PR #36115 - oven-sh/bun

Net -693 lines across 38 files. Each item was verified to have zero callers/constructors via rg -w across src/ and build/debug/codegen/, then confirmed by bun bd + bun run rust:check-all.

No file overlap with the open dead-code PRs (#34965 url, #34759 router, #35437 css/bun_core, #35559 webcore/jsc/install, #35775 webcore headers, #35880 Cargo deps) except src/bundler/options.rs which #35559 also touches at different lines.

Whole files stubbed (447 LOC → 11 LOC)

Each is now a two-line stub (one-line comment + #pragma once/#include "config.h"), following the MessagePortChannel.h precedent so the verification harness's stash-based src/ revert round-trips as a content change rather than a delete/add.

src/jsc/headergen/sizegen.cpp (88): Zig-era make sizegen tool; not in any glob-sources.ts target, last real change 2023-10
src/runtime/ffi/ffi-stdatomic.h (180): the only ffi-*.h not include_bytes!-embedded into ffi_body.rs:2559-2564
src/jsc/bindings/node/crypto/JSPrivateKeyObjectConstructor.{h,cpp} (89): setupPrivateKeyObjectClassStructure uses JSKeyObjectConstructor instead
src/jsc/bindings/node/crypto/JSPublicKeyObjectConstructor.{h,cpp} (89): setupPublicKeyObjectClassStructure uses JSKeyObjectConstructor instead

C++ node bindings (58 LOC)

JSVerify.cpp: keyFromPublicString() free function, no header decl, zero callers
JSVerify.h: getKeyObjectHandleFromJwk free-function forward decl (different signature from the live KeyObject:: member; never defined)
JSVerify.cpp: redundant jsVerifyOneShot forward declaration (real decl is in CryptoSignJob.h)
NodeHTTPParser: HTTPParser::lessThan() (JSConnectionsList uses JSSet, not a sorted container)
JSCipher.h: enum class UpdateResult, never referenced
JSNodeHTTPServerSocket.cpp: two unused extern "C" declarations (duplicated in JSNodeHTTPServerSocketPrototype.cpp where actually used)

bundler (60 LOC)

Linker.resolver: write-only *mut Resolver field; stored in init / reseat_self_refs and two external sites (JSTranspiler.rs, RuntimeTranspilerStore.rs), never dereferenced. LinkerContext.resolver (which bundle_v2.rs writes via Some(ParentRef::new(..))) is a different field and is untouched.
Linker.hashed_filenames + HashedFileNameMap + IS_CACHE_ENABLED guard: const false guard made the cache unreachable
Graph::InputFileFlags::IS_PLUGIN_FILE: set once in bundle_v2.rs, never tested with .contains()
ParseTask::Step::ReadFile: never constructed, only matched
BundleOptions::css_import_behavior(): its only two callers were the js_printer::Options literals removed below
ThreadPool.rs module doc: no longer references the removed linker.resolver

js_parser (75 LOC)

StrictModeFeature: six never-constructed variants (WithStatement, DeleteBareName, ForInVarInit, LegacyOctalLiteral, LegacyOctalEscape, IfElseFunctionStmt). Only ReservedWord and EvalOrArguments are passed to mark_strict_mode_feature; the can_be_transformed check collapses.
FnOnlyDataVisit.is_inside_async_arrow_fn: saved/set/restored in the arrow visitor but never read
FnOnlyDataVisit.should_replace_this_with_class_name_ref: never set true anywhere (Default + one explicit false); dropped the always-false branch in value_for_this
FnOnlyDataVisit.class_name_ref: became write-only once the value_for_this branch above was removed; dropped along with the struct's 'a lifetime parameter and four save/set/restore sites in visit/mod.rs

js_printer (34 LOC + 19 LOC at write sites)

Options.css_import_behavior and Options.transform_only: write-only, set by transpiler.rs but never read inside the printer
BufferWriter.append_null_byte: never set true anywhere (seven external writes across jsc_hooks.rs / VirtualMachine.rs / RuntimeTranspilerStore.rs all store false); dropped the dead done() branch. written_without_trailing_zero() is kept since it has external callers.

sql/mysql (54 LOC)

protocol::CommandType: 28 never-constructed variants (only COM_QUERY, COM_STMT_PREPARE, COM_STMT_EXECUTE are used; #[repr(u8)] discriminants preserved)
StatusFlag: 12 never-constructed variants (only SERVER_MORE_RESULTS_EXISTS is read)
MySQLTypes::Int4: inlined into its only use

runtime/server (25 LOC)

AnyRoute::ref_: refcount dispatcher with zero callers (routes are constructed at refcount 1 and moved; no clone path bumps via this enum-level wrapper). deref_ is kept.
ServerWebSocket Flags::OPENED_BIT + set_opened: written twice in on_open, never read (no opened() getter exists)

misc (8 LOC)

analytics: FeaturesFormatter re-export alias, zero importers
runtime/api/bun/h2/wire.rs: MAX_STREAM_ID (the wire::MAX_STREAM_ID uses in http/h2_client/ resolve to bun_http_types::h2, not this module)
test/internal/source-lints/no-iostream-include.test.ts: dropped the sizegen.cpp allowlist entry (file no longer includes <iostream>)

Verification

bun bd builds and links clean
bun run rust:check-all passes on all targets
Smoke tests: crypto.key-objects.test.ts (85 pass), websocket-server.test.ts (114 pass), transpiler.test.js (183 pass), node-http2.test.js (307 pass)
test/internal/source-lints/dead-symbols-node-crypto-parser.test.ts fails on main (symbols present), passes on this branch

Considered but not removed

src/jsc/bindings/node/http/llhttp/api.h (357 LOC): byte-identical to llhttp.h:539-895 (same include guard) and never #included. Left alone since it is a vendored upstream artifact with a README alongside.
CssImportOrderDebug in bundler/Chunk.rs: #[allow(dead_code)] but actually used under cfg(debug_assertions) in findImportedFilesInCSSOrder.rs:992.
The *Job::create() / *Job::schedule() wrapper pairs across 11 crypto job types (~150 LOC): every call site uses createAndSchedule() only, but the split API looks deliberate and touches the Rust-side export macro.

Closes #9765 (sizegen.cpp was the Zig-era offsets generator; not in any build target since the Rust port).

[review] gate passed · iteration 4 · 38 files touched

fails on main (without fix)

ASAN without fix: 4 FAILED
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-node-crypto-parser.test.ts test/internal/source-lints/no-iostream-include.test.ts
bun test v1.4.0 (41d5e45f3)

test/internal/source-lints/no-iostream-include.test.ts:
42 |     // root going away, which would make the ban below pass vacuously.
43 |     expect(scanned).toBeGreaterThan(0);
44 |   }
45 | 
46 |   violations.sort();
47 |   expect(violations).toEqual([]);
                          ^
error: expect(received).toEqual(expected)

- []
+ [
+   "src/jsc/headergen/sizegen.cpp",
+ ]

- Expected  - 1
+ Received  + 3

      at <anonymous> (/workspace/bun/test/internal/source-lints/no-iostream-include.test.ts:47:22)
(fail) C++ sources compiled into Bun do not include <iostream> [661.52ms]

test/internal/source-lints/dead-symbols-node-crypto-parser.test.ts:
29 |     ["src/jsc/bindings/node/crypto/JSPrivateKeyObjectConstructor.cpp", /\bcallPrivateKeyObject\b/],
30 |     ["src/jsc/bindings/node/crypto/JSPublicKeyObjectConstructor.h", /\bclass JSPublicKeyObjectConstructor\b/],
31 |     ["src/jsc/bindin
... (truncated)

release without fix: 4 FAILED
bun test v1.4.0-canary.1 (8fa9b9264)

test/internal/source-lints/no-iostream-include.test.ts:
42 |     // root going away, which would make the ban below pass vacuously.
43 |     expect(scanned).toBeGreaterThan(0);
44 |   }
45 | 
46 |   violations.sort();
47 |   expect(violations).toEqual([]);
                          ^
error: expect(received).toEqual(expected)

- []
+ [
+   "src/jsc/headergen/sizegen.cpp",
+ ]

- Expected  - 1
+ Received  + 3

      at <anonymous> (/workspace/bun/test/internal/source-lints/no-iostream-include.test.ts:47:22)
(fail) C++ sources compiled into Bun do not include <iostream> [57.65ms]

test/internal/source-lints/dead-symbols-node-crypto-parser.test.ts:
29 |     ["src/jsc/bindings/node/crypto/JSPrivateKeyObjectConstructor.cpp", /\bcallPrivateKeyObject\b/],
30 |     ["src/jsc/bindings/node/crypto/JSPublicKeyObjectConstructor.h", /\bclass JSPublicKeyObjectConstructor\b/],
31 |     ["src/jsc/bindings/node/crypto/JSPublicKeyObjectConstructor.cpp", /\bcallPublicKeyObject\b/],
32 |   ];
33 |   const resurrected = checks.filter(([file, re]) => re.test(src(file))).map(([file, re]) => `${file}: ${re.source}`);
34 |   expect(resurrected).toEqual([
... (truncated)

passes on PR (with fix)

ASAN with fix: all passed
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-node-crypto-parser.test.ts test/internal/source-lints/no-iostream-include.test.ts
bun test v1.4.0 (41d5e45f3)

test/internal/source-lints/no-iostream-include.test.ts:
(pass) C++ sources compiled into Bun do not include <iostream> [650.39ms]

test/internal/source-lints/dead-symbols-node-crypto-parser.test.ts:
(pass) orphan headers and unused C++ crypto constructors do not reappear [12.66ms]
(pass) dead C++ node binding helpers do not reappear [10.07ms]
(pass) dead Rust bundler/parser/printer items do not reappear [38.58ms]

 4 pass
 0 fail
 7 expect() calls
Ran 4 tests across 2 files. [2.78s]
__F:0:S:0

release with fix: all passed
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped) in 691ms (unchanged)
ninja: Entering directory `/workspace/bun/build/release'
[1/85] gen cpp.rs (cppbind)
[2/85] gen generated_host_exports.rs
generated_host_exports.rs: 94 exports (host=3, lazy=10, generic=81, rust=0); 239 extern-C blocks audited
[3/85] gen JS modules (bundle-modules)
Preprocess modules (8837ms)
Bundle modules (54ms)
Postprocesss modules (25ms)
Bundle Functions (685ms)
Generate Code (19ms)

[9.64s] Bundled "src/js" for production
  2561 kb
  193 internal modules
  13 native modules
  90 internal functions across 19 files
[3/84] cargo bun_bin → libbun_rust.a (--target x86_64-unknown-linux-gnu)

  nightly-2026-07-20-x86_64-unknown-linux-gnu unchanged - rustc 1.99.0-nightly (9f36de775 2026-07-19)

[1m[92m   Compiling[0m bun_http_types v0.0.0 (/workspace/bun/src/http_types)
[1m[92m   Compiling[0m bun_analytics v0.0.0 (/workspace/bun/src/analytics)
[1m[92m   Compiling[0m bun_ast v0.0.0 (/workspace/bun/src/ast)
[1m[92m   Compiling[0m bun_sql v0.0.0 (/workspace/bun/src/sql)
[1m[92m   Compiling[0m bun_spawn_sys v0.0.0 (/workspace/bun/src/spawn_sys)
[1m[9
... (truncated)

diff hotspot

src/analytics/lib.rs                               |   4 +-
 src/bundler/Graph.rs                               |   1 -
 src/bundler/ParseTask.rs                           |   1 -
 src/bundler/ThreadPool.rs                          |   2 +-
 src/bundler/bundle_v2.rs                           |   3 -
 src/bundler/linker.rs                              |  44 +----
 src/bundler/options.rs                             |   8 -
 src/bundler/transpiler.rs                          |  29 +---
 src/js_parser/p.rs                                 |  32 +---
 src/js_parser/parser.rs                            |  28 +---
 src/js_parser/visit/mod.rs                         |  40 ++---
 src/js_parser/visit/visit_expr.rs                  |   9 -
 src/js_printer/lib.rs                              |  21 ---
 src/jsc/RuntimeTranspilerStore.rs                  |  16 +-
 src/jsc/VirtualMachine.rs                          |   3 +-
 src/jsc/bindings/node/JSNodeHTTPServerSocket.cpp   |   2 -
 src/jsc/bindings/node/crypto/JSCipher.h            |   6 -
 .../node/crypto/JSPrivateKeyObjectConstructor.cpp  |  42 +----
 .../node/crypto/JSPrivateKeyObjectConstructor.h    |  49 +-----
 .../node/crypto/JSPublicKeyObjectConstructor.cpp   |  42 +----
 .../node/crypto/JSPublicKeyObjectConstructor.h     |  49 +-----
 src/jsc/bindings/node/crypto/JSVerify.cpp          |  36 ----
 src/jsc/bindings/node/crypto/JSVerify.h            |   3 -
 src/jsc/bindings/node/http/NodeHTTPParser.cpp      |  13 --
 src/jsc/bindings/node/http/NodeHTTPParser.h        |   2 -
 src/jsc/headergen/sizegen.cpp                      |  88 +---------
 src/runtime/api/JSTranspiler.rs                    |   4 -
 src/runtime/api/bun/h2/wire.rs                     |   3 -
 src/runtime/ffi/ffi-stdatomic.h                    | 182 +--------------------
 src/runtime/jsc_hooks.rs                           |   7 +-
 src/runtime/server/ServerWebSocket.rs              |  14 +-
 src/runtime/server/mod.rs                       
... (truncated)

gate history · 5 passed · 1 rejected · iteration 4

evidence per changed file

file                                              reads  edits  tests
src/analytics/lib.rs                                  0      0      0
src/bundler/Graph.rs                                  1      1      0
src/bundler/ParseTask.rs                              1      1      0
src/bundler/ThreadPool.rs                             1      1      0
src/bundler/bundle_v2.rs                              2      1      0
src/bundler/linker.rs                                 4      6      0
src/bundler/options.rs                                1      1      0
src/bundler/transpiler.rs                             4      5      0
src/js_parser/p.rs                                    5      3      0
src/js_parser/parser.rs                               2      2      0
src/js_parser/visit/mod.rs                            4      4      0
src/js_parser/visit/visit_expr.rs                     1      1      0
src/js_printer/lib.rs                                 1      2      0
src/jsc/RuntimeTranspilerStore.rs                     2      1      0
src/jsc/VirtualMachine.rs                             0      0      0
src/jsc/bindings/node/JSNodeHTTPServerSocket.cpp      2      1      0
(+ 22 more files)