ARG MARCH_FLAG="-march=nehalem"

ARG WEBKIT_RELEASE_TYPE=Release

ARG LTO_FLAG=""

ARG LLVM_VERSION="23"

ARG LLVM_DEBS_SHA256="993eba8b8ca23ea4d6074643d52ff9397b411e6ac5af6b7b2ca09dca2b351011"

ARG FREEBSD_VERSION="14.3"

ARG FREEBSD_ARCH="x86_64"

ARG DEFAULT_CFLAGS="-mno-omit-leaf-frame-pointer -fno-omit-frame-pointer -ffunction-sections -fdata-sections -faddrsig -fno-unwind-tables -fno-asynchronous-unwind-tables -DU_STATIC_IMPLEMENTATION=1 "

ARG USE_MIMALLOC="OFF"

ARG USE_EXTERNAL_MIMALLOC="OFF"

# -g is added per-stage below for Debug only — with -O3 + tmpfs, debug info

# OOMs the linux-x64-gh runner during Release builds (not seen on Android,

# but FreeBSD's libc++ headers generate notably more DWARF).

ARG DEBUG_CFLAGS="-g"

FROM ubuntu:24.04 AS base

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

ARG LLVM_VERSION

ARG LLVM_DEBS_SHA256

ARG FREEBSD_VERSION

ARG FREEBSD_ARCH

RUN apt-get update && apt-get install -y --no-install-recommends \

wget unzip xz-utils ca-certificates \

cmake ninja-build make git \

ruby ruby-getoptlong perl python3 rsync file cpio \

lsb-release software-properties-common gnupg \

&& rm -rf /var/lib/apt/lists/*

# Host clang (same version Bun uses) — we cross-compile via --target/--sysroot.

# apt.llvm.org installs version-suffixed names only, so add unversioned links

# for -fuse-ld=lld. The debs are mirrored from apt.llvm.org to a GitHub

# release (see scripts/mirror-llvm-debs.sh) so the build doesn't depend on it.

ADD --checksum=sha256:${LLVM_DEBS_SHA256} \

https://github.com/oven-sh/WebKit/releases/download/llvm-${LLVM_VERSION}-debs/llvm-${LLVM_VERSION}-noble-amd64.tar.gz /tmp/llvm.tar.gz

RUN mkdir -p /tmp/llvm && tar xzf /tmp/llvm.tar.gz -C /tmp/llvm && \

apt-get update && apt-get install -y /tmp/llvm/*.deb && \

rm -rf /tmp/llvm /tmp/llvm.tar.gz /var/lib/apt/lists/* && \

for t in clang clang++ ld.lld lld llvm-ar llvm-ranlib; do \

ln -sf /usr/bin/${t}-${LLVM_VERSION} /usr/local/bin/${t}; \

done

ENV CC=clang-${LLVM_VERSION}

ENV CXX=clang++-${LLVM_VERSION}

ENV AR=llvm-ar-${LLVM_VERSION}

ENV RANLIB=llvm-ranlib-${LLVM_VERSION}

ENV LD=lld-${LLVM_VERSION}

# FreeBSD sysroot — extract base.txz (libc, libc++, headers, crt files,

# compiler-rt). FreeBSD ships its own libc++ in base, so /usr/include/c++/v1

# and /usr/lib/libc++.* come from here.

RUN set -eux; \

case "${FREEBSD_ARCH}" in \

x86_64) FBSD_DL_ARCH="amd64" ;; \

aarch64) FBSD_DL_ARCH="arm64" ;; \

*) echo "unsupported FREEBSD_ARCH ${FREEBSD_ARCH}" >&2; exit 1 ;; \

esac; \

mkdir -p /opt/freebsd-sysroot; \

wget -q "https://download.freebsd.org/releases/${FBSD_DL_ARCH}/${FREEBSD_VERSION}-RELEASE/base.txz" -O /tmp/base.txz || \

wget -q "https://archive.freebsd.org/old-releases/${FBSD_DL_ARCH}/${FREEBSD_VERSION}-RELEASE/base.txz" -O /tmp/base.txz; \

tar -C /opt/freebsd-sysroot -xJf /tmp/base.txz ./usr/include ./usr/lib ./lib; \

rm /tmp/base.txz

ENV FREEBSD_SYSROOT=/opt/freebsd-sysroot

# Sanity check. FreeBSD's base ships builtins as /usr/lib/libgcc.a (it IS

# compiler-rt, renamed for ABI compat) and clang's freebsd driver finds it

# via --sysroot, so no resource-dir symlinking is needed (unlike Android).

RUN echo 'int main(){return 0;}' | $CC --target=${FREEBSD_ARCH}-unknown-freebsd${FREEBSD_VERSION} --sysroot=$FREEBSD_SYSROOT -fuse-ld=lld -xc - -o /tmp/t && file /tmp/t | grep -q FreeBSD

RUN mkdir -p /output/lib /output/include /output/include/JavaScriptCore /output/include/wtf /output/include/bmalloc /output/include/unicode

# ICU's sources and, for this container, its tools. ICU runs them while it builds (pkgdata, genrb, ...), so a cross

# build needs a host build first. Neither depends on the lane, so they are part of the toolchain: no lane downloads

# or rebuilds them.

# Which ICU: icu/source.json, by way of lanes.mjs.

ARG ICU_VERSION

ARG ICU_SHA256

ADD --checksum=sha256:${ICU_SHA256} https://github.com/unicode-org/icu/releases/download/release-${ICU_VERSION}/icu4c-${ICU_VERSION}-sources.tgz /icu.tgz

# Host build (tools only — no LTO, fast).

RUN mkdir -p /icu-host && cd /icu-host \

&& tar -xf /icu.tgz --strip-components=1 \

&& cd source \

&& CC=$CC CXX=$CXX CFLAGS="-Os" CXXFLAGS="-Os" \

./configure --disable-shared --enable-static --disable-samples --disable-tests \

&& make -j$(nproc)

# ───────────────────────────────────────────────────────────────────────────

# ICU — cross-compiled. Same two-stage host/target build as Android: host

# tools first, then --with-cross-build.

# ───────────────────────────────────────────────────────────────────────────

FROM base AS build_icu

ARG ICU_VERSION

ARG MARCH_FLAG

ARG LTO_FLAG

ARG DEFAULT_CFLAGS

ARG FREEBSD_VERSION

ARG FREEBSD_ARCH

# Target build.

#

# GENCCODE_ASSEMBLY (icudefs.mk's name; pkgdataMakefile writes it into icupkg.inc as

# GENCCODE_ASSEMBLY_TYPE): ICU's configure only picks the assembly data path for

# *-linux* / i*86-*bsd hosts (configure.ac ~line 651). On x86_64/aarch64 freebsd it

# falls back to having genccode write the data as an ELF object modelled on a probe

# object compiled with our CFLAGS, which is bitcode under -flto ("match-arch file

# oma.obj is not an ELF object file"). Forcing the assembly path (what the linux and

# android builds already use) makes the data a .S that assembles regardless of LTO.

#

# Before configure, filter data/in/icudt<major>l.dat (using the host icupkg) to drop

# converters/translit/stringprep/confusables/unames. Bun has zero

# ucnv_/utrans_/usprep_/uspoof_ consumers (TextCodecICU is removed in

# src/bun.js/bindings/TextEncodingRegistry.cpp). Cuts libicudata.a by ~7.4 MB.

# Most of rbnf/ goes too, but root/ja/zh/zh_Hant stay: ICU reaches those on its own

# through the algorithmic numbering systems in numberingSystems.res (see the note and

# the staleness guard in ./Dockerfile).

# This image does not run compress-data.ts, so those five items cost their raw

# 35 KB here rather than the ~8 KB they compress to elsewhere.

RUN --mount=type=tmpfs,target=/icu \

export TARGET_TRIPLE="${FREEBSD_ARCH}-unknown-freebsd${FREEBSD_VERSION}" && \

export CROSS_FLAGS="--target=${TARGET_TRIPLE} --sysroot=${FREEBSD_SYSROOT}" && \

export CFLAGS="${CROSS_FLAGS} ${DEFAULT_CFLAGS} ${MARCH_FLAG} -Os -std=c17 ${LTO_FLAG}" && \

export CXXFLAGS="${CROSS_FLAGS} ${DEFAULT_CFLAGS} ${MARCH_FLAG} -Os -std=c++20 -fno-exceptions ${LTO_FLAG} -fno-c++-static-destructors" && \

export LDFLAGS="${CROSS_FLAGS} -fuse-ld=lld" && \

cd /icu && tar -xf /icu.tgz --strip-components=1 && rm /icu.tgz && cd source && \

/icu-host/source/bin/icupkg -l data/in/icudt${ICU_VERSION%%.*}l.dat | grep -E '\.(cnv|spp|cfu)$|^cnvalias\.icu$|^translit/|^rbnf/|^unames\.icu$' | grep -vE '^rbnf/(root|res_index|ja|zh|zh_Hant)\.res$' > data/in/rm.lst && \

/icu-host/source/bin/icupkg --auto_toc_prefix -r data/in/rm.lst data/in/icudt${ICU_VERSION%%.*}l.dat data/in/icudt${ICU_VERSION%%.*}l_filtered.dat && \

mv -f data/in/icudt${ICU_VERSION%%.*}l_filtered.dat data/in/icudt${ICU_VERSION%%.*}l.dat && \

{ ./configure --host=${FREEBSD_ARCH}-unknown-freebsd${FREEBSD_VERSION} \

--with-cross-build=/icu-host/source \

--enable-static --disable-shared --with-data-packaging=static \

--disable-samples --disable-tests --disable-debug \

|| { cat config.log; exit 1; }; } && \

make -j$(nproc) GENCCODE_ASSEMBLY="-a gcc" && \

cp lib/*.a /output/lib && \

cp -r i18n/unicode/* common/unicode/* /output/include/unicode

# ───────────────────────────────────────────────────────────────────────────

# WebKit (JSCOnly) — cross-compiled. CMAKE_SYSTEM_NAME=FreeBSD is already

# handled in Source/WTF/wtf/PlatformJSCOnly.cmake (selects

# generic/MemoryFootprintGeneric.cpp + unix/MemoryPressureHandlerUnix.cpp),

# and __FreeBSD__ is defined by --target=*-freebsd*.

# ───────────────────────────────────────────────────────────────────────────

FROM base AS build_webkit

ARG MARCH_FLAG

ARG WEBKIT_RELEASE_TYPE

ARG LTO_FLAG

ARG DEFAULT_CFLAGS

ARG FREEBSD_VERSION

ARG FREEBSD_ARCH

ARG USE_MIMALLOC

ARG USE_EXTERNAL_MIMALLOC

COPY . /webkit

WORKDIR /webkit

COPY --from=build_icu /output /icu

ENV WEBKIT_OUT_DIR=/webkitbuild

ARG DEBUG_CFLAGS

RUN --mount=type=tmpfs,target=/webkitbuild \

export G=$([ "${WEBKIT_RELEASE_TYPE}" = "Debug" ] && echo "${DEBUG_CFLAGS}" || echo "") && \

export TARGET_TRIPLE="${FREEBSD_ARCH}-unknown-freebsd${FREEBSD_VERSION}" && \

export CROSS="--target=${TARGET_TRIPLE} --sysroot=${FREEBSD_SYSROOT}" && \

export CFLAGS="${CROSS} ${DEFAULT_CFLAGS} ${G} ${MARCH_FLAG} ${LTO_FLAG} -isystem /icu/include -ffile-prefix-map=/webkit/Source=vendor/WebKit/Source -ffile-prefix-map=/webkitbuild/=." && \

export CXXFLAGS="${CROSS} -isystem ${FREEBSD_SYSROOT}/usr/include/c++/v1 ${DEFAULT_CFLAGS} ${G} ${MARCH_FLAG} ${LTO_FLAG} -isystem /icu/include -fno-c++-static-destructors -ffile-prefix-map=/webkit/Source=vendor/WebKit/Source -ffile-prefix-map=/webkitbuild/=." && \

cd /webkitbuild && \

cmake \

-DCMAKE_SYSTEM_NAME=FreeBSD \

-DCMAKE_SYSTEM_PROCESSOR=${FREEBSD_ARCH} \

-DCMAKE_SYSROOT=${FREEBSD_SYSROOT} \

-DCMAKE_C_COMPILER=$(which $CC) \

-DCMAKE_CXX_COMPILER=$(which $CXX) \

-DCMAKE_AR=$(which $AR) \

-DCMAKE_RANLIB=$(which $RANLIB) \

-DPORT=JSCOnly \

-DENABLE_STATIC_JSC=ON \

-DENABLE_BUN_SKIP_FAILING_ASSERTIONS=ON \

-DCMAKE_BUILD_TYPE=${WEBKIT_RELEASE_TYPE} \

-DUSE_THIN_ARCHIVES=OFF \

-DUSE_BUN_JSC_ADDITIONS=ON \

-DUSE_BUN_EVENT_LOOP=ON \

-DUSE_MIMALLOC="$USE_MIMALLOC" \

-DUSE_EXTERNAL_MIMALLOC="$USE_EXTERNAL_MIMALLOC" \

-DENABLE_FTL_JIT=ON \

-DENABLE_API_TESTS=OFF \

-DCMAKE_EXPORT_COMPILE_COMMANDS=ON \

-DALLOW_LINE_AND_COLUMN_NUMBER_IN_BUILTINS=ON \

-DENABLE_REMOTE_INSPECTOR=ON \

-DCMAKE_EXE_LINKER_FLAGS="${CROSS} -fuse-ld=lld" \

-DCMAKE_C_FLAGS="$CFLAGS" \

-DCMAKE_CXX_FLAGS="$CXXFLAGS" \

-DICU_ROOT=/icu \

-DICU_INCLUDE_DIR=/icu/include \

-DCMAKE_FIND_ROOT_PATH_MODE_PACKAGE=BOTH \

-DCMAKE_FIND_ROOT_PATH_MODE_LIBRARY=BOTH \

-DCMAKE_FIND_ROOT_PATH_MODE_INCLUDE=BOTH \

-G Ninja \

/webkit && \

cmake --build /webkitbuild --config ${WEBKIT_RELEASE_TYPE} --target jsc --target testFFI && \

python3 /webkit/Tools/Scripts/check-classinfo-uniqueness.py $WEBKIT_OUT_DIR/bin/jsc && \

cp -r $WEBKIT_OUT_DIR/lib/*.a /output/lib && \

cp $WEBKIT_OUT_DIR/*.h /output/include && \

cp -r $WEBKIT_OUT_DIR/bin /output/bin && \

cp $WEBKIT_OUT_DIR/*.json /output && \

find $WEBKIT_OUT_DIR/JavaScriptCore/DerivedSources/ -name "*.h" -exec sh -c 'cp "$1" "/output/include/JavaScriptCore/$(basename "$1")"' sh {} \; && \

find $WEBKIT_OUT_DIR/JavaScriptCore/DerivedSources/ -name "*.json" -exec sh -c 'cp "$1" "/output/$(basename "$1")"' sh {} \; && \

find $WEBKIT_OUT_DIR/JavaScriptCore/Headers/JavaScriptCore/ -name "*.h" -exec cp {} /output/include/JavaScriptCore/ \; && \

find $WEBKIT_OUT_DIR/JavaScriptCore/PrivateHeaders/JavaScriptCore/ -name "*.h" -exec cp {} /output/include/JavaScriptCore/ \; && \

cp -r $WEBKIT_OUT_DIR/WTF/Headers/wtf/ /output/include && \

cp -r $WEBKIT_OUT_DIR/bmalloc/Headers/bmalloc/ /output/include && \

mkdir -p /output/Source/JavaScriptCore && \

cp -r /webkit/Source/JavaScriptCore/Scripts /output/Source/JavaScriptCore && \

cp /webkit/Source/JavaScriptCore/create_hash_table /output/Source/JavaScriptCore

FROM scratch AS artifact

COPY --from=build_icu /output /

COPY --from=build_webkit /output /