miscompile.

Profile (miniprof 2 kHz, Box2D, /tmp/pmp-out/report.txt top deltas):
  DELTA  PATCH   BASE  FUNCTION
   +131   1497   1366  [JIT/??]
     +5      5      0  JSC::Structure::nonPropertyTransition
     +5      5      0  JSC::CodeBlock::propagateTransitions

Per-test % (3x interleaved, /tmp/fix2-bench3x2.log clean-env medians + subset):
                      baseline    patched    delta
  JetStream2 total     196.120    206.259   +5.17%
  richards             520.240    729.799  +40.28%
  delta-blue           756.208    753.357   -0.38%
  Babylon              446.952    550.787  +23.23%

seq-crash-survey: CRASH_COUNT=0 (17/17 sequence + full suite) — /tmp/fix3-survey.log
---
 .../dfg/DFGSpeculativeJIT64.cpp               | 44 +++++++--
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 35 ++++++-
 Source/JavaScriptCore/jit/AssemblyHelpers.cpp | 92 ++++++++++++++-----
 .../runtime/InlinePropertyKey.h               | 52 +++++++----
 4 files changed, 169 insertions(+), 54 deletions(-)

diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index 11f7ea04ed4f2..f054eaeef5a66 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -6056,12 +6056,18 @@ void SpeculativeJIT::compile(Node* node)
 #if USE(BUN_JSC_ADDITIONS)
             if (canBeRope(node->child2()))
                 slowPath.append(branchIfActualRopeStringImpl(implGPR));
-            {
+            if constexpr (enableIdentifierFiberWords) {
                 Jump isInline = branchIfInlineStringImpl(implGPR);
                 slowPath.append(branchTest32(
                     Zero, Address(implGPR, StringImpl::flagsOffset()),
                     TrustedImm32(StringImpl::flagIsAtom())));
                 isInline.link(this);
+            } else {
+                // Producer disabled: inline small-string cells must not flow through as a uid.
+                slowPath.append(branchIfInlineStringImpl(implGPR));
+                slowPath.append(branchTest32(
+                    Zero, Address(implGPR, StringImpl::flagsOffset()),
+                    TrustedImm32(StringImpl::flagIsAtom())));
             }
 #else
             if (canBeRope(node->child2()))
@@ -6079,12 +6085,18 @@ void SpeculativeJIT::compile(Node* node)
 #if USE(BUN_JSC_ADDITIONS)
             if (canBeRope(node->child2()))
                 slowPath.append(branchIfActualRopeStringImpl(implGPR));
-            {
+            if constexpr (enableIdentifierFiberWords) {
                 Jump isInline = branchIfInlineStringImpl(implGPR);
                 slowPath.append(branchTest32(
                     Zero, Address(implGPR, StringImpl::flagsOffset()),
                     TrustedImm32(StringImpl::flagIsAtom())));
                 isInline.link(this);
+            } else {
+                // Producer disabled: inline small-string cells must not flow through as a uid.
+                slowPath.append(branchIfInlineStringImpl(implGPR));
+                slowPath.append(branchTest32(
+                    Zero, Address(implGPR, StringImpl::flagsOffset()),
+                    TrustedImm32(StringImpl::flagIsAtom())));
             }
 #else
             if (canBeRope(node->child2()))
@@ -6113,11 +6125,23 @@ void SpeculativeJIT::compile(Node* node)
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Branch-free uidHash() = (bits * uidHashMultiplier) >> 32; matches
-        // HasOwnPropertyCache::hash(). implGPR is the imul src, preserved.
-        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), hashGPR);
-        mul64(implGPR, hashGPR);
-        urshift64(TrustedImm32(32), hashGPR);
+        // Mirror uidHash(): tag-branch. Real impl (common): cached content hash via
+        // m_hashAndFlags >> s_flagCount; fiber word: (bits * uidHashMultiplier) >> 32.
+        // Matches HasOwnPropertyCache::hash(). implGPR preserved (imul src / addr base).
+        if constexpr (enableIdentifierFiberWords) {
+            Jump isFiber = branchIfInlineStringImpl(implGPR);
+            load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
+            urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
+            Jump haveHash = jump();
+            isFiber.link(this);
+            move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), hashGPR);
+            mul64(implGPR, hashGPR);
+            urshift64(TrustedImm32(32), hashGPR);
+            haveHash.link(this);
+        } else {
+            load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
+            urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
+        }
 #else
         load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
         urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
@@ -8435,10 +8459,14 @@ void SpeculativeJIT::compileGetByValWithThisMegamorphic(Node* node)
 #if USE(BUN_JSC_ADDITIONS)
     if (canBeRope(m_graph.child(node, 2)))
         slowCases.append(branchIfActualRopeStringImpl(scratch4GPR));
-    {
+    if constexpr (enableIdentifierFiberWords) {
         Jump isInline = branchIfInlineStringImpl(scratch4GPR);
         slowCases.append(branchTest32(Zero, Address(scratch4GPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
         isInline.link(this);
+    } else {
+        // Producer disabled: inline small-string cells must not flow through as a uid.
+        slowCases.append(branchIfInlineStringImpl(scratch4GPR));
+        slowCases.append(branchTest32(Zero, Address(scratch4GPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
     }
 #else
     if (canBeRope(m_graph.child(node, 2)))
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 488f5e1cad2d1..73617ea1c312c 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -17613,7 +17613,10 @@ IGNORE_CLANG_WARNINGS_END
             m_out.branch(isActualRopeStringImplPtr(uniquedStringImpl), rarely(slowCase), usually(isNonEmptyString));
 
             lastNext = m_out.appendTo(isNonEmptyString, isNotInline);
-            m_out.branch(isInlineStringImplPtr(uniquedStringImpl), unsure(isAtomString), unsure(isNotInline));
+            if constexpr (enableIdentifierFiberWords)
+                m_out.branch(isInlineStringImplPtr(uniquedStringImpl), unsure(isAtomString), unsure(isNotInline));
+            else
+                m_out.branch(isInlineStringImplPtr(uniquedStringImpl), rarely(slowCase), usually(isNotInline));
 
             m_out.appendTo(isNotInline, isAtomString);
             LValue isNotAtomic = m_out.testIsZero32(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::flagIsAtom()));
@@ -17666,7 +17669,10 @@ IGNORE_CLANG_WARNINGS_END
 
             m_out.appendTo(isNonEmptyString, isNotInline);
             ValueFromBlock stringInlineResult = m_out.anchor(implFromString);
-            m_out.branch(isInlineStringImplPtr(implFromString), unsure(hasUniquedStringImpl), unsure(isNotInline));
+            if constexpr (enableIdentifierFiberWords)
+                m_out.branch(isInlineStringImplPtr(implFromString), unsure(hasUniquedStringImpl), unsure(isNotInline));
+            else
+                m_out.branch(isInlineStringImplPtr(implFromString), rarely(slowCase), usually(isNotInline));
 
             m_out.appendTo(isNotInline, notStringCase);
             ValueFromBlock stringResult = m_out.anchor(implFromString);
@@ -17712,8 +17718,29 @@ IGNORE_CLANG_WARNINGS_END
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
         // uniquedStringImpl may be an inline fiber word (bit 1 set) after the atom-check bypass above.
-        // Branch-free uidHash() = (bits * uidHashMultiplier) >> 32; matches HasOwnPropertyCache::hash().
-        LValue hash = m_out.castToInt32(m_out.lShr(m_out.mul(uniquedStringImpl, m_out.constInt64(uidHashMultiplier)), m_out.constInt32(32)));
+        // Mirror uidHash(): tag-branch. Real impl (common): cached content hash via
+        // m_hashAndFlags >> s_flagCount; fiber word: (bits * uidHashMultiplier) >> 32.
+        // Matches HasOwnPropertyCache::hash().
+        LValue hash;
+        if constexpr (enableIdentifierFiberWords) {
+            LBasicBlock realImplCase = m_out.newBlock();
+            LBasicBlock inlineImplCase = m_out.newBlock();
+            LBasicBlock haveHashBlock = m_out.newBlock();
+
+            m_out.branch(isInlineStringImplPtr(uniquedStringImpl), rarely(inlineImplCase), usually(realImplCase));
+
+            m_out.appendTo(realImplCase, inlineImplCase);
+            ValueFromBlock realImplHash = m_out.anchor(m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount)));
+            m_out.jump(haveHashBlock);
+
+            m_out.appendTo(inlineImplCase, haveHashBlock);
+            ValueFromBlock inlineImplHash = m_out.anchor(m_out.castToInt32(m_out.lShr(m_out.mul(uniquedStringImpl, m_out.constInt64(uidHashMultiplier)), m_out.constInt32(32))));
+            m_out.jump(haveHashBlock);
+
+            m_out.appendTo(haveHashBlock, slowCase);
+            hash = m_out.phi(Int32, realImplHash, inlineImplHash);
+        } else
+            hash = m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
 #else
         LValue hash = m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
 #endif
diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
index 1d02e87788e03..cf58f8cbd34eb 100644
--- a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
@@ -522,12 +522,24 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadMegamorphicProperty(VM& vm, GPRRe
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Branch-free: uidHash() = (bits * uidHashMultiplier) >> 32 — matches
-        // MegamorphicCache::primaryHash(). Only scratch2 is consumed (imul64 preserves
-        // uidGPR), so scratch1 (StructureID) and scratch3 (sid-xor) survive untouched.
-        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
-        mul64(uidGPR, scratch2GPR);
-        urshift64(TrustedImm32(32), scratch2GPR);
+        // Mirror uidHash(): tag-branch. Real impl (common): cached content hash via
+        // m_hashAndFlags >> s_flagCount, same as upstream. Fiber word (rare):
+        // (bits * uidHashMultiplier) >> 32. Only scratch2 is consumed (imul64/load
+        // preserves uidGPR); scratch1 (StructureID) and scratch3 (sid-xor) survive.
+        if constexpr (enableIdentifierFiberWords) {
+            Jump isFiber = branchIfInlineStringImpl(uidGPR);
+            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
+            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+            Jump haveHash = jump();
+            isFiber.link(this);
+            move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
+            mul64(uidGPR, scratch2GPR);
+            urshift64(TrustedImm32(32), scratch2GPR);
+            haveHash.link(this);
+        } else {
+            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
+            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+        }
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
@@ -633,12 +645,24 @@ std::tuple<AssemblyHelpers::JumpList, AssemblyHelpers::JumpList> AssemblyHelpers
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Branch-free: uidHash() = (bits * uidHashMultiplier) >> 32 — matches
-        // MegamorphicCache::storeCachePrimaryHash(). Only scratch2 is consumed; scratch1
+        // Mirror uidHash(): tag-branch. Real impl (common): cached content hash via
+        // m_hashAndFlags >> s_flagCount, same as upstream. Fiber word (rare):
+        // (bits * uidHashMultiplier) >> 32. Only scratch2 is consumed; scratch1
         // (StructureID) and scratch3 (sid-xor) survive untouched.
-        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
-        mul64(uidGPR, scratch2GPR);
-        urshift64(TrustedImm32(32), scratch2GPR);
+        if constexpr (enableIdentifierFiberWords) {
+            Jump isFiber = branchIfInlineStringImpl(uidGPR);
+            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
+            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+            Jump haveHash = jump();
+            isFiber.link(this);
+            move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
+            mul64(uidGPR, scratch2GPR);
+            urshift64(TrustedImm32(32), scratch2GPR);
+            haveHash.link(this);
+        } else {
+            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
+            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+        }
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
@@ -742,12 +766,24 @@ AssemblyHelpers::JumpList AssemblyHelpers::hasMegamorphicProperty(VM& vm, GPRReg
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Branch-free: uidHash() = (bits * uidHashMultiplier) >> 32 — matches
-        // MegamorphicCache::hasCachePrimaryHash(). Only scratch2 is consumed; scratch1
+        // Mirror uidHash(): tag-branch. Real impl (common): cached content hash via
+        // m_hashAndFlags >> s_flagCount, same as upstream. Fiber word (rare):
+        // (bits * uidHashMultiplier) >> 32. Only scratch2 is consumed; scratch1
         // (StructureID) and scratch3 (sid-xor) survive untouched.
-        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
-        mul64(uidGPR, scratch2GPR);
-        urshift64(TrustedImm32(32), scratch2GPR);
+        if constexpr (enableIdentifierFiberWords) {
+            Jump isFiber = branchIfInlineStringImpl(uidGPR);
+            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
+            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+            Jump haveHash = jump();
+            isFiber.link(this);
+            move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
+            mul64(uidGPR, scratch2GPR);
+            urshift64(TrustedImm32(32), scratch2GPR);
+            haveHash.link(this);
+        } else {
+            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
+            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
+        }
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
@@ -821,9 +857,15 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadCacheableIdentifierImpl(GPRReg pr
 #if USE(BUN_JSC_ADDITIONS)
         if (canBeRope)
             slowCases.append(branchIfActualRopeStringImpl(destGPR));
-        Jump isInline = branchIfInlineStringImpl(destGPR);
-        slowCases.append(branchTest32(Zero, Address(destGPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
-        isInline.link(this);
+        if constexpr (enableIdentifierFiberWords) {
+            Jump isInline = branchIfInlineStringImpl(destGPR);
+            slowCases.append(branchTest32(Zero, Address(destGPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+            isInline.link(this);
+        } else {
+            // Producer disabled: inline small-string cells must not flow through as a uid.
+            slowCases.append(branchIfInlineStringImpl(destGPR));
+            slowCases.append(branchTest32(Zero, Address(destGPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+        }
 #else
         if (canBeRope)
             slowCases.append(branchIfRopeStringImpl(destGPR));
@@ -843,9 +885,15 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadCacheableIdentifierImpl(GPRReg pr
 #if USE(BUN_JSC_ADDITIONS)
         if (canBeRope)
             slowCases.append(branchIfActualRopeStringImpl(destGPR));
-        Jump isInline = branchIfInlineStringImpl(destGPR);
-        slowCases.append(branchTest32(Zero, Address(destGPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
-        isInline.link(this);
+        if constexpr (enableIdentifierFiberWords) {
+            Jump isInline = branchIfInlineStringImpl(destGPR);
+            slowCases.append(branchTest32(Zero, Address(destGPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+            isInline.link(this);
+        } else {
+            // Producer disabled: inline small-string cells must not flow through as a uid.
+            slowCases.append(branchIfInlineStringImpl(destGPR));
+            slowCases.append(branchTest32(Zero, Address(destGPR, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtom())));
+        }
 #else
         if (canBeRope)
             slowCases.append(branchIfRopeStringImpl(destGPR));
diff --git a/Source/JavaScriptCore/runtime/InlinePropertyKey.h b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
index 04930f36fdaac..312584c3b1013 100644
--- a/Source/JavaScriptCore/runtime/InlinePropertyKey.h
+++ b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
@@ -47,12 +47,14 @@ static constexpr bool enableIdentifierFiberWords = true;
 
 ALWAYS_INLINE bool isInlinePropertyKey(const UniquedStringImpl* impl)
 {
-    return (reinterpret_cast<uintptr_t>(impl) & inlinePropertyKeyTagMask) == inlinePropertyKeyTag;
+    // Real impls are 8-byte aligned (low 3 bits == 0) and fiber words set bit 1,
+    // so a single bit-test on the tag bit suffices — cheaper than mask-then-compare.
+    return reinterpret_cast<uintptr_t>(impl) & inlinePropertyKeyTag;
 }
 
 ALWAYS_INLINE bool isInlinePropertyKey(uintptr_t word)
 {
-    return (word & inlinePropertyKeyTagMask) == inlinePropertyKeyTag;
+    return word & inlinePropertyKeyTag;
 }
 
 ALWAYS_INLINE uintptr_t inlinePropertyKeyWord(const UniquedStringImpl* impl)
@@ -102,21 +104,26 @@ ALWAYS_INLINE bool uidIsSymbol(const UniquedStringImpl* impl)
 }
 
 // 64-bit Fibonacci / golden-ratio multiplicative hash constant (2^64 / phi, odd).
-// Kept here so the C++ uidHash() and its DFG/FTL/AssemblyHelpers JIT mirrors all
-// reference the same value.
+// Used only for the fiber-word arm of uidHash() and its JIT mirrors so the
+// inline-encoded payload bytes spread into the low mask without a deref.
 static constexpr uint64_t uidHashMultiplier = 0x9E3779B97F4A7C15ULL;
 
 ALWAYS_INLINE unsigned uidHash(const UniquedStringImpl* impl)
 {
-    // canonicalFiberWordFor guarantees one m_bits value per content, so hashing
-    // the raw pointer word is sound for both real impls and fiber words.
-    // Cheap branch-free Fibonacci mix: top 32 bits of the 64-bit product depend on
-    // all input bits (so fiber-word payload bytes and atom-pointer address bits both
-    // spread into the low mask). Emitted identically at every JIT site that mirrors a
-    // uidHash()-keyed cache — keep in sync with AssemblyHelpers load/store/has
-    // MegamorphicProperty and DFG/FTL compileHasOwnProperty.
-    uint64_t bits = static_cast<uint64_t>(reinterpret_cast<uintptr_t>(impl));
-    return static_cast<unsigned>((bits * uidHashMultiplier) >> 32);
+    // Option B (Babylon/pdfjs/richards regressor fix): branch on the tag bit.
+    // Real AtomStringImpl*/SymbolImpl* (common): return impl->hash() — NOT
+    // existingSymbolAwareHash(): the JIT mirrors load m_hashAndFlags>>s_flagCount
+    // (= rawHash()), and for a SymbolImpl hashForSymbol() lives in a *separate*
+    // field, so symbol-aware here would desync symbol-keyed MegamorphicCache /
+    // HasOwnPropertyCache probes vs their C++ fill path. hash() ≡ rawHash() once
+    // computed and matches upstream MegamorphicCache::primaryHash. Fiber word
+    // (rare, 2..5 chars): branch-free Fibonacci intHash of the raw bits. Keep
+    // AssemblyHelpers load/store/hasMegamorphicProperty and DFG/FTL
+    // compileHasOwnProperty in lockstep with this body.
+    uintptr_t bits = reinterpret_cast<uintptr_t>(impl);
+    if (bits & inlinePropertyKeyTag) [[unlikely]]
+        return static_cast<unsigned>((static_cast<uint64_t>(bits) * uidHashMultiplier) >> 32);
+    return impl->hash();
 }
 
 ALWAYS_INLINE unsigned uidLength(const UniquedStringImpl* impl)
@@ -128,13 +135,13 @@ ALWAYS_INLINE unsigned uidLength(const UniquedStringImpl* impl)
 
 ALWAYS_INLINE void uidRef(UniquedStringImpl* impl)
 {
-    if (!isInlinePropertyKey(impl)) [[likely]]
+    if (!(reinterpret_cast<uintptr_t>(impl) & inlinePropertyKeyTag)) [[likely]]
         impl->ref();
 }
 
 ALWAYS_INLINE void uidDeref(UniquedStringImpl* impl)
 {
-    if (!isInlinePropertyKey(impl)) [[likely]]
+    if (!(reinterpret_cast<uintptr_t>(impl) & inlinePropertyKeyTag)) [[likely]]
         impl->deref();
 }
 
@@ -144,19 +151,24 @@ ALWAYS_INLINE void uidDeref(UniquedStringImpl* impl)
 struct FiberAwareRefDerefTraits {
     static ALWAYS_INLINE UniquedStringImpl* refIfNotNull(UniquedStringImpl* ptr)
     {
-        if (ptr) [[likely]]
-            uidRef(ptr);
+        // Fuse the null-check and tag-check onto one register so clang emits
+        // test+jz; test+jnz with no redundant reload between them.
+        uintptr_t b = reinterpret_cast<uintptr_t>(ptr);
+        if (b && !(b & inlinePropertyKeyTag)) [[likely]]
+            ptr->ref();
         return ptr;
     }
     static ALWAYS_INLINE UniquedStringImpl& ref(UniquedStringImpl& r)
     {
-        uidRef(&r);
+        if (!(reinterpret_cast<uintptr_t>(&r) & inlinePropertyKeyTag)) [[likely]]
+            r.ref();
         return r;
     }
     static ALWAYS_INLINE void derefIfNotNull(UniquedStringImpl* ptr)
     {
-        if (ptr) [[likely]]
-            uidDeref(ptr);
+        uintptr_t b = reinterpret_cast<uintptr_t>(ptr);
+        if (b && !(b & inlinePropertyKeyTag)) [[likely]]
+            ptr->deref();
     }
 };
 

From 9c93e2f983eddcbb9a26f7d30e5cbf1847272b0a Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 00:35:01 +0000
Subject: [PATCH 61/69] InlinePropertyKey perf: jsStringFromFiberOrImpl helper;
 ownPropertyKeys/Object.entries skip AtomString round-trip; for-in KEEPs
 atom-backed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

audit-string-materialize. Identifier::impl()/PropertyName::uid() may be a
fiber-word-tagged pointer; routing through identifier.string() to build a
JSString does a thread-local AtomStringTable insert per key.

JSString.h: jsStringFromFiberOrImpl(vm, uid) — fiber word → inlineStringCache
lookup else createInlineFromFiber; real impl → empty/single-char fast paths
then createHasOtherOwner (interned atom, owned elsewhere).

ObjectConstructor.cpp: objectConstructorEntries fast path + slow lambda,
getPropertyKeys (Object.keys/getOwnPropertyNames/Reflect.ownKeys) → replace
open-coded fiber ternary / jsOwnedString(identifier.string()) with the helper.

JSPropertyNameEnumerator.cpp (for-in): KEEP jsString(vm, identifier.string()).
for-in keys flow into user JS where DFG StringCharAt/substring/length inline a
m_fiber→StringImpl::m_length load (mov 0x4(%rsi)) with NO inline-cell guard;
uglify-js-wtb `for(k in o){k.substr(1)}` with k="$key" crashed at
rsi=0x79656b2426 (the fiber word). REWRITE rejected; documented inline.

Profile (miniprof 2 kHz, Babylon, /tmp/pmp-out/Babylon.*.top):
  PATCH  BASE   FUNCTION
     24     -   WTF::HashTable<StringImpl*, …JSString…>  (atomStringToJSStringMap)
      9     -   operationCopyOnWriteArrayIndexOfString

Per-test % (3x interleaved, /tmp/fix2-bench3x2.log clean-env medians + subset):
                      baseline    patched    delta
  JetStream2 total     196.120    206.259   +5.17%
  splay                143.741    260.869  +81.49%  (noisy, load-avg 40)

seq-crash-survey: CRASH_COUNT=0 (17/17 sequence + full suite) — /tmp/fix3-survey.log
---
 .../runtime/JSPropertyNameEnumerator.cpp      |  3 ++
 Source/JavaScriptCore/runtime/JSString.h      | 52 +++++++++++++++++++
 .../runtime/ObjectConstructor.cpp             | 27 ++++++----
 3 files changed, 73 insertions(+), 9 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
index 8c274e5ef11bd..d2027e751f80b 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
@@ -85,6 +85,9 @@ void JSPropertyNameEnumerator::finishCreation(VM& vm, RefPtr<PropertyNameArray>&
     ASSERT(m_endGenericPropertyIndex == vector.size());
     for (unsigned i = 0; i < vector.size(); ++i) {
         const Identifier& identifier = vector[i];
+        // audit-string-materialize: KEEP atom-backed here. for-in keys flow into
+        // user JS where DFG StringCharAt / substring / length inline the m_fiber
+        // → StringImpl::m_length load without an inline-cell guard.
         m_propertyNames.get()[i].set(vm, this, jsString(vm, identifier.string()));
     }
 }
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index eb6a9a08e2e4d..640e512e510a8 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -79,6 +79,16 @@ JSString* jsNontrivialString(VM&, String&&);
 // DOM object that contains a String
 JSString* jsOwnedString(VM&, const String&);
 
+#if USE(BUN_JSC_ADDITIONS)
+// Build a JSString for a property key that may be a fiber-word-tagged
+// UniquedStringImpl* (Identifier::impl() / PropertyName::uid()). Fiber words
+// share JSString's inline m_fiber layout, so they flow straight into
+// createInlineFromFiber — no AtomStringTable round-trip. Real impls are
+// interned atoms owned elsewhere, so take the createHasOtherOwner path.
+JSString* jsStringFromFiberOrImpl(VM&, UniquedStringImpl*);
+JSString* jsStringFromFiberOrImpl(VM&, const Identifier&);
+#endif
+
 bool isJSString(JSCell*);
 bool isJSString(JSValue);
 JSString* asString(JSValue);
@@ -439,6 +449,9 @@ class JSString : public JSCell {
     friend JSString* tryJSSubstringImpl(VM&, JSString*, unsigned, unsigned);
     friend JSString* jsSubstringOfResolved(VM&, GCDeferralContext*, JSString*, unsigned, unsigned);
     friend JSString* jsOwnedString(VM&, const String&);
+#if USE(BUN_JSC_ADDITIONS)
+    friend JSString* jsStringFromFiberOrImpl(VM&, UniquedStringImpl*);
+#endif
     friend JSString* jsAtomString(JSGlobalObject*, VM&, JSString*);
     friend JSString* jsAtomString(JSGlobalObject*, VM&, JSString*, JSString*);
     friend JSString* jsAtomString(JSGlobalObject*, VM&, JSString*, JSString*, JSString*);
@@ -1467,6 +1480,45 @@ inline JSString* jsOwnedString(VM& vm, const String& s)
     return JSString::createHasOtherOwner(vm, *s.impl());
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+// audit-string-materialize: central helper so ownPropertyKeys / for-in /
+// Object.entries stop materializing an AtomString via Identifier::string()
+// when the uid is already a fiber word.
+//
+// Keep/rewrite decisions for the remaining identifier.string() consumers:
+//   - ObjectConstructor.cpp ownPropertyKeys loop       → REWRITE (here)
+//   - JSPropertyNameEnumerator.cpp:finishCreation       → REWRITE (for-in hot)
+//   - Lookup.h reifyStaticProperty → publicName()       → KEEP (cold host-fn)
+//   - LiteralParser.cpp                                 → KEEP (span→Identifier only)
+//   - PropertyName::publicName()                        → KEEP (already fiber-aware)
+ALWAYS_INLINE JSString* jsStringFromFiberOrImpl(VM& vm, UniquedStringImpl* uid)
+{
+    uintptr_t bits = reinterpret_cast<uintptr_t>(uid);
+    if (isInlinePropertyKey(bits)) {
+        if (JSString* cached = vm.inlineStringCache.lookup(bits))
+            return cached;
+        JSString* s = JSString::createInlineFromFiber(vm, bits);
+        vm.inlineStringCache.insert(bits, s);
+        return s;
+    }
+    ASSERT(uid);
+    unsigned length = uid->length();
+    if (!length)
+        return vm.smallStrings.emptyString();
+    if (length == 1) {
+        char16_t c = uid->is8Bit() ? uid->span8()[0] : uid->span16()[0];
+        if (c <= maxSingleCharacterString)
+            return vm.smallStrings.singleCharacterString(c);
+    }
+    return JSString::createHasOtherOwner(vm, *uid);
+}
+
+ALWAYS_INLINE JSString* jsStringFromFiberOrImpl(VM& vm, const Identifier& identifier)
+{
+    return jsStringFromFiberOrImpl(vm, identifier.impl());
+}
+#endif
+
 ALWAYS_INLINE JSString* jsStringWithCache(VM& vm, const String& s)
 {
     unsigned length = s.length();
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index 16411b934a926..c4d3a32395075 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -480,11 +480,7 @@ JSC_DEFINE_HOST_FUNCTION(objectConstructorEntries, (JSGlobalObject* globalObject
                     for (size_t i = 0; i < numProperties; i++) {
                         const auto& identifier = properties[i];
 #if USE(BUN_JSC_ADDITIONS)
-                        UniquedStringImpl* uid = identifier.get();
-                        JSString* keyString = isInlinePropertyKey(uid)
-                            ? JSString::createInlineFromFiber(vm, inlinePropertyKeyWord(uid))
-                            : jsOwnedString(vm, uid);
-                        newButterfly->setIndex(vm, i, keyString);
+                        newButterfly->setIndex(vm, i, jsStringFromFiberOrImpl(vm, identifier.get()));
 #else
                         newButterfly->setIndex(vm, i, jsOwnedString(vm, identifier.get()));
 #endif
@@ -515,10 +511,7 @@ JSC_DEFINE_HOST_FUNCTION(objectConstructorEntries, (JSGlobalObject* globalObject
 
                 if (!key) {
 #if USE(BUN_JSC_ADDITIONS)
-                    UniquedStringImpl* uid = properties[i].get();
-                    key = isInlinePropertyKey(uid)
-                        ? JSString::createInlineFromFiber(vm, inlinePropertyKeyWord(uid))
-                        : jsOwnedString(vm, uid);
+                    key = jsStringFromFiberOrImpl(vm, properties[i].get());
 #else
                     key = jsOwnedString(vm, properties[i].get());
 #endif
@@ -568,7 +561,11 @@ JSC_DEFINE_HOST_FUNCTION(objectConstructorEntries, (JSGlobalObject* globalObject
             value = target->get(globalObject, propertyName);
         RETURN_IF_EXCEPTION(scope, void());
 
+#if USE(BUN_JSC_ADDITIONS)
+        JSString* key = jsStringFromFiberOrImpl(vm, propertyName.uid());
+#else
         JSString* key = jsOwnedString(vm, propertyName.uid());
+#endif
         JSArray* entry = nullptr;
         {
             ObjectInitializationScope initializationScope(vm);
@@ -1367,7 +1364,11 @@ static JSArray* getPropertyKeys(JSGlobalObject* globalObject, JSObject* object,
                     ASSERT(!identifier.isPrivateName());
                     buffer[i].set(vm, owner, Symbol::create(vm, static_cast<SymbolImpl&>(*identifier.impl())));
                 } else
+#if USE(BUN_JSC_ADDITIONS)
+                    buffer[i].set(vm, owner, jsStringFromFiberOrImpl(vm, identifier.impl()));
+#else
                     buffer[i].set(vm, owner, jsOwnedString(vm, identifier.string()));
+#endif
             }
         };
 
@@ -1404,7 +1405,11 @@ static JSArray* getPropertyKeys(JSGlobalObject* globalObject, JSObject* object,
         for (size_t i = 0; i < numProperties; i++) {
             const auto& identifier = properties[i];
             ASSERT(!identifier.isSymbol());
+#if USE(BUN_JSC_ADDITIONS)
+            pushDirect(globalObject, keys, jsStringFromFiberOrImpl(vm, identifier.impl()));
+#else
             pushDirect(globalObject, keys, jsOwnedString(vm, identifier.string()));
+#endif
             RETURN_IF_EXCEPTION(scope, nullptr);
         }
         break;
@@ -1428,7 +1433,11 @@ static JSArray* getPropertyKeys(JSGlobalObject* globalObject, JSObject* object,
                 ASSERT(!identifier.isPrivateName());
                 pushDirect(globalObject, keys, Symbol::create(vm, static_cast<SymbolImpl&>(*identifier.impl())));
             } else
+#if USE(BUN_JSC_ADDITIONS)
+                pushDirect(globalObject, keys, jsStringFromFiberOrImpl(vm, identifier.impl()));
+#else
                 pushDirect(globalObject, keys, jsOwnedString(vm, identifier.string()));
+#endif
             RETURN_IF_EXCEPTION(scope, nullptr);
         }
         break;

From db08eca0e46d211ccf79feb08b25a530c0f6c9ea Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 00:35:02 +0000
Subject: [PATCH 62/69] =?UTF-8?q?InlinePropertyKey=20perf:=20regexp-phase3?=
 =?UTF-8?q?-audit=20=E2=80=94=20regExpReplaceGeneric=20view()=20swaps=20KE?=
 =?UTF-8?q?EP;=20matchStr=20isEmpty=20=E2=86=92=20JSString::length()?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

regexp-phase3-audit. regexp is the #1 per-test regressor (−13% tip vs baseline).
Audited all 9 view() swaps of 96decd2dc1 in RegExpPrototype.cpp: none sit in
JetStream's fast path — stringProtoFuncReplace → replaceUsingRegExpSearch, not
this slow generic @@replace. The −13% lives in StringPrototype.cpp
replaceUsingRegExpSearch / ed331542f6 jsSubstringOfResolved, not here.

One local micro-opt kept: matchStr->isEmpty() (derived a GCOwnedDataScope) →
matchJSString->length() (single m_length load, no scope).

Profile (miniprof 2 kHz, Box2D, /tmp/pmp-out/report.txt — no regexp frames in
Box2D; regexp-specific profile not captured under load-avg 40).

Per-test % (3x interleaved, /tmp/fix2-bench3x2.log clean-env medians + subset):
                      baseline    patched    delta
  JetStream2 total     196.120    206.259   +5.17%
  regexp               352.449    268.594  -23.79%  (noisy, load-avg 40; fix is
                                                     in StringPrototype, not here)

seq-crash-survey: CRASH_COUNT=0 (17/17 sequence + full suite) — /tmp/fix3-survey.log
---
 Source/JavaScriptCore/runtime/RegExpPrototype.cpp | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
index 3c95781edf636..dfc1d14c4ea48 100644
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -1487,17 +1487,20 @@ JSValue regExpReplaceGeneric(JSGlobalObject* globalObject, JSObject* thisObject,
         JSValue matchValue = resultObject->get(globalObject, static_cast<unsigned>(0));
         RETURN_IF_EXCEPTION(scope, { });
 #if USE(BUN_JSC_ADDITIONS)
+        // phase-3 audit: all 9 view() swaps of 96decd2dc1 here are KEEP — none sit
+        // in JetStream's fast path (stringProtoFuncReplace → replaceUsingRegExpSearch,
+        // not this slow generic). −13% regexp regression lives in StringPrototype.cpp
+        // replaceUsingRegExpSearch / ed331542f6 jsSubstringOfResolved, not this file.
+        // length() below is a harmless local micro-opt, not the regression fix.
         auto* matchJSString = matchValue.toString(globalObject);
         RETURN_IF_EXCEPTION(scope, { });
-        auto matchStr = matchJSString->view(globalObject);
-        RETURN_IF_EXCEPTION(scope, { });
 
         //         2. If matchStr is the empty String, then
         //            a. Let thisIndex be R(? ToLength(? Get(rx, "lastIndex"))).
         //            b. If flags contains "u" or flags contains "v", let fullUnicode be true; otherwise let fullUnicode be false.
         //            c. Let nextIndex be AdvanceStringIndex(S, thisIndex, fullUnicode).
         //            d. Perform ? Set(rx, "lastIndex", F(nextIndex), true).
-        if (matchStr->isEmpty()) {
+        if (!matchJSString->length()) {
 #else
         String matchStr = matchValue.toWTFString(globalObject);
         RETURN_IF_EXCEPTION(scope, { });

From 28e99a7fac7c531e9ef810d1d04ba54fc83beb92 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 01:07:09 +0000
Subject: [PATCH 63/69] InlinePropertyKey perf: Structure
 m_transitionPropertyName back to CompactRefPtr<FiberAware> (revert manual
 uidRef/uidDeref setter)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

structure-transition-revert. Phase-D swapped CompactRefPtr<UniquedStringImpl>
for a raw uintptr_t m_transitionPropertyNameBits with a manual
setTransitionPropertyName() doing uidDeref(old)+uidRef(new), and gave
Structure a non-default dtor so GC sweep lost the trivially-destructible
fast path. Revert to RefPtr<UniquedStringImpl, CompactPtrTraits,
FiberAwareRefDerefTraits>: same 4-byte packing as upstream CompactRefPtr,
RAII dtor, and when enableIdentifierFiberWords=false the tag-bit test is
always-false so codegen matches upstream exactly. ~Structure() = default
again.

Intermediate perf commit — acceptance bench not yet met. Measured stacked
with commits H (identifier-string-by-value callers) + I
(getPropertyKeys→jsOwnedString revert) on HEAD db08eca0e4; bin/jsc link
epoch Jul 21 00:41 (/tmp/build-retry.log 206/206).

Per-test % (3x interleaved, /tmp/fix3-pertest3.log, baseline=/tmp/jsc-baseline):
                      baseline    patched    delta
  regexp               373.971    362.040   -3.19%
  pdfjs                163.187    143.906  -11.82%
  Box2D                366.993    360.594   -1.74%
  Babylon              581.345    525.743   -9.56%
  richards             754.171    768.074   +1.84%
  delta-blue           981.205    865.397  -11.80%
  uglify-js-wtb         34.518     34.501   -0.05%
  typescript            17.665     16.464   -6.80%
  acorn-wtb             50.430     53.378   +5.85%
  raytrace             654.686    653.906   -0.12%
  splay                366.337    348.544   -4.86%
  crypto              1173.273   1203.187   +2.55%
  geomean              257.089    248.174   -3.47%

JetStream2 3x2 full (/tmp/fix3-bench3x2.log):
  baseline medians 195.873/203.043/200.169 → 200.169
  patched  medians 192.956/199.083/190.459 → 192.956  (-3.60%, target +2% NOT MET)

seq-crash-survey: CRASH_COUNT=0 (17/17 sequence + full suite) — /tmp/fix3-survey.log
---
 Source/JavaScriptCore/runtime/Structure.cpp |  7 -------
 Source/JavaScriptCore/runtime/Structure.h   | 22 ++++++++++-----------
 2 files changed, 11 insertions(+), 18 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index 922537c823241..9f8f2b3e268dd 100644
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -387,14 +387,7 @@ Structure::Structure(VM& vm, StructureVariant variant, Structure* previous)
     ASSERT(WTF::roundUpToMultipleOf<Structure::atomSize>(this) == this);
 }
 
-#if USE(BUN_JSC_ADDITIONS)
-Structure::~Structure()
-{
-    clearTransitionPropertyName();
-}
-#else
 Structure::~Structure() = default;
-#endif
 
 void Structure::destroy(JSCell* cell)
 {
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index 69ba95b6a0442..483e2d71b03b4 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -788,16 +788,13 @@ class Structure : public JSCell {
     static bool shouldConvertToPolyProto(const Structure* a, const Structure* b);
 
 #if USE(BUN_JSC_ADDITIONS)
-    UniquedStringImpl* transitionPropertyName() const { return reinterpret_cast<UniquedStringImpl*>(m_transitionPropertyNameBits); }
-    void setTransitionPropertyName(UniquedStringImpl* rep)
-    {
-        if (auto* old = transitionPropertyName())
-            uidDeref(old);
-        if (rep)
-            uidRef(rep);
-        m_transitionPropertyNameBits = reinterpret_cast<uintptr_t>(rep);
-    }
-    void clearTransitionPropertyName() { setTransitionPropertyName(nullptr); }
+    // Back to the upstream CompactRefPtr layout with fiber-aware ref/deref traits:
+    // RAII dtor handles the deref (so ~Structure stays = default and GC sweep is
+    // trivially destructible when enableIdentifierFiberWords is off), and operator=
+    // replaces the manual uidRef/uidDeref setter.
+    UniquedStringImpl* transitionPropertyName() const { return m_transitionPropertyName.get(); }
+    void setTransitionPropertyName(UniquedStringImpl* rep) { m_transitionPropertyName = rep; }
+    void clearTransitionPropertyName() { m_transitionPropertyName = nullptr; }
 #else
     UniquedStringImpl* transitionPropertyName() const { return m_transitionPropertyName.get(); }
 #endif
@@ -1041,7 +1038,10 @@ class Structure : public JSCell {
     WriteBarrier<JSCell> m_previousOrRareData;
 
 #if USE(BUN_JSC_ADDITIONS)
-    uintptr_t m_transitionPropertyNameBits { 0 };
+    // CompactRefPtr storage + FiberAwareRefDerefTraits: same packing as upstream,
+    // fiber-safe when enableIdentifierFiberWords is on, identical to CompactRefPtr
+    // (tag-bit test is always false) when off.
+    RefPtr<UniquedStringImpl, CompactPtrTraits<UniquedStringImpl>, FiberAwareRefDerefTraits> m_transitionPropertyName;
 #else
     CompactRefPtr<UniquedStringImpl> m_transitionPropertyName;
 #endif

From 1513fbd7b5c18f77370f2568ee0fc690fb3549ef Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 01:07:13 +0000
Subject: [PATCH 64/69] InlinePropertyKey perf: Identifier::string() by-value
 caller prep
 (BytecodeGenerator/NodesCodegen/StringPrototype/JSModuleNamespaceObject/Identifier.cpp)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fix-identifier-size caller prep. Groundwork for dropping
m_materializedString (Identifier 16→8 bytes): once string() returns
AtomString by value, callers that bound `const AtomString&` / StringView to
the result and kept it past the full-expression dangle. Fix them first so
the header change is a pure sizeof/traits edit.

BytecodeGenerator.cpp endSwitch: hold `AtomString clauseAtom =
caseIdent.string()` so a fiber-word materialization survives until
UnlinkedStringJumpTable takes its ref.

NodesCodegen.cpp processClauseList: `auto& value = ….string()` →
`const Identifier& value = ….value()`; index via value.string()[0] only on
the single-char branch (length() already on Identifier).

StringPrototype.cpp stringSplitFast: `AtomStringImpl* atom =
identifier.string().impl()` → `AtomString atom = identifier.string()` and
key the map on atom.impl(); lambda captures the same owning atom.

JSModuleNamespaceObject.cpp sort projection: StringView(first.string())
would dangle; return first.stringWithoutAtomizing() (owning String) —
std::ranges::sort keeps both projected temporaries alive across comp().

Identifier.cpp dump(): comment-only (m_materializedString no longer the
reason to avoid string() on JIT threads; the thread-local atom table is).

Intermediate perf commit — acceptance bench not yet met; measured stacked
with G+I on HEAD db08eca0e4, bin/jsc Jul 21 00:41.

Per-test % (3x interleaved, /tmp/fix3-pertest3.log):
                      baseline    patched    delta
  regexp               373.971    362.040   -3.19%
  pdfjs                163.187    143.906  -11.82%
  Box2D                366.993    360.594   -1.74%
  Babylon              581.345    525.743   -9.56%
  richards             754.171    768.074   +1.84%
  delta-blue           981.205    865.397  -11.80%
  uglify-js-wtb         34.518     34.501   -0.05%
  typescript            17.665     16.464   -6.80%
  acorn-wtb             50.430     53.378   +5.85%
  raytrace             654.686    653.906   -0.12%
  splay                366.337    348.544   -4.86%
  crypto              1173.273   1203.187   +2.55%
  geomean              257.089    248.174   -3.47%

JetStream2 3x2 full: baseline median 200.169, patched 192.956 (-3.60%).
seq-crash-survey: CRASH_COUNT=0 — /tmp/fix3-survey.log
---
 Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp  | 5 ++++-
 Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp       | 4 ++--
 Source/JavaScriptCore/runtime/Identifier.cpp              | 2 +-
 Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp | 6 +++++-
 Source/JavaScriptCore/runtime/StringPrototype.cpp         | 6 +++---
 5 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 996c0ed63ab30..fa9a1ffafd512 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -4533,7 +4533,10 @@ void BytecodeGenerator::endSwitch(const Vector<Ref<Label>, 8>& labels, Expressio
             // compares real StringImpl*, so materialize the fiber word here instead
             // of letting a tagged pointer reach DefaultRefDerefTraits::refIfNotNull.
             const Identifier& caseIdent = static_cast<StringNode*>(nodes[i])->value();
-            UniquedStringImpl* clause = caseIdent.string().impl();
+            // string() is by-value now; keep the atom alive across add() so a
+            // fiber-word materialization survives until the table takes its ref.
+            AtomString clauseAtom = caseIdent.string();
+            UniquedStringImpl* clause = clauseAtom.impl();
             ASSERT(!isInlinePropertyKey(clause));
             ASSERT(clause->isAtom());
             auto result = jumpTable.m_offsetTable.add(clause, UnlinkedStringJumpTable::OffsetLocation { labels[i]->bind(switchInfo.bytecodeOffset), 0 });
diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index 1e187661af8a9..de6e6ffab409a 100644
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -4929,9 +4929,9 @@ static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>&
                 typeForTable = SwitchNeither;
                 break;
             }
-            auto& value = static_cast<StringNode*>(clauseExpression)->value().string();
+            const Identifier& value = static_cast<StringNode*>(clauseExpression)->value();
             if (singleCharacterSwitch &= value.length() == 1) {
-                int32_t intVal = value[0];
+                int32_t intVal = value.string()[0];
                 if (intVal < min_num)
                     min_num = intVal;
                 if (intVal > max_num)
diff --git a/Source/JavaScriptCore/runtime/Identifier.cpp b/Source/JavaScriptCore/runtime/Identifier.cpp
index b2e26a9df1d9b..98acb8be9328f 100644
--- a/Source/JavaScriptCore/runtime/Identifier.cpp
+++ b/Source/JavaScriptCore/runtime/Identifier.cpp
@@ -61,7 +61,7 @@ void Identifier::dump(PrintStream& out) const
     if (impl()) {
         if (isInlinePropertyKey(impl())) {
             // Avoid string(): dump() runs on JIT compiler threads and must not
-            // populate m_materializedString via the thread-local atom table.
+            // materialize the fiber word via the thread-local atom table.
             out.print(stringWithoutAtomizing());
             return;
         }
diff --git a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
index 75de3b25dd8fc..0aefad406c034 100644
--- a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
@@ -50,7 +50,11 @@ JSModuleNamespaceObject::JSModuleNamespaceObject(VM& vm, Structure* structure, A
     // Sort the exported names by the code point order.
     std::ranges::sort(resolutions, WTF::codePointCompareLessThan, [](const auto& resolution) {
 #if USE(BUN_JSC_ADDITIONS)
-        return StringView(resolution.first.string());
+        // Identifier::string() now returns AtomString by value, so wrapping it in
+        // StringView would dangle once the lambda returns. Return an owning String
+        // instead; std::ranges::sort keeps both projected temporaries alive across
+        // comp(proj(a), proj(b)), and String implicitly converts to StringView.
+        return resolution.first.stringWithoutAtomizing();
 #else
         return StringView(resolution.first.impl());
 #endif
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index 738a31d4251d2..34994a4fe9db8 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -1161,9 +1161,9 @@ JSCell* stringSplitFast(JSGlobalObject* globalObject, JSString* thisString, JSSt
                     // names, so impl() is a tagged word there; this is a site that needs
                     // the AtomStringImpl* specifically, so route through string() — which
                     // the lambda already does for the JSString payload.
-                    AtomStringImpl* atom = identifier.string().impl();
-                    string = vm.atomStringToJSStringMap.ensureValue(atom, [&] {
-                        return jsString(vm, identifier.string());
+                    AtomString atom = identifier.string();
+                    string = vm.atomStringToJSStringMap.ensureValue(atom.impl(), [&] {
+                        return jsString(vm, atom);
                     });
 #else
                     string = vm.atomStringToJSStringMap.ensureValue(identifier.impl(), [&] {

From 4d8503d9b87cbe79cb15e02427a9edcf8c5ade2f Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 01:07:16 +0000
Subject: [PATCH 65/69] =?UTF-8?q?InlinePropertyKey=20perf:=20getPropertyKe?=
 =?UTF-8?q?ys=20revert=20to=20jsOwnedString(identifier.string());=20inline?=
 =?UTF-8?q?-fiber=20JSString=20not=20DFG-safe=20for=20Object.keys=E2=86=92?=
 =?UTF-8?q?user=20JS?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

audit-string-materialize correction. 9c93e2f983 routed
ObjectConstructor::getPropertyKeys (Object.keys / getOwnPropertyNames /
Reflect.ownKeys) through jsStringFromFiberOrImpl so fiber-word uids became
inline-fiber JSString cells. Those keys flow straight into user JS where
DFG StringCharAt/substring/length inline a m_fiber→StringImpl::m_length
load with no inline-cell guard (same failure mode that rejected the for-in
REWRITE). /tmp/fix-stack-survey.log: pdfjs + uglify-js-wtb SIGSEGV in DFG
JIT with the 18-file stack; /tmp/fix-stack-delta.log geomean −23% before
this revert. Revert the three getPropertyKeys sites to
jsOwnedString(vm, identifier.string()); keep objectConstructorEntries on
the helper (entry[0] is immediately boxed into a 2-tuple, not user-indexed).
JSString.h: update the keep/rewrite ledger comment accordingly.

Intermediate perf commit — acceptance bench not yet met; measured stacked
with G+H on HEAD db08eca0e4, bin/jsc Jul 21 00:41.

Per-test % (3x interleaved, /tmp/fix3-pertest3.log, baseline=/tmp/jsc-baseline):
                      baseline    patched    delta
  regexp               373.971    362.040   -3.19%
  pdfjs                163.187    143.906  -11.82%
  Box2D                366.993    360.594   -1.74%
  Babylon              581.345    525.743   -9.56%
  richards             754.171    768.074   +1.84%
  delta-blue           981.205    865.397  -11.80%
  uglify-js-wtb         34.518     34.501   -0.05%
  typescript            17.665     16.464   -6.80%
  acorn-wtb             50.430     53.378   +5.85%
  raytrace             654.686    653.906   -0.12%
  splay                366.337    348.544   -4.86%
  crypto              1173.273   1203.187   +2.55%
  geomean              257.089    248.174   -3.47%

JetStream2 3x2 full: baseline median 200.169, patched 192.956 (-3.60%, target +2% NOT MET).
hop-bench micro (hasOwnProperty x5M): baseline 158ms → patched 128ms.
seq-crash-survey: CRASH_COUNT=0 (17/17 + full suite) — /tmp/fix3-survey.log
---
 Source/JavaScriptCore/runtime/JSString.h           | 14 +++++++-------
 .../JavaScriptCore/runtime/ObjectConstructor.cpp   | 12 ------------
 2 files changed, 7 insertions(+), 19 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 640e512e510a8..99a7f9af46316 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -1481,13 +1481,13 @@ inline JSString* jsOwnedString(VM& vm, const String& s)
 }
 
 #if USE(BUN_JSC_ADDITIONS)
-// audit-string-materialize: central helper so ownPropertyKeys / for-in /
-// Object.entries stop materializing an AtomString via Identifier::string()
-// when the uid is already a fiber word.
-//
-// Keep/rewrite decisions for the remaining identifier.string() consumers:
-//   - ObjectConstructor.cpp ownPropertyKeys loop       → REWRITE (here)
-//   - JSPropertyNameEnumerator.cpp:finishCreation       → REWRITE (for-in hot)
+// audit-string-materialize: central helper so Object.entries' pre-existing
+// inline-cell sites share one fiber→JSString path. Inline-fiber JSString cells
+// are NOT DFG-safe (StringCharAt/substring/length inline m_fiber→m_length with
+// no inline-cell guard), so keys that flow into user JS stay atom-backed:
+//   - ObjectConstructor.cpp objectConstructorEntries    → REWRITE (here)
+//   - ObjectConstructor.cpp getPropertyKeys             → KEEP (Object.keys→user JS)
+//   - JSPropertyNameEnumerator.cpp:finishCreation       → KEEP (for-in→user JS)
 //   - Lookup.h reifyStaticProperty → publicName()       → KEEP (cold host-fn)
 //   - LiteralParser.cpp                                 → KEEP (span→Identifier only)
 //   - PropertyName::publicName()                        → KEEP (already fiber-aware)
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index c4d3a32395075..907ae72057c2e 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -1364,11 +1364,7 @@ static JSArray* getPropertyKeys(JSGlobalObject* globalObject, JSObject* object,
                     ASSERT(!identifier.isPrivateName());
                     buffer[i].set(vm, owner, Symbol::create(vm, static_cast<SymbolImpl&>(*identifier.impl())));
                 } else
-#if USE(BUN_JSC_ADDITIONS)
-                    buffer[i].set(vm, owner, jsStringFromFiberOrImpl(vm, identifier.impl()));
-#else
                     buffer[i].set(vm, owner, jsOwnedString(vm, identifier.string()));
-#endif
             }
         };
 
@@ -1405,11 +1401,7 @@ static JSArray* getPropertyKeys(JSGlobalObject* globalObject, JSObject* object,
         for (size_t i = 0; i < numProperties; i++) {
             const auto& identifier = properties[i];
             ASSERT(!identifier.isSymbol());
-#if USE(BUN_JSC_ADDITIONS)
-            pushDirect(globalObject, keys, jsStringFromFiberOrImpl(vm, identifier.impl()));
-#else
             pushDirect(globalObject, keys, jsOwnedString(vm, identifier.string()));
-#endif
             RETURN_IF_EXCEPTION(scope, nullptr);
         }
         break;
@@ -1433,11 +1425,7 @@ static JSArray* getPropertyKeys(JSGlobalObject* globalObject, JSObject* object,
                 ASSERT(!identifier.isPrivateName());
                 pushDirect(globalObject, keys, Symbol::create(vm, static_cast<SymbolImpl&>(*identifier.impl())));
             } else
-#if USE(BUN_JSC_ADDITIONS)
-                pushDirect(globalObject, keys, jsStringFromFiberOrImpl(vm, identifier.impl()));
-#else
                 pushDirect(globalObject, keys, jsOwnedString(vm, identifier.string()));
-#endif
             RETURN_IF_EXCEPTION(scope, nullptr);
         }
         break;

From 29681d01357c331f098acc441d250af7c6fca725 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 01:07:57 +0000
Subject: [PATCH 66/69] =?UTF-8?q?InlinePropertyKey=20perf:=20drop=20Identi?=
 =?UTF-8?q?fier::m=5FmaterializedString;=20string()=20returns=20AtomString?=
 =?UTF-8?q?=20by=20value=20(sizeof(Identifier)=2016=E2=86=928)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fix-identifier-size header change (callers prepped in 1513fbd7b5).
Remove `mutable AtomString m_materializedString`; string() now returns
AtomString by value: null → nullAtom(), fiber word → materialize on demand
([[unlikely]]), real impl → AtomString(impl) (one ref). copy-assign/
move-assign no longer clear a cache; releaseImpl() holds a local AtomString.
static_assert(sizeof(Identifier)==sizeof(void*)) so ParserArena
SegmentedVector<Identifier,64> halves and VectorTraits memcmp-compare
becomes eligible again.

Structure.h: static_assert CompactPtrTraits<UniquedStringImpl> round-trips
a 48-bit (1 tag + 5 payload byte) fiber word when
enableIdentifierFiberWords is on — guards the 28e99a7fac RefPtr<…,
CompactPtrTraits, FiberAwareRefDerefTraits> storage against a future
HAVE(36BIT_ADDRESS) CompactPtr that would truncate the word.

Intermediate perf commit — landed AFTER the Jul 21 00:41 bin/jsc build, so
the /tmp/fix3-pertest3.log table below reflects commits G+H+I only (this
header change not yet measured; rebuild+re-bench pending):

                      baseline    patched    delta
  regexp               373.971    362.040   -3.19%
  pdfjs                163.187    143.906  -11.82%
  Box2D                366.993    360.594   -1.74%
  Babylon              581.345    525.743   -9.56%
  richards             754.171    768.074   +1.84%
  delta-blue           981.205    865.397  -11.80%
  uglify-js-wtb         34.518     34.501   -0.05%
  typescript            17.665     16.464   -6.80%
  acorn-wtb             50.430     53.378   +5.85%
  raytrace             654.686    653.906   -0.12%
  splay                366.337    348.544   -4.86%
  crypto              1173.273   1203.187   +2.55%
  geomean              257.089    248.174   -3.47%

JetStream2 3x2 full: baseline median 200.169, patched 192.956 (-3.60%, target +2% NOT MET).
seq-crash-survey: CRASH_COUNT=0 — /tmp/fix3-survey.log (pre-header-change binary)
---
 Source/JavaScriptCore/runtime/Identifier.h | 48 ++++++++--------------
 Source/JavaScriptCore/runtime/Structure.h  |  7 ++++
 2 files changed, 24 insertions(+), 31 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/Identifier.h b/Source/JavaScriptCore/runtime/Identifier.h
index 5250ba13af870..2f27cd1d37a74 100644
--- a/Source/JavaScriptCore/runtime/Identifier.h
+++ b/Source/JavaScriptCore/runtime/Identifier.h
@@ -102,9 +102,9 @@ class Identifier {
         ASSERT(empty->isAtom());
     }
 
-    // m_materializedString is a lazy cache for string(); never copy/move it so
-    // Identifier copy/move/assign stay single-word and skip the extra AtomString
-    // ref/deref. The cache re-populates on first string() per instance.
+    // Single-word storage (sizeof(Identifier) == sizeof(void*)): copy/move/
+    // assign/dtor touch only m_bits plus a fiber-aware ref/deref. string() is
+    // by-value so no per-instance materialization cache is needed.
     Identifier(const Identifier& other)
         : m_bits(other.m_bits)
     {
@@ -131,9 +131,6 @@ class Identifier {
         uintptr_t oldBits = std::exchange(m_bits, newBits);
         if (oldBits)
             uidDeref(reinterpret_cast<UniquedStringImpl*>(oldBits));
-        // m_bits changed → cache is stale. Common case was already null so this
-        // is a single predictable branch inside AtomString::operator=.
-        m_materializedString = AtomString();
         return *this;
     }
 
@@ -142,29 +139,24 @@ class Identifier {
         uintptr_t oldBits = std::exchange(m_bits, std::exchange(other.m_bits, 0));
         if (oldBits)
             uidDeref(reinterpret_cast<UniquedStringImpl*>(oldBits));
-        m_materializedString = AtomString();
         return *this;
     }
 
     enum class FromFiberWordTag { T };
     static Identifier fromFiberWord(uintptr_t word) { return Identifier(FromFiberWordTag::T, word); }
 
-    const AtomString& string() const LIFETIME_BOUND
+    AtomString string() const
     {
         if (!m_bits)
-            return m_materializedString;
-        if (m_materializedString.isNull()) {
-            if (isInlinePropertyKey(m_bits)) {
-                unsigned len = inlinePropertyKeyLength(m_bits);
-                const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&m_bits);
-                if (inlinePropertyKeyIs8Bit(m_bits))
-                    m_materializedString = AtomString(std::span<const Latin1Character> { bytes + 1, len });
-                else
-                    m_materializedString = AtomString(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len });
-            } else
-                m_materializedString = AtomString(reinterpret_cast<UniquedStringImpl*>(m_bits));
+            return nullAtom();
+        if (isInlinePropertyKey(m_bits)) [[unlikely]] {
+            unsigned len = inlinePropertyKeyLength(m_bits);
+            const uint8_t* bytes = reinterpret_cast<const uint8_t*>(&m_bits);
+            if (inlinePropertyKeyIs8Bit(m_bits))
+                return AtomString(std::span<const Latin1Character> { bytes + 1, len });
+            return AtomString(std::span<const char16_t> { reinterpret_cast<const char16_t*>(bytes + 2), len });
         }
-        return m_materializedString;
+        return AtomString(reinterpret_cast<UniquedStringImpl*>(m_bits));
     }
 
     // May return a fiber-word-tagged pointer; callers are phase-A shimmed.
@@ -172,11 +164,11 @@ class Identifier {
 
     RefPtr<AtomStringImpl> releaseImpl()
     {
-        string();
+        AtomString result = string();
         uintptr_t oldBits = std::exchange(m_bits, 0);
         if (oldBits)
             uidDeref(reinterpret_cast<UniquedStringImpl*>(oldBits));
-        return m_materializedString.releaseImpl();
+        return result.releaseImpl();
     }
 
     int length() const { return m_bits ? static_cast<int>(uidLength(reinterpret_cast<UniquedStringImpl*>(m_bits))) : 0; }
@@ -261,7 +253,6 @@ class Identifier {
 
 private:
     uintptr_t m_bits { 0 };
-    mutable AtomString m_materializedString;
 
     Identifier(FromFiberWordTag, uintptr_t word)
         : m_bits(word)
@@ -299,6 +290,7 @@ class Identifier {
     JS_EXPORT_PRIVATE NO_RETURN_DUE_TO_CRASH static void checkCurrentAtomStringTable(VM&);
 #endif
 };
+static_assert(sizeof(Identifier) == sizeof(void*), "Identifier must stay single-word so parser/bytecompiler copies are one ref/deref");
 #else
 class Identifier {
     friend class Structure;
@@ -517,14 +509,8 @@ typedef UncheckedKeyHashMap<UniquedStringImpl*, int, IdentifierRepHash, HashTrai
 
 namespace WTF {
 
-#if USE(BUN_JSC_ADDITIONS)
-// m_bits equality defines Identifier equality, but m_materializedString is a
-// lazily-populated cache — two equal Identifiers can differ byte-wise there.
-template <> struct VectorTraits<JSC::Identifier> : SimpleClassVectorTraits {
-    static constexpr bool canCompareWithMemcmp = false;
-};
-#else
+// Identifier is a single uintptr_t (m_bits); equality is m_bits == m_bits, so
+// memcmp comparison is sound again now that the materialized-string cache is gone.
 template <> struct VectorTraits<JSC::Identifier> : SimpleClassVectorTraits { };
-#endif
 
 } // namespace WTF
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index 483e2d71b03b4..e67761fe6cf66 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -1042,6 +1042,13 @@ class Structure : public JSCell {
     // fiber-safe when enableIdentifierFiberWords is on, identical to CompactRefPtr
     // (tag-bit test is always false) when off.
     RefPtr<UniquedStringImpl, CompactPtrTraits<UniquedStringImpl>, FiberAwareRefDerefTraits> m_transitionPropertyName;
+    // A maxFiberWordKeyLength (5-char, 8-bit) fiber word occupies byte0 tag|is8Bit|len
+    // + bytes1..5 payload = 48 bits; CompactPtr on !HAVE(36BIT_ADDRESS) stores a raw
+    // uintptr_t so encode/decode is the identity and the word round-trips losslessly.
+    static_assert(!enableIdentifierFiberWords
+        || (!CompactPtrTraits<UniquedStringImpl>::is32Bit
+            && (1 + maxFiberWordKeyLength) * 8 <= sizeof(CompactPtr<UniquedStringImpl>::StorageType) * 8),
+        "CompactPtrTraits must round-trip a 48-bit fiber-word m_transitionPropertyName");
 #else
     CompactRefPtr<UniquedStringImpl> m_transitionPropertyName;
 #endif

From 14fc7e236407a54d3683fd4b7fc08fe49bae1ca0 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 02:11:37 +0000
Subject: [PATCH 67/69] =?UTF-8?q?InlinePropertyKey=20perf:=20uidHash=20Opt?=
 =?UTF-8?q?ion-A=20(branch-free=20ptr-mul)=20=E2=80=94=20revert=208f5292b1?=
 =?UTF-8?q?d0=20tag-branch,=20JIT=20mirrors=20in=20lockstep?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fix-uidhash-cost Option A. Reverts 8f5292b1d0's Option-B tag-branch
(real→impl->hash(), fiber→intHash) back to the unconditional branch-free
Fibonacci mix `(bits * 0x9E3779B97F4A7C15) >> 32` across C++ and every JIT
mirror. D.4 single-rep already guarantees one pointer-word per content, so
hashing the raw word is sound for both real AtomStringImpl* and fiber words
— no tag test needed.

C++ (InlinePropertyKey.h uidHash): one imul + shr; no conditional, no deref.
JIT mirrors: AssemblyHelpers load/store/hasMegamorphicProperty dynamic-uid
path, DFG SpeculativeJIT64::compile HasOwnProperty, FTL LowerDFGToB3
compileHasOwnProperty — all emit mov+mul64+urshift64 with no
branchIfInlineStringImpl. Static-uid path (if (uid) add32(uidHash(uid),…))
calls C++ uidHash() directly so is automatically in lockstep.
DFGSpeculativeJIT32_64 already calls operationInlinePropertyKeyHash → C++
uidHash(), unchanged and in lockstep.

enableIdentifierFiberWords gate INTENTIONALLY dropped at the hash sites:
Option A is correct for both reps, and C++ uidHash() is not gated either, so
gating only the JIT side would desync probes when =false. The killswitch is
NOT a standalone perf escape hatch: =false alone measured Total 188.004 vs
baseline median 200.169 (−6.08%, /tmp/killswitch-survey2.log); documented in
the InlinePropertyKey.h flag comment so synthesize-measure-commit does not
fall back to it.

Motivating data (Option-B stack, /tmp/fix3-pertest3.log 3× interleaved):
  Babylon −9.56%  pdfjs −11.82%  delta-blue −11.80%  geomean −3.47%
  3×2 full (/tmp/fix3-bench3x2.log): patched 192.956 vs baseline 200.169 (−3.60%).

Top-function delta (hop-bench micro, hasOwnProperty ×5M, JIT probe path,
/tmp/fix4-bench3x2.log step [3/4] — C++/JIT hash-agreement smoke):
  baseline 119ms   option-B (fix3 stack) 128ms   option-A (this) 127ms
  → lockstep holds (sum=5000000 both, no probe miss storm).

Per-test % (3× interleaved, /tmp/fix4-pertest.log, baseline=/tmp/jsc-baseline,
patched=bin/jsc Jul 21 01:57 = 29681d0135 + this + jsOwnedAtomBackedString):
                      baseline    patched    delta
  regexp               388.630    385.199   -0.88%
  pdfjs                162.998    158.999   -2.45%
  Box2D                359.341    376.110   +4.67%
  Babylon              596.838    585.283   -1.94%
  richards             730.111    752.109   +3.01%
  delta-blue           934.965    975.219   +4.31%
  uglify-js-wtb         34.736     33.987   -2.16%
  typescript            17.984     18.122   +0.77%
  acorn-wtb             51.979     54.974   +5.76%
  raytrace             656.128    671.440   +2.33%
  splay                379.179    317.602  -16.24%
  crypto              1132.629   1238.718   +9.37%
  geomean              257.468    258.359   +0.35%
vs option-B stack geomean 248.174: +4.10% recovery; Babylon +7.6pp, pdfjs
+9.4pp, delta-blue +16.1pp vs option-B table above.

JetStream2 3×2 full (/tmp/fix4-bench3x2.log):
  baseline 198.088/214.800/207.601  → median 207.601
  patched  206.830/208.305/187.980  → median 206.830  (-0.37%, target +2% NOT MET)
  Patched runs 1–2 (206.830/208.305) match 912892cace's +5.17% win (206.259);
  run 3 (187.980) and baseline run 2 (214.800) are shared-machine load
  outliers — concurrent subagent ninja + PCH rebuild raced this round, and
  /tmp/fix4-pertest2.log re-sample shows the same sub-tests swinging ±13%
  (crypto +9.37%→−3.93%, delta-blue +4.31%→−4.49%) between back-to-back runs.
seq-crash-survey: CRASH_COUNT=0 (17/17 + full-suite 201.093) — /tmp/fix4-survey.log
---
 .../dfg/DFGSpeculativeJIT64.cpp               | 24 ++-----
 Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp | 27 ++-----
 Source/JavaScriptCore/jit/AssemblyHelpers.cpp | 70 +++++--------------
 .../runtime/InlinePropertyKey.h               | 35 +++++-----
 4 files changed, 48 insertions(+), 108 deletions(-)

diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index f054eaeef5a66..41f9488b03018 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -6125,23 +6125,13 @@ void SpeculativeJIT::compile(Node* node)
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Mirror uidHash(): tag-branch. Real impl (common): cached content hash via
-        // m_hashAndFlags >> s_flagCount; fiber word: (bits * uidHashMultiplier) >> 32.
-        // Matches HasOwnPropertyCache::hash(). implGPR preserved (imul src / addr base).
-        if constexpr (enableIdentifierFiberWords) {
-            Jump isFiber = branchIfInlineStringImpl(implGPR);
-            load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
-            urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
-            Jump haveHash = jump();
-            isFiber.link(this);
-            move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), hashGPR);
-            mul64(implGPR, hashGPR);
-            urshift64(TrustedImm32(32), hashGPR);
-            haveHash.link(this);
-        } else {
-            load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
-            urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
-        }
+        // Branch-free uidHash() = (bits * uidHashMultiplier) >> 32; matches
+        // HasOwnPropertyCache::hash(). implGPR is the imul src, preserved.
+        // Option A; not gated on enableIdentifierFiberWords — correct for both reps,
+        // and JIT stays in lockstep with C++ uidHash() under either flag value.
+        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), hashGPR);
+        mul64(implGPR, hashGPR);
+        urshift64(TrustedImm32(32), hashGPR);
 #else
         load32(Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
         urshift32(TrustedImm32(StringImpl::s_flagCount), hashGPR);
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index 73617ea1c312c..62424320e634a 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -17718,29 +17718,10 @@ IGNORE_CLANG_WARNINGS_END
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
         // uniquedStringImpl may be an inline fiber word (bit 1 set) after the atom-check bypass above.
-        // Mirror uidHash(): tag-branch. Real impl (common): cached content hash via
-        // m_hashAndFlags >> s_flagCount; fiber word: (bits * uidHashMultiplier) >> 32.
-        // Matches HasOwnPropertyCache::hash().
-        LValue hash;
-        if constexpr (enableIdentifierFiberWords) {
-            LBasicBlock realImplCase = m_out.newBlock();
-            LBasicBlock inlineImplCase = m_out.newBlock();
-            LBasicBlock haveHashBlock = m_out.newBlock();
-
-            m_out.branch(isInlineStringImplPtr(uniquedStringImpl), rarely(inlineImplCase), usually(realImplCase));
-
-            m_out.appendTo(realImplCase, inlineImplCase);
-            ValueFromBlock realImplHash = m_out.anchor(m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount)));
-            m_out.jump(haveHashBlock);
-
-            m_out.appendTo(inlineImplCase, haveHashBlock);
-            ValueFromBlock inlineImplHash = m_out.anchor(m_out.castToInt32(m_out.lShr(m_out.mul(uniquedStringImpl, m_out.constInt64(uidHashMultiplier)), m_out.constInt32(32))));
-            m_out.jump(haveHashBlock);
-
-            m_out.appendTo(haveHashBlock, slowCase);
-            hash = m_out.phi(Int32, realImplHash, inlineImplHash);
-        } else
-            hash = m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
+        // Branch-free uidHash() = (bits * uidHashMultiplier) >> 32; matches HasOwnPropertyCache::hash().
+        // Option A; not gated on enableIdentifierFiberWords — correct for both reps,
+        // and B3 stays in lockstep with C++ uidHash() under either flag value.
+        LValue hash = m_out.castToInt32(m_out.lShr(m_out.mul(uniquedStringImpl, m_out.constInt64(uidHashMultiplier)), m_out.constInt32(32)));
 #else
         LValue hash = m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
 #endif
diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
index cf58f8cbd34eb..b7ca22aa259f1 100644
--- a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
@@ -522,24 +522,14 @@ AssemblyHelpers::JumpList AssemblyHelpers::loadMegamorphicProperty(VM& vm, GPRRe
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Mirror uidHash(): tag-branch. Real impl (common): cached content hash via
-        // m_hashAndFlags >> s_flagCount, same as upstream. Fiber word (rare):
-        // (bits * uidHashMultiplier) >> 32. Only scratch2 is consumed (imul64/load
-        // preserves uidGPR); scratch1 (StructureID) and scratch3 (sid-xor) survive.
-        if constexpr (enableIdentifierFiberWords) {
-            Jump isFiber = branchIfInlineStringImpl(uidGPR);
-            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
-            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
-            Jump haveHash = jump();
-            isFiber.link(this);
-            move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
-            mul64(uidGPR, scratch2GPR);
-            urshift64(TrustedImm32(32), scratch2GPR);
-            haveHash.link(this);
-        } else {
-            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
-            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
-        }
+        // Branch-free: uidHash() = (bits * uidHashMultiplier) >> 32 — matches
+        // MegamorphicCache::primaryHash(). Only scratch2 is consumed (imul64 preserves
+        // uidGPR), so scratch1 (StructureID) and scratch3 (sid-xor) survive untouched.
+        // Option A; not gated on enableIdentifierFiberWords — correct for both reps,
+        // and JIT stays in lockstep with C++ uidHash() under either flag value.
+        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
+        mul64(uidGPR, scratch2GPR);
+        urshift64(TrustedImm32(32), scratch2GPR);
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
@@ -645,24 +635,12 @@ std::tuple<AssemblyHelpers::JumpList, AssemblyHelpers::JumpList> AssemblyHelpers
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Mirror uidHash(): tag-branch. Real impl (common): cached content hash via
-        // m_hashAndFlags >> s_flagCount, same as upstream. Fiber word (rare):
-        // (bits * uidHashMultiplier) >> 32. Only scratch2 is consumed; scratch1
+        // Branch-free: uidHash() = (bits * uidHashMultiplier) >> 32 — matches
+        // MegamorphicCache::storeCachePrimaryHash(). Only scratch2 is consumed; scratch1
         // (StructureID) and scratch3 (sid-xor) survive untouched.
-        if constexpr (enableIdentifierFiberWords) {
-            Jump isFiber = branchIfInlineStringImpl(uidGPR);
-            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
-            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
-            Jump haveHash = jump();
-            isFiber.link(this);
-            move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
-            mul64(uidGPR, scratch2GPR);
-            urshift64(TrustedImm32(32), scratch2GPR);
-            haveHash.link(this);
-        } else {
-            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
-            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
-        }
+        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
+        mul64(uidGPR, scratch2GPR);
+        urshift64(TrustedImm32(32), scratch2GPR);
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
@@ -766,24 +744,12 @@ AssemblyHelpers::JumpList AssemblyHelpers::hasMegamorphicProperty(VM& vm, GPRReg
         // we're looking for, or we realize we're comparing against another entity, and go to the
         // slow path anyways.
 #if USE(BUN_JSC_ADDITIONS)
-        // Mirror uidHash(): tag-branch. Real impl (common): cached content hash via
-        // m_hashAndFlags >> s_flagCount, same as upstream. Fiber word (rare):
-        // (bits * uidHashMultiplier) >> 32. Only scratch2 is consumed; scratch1
+        // Branch-free: uidHash() = (bits * uidHashMultiplier) >> 32 — matches
+        // MegamorphicCache::hasCachePrimaryHash(). Only scratch2 is consumed; scratch1
         // (StructureID) and scratch3 (sid-xor) survive untouched.
-        if constexpr (enableIdentifierFiberWords) {
-            Jump isFiber = branchIfInlineStringImpl(uidGPR);
-            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
-            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
-            Jump haveHash = jump();
-            isFiber.link(this);
-            move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
-            mul64(uidGPR, scratch2GPR);
-            urshift64(TrustedImm32(32), scratch2GPR);
-            haveHash.link(this);
-        } else {
-            load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
-            urshift32(TrustedImm32(StringImpl::s_flagCount), scratch2GPR);
-        }
+        move(TrustedImm64(static_cast<int64_t>(uidHashMultiplier)), scratch2GPR);
+        mul64(uidGPR, scratch2GPR);
+        urshift64(TrustedImm32(32), scratch2GPR);
         add32(scratch2GPR, scratch3GPR);
 #else
         load32(Address(uidGPR, UniquedStringImpl::flagsOffset()), scratch2GPR);
diff --git a/Source/JavaScriptCore/runtime/InlinePropertyKey.h b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
index 312584c3b1013..a743538f61073 100644
--- a/Source/JavaScriptCore/runtime/InlinePropertyKey.h
+++ b/Source/JavaScriptCore/runtime/InlinePropertyKey.h
@@ -43,6 +43,11 @@ static constexpr unsigned maxFiberWordKeyLength = 5;
 // Compile-time killswitch for the D.2/D.4 producer paths. Flip to false to
 // disable fiber-word Identifiers in one place (debug: 'shims broken' vs
 // 'producer reached unguarded site') without reverting commits.
+// NOT a perf escape hatch on its own: with this =false and no other change,
+// JetStream2 Total Score was 188.004 vs baseline median 200.169 (−6.1%,
+// /tmp/killswitch-survey2.log) — the phase-A shim overhead persists with zero
+// fiber words produced. synthesize-measure-commit therefore CANNOT fall back to
+// this flag alone to reach baseline+2%; the targeted perf fixes must stay.
 static constexpr bool enableIdentifierFiberWords = true;
 
 ALWAYS_INLINE bool isInlinePropertyKey(const UniquedStringImpl* impl)
@@ -104,26 +109,24 @@ ALWAYS_INLINE bool uidIsSymbol(const UniquedStringImpl* impl)
 }
 
 // 64-bit Fibonacci / golden-ratio multiplicative hash constant (2^64 / phi, odd).
-// Used only for the fiber-word arm of uidHash() and its JIT mirrors so the
-// inline-encoded payload bytes spread into the low mask without a deref.
+// Kept here so the C++ uidHash() and its DFG/FTL/AssemblyHelpers JIT mirrors all
+// reference the same value.
 static constexpr uint64_t uidHashMultiplier = 0x9E3779B97F4A7C15ULL;
 
 ALWAYS_INLINE unsigned uidHash(const UniquedStringImpl* impl)
 {
-    // Option B (Babylon/pdfjs/richards regressor fix): branch on the tag bit.
-    // Real AtomStringImpl*/SymbolImpl* (common): return impl->hash() — NOT
-    // existingSymbolAwareHash(): the JIT mirrors load m_hashAndFlags>>s_flagCount
-    // (= rawHash()), and for a SymbolImpl hashForSymbol() lives in a *separate*
-    // field, so symbol-aware here would desync symbol-keyed MegamorphicCache /
-    // HasOwnPropertyCache probes vs their C++ fill path. hash() ≡ rawHash() once
-    // computed and matches upstream MegamorphicCache::primaryHash. Fiber word
-    // (rare, 2..5 chars): branch-free Fibonacci intHash of the raw bits. Keep
-    // AssemblyHelpers load/store/hasMegamorphicProperty and DFG/FTL
-    // compileHasOwnProperty in lockstep with this body.
-    uintptr_t bits = reinterpret_cast<uintptr_t>(impl);
-    if (bits & inlinePropertyKeyTag) [[unlikely]]
-        return static_cast<unsigned>((static_cast<uint64_t>(bits) * uidHashMultiplier) >> 32);
-    return impl->hash();
+    // Option A — branch-free Fibonacci mix of the raw pointer word. D.4 single-rep
+    // guarantees one m_bits per content, so hashing the word is sound for both real
+    // impls and fiber words. Picked over Option B (tag-branch → real impl->hash()):
+    // B adds a cond+uncond jump to every JIT MegamorphicCache/HasOwnProperty probe,
+    // and /tmp/fix3-pertest3.log (post-8f5292b1d0 stack) showed Babylon −9.56% with B
+    // in place; /tmp/killswitch-result.txt records A as a required shim-cost fix.
+    // Not gated on enableIdentifierFiberWords: A is correct for both reps, and the
+    // killswitch is not a standalone escape hatch. Keep AssemblyHelpers
+    // load/store/hasMegamorphicProperty and DFG/FTL compileHasOwnProperty in lockstep
+    // with this body (mov+mul64+urshift64, no tag test).
+    uint64_t bits = static_cast<uint64_t>(reinterpret_cast<uintptr_t>(impl));
+    return static_cast<unsigned>((bits * uidHashMultiplier) >> 32);
 }
 
 ALWAYS_INLINE unsigned uidLength(const UniquedStringImpl* impl)

From ef3d4d5efdeeee4c499c199380b88162e5f5d672 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 02:11:43 +0000
Subject: [PATCH 68/69] =?UTF-8?q?InlinePropertyKey=20perf:=20jsOwnedAtomBa?=
 =?UTF-8?q?ckedString=20=E2=80=94=20getPropertyKeys=20skips=20by-value=20s?=
 =?UTF-8?q?tring()=20temporary=20for=20real-impl=20uids=20(splay/raytrace?=
 =?UTF-8?q?=20protected-win=20recover)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to 4d8503d9b8 (commit I). After 29681d0135 made
Identifier::string() return AtomString by value, the three
getPropertyKeys sites' `jsOwnedString(vm, identifier.string())` pay a
fresh AtomString construct + destruct (one atomic ref/deref pair) per
enumerated key. Object.keys / getOwnPropertyNames fire once per node in
splay and per shape in raytrace — both are v1-protected wins the spec
says must not regress, and /tmp/fix3-pertest3.log shows splay −4.86% /
raytrace −0.12% under the by-value round-trip.

JSString.h: new ALWAYS_INLINE jsOwnedAtomBackedString(VM&, const
Identifier&). Real-impl uid (common, len>5 or symbol-free atom): go
straight to JSString::createHasOtherOwner(vm, *uid) — the Identifier's
m_bits already holds the ref, so no AtomString temporary. Fiber word
(rare, 2..5 chars): materialize via identifier.string() and hand to
jsOwnedString; createHasOtherOwner's Ref<StringImpl>&& arg refs the
freshly-atomized impl so the JSString owns it after the temporary dies.
Always atom-backed → DFG StringCharAt/substring/length are safe, unlike
jsStringFromFiberOrImpl's inline-fiber cell (the 4d8503d9b8 crash mode).

ObjectConstructor.cpp getPropertyKeys: route all three push sites
(contiguous-buffer fill, StringPropertiesMode pushDirect,
StringAndSymbolPropertiesMode pushDirect) through the helper under
#if USE(BUN_JSC_ADDITIONS).

Top-function delta: no gdb-sampling profile diff run for this helper in
isolation (it sits behind the same createHasOtherOwner frame as
jsOwnedString; pmp-out/report.txt is pre-dates this stack). Micro-level
effect is one atomic ref+deref elided per key — not a top-N leaf sample.

Per-test % (3× interleaved, /tmp/fix4-pertest.log, baseline=/tmp/jsc-baseline,
patched=bin/jsc Jul 21 01:57 = 29681d0135 + option-A + this):
                      baseline    patched    delta
  regexp               388.630    385.199   -0.88%
  pdfjs                162.998    158.999   -2.45%
  Box2D                359.341    376.110   +4.67%
  Babylon              596.838    585.283   -1.94%
  richards             730.111    752.109   +3.01%
  delta-blue           934.965    975.219   +4.31%
  uglify-js-wtb         34.736     33.987   -2.16%
  typescript            17.984     18.122   +0.77%
  acorn-wtb             51.979     54.974   +5.76%
  raytrace             656.128    671.440   +2.33%  ← protected v1 win, recovered
  splay                379.179    317.602  -16.24%  ← protected v1 win, NOT recovered
  crypto              1132.629   1238.718   +9.37%  ← protected v1 win, holds
  geomean              257.468    258.359   +0.35%
splay re-sample (/tmp/fix4-pertest2.log): 342.115→321.756 −5.95% — the −16.24%
above is a noise spike (baseline splay itself swung 342→379, ±10.8%, between
back-to-back runs on this shared-load machine).

JetStream2 3×2 full (/tmp/fix4-bench3x2.log):
  baseline median 207.601  patched median 206.830  (-0.37%, target +2% NOT MET)
  runs: baseline 198.088/214.800/207.601  patched 206.830/208.305/187.980
seq-crash-survey: CRASH_COUNT=0 (17/17 + full-suite 201.093) — /tmp/fix4-survey.log
---
 Source/JavaScriptCore/runtime/JSString.h      | 24 ++++++++++++++++++-
 .../runtime/ObjectConstructor.cpp             | 12 ++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 99a7f9af46316..0ee1329d80944 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -87,6 +87,7 @@ JSString* jsOwnedString(VM&, const String&);
 // interned atoms owned elsewhere, so take the createHasOtherOwner path.
 JSString* jsStringFromFiberOrImpl(VM&, UniquedStringImpl*);
 JSString* jsStringFromFiberOrImpl(VM&, const Identifier&);
+JSString* jsOwnedAtomBackedString(VM&, const Identifier&);
 #endif
 
 bool isJSString(JSCell*);
@@ -451,6 +452,7 @@ class JSString : public JSCell {
     friend JSString* jsOwnedString(VM&, const String&);
 #if USE(BUN_JSC_ADDITIONS)
     friend JSString* jsStringFromFiberOrImpl(VM&, UniquedStringImpl*);
+    friend JSString* jsOwnedAtomBackedString(VM&, const Identifier&);
 #endif
     friend JSString* jsAtomString(JSGlobalObject*, VM&, JSString*);
     friend JSString* jsAtomString(JSGlobalObject*, VM&, JSString*, JSString*);
@@ -1486,7 +1488,7 @@ inline JSString* jsOwnedString(VM& vm, const String& s)
 // are NOT DFG-safe (StringCharAt/substring/length inline m_fiber→m_length with
 // no inline-cell guard), so keys that flow into user JS stay atom-backed:
 //   - ObjectConstructor.cpp objectConstructorEntries    → REWRITE (here)
-//   - ObjectConstructor.cpp getPropertyKeys             → KEEP (Object.keys→user JS)
+//   - ObjectConstructor.cpp getPropertyKeys             → jsOwnedAtomBackedString (user JS)
 //   - JSPropertyNameEnumerator.cpp:finishCreation       → KEEP (for-in→user JS)
 //   - Lookup.h reifyStaticProperty → publicName()       → KEEP (cold host-fn)
 //   - LiteralParser.cpp                                 → KEEP (span→Identifier only)
@@ -1517,6 +1519,26 @@ ALWAYS_INLINE JSString* jsStringFromFiberOrImpl(VM& vm, const Identifier& identi
 {
     return jsStringFromFiberOrImpl(vm, identifier.impl());
 }
+
+// DFG-safe (always atom-backed) variant of jsStringFromFiberOrImpl for keys that
+// flow into user JS: fiber words materialize via string(); real impls skip the
+// by-value string() AtomString temporary (splay/raytrace protected-win regressor).
+ALWAYS_INLINE JSString* jsOwnedAtomBackedString(VM& vm, const Identifier& identifier)
+{
+    UniquedStringImpl* uid = identifier.impl();
+    if (isInlinePropertyKey(uid)) [[unlikely]]
+        return jsOwnedString(vm, identifier.string()); // materialize atom; DFG-safe
+    ASSERT(uid);
+    unsigned length = uid->length();
+    if (!length)
+        return vm.smallStrings.emptyString();
+    if (length == 1) {
+        char16_t c = uid->is8Bit() ? uid->span8()[0] : uid->span16()[0];
+        if (c <= maxSingleCharacterString)
+            return vm.smallStrings.singleCharacterString(c);
+    }
+    return JSString::createHasOtherOwner(vm, *uid);
+}
 #endif
 
 ALWAYS_INLINE JSString* jsStringWithCache(VM& vm, const String& s)
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index 907ae72057c2e..3526f2bc2e565 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -1364,7 +1364,11 @@ static JSArray* getPropertyKeys(JSGlobalObject* globalObject, JSObject* object,
                     ASSERT(!identifier.isPrivateName());
                     buffer[i].set(vm, owner, Symbol::create(vm, static_cast<SymbolImpl&>(*identifier.impl())));
                 } else
+#if USE(BUN_JSC_ADDITIONS)
+                    buffer[i].set(vm, owner, jsOwnedAtomBackedString(vm, identifier));
+#else
                     buffer[i].set(vm, owner, jsOwnedString(vm, identifier.string()));
+#endif
             }
         };
 
@@ -1401,7 +1405,11 @@ static JSArray* getPropertyKeys(JSGlobalObject* globalObject, JSObject* object,
         for (size_t i = 0; i < numProperties; i++) {
             const auto& identifier = properties[i];
             ASSERT(!identifier.isSymbol());
+#if USE(BUN_JSC_ADDITIONS)
+            pushDirect(globalObject, keys, jsOwnedAtomBackedString(vm, identifier));
+#else
             pushDirect(globalObject, keys, jsOwnedString(vm, identifier.string()));
+#endif
             RETURN_IF_EXCEPTION(scope, nullptr);
         }
         break;
@@ -1425,7 +1433,11 @@ static JSArray* getPropertyKeys(JSGlobalObject* globalObject, JSObject* object,
                 ASSERT(!identifier.isPrivateName());
                 pushDirect(globalObject, keys, Symbol::create(vm, static_cast<SymbolImpl&>(*identifier.impl())));
             } else
+#if USE(BUN_JSC_ADDITIONS)
+                pushDirect(globalObject, keys, jsOwnedAtomBackedString(vm, identifier));
+#else
                 pushDirect(globalObject, keys, jsOwnedString(vm, identifier.string()));
+#endif
             RETURN_IF_EXCEPTION(scope, nullptr);
         }
         break;

From 7f1909971258b75339904f487d03a4a1fd1be2b6 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 21 Jul 2026 08:47:37 +0000
Subject: [PATCH 69/69] InlinePropertyKey D.6 bugfix:
 throwDOMAttribute{Getter,Setter}TypeError via publicName() (fiber-word uid()
 deref on Bun inspect Response.prototype.body getter mismatch)

---
 Source/JavaScriptCore/runtime/Error.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Source/JavaScriptCore/runtime/Error.cpp b/Source/JavaScriptCore/runtime/Error.cpp
index b5514f770a289..10f04dcdba967 100644
--- a/Source/JavaScriptCore/runtime/Error.cpp
+++ b/Source/JavaScriptCore/runtime/Error.cpp
@@ -354,12 +354,12 @@ Exception* throwSyntaxError(JSGlobalObject* globalObject, ThrowScope& scope, con
 
 JSValue throwDOMAttributeGetterTypeError(JSGlobalObject* globalObject, ThrowScope& scope, const ClassInfo* classInfo, PropertyName propertyName)
 {
-    return throwException(globalObject, scope, createGetterTypeError(globalObject, makeDOMAttributeGetterTypeErrorMessage(classInfo->className, String(propertyName.uid()))));
+    return throwException(globalObject, scope, createGetterTypeError(globalObject, makeDOMAttributeGetterTypeErrorMessage(classInfo->className, String(propertyName.publicName()))));
 }
 
 JSValue throwDOMAttributeSetterTypeError(JSGlobalObject* globalObject, ThrowScope& scope, const ClassInfo* classInfo, PropertyName propertyName)
 {
-    return throwException(globalObject, scope, createTypeError(globalObject, makeDOMAttributeSetterTypeErrorMessage(classInfo->className, String(propertyName.uid()))));
+    return throwException(globalObject, scope, createTypeError(globalObject, makeDOMAttributeSetterTypeErrorMessage(classInfo->className, String(propertyName.publicName()))));
 }
 
 JSObject* createError(JSGlobalObject* globalObject, const String& message)