macOS: JIT emits AVX on Macs without it, so a darwin-x64 baseline build SIGILLs once code tiers up #34215

What version of Bun is running?

1.4.0-canary.1 (1e35118), built from main for darwin-x64 --baseline=true

What platform is your computer?

Darwin x86_64 — reproduced on two independent machines (see below)

What steps can reproduce the bug?

This is the second half of the pre-AVX2 Mac problem, and it is distinct from #32511.

#32511 / #32512 cover the startup crash: the shipped bun-darwin-x64-baseline links the Haswell macOS WebKit, whose bmalloc constructors use BMI2, so it SIGILLs before main(). oven-sh/WebKit#290 builds the missing Nehalem macOS WebKit and fixes that.

With that artifact in place, bun starts on a pre-AVX Mac — and then dies as soon as any code tiers up, because JavaScriptCore's JIT emits AVX regardless of the CPU:

./bun --version
# 1.4.0  -> rc=0, starts fine

./bun -e 'let s=0; for(let i=0;i<3e7;i++){s+=Math.sqrt(i)*1.000001;} console.log(s)'
# rc=132 -> SIGILL

BUN_JSC_useJIT=0 ./bun -e '...same loop...'
# rc=0   -> works

What is the expected behavior?

A --baseline darwin build should run on a CPU without AVX.

What do you see instead?

SIGILL once the JIT tiers up. The crash banner states the problem better than I can — bun's own CPU detection is correct, and JSC ignores it:

Bun Canary v1.4.0-canary.1 (1e3511800) macOS x64 (baseline)
macOS v14.6.1
CPU: sse42 popcnt                      <-- no AVX

Additional information

Root cause — Source/JavaScriptCore/assembler/MacroAssemblerX86_64.cpp hardcodes AVX as present on Darwin instead of asking the CPU:

#if OS(DARWIN)
        s_avxCheckState = CPUIDCheckState::Set;   // never checks the CPU
#else
        // CPUID.1:ECX.AVX[28] + OSXSAVE[27] + XCR0[2:1] == 11b
#endif

oven-sh/WebKit#198 fixed exactly this for Linux/Windows and guarded the new code with #if !OS(DARWIN), so Darwin kept the assumption. supportsAVX() then feeds ~10 VEX-emitting codegen sites. -march=nehalem cannot help, because the JIT decides at runtime.

Note AVX2 on Darwin is detected correctly, via sysctlbyname("hw.optional.avx2_0"). Only AVX is assumed — so Sandy/Ivy Bridge Macs (AVX, no AVX2) are unaffected by this one; it hits Macs with no AVX at all.

Reproduced on two independent machines:

Rosetta 2 reports no AVX, so it reproduces the pre-AVX Mac case on rentable hardware.

Fix: oven-sh/WebKit#292 uses the same runtime check on Darwin that Linux/Windows already use. Verified: the preprocessed output for non-Darwin is byte-identical before/after (so Linux/Windows cannot regress); on AVX hardware the new check returns Set, matching the old hardcode exactly (so every real Mac is unchanged); and on Rosetta the JIT loop and opencode --version both go from rc=132 to rc=0.

Builds, if you have a pre-AVX Mac and want to try one now — a bun with this fix plus an opencode compiled against it: https://github.com/tobocop2/opencode-bun-pre-avx2-mac/releases/latest

Full chain for a working pre-Haswell Mac: oven-sh/WebKit#290 (build the baseline WebKit) → #34207 (add the darwin-x64-baseline lane) → oven-sh/WebKit#292 (this — stop the JIT emitting AVX).

Found by @WolfgangFahl on the X5690 in anomalyco/opencode#8345; @lumik0 flagged collectCPUFeatures() as the suspect area in #26872.