oven-sh · robobun · Jul 17, 2026 · Jul 17, 2026 · Jul 17, 2026 · Jul 17, 2026
diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml
@@ -32,6 +32,7 @@ jobs:
     name: Linux
     runs-on: ${{matrix.os}}
     strategy:
+      fail-fast: false
       matrix:
         include:
           - lto_flag: ""

diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
@@ -1330,6 +1330,8 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
     runtime/InferredValueInlines.h
     runtime/InitializeThreading.h
     runtime/InlineAttribute.h
+    runtime/InlinePropertyKey.h
+    runtime/InlineStringCache.h
     runtime/Int16Array.h
     runtime/Int32Array.h
     runtime/Int8Array.h
@@ -1525,6 +1527,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
     runtime/JSSourceCode.h
     runtime/JSSourceCodeInlines.h
     runtime/JSString.h
+    runtime/JSStringBuilder.h
     runtime/JSStringInlines.h
     runtime/JSStringIterator.h
     runtime/JSStringIteratorInlines.h

diff --git a/Source/JavaScriptCore/builtins/BuiltinNames.cpp b/Source/JavaScriptCore/builtins/BuiltinNames.cpp
@@ -61,11 +61,19 @@ SymbolImpl::StaticSymbolImpl polyProtoPrivateName { "PolyProto", SymbolImpl::s_f
         m_privateNameSet.add(symbol); \
     } while (0);
 
+#if USE(BUN_JSC_ADDITIONS)
+#define INITIALIZE_WELL_KNOWN_SYMBOL_PUBLIC_TO_PRIVATE_ENTRY(name) \
+    do { \
+        SymbolImpl* symbol = static_cast<SymbolImpl*>(m_##name##Symbol.impl()); \
+        m_wellKnownSymbolsMap.add(m_##name##SymbolPrivateIdentifier.string(), symbol); \
+    } while (0);
+#else
 #define INITIALIZE_WELL_KNOWN_SYMBOL_PUBLIC_TO_PRIVATE_ENTRY(name) \
     do { \
         SymbolImpl* symbol = static_cast<SymbolImpl*>(m_##name##Symbol.impl()); \
         m_wellKnownSymbolsMap.add(m_##name##SymbolPrivateIdentifier.impl(), symbol); \
     } while (0);
+#endif
 
 WTF_MAKE_TZONE_ALLOCATED_IMPL(BuiltinNames);
 

diff --git a/Source/JavaScriptCore/bytecode/GetByStatus.cpp b/Source/JavaScriptCore/bytecode/GetByStatus.cpp
@@ -482,8 +482,13 @@ GetByStatus GetByStatus::computeFor(JSGlobalObject* globalObject, const Structur
     if (set.isEmpty())
         return GetByStatus();
 
+#if USE(BUN_JSC_ADDITIONS)
+    if (parseIndex(PropertyName(identifier.uid())))
+        return GetByStatus(LikelyTakesSlowPath);
+#else
     if (parseIndex(*identifier.uid()))
         return GetByStatus(LikelyTakesSlowPath);
+#endif
 
     VM& vm = globalObject->vm();
     auto attempToFold = [&]() -> std::optional<GetByStatus> {

diff --git a/Source/JavaScriptCore/bytecode/InlineAccess.cpp b/Source/JavaScriptCore/bytecode/InlineAccess.cpp
@@ -365,6 +365,12 @@ bool InlineAccess::generateStringLength(PropertyInlineCache& propertyCache)
     auto done = jit.jump();
 
     isRope.link(&jit);
+#if USE(BUN_JSC_ADDITIONS)
+    // Inline small strings share the rope branch; their cell is only 16 bytes,
+    // so JSRopeString::offsetOfLength() would read past the end. Take the slow path.
+    jit.branchTestPtr(CCallHelpers::Zero, scratch, CCallHelpers::TrustedImm32(JSString::isRopeInPointer))
+        .linkThunk(propertyCache.slowPathStartLocation, &jit);
+#endif
     jit.load32(CCallHelpers::Address(base, JSRopeString::offsetOfLength()), value.payloadGPR());
 
     done.link(&jit);

diff --git a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
diff --git a/Source/JavaScriptCore/bytecode/InlineCacheCompiler.h b/Source/JavaScriptCore/bytecode/InlineCacheCompiler.h
@@ -157,7 +157,11 @@ ALWAYS_INLINE bool canUseMegamorphicGetByIdExcludingIndex(VM& vm, UniquedStringI
 
 inline bool canUseMegamorphicGetById(VM& vm, UniquedStringImpl* uid)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return !parseIndex(PropertyName(uid)) && canUseMegamorphicGetByIdExcludingIndex(vm, uid);
+#else
     return !parseIndex(*uid) && canUseMegamorphicGetByIdExcludingIndex(vm, uid);
+#endif
 }
 
 inline bool canUseMegamorphicInById(VM& vm, UniquedStringImpl* uid)
@@ -167,7 +171,11 @@ inline bool canUseMegamorphicInById(VM& vm, UniquedStringImpl* uid)
 
 inline bool canUseMegamorphicPutById(VM& vm, UniquedStringImpl* uid)
 {
+#if USE(BUN_JSC_ADDITIONS)
+    return !parseIndex(PropertyName(uid)) && uid != vm.propertyNames->underscoreProto;
+#else
     return !parseIndex(*uid) && uid != vm.propertyNames->underscoreProto;
+#endif
 }
 
 bool NODELETE canBeViaGlobalProxy(AccessCase::AccessType);

diff --git a/Source/JavaScriptCore/bytecode/PutByStatus.cpp b/Source/JavaScriptCore/bytecode/PutByStatus.cpp
@@ -369,8 +369,13 @@ PutByStatus PutByStatus::computeFor(CodeBlock* baselineBlock, ICStatusMap& basel
 PutByStatus PutByStatus::computeFor(JSGlobalObject* globalObject, const StructureSet& set, CacheableIdentifier identifier, bool isDirect, PrivateFieldPutKind privateFieldPutKind)
 {
     UniquedStringImpl* uid = identifier.uid();
+#if USE(BUN_JSC_ADDITIONS)
+    if (parseIndex(PropertyName(uid)))
+        return PutByStatus(LikelyTakesSlowPath);
+#else
     if (parseIndex(*uid))
         return PutByStatus(LikelyTakesSlowPath);
+#endif
 
     if (set.isEmpty())
         return PutByStatus();

diff --git a/Source/JavaScriptCore/bytecode/SpeculatedType.cpp b/Source/JavaScriptCore/bytecode/SpeculatedType.cpp
@@ -271,6 +271,13 @@ void dumpSpeculation(PrintStream& outStream, SpeculatedType value)
                     strOut.print("StringUnresolvedVar");
                 else
                     isTop = false;
+
+#if USE(BUN_JSC_ADDITIONS)
+                if (value & SpecStringInline)
+                    strOut.print("StringInline");
+                else
+                    isTop = false;
+#endif
             }
         }
 
@@ -610,6 +617,10 @@ SpeculatedType speculationFromCell(JSCell* cell)
                 return SpecStringIdent;
             return SpecStringResolved;
         }
+#if USE(BUN_JSC_ADDITIONS)
+        if (string->isInline())
+            return SpecStringInline;
+#endif
         return SpecString;
     }
 

diff --git a/Source/JavaScriptCore/bytecode/SpeculatedType.h b/Source/JavaScriptCore/bytecode/SpeculatedType.h
@@ -80,7 +80,12 @@ static constexpr SpeculatedType SpecObjectOther                       = 1ull <<
 static constexpr SpeculatedType SpecStringIdent                       = 1ull << 32; // It's definitely a JSString, and it's an identifier.
 static constexpr SpeculatedType SpecStringResolvedVar                 = 1ull << 33; // It's definitely a JSString, and it's not an identifier. And string is resolved.
 static constexpr SpeculatedType SpecStringUnresolvedVar               = 1ull << 34; // It's definitely a JSString, and it's not an identifier. And string is unresolved.
+#if USE(BUN_JSC_ADDITIONS)
+static constexpr SpeculatedType SpecStringInline                      = 1ull << 51; // It's definitely a JSString with inline-small-string storage (not resolved, not a rope).
+static constexpr SpeculatedType SpecStringVar                         = SpecStringUnresolvedVar | SpecStringResolvedVar | SpecStringInline; // It's definitely a JSString, and it's not an identifier.
+#else
 static constexpr SpeculatedType SpecStringVar                         = SpecStringUnresolvedVar | SpecStringResolvedVar; // It's definitely a JSString, and it's not an identifier.
+#endif
 static constexpr SpeculatedType SpecStringResolved                    = SpecStringIdent | SpecStringResolvedVar; // It's definitely a JSString, and it's resolved. May be an identifier or not.
 static constexpr SpeculatedType SpecString                            = SpecStringIdent | SpecStringVar; // It's definitely a JSString.
 static constexpr SpeculatedType SpecSymbol                            = 1ull << 35; // It's definitely a Symbol.

diff --git a/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h b/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h
@@ -353,7 +353,12 @@ class UnlinkedFunctionExecutable final : public JSCell {
 };
 
 #if !ASSERT_ENABLED
+#if USE(BUN_JSC_ADDITIONS)
+// Identifier carries a lazily-materialized AtomString under BUN_JSC_ADDITIONS (phase D.1), which grows this type.
+static_assert(sizeof(UnlinkedFunctionExecutable) <= 112, "UnlinkedFunctionExecutable needs to be small");
+#else
 static_assert(sizeof(UnlinkedFunctionExecutable) <= 96, "UnlinkedFunctionExecutable needs to be small");
 #endif
+#endif
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -4528,6 +4528,24 @@ void BytecodeGenerator::endSwitch(const Vector<Ref<Label>, 8>& labels, Expressio
             ASSERT(!labels[i]->isForward());
 
             ASSERT(nodes[i]->isString());
+#if USE(BUN_JSC_ADDITIONS)
+            // StringOffsetTable is RefPtr<StringImpl>-keyed and the runtime lookup
+            // compares real StringImpl*, so materialize the fiber word here instead
+            // of letting a tagged pointer reach DefaultRefDerefTraits::refIfNotNull.
+            const Identifier& caseIdent = static_cast<StringNode*>(nodes[i])->value();
+            // string() is by-value now; keep the atom alive across add() so a
+            // fiber-word materialization survives until the table takes its ref.
+            AtomString clauseAtom = caseIdent.string();
+            UniquedStringImpl* clause = clauseAtom.impl();
+            ASSERT(!isInlinePropertyKey(clause));
+            ASSERT(clause->isAtom());
+            auto result = jumpTable.m_offsetTable.add(clause, UnlinkedStringJumpTable::OffsetLocation { labels[i]->bind(switchInfo.bytecodeOffset), 0 });
+            if (result.isNewEntry) {
+                result.iterator->value.m_indexInTable = jumpTable.m_offsetTable.size() - 1;
+                jumpTable.m_minLength = std::min(jumpTable.m_minLength, clause->length());
+                jumpTable.m_maxLength = std::max(jumpTable.m_maxLength, clause->length());
+            }
+#else
             UniquedStringImpl* clause = static_cast<StringNode*>(nodes[i])->value().impl();
             ASSERT(clause->isAtom());
             auto result = jumpTable.m_offsetTable.add(clause, UnlinkedStringJumpTable::OffsetLocation { labels[i]->bind(switchInfo.bytecodeOffset), 0 });
@@ -4536,6 +4554,7 @@ void BytecodeGenerator::endSwitch(const Vector<Ref<Label>, 8>& labels, Expressio
                 jumpTable.m_minLength = std::min(jumpTable.m_minLength, clause->length());
                 jumpTable.m_maxLength = std::max(jumpTable.m_maxLength, clause->length());
             }
+#endif
         }
         ASSERT(!defaultLabel.isForward());
         jumpTable.m_defaultOffset = defaultLabel.bind(switchInfo.bytecodeOffset);
@@ -5046,11 +5065,19 @@ RegisterID* BytecodeGenerator::emitGetTemplateObject(RegisterID* dst, TaggedTemp
     for (; templateString; templateString = templateString->next()) {
         auto* string = templateString->value();
         ASSERT(string->raw());
+#if USE(BUN_JSC_ADDITIONS)
+        rawStrings.append(string->raw()->string());
+        if (!string->cooked())
+            cookedStrings.append(std::nullopt);
+        else
+            cookedStrings.append(string->cooked()->string());
+#else
         rawStrings.append(string->raw()->impl());
         if (!string->cooked())
             cookedStrings.append(std::nullopt);
         else
             cookedStrings.append(string->cooked()->impl());
+#endif
     }
     RefPtr<RegisterID> constant = addTemplateObjectConstant(TemplateObjectDescriptor::create(WTF::move(rawStrings), WTF::move(cookedStrings)), taggedTemplate->endOffset());
     if (!dst)

diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -1280,7 +1280,11 @@ namespace JSC {
             Optimize,
             DoNotOptimize
         };
+#if USE(BUN_JSC_ADDITIONS)
+        typedef UncheckedKeyHashMap<FiberAwareRefPtr, TDZNecessityLevel, IdentifierRepHash> TDZMap;
+#else
         typedef UncheckedKeyHashMap<RefPtr<UniquedStringImpl>, TDZNecessityLevel, IdentifierRepHash> TDZMap;
+#endif
 
     public:
         JSString* addStringConstant(const Identifier&);
@@ -1355,7 +1359,11 @@ namespace JSC {
 
         // Some of these objects keep pointers to one another. They are arranged
         // to ensure a sane destruction order that avoids references to freed memory.
+#if USE(BUN_JSC_ADDITIONS)
+        UncheckedKeyHashSet<FiberAwareRefPtr, IdentifierRepHash> m_functions;
+#else
         UncheckedKeyHashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> m_functions;
+#endif
         RegisterID m_ignoredResultRegister;
         RegisterID m_thisRegister;
         RegisterID m_calleeRegister;

diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -4929,9 +4929,9 @@ static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>&
                 typeForTable = SwitchNeither;
                 break;
             }
-            auto& value = static_cast<StringNode*>(clauseExpression)->value().string();
+            const Identifier& value = static_cast<StringNode*>(clauseExpression)->value();
             if (singleCharacterSwitch &= value.length() == 1) {
-                int32_t intVal = value[0];
+                int32_t intVal = value.string()[0];
                 if (intVal < min_num)
                     min_num = intVal;
                 if (intVal > max_num)

diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
@@ -5025,7 +5025,14 @@ bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimi
     case ResolveRope: {
         AbstractValue& value = forNode(node->child1());
         JSValue childConst = value.value();
+#if USE(BUN_JSC_ADDITIONS)
+        // Inline small strings are !isRope() but still lack a StringImpl*. Folding them through
+        // lets the generic constant folder elide this node, leaking an inline fiber to consumers
+        // (GetByVal/StringCharAt/StringCodePointAt) that load StringImpl fields without a guard.
+        if (childConst && childConst.isString() && !asString(childConst)->isRope() && !asString(childConst)->isInline()) {
+#else
         if (childConst && childConst.isString() && !asString(childConst)->isRope()) {
+#endif
             setConstant(node, *m_graph.freeze(childConst));
             break;
         }

diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -1140,6 +1140,19 @@ class FixupPhase : public Phase {
                 ASSERT(node->arrayMode() == ArrayMode(Array::String, Array::Read, Array::OutOfBounds) || node->arrayMode() == ArrayMode(Array::String, Array::Read, Array::InBounds));
             else
                 ASSERT(node->arrayMode() == ArrayMode(Array::String, Array::Read));
+#if USE(BUN_JSC_ADDITIONS)
+            // For StringCharCodeAt/StringCodePointAt on a monomorphic-inline
+            // profile, skip the ResolveRope insertion so the compile functions
+            // read from the cell bytes directly without a StringImpl.
+            {
+                SpeculatedType pred = node->child1()->prediction() & SpecString;
+                if ((op == StringCharCodeAt || op == StringCodePointAt) && pred && !(pred & ~SpecStringInline)) {
+                    fixEdge<StringUse>(node->child1());
+                    fixEdge<Int32Use>(node->child2());
+                    break;
+                }
+            }
+#endif
             blessArrayOperation(node->child1(), node->child2(), node->child1()); // Rewrite child1 with ResolveRope.
             fixEdge<KnownStringUse>(node->child1());
             fixEdge<Int32Use>(node->child2());
@@ -2615,7 +2628,7 @@ class FixupPhase : public Phase {
         }
 
         case CheckIdent: {
-            if (node->uidOperand()->isSymbol())
+            if (uidIsSymbol(node->uidOperand()))
                 fixEdge<SymbolUse>(node->child1());
             else
                 fixEdge<StringIdentUse>(node->child1());