Upgrade to upstream WebKit 50320fd3b3

[robobun]

Merges upstream WebKit main at 50320fd3b3 (2026-09-10) into the fork: 93 commits since the previous merge base ccdcb8a026 (2026-09-09), 14 of them in JavaScriptCore, WTF, bmalloc or cmake. git merge-base origin/main upstream/main reports ccdcb8a026 directly. This merge commit has 50320fd3b3 as its second parent.

The branch also contains the fork's main as of cf1b36ec8703 (#522), merged in as e1831791003d after #522 landed. That second merge had no conflicts (bytecompiler/NodesCodegen.cpp, jsc.cpp and tools/JSDollarVM.cpp merged automatically), so GitHub can merge this PR into main as it is.

Conflicts and how they were resolved

2 files conflicted. Both are one-line overlaps between a mechanical upstream rename and a fork edit on the next line.

• wtf/URLParser.cpp (7bd7b6dfad): upstream changes the URL_PARSER_LOG line at the top of URLParser::parse from utf8().data() to utf8().legacyCStringPointer(). The fork (Make WTF::URLParser faster than Ada #452) replaced the line after it, m_url = { };, with ASSERT(!m_url.isValid() && m_url.m_string.isNull());. Took upstream's log line and kept the fork's ASSERT.
• wtf/UUID.cpp (74b519d7f9): upstream retypes the buffer in the OS(DARWIN) branch of bootSessionUUIDString() to Latin1Character. The fork has that branch commented out. Kept the fork's version.

Everything else merged without conflicts, including runtime/RegExp.cpp (e19f57a779), runtime/JSONObject.cpp, runtime/NumberPrototype.cpp, runtime/StringPrototype.cpp, runtime/JSArrayBufferPrototype.cpp, b3/B3LowerToAir.cpp and wtf/text/WTFString.h. No fork-only code used the String(std::span<const char>) constructor that 74b519d7f9 makes private, or CStringWithEncoding::characters() that 7bd7b6dfad renames.

Checked and unchanged: runtime/JSType.h, Source/WebCore/bindings/scripts, .github/workflows, the release tarball names.

Verification

• bun run jsc:build:debug (Linux x64, Debug + ASAN, clang 21): builds, jsc runs.
• The 5 JSTests files added upstream in this range (stress/arraybuffer-grow-resize-huge-length.js, stress/multiply-negated-operand.js, stress/regexp-cached-result-one-character-atom-delete-all-code.js, microbenchmarks/mul-negated-operand-{chain,integrate}.js) and the modified wasm/gc/bulk-array-element-types.js pass on that jsc.
• The 316 existing JSTests/stress files whose names match regexp*, regex*, *lookbehind* or *yarr*, on the same jsc: 299 pass, 13 carry a //@ skip, 4 fail. The 4 (regexp-boundary-assertions.js, regexp-buffer-boundaries-anchoring.js, regexp-lazy-pattern-construction.js, regexp-unicode-code-unit-read-for-bmp-terms.js) fail with identical output on the jsc from the current autobuild-4b9ff9959a04 debug-asan tarball. They are the pre-existing failures Upgrade to upstream WebKit ccdcb8a026 #614 lists.
• After the merge of main ([JSC] Additional module loaders per global object, sharing linked module code between them #522): bun run jsc:build:debug builds again, the 5 JSTests/modules/module-loaders*.js files from [JSC] Additional module loaders per global object, sharing linked module code between them #522 pass, and so do the upstream tests listed above.
• bun run build:local at 73feb01375e7 (before [JSC] Additional module loaders per global object, sharing linked module code between them #522): Bun builds and links against the tree with one source change on top of Upgrade WebKit to ccdcb8a026 bun#42177 (BunProcess.cpp built a String from a std::span<const char>, it now calls String::fromLatin1). bun-debug -p 42 runs.
• bun run build:local at e1831791003d (with [JSC] Additional module loaders per global object, sharing linked module code between them #522): Bun needs Bun.unsafe.ModuleGraph: multiple instances of an ES module graph in one global bun#42271 to build against any tree that contains [JSC] Additional module loaders per global object, sharing linked module code between them #522 (ModuleAnalyzer, SyntheticModuleRecord::create and the module loader hooks changed shape). Bun.unsafe.ModuleGraph: multiple instances of an ES module graph in one global bun#42271 plus the BunProcess.cpp change builds and links, and test/js/bun/module-graph/module-graph.test.ts passes except for 3 timeouts of the debug build. The bytecode portability hashes are the ones Bun.unsafe.ModuleGraph: multiple instances of an ES module graph in one global bun#42271 gets on its own CI, so the upstream range does not move them.

Upstream changes

Each commit appears once under the most specific heading that applies.

Needs an embedder-side change

• 74b519d7f9 WTF::String(std::span<const char>) is now private, next to String(const char*), because char carries no encoding. Callers name the encoding: String::fromLatin1(std::span<const char>) (new overload), String(std::span<const Latin1Character>), String::fromUTF8(...) or String(ASCIILiteral). In the same commit WTF::enumName() and WTF::enumTypeName() (wtf/EnumTraits.h) return ASCIILiteral instead of std::span<const char>, so callers test isEmpty() instead of empty(). https://bugs.webkit.org/show_bug.cgi?id=323650
• 7bd7b6dfad CString gains legacyCStringPointer(), which returns the same const char* as data(), and every upstream utf8().data() call site moves to it. CStringWithEncoding::characters() (the const char* accessor of UTF8CString and ASCIICString from 5f14e32e57) is renamed to legacyCStringPointer(). No type changes yet. This is the mechanical half of retyping String::utf8() to return UTF8CString. After that follow-up lands, utf8().data() returns const char8_t* and only legacyCStringPointer() keeps returning const char*. https://bugs.webkit.org/show_bug.cgi?id=323722

Runtime and builtins

• 223bd0faee ArrayBuffer.prototype.resize and SharedArrayBuffer.prototype.grow convert the new length with toIndex instead of ToIntegerOrInfinity plus a cast to size_t, which was undefined for a value such as 1e20. A length above 2^53 - 1 or a negative length now throws RangeError before the detached check, so detached.resize(-1) throws RangeError where it used to throw TypeError. https://bugs.webkit.org/show_bug.cgi?id=323440
• c194b75cde speculationFromString() (bytecode/SpeculatedType.h, used by the @idWithProfile bytecode intrinsic) takes a StringView and looks the name up in a SortedArrayMap instead of a chain of strncmp prefix tests. The rest of the commit is review follow-up for 7bd7b6dfad in the Wasm debugger tests. https://bugs.webkit.org/show_bug.cgi?id=323841

RegExp (Yarr)

• e19f57a779 RegExp::deleteCode() no longer clears m_atom and m_specificPattern. They depend only on the pattern, like m_numSubpatterns. RegExpCachedResult::lastResult() reads RegExp::atom() to reify the position of a cached one-character global match. After VM::deleteAllCode() cleared the atom it searched for U+0000 instead, so RegExp.leftContext, RegExp.rightContext and RegExp.lastMatch could be wrong (a debug build asserts). Bun calls deleteAllCode on hot reload and when a debugger attaches. https://bugs.webkit.org/show_bug.cgi?id=323838

JIT (B3)

• 41ec81351b B3 LowerToAir matches Mul(Neg(n), m) and Mul(n, Neg(m)) and emits one MultiplyNeg (ARM64 MNEG / FNMUL) when the Neg has no other user. This is the shape -n * m parses to. The floating point form used to emit fneg plus fmul. About 1.5x on the mul-negated-operand-chain microbenchmark. No effect on x86_64, which has no such instruction form. https://bugs.webkit.org/show_bug.cgi?id=323150

WebAssembly

• 0d81375a0f JSWebAssemblyArray::fill of reference elements stores through the new gcSafeMemfill() (heap/GCMemoryOperations.h, next to gcSafeZeroMemory) and then runs one write barrier, like array.copy. The old loop of plain stores could be lowered to sub-8-byte writes, and the concurrent marker could read a torn value. https://bugs.webkit.org/show_bug.cgi?id=323628
• 92a274ec73 The Wasm debugger BreakpointManager stores Ref<Breakpoint> in its map and returns RefPtr<Breakpoint>, so a breakpoint pointer no longer goes stale when the map rehashes. Breakpoint becomes ThreadSafeRefCounted. Debugger only. https://bugs.webkit.org/show_bug.cgi?id=323910

WTF and bmalloc

• 86f52ba2f2 libpas: pas_runtime_config::enabled (MTE enablement, a bool where 0 meant either "not initialized" or "off") becomes the tri-state mte_state. pas_mte_is_mte_enabled() is now an inlineable relaxed load that falls back to the renamed pas_mte_is_mte_enabled_slow() only when the state is not initialized. Darwin arm64e only. https://bugs.webkit.org/show_bug.cgi?id=323820
• 50320fd3b3 wtf/MathExtras.h gains absoluteValueAsUnsigned(), an abs that is defined for the most negative value of a signed type. The only adopter is WebCore. https://bugs.webkit.org/show_bug.cgi?id=257369
• 1455983c9d wtf/PlatformHave.h defines HAVE_AVPLAYER_DISCONNECTEDFROMSYSTEMAUDIO for the iOS family 27.0 SDKs. https://bugs.webkit.org/show_bug.cgi?id=323772
• 8eb608658b UnifiedWebPreferences.yaml gains a WebRTC DNS preference. No JSC effect. https://bugs.webkit.org/show_bug.cgi?id=323606

Build system and platform

• b1865b2d63 Swift compiler flags for CMake move from OptionsCocoa.cmake and WebKitMacros.cmake into a new Source/cmake/WebKitSwiftFlags.cmake and are aligned with the Xcode build. Swift targets only. https://bugs.webkit.org/show_bug.cgi?id=322750
• bc5bc3c2d6 WebKitMacros.cmake normalizes MSVC-style /D definitions to -D when it forwards them to the Swift clang importer on Windows. Swift targets only. https://bugs.webkit.org/show_bug.cgi?id=323791

WebCore-only or no effect on JSC embedders

The other 79 commits in the range touch WebCore, WebKit, WebGPU, LayoutTests or tooling only.

[github-actions]

Preview Builds

Commit	Release	Date
e1831791	autobuild-preview-pr-623-e1831791	2026-09-11 18:30:41 UTC
73feb013	autobuild-preview-pr-623-73feb013	2026-09-11 02:11:46 UTC

[claude]

Findings marked 🟡 are optional suggestions and need no follow-up push.

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.