From 42abe863c1f57c376eaa2dc3f1be8e718c4821aa Mon Sep 17 00:00:00 2001 From: Sosuke Suzuki Date: Tue, 21 Jul 2026 16:29:27 +0900 Subject: [PATCH 1/8] Run wklint (JSC exception-check linter) during the Linux amd64 debug build wklint is oven-sh's static analyzer for JSC's exception-check protocol (a whole-CFG version of --validateExceptionChecks). This wires it into the existing JSC build: - Dockerfile: an optional stage fetches the prebuilt wklint tarball from oven-sh/webkit-lint when WKLINT_TAG is set (token passed as a BuildKit secret), and the linter runs over the JSC unified sources right after the jsc target builds, writing wklint-{findings.json,report.txt,exit-code} to /output. A lint failure never fails the image build. - release.sh: threads WKLINT_TAG and the token secret into buildx (no-op when unset). - build-reusable.yml: enables lint on the linux amd64 debug leg only (input wklint_tag, falling back to the WKLINT_TAG repo variable), then reports: findings not covered by Tools/wklint/expectations.yaml fail the job with a summary of what to fix or triage; the raw findings are kept as an artifact. - Tools/wklint/expectations.yaml: the baseline for this fork (165 entries). New PRs only need to keep the report clean; entries carry a reason. --- .github/workflows/build-reusable.yml | 46 ++ Dockerfile | 33 + Tools/wklint/expectations.yaml | 1012 ++++++++++++++++++++++++++ release.sh | 9 + 4 files changed, 1100 insertions(+) create mode 100644 Tools/wklint/expectations.yaml diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml index 2dbb323f3a0ef..02d7217a49499 100644 --- a/.github/workflows/build-reusable.yml +++ b/.github/workflows/build-reusable.yml @@ -22,6 +22,10 @@ on: description: 'LLVM version to use' type: string default: '19' + wklint_tag: + description: 'oven-sh/webkit-lint release tag to run the JSC exception-check linter (empty = skip; falls back to the WKLINT_TAG repository variable)' + type: string + default: '' outputs: release_tag: description: 'The release tag that was created' @@ -40,6 +44,7 @@ jobs: package_json_arch: "x64" CMAKE_BUILD_TYPE: "Debug" RELEASE_FLAGS: "-O3 -DNDEBUG=1" + wklint: "true" - lto_flag: "" label: bun-webkit-linux-arm64-debug os: linux-arm64-gh @@ -124,6 +129,8 @@ jobs: env: RELEASE_FLAGS: ${{matrix.RELEASE_FLAGS}} ENABLE_SANITIZERS: ${{matrix.ENABLE_SANITIZERS}} + WKLINT_TAG: ${{ matrix.wklint == 'true' && (inputs.wklint_tag || vars.WKLINT_TAG || '') || '' }} + WEBKIT_LINT_RELEASE_TOKEN: ${{ secrets.WEBKIT_LINT_RELEASE_TOKEN }} run: | rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz if [ "${{matrix.package_json_arch}}" = "arm64" ]; then @@ -137,12 +144,51 @@ jobs: echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["linux"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json rm -rf bun-webkit/lib/*.so rm -rf bun-webkit/lib/*.so.* + # wklint results (if the linter ran) live in the artifact output dir. + if [ -f bun-webkit/wklint-findings.json ]; then + cp bun-webkit/wklint-findings.json bun-webkit/wklint-report.txt bun-webkit/wklint-exit-code . 2>/dev/null || true + rm -f bun-webkit/wklint-findings.json bun-webkit/wklint-report.txt bun-webkit/wklint-log.txt bun-webkit/wklint-exit-code + fi tar -czf bun-webkit.tar.gz bun-webkit rm -rf bun-webkit - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: ${{matrix.label}} path: ${{runner.temp}}/bun-webkit.tar.gz + - name: Report wklint (JSC exception-check) findings + if: matrix.wklint == 'true' + working-directory: ${{runner.temp}} + run: | + if [ ! -f wklint-exit-code ]; then + echo "wklint did not run (WKLINT_TAG not set); skipping." + exit 0 + fi + exit_code=$(cat wklint-exit-code) + echo "wklint exit code: $exit_code" + cat wklint-report.txt || true + if [ "$exit_code" = "1" ]; then + new=$(grep -c ' warning: ' wklint-report.txt || true) + { + echo "### wklint: $new new unchecked-exception finding(s)" + echo + echo "These are JSC exception-check patterns not covered by \`Tools/wklint/expectations.yaml\`." + echo "Fix them, or add an entry with a \`reason:\` if the finding is a known/latent case." + echo + echo '```' + head -60 wklint-report.txt + echo '```' + } >> "$GITHUB_STEP_SUMMARY" + echo "::warning title=wklint::$new new unchecked-exception finding(s); see the job summary" + exit 1 + fi + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + if: matrix.wklint == 'true' && always() + with: + name: wklint-findings + path: | + ${{runner.temp}}/wklint-findings.json + ${{runner.temp}}/wklint-report.txt + if-no-files-found: ignore windows-cross: name: Windows (cross-compiled from Linux) diff --git a/Dockerfile b/Dockerfile index cef74738100cb..c2c4697e1011a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,6 +6,9 @@ ARG RELEASE_FLAGS="-O3 -DNDEBUG=1" ARG LLVM_VERSION="21" ARG DEFAULT_CFLAGS="-mno-omit-leaf-frame-pointer -g -fno-omit-frame-pointer -ffunction-sections -fdata-sections -faddrsig -fno-unwind-tables -fno-asynchronous-unwind-tables -DU_STATIC_IMPLEMENTATION=1 " ARG ENABLE_SANITIZERS="" +# wklint (JSC exception-check linter) release tag from oven-sh/webkit-lint, +# e.g. "autobuild-". Empty = do not lint. +ARG WKLINT_TAG="" ARG USE_MIMALLOC="OFF" ARG USE_EXTERNAL_MIMALLOC="OFF" @@ -25,6 +28,7 @@ ARG TARGETARCH ARG ENABLE_SANITIZERS ARG USE_MIMALLOC ARG USE_EXTERNAL_MIMALLOC +ARG WKLINT_TAG # Prevent interactive prompts ENV DEBIAN_FRONTEND=noninteractive @@ -109,6 +113,22 @@ RUN wget https://apt.llvm.org/llvm.sh \ && rm llvm.sh \ && rm -rf /var/lib/apt/lists/* +# wklint: JSC exception-check static analyzer (oven-sh/webkit-lint prebuilt). +# Fetched only when WKLINT_TAG is set; the token is a BuildKit secret because +# the release lives in an internal repository. +RUN --mount=type=secret,id=WEBKIT_LINT_RELEASE_TOKEN \ + if [ -n "$WKLINT_TAG" ]; then \ + set -eu; \ + token=$(cat /run/secrets/WEBKIT_LINT_RELEASE_TOKEN); \ + api="https://api.github.com/repos/oven-sh/webkit-lint/releases/tags/${WKLINT_TAG}"; \ + asset_url=$(curl -fsSL -H "Authorization: token ${token}" "$api" \ + | python3 -c 'import json,sys; print([a["url"] for a in json.load(sys.stdin)["assets"] if a["name"].endswith("-linux-x64.tar.zst")][0])'); \ + curl -fsSL -H "Authorization: token ${token}" -H "Accept: application/octet-stream" \ + -o /tmp/wklint.tar.zst "$asset_url"; \ + mkdir -p /opt && tar --zstd -xf /tmp/wklint.tar.zst -C /opt && rm /tmp/wklint.tar.zst; \ + /opt/wklint-linux-x64/bin/wklint --version; \ + fi + # Configure library paths RUN if [ "$TARGETARCH" = "arm64" ]; then \ export ARCH_PATH="aarch64-linux-gnu"; \ @@ -295,6 +315,19 @@ RUN --mount=type=tmpfs,target=/webkitbuild \ cd /webkitbuild && \ cmake --build /webkitbuild --config $WEBKIT_RELEASE_TYPE --target "jsc" && \ python3 /webkit/Tools/Scripts/check-classinfo-uniqueness.py $WEBKIT_OUT_DIR/bin/jsc && \ + if [ -x /opt/wklint-linux-x64/bin/wklint ]; then \ + set +e; \ + python3 /opt/wklint-linux-x64/tools/wklint-run.py \ + -p /webkitbuild --wklint /opt/wklint-linux-x64/bin/wklint \ + --files 'JavaScriptCore/DerivedSources/unified-sources/UnifiedSource-.*\.cpp' \ + --checks 'jsc-*' --source-root /webkit \ + --workdir /webkitbuild/wklint-cache \ + --expectations /webkit/Tools/wklint/expectations.yaml \ + --json-out /output/wklint-findings.json \ + > /output/wklint-report.txt 2> /output/wklint-log.txt; \ + echo $? > /output/wklint-exit-code; \ + set -e; \ + fi && \ cp -r $WEBKIT_OUT_DIR/lib/*.a /output/lib && \ cp $WEBKIT_OUT_DIR/*.h /output/include && \ cp -r $WEBKIT_OUT_DIR/bin /output/bin && \ diff --git a/Tools/wklint/expectations.yaml b/Tools/wklint/expectations.yaml new file mode 100644 index 0000000000000..259d2c930021a --- /dev/null +++ b/Tools/wklint/expectations.yaml @@ -0,0 +1,1012 @@ +# wklint expectations: findings listed here are known/triaged and not reported. +# Match key: rule + file + function + key (line is informational). Regenerate with --update-expectations. +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/API/APICallbackFunction.h' + function: 'JSC::APICallbackFunction::callImpl' + key: 'toThis -> throwException' + line: 73 + reason: '[c-api] latent (C API glue): contract violation; would trip validateExceptionChecks in testapi' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/API/APICallbackFunction.h' + function: 'JSC::APICallbackFunction::callImpl' + key: 'return after toThis' + line: 79 + count: 2 + reason: '[c-api] latent (C API glue): contract violation; would trip validateExceptionChecks in testapi' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/API/APICallbackFunction.h' + function: 'JSC::APICallbackFunction::constructImpl' + key: 'return after get' + line: 140 + reason: '[c-api] latent (C API glue): contract violation; would trip validateExceptionChecks in testapi' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/API/JSCallbackObjectFunctions.h' + function: 'JSC::JSCallbackObject::customToPrimitive' + key: 'return ordinaryToPrimitive' + line: 256 + reason: '[c-api] latent (C API glue): contract violation; would trip validateExceptionChecks in testapi' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/API/JSCallbackObjectFunctions.h' + function: 'JSC::JSCallbackObject::callImpl' + key: 'toThis -> throwException' + line: 588 + reason: '[c-api] latent (C API glue): contract violation; would trip validateExceptionChecks in testapi' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/API/JSCallbackObjectFunctions.h' + function: 'JSC::JSCallbackObject::callImpl' + key: 'return after toThis' + line: 591 + reason: '[c-api] latent (C API glue): contract violation; would trip validateExceptionChecks in testapi' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/API/JSCallbackObjectFunctions.h' + function: 'JSC::JSCallbackObject::staticFunctionGetterImpl' + key: 'return getValue' + line: 711 + reason: '[c-api] latent (C API glue): contract violation; would trip validateExceptionChecks in testapi' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/API/JSTypedArray.cpp' + function: 'createTypedArray' + key: 'return create' + line: 126 + reason: '[c-api] latent (C API glue): contract violation; would trip validateExceptionChecks in testapi' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/debugger/Debugger.cpp' + function: 'JSC::Debugger::pauseIfNeeded' + key: 'exit after handlePause' + line: 1131 + reason: 'TRIAGE-ME: the ThrowScope goes out of scope while the exception from ''handlePause'' (line 1121) is unchecked; check it (RETURN_IF_EXCEPTION) or release the scope' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/dfg/DFGOperations.cpp' + function: 'JSC::DFG::operationRegExpExecStickyKnownRegExp' + key: 'createRegExpMatchesArray -> setLastIndex' + line: 1770 + reason: 'TRIAGE-ME: ''setLastIndex'' can throw, but the exception from ''createRegExpMatchesArray'' (line 1762) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/dfg/DFGOperations.cpp' + function: 'JSC::DFG::operationCreateClonedArgumentsDuringExit' + key: 'putDirectIndex -> putDirectIndex' + line: 3035 + reason: '[osr-materialization] latent: OSR-exit materialization writes into freshly created objects (putDirectIndex fast path); a throw here would already be fatal' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/dfg/DFGOperations.cpp' + function: 'JSC::DFG::operationCompareStringLess' + key: 'view -> view' + line: 4949 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/dfg/DFGOperations.cpp' + function: 'JSC::DFG::operationCompareStringLessEq' + key: 'view -> view' + line: 4959 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/dfg/DFGOperations.cpp' + function: 'JSC::DFG::operationCompareStringGreater' + key: 'view -> view' + line: 4969 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/dfg/DFGOperations.cpp' + function: 'JSC::DFG::operationCompareStringGreaterEq' + key: 'view -> view' + line: 4979 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/dfg/DFGOperations.cpp' + function: 'JSC::DFG::operationGetDynamicVar(JSGlobalObject *, JSObject *, UniquedStringImpl *, unsigned int)::(anonymous class)::operator()' + key: 'getValue -> throwException' + line: 5871 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/dfg/DFGOperations.cpp' + function: 'JSC::DFG::putDynamicVar' + key: 'getValue -> throwException' + line: 5896 + count: 2 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/dfg/DFGOperations.cpp' + function: 'JSC::DFG::putDynamicVar' + key: 'getValue -> put' + line: 5908 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/dfg/DFGOperations.cpp' + function: 'JSC::DFG::operationThrowStaticError' + key: 'value -> throwException' + line: 6501 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/ftl/FTLOperations.cpp' + function: 'JSC::FTL::operationMaterializeObjectInOSR' + key: 'putDirectIndex -> putDirectIndex' + line: 686 + count: 4 + reason: '[osr-materialization] latent: OSR-exit materialization writes into freshly created objects (putDirectIndex fast path); a throw here would already be fatal' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::getOwnPrivatePropertySymbols' + key: 'getOwnPropertyNames -> putDirectIndex' + line: 345 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::getOwnPrivatePropertySymbols' + key: 'return after putDirectIndex' + line: 348 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::getInternalProperties' + key: 'boundArgsCopy -> putDirectIndex' + line: 570 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::weakMapEntries' + key: 'toIntegerOrInfinity -> constructEmptyArray' + line: 802 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::weakSetEntries' + key: 'toIntegerOrInfinity -> constructEmptyArray' + line: 845 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::iteratorEntries' + key: 'get -> toIntegerOrInfinity' + line: 923 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::queryInstances' + key: 'getPropertySlot -> throwTypeError' + line: 995 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::queryInstances' + key: 'getPropertySlot -> checkForbiddenPrototype' + line: 998 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::queryInstances' + key: 'checkForbiddenPrototype -> throwTypeError' + line: 999 + count: 6 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::queryInstances' + key: 'checkForbiddenPrototype -> checkForbiddenPrototype' + line: 1000 + count: 5 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::queryInstances' + key: 'checkForbiddenPrototype -> constructEmptyArray' + line: 1014 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::queryHolders' + key: 'putDirectIndex -> putDirectIndex' + line: 1198 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp' + function: 'Inspector::JSInjectedScriptHost::queryHolders' + key: 'return after putDirectIndex' + line: 1201 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp' + function: 'Inspector::jsInjectedScriptHostPrototypeFunctionInternalConstructorName' + key: 'return internalConstructorName' + line: 126 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp' + function: 'Inspector::jsInjectedScriptHostPrototypeFunctionIsPromiseRejectedWithNativeGetterTypeError' + key: 'return isPromiseRejectedWithNativeGetterTypeError' + line: 152 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp' + function: 'Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapEntries' + key: 'return weakMapEntries' + line: 204 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp' + function: 'Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetEntries' + key: 'return weakSetEntries' + line: 230 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp' + function: 'Inspector::jsInjectedScriptHostPrototypeFunctionIteratorEntries' + key: 'return iteratorEntries' + line: 243 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp' + function: 'Inspector::jsInjectedScriptHostPrototypeFunctionQueryInstances' + key: 'return queryInstances' + line: 256 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp' + function: 'Inspector::jsInjectedScriptHostPrototypeFunctionQueryHolders' + key: 'return queryHolders' + line: 269 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp' + function: 'Inspector::jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension' + key: 'return evaluateWithScopeExtension' + line: 282 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp' + function: 'Inspector::jsInjectedScriptHostPrototypeFunctionGetOwnPrivatePropertySymbols' + key: 'return getOwnPrivatePropertySymbols' + line: 321 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp' + function: 'Inspector::jsInjectedScriptHostPrototypeFunctionGetOwnPrivatePropertyMethods' + key: 'return getOwnPrivatePropertyMethods' + line: 334 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp' + function: 'Inspector::jsInjectedScriptHostPrototypeFunctionGetInternalProperties' + key: 'return getInternalProperties' + line: 347 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp' + function: 'Inspector::JSJavaScriptCallFrame::scopeDescriptions' + key: 'constructEmptyArray -> putDirectIndex' + line: 142 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp' + function: 'Inspector::JSJavaScriptCallFrame::scopeDescriptions' + key: 'return after constructEmptyArray' + line: 146 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp' + function: 'Inspector::JSJavaScriptCallFrame::scopeChain' + key: 'return constructArray' + line: 200 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp' + function: 'Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension' + key: 'return evaluateWithScopeExtension' + line: 83 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp' + function: 'Inspector::jsJavaScriptCallFramePrototypeFunctionScopeDescriptions' + key: 'return scopeDescriptions' + line: 96 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp' + function: 'Inspector::jsJavaScriptCallFrameAttributeScopeChain' + key: 'return scopeChain' + line: 174 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp' + function: 'Inspector::jsJavaScriptCallFrameAttributeThisObject' + key: 'return thisObject' + line: 187 + reason: '[inspector] latent (inspector-only code): contract violation not reachable from web content; fix opportunistically' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/interpreter/Interpreter.cpp' + function: 'JSC::eval' + key: 'value -> canCompileStrings' + line: 150 + reason: 'TRIAGE-ME: ''canCompileStrings'' can throw, but the exception from ''value'' (line 150) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/interpreter/Interpreter.cpp' + function: 'JSC::eval' + key: 'value -> reportViolationForUnsafeEval' + line: 160 + reason: 'TRIAGE-ME: ''reportViolationForUnsafeEval'' can throw, but the exception from ''value'' (line 160) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/interpreter/Interpreter.cpp' + function: 'JSC::eval' + key: 'reportViolationForUnsafeEval -> throwException' + line: 161 + reason: '[csp-callback] latent: globalObjectMethodTable CSP callbacks are indirect calls assumed throwing; followed by throwException/eval without a check' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/interpreter/Interpreter.cpp' + function: 'JSC::Interpreter::executeProgram' + key: 'getValue -> throwException' + line: 1170 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/interpreter/Interpreter.cpp' + function: 'JSC::Interpreter::executeProgram' + key: 'getValue -> get' + line: 1178 + reason: 'TRIAGE-ME: ''get'' can throw, but the exception from ''getValue'' (line 1169) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/interpreter/Interpreter.cpp' + function: 'JSC::Interpreter::executeProgram' + key: 'getValue -> put' + line: 1192 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/interpreter/Interpreter.cpp' + function: 'JSC::Interpreter::executeProgram' + key: 'getValue -> putByIndex' + line: 1197 + reason: 'TRIAGE-ME: ''putByIndex'' can throw, but the exception from ''getValue'' (line 1169) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/jit/JITOperations.cpp' + function: 'JSC::getPrivateName' + key: 'return getValue' + line: 4077 + count: 2 + reason: 'TRIAGE-ME: returning the result of throwing call ''getValue'' without releasing the scope; use RELEASE_AND_RETURN(scope, ...)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/jit/JITOperations.cpp' + function: 'JSC::operationGetFromScope(JSGlobalObject *, const JSInstruction *)::(anonymous class)::operator()' + key: 'getValue -> throwException' + line: 4730 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/jit/JITOperations.cpp' + function: 'JSC::operationGetFromScope(JSGlobalObject *, const JSInstruction *)::(anonymous class)::operator()' + key: 'getValue -> getValue' + line: 4738 + reason: 'TRIAGE-ME: ''getValue'' can throw, but the exception from ''getValue'' (line 4718) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/jit/JITOperations.cpp' + function: 'JSC::operationPutToScope' + key: 'getValue -> throwException' + line: 4779 + count: 2 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/jit/JITOperations.cpp' + function: 'JSC::operationPutToScope' + key: 'getValue -> put' + line: 4790 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/llint/LLIntSlowPaths.cpp' + function: 'JSC::LLInt::llint_slow_path_get_from_scope(CallFrame *, const JSInstruction *)::(anonymous class)::operator()' + key: 'getValue -> throwException' + line: 2363 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/llint/LLIntSlowPaths.cpp' + function: 'JSC::LLInt::llint_slow_path_get_from_scope(CallFrame *, const JSInstruction *)::(anonymous class)::operator()' + key: 'getValue -> getValue' + line: 2369 + reason: 'TRIAGE-ME: ''getValue'' can throw, but the exception from ''getValue'' (line 2351) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/llint/LLIntSlowPaths.cpp' + function: 'JSC::LLInt::llint_slow_path_put_to_scope' + key: 'getValue -> throwException' + line: 2404 + count: 2 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/llint/LLIntSlowPaths.cpp' + function: 'JSC::LLInt::llint_slow_path_put_to_scope' + key: 'getValue -> put' + line: 2411 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/lol/LOLJITOperations.cpp' + function: 'JSC::LOL::operationGetFromScopeForLOL(CallFrame *, unsigned int, JSObject *)::(anonymous class)::operator()' + key: 'getValue -> throwException' + line: 157 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/lol/LOLJITOperations.cpp' + function: 'JSC::LOL::operationGetFromScopeForLOL(CallFrame *, unsigned int, JSObject *)::(anonymous class)::operator()' + key: 'getValue -> getValue' + line: 165 + reason: 'TRIAGE-ME: ''getValue'' can throw, but the exception from ''getValue'' (line 145) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/lol/LOLJITOperations.cpp' + function: 'JSC::LOL::operationPutToScopeForLOL' + key: 'getValue -> throwException' + line: 205 + count: 2 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/lol/LOLJITOperations.cpp' + function: 'JSC::LOL::operationPutToScopeForLOL' + key: 'getValue -> put' + line: 216 + reason: '[tdz-slot-getvalue] latent: PropertySlot::getValue after JSGlobalLexicalEnvironment::getOwnPropertySlot is a plain value slot and cannot throw; contract-wise a check is missing' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/CommonSlowPaths.cpp' + function: 'JSC::slow_path_throw_static_error' + key: 'value -> throwException' + line: 1571 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/Completion.cpp' + function: 'JSC::loadAndEvaluateModule' + key: 'return after performPromiseThenWithInternalMicrotask' + line: 244 + reason: 'TRIAGE-ME: returning while the exception from ''performPromiseThenWithInternalMicrotask'' (line 242) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ConsoleObject.cpp' + function: 'JSC::consoleProtoFuncCount' + key: 'return after count' + line: 244 + reason: '[console-client] latent: ConsoleClient callbacks may reach throwing code only via argument stringification; unchecked before return' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ConsoleObject.cpp' + function: 'JSC::consoleProtoFuncCountReset' + key: 'return after countReset' + line: 258 + reason: '[console-client] latent: ConsoleClient callbacks may reach throwing code only via argument stringification; unchecked before return' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ConsoleObject.cpp' + function: 'JSC::consoleProtoFuncProfile' + key: 'return after profile' + line: 272 + count: 2 + reason: '[console-client] latent: ConsoleClient callbacks may reach throwing code only via argument stringification; unchecked before return' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ConsoleObject.cpp' + function: 'JSC::consoleProtoFuncProfileEnd' + key: 'return after profileEnd' + line: 293 + count: 2 + reason: '[console-client] latent: ConsoleClient callbacks may reach throwing code only via argument stringification; unchecked before return' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ConsoleObject.cpp' + function: 'JSC::consoleProtoFuncTakeHeapSnapshot' + key: 'return after takeHeapSnapshot' + line: 314 + count: 2 + reason: '[console-client] latent: ConsoleClient callbacks may reach throwing code only via argument stringification; unchecked before return' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ConsoleObject.cpp' + function: 'JSC::consoleProtoFuncTime' + key: 'return after time' + line: 335 + reason: '[console-client] latent: ConsoleClient callbacks may reach throwing code only via argument stringification; unchecked before return' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ConsoleObject.cpp' + function: 'JSC::consoleProtoFuncTimeLog' + key: 'return after timeLog' + line: 349 + reason: '[console-client] latent: ConsoleClient callbacks may reach throwing code only via argument stringification; unchecked before return' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ConsoleObject.cpp' + function: 'JSC::consoleProtoFuncTimeEnd' + key: 'return after timeEnd' + line: 363 + reason: '[console-client] latent: ConsoleClient callbacks may reach throwing code only via argument stringification; unchecked before return' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/CyclicModuleRecord.cpp' + function: 'JSC::CyclicModuleRecord::executeAsync' + key: 'performPromiseThenWithInternalMicrotask -> execute' + line: 551 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/CyclicModuleRecord.cpp' + function: 'JSC::CyclicModuleRecord::asyncExecutionFulfilled' + key: 'asyncExecutionRejected -> executeAsync' + line: 718 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/CyclicModuleRecord.cpp' + function: 'JSC::CyclicModuleRecord::asyncExecutionFulfilled' + key: 'asyncExecutionRejected -> execute' + line: 727 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/CyclicModuleRecord.cpp' + function: 'JSC::CyclicModuleRecord::asyncExecutionFulfilled' + key: 'exit after asyncExecutionRejected' + line: 751 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/DirectEvalExecutable.cpp' + function: 'JSC::DirectEvalExecutable::create' + key: 'reportViolationForUnsafeEval -> throwException' + line: 45 + reason: '[csp-callback] latent: globalObjectMethodTable CSP callbacks are indirect calls assumed throwing; followed by throwException/eval without a check' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ErrorInstance.cpp' + function: 'JSC::ErrorInstance::sanitizedMessageString' + key: 'getOwnPropertySlot -> getValue' + line: 253 + reason: 'TRIAGE-ME: ''getValue'' can throw, but the exception from ''getOwnPropertySlot'' (line 252) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ErrorInstance.cpp' + function: 'JSC::ErrorInstance::sanitizedNameString' + key: 'getOwnPropertySlot -> getOwnPropertySlot' + line: 280 + reason: 'TRIAGE-ME: ''getOwnPropertySlot'' can throw, but the exception from ''getOwnPropertySlot'' (line 280) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ErrorInstance.cpp' + function: 'JSC::ErrorInstance::sanitizedNameString' + key: 'getOwnPropertySlot -> getValue' + line: 281 + reason: 'TRIAGE-ME: ''getValue'' can throw, but the exception from ''getOwnPropertySlot'' (line 280) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/FunctionConstructor.cpp' + function: 'JSC::constructFunction' + key: 'reportViolationForUnsafeEval -> throwException' + line: 206 + reason: '[csp-callback] latent: globalObjectMethodTable CSP callbacks are indirect calls assumed throwing; followed by throwException/eval without a check' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/IndirectEvalExecutable.cpp' + function: 'JSC::IndirectEvalExecutable::createImpl' + key: 'reportViolationForUnsafeEval -> throwException' + line: 46 + reason: '[csp-callback] latent: globalObjectMethodTable CSP callbacks are indirect calls assumed throwing; followed by throwException/eval without a check' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSArrayBufferView.cpp' + function: 'JSC::JSArrayBufferView::unsharedJSBuffer' + key: 'return toJS' + line: 245 + reason: 'TRIAGE-ME: returning the result of throwing call ''toJS'' without releasing the scope; use RELEASE_AND_RETURN(scope, ...)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSArrayBufferView.cpp' + function: 'JSC::JSArrayBufferView::possiblySharedJSBuffer' + key: 'return toJS' + line: 255 + reason: 'TRIAGE-ME: returning the result of throwing call ''toJS'' without releasing the scope; use RELEASE_AND_RETURN(scope, ...)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSCJSValue.cpp' + function: 'JSC::JSValue::putToPrimitiveByIndex' + key: 'return putToPrimitive' + line: 240 + reason: 'TRIAGE-ME: returning the result of throwing call ''putToPrimitive'' without releasing the scope; use RELEASE_AND_RETURN(scope, ...)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSGlobalObject.cpp' + function: 'JSC::jsonParse' + key: 'return JSONParse' + line: 465 + reason: 'TRIAGE-ME: returning the result of throwing call ''JSONParse'' without releasing the scope; use RELEASE_AND_RETURN(scope, ...)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSGlobalObject.cpp' + function: 'JSC::JSGlobalObject::tryInstallSpeciesWatchpoint' + key: 'return after getValue' + line: 3314 + reason: 'TRIAGE-ME: returning while the exception from ''getValue'' (line 3312) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSGlobalObject.cpp' + function: 'JSC::JSGlobalObject::tryInstallSpeciesWatchpoint' + key: 'getValue -> getOwnPropertySlot' + line: 3322 + reason: 'TRIAGE-ME: ''getOwnPropertySlot'' can throw, but the exception from ''getValue'' (line 3312) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp' + function: 'JSC::globalFuncEval' + key: 'reportViolationForUnsafeEval -> throwException' + line: 493 + reason: '[csp-callback] latent: globalObjectMethodTable CSP callbacks are indirect calls assumed throwing; followed by throwException/eval without a check' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSMicrotask.cpp' + function: 'JSC::moduleRegistryFetchSettled' + key: 'setFetchError -> reject' + line: 941 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSMicrotask.cpp' + function: 'JSC::moduleLoadTopSettled' + key: 'performPromiseThenWithInternalMicrotask -> performPromiseThenWithInternalMicrotask' + line: 1136 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSMicrotask.cpp' + function: 'JSC::moduleLoadTopSettled' + key: 'performPromiseThenWithInternalMicrotask -> pipeFrom' + line: 1138 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSMicrotask.cpp' + function: 'JSC::moduleLoadTopSettled' + key: 'getErrorInfo -> setFetchError' + line: 1154 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSMicrotask.cpp' + function: 'JSC::moduleLoadTopSettled' + key: 'setFetchError -> reject' + line: 1161 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSMicrotask.cpp' + function: 'JSC::moduleLoadStoreError' + key: 'getErrorInfo -> isFetchError' + line: 1355 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSMicrotask.cpp' + function: 'JSC::moduleLoadStoreError' + key: 'isFetchError -> setFetchError' + line: 1356 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSMicrotask.cpp' + function: 'JSC::dynamicImportLoadSettled' + key: 'performPromiseThenWithInternalMicrotask -> performPromiseThenWithInternalMicrotask' + line: 1472 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp' + function: 'JSC::JSModuleEnvironment::getOwnPropertySlot' + key: 'getOwnPropertySlot -> getValue' + line: 89 + reason: 'TRIAGE-ME: ''getValue'' can throw, but the exception from ''getOwnPropertySlot'' (line 86) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp' + function: 'JSC::JSModuleEnvironment::deleteProperty' + key: 'return deleteProperty' + line: 140 + reason: 'TRIAGE-ME: returning the result of throwing call ''deleteProperty'' without releasing the scope; use RELEASE_AND_RETURN(scope, ...)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::maybeDuplicateFetchError' + key: 'hasOwnProperty -> duplicateError' + line: 166 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::loadModule' + key: 'return rejectedPromise' + line: 367 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::loadModule' + key: 'ensureFetchPromise -> fetch' + line: 374 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::loadModule' + key: 'ensureFetchPromise -> performPromiseThenWithInternalMicrotask' + line: 387 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::loadModule' + key: 'performPromiseThenWithInternalMicrotask -> performPromiseThenWithInternalMicrotask' + line: 391 + count: 2 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::loadModule' + key: 'return after performPromiseThenWithInternalMicrotask' + line: 393 + count: 2 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::requestImportModule' + key: 'return after performPromiseThenWithInternalMicrotask' + line: 458 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::hostLoadImportedModule' + key: 'reject -> finishLoadingImportedModule' + line: 660 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::hostLoadImportedModule' + key: 'return rejectedPromise' + line: 708 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::hostLoadImportedModule' + key: 'ensureFetchPromise -> ensureModulePromise' + line: 719 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::hostLoadImportedModule' + key: 'ensureModulePromise -> fetch' + line: 729 + count: 2 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::hostLoadImportedModule' + key: 'ensureModulePromise -> makeModule' + line: 742 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::hostLoadImportedModule' + key: 'ensureModulePromise -> finishLoadingImportedModule' + line: 763 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::hostLoadImportedModule' + key: 'ensureModulePromise -> performPromiseThenWithInternalMicrotask' + line: 769 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::hostLoadImportedModule' + key: 'return after performPromiseThenWithInternalMicrotask' + line: 773 + count: 2 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::hostLoadImportedModule' + key: 'ensureFetchPromise -> pipeFrom' + line: 786 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::hostLoadImportedModule' + key: 'pipeFrom -> ensureModulePromise' + line: 788 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleLoader.cpp' + function: 'JSC::JSModuleLoader::innerModuleLoading' + key: 'performPromiseThenWithInternalMicrotask -> hostLoadImportedModule' + line: 881 + reason: '[module-loader] latent (module loading): promise-plumbing helpers leave a pending obligation; failures surface as rejections in practice' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp' + function: 'JSC::JSModuleNamespaceObject::getOwnPropertySlotCommon' + key: 'return getOwnPropertySlot' + line: 156 + count: 2 + reason: 'TRIAGE-ME: returning the result of throwing call ''getOwnPropertySlot'' without releasing the scope; use RELEASE_AND_RETURN(scope, ...)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp' + function: 'JSC::JSModuleNamespaceObject::overrideExports' + key: 'put -> getModuleNamespace' + line: 407 + reason: 'TRIAGE-ME: ''getModuleNamespace'' can throw, but the exception from ''put'' (line 415) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp' + function: 'JSC::JSModuleNamespaceObject::overrideExports' + key: 'symbolTablePutTouchWatchpointSet -> put' + line: 415 + reason: 'TRIAGE-ME: ''put'' can throw, but the exception from ''symbolTablePutTouchWatchpointSet'' (line 412) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp' + function: 'JSC::JSModuleNamespaceObject::overrideExports' + key: 'exit after put' + line: 419 + reason: 'TRIAGE-ME: the ThrowScope goes out of scope while the exception from ''put'' (line 415) is unchecked; check it (RETURN_IF_EXCEPTION) or release the scope' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSObject.cpp' + function: 'JSC::JSObject::setPrototypeWithCycleCheck' + key: 'return after getPrototype' + line: 2157 + reason: 'TRIAGE-ME: returning while the exception from ''getPrototype'' (line 2156) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSObject.cpp' + function: 'JSC::JSObject::setPrototypeWithCycleCheck' + key: 'getPrototype -> typeError' + line: 2159 + reason: 'TRIAGE-ME: ''typeError'' can throw, but the exception from ''getPrototype'' (line 2156) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSObject.cpp' + function: 'JSC::JSObject::setPrototypeWithCycleCheck' + key: 'return after toThis' + line: 2167 + reason: 'TRIAGE-ME: returning while the exception from ''toThis'' (line 2164) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSObject.cpp' + function: 'JSC::JSObject::setPrototypeWithCycleCheck' + key: 'toThis -> isExtensible' + line: 2169 + reason: 'TRIAGE-ME: ''isExtensible'' can throw, but the exception from ''toThis'' (line 2164) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSObject.cpp' + function: 'JSC::validateAndApplyPropertyDescriptor' + key: 'return after putDirectAccessor' + line: 3984 + count: 2 + reason: 'TRIAGE-ME: returning while the exception from ''putDirectAccessor'' (line 3976) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSOrderedHashTableHelper.h' + function: 'JSC::JSOrderedHashTableHelper::find' + key: 'return find' + line: 392 + reason: 'TRIAGE-ME: returning the result of throwing call ''find'' without releasing the scope; use RELEASE_AND_RETURN(scope, ...)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSPromise.cpp' + function: 'JSC::JSPromise::promiseReject' + key: 'return after reject' + line: 1196 + reason: '[promise] latent (promise machinery): call()/reject helpers after which the function returns; exceptions become rejections' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp' + function: 'JSC::promiseConstructorFuncAll' + key: 'throw@503 -> operator()' + line: 504 + reason: '[promise] latent (promise machinery): call()/reject helpers after which the function returns; exceptions become rejections' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp' + function: 'JSC::promiseConstructorFuncAllSettled' + key: 'throw@812 -> operator()' + line: 813 + reason: '[promise] latent (promise machinery): call()/reject helpers after which the function returns; exceptions become rejections' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp' + function: 'JSC::promiseConstructorFuncAny' + key: 'throw@1265 -> operator()' + line: 1266 + reason: '[promise] latent (promise machinery): call()/reject helpers after which the function returns; exceptions become rejections' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/JSPromisePrototype.cpp' + function: 'JSC::promiseProtoFuncFinally' + key: 'return after performPromiseThenWithInternalMicrotask' + line: 300 + reason: '[promise] latent (promise machinery): call()/reject helpers after which the function returns; exceptions become rejections' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/ModuleProgramExecutable.cpp' + function: 'JSC::ModuleProgramExecutable::tryCreate' + key: 'return after getUnlinkedCodeBlock' + line: 87 + reason: 'TRIAGE-ME: returning while the exception from ''getUnlinkedCodeBlock'' (line 86) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/OperationsInlines.h' + function: 'JSC::jsLess' + key: 'return view' + line: 474 + reason: 'TRIAGE-ME: returning the result of throwing call ''view'' without releasing the scope; use RELEASE_AND_RETURN(scope, ...)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/OperationsInlines.h' + function: 'JSC::jsLess' + key: 'view -> view' + line: 474 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/OperationsInlines.h' + function: 'JSC::jsLessEq' + key: 'return view' + line: 523 + reason: 'TRIAGE-ME: returning the result of throwing call ''view'' without releasing the scope; use RELEASE_AND_RETURN(scope, ...)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/OperationsInlines.h' + function: 'JSC::jsLessEq' + key: 'view -> view' + line: 523 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/PropertyDescriptor.cpp' + function: 'JSC::PropertyDescriptor::equalTo' + key: 'return strictEqual' + line: 259 + reason: 'TRIAGE-ME: returning the result of throwing call ''strictEqual'' without releasing the scope; use RELEASE_AND_RETURN(scope, ...)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/PropertyDescriptor.cpp' + function: 'JSC::PropertyDescriptor::equalTo' + key: 'strictEqual -> strictEqual' + line: 260 + reason: 'TRIAGE-ME: ''strictEqual'' can throw, but the exception from ''strictEqual'' (line 259) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/RegExpObjectInlines.h' + function: 'JSC::RegExpObject::execInline' + key: 'createRegExpMatchesArray -> setLastIndex' + line: 251 + reason: 'TRIAGE-ME: ''setLastIndex'' can throw, but the exception from ''createRegExpMatchesArray'' (line 241) has not been checked yet (missing RETURN_IF_EXCEPTION between them)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/SetPrototype.cpp' + function: 'JSC::getSetSizeAsInt' + key: 'toIntegerOrInfinity -> throwVMRangeError' + line: 213 + reason: '[tointeger-on-number-or-latent] latent: toIntegerOrInfinity(...) — throwing callee left unchecked before the next verification point' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/SetPrototype.cpp' + function: 'JSC::getSetSizeAsInt' + key: 'return after toIntegerOrInfinity' + line: 216 + count: 2 + reason: 'TRIAGE-ME: returning while the exception from ''toIntegerOrInfinity'' (line 210) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/StringPrototype.cpp' + function: 'JSC::stringProtoFuncToLowerCase' + key: 'return after view' + line: 1714 + reason: 'TRIAGE-ME: returning while the exception from ''view'' (line 1704) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/StringPrototype.cpp' + function: 'JSC::stringProtoFuncToLowerCase' + key: 'view -> value' + line: 1717 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/StringPrototype.cpp' + function: 'JSC::stringProtoFuncToUpperCase' + key: 'return after view' + line: 1750 + reason: 'TRIAGE-ME: returning while the exception from ''view'' (line 1740) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/StringPrototype.cpp' + function: 'JSC::stringProtoFuncToUpperCase' + key: 'view -> value' + line: 1753 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/StringPrototypeInlines.h' + function: 'JSC::tryReplaceOneCharUsingString' + key: 'value -> value' + line: 598 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/runtime/StringPrototypeInlines.h' + function: 'JSC::replaceAllWithCacheUsingRegExpSearchThreeArguments' + key: 'value -> value' + line: 947 + count: 2 + reason: '[rope-resolution-oom] latent: JSString::value/view can only throw OOM on rope resolution; second resolution unchecked' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/tools/JSDollarVM.cpp' + function: '(anonymous namespace)::ImpureGetter::getOwnPropertySlot' + key: 'return after getPropertySlot' + line: 498 + reason: '[testing-only] latent (testing/tooling-only code)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/tools/JSDollarVM.cpp' + function: '(anonymous namespace)::ImpureGetter::getOwnPropertySlot' + key: 'return getOwnPropertySlot' + line: 502 + reason: '[testing-only] latent (testing/tooling-only code)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/tools/JSDollarVM.cpp' + function: 'JSC::functionSetUserPreferredLanguages' + key: 'get -> toWTFString' + line: 4100 + reason: '[testing-only] latent (testing/tooling-only code)' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/wasm/js/JSWebAssembly.cpp' + function: 'JSC::compileAndInstantiate' + key: 'exit after addPendingWork' + line: 336 + reason: 'TRIAGE-ME: the ThrowScope goes out of scope while the exception from ''addPendingWork'' (line 297) is unchecked; check it (RETURN_IF_EXCEPTION) or release the scope' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/wasm/js/JSWebAssembly.cpp' + function: 'JSC::webAssemblyCompileStreamingFunc' + key: 'return after performPromiseThenWithInternalMicrotask' + line: 485 + reason: 'TRIAGE-ME: returning while the exception from ''performPromiseThenWithInternalMicrotask'' (line 484) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/wasm/js/JSWebAssembly.cpp' + function: 'JSC::webAssemblyInstantiateStreamingFunc' + key: 'return after performPromiseThenWithInternalMicrotask' + line: 534 + reason: 'TRIAGE-ME: returning while the exception from ''performPromiseThenWithInternalMicrotask'' (line 533) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/wasm/js/WebAssemblySuspending.cpp' + function: 'JSC::runWebAssemblySuspendingFunction' + key: 'return after performPromiseThen' + line: 189 + reason: 'TRIAGE-ME: returning while the exception from ''performPromiseThen'' (line 187) is unchecked; check it (RETURN_IF_EXCEPTION) or use RELEASE_AND_RETURN' +- rule: jsc-unchecked-exception + file: 'Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp' + function: 'JSC::webAssemblyTableProtoFuncGrow' + key: 'addressValueToUint64 -> throwVMTypeError' + line: 97 + reason: 'TRIAGE-ME: throwing via ''throwVMTypeError'' while the exception from ''addressValueToUint64'' (line 95) has not been checked' diff --git a/release.sh b/release.sh index 160139a481a1e..dcdddafc50bc1 100644 --- a/release.sh +++ b/release.sh @@ -54,6 +54,13 @@ export DEBIAN_VERSION="bookworm" export temp=${temp:-"$(mktemp -d -t bun-webkit-linux-$BUILDKIT_ARCH-release-$(date +%s)-XXXX)"} export ENABLE_SANITIZERS=${ENABLE_SANITIZERS:-} +# wklint (JSC exception-check linter): set WKLINT_TAG (a webkit-lint release tag) +# and WEBKIT_LINT_RELEASE_TOKEN in the environment to run it during the build. +export WKLINT_TAG=${WKLINT_TAG:-""} +WKLINT_SECRET_ARGS="" +if [ -n "$WKLINT_TAG" ] && [ -n "${WEBKIT_LINT_RELEASE_TOKEN:-}" ]; then + WKLINT_SECRET_ARGS="--secret id=WEBKIT_LINT_RELEASE_TOKEN,env=WEBKIT_LINT_RELEASE_TOKEN" +fi export USE_MIMALLOC=${USE_MIMALLOC:-"OFF"} export USE_EXTERNAL_MIMALLOC=${USE_EXTERNAL_MIMALLOC:-"OFF"} @@ -70,6 +77,8 @@ docker buildx build \ --build-arg MARCH_FLAG="$MARCH_FLAG" \ --build-arg RELEASE_FLAGS="$RELEASE_FLAGS" \ --build-arg WEBKIT_RELEASE_TYPE=$WEBKIT_RELEASE_TYPE \ + --build-arg WKLINT_TAG="$WKLINT_TAG" \ + $WKLINT_SECRET_ARGS \ --build-arg RELEASE_FLAGS="${RELEASE_FLAGS:-"-O2 -DNDEBUG=1"}" \ --build-arg USE_MIMALLOC="$USE_MIMALLOC" \ --build-arg USE_EXTERNAL_MIMALLOC="$USE_EXTERNAL_MIMALLOC" \ From ba78a44e9af4cbea036eaca3b28d7c05f9a4974f Mon Sep 17 00:00:00 2001 From: Sosuke Suzuki Date: Tue, 21 Jul 2026 17:01:36 +0900 Subject: [PATCH 2/8] Default wklint to the latest webkit-lint release WKLINT_TAG now accepts "latest" (the default), a specific autobuild tag, or "off", so no repository variable is needed to keep the linter on the newest analyzer. When the release token secret is unavailable (fork PRs), the lint step is skipped instead of failing the build. --- .github/workflows/build-reusable.yml | 6 +++--- Dockerfile | 12 ++++++++---- release.sh | 7 +++++-- 3 files changed, 16 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml index 02d7217a49499..d35359debef04 100644 --- a/.github/workflows/build-reusable.yml +++ b/.github/workflows/build-reusable.yml @@ -23,9 +23,9 @@ on: type: string default: '19' wklint_tag: - description: 'oven-sh/webkit-lint release tag to run the JSC exception-check linter (empty = skip; falls back to the WKLINT_TAG repository variable)' + description: 'oven-sh/webkit-lint release for the JSC exception-check linter: "latest", an "autobuild-" tag, or "off"' type: string - default: '' + default: 'latest' outputs: release_tag: description: 'The release tag that was created' @@ -129,7 +129,7 @@ jobs: env: RELEASE_FLAGS: ${{matrix.RELEASE_FLAGS}} ENABLE_SANITIZERS: ${{matrix.ENABLE_SANITIZERS}} - WKLINT_TAG: ${{ matrix.wklint == 'true' && (inputs.wklint_tag || vars.WKLINT_TAG || '') || '' }} + WKLINT_TAG: ${{ (matrix.wklint == 'true' && (inputs.wklint_tag || vars.WKLINT_TAG || 'latest') != 'off') && (inputs.wklint_tag || vars.WKLINT_TAG || 'latest') || '' }} WEBKIT_LINT_RELEASE_TOKEN: ${{ secrets.WEBKIT_LINT_RELEASE_TOKEN }} run: | rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz diff --git a/Dockerfile b/Dockerfile index c2c4697e1011a..02f49f96b3c18 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,9 +6,9 @@ ARG RELEASE_FLAGS="-O3 -DNDEBUG=1" ARG LLVM_VERSION="21" ARG DEFAULT_CFLAGS="-mno-omit-leaf-frame-pointer -g -fno-omit-frame-pointer -ffunction-sections -fdata-sections -faddrsig -fno-unwind-tables -fno-asynchronous-unwind-tables -DU_STATIC_IMPLEMENTATION=1 " ARG ENABLE_SANITIZERS="" -# wklint (JSC exception-check linter) release tag from oven-sh/webkit-lint, -# e.g. "autobuild-". Empty = do not lint. -ARG WKLINT_TAG="" +# wklint (JSC exception-check linter) release from oven-sh/webkit-lint: +# "latest" (default), a specific "autobuild-" tag, or "" to not lint. +ARG WKLINT_TAG="latest" ARG USE_MIMALLOC="OFF" ARG USE_EXTERNAL_MIMALLOC="OFF" @@ -120,7 +120,11 @@ RUN --mount=type=secret,id=WEBKIT_LINT_RELEASE_TOKEN \ if [ -n "$WKLINT_TAG" ]; then \ set -eu; \ token=$(cat /run/secrets/WEBKIT_LINT_RELEASE_TOKEN); \ - api="https://api.github.com/repos/oven-sh/webkit-lint/releases/tags/${WKLINT_TAG}"; \ + if [ "$WKLINT_TAG" = "latest" ]; then \ + api="https://api.github.com/repos/oven-sh/webkit-lint/releases/latest"; \ + else \ + api="https://api.github.com/repos/oven-sh/webkit-lint/releases/tags/${WKLINT_TAG}"; \ + fi; \ asset_url=$(curl -fsSL -H "Authorization: token ${token}" "$api" \ | python3 -c 'import json,sys; print([a["url"] for a in json.load(sys.stdin)["assets"] if a["name"].endswith("-linux-x64.tar.zst")][0])'); \ curl -fsSL -H "Authorization: token ${token}" -H "Accept: application/octet-stream" \ diff --git a/release.sh b/release.sh index dcdddafc50bc1..12ced60ca59c0 100644 --- a/release.sh +++ b/release.sh @@ -56,10 +56,13 @@ export temp=${temp:-"$(mktemp -d -t bun-webkit-linux-$BUILDKIT_ARCH-release-$(da export ENABLE_SANITIZERS=${ENABLE_SANITIZERS:-} # wklint (JSC exception-check linter): set WKLINT_TAG (a webkit-lint release tag) # and WEBKIT_LINT_RELEASE_TOKEN in the environment to run it during the build. -export WKLINT_TAG=${WKLINT_TAG:-""} +export WKLINT_TAG=${WKLINT_TAG:-"latest"} WKLINT_SECRET_ARGS="" -if [ -n "$WKLINT_TAG" ] && [ -n "${WEBKIT_LINT_RELEASE_TOKEN:-}" ]; then +if [ -n "${WEBKIT_LINT_RELEASE_TOKEN:-}" ]; then WKLINT_SECRET_ARGS="--secret id=WEBKIT_LINT_RELEASE_TOKEN,env=WEBKIT_LINT_RELEASE_TOKEN" +else + # No token available (e.g. a fork PR without secrets): skip the linter. + WKLINT_TAG="" fi export USE_MIMALLOC=${USE_MIMALLOC:-"OFF"} export USE_EXTERNAL_MIMALLOC=${USE_EXTERNAL_MIMALLOC:-"OFF"} From e65dc0b2d88bcaaa579391ca661d183afc6e3b04 Mon Sep 17 00:00:00 2001 From: Sosuke Suzuki Date: Tue, 21 Jul 2026 17:16:28 +0900 Subject: [PATCH 3/8] Pass the webkit-lint release token into the reusable build workflow Reusable (workflow_call) workflows do not inherit secrets by default, so WEBKIT_LINT_RELEASE_TOKEN was empty inside build-reusable.yml and the linter was silently skipped. Declare it as an (optional) secret input and inherit secrets from build.yml / build-preview.yml. --- .github/workflows/build-preview.yml | 1 + .github/workflows/build-reusable.yml | 4 ++++ .github/workflows/build.yml | 1 + 3 files changed, 6 insertions(+) diff --git a/.github/workflows/build-preview.yml b/.github/workflows/build-preview.yml index 08696c1926757..e6dfbf363fe3b 100644 --- a/.github/workflows/build-preview.yml +++ b/.github/workflows/build-preview.yml @@ -76,6 +76,7 @@ jobs: permissions: contents: write uses: ./.github/workflows/build-reusable.yml + secrets: inherit with: build_ref: ${{ needs.trigger.outputs.sha }} release_tag: ${{ needs.trigger.outputs.release_tag }} diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml index d35359debef04..2a0f78e373233 100644 --- a/.github/workflows/build-reusable.yml +++ b/.github/workflows/build-reusable.yml @@ -26,6 +26,10 @@ on: description: 'oven-sh/webkit-lint release for the JSC exception-check linter: "latest", an "autobuild-" tag, or "off"' type: string default: 'latest' + secrets: + WEBKIT_LINT_RELEASE_TOKEN: + description: 'Read access to oven-sh/webkit-lint releases (optional; the linter is skipped without it)' + required: false outputs: release_tag: description: 'The release tag that was created' diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 97a1721913f36..dea44df61c2d9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -18,6 +18,7 @@ jobs: permissions: contents: write uses: ./.github/workflows/build-reusable.yml + secrets: inherit with: build_ref: ${{ github.sha }} release_tag: autobuild-${{ github.sha }} From 9abd4f9703081dee6a3b7e9a848bc5214122dadf Mon Sep 17 00:00:00 2001 From: Sosuke Suzuki Date: Tue, 21 Jul 2026 17:24:43 +0900 Subject: [PATCH 4/8] Run the linter only on the opt-in amd64 leg The wklint prebuilt is x86-64, so unconditionally enabling it made the arm64 Docker builds fail with an exec format error. Lint is now opt-in per matrix leg (the workflow sets WKLINT_TAG=latest only where wklint: true), the Dockerfile default is off, and the fetch stage additionally requires TARGETARCH=amd64. --- .envrc | 2 ++ .github/workflows/build-reusable.yml | 2 +- .zed/debug.json | 0 Dockerfile | 7 ++++--- build/bctest/app2.js | 10 ++++++++++ release.sh | 2 +- 6 files changed, 18 insertions(+), 5 deletions(-) create mode 100644 .envrc create mode 100644 .zed/debug.json create mode 100644 build/bctest/app2.js diff --git a/.envrc b/.envrc new file mode 100644 index 0000000000000..207236abb4ca6 --- /dev/null +++ b/.envrc @@ -0,0 +1,2 @@ +export CC=/opt/homebrew/opt/llvm/bin/clang +export CXX=/opt/homebrew/opt/llvm/bin/clang++ diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml index 2a0f78e373233..524a3b4aec7d7 100644 --- a/.github/workflows/build-reusable.yml +++ b/.github/workflows/build-reusable.yml @@ -133,7 +133,7 @@ jobs: env: RELEASE_FLAGS: ${{matrix.RELEASE_FLAGS}} ENABLE_SANITIZERS: ${{matrix.ENABLE_SANITIZERS}} - WKLINT_TAG: ${{ (matrix.wklint == 'true' && (inputs.wklint_tag || vars.WKLINT_TAG || 'latest') != 'off') && (inputs.wklint_tag || vars.WKLINT_TAG || 'latest') || '' }} + WKLINT_TAG: ${{ matrix.wklint == 'true' && (inputs.wklint_tag || vars.WKLINT_TAG || 'latest') != 'off' && (inputs.wklint_tag || vars.WKLINT_TAG || 'latest') || '' }} WEBKIT_LINT_RELEASE_TOKEN: ${{ secrets.WEBKIT_LINT_RELEASE_TOKEN }} run: | rm -rf ${{runner.temp}}/bun-webkit ${{runner.temp}}/bun-webkit.tar.gz diff --git a/.zed/debug.json b/.zed/debug.json new file mode 100644 index 0000000000000..e69de29bb2d1d diff --git a/Dockerfile b/Dockerfile index 02f49f96b3c18..29badd9d0c411 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,8 +7,9 @@ ARG LLVM_VERSION="21" ARG DEFAULT_CFLAGS="-mno-omit-leaf-frame-pointer -g -fno-omit-frame-pointer -ffunction-sections -fdata-sections -faddrsig -fno-unwind-tables -fno-asynchronous-unwind-tables -DU_STATIC_IMPLEMENTATION=1 " ARG ENABLE_SANITIZERS="" # wklint (JSC exception-check linter) release from oven-sh/webkit-lint: -# "latest" (default), a specific "autobuild-" tag, or "" to not lint. -ARG WKLINT_TAG="latest" +# "latest", a specific "autobuild-" tag, or "" (default: do not lint). +# The prebuilt is x86-64 only, so it also stays off on non-amd64 builds. +ARG WKLINT_TAG="" ARG USE_MIMALLOC="OFF" ARG USE_EXTERNAL_MIMALLOC="OFF" @@ -117,7 +118,7 @@ RUN wget https://apt.llvm.org/llvm.sh \ # Fetched only when WKLINT_TAG is set; the token is a BuildKit secret because # the release lives in an internal repository. RUN --mount=type=secret,id=WEBKIT_LINT_RELEASE_TOKEN \ - if [ -n "$WKLINT_TAG" ]; then \ + if [ -n "$WKLINT_TAG" ] && [ "$TARGETARCH" = "amd64" ]; then \ set -eu; \ token=$(cat /run/secrets/WEBKIT_LINT_RELEASE_TOKEN); \ if [ "$WKLINT_TAG" = "latest" ]; then \ diff --git a/build/bctest/app2.js b/build/bctest/app2.js new file mode 100644 index 0000000000000..8f3d441928e0c --- /dev/null +++ b/build/bctest/app2.js @@ -0,0 +1,10 @@ +const fs = require("node:fs"); +const stream = require("node:stream"); +const path = require("node:path"); +const util = require("node:util"); +console.log(JSON.stringify({ + fs: typeof fs.readFileSync, + stream: typeof stream.Readable, + path: typeof path.join, + util: typeof util.inspect, +})); diff --git a/release.sh b/release.sh index 12ced60ca59c0..d2af2cc528cbc 100644 --- a/release.sh +++ b/release.sh @@ -56,7 +56,7 @@ export temp=${temp:-"$(mktemp -d -t bun-webkit-linux-$BUILDKIT_ARCH-release-$(da export ENABLE_SANITIZERS=${ENABLE_SANITIZERS:-} # wklint (JSC exception-check linter): set WKLINT_TAG (a webkit-lint release tag) # and WEBKIT_LINT_RELEASE_TOKEN in the environment to run it during the build. -export WKLINT_TAG=${WKLINT_TAG:-"latest"} +export WKLINT_TAG=${WKLINT_TAG:-""} WKLINT_SECRET_ARGS="" if [ -n "${WEBKIT_LINT_RELEASE_TOKEN:-}" ]; then WKLINT_SECRET_ARGS="--secret id=WEBKIT_LINT_RELEASE_TOKEN,env=WEBKIT_LINT_RELEASE_TOKEN" From a928c9f5790d2d49ed1f8733848f12876e3cf6d6 Mon Sep 17 00:00:00 2001 From: Sosuke Suzuki Date: Tue, 21 Jul 2026 17:25:31 +0900 Subject: [PATCH 5/8] Remove local editor/env files added by mistake --- .envrc | 2 -- .zed/debug.json | 0 build/bctest/app2.js | 10 ---------- 3 files changed, 12 deletions(-) delete mode 100644 .envrc delete mode 100644 .zed/debug.json delete mode 100644 build/bctest/app2.js diff --git a/.envrc b/.envrc deleted file mode 100644 index 207236abb4ca6..0000000000000 --- a/.envrc +++ /dev/null @@ -1,2 +0,0 @@ -export CC=/opt/homebrew/opt/llvm/bin/clang -export CXX=/opt/homebrew/opt/llvm/bin/clang++ diff --git a/.zed/debug.json b/.zed/debug.json deleted file mode 100644 index e69de29bb2d1d..0000000000000 diff --git a/build/bctest/app2.js b/build/bctest/app2.js deleted file mode 100644 index 8f3d441928e0c..0000000000000 --- a/build/bctest/app2.js +++ /dev/null @@ -1,10 +0,0 @@ -const fs = require("node:fs"); -const stream = require("node:stream"); -const path = require("node:path"); -const util = require("node:util"); -console.log(JSON.stringify({ - fs: typeof fs.readFileSync, - stream: typeof stream.Readable, - path: typeof path.join, - util: typeof util.inspect, -})); From 25a97b53f53de3ff95e796290248d34a68d1b3df Mon Sep 17 00:00:00 2001 From: Sosuke Suzuki Date: Tue, 21 Jul 2026 17:56:12 +0900 Subject: [PATCH 6/8] [DO NOT MERGE] wklint CI probe: intentionally unchecked toLength in Array.prototype.pop --- Source/JavaScriptCore/runtime/ArrayPrototype.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp index 0adcea2f35a84..17c58a9ffd746 100644 --- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp +++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp @@ -546,6 +546,8 @@ JSC_DEFINE_HOST_FUNCTION(arrayProtoFuncPop, (JSGlobalObject* globalObject, CallF EXCEPTION_ASSERT(!!scope.exception() == !thisObj); if (!thisObj) [[unlikely]] return encodedJSValue(); + uint64_t wklintProbe = toLength(globalObject, thisObj); // WKLINT-CI-PROBE: intentionally unchecked + (void)wklintProbe; uint64_t length = toLength(globalObject, thisObj); RETURN_IF_EXCEPTION(scope, encodedJSValue()); From e6fc9706d571c9084c87ffafc422dfb5ef63ebf0 Mon Sep 17 00:00:00 2001 From: Sosuke Suzuki Date: Tue, 21 Jul 2026 18:24:47 +0900 Subject: [PATCH 7/8] Revert "[DO NOT MERGE] wklint CI probe: intentionally unchecked toLength in Array.prototype.pop" This reverts commit 25a97b53f53de3ff95e796290248d34a68d1b3df. --- Source/JavaScriptCore/runtime/ArrayPrototype.cpp | 2 -- 1 file changed, 2 deletions(-) diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp index 17c58a9ffd746..0adcea2f35a84 100644 --- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp +++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp @@ -546,8 +546,6 @@ JSC_DEFINE_HOST_FUNCTION(arrayProtoFuncPop, (JSGlobalObject* globalObject, CallF EXCEPTION_ASSERT(!!scope.exception() == !thisObj); if (!thisObj) [[unlikely]] return encodedJSValue(); - uint64_t wklintProbe = toLength(globalObject, thisObj); // WKLINT-CI-PROBE: intentionally unchecked - (void)wklintProbe; uint64_t length = toLength(globalObject, thisObj); RETURN_IF_EXCEPTION(scope, encodedJSValue()); From 6dbb517f12aec5453e06fce02ad0c7cae6d9b22e Mon Sep 17 00:00:00 2001 From: Sosuke Suzuki Date: Wed, 22 Jul 2026 07:00:00 +0900 Subject: [PATCH 8/8] Address review feedback on the wklint integration - release.sh: use the ${VAR:+x} idiom so the token never appears in xtrace output. - Dockerfile: skip the linter (with a hint) when WKLINT_TAG is set but the secret is not mounted, and extract with `tar -I zstd` for older GNU tar. - workflow: leave the wklint_tag input empty by default so the WKLINT_TAG repository variable fallback is reachable; collect results whenever the linter was invoked (gate on wklint-exit-code, keep wklint-log.txt); and surface non-0/1 wklint exit codes as a warning so tool errors are visible without blocking the build during the soft launch. --- .github/workflows/build-reusable.yml | 19 ++++++++++++++----- Dockerfile | 6 +++++- release.sh | 3 ++- 3 files changed, 21 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml index 524a3b4aec7d7..7f1a89b75a167 100644 --- a/.github/workflows/build-reusable.yml +++ b/.github/workflows/build-reusable.yml @@ -23,9 +23,9 @@ on: type: string default: '19' wklint_tag: - description: 'oven-sh/webkit-lint release for the JSC exception-check linter: "latest", an "autobuild-" tag, or "off"' + description: 'oven-sh/webkit-lint release for the JSC exception-check linter: "latest", an "autobuild-" tag, or "off" (empty falls back to the WKLINT_TAG repo variable, then latest)' type: string - default: 'latest' + default: '' secrets: WEBKIT_LINT_RELEASE_TOKEN: description: 'Read access to oven-sh/webkit-lint releases (optional; the linter is skipped without it)' @@ -148,9 +148,11 @@ jobs: echo '{ "name": "${{matrix.label}}", "version": "0.0.1-${{ inputs.build_ref }}", "os": ["linux"], "cpu": ["${{matrix.package_json_arch}}"], "repository": "https://github.com/${{github.repository}}" }' > bun-webkit/package.json rm -rf bun-webkit/lib/*.so rm -rf bun-webkit/lib/*.so.* - # wklint results (if the linter ran) live in the artifact output dir. - if [ -f bun-webkit/wklint-findings.json ]; then - cp bun-webkit/wklint-findings.json bun-webkit/wklint-report.txt bun-webkit/wklint-exit-code . 2>/dev/null || true + # wklint results live in the artifact output dir whenever the linter was + # invoked (the exit-code file is written even if the run failed early). + if [ -f bun-webkit/wklint-exit-code ]; then + cp bun-webkit/wklint-exit-code . 2>/dev/null || true + cp bun-webkit/wklint-findings.json bun-webkit/wklint-report.txt bun-webkit/wklint-log.txt . 2>/dev/null || true rm -f bun-webkit/wklint-findings.json bun-webkit/wklint-report.txt bun-webkit/wklint-log.txt bun-webkit/wklint-exit-code fi tar -czf bun-webkit.tar.gz bun-webkit @@ -170,6 +172,13 @@ jobs: exit_code=$(cat wklint-exit-code) echo "wklint exit code: $exit_code" cat wklint-report.txt || true + if [ "$exit_code" != "0" ] && [ "$exit_code" != "1" ]; then + # Tool / infrastructure error (parse failures, crash): surface it without + # blocking the build during the soft launch. + echo "::warning title=wklint::wklint exited with $exit_code (tool error); see wklint-log.txt in the wklint-findings artifact" + tail -40 wklint-log.txt 2>/dev/null || true + exit 0 + fi if [ "$exit_code" = "1" ]; then new=$(grep -c ' warning: ' wklint-report.txt || true) { diff --git a/Dockerfile b/Dockerfile index 29badd9d0c411..fe77ac5d65344 100644 --- a/Dockerfile +++ b/Dockerfile @@ -119,6 +119,10 @@ RUN wget https://apt.llvm.org/llvm.sh \ # the release lives in an internal repository. RUN --mount=type=secret,id=WEBKIT_LINT_RELEASE_TOKEN \ if [ -n "$WKLINT_TAG" ] && [ "$TARGETARCH" = "amd64" ]; then \ + if [ ! -f /run/secrets/WEBKIT_LINT_RELEASE_TOKEN ]; then \ + echo "wklint: WKLINT_TAG is set but the WEBKIT_LINT_RELEASE_TOKEN secret is missing; skipping the linter."; \ + exit 0; \ + fi; \ set -eu; \ token=$(cat /run/secrets/WEBKIT_LINT_RELEASE_TOKEN); \ if [ "$WKLINT_TAG" = "latest" ]; then \ @@ -130,7 +134,7 @@ RUN --mount=type=secret,id=WEBKIT_LINT_RELEASE_TOKEN \ | python3 -c 'import json,sys; print([a["url"] for a in json.load(sys.stdin)["assets"] if a["name"].endswith("-linux-x64.tar.zst")][0])'); \ curl -fsSL -H "Authorization: token ${token}" -H "Accept: application/octet-stream" \ -o /tmp/wklint.tar.zst "$asset_url"; \ - mkdir -p /opt && tar --zstd -xf /tmp/wklint.tar.zst -C /opt && rm /tmp/wklint.tar.zst; \ + mkdir -p /opt && tar -I zstd -xf /tmp/wklint.tar.zst -C /opt && rm /tmp/wklint.tar.zst; \ /opt/wklint-linux-x64/bin/wklint --version; \ fi diff --git a/release.sh b/release.sh index d2af2cc528cbc..c17c5361fa139 100644 --- a/release.sh +++ b/release.sh @@ -58,7 +58,8 @@ export ENABLE_SANITIZERS=${ENABLE_SANITIZERS:-} # and WEBKIT_LINT_RELEASE_TOKEN in the environment to run it during the build. export WKLINT_TAG=${WKLINT_TAG:-""} WKLINT_SECRET_ARGS="" -if [ -n "${WEBKIT_LINT_RELEASE_TOKEN:-}" ]; then +# `:+x` keeps the token out of the xtrace output (only a literal "x" is traced). +if [ -n "${WEBKIT_LINT_RELEASE_TOKEN:+x}" ]; then WKLINT_SECRET_ARGS="--secret id=WEBKIT_LINT_RELEASE_TOKEN,env=WEBKIT_LINT_RELEASE_TOKEN" else # No token available (e.g. a fork PR without secrets): skip the linter.