From 4af3f2e147d7b36bbdac396327c696655a196f32 Mon Sep 17 00:00:00 2001
From: Joshua Koo <zz85nus@gmail.com>
Date: Tue, 1 Sep 2026 05:29:56 +0000
Subject: [PATCH 1/4] Bun/JSC JIT symbol resolution via JITDump (rebased from
 bun branch)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Port the `bun` branch's JITDump support onto the current tree. The bun
branch forked at v0.3.13 and predates HotSpot introspection, DWARF
tail-call unwinding, and aarch64; a literal rebase conflicted heavily
across trace_handler/event_loop/spawn/symbolize, so this re-applies the
work semantically against current code as one coherent change.

Bun uses JavaScriptCore, which emits a binary perf JITDump
(`jit-<pid>.dump`) rather than a text perf-map, so its JIT-compiled JS
showed as `[unknown]`.

- jitdump.rs (new, from the bun branch tip): zero-dependency JITDump parser
  (JIT_CODE_LOAD/MOVE/DEBUG_INFO/CLOSE, BTreeMap range lookups, incremental
  reload, tolerant of truncated files, JSC + standard file naming, JSC #hash
  stripping).
- trace_handler: per-PID `jit_tables`; `apply_jitdump_symbols` runs as an
  additional JIT source *after* V8 SFI, HotSpot Method*, and the text
  perf-map fallback, so it only names frames nothing else resolved.
- event_loop: auto-load JITDump on new-PID detection; reload each collection
  window (symbolize path only); one-time warning when a --pid/system-wide
  Bun process has no JITDump file.
- spawn: `is_bun_program` + auto-inject `BUN_JSC_useJITDump=1` for
  `probee -- bun <script>` (mirrors the Node/JVM env injection).
- symbolize: JITDump override in the offline `.raw` re-symbolization path.
- E2E: bun_callstack.js fixture + a JITDump resolution test.

Deferred from the bun branch: the Zig-binary DWARF stop-unwind override and
Zig demangling (separate concern, compiler-version-specific, higher risk
against the evolved dwarf_unwind); can follow up if needed.

Validated on aarch64 Bun 1.3.14: the on-CPU FTL-JIT frame resolves to
`JSC-FTL: hot` (was [unknown]). e2e 20/20 green; jitdump unit tests (14)
pass; fmt/clippy clean. Userspace-only — no eBPF change, prebuilts
untouched.
---
 CHANGELOG.md                        |   4 +
 README.md                           |   2 +-
 profile-bee/src/event_loop.rs       |  89 +++
 profile-bee/src/jitdump.rs          | 825 ++++++++++++++++++++++++++++
 profile-bee/src/lib.rs              |   1 +
 profile-bee/src/spawn.rs            |  17 +
 profile-bee/src/symbolize.rs        |  35 +-
 profile-bee/src/trace_handler.rs    |  51 ++
 tests/fixtures/src/bun_callstack.js |  52 ++
 tests/run_e2e.sh                    |  70 +++
 10 files changed, 1143 insertions(+), 3 deletions(-)
 create mode 100644 profile-bee/src/jitdump.rs
 create mode 100644 tests/fixtures/src/bun_callstack.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee194cb..2953237 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 ## v0.3.23
 
+### New Features
+
+- **Bun / JavaScriptCore JIT symbol resolution via JITDump** — JIT-compiled JavaScript in Bun (which uses JavaScriptCore, not V8) previously showed as `[unknown]` because JSC emits a binary perf JITDump (`jit-<pid>.dump`) rather than a text perf-map. New `jitdump.rs` parses that format (JIT_CODE_LOAD / MOVE / DEBUG_INFO / CLOSE records, `BTreeMap` range lookups, incremental reload for streaming modes, JSC and standard `jit-<pid>.dump` file-naming). Integrated as an additional JIT symbol source *after* V8 SFI, HotSpot `Method*`, and the text perf-map fallback, so it only names frames nothing else could. `spawn` auto-injects `BUN_JSC_useJITDump=1` for `probee -- bun <script>`; `event_loop` auto-loads per PID and reloads each collection window; `event_loop` warns once when a `--pid`/system-wide Bun process lacks a JITDump file; offline re-symbolization (`.raw`) applies the same override. JSC symbol names are cleaned (e.g. `hot#DdCypB` → `hot`). Validated on aarch64 Bun 1.3.14: the on-CPU FTL-JIT frame resolves to `JSC-FTL: hot`. Ported from the `bun` branch and rebased onto the current V8/HotSpot/DWARF/aarch64 infrastructure. E2E: `bun_callstack.js` fixture + a JITDump resolution test.
+
 ### New Features (experimental)
 
 - **`--java-engine async-profiler` (experimental, opt-in)** — instead of reconstructing Java stacks from eBPF (which needs `-XX:+PreserveFramePointer` for JIT frames), profile-bee can delegate to [async-profiler](https://github.com/async-profiler/async-profiler), whose in-process `AsyncGetCallTrace` walks Java stacks without frame pointers and names JIT/interpreter/inlined frames. profile-bee attaches `asprof` for the profiling window; its `-o collapsed` output is the same folded format profile-bee emits, so merging is a splice.
diff --git a/README.md b/README.md
index a2fea8c..32259d5 100644
--- a/README.md
+++ b/README.md
@@ -456,7 +456,7 @@ let session = ProfilingSession::new(config).await?;
 
 - Linux only (requires eBPF support)
 - Architecture: x86_64 and aarch64 supported (frame-pointer + DWARF unwinding, Java/HotSpot `Method*` naming)
-- JIT-compiled code (HotSpot Java, V8/Node) is symbolized via `/tmp/perf-<pid>.map`; interpreter and inlined frames are not yet reconstructed by the eBPF engine. `Compiler.perfmap` auto-dump requires JDK 17+ (on JDK 8/11 use perf-map-agent/async-profiler). For full Java fidelity without `-XX:+PreserveFramePointer`, use `--java-engine async-profiler` (batch output only)
+- JIT-compiled code (HotSpot Java, V8/Node) is symbolized via `/tmp/perf-<pid>.map`; interpreter and inlined frames are not yet reconstructed by the eBPF engine. `Compiler.perfmap` auto-dump requires JDK 17+ (on JDK 8/11 use perf-map-agent/async-profiler). For full Java fidelity without `-XX:+PreserveFramePointer`, use `--java-engine async-profiler` (batch output only). Bun/JavaScriptCore JIT frames are resolved from the binary JITDump (`jit-<pid>.dump`); `probee -- bun <script>` auto-enables it via `BUN_JSC_useJITDump=1` (for `--pid`/system-wide, start Bun with that env var set)
 - [VDSO](https://man7.org/linux/man-pages/man7/vdso.7.html) `.eh_frame` parsed for DWARF unwinding; VDSO symbolization not yet supported
 
 ## Development
diff --git a/profile-bee/src/event_loop.rs b/profile-bee/src/event_loop.rs
index 622fe1f..5e476c3 100644
--- a/profile-bee/src/event_loop.rs
+++ b/profile-bee/src/event_loop.rs
@@ -15,6 +15,7 @@ use profile_bee_common::{StackInfo, EVENT_TRACE_ALWAYS, PROCESS_EVENT_EXEC, PROC
 use crate::ebpf::{
     apply_dwarf_refresh, FramePointersPod, HotspotProcInfoPod, StackInfoPod, V8ProcInfoPod,
 };
+use crate::jitdump::{self, JitSymbolTable};
 use crate::pipeline::{DwarfThreadMsg, PerfWork};
 use crate::process_metadata::ProcessMetadataCache;
 use crate::trace_handler::TraceHandler;
@@ -147,6 +148,9 @@ pub struct ProfilingEventLoop {
     hotspot_armed: HashSet<u32>,
     /// Effective target PID; when set, Java discovery is scoped to it only.
     java_target_pid: Option<u32>,
+    /// PIDs for which we've already emitted the "Bun without JITDump" warning
+    /// (one-shot per PID to avoid log spam during system-wide / `--pid` runs).
+    warned_jitdump_pids: HashSet<u32>,
 }
 
 /// System-wide startup path: discover every running JVM and dump/load its
@@ -245,6 +249,7 @@ impl ProfilingEventLoop {
             java_known_pids,
             hotspot_armed: HashSet::new(),
             java_target_pid: config.java_target_pid,
+            warned_jitdump_pids: HashSet::new(),
         }
     }
 
@@ -339,6 +344,83 @@ impl ProfilingEventLoop {
         // Always arm perf-map discovery — cheap if the file is absent, and
         // helps any JIT runtime that writes /tmp/perf-<pid>.map.
         self.trace_handler.register_perf_map(tgid);
+        // Binary JITDump (`jit-<pid>.dump`) for Bun/JSC and other emitters.
+        self.try_load_jitdump_for_pid(tgid);
+    }
+
+    /// Load a binary JITDump table (`jit-<pid>.dump`) for a PID if one exists.
+    ///
+    /// If the PID is a Bun process and no JITDump file exists, emits a one-time
+    /// warning so the user knows to restart Bun with `BUN_JSC_useJITDump=1`.
+    fn try_load_jitdump_for_pid(&mut self, tgid: u32) {
+        if self.trace_handler.has_jit_table(tgid) {
+            return;
+        }
+        if let Some(path) = jitdump::find_jitdump_for_pid(tgid) {
+            match JitSymbolTable::load_from_file(&path) {
+                Ok(table) if !table.is_empty() => {
+                    self.trace_handler.register_jit_table(tgid, table);
+                }
+                Ok(_) => tracing::debug!("JITDump for pid {} is empty", tgid),
+                Err(e) => tracing::debug!("JITDump read failed for pid {}: {}", tgid, e),
+            }
+        } else {
+            self.warn_bun_missing_jitdump(tgid);
+        }
+    }
+
+    /// One-time warning if a PID is a Bun process running without a JITDump file.
+    ///
+    /// Bun (JavaScriptCore) only writes `jit-<pid>.dump` when started with
+    /// `BUN_JSC_useJITDump=1`; without it, JIT-compiled JS shows as `[unknown]`.
+    /// Fires during system-wide / `--pid` profiling where probee can't inject
+    /// the env var itself (for `probee -- bun ...`, `spawn` injects it).
+    fn warn_bun_missing_jitdump(&mut self, tgid: u32) {
+        if self.warned_jitdump_pids.contains(&tgid) {
+            return;
+        }
+        let exe_path = match std::fs::read_link(format!("/proc/{tgid}/exe")) {
+            Ok(p) => p,
+            Err(_) => return,
+        };
+        let basename = exe_path.file_name().and_then(|n| n.to_str()).unwrap_or("");
+        if !crate::spawn::is_bun_program(basename) {
+            return;
+        }
+        self.warned_jitdump_pids.insert(tgid);
+        tracing::warn!(
+            "Bun process (PID {tgid}) detected without a JITDump file; JS function \
+             names will show as [unknown]. Restart with BUN_JSC_useJITDump=1, or \
+             profile via `probee -- bun <script>` for auto-injection."
+        );
+    }
+
+    /// Reload JITDump tables for known PIDs (streaming modes pick up newly
+    /// JIT-compiled functions). Incremental for loaded tables, fresh-load
+    /// otherwise; invalidates the symbol cache for PIDs that gained symbols so
+    /// previously-`[unknown]` frames re-resolve.
+    pub fn reload_jitdump_tables(&mut self) {
+        let tgids: Vec<u32> = self.known_tgids.iter().copied().collect();
+        for tgid in tgids {
+            if self.trace_handler.has_jit_table(tgid) {
+                if let Some(path) = jitdump::find_jitdump_for_pid(tgid) {
+                    if let Some(table) = self.trace_handler.jit_table_mut(tgid) {
+                        match table.reload_from_file(&path) {
+                            Ok(n) if n > 0 => {
+                                tracing::debug!("reloaded {n} new JITDump symbols for pid {tgid}");
+                                self.trace_handler.flush_frame_cache_for_pid(tgid);
+                            }
+                            Ok(_) => {}
+                            Err(e) => {
+                                tracing::debug!("JITDump reload failed for pid {tgid}: {e}")
+                            }
+                        }
+                    }
+                }
+            } else {
+                self.try_load_jitdump_for_pid(tgid);
+            }
+        }
     }
 
     /// Detect HotSpot/OpenJDK processes and enable Java JIT symbolization.
@@ -748,6 +830,13 @@ impl ProfilingEventLoop {
             }
         }
 
+        // Reload JITDump tables at the end of the window so symbols compiled
+        // during profiling are picked up (the first-sight load may have seen an
+        // empty/absent file). Skip on the raw-capture path to avoid I/O.
+        if symbolize {
+            self.reload_jitdump_tables();
+        }
+
         tracing::debug!("drain_events: processed {} events", queue_processed);
         (local_counting, stopped)
     }
diff --git a/profile-bee/src/jitdump.rs b/profile-bee/src/jitdump.rs
new file mode 100644
index 0000000..daa406b
--- /dev/null
+++ b/profile-bee/src/jitdump.rs
@@ -0,0 +1,825 @@
+//! JITDump file parser for resolving JIT-compiled function names.
+//!
+//! JITDump is a standard binary format written by JIT runtimes to map
+//! dynamically-generated code addresses to function names. Supported by
+//! Bun (JavaScriptCore via `BUN_JSC_useJITDump=1`), Node.js (`--perf-prof`),
+//! Java HotSpot, LuaJIT, and others.
+//!
+//! Reference: `tools/perf/Documentation/jitdump-specification.txt` in the
+//! Linux kernel source.
+//!
+//! This module provides a zero-dependency parser (std only) with a
+//! `BTreeMap`-backed symbol table for O(log n) address range lookups.
+
+use std::collections::{BTreeMap, HashMap};
+use std::io::{self, BufReader, Read, Seek, SeekFrom};
+use std::path::{Path, PathBuf};
+
+// JITDump magic numbers
+const JITDUMP_MAGIC_LE: u32 = 0x4A695444; // "JiTD" little-endian
+const JITDUMP_MAGIC_BE: u32 = 0x4454694A; // "JiTD" big-endian
+
+// Record type IDs
+const JIT_CODE_LOAD: u32 = 0;
+const JIT_CODE_MOVE: u32 = 1;
+const JIT_CODE_DEBUG_INFO: u32 = 2;
+const JIT_CODE_CLOSE: u32 = 3;
+// const JIT_CODE_UNWINDING_INFO: u32 = 4; // not needed
+
+// Header size in bytes (10 fields)
+const JITDUMP_HEADER_SIZE: u64 = 40;
+
+// Record header size: id(u32) + total_size(u32) + timestamp(u64)
+const RECORD_HEADER_SIZE: u64 = 16;
+
+/// A single JIT symbol region: code address range -> function name.
+#[derive(Debug, Clone)]
+pub struct JitSymbol {
+    pub code_addr: u64,
+    pub code_size: u64,
+    pub name: String,
+    /// Optional source file + line from JIT_CODE_DEBUG_INFO.
+    pub source: Option<(String, u32)>,
+}
+
+/// Parsed JITDump symbol table for a single process.
+///
+/// Uses a `BTreeMap` keyed by `code_addr` for O(log n) range-based lookup.
+/// Supports incremental reloading for streaming/TUI modes.
+pub struct JitSymbolTable {
+    symbols: BTreeMap<u64, JitSymbol>,
+    /// Debug info that arrives before its corresponding JIT_CODE_LOAD.
+    /// Keyed by `code_index` (matches JIT_CODE_LOAD's `code_index` field).
+    pending_debug: HashMap<u64, (String, u32)>,
+    /// File offset for incremental reload — next read starts here.
+    last_read_offset: u64,
+}
+
+impl JitSymbolTable {
+    /// Look up a symbol by instruction pointer address.
+    ///
+    /// Returns the function name if `addr` falls within a known JIT region
+    /// `[code_addr, code_addr + code_size)`.
+    pub fn resolve(&self, addr: u64) -> Option<&JitSymbol> {
+        // Find the last entry with code_addr <= addr
+        self.symbols
+            .range(..=addr)
+            .next_back()
+            .map(|(_, sym)| sym)
+            .filter(|sym| addr < sym.code_addr + sym.code_size)
+    }
+
+    /// Parse a JITDump file and populate the symbol table.
+    ///
+    /// Tolerates partial/truncated files — returns whatever was successfully
+    /// parsed. This is important because the JIT runtime may still be writing
+    /// the file while we read it.
+    pub fn load_from_file(path: &Path) -> io::Result<Self> {
+        let file = std::fs::File::open(path)?;
+        let mut reader = BufReader::new(file);
+
+        let mut table = JitSymbolTable {
+            symbols: BTreeMap::new(),
+            pending_debug: HashMap::new(),
+            last_read_offset: 0,
+        };
+
+        // Parse and validate header
+        let _header = match parse_header(&mut reader) {
+            Ok(h) => h,
+            Err(e) => {
+                tracing::debug!("JITDump header parse failed: {}", e);
+                return Ok(table);
+            }
+        };
+
+        table.last_read_offset = JITDUMP_HEADER_SIZE;
+
+        // Read records
+        table.read_records(&mut reader)?;
+
+        Ok(table)
+    }
+
+    /// Resume reading from a partially-read file for streaming modes.
+    ///
+    /// Seeks to `last_read_offset` and reads any new records appended since
+    /// the last read. Returns the number of new symbols loaded.
+    ///
+    /// If the file has been truncated or rotated (size < last_read_offset),
+    /// resets state and re-parses from the beginning.
+    pub fn reload_from_file(&mut self, path: &Path) -> io::Result<usize> {
+        let file = std::fs::File::open(path)?;
+        let file_len = file.metadata()?.len();
+
+        // Detect truncated/rotated file — reset and re-parse from scratch
+        if file_len < self.last_read_offset {
+            tracing::debug!(
+                "JITDump file shrunk ({} < {}), resetting",
+                file_len,
+                self.last_read_offset
+            );
+            self.symbols.clear();
+            self.pending_debug.clear();
+            self.last_read_offset = 0;
+
+            let mut reader = BufReader::new(file);
+            match parse_header(&mut reader) {
+                Ok(_) => {
+                    self.last_read_offset = JITDUMP_HEADER_SIZE;
+                    let before = self.symbols.len();
+                    self.read_records(&mut reader)?;
+                    return Ok(self.symbols.len() - before);
+                }
+                Err(e) => return Err(e),
+            }
+        }
+
+        let mut reader = BufReader::new(file);
+        reader.seek(SeekFrom::Start(self.last_read_offset))?;
+
+        let before = self.symbols.len();
+        self.read_records(&mut reader)?;
+        Ok(self.symbols.len() - before)
+    }
+
+    /// Number of symbols in the table.
+    pub fn len(&self) -> usize {
+        self.symbols.len()
+    }
+
+    /// Whether the table is empty.
+    pub fn is_empty(&self) -> bool {
+        self.symbols.is_empty()
+    }
+
+    /// Read records from the current reader position until EOF or JIT_CODE_CLOSE.
+    fn read_records<R: Read + Seek>(&mut self, reader: &mut R) -> io::Result<()> {
+        loop {
+            let record_start = reader.stream_position()?;
+
+            // Read record header (16 bytes)
+            let (record_id, total_size, _timestamp) = match read_record_header(reader) {
+                Ok(h) => h,
+                Err(e) if e.kind() == io::ErrorKind::UnexpectedEof => {
+                    // Partial file — stop reading, keep what we have
+                    self.last_read_offset = record_start;
+                    break;
+                }
+                Err(e) => {
+                    tracing::debug!("JITDump record header read error: {}", e);
+                    self.last_read_offset = record_start;
+                    break;
+                }
+            };
+
+            if total_size < RECORD_HEADER_SIZE as u32 {
+                tracing::debug!(
+                    "JITDump record with invalid size {} at offset {}",
+                    total_size,
+                    record_start
+                );
+                self.last_read_offset = record_start;
+                break;
+            }
+
+            let payload_size = total_size as u64 - RECORD_HEADER_SIZE;
+
+            match record_id {
+                JIT_CODE_LOAD => match self.parse_code_load(reader, payload_size) {
+                    Ok(()) => {}
+                    Err(_) => {
+                        self.last_read_offset = record_start;
+                        break;
+                    }
+                },
+                JIT_CODE_MOVE => match self.parse_code_move(reader, payload_size) {
+                    Ok(()) => {}
+                    Err(_) => {
+                        self.last_read_offset = record_start;
+                        break;
+                    }
+                },
+                JIT_CODE_DEBUG_INFO => match self.parse_debug_info(reader, payload_size) {
+                    Ok(()) => {}
+                    Err(_) => {
+                        self.last_read_offset = record_start;
+                        break;
+                    }
+                },
+                JIT_CODE_CLOSE => {
+                    self.last_read_offset = record_start + total_size as u64;
+                    break;
+                }
+                _ => {
+                    // Unknown record type — skip
+                    skip_bytes(reader, payload_size)?;
+                }
+            }
+
+            self.last_read_offset = record_start + total_size as u64;
+        }
+
+        Ok(())
+    }
+
+    /// Parse a JIT_CODE_LOAD record.
+    ///
+    /// Fixed fields after record header:
+    ///   pid(u32), tid(u32), vma(u64), code_addr(u64), code_size(u64), code_index(u64)
+    /// Followed by: null-terminated function name, then raw code bytes.
+    fn parse_code_load<R: Read>(&mut self, reader: &mut R, payload_size: u64) -> io::Result<()> {
+        // Fixed fields: 4 + 4 + 8 + 8 + 8 + 8 = 40 bytes
+        const FIXED_SIZE: u64 = 40;
+        if payload_size < FIXED_SIZE {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "JIT_CODE_LOAD too small",
+            ));
+        }
+
+        let _pid = read_u32(reader)?;
+        let _tid = read_u32(reader)?;
+        let _vma = read_u64(reader)?;
+        let code_addr = read_u64(reader)?;
+        let code_size = read_u64(reader)?;
+        let _code_index = read_u64(reader)?;
+
+        // Remaining bytes: null-terminated name + code bytes
+        let remaining = payload_size - FIXED_SIZE;
+        let mut name_and_code = vec![0u8; remaining as usize];
+        reader.read_exact(&mut name_and_code)?;
+
+        // Extract null-terminated name
+        let name_end = name_and_code
+            .iter()
+            .position(|&b| b == 0)
+            .unwrap_or(name_and_code.len());
+        let name = String::from_utf8_lossy(&name_and_code[..name_end]).to_string();
+
+        // Check for pending debug info (keyed by code_addr — the same
+        // address that appeared in the preceding JIT_CODE_DEBUG_INFO record)
+        let source = self.pending_debug.remove(&code_addr);
+
+        self.symbols.insert(
+            code_addr,
+            JitSymbol {
+                code_addr,
+                code_size,
+                name,
+                source,
+            },
+        );
+
+        Ok(())
+    }
+
+    /// Parse a JIT_CODE_MOVE record.
+    ///
+    /// Fixed fields: old_code_addr(u64), new_code_addr(u64),
+    ///               new_code_size(u64), code_index(u64)
+    fn parse_code_move<R: Read>(&mut self, reader: &mut R, payload_size: u64) -> io::Result<()> {
+        const FIXED_SIZE: u64 = 32;
+        if payload_size < FIXED_SIZE {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "JIT_CODE_MOVE too small",
+            ));
+        }
+
+        let old_code_addr = read_u64(reader)?;
+        let new_code_addr = read_u64(reader)?;
+        let new_code_size = read_u64(reader)?;
+        let _code_index = read_u64(reader)?;
+
+        // Skip any remaining payload
+        if payload_size > FIXED_SIZE {
+            skip_bytes(reader, payload_size - FIXED_SIZE)?;
+        }
+
+        // Move the symbol entry
+        if let Some(mut sym) = self.symbols.remove(&old_code_addr) {
+            sym.code_addr = new_code_addr;
+            sym.code_size = new_code_size;
+            self.symbols.insert(new_code_addr, sym);
+        }
+
+        Ok(())
+    }
+
+    /// Parse a JIT_CODE_DEBUG_INFO record.
+    ///
+    /// Fixed fields: code_addr(u64), nr_entry(u64)
+    /// Followed by array of debug entries: addr(u64), line(u32), discrim(u32),
+    /// then null-terminated filename.
+    ///
+    /// Per spec, DEBUG_INFO must appear before its corresponding CODE_LOAD.
+    /// We store the first entry's (filename, line) in pending_debug keyed by
+    /// `code_addr` — the same address that will appear in the subsequent
+    /// JIT_CODE_LOAD record's `code_addr` field.
+    fn parse_debug_info<R: Read>(&mut self, reader: &mut R, payload_size: u64) -> io::Result<()> {
+        if payload_size < 16 {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "JIT_CODE_DEBUG_INFO too small",
+            ));
+        }
+
+        let code_addr = read_u64(reader)?;
+        let nr_entry = read_u64(reader)?;
+
+        // Read the first debug entry if available, skip the rest.
+        // Each entry: addr(u64) + line(u32) + discrim(u32) + null-terminated filename
+        let mut consumed = 16u64;
+        if nr_entry > 0 && payload_size > consumed + 16 {
+            let _entry_addr = read_u64(reader)?;
+            let line = read_u32(reader)?;
+            let _discrim = read_u32(reader)?;
+            consumed += 16;
+
+            // Read null-terminated filename from remaining payload
+            let remaining = payload_size - consumed;
+            let mut buf = vec![0u8; remaining as usize];
+            reader.read_exact(&mut buf)?;
+
+            let name_end = buf.iter().position(|&b| b == 0).unwrap_or(buf.len());
+            let filename = String::from_utf8_lossy(&buf[..name_end]).to_string();
+
+            if !filename.is_empty() {
+                self.pending_debug.insert(code_addr, (filename, line));
+            }
+
+            return Ok(());
+        }
+
+        // Skip remaining payload
+        if payload_size > consumed {
+            skip_bytes(reader, payload_size - consumed)?;
+        }
+
+        Ok(())
+    }
+}
+
+/// Check if a JITDump file exists for the given PID.
+///
+/// Searches for JITDump files in `/tmp/` using two naming conventions:
+/// 1. Standard: `/tmp/jit-<pid>.dump` (used by Java HotSpot, LuaJIT, `perf`)
+/// 2. JSC/Bun: `/tmp/jit-<tid>-<pid>-<random>` (used by JavaScriptCore)
+///
+/// Returns the first matching file path, preferring the standard convention.
+pub fn find_jitdump_for_pid(pid: u32) -> Option<PathBuf> {
+    find_jitdump_for_pid_in_dir(pid, Path::new("/tmp"))
+}
+
+/// Search for a JITDump file for the given PID in the specified directory.
+///
+/// This is the testable core of [`find_jitdump_for_pid`], allowing tests to
+/// use an isolated directory instead of the global `/tmp`.
+pub fn find_jitdump_for_pid_in_dir(pid: u32, dir: &Path) -> Option<PathBuf> {
+    // Standard convention: jit-<pid>.dump
+    let standard = dir.join(format!("jit-{}.dump", pid));
+    if standard.exists() {
+        return Some(standard);
+    }
+
+    // JSC/Bun convention: jit-<tid>-<pid>-<random>
+    // Scan directory for files matching this pattern.
+    let pid_str = pid.to_string();
+    if let Ok(entries) = std::fs::read_dir(dir) {
+        for entry in entries.flatten() {
+            let name = entry.file_name();
+            let name = name.to_string_lossy();
+            // Match pattern: jit-<digits>-<pid>-<alphanum>
+            // Split on '-' and verify PID is in the expected segment (index 2).
+            if !name.starts_with("jit-") {
+                continue;
+            }
+            let parts: Vec<&str> = name.splitn(4, '-').collect();
+            // parts: ["jit", "<tid>", "<pid>", "<random>"]
+            if parts.len() >= 4 && parts[2] == pid_str {
+                return Some(entry.path());
+            }
+        }
+    }
+
+    None
+}
+
+/// Format a JIT symbol for display in flamegraphs.
+///
+/// Cleans up JSC-specific noise from the symbol name:
+/// - Strips `#<hash>` suffixes (JSC JIT code version hashes, e.g. `hello#DdCypB` → `hello`)
+///
+/// If source file info is available: `functionName (file.js:42)`
+/// Otherwise just: `functionName`
+pub fn format_jit_symbol(sym: &JitSymbol) -> String {
+    let name = strip_jsc_hash(&sym.name);
+    if let Some((ref file, line)) = sym.source {
+        let basename = Path::new(file)
+            .file_name()
+            .and_then(|f| f.to_str())
+            .unwrap_or(file);
+        format!("{} ({}:{})", name, basename, line)
+    } else {
+        name.to_string()
+    }
+}
+
+/// Strip JSC JIT code version hash from a symbol name.
+///
+/// JSC appends `#<alphanumeric>` to JIT-compiled function names to
+/// disambiguate recompilations (e.g. `hello#DdCypB`, `/tmp/test.js#B9UAQK`).
+/// This is internal noise that obscures the actual function name.
+fn strip_jsc_hash(name: &str) -> &str {
+    if let Some(pos) = name.rfind('#') {
+        let suffix = &name[pos + 1..];
+        // Only strip if the suffix is non-empty alphanumeric (JSC hash format)
+        if !suffix.is_empty() && suffix.bytes().all(|b| b.is_ascii_alphanumeric()) {
+            return &name[..pos];
+        }
+    }
+    name
+}
+
+// ── Binary reading helpers ──────────────────────────────────────────────────
+
+/// JITDump file header (40 bytes).
+struct JitdumpHeader {
+    _version: u32,
+    _elf_mach: u32,
+    _pid: u32,
+}
+
+fn parse_header<R: Read>(reader: &mut R) -> io::Result<JitdumpHeader> {
+    let magic = read_u32(reader)?;
+    if magic != JITDUMP_MAGIC_LE && magic != JITDUMP_MAGIC_BE {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("invalid JITDump magic: {:#x}", magic),
+        ));
+    }
+    if magic == JITDUMP_MAGIC_BE {
+        // We only support little-endian (x86_64). Big-endian JITDump files
+        // are theoretically possible but not encountered in practice.
+        return Err(io::Error::new(
+            io::ErrorKind::Unsupported,
+            "big-endian JITDump not supported",
+        ));
+    }
+
+    let version = read_u32(reader)?;
+    let _total_size = read_u32(reader)?;
+    let elf_mach = read_u32(reader)?;
+    let _pad1 = read_u32(reader)?;
+    let pid = read_u32(reader)?;
+    let _timestamp = read_u64(reader)?;
+    let _flags = read_u64(reader)?;
+
+    Ok(JitdumpHeader {
+        _version: version,
+        _elf_mach: elf_mach,
+        _pid: pid,
+    })
+}
+
+fn read_record_header<R: Read>(reader: &mut R) -> io::Result<(u32, u32, u64)> {
+    let id = read_u32(reader)?;
+    let total_size = read_u32(reader)?;
+    let timestamp = read_u64(reader)?;
+    Ok((id, total_size, timestamp))
+}
+
+fn read_u32<R: Read>(reader: &mut R) -> io::Result<u32> {
+    let mut buf = [0u8; 4];
+    reader.read_exact(&mut buf)?;
+    Ok(u32::from_le_bytes(buf))
+}
+
+fn read_u64<R: Read>(reader: &mut R) -> io::Result<u64> {
+    let mut buf = [0u8; 8];
+    reader.read_exact(&mut buf)?;
+    Ok(u64::from_le_bytes(buf))
+}
+
+fn skip_bytes<R: Read>(reader: &mut R, n: u64) -> io::Result<()> {
+    // For BufReader, seeking is more efficient but Read doesn't guarantee Seek.
+    // Use a small buffer to discard bytes.
+    let mut remaining = n;
+    let mut buf = [0u8; 4096];
+    while remaining > 0 {
+        let to_read = remaining.min(buf.len() as u64) as usize;
+        reader.read_exact(&mut buf[..to_read])?;
+        remaining -= to_read as u64;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Cursor;
+
+    /// Build a minimal JITDump file in memory with the given records.
+    fn build_jitdump(records: &[Vec<u8>]) -> Vec<u8> {
+        let mut buf = Vec::new();
+
+        // Header (40 bytes)
+        buf.extend_from_slice(&JITDUMP_MAGIC_LE.to_le_bytes()); // magic
+        buf.extend_from_slice(&1u32.to_le_bytes()); // version
+        buf.extend_from_slice(&40u32.to_le_bytes()); // total_size (header)
+        buf.extend_from_slice(&0x3Eu32.to_le_bytes()); // elf_mach (EM_X86_64)
+        buf.extend_from_slice(&0u32.to_le_bytes()); // pad1
+        buf.extend_from_slice(&1234u32.to_le_bytes()); // pid
+        buf.extend_from_slice(&0u64.to_le_bytes()); // timestamp
+        buf.extend_from_slice(&0u64.to_le_bytes()); // flags
+
+        for record in records {
+            buf.extend_from_slice(record);
+        }
+
+        buf
+    }
+
+    /// Build a JIT_CODE_LOAD record.
+    fn code_load_record(code_addr: u64, code_size: u64, code_index: u64, name: &str) -> Vec<u8> {
+        let name_bytes = name.as_bytes();
+        // name + null terminator, no code bytes for simplicity
+        let payload_size = 40 + name_bytes.len() as u32 + 1;
+        let total_size = 16 + payload_size;
+
+        let mut rec = Vec::new();
+        rec.extend_from_slice(&JIT_CODE_LOAD.to_le_bytes()); // id
+        rec.extend_from_slice(&total_size.to_le_bytes()); // total_size
+        rec.extend_from_slice(&0u64.to_le_bytes()); // timestamp
+
+        // Fixed payload
+        rec.extend_from_slice(&1234u32.to_le_bytes()); // pid
+        rec.extend_from_slice(&1234u32.to_le_bytes()); // tid
+        rec.extend_from_slice(&code_addr.to_le_bytes()); // vma
+        rec.extend_from_slice(&code_addr.to_le_bytes()); // code_addr
+        rec.extend_from_slice(&code_size.to_le_bytes()); // code_size
+        rec.extend_from_slice(&code_index.to_le_bytes()); // code_index
+
+        // Name + null
+        rec.extend_from_slice(name_bytes);
+        rec.push(0);
+
+        rec
+    }
+
+    /// Build a JIT_CODE_MOVE record.
+    fn code_move_record(old_addr: u64, new_addr: u64, new_size: u64, code_index: u64) -> Vec<u8> {
+        let total_size: u32 = 16 + 32;
+        let mut rec = Vec::new();
+        rec.extend_from_slice(&JIT_CODE_MOVE.to_le_bytes());
+        rec.extend_from_slice(&total_size.to_le_bytes());
+        rec.extend_from_slice(&0u64.to_le_bytes()); // timestamp
+        rec.extend_from_slice(&old_addr.to_le_bytes());
+        rec.extend_from_slice(&new_addr.to_le_bytes());
+        rec.extend_from_slice(&new_size.to_le_bytes());
+        rec.extend_from_slice(&code_index.to_le_bytes());
+        rec
+    }
+
+    /// Build a JIT_CODE_CLOSE record.
+    fn close_record() -> Vec<u8> {
+        let mut rec = Vec::new();
+        rec.extend_from_slice(&JIT_CODE_CLOSE.to_le_bytes());
+        rec.extend_from_slice(&16u32.to_le_bytes()); // total_size = header only
+        rec.extend_from_slice(&0u64.to_le_bytes()); // timestamp
+        rec
+    }
+
+    #[test]
+    fn test_parse_single_symbol() {
+        let data = build_jitdump(&[code_load_record(0x1000, 0x100, 0, "myFunction")]);
+        let mut cursor = Cursor::new(data);
+        let _header = parse_header(&mut cursor).unwrap();
+        let mut table = JitSymbolTable {
+            symbols: BTreeMap::new(),
+            pending_debug: HashMap::new(),
+            last_read_offset: JITDUMP_HEADER_SIZE,
+        };
+        table.read_records(&mut cursor).unwrap();
+
+        assert_eq!(table.len(), 1);
+
+        // Exact start address
+        let sym = table.resolve(0x1000).unwrap();
+        assert_eq!(sym.name, "myFunction");
+        assert_eq!(sym.code_size, 0x100);
+
+        // Middle of the range
+        assert!(table.resolve(0x1050).is_some());
+
+        // Just before the end
+        assert!(table.resolve(0x10FF).is_some());
+
+        // At the end (exclusive)
+        assert!(table.resolve(0x1100).is_none());
+
+        // Before the start
+        assert!(table.resolve(0x0FFF).is_none());
+    }
+
+    #[test]
+    fn test_parse_multiple_symbols() {
+        let data = build_jitdump(&[
+            code_load_record(0x1000, 0x100, 0, "funcA"),
+            code_load_record(0x2000, 0x200, 1, "funcB"),
+            code_load_record(0x3000, 0x50, 2, "funcC"),
+        ]);
+        let mut cursor = Cursor::new(data);
+        let _header = parse_header(&mut cursor).unwrap();
+        let mut table = JitSymbolTable {
+            symbols: BTreeMap::new(),
+            pending_debug: HashMap::new(),
+            last_read_offset: JITDUMP_HEADER_SIZE,
+        };
+        table.read_records(&mut cursor).unwrap();
+
+        assert_eq!(table.len(), 3);
+        assert_eq!(table.resolve(0x1050).unwrap().name, "funcA");
+        assert_eq!(table.resolve(0x2100).unwrap().name, "funcB");
+        assert_eq!(table.resolve(0x3000).unwrap().name, "funcC");
+
+        // In the gap between funcA and funcB
+        assert!(table.resolve(0x1500).is_none());
+    }
+
+    #[test]
+    fn test_code_move() {
+        let data = build_jitdump(&[
+            code_load_record(0x1000, 0x100, 0, "movedFunc"),
+            code_move_record(0x1000, 0x5000, 0x200, 0),
+        ]);
+        let mut cursor = Cursor::new(data);
+        let _header = parse_header(&mut cursor).unwrap();
+        let mut table = JitSymbolTable {
+            symbols: BTreeMap::new(),
+            pending_debug: HashMap::new(),
+            last_read_offset: JITDUMP_HEADER_SIZE,
+        };
+        table.read_records(&mut cursor).unwrap();
+
+        assert_eq!(table.len(), 1);
+        // Old address should not resolve
+        assert!(table.resolve(0x1050).is_none());
+        // New address should resolve
+        let sym = table.resolve(0x5050).unwrap();
+        assert_eq!(sym.name, "movedFunc");
+        assert_eq!(sym.code_size, 0x200);
+    }
+
+    #[test]
+    fn test_close_record_stops_parsing() {
+        let data = build_jitdump(&[
+            code_load_record(0x1000, 0x100, 0, "beforeClose"),
+            close_record(),
+            code_load_record(0x2000, 0x100, 1, "afterClose"),
+        ]);
+        let mut cursor = Cursor::new(data);
+        let _header = parse_header(&mut cursor).unwrap();
+        let mut table = JitSymbolTable {
+            symbols: BTreeMap::new(),
+            pending_debug: HashMap::new(),
+            last_read_offset: JITDUMP_HEADER_SIZE,
+        };
+        table.read_records(&mut cursor).unwrap();
+
+        assert_eq!(table.len(), 1);
+        assert!(table.resolve(0x1050).is_some());
+        assert!(table.resolve(0x2050).is_none());
+    }
+
+    #[test]
+    fn test_truncated_file() {
+        // Build a valid file but truncate it mid-record
+        let data = build_jitdump(&[code_load_record(0x1000, 0x100, 0, "complete")]);
+        let mut truncated = data.clone();
+        // Append a partial second record (just the header, no payload)
+        truncated.extend_from_slice(&JIT_CODE_LOAD.to_le_bytes());
+        truncated.extend_from_slice(&100u32.to_le_bytes()); // total_size
+                                                            // No more bytes — truncated
+
+        let mut cursor = Cursor::new(truncated);
+        let _header = parse_header(&mut cursor).unwrap();
+        let mut table = JitSymbolTable {
+            symbols: BTreeMap::new(),
+            pending_debug: HashMap::new(),
+            last_read_offset: JITDUMP_HEADER_SIZE,
+        };
+        table.read_records(&mut cursor).unwrap();
+
+        // Should have the first complete symbol
+        assert_eq!(table.len(), 1);
+        assert_eq!(table.resolve(0x1050).unwrap().name, "complete");
+    }
+
+    #[test]
+    fn test_invalid_magic() {
+        let mut data = vec![0u8; 40];
+        data[0..4].copy_from_slice(&0xDEADBEEFu32.to_le_bytes());
+        let mut cursor = Cursor::new(data);
+        assert!(parse_header(&mut cursor).is_err());
+    }
+
+    #[test]
+    fn test_format_jit_symbol_with_source() {
+        let sym = JitSymbol {
+            code_addr: 0x1000,
+            code_size: 0x100,
+            name: "handleRequest#AbCdEf".to_string(),
+            source: Some(("/home/user/app/server.js".to_string(), 42)),
+        };
+        assert_eq!(format_jit_symbol(&sym), "handleRequest (server.js:42)");
+    }
+
+    #[test]
+    fn test_format_jit_symbol_without_source() {
+        let sym = JitSymbol {
+            code_addr: 0x1000,
+            code_size: 0x100,
+            name: "hello#DdCypB".to_string(),
+            source: None,
+        };
+        assert_eq!(format_jit_symbol(&sym), "hello");
+    }
+
+    #[test]
+    fn test_format_jit_symbol_no_hash() {
+        let sym = JitSymbol {
+            code_addr: 0x1000,
+            code_size: 0x100,
+            name: "anonymous".to_string(),
+            source: None,
+        };
+        assert_eq!(format_jit_symbol(&sym), "anonymous");
+    }
+
+    #[test]
+    fn test_strip_jsc_hash() {
+        assert_eq!(strip_jsc_hash("hello#DdCypB"), "hello");
+        assert_eq!(strip_jsc_hash("/tmp/test.js#B9UAQK"), "/tmp/test.js");
+        assert_eq!(strip_jsc_hash("no_hash"), "no_hash");
+        // Don't strip if suffix contains non-alphanumeric
+        assert_eq!(strip_jsc_hash("color#ff-00"), "color#ff-00");
+    }
+
+    #[test]
+    fn test_find_jitdump_nonexistent() {
+        // Use an isolated temp directory so stale files in /tmp can't cause false failures
+        let dir = std::env::temp_dir().join("jitdump_test_nonexistent");
+        let _ = std::fs::create_dir_all(&dir);
+        // Clean any leftovers from previous test runs
+        for entry in std::fs::read_dir(&dir).into_iter().flatten().flatten() {
+            let _ = std::fs::remove_file(entry.path());
+        }
+        assert!(find_jitdump_for_pid_in_dir(99999, &dir).is_none());
+        let _ = std::fs::remove_dir(&dir);
+    }
+
+    #[test]
+    fn test_find_jitdump_standard_convention() {
+        let dir = std::env::temp_dir().join("jitdump_test_standard");
+        let _ = std::fs::create_dir_all(&dir);
+        let path = dir.join("jit-1234.dump");
+        std::fs::write(&path, b"dummy").unwrap();
+        let found = find_jitdump_for_pid_in_dir(1234, &dir);
+        assert_eq!(found, Some(path.clone()));
+        let _ = std::fs::remove_file(&path);
+        let _ = std::fs::remove_dir(&dir);
+    }
+
+    #[test]
+    fn test_find_jitdump_jsc_convention() {
+        let dir = std::env::temp_dir().join("jitdump_test_jsc");
+        let _ = std::fs::create_dir_all(&dir);
+        let path = dir.join("jit-5678-1234-AbCdEf");
+        std::fs::write(&path, b"dummy").unwrap();
+        let found = find_jitdump_for_pid_in_dir(1234, &dir);
+        assert_eq!(found, Some(path.clone()));
+        // Verify it doesn't match wrong PID
+        assert!(find_jitdump_for_pid_in_dir(5678, &dir).is_none());
+        let _ = std::fs::remove_file(&path);
+        let _ = std::fs::remove_dir(&dir);
+    }
+
+    #[test]
+    fn test_empty_table() {
+        let data = build_jitdump(&[]);
+        let mut cursor = Cursor::new(data);
+        let _header = parse_header(&mut cursor).unwrap();
+        let mut table = JitSymbolTable {
+            symbols: BTreeMap::new(),
+            pending_debug: HashMap::new(),
+            last_read_offset: JITDUMP_HEADER_SIZE,
+        };
+        table.read_records(&mut cursor).unwrap();
+
+        assert_eq!(table.len(), 0);
+        assert!(table.is_empty());
+        assert!(table.resolve(0x1000).is_none());
+    }
+}
diff --git a/profile-bee/src/lib.rs b/profile-bee/src/lib.rs
index 58c5712..41e567d 100644
--- a/profile-bee/src/lib.rs
+++ b/profile-bee/src/lib.rs
@@ -37,6 +37,7 @@ pub mod probe_spec;
 pub mod v8;
 
 pub mod java;
+pub mod jitdump;
 pub mod perf_map;
 
 mod trace_handler;
diff --git a/profile-bee/src/spawn.rs b/profile-bee/src/spawn.rs
index 342979e..bd8e921 100644
--- a/profile-bee/src/spawn.rs
+++ b/profile-bee/src/spawn.rs
@@ -180,6 +180,15 @@ fn is_nodejs_program(program: &str) -> bool {
     matches!(basename, "node" | "nodejs" | "nsolid")
 }
 
+/// Check if a program name looks like Bun (JavaScriptCore runtime).
+pub fn is_bun_program(program: &str) -> bool {
+    let basename = Path::new(program)
+        .file_name()
+        .and_then(|n| n.to_str())
+        .unwrap_or(program);
+    matches!(basename, "bun" | "bunx")
+}
+
 /// Add `-XX:+PreserveFramePointer` to a `JAVA_TOOL_OPTIONS` value unless it is
 /// already present. Preserving the frame pointer (JDK 8u60+, usually <1%
 /// overhead) is what lets the frame-pointer unwinder walk through JIT-compiled
@@ -256,6 +265,14 @@ fn build_runtime_env(program: &str) -> Vec<(&'static str, String)> {
         env.push(("JAVA_TOOL_OPTIONS", value));
     }
 
+    if is_bun_program(program) {
+        // BUN_JSC_useJITDump=1 makes JavaScriptCore write a perf `jit-<pid>.dump`
+        // with JIT symbol addresses, so JIT-compiled JS resolves instead of
+        // appearing as [unknown].
+        tracing::info!("Bun detected: injecting BUN_JSC_useJITDump=1 for JIT symbol resolution");
+        env.push(("BUN_JSC_useJITDump", "1".to_string()));
+    }
+
     env
 }
 
diff --git a/profile-bee/src/symbolize.rs b/profile-bee/src/symbolize.rs
index 69a76f7..7e24e4a 100644
--- a/profile-bee/src/symbolize.rs
+++ b/profile-bee/src/symbolize.rs
@@ -22,6 +22,8 @@ use blazesym::symbolize::source::{Kernel, Process, Source};
 use blazesym::symbolize::{Input, Symbolized, Symbolizer};
 use blazesym::Pid;
 
+use crate::jitdump::{self, JitSymbolTable};
+
 /// A parsed raw stack sample (one line of the raw collapse file).
 #[derive(Debug)]
 struct RawLine {
@@ -61,6 +63,22 @@ pub fn symbolize_raw_file(path: &Path) -> anyhow::Result<Vec<String>> {
     // Determine PIDs from mappings header
     let pids: Vec<u32> = mappings.keys().copied().collect();
 
+    // Load binary JITDump tables (`jit-<pid>.dump`) for any PIDs that have them,
+    // so JIT-compiled frames (e.g. Bun/JSC) resolve in offline re-symbolization.
+    let mut jit_tables: HashMap<u32, JitSymbolTable> = HashMap::new();
+    for &pid in &pids {
+        if let Some(dump) = jitdump::find_jitdump_for_pid(pid) {
+            match JitSymbolTable::load_from_file(&dump) {
+                Ok(table) if !table.is_empty() => {
+                    tracing::info!("loaded JITDump for pid {} ({} symbols)", pid, table.len());
+                    jit_tables.insert(pid, table);
+                }
+                Ok(_) => {}
+                Err(e) => tracing::debug!("JITDump read failed for pid {}: {}", pid, e),
+            }
+        }
+    }
+
     let symbolizer = Symbolizer::new();
     let mut output = Vec::new();
 
@@ -104,10 +122,23 @@ pub fn symbolize_raw_file(path: &Path) -> anyhow::Result<Vec<String>> {
         if !sample.user_addrs.is_empty() {
             if let Some(pid) = target_pid {
                 let src = Source::Process(Process::new(Pid::from(pid)));
+                let jit_table = jit_tables.get(&pid);
                 match symbolizer.symbolize(&src, Input::AbsAddr(&sample.user_addrs)) {
                     Ok(syms) => {
-                        for sym in syms {
-                            frames.push(format_symbolized(sym, false));
+                        for (i, sym) in syms.into_iter().enumerate() {
+                            let formatted = format_symbolized(sym, false);
+                            // Override [unknown] with a JITDump symbol if available.
+                            if formatted == "[unknown]" {
+                                if let (Some(table), Some(addr)) =
+                                    (jit_table, sample.user_addrs.get(i))
+                                {
+                                    if let Some(jit_sym) = table.resolve(*addr) {
+                                        frames.push(jitdump::format_jit_symbol(jit_sym));
+                                        continue;
+                                    }
+                                }
+                            }
+                            frames.push(formatted);
                         }
                     }
                     Err(e) => {
diff --git a/profile-bee/src/trace_handler.rs b/profile-bee/src/trace_handler.rs
index 4bda73e..d8579fb 100644
--- a/profile-bee/src/trace_handler.rs
+++ b/profile-bee/src/trace_handler.rs
@@ -1,4 +1,5 @@
 use crate::ebpf::{FramePointersPod, StackInfoPod};
+use crate::jitdump::{self, JitSymbolTable};
 use crate::perf_map::{format_jit_symbol, PerfMapCache};
 use crate::v8::{V8HeapReader, V8IntrospectionData};
 use crate::{cache::PointerStackFramesCache, types::StackFrameInfo, types::StackInfoExt};
@@ -488,6 +489,10 @@ pub struct TraceHandler {
     perf_maps: PerfMapCache,
     /// PIDs we've already logged a missing-perf-map hint for (avoid spam).
     perf_map_hinted: HashMap<u32, bool>,
+    /// Binary JITDump tables (`jit-<pid>.dump`) per PID, for runtimes that emit
+    /// the perf JITDump format — notably Bun/JavaScriptCore (`BUN_JSC_useJITDump=1`),
+    /// which does not write a text perf-map. Consulted after V8/HotSpot/perf-map.
+    jit_tables: HashMap<u32, JitSymbolTable>,
 }
 
 impl Default for TraceHandler {
@@ -580,6 +585,7 @@ impl TraceHandler {
             softirq_bits_valid,
             perf_maps: PerfMapCache::new(),
             perf_map_hinted: HashMap::new(),
+            jit_tables: HashMap::new(),
         }
     }
 
@@ -616,6 +622,7 @@ impl TraceHandler {
         self.hotspot_readers.remove(&tgid);
         self.perf_maps.remove(tgid);
         self.perf_map_hinted.remove(&tgid);
+        self.jit_tables.remove(&tgid);
         tracing::debug!("invalidated symbol caches for pid {}", tgid);
     }
 
@@ -750,6 +757,23 @@ impl TraceHandler {
         self.cache.invalidate_pid(tgid);
     }
 
+    /// Register a JITDump symbol table for a PID (perf `jit-<pid>.dump`).
+    /// Flushes cached frames so previously-`[unknown]` stacks re-resolve.
+    pub fn register_jit_table(&mut self, tgid: u32, table: JitSymbolTable) {
+        self.jit_tables.insert(tgid, table);
+        self.cache.invalidate_pid(tgid);
+    }
+
+    /// Whether a JITDump table is loaded for this PID.
+    pub fn has_jit_table(&self, tgid: u32) -> bool {
+        self.jit_tables.contains_key(&tgid)
+    }
+
+    /// Mutable access to a PID's JITDump table for incremental reloads.
+    pub fn jit_table_mut(&mut self, tgid: u32) -> Option<&mut JitSymbolTable> {
+        self.jit_tables.get_mut(&tgid)
+    }
+
     pub fn print_stats(&self) {
         tracing::info!("{}", self.cache.stats());
     }
@@ -1132,6 +1156,10 @@ impl TraceHandler {
         // (HotSpot, V8 without SFI, other runtimes).
         self.apply_perf_map_symbols(pid, &addrs, &mut user_syms);
 
+        // Binary JITDump fallback (`jit-<pid>.dump`) for runtimes that emit the
+        // perf JITDump format instead of a text perf-map — notably Bun/JSC.
+        self.apply_jitdump_symbols(pid, &addrs, &mut user_syms);
+
         let kernel_addrs = kernel_stack.unwrap_or_default();
         let mut kernel_syms = self
             .symbolize_kernel_stack(&kernel_addrs)
@@ -1224,6 +1252,29 @@ impl TraceHandler {
             }
         }
     }
+
+    /// Fill still-unresolved user frames from the per-PID binary JITDump table.
+    /// Runs after the perf-map fallback, so it only touches frames no other
+    /// source could name (e.g. Bun/JSC JIT code in anonymous mappings).
+    fn apply_jitdump_symbols(&mut self, pid: u32, addrs: &[u64], user_syms: &mut [StackFrameInfo]) {
+        let Some(jit_table) = self.jit_tables.get(&pid) else {
+            return;
+        };
+        for (frame, &addr) in user_syms.iter_mut().zip(addrs.iter()) {
+            let needs_jit = match frame.symbol.as_deref() {
+                None => true,
+                Some("[unknown]") => true,
+                Some(s) if s.starts_with("0x") => true,
+                Some(_) => false,
+            };
+            if !needs_jit {
+                continue;
+            }
+            if let Some(jit_sym) = jit_table.resolve(addr) {
+                frame.symbol = Some(jitdump::format_jit_symbol(jit_sym));
+            }
+        }
+    }
 }
 
 #[cfg(test)]
diff --git a/tests/fixtures/src/bun_callstack.js b/tests/fixtures/src/bun_callstack.js
new file mode 100644
index 0000000..ac5aad4
--- /dev/null
+++ b/tests/fixtures/src/bun_callstack.js
@@ -0,0 +1,52 @@
+// Bun test fixture for profile-bee E2E tests.
+// Creates a CPU-intensive call stack with known function names.
+//
+// Bun uses JavaScriptCore (not V8). When BUN_JSC_useJITDump=1 is set,
+// JSC writes /tmp/jit-<pid>.dump with address-to-symbol mappings for
+// JIT-compiled functions. profile-bee auto-injects this env var when
+// spawning Bun via `probee -- bun <script>`.
+//
+// The warmup phase ensures functions are JIT-compiled (and recorded in
+// the JITDump file) before the main profiling window.
+
+'use strict';
+
+function hot() {
+    // Busy loop to consume CPU time and be visible in profiles
+    let sum = 0;
+    for (let i = 0; i < 1e6; i++) {
+        sum += Math.sqrt(i) * Math.sin(i);
+    }
+    return sum;
+}
+
+function processData() {
+    return hot();
+}
+
+function handleRequest() {
+    return processData();
+}
+
+function serverLoop() {
+    return handleRequest();
+}
+
+// Warmup: call enough times to trigger JIT compilation in JSC.
+// JSC's DFG JIT compiles after ~100 invocations, FTL after ~1000.
+for (let i = 0; i < 100; i++) {
+    serverLoop();
+}
+
+// Run for a fixed duration to give the profiler time to capture samples
+const duration = parseInt(process.env.DURATION_MS || '2000', 10);
+const start = Date.now();
+let result = 0;
+while (Date.now() - start < duration) {
+    result += serverLoop();
+}
+
+// Prevent dead code elimination
+if (result === Infinity) {
+    console.log(result);
+}
diff --git a/tests/run_e2e.sh b/tests/run_e2e.sh
index 9ad0236..83bbb48 100755
--- a/tests/run_e2e.sh
+++ b/tests/run_e2e.sh
@@ -569,6 +569,72 @@ test_nodejs_dwarf_callstack() {
         "Should contain JS function names or V8 internal frames with DWARF"
 }
 
+# ---------- Bun / JITDump tests ---------------------------------------------
+
+# Profile a Bun script. Uses `-- bun <script>` so setup_process_to_profile
+# auto-injects BUN_JSC_useJITDump=1 (JSC writes jit-<pid>.dump).
+run_bun_profiler() {
+    local script="$1"
+    local name="$2"
+    shift 2
+    local extra_args=("$@")
+    local collapse_file="$OUTPUT_DIR/${name}.collapse"
+
+    rm -f "$collapse_file"
+
+    local profiler_output
+    profiler_output=$(DURATION_MS=$((PROFILE_TIME_MS + 500)) timeout "$TEST_TIMEOUT" "$PROFILER" \
+        --time "$PROFILE_TIME_MS" \
+        --frequency "$FREQUENCY" \
+        --collapse "$collapse_file" \
+        --skip-idle \
+        "${extra_args[@]+"${extra_args[@]}"}" \
+        -- bun "$script" 2>&1) || true
+
+    if [[ "$VERBOSE" == "true" ]]; then
+        echo "--- profiler output ---" >&2
+        echo "$profiler_output" >&2
+        echo "--- end ---" >&2
+    fi
+
+    if [[ ! -f "$collapse_file" ]]; then
+        echo "Collapse file not created: $collapse_file" >&2
+        return 1
+    fi
+
+    echo "$collapse_file"
+}
+
+test_bun_jitdump_callstack() {
+    if ! command -v bun &>/dev/null; then
+        echo "  SKIP: bun not found in PATH" >&2
+        return 0
+    fi
+
+    local script="$SCRIPT_DIR/fixtures/src/bun_callstack.js"
+    if [[ ! -f "$script" ]]; then
+        echo "  SKIP: fixture $script not found" >&2
+        return 0
+    fi
+
+    local file
+    file=$(run_bun_profiler "$script" "bun-jitdump-callstack")
+
+    local total
+    total=$(count_samples "$file")
+    if [[ "$total" -le 0 ]]; then
+        echo "  No samples collected for Bun (total=$total)" >&2
+        return 1
+    fi
+
+    # JSC emits JITDump symbols like "JSC-FTL: hot" / "JSC-DFG: processData"
+    # (JSC #hash suffixes are stripped during formatting). Require a JSC JIT
+    # tier marker before a fixture function name so we don't match native syms.
+    assert_stack_contains "$file" \
+        "JSC.*\bhot\b\|JSC.*\bprocessData\b\|JSC.*\bhandleRequest\b\|JSC.*\bserverLoop\b" \
+        "Should contain JSC JIT-compiled JS function names from JITDump"
+}
+
 # ── Run all tests ────────────────────────────────────────────────────────────
 
 echo ""
@@ -622,6 +688,10 @@ run_test "Node.js JS function names in stacks"       test_nodejs_callstack
 run_test "Node.js DWARF + FP-only JIT zones"         test_nodejs_dwarf_callstack
 echo ""
 
+echo "── Bun / JITDump ──"
+run_test "Bun JS function names via JITDump"         test_bun_jitdump_callstack
+echo ""
+
 # ── Summary ──────────────────────────────────────────────────────────────────
 
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

From 52078c7b7982b7ace09f8fa12490bc1fc9c9c274 Mon Sep 17 00:00:00 2001
From: Joshua Koo <zz85nus@gmail.com>
Date: Tue, 1 Sep 2026 14:50:04 +0000
Subject: [PATCH 2/4] =?UTF-8?q?jitdump:=20address=20review=20=E2=80=94=20M?=
 =?UTF-8?q?OVE=20layout,=20LOAD=20bounds,=20mutation=20flush,=20offline=20?=
 =?UTF-8?q?JIT?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- parse_code_move: parse the full 48-byte perf jr_code_move payload
  (pid, tid, vma precede old/new addr, code_size, code_index). It previously
  read a 32-byte layout, misaligning every field and moving the wrong symbol.
  Test helper corrected to emit the 48-byte record; test_code_move verifies
  resolution at both the old (gone) and new address.
- parse_code_load: validate code_size <= remaining payload and cap the
  name allocation (64 KiB); read only the bounded name and skip the native
  code instead of allocating name+code from an unvalidated total_size. Guards
  against a malformed /tmp/jit-<pid>.dump driving a huge allocation (profile-bee
  reads these as root). New test rejects an oversized code_size record.
- read_records/reload_from_file now return the number of *mutations* (loads +
  applied moves) rather than the net symbol-count delta. Same-length
  replacements (a move onto an existing address, a reload at the same address)
  now register, so event_loop's `n > 0` frame-cache flush fires for them; also
  removes a potential usize underflow when a move shrank the map. New test
  asserts load+move counts as two mutations with net count one.
- symbolize (offline .raw): the whole-stack blazesym-failure branch now
  resolves each address through the JITDump table before falling back to hex,
  matching the Ok-branch override (the resolve() contract is covered by
  jitdump unit tests).

Validated: 16 jitdump unit tests pass; Bun e2e still resolves `JSC-FTL: hot`;
fmt/clippy clean.
---
 profile-bee/src/jitdump.rs   | 169 ++++++++++++++++++++++++++++-------
 profile-bee/src/symbolize.rs |   8 +-
 2 files changed, 145 insertions(+), 32 deletions(-)

diff --git a/profile-bee/src/jitdump.rs b/profile-bee/src/jitdump.rs
index daa406b..788db96 100644
--- a/profile-bee/src/jitdump.rs
+++ b/profile-bee/src/jitdump.rs
@@ -104,7 +104,10 @@ impl JitSymbolTable {
     /// Resume reading from a partially-read file for streaming modes.
     ///
     /// Seeks to `last_read_offset` and reads any new records appended since
-    /// the last read. Returns the number of new symbols loaded.
+    /// the last read. Returns the number of records that mutated the table
+    /// (loads and applied moves) — nonzero means a cache flush is warranted,
+    /// including same-length replacements that a net symbol-count delta would
+    /// miss.
     ///
     /// If the file has been truncated or rotated (size < last_read_offset),
     /// resets state and re-parses from the beginning.
@@ -127,9 +130,7 @@ impl JitSymbolTable {
             match parse_header(&mut reader) {
                 Ok(_) => {
                     self.last_read_offset = JITDUMP_HEADER_SIZE;
-                    let before = self.symbols.len();
-                    self.read_records(&mut reader)?;
-                    return Ok(self.symbols.len() - before);
+                    return self.read_records(&mut reader);
                 }
                 Err(e) => return Err(e),
             }
@@ -138,9 +139,7 @@ impl JitSymbolTable {
         let mut reader = BufReader::new(file);
         reader.seek(SeekFrom::Start(self.last_read_offset))?;
 
-        let before = self.symbols.len();
-        self.read_records(&mut reader)?;
-        Ok(self.symbols.len() - before)
+        self.read_records(&mut reader)
     }
 
     /// Number of symbols in the table.
@@ -154,7 +153,14 @@ impl JitSymbolTable {
     }
 
     /// Read records from the current reader position until EOF or JIT_CODE_CLOSE.
-    fn read_records<R: Read + Seek>(&mut self, reader: &mut R) -> io::Result<()> {
+    ///
+    /// Returns the number of records that mutated the symbol table (loads and
+    /// applied moves). Callers use this to decide whether to flush caches —
+    /// counting *mutations* rather than the net symbol-count delta so that
+    /// same-length replacements (a move onto an existing address, or a reload
+    /// at the same address) still register as a change.
+    fn read_records<R: Read + Seek>(&mut self, reader: &mut R) -> io::Result<usize> {
+        let mut mutations: usize = 0;
         loop {
             let record_start = reader.stream_position()?;
 
@@ -187,14 +193,22 @@ impl JitSymbolTable {
 
             match record_id {
                 JIT_CODE_LOAD => match self.parse_code_load(reader, payload_size) {
-                    Ok(()) => {}
+                    Ok(changed) => {
+                        if changed {
+                            mutations += 1;
+                        }
+                    }
                     Err(_) => {
                         self.last_read_offset = record_start;
                         break;
                     }
                 },
                 JIT_CODE_MOVE => match self.parse_code_move(reader, payload_size) {
-                    Ok(()) => {}
+                    Ok(changed) => {
+                        if changed {
+                            mutations += 1;
+                        }
+                    }
                     Err(_) => {
                         self.last_read_offset = record_start;
                         break;
@@ -220,7 +234,7 @@ impl JitSymbolTable {
             self.last_read_offset = record_start + total_size as u64;
         }
 
-        Ok(())
+        Ok(mutations)
     }
 
     /// Parse a JIT_CODE_LOAD record.
@@ -228,9 +242,15 @@ impl JitSymbolTable {
     /// Fixed fields after record header:
     ///   pid(u32), tid(u32), vma(u64), code_addr(u64), code_size(u64), code_index(u64)
     /// Followed by: null-terminated function name, then raw code bytes.
-    fn parse_code_load<R: Read>(&mut self, reader: &mut R, payload_size: u64) -> io::Result<()> {
+    fn parse_code_load<R: Read>(&mut self, reader: &mut R, payload_size: u64) -> io::Result<bool> {
         // Fixed fields: 4 + 4 + 8 + 8 + 8 + 8 = 40 bytes
         const FIXED_SIZE: u64 = 40;
+        // Upper bound on the symbol-name portion we will allocate. Real JIT
+        // function names / source paths are short; this caps memory use if a
+        // malformed record advertises a huge total_size (profile-bee reads
+        // attacker-influenceable /tmp/jit-<pid>.dump files as root).
+        const MAX_NAME_BYTES: u64 = 64 * 1024;
+
         if payload_size < FIXED_SIZE {
             return Err(io::Error::new(
                 io::ErrorKind::InvalidData,
@@ -245,17 +265,34 @@ impl JitSymbolTable {
         let code_size = read_u64(reader)?;
         let _code_index = read_u64(reader)?;
 
-        // Remaining bytes: null-terminated name + code bytes
+        // The remaining payload is the null-terminated name followed by
+        // `code_size` bytes of native code. Reject records whose code_size
+        // can't fit — this catches oversized/malformed sizes before we read.
         let remaining = payload_size - FIXED_SIZE;
-        let mut name_and_code = vec![0u8; remaining as usize];
-        reader.read_exact(&mut name_and_code)?;
+        if code_size > remaining {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "JIT_CODE_LOAD code_size exceeds record payload",
+            ));
+        }
 
-        // Extract null-terminated name
-        let name_end = name_and_code
+        // Name occupies the bytes before the native code. Read only a bounded
+        // prefix of it (never the code), so a huge advertised size can't drive
+        // a huge allocation.
+        let name_region = remaining - code_size;
+        let name_read = name_region.min(MAX_NAME_BYTES) as usize;
+        let mut name_buf = vec![0u8; name_read];
+        reader.read_exact(&mut name_buf)?;
+
+        let name_end = name_buf
             .iter()
             .position(|&b| b == 0)
-            .unwrap_or(name_and_code.len());
-        let name = String::from_utf8_lossy(&name_and_code[..name_end]).to_string();
+            .unwrap_or(name_buf.len());
+        let name = String::from_utf8_lossy(&name_buf[..name_end]).to_string();
+
+        // Skip the rest of the name region (if we capped it) and the native
+        // code bytes without allocating them.
+        skip_bytes(reader, (name_region - name_read as u64) + code_size)?;
 
         // Check for pending debug info (keyed by code_addr — the same
         // address that appeared in the preceding JIT_CODE_DEBUG_INFO record)
@@ -271,15 +308,18 @@ impl JitSymbolTable {
             },
         );
 
-        Ok(())
+        Ok(true)
     }
 
     /// Parse a JIT_CODE_MOVE record.
     ///
-    /// Fixed fields: old_code_addr(u64), new_code_addr(u64),
-    ///               new_code_size(u64), code_index(u64)
-    fn parse_code_move<R: Read>(&mut self, reader: &mut R, payload_size: u64) -> io::Result<()> {
-        const FIXED_SIZE: u64 = 32;
+    /// Fixed fields (perf JITDump `jr_code_move`, 48 bytes after the header):
+    ///   pid(u32), tid(u32), vma(u64), old_code_addr(u64),
+    ///   new_code_addr(u64), code_size(u64), code_index(u64)
+    ///
+    /// Returns whether an existing symbol was actually moved.
+    fn parse_code_move<R: Read>(&mut self, reader: &mut R, payload_size: u64) -> io::Result<bool> {
+        const FIXED_SIZE: u64 = 48;
         if payload_size < FIXED_SIZE {
             return Err(io::Error::new(
                 io::ErrorKind::InvalidData,
@@ -287,6 +327,9 @@ impl JitSymbolTable {
             ));
         }
 
+        let _pid = read_u32(reader)?;
+        let _tid = read_u32(reader)?;
+        let _vma = read_u64(reader)?;
         let old_code_addr = read_u64(reader)?;
         let new_code_addr = read_u64(reader)?;
         let new_code_size = read_u64(reader)?;
@@ -302,9 +345,10 @@ impl JitSymbolTable {
             sym.code_addr = new_code_addr;
             sym.code_size = new_code_size;
             self.symbols.insert(new_code_addr, sym);
+            Ok(true)
+        } else {
+            Ok(false)
         }
-
-        Ok(())
     }
 
     /// Parse a JIT_CODE_DEBUG_INFO record.
@@ -541,11 +585,12 @@ mod tests {
         buf
     }
 
-    /// Build a JIT_CODE_LOAD record.
+    /// Build a JIT_CODE_LOAD record (spec-compliant: name + `code_size` bytes
+    /// of native code follow the fixed fields).
     fn code_load_record(code_addr: u64, code_size: u64, code_index: u64, name: &str) -> Vec<u8> {
         let name_bytes = name.as_bytes();
-        // name + null terminator, no code bytes for simplicity
-        let payload_size = 40 + name_bytes.len() as u32 + 1;
+        // fixed(40) + name + null + code_size code bytes
+        let payload_size = 40 + name_bytes.len() as u32 + 1 + code_size as u32;
         let total_size = 16 + payload_size;
 
         let mut rec = Vec::new();
@@ -565,16 +610,23 @@ mod tests {
         rec.extend_from_slice(name_bytes);
         rec.push(0);
 
+        // Native code bytes (content irrelevant — the parser skips them)
+        rec.extend(std::iter::repeat(0xCCu8).take(code_size as usize));
+
         rec
     }
 
-    /// Build a JIT_CODE_MOVE record.
+    /// Build a JIT_CODE_MOVE record (spec-compliant 48-byte payload with
+    /// pid/tid/vma preceding the address fields).
     fn code_move_record(old_addr: u64, new_addr: u64, new_size: u64, code_index: u64) -> Vec<u8> {
-        let total_size: u32 = 16 + 32;
+        let total_size: u32 = 16 + 48;
         let mut rec = Vec::new();
         rec.extend_from_slice(&JIT_CODE_MOVE.to_le_bytes());
         rec.extend_from_slice(&total_size.to_le_bytes());
         rec.extend_from_slice(&0u64.to_le_bytes()); // timestamp
+        rec.extend_from_slice(&1234u32.to_le_bytes()); // pid
+        rec.extend_from_slice(&1234u32.to_le_bytes()); // tid
+        rec.extend_from_slice(&new_addr.to_le_bytes()); // vma
         rec.extend_from_slice(&old_addr.to_le_bytes());
         rec.extend_from_slice(&new_addr.to_le_bytes());
         rec.extend_from_slice(&new_size.to_le_bytes());
@@ -672,6 +724,61 @@ mod tests {
         assert_eq!(sym.code_size, 0x200);
     }
 
+    #[test]
+    fn test_read_records_reports_mutations() {
+        // A load followed by a move is two mutations even though the net symbol
+        // count stays at one — this is what drives cache invalidation.
+        let data = build_jitdump(&[
+            code_load_record(0x1000, 0x100, 0, "f"),
+            code_move_record(0x1000, 0x5000, 0x100, 0),
+        ]);
+        let mut cursor = Cursor::new(data);
+        let _ = parse_header(&mut cursor).unwrap();
+        let mut table = JitSymbolTable {
+            symbols: BTreeMap::new(),
+            pending_debug: HashMap::new(),
+            last_read_offset: JITDUMP_HEADER_SIZE,
+        };
+        let mutations = table.read_records(&mut cursor).unwrap();
+        assert_eq!(mutations, 2, "load + move should count as two mutations");
+        assert_eq!(table.len(), 1);
+        assert!(table.resolve(0x5050).is_some());
+    }
+
+    #[test]
+    fn test_code_load_oversized_code_size_rejected() {
+        // A JIT_CODE_LOAD whose code_size far exceeds the record payload must be
+        // rejected without loading a symbol (and without a huge allocation),
+        // rather than trusting the advertised size.
+        let name = b"evil\0";
+        let payload_size = 40u32 + name.len() as u32; // fixed fields + name, no code
+        let total_size = 16 + payload_size;
+        let mut rec = Vec::new();
+        rec.extend_from_slice(&JIT_CODE_LOAD.to_le_bytes());
+        rec.extend_from_slice(&total_size.to_le_bytes());
+        rec.extend_from_slice(&0u64.to_le_bytes()); // timestamp
+        rec.extend_from_slice(&1234u32.to_le_bytes()); // pid
+        rec.extend_from_slice(&1234u32.to_le_bytes()); // tid
+        rec.extend_from_slice(&0x1000u64.to_le_bytes()); // vma
+        rec.extend_from_slice(&0x1000u64.to_le_bytes()); // code_addr
+        rec.extend_from_slice(&0xFFFF_FFFFu64.to_le_bytes()); // code_size (bogus)
+        rec.extend_from_slice(&0u64.to_le_bytes()); // code_index
+        rec.extend_from_slice(name);
+
+        let data = build_jitdump(&[rec]);
+        let mut cursor = Cursor::new(data);
+        let _ = parse_header(&mut cursor).unwrap();
+        let mut table = JitSymbolTable {
+            symbols: BTreeMap::new(),
+            pending_debug: HashMap::new(),
+            last_read_offset: JITDUMP_HEADER_SIZE,
+        };
+        // Stops cleanly; no symbol loaded.
+        table.read_records(&mut cursor).unwrap();
+        assert_eq!(table.len(), 0);
+        assert!(table.resolve(0x1000).is_none());
+    }
+
     #[test]
     fn test_close_record_stops_parsing() {
         let data = build_jitdump(&[
diff --git a/profile-bee/src/symbolize.rs b/profile-bee/src/symbolize.rs
index 7e24e4a..edd169d 100644
--- a/profile-bee/src/symbolize.rs
+++ b/profile-bee/src/symbolize.rs
@@ -143,8 +143,14 @@ pub fn symbolize_raw_file(path: &Path) -> anyhow::Result<Vec<String>> {
                     }
                     Err(e) => {
                         tracing::debug!("user symbolization failed for pid {}: {}", pid, e);
+                        // blazesym failed for the whole stack (e.g. process gone),
+                        // but JIT frames can still resolve from the JITDump table.
                         for addr in &sample.user_addrs {
-                            frames.push(format!("{:#x}", addr));
+                            if let Some(jit_sym) = jit_table.and_then(|t| t.resolve(*addr)) {
+                                frames.push(jitdump::format_jit_symbol(jit_sym));
+                            } else {
+                                frames.push(format!("{:#x}", addr));
+                            }
                         }
                     }
                 }

From 5c8c6fd0a18c821d2cd09118d9f1f14dc2b25035 Mon Sep 17 00:00:00 2001
From: Joshua Koo <zz85nus@gmail.com>
Date: Tue, 1 Sep 2026 15:55:13 +0000
Subject: [PATCH 3/4] =?UTF-8?q?jitdump:=20round-2=20review=20=E2=80=94=20b?=
 =?UTF-8?q?ounds,=20retryable=20reload,=20header-pid=20check,=20tests?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- parse_debug_info: bound the filename allocation (64 KiB) instead of allocating
  the file-controlled `remaining` directly, then skip the rest of the payload so
  the reader stays aligned. Same malformed-/tmp/-file hardening as parse_code_load.
- read_records: a truncated skip of an *unknown* record type is now handled like
  any other incomplete record (rewind to record_start, break, retryable) instead
  of propagating; unrelated I/O errors still propagate.
- reload_from_file: when not yet past the header (last_read_offset == 0, e.g. a
  freshly constructed table or after a shrink/reset), parse and validate the
  40-byte header before reading records so header bytes are never misread as a
  record; an incompletely-written header returns Ok(0) and stays retryable.
- symbolize (offline .raw): validate the JITDump header PID against the requested
  PID (via new jitdump::read_header_pid) before applying a table, rejecting a
  dump whose header belongs to a different process (pid reuse / mislabeled file).
  Exposed the previously-discarded header PID (JitdumpHeader.pid).
- Docs: correct the pending_debug field comment — it is keyed by code_addr
  (matching parse_debug_info/parse_code_load), not code_index.
- Tests (+3): debug-info source population + format_jit_symbol rendering
  (`name (file.js:line)`); oversized DEBUG_INFO rejected without a giant
  allocation; reload_from_file incremental-append and shrink/reset paths.

19 jitdump unit tests pass; Bun e2e still resolves `JSC-FTL: hot`; fmt/clippy clean.
---
 profile-bee/src/jitdump.rs   | 160 +++++++++++++++++++++++++++++++++--
 profile-bee/src/symbolize.rs |  19 +++++
 2 files changed, 171 insertions(+), 8 deletions(-)

diff --git a/profile-bee/src/jitdump.rs b/profile-bee/src/jitdump.rs
index 788db96..659d02f 100644
--- a/profile-bee/src/jitdump.rs
+++ b/profile-bee/src/jitdump.rs
@@ -49,7 +49,8 @@ pub struct JitSymbol {
 pub struct JitSymbolTable {
     symbols: BTreeMap<u64, JitSymbol>,
     /// Debug info that arrives before its corresponding JIT_CODE_LOAD.
-    /// Keyed by `code_index` (matches JIT_CODE_LOAD's `code_index` field).
+    /// Keyed by `code_addr` — the same address `parse_debug_info` stores under
+    /// and `parse_code_load` looks up (see those methods).
     pending_debug: HashMap<u64, (String, u32)>,
     /// File offset for incremental reload — next read starts here.
     last_read_offset: u64,
@@ -115,7 +116,7 @@ impl JitSymbolTable {
         let file = std::fs::File::open(path)?;
         let file_len = file.metadata()?.len();
 
-        // Detect truncated/rotated file — reset and re-parse from scratch
+        // Detect truncated/rotated file — reset and re-parse from scratch.
         if file_len < self.last_read_offset {
             tracing::debug!(
                 "JITDump file shrunk ({} < {}), resetting",
@@ -125,13 +126,20 @@ impl JitSymbolTable {
             self.symbols.clear();
             self.pending_debug.clear();
             self.last_read_offset = 0;
+        }
 
+        // Not yet past the header (never loaded, or just reset above): parse and
+        // validate the header before reading records, so header bytes are never
+        // misinterpreted as a record. Keep an incompletely-written header
+        // retryable — leave the offset at 0 so a later reload picks it up.
+        if self.last_read_offset < JITDUMP_HEADER_SIZE {
             let mut reader = BufReader::new(file);
             match parse_header(&mut reader) {
                 Ok(_) => {
                     self.last_read_offset = JITDUMP_HEADER_SIZE;
                     return self.read_records(&mut reader);
                 }
+                Err(e) if e.kind() == io::ErrorKind::UnexpectedEof => return Ok(0),
                 Err(e) => return Err(e),
             }
         }
@@ -226,8 +234,18 @@ impl JitSymbolTable {
                     break;
                 }
                 _ => {
-                    // Unknown record type — skip
-                    skip_bytes(reader, payload_size)?;
+                    // Unknown record type — skip its payload. A truncated skip
+                    // (partial file) is handled like any other incomplete record:
+                    // rewind to the record start and stop, leaving it retryable.
+                    // Unrelated I/O errors still propagate.
+                    match skip_bytes(reader, payload_size) {
+                        Ok(()) => {}
+                        Err(e) if e.kind() == io::ErrorKind::UnexpectedEof => {
+                            self.last_read_offset = record_start;
+                            break;
+                        }
+                        Err(e) => return Err(e),
+                    }
                 }
             }
 
@@ -381,14 +399,22 @@ impl JitSymbolTable {
             let _discrim = read_u32(reader)?;
             consumed += 16;
 
-            // Read null-terminated filename from remaining payload
+            // Read a bounded prefix of the null-terminated filename, then skip
+            // the rest of the payload. Bounding the allocation guards against a
+            // malformed record advertising a huge total_size (these files come
+            // from /tmp and profile-bee reads them as root).
+            const MAX_FILENAME_BYTES: u64 = 64 * 1024;
             let remaining = payload_size - consumed;
-            let mut buf = vec![0u8; remaining as usize];
+            let read_len = remaining.min(MAX_FILENAME_BYTES) as usize;
+            let mut buf = vec![0u8; read_len];
             reader.read_exact(&mut buf)?;
 
             let name_end = buf.iter().position(|&b| b == 0).unwrap_or(buf.len());
             let filename = String::from_utf8_lossy(&buf[..name_end]).to_string();
 
+            // Keep the reader aligned to the end of the record.
+            skip_bytes(reader, remaining - read_len as u64)?;
+
             if !filename.is_empty() {
                 self.pending_debug.insert(code_addr, (filename, line));
             }
@@ -492,7 +518,19 @@ fn strip_jsc_hash(name: &str) -> &str {
 struct JitdumpHeader {
     _version: u32,
     _elf_mach: u32,
-    _pid: u32,
+    /// PID of the process that produced the dump. Used to confirm a dump file
+    /// belongs to the process being symbolized before its symbols are applied.
+    pid: u32,
+}
+
+/// Read only the JITDump header and return its embedded PID.
+///
+/// Callers use this to reject a dump whose header PID does not match the
+/// process being symbolized (defends against pid reuse / a mislabeled file)
+/// before loading and applying its symbols.
+pub fn read_header_pid(path: &Path) -> io::Result<u32> {
+    let mut reader = BufReader::new(std::fs::File::open(path)?);
+    Ok(parse_header(&mut reader)?.pid)
 }
 
 fn parse_header<R: Read>(reader: &mut R) -> io::Result<JitdumpHeader> {
@@ -523,7 +561,7 @@ fn parse_header<R: Read>(reader: &mut R) -> io::Result<JitdumpHeader> {
     Ok(JitdumpHeader {
         _version: version,
         _elf_mach: elf_mach,
-        _pid: pid,
+        pid,
     })
 }
 
@@ -643,6 +681,26 @@ mod tests {
         rec
     }
 
+    /// Build a JIT_CODE_DEBUG_INFO record with a single entry.
+    fn debug_info_record(code_addr: u64, entry_addr: u64, line: u32, filename: &str) -> Vec<u8> {
+        let fname = filename.as_bytes();
+        // code_addr(8) + nr_entry(8) + entry[addr(8)+line(4)+discrim(4)] + name+null
+        let payload_size = 16 + 16 + fname.len() as u32 + 1;
+        let total_size = 16 + payload_size;
+        let mut rec = Vec::new();
+        rec.extend_from_slice(&JIT_CODE_DEBUG_INFO.to_le_bytes());
+        rec.extend_from_slice(&total_size.to_le_bytes());
+        rec.extend_from_slice(&0u64.to_le_bytes()); // timestamp
+        rec.extend_from_slice(&code_addr.to_le_bytes());
+        rec.extend_from_slice(&1u64.to_le_bytes()); // nr_entry
+        rec.extend_from_slice(&entry_addr.to_le_bytes());
+        rec.extend_from_slice(&line.to_le_bytes());
+        rec.extend_from_slice(&0u32.to_le_bytes()); // discriminator
+        rec.extend_from_slice(fname);
+        rec.push(0);
+        rec
+    }
+
     #[test]
     fn test_parse_single_symbol() {
         let data = build_jitdump(&[code_load_record(0x1000, 0x100, 0, "myFunction")]);
@@ -779,6 +837,92 @@ mod tests {
         assert!(table.resolve(0x1000).is_none());
     }
 
+    #[test]
+    fn test_debug_info_populates_source_and_format() {
+        // DEBUG_INFO precedes its CODE_LOAD (per spec); the loaded symbol should
+        // carry the (file, line) and format_jit_symbol should render it.
+        let data = build_jitdump(&[
+            debug_info_record(0x1000, 0x1000, 42, "app/server.js"),
+            code_load_record(0x1000, 0x100, 0, "handleRequest"),
+        ]);
+        let mut cursor = Cursor::new(data);
+        let _ = parse_header(&mut cursor).unwrap();
+        let mut table = JitSymbolTable {
+            symbols: BTreeMap::new(),
+            pending_debug: HashMap::new(),
+            last_read_offset: JITDUMP_HEADER_SIZE,
+        };
+        table.read_records(&mut cursor).unwrap();
+
+        let sym = table.resolve(0x1050).unwrap();
+        assert_eq!(sym.source, Some(("app/server.js".to_string(), 42)));
+        assert_eq!(format_jit_symbol(sym), "handleRequest (server.js:42)");
+    }
+
+    #[test]
+    fn test_debug_info_oversized_rejected() {
+        // A DEBUG_INFO advertising a huge payload but with a short body must be
+        // handled without a giant allocation: the bounded filename read hits EOF
+        // and parsing stops cleanly rather than allocating the advertised size.
+        let mut rec = Vec::new();
+        let huge_payload: u32 = 512 * 1024 * 1024; // advertise 512 MiB
+        let total_size = 16 + huge_payload;
+        rec.extend_from_slice(&JIT_CODE_DEBUG_INFO.to_le_bytes());
+        rec.extend_from_slice(&total_size.to_le_bytes());
+        rec.extend_from_slice(&0u64.to_le_bytes()); // timestamp
+        rec.extend_from_slice(&0x1000u64.to_le_bytes()); // code_addr
+        rec.extend_from_slice(&1u64.to_le_bytes()); // nr_entry
+        rec.extend_from_slice(&0x1000u64.to_le_bytes()); // entry addr
+        rec.extend_from_slice(&7u32.to_le_bytes()); // line
+        rec.extend_from_slice(&0u32.to_le_bytes()); // discriminator
+        rec.extend_from_slice(b"short.js\0"); // real body is tiny (truncated vs advertised)
+
+        let data = build_jitdump(&[rec]);
+        let mut cursor = Cursor::new(data);
+        let _ = parse_header(&mut cursor).unwrap();
+        let mut table = JitSymbolTable {
+            symbols: BTreeMap::new(),
+            pending_debug: HashMap::new(),
+            last_read_offset: JITDUMP_HEADER_SIZE,
+        };
+        // Returns cleanly; no code loaded (only a truncated debug-info record).
+        assert!(table.read_records(&mut cursor).is_ok());
+        assert_eq!(table.len(), 0);
+    }
+
+    #[test]
+    fn test_reload_incremental_and_shrink() {
+        let dir = std::env::temp_dir().join("jitdump_test_reload");
+        let _ = std::fs::create_dir_all(&dir);
+        let path = dir.join(format!("jit-reload-{}.dump", std::process::id()));
+
+        // Initial file: header + one symbol.
+        let initial = build_jitdump(&[code_load_record(0x1000, 0x100, 0, "first")]);
+        std::fs::write(&path, &initial).unwrap();
+        let mut table = JitSymbolTable::load_from_file(&path).unwrap();
+        assert_eq!(table.len(), 1);
+        assert!(table.resolve(0x1050).is_some());
+
+        // Append a second record; incremental reload reads only the new one.
+        let mut appended = initial.clone();
+        appended.extend_from_slice(&code_load_record(0x2000, 0x100, 1, "second"));
+        std::fs::write(&path, &appended).unwrap();
+        let mutations = table.reload_from_file(&path).unwrap();
+        assert_eq!(mutations, 1, "only the appended record should be read");
+        assert_eq!(table.len(), 2);
+        assert!(table.resolve(0x2050).is_some());
+
+        // Shrink/rotate the file: reload resets and re-parses from scratch.
+        let shrunk = build_jitdump(&[code_load_record(0x3000, 0x100, 0, "third")]);
+        std::fs::write(&path, &shrunk).unwrap();
+        table.reload_from_file(&path).unwrap();
+        assert_eq!(table.len(), 1);
+        assert!(table.resolve(0x3050).is_some());
+        assert!(table.resolve(0x1050).is_none());
+
+        let _ = std::fs::remove_file(&path);
+    }
+
     #[test]
     fn test_close_record_stops_parsing() {
         let data = build_jitdump(&[
diff --git a/profile-bee/src/symbolize.rs b/profile-bee/src/symbolize.rs
index edd169d..a1f5787 100644
--- a/profile-bee/src/symbolize.rs
+++ b/profile-bee/src/symbolize.rs
@@ -68,6 +68,25 @@ pub fn symbolize_raw_file(path: &Path) -> anyhow::Result<Vec<String>> {
     let mut jit_tables: HashMap<u32, JitSymbolTable> = HashMap::new();
     for &pid in &pids {
         if let Some(dump) = jitdump::find_jitdump_for_pid(pid) {
+            // Confirm the dump's embedded PID matches before trusting its
+            // symbols — a mismatched header means the file belongs to a
+            // different process (pid reuse / mislabeled file).
+            match jitdump::read_header_pid(&dump) {
+                Ok(header_pid) if header_pid != pid => {
+                    tracing::debug!(
+                        "JITDump {} header pid {} != {}, skipping",
+                        dump.display(),
+                        header_pid,
+                        pid
+                    );
+                    continue;
+                }
+                Err(e) => {
+                    tracing::debug!("JITDump header read failed for pid {}: {}", pid, e);
+                    continue;
+                }
+                Ok(_) => {}
+            }
             match JitSymbolTable::load_from_file(&dump) {
                 Ok(table) if !table.is_empty() => {
                     tracing::info!("loaded JITDump for pid {} ({} symbols)", pid, table.len());

From bbdd76a360bfdfa29f847f981fd90214e30f7cac Mon Sep 17 00:00:00 2001
From: Joshua Koo <zz85nus@gmail.com>
Date: Tue, 1 Sep 2026 16:04:34 +0000
Subject: [PATCH 4/4] jitdump: use repeat_n in test helper (clippy
 manual_repeat_n)

---
 profile-bee/src/jitdump.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/profile-bee/src/jitdump.rs b/profile-bee/src/jitdump.rs
index 659d02f..1f74170 100644
--- a/profile-bee/src/jitdump.rs
+++ b/profile-bee/src/jitdump.rs
@@ -649,7 +649,7 @@ mod tests {
         rec.push(0);
 
         // Native code bytes (content irrelevant — the parser skips them)
-        rec.extend(std::iter::repeat(0xCCu8).take(code_size as usize));
+        rec.extend(std::iter::repeat_n(0xCCu8, code_size as usize));
 
         rec
     }