In trying to fuzz test a different issue, I ran into a reproducible case where
we end up with a broken handlescope stack. The issue requires a large number
of handlescopes created with aggressive GC, so hopefully it isn't something
that too many users have run into.
The issue is that a single HandleScope address is used to initialize two
HandleScopes. The fix could just be to create a 2nd HS variable (to get a 2nd
address), but the first initialization is unnecessary and can just be removed.
(Note that EventManager dispatch creates its own HandleScope, so the one
removed in frameCompletedLoading really did nothing)
Adds a abortParked (to be used instead of abort for a parked transfer) which
guards against a double-free by setting the state to .completing BEFORE running
the requestFailed callback. Without this, requestFail could itself cause the
transfer to be cleared.
Also added a guard to try to catch double transfer deinit's in Debug. Because
the memory could get re-used between the first and second free, the lack of
failure doesn't prove there is no UAF. But it's cheap to do and debug only.
Follow up to https://github.com/lightpanda-io/browser/pull/2789 which adds
better multi-page support for runner. When waiting, callers have the choice
to wait for a specific frame, all current frames, or a given list of frames. The
last one, a given list of frames, is the most flexible, allowing callers to
provide an `until` per frame AND receive a per-frame result.
waitForSelector and waitForScript continue to be per frame (which is now
explicitly given).
Like 2789, while the changes aren't insignificant (Runner is doing important
work), a number of files were touched either purely because of changes in tests
or other superficial changes, e.g. `session.runner` is now infallible.
Cleanup sloppy tests, make sure pages are always closed after page tests - not
before and not never.
Fix a UAF in replaceRootImmediate..if a page is being retired, also retire its
replacement.
Give BrowserContext a Session.PageHandle rather than having a frame_id and re-
implementing PageHandle logic.
Replaces the 1 (+1 inflight) page design of session for an unlimited number of
pages. The main goal is to support a more efficient async goto (1). Without this
commit, async goto has two implementation: multiple browser, which is resource
intensive (thread + isolate per page), bolting it onto sub-frames (like iframe
or popups). The issue with the 2nd version (which I originally suggested) is
that most resources are tied to the Page. So even if an async goto "page" (which
would map to a Frame) is released, most things stay in memory, including the
DOM (page.factory) and the V8::Context.
This new approach adds multiple page support to sessions. The advantage is
pretty clear: the existing memory model (page-tied resources) becomes a strength
of the design, rather than a weakness.
This change is not tirivla, but the diff is inflated by 2 large mechanial
changes, so it isn't _that_ big either. That said, I'd divide this into four
parts.
1 - The old concept of _active/_pending is now baked into the Page itself. A
Page has a `replaces: ?*Page = null` and `replacement: ?*Page = null` field.
2 - Because of #1 above, the Session now just has an `pages: ArrayList(*Page)`.
As much as possible, single-page APIs, like `removePage` no longer exists. We're
trying to present a consistent multi-page API. See #3.
3 - References to *Page and *Frame have always been dangerous. For example,
`lightpanda.fetch` has a block to scope `frame`:
```zig
{
const frame = try session.createPage();
// frame isn't safe to use after navigate, it can be swapped out
_ = try frame.navigate(...)
}
```
While we still hand out *Page and *Frame (user-beware), some of the more
important APIs now take a frame_id which Session can resolve. Furthermore,
createPage now returns a PageHandle which is a safe wrapper around a page/frame.
4 - Two large mechanical changes were made:
a - Many tests were superficially changed to account for new naming or use
a new test-helper to preserve the single-page illusion (because 99% of
tests _are_ single-page)
b - Many CDP changes where `bc.session.currentFrame()` -> `bc.mainFrame()`).
This isn't to say CDP changes are meaningless, but it's mostly 1 change
about how the "main" target/frame_id is tracked (by CDP itself, rather
than the Session) that required a number of superficial changes to
accomodate
`Runner` remains largely single-page focused. Runner and some MCP/Agent tools
continue to be tied to the "currentFrame" or "primaryPage". The Runner is
something I want to address in a follow-up PR, but we need to figure out what
it means to "wait" for multiple pages.
As much as possible, Session becomes multi-page native and has no concept of
a special/first/primary/main page. Users of session become responsible for
tracking pages of interest.
This change is not trivial, but the diff is inflated by 2 large mechanical
changes:
1 - Many tests
(1) https://github.com/lightpanda-io/browser/pull/2759
History.goInner re-derived the fragment-vs-document decision from the raw
entry._url, while navigateInner computes it from the resolved URL. These
diverge when an entry stores a non-canonical URL, queuing a spurious
hashchange (or missing one). Let navigateInner own the decision and queue
the event for all same-document navigations; drop goInner's duplicate.
This is a deprecated API, but it's used in various WPT tests. I don't expect
WPT tests to necessarily improve, but they should get further than just failing
on the setter.
This also includes a change where BroadcastChannel now uses the origin string
rather than the js.Origin identity because BroadcastChannel should be based
on the actual frame's origin...which used to be captured in Context.origin but
which the new document.domain can change.
When "rendering" innerText, we don't care about the visibility of the entire
tree, we just care about the visibilty of the element itself and then all of
it's children. Or, put differently:
```
<div style=display:none>
<div id=x>spice</div>
</div>
<script>
console.log(document.getElementById('x').innerText)
</script>
```
Should still print "spice"..even though 'x' is inside a hidden element. The
original version used the StyleManager's isHidden which fails this test - it
scans all the parents. This new version just considers the visibility of each
element being displayed. This is faster and more correct
Add Element/DocuemntFragment/Document moveBefore. The API is relatively
complicated compared to other node-moving APIs, so there are still some edge
cases. But this implementation should be at a level where having the API fixes
more things than it breaks.
Rules wrapped in @layer blocks (named, dotted sub-layer names, or
anonymous) were dropped from the cascade: StyleManager.parseSheet applied
top-level style rules and recursed into @media only, so @layer fell into
the silent else arm on both the _css_rules path and the <style> text path.
@layer blocks now flatten into the cascade like a matching @media body,
recursing into nested @media/@layer in both directions under the shared
MAX_AT_RULE_NESTING depth cap. The statement form (@layer a, b;) declares
ordering only and stays inert. Layer-priority ordering (css-cascade-5
section 6.4) is deliberately out of scope for this change: flattening with
the existing specificity + source-order tie-breaking fixes the common
failure mode of layered rules vanishing entirely (e.g. Tailwind v4 emits
its whole compiled output inside @layer, so .hidden { display: none }
never applied and checkVisibility()/getComputedStyle() reported hidden
elements as visible).
cssRules-inserted layer rules (insertRule/replaceSync) get their own
CSSRule.Type variant so the cascade pass can recognize them; their
JS-visible type stays 0 per CSSOM section 6.4.1 (no legacy code assigned),
matching Chrome's CSSLayerBlockRule.
Closes#2718
Implement the HashChangeEvent interface and fire a `hashchange` event on
the window whenever the URL fragment changes without a document reload,
mirroring the existing PopStateEvent/onpopstate wiring.
Per spec, hashchange is fired by queuing a task rather than synchronously,
so a listener registered after the fragment change still observes it and
each fragment change fires its own event. The task is queued via a
factory-allocated callback (the same async-dispatch pattern as MessagePort
and BroadcastChannel), capturing the old/new URLs since the frame's URL
keeps changing synchronously before the task runs.
Some CDNs (e.g. CloudFront/Brave Search) emit Brotli streams with 1+
trailing bytes after the logical end. The Brotli decoder succeeds, but
libcurl's brotli_do_write() (content_encoding.c:439) rejects unconsumed
input bytes as CURLE_WRITE_ERROR — even though all decompressed data was
delivered to the write callback.
Browsers accept such responses, so match that: when CURLE_WRITE_ERROR
arrives but our callback never errored and bytes were received, downgrade
to success.
Adds a new strip-mode "invisible" which consults the StyleManager to remove
hidden elements. However, unlike the general isHidden check in StyleManager
which is spec-compliant and will automatically hide a number of tags, e.g.
"meta", this check is explicitly against explicit styles. This seems more
practical to me, while it might be useful to remove some tags by default, e.g.
template, some tags like head, title and meta are too important to strip out.
innerText now uses the StyleManager's visibility check (isHidden) to skip
rendering children which are hidden.
Should allow us to close
https://github.com/lightpanda-io/browser/pull/2741 and
https://github.com/lightpanda-io/browser/issues/2734
Note that ~1000 WPT test still fail because of other style-driven behavior, most
significantly is `white-space`. The isHidden change only fixes a couple WPT
cases, but I think, for end users, it's the more important change (and it's also
the simpler for us to implement). Having wrong spacing is usually less of a
problem than showing the wrong content.
A queued module/preload transfer aborted during a page-swap teardown fired
shutdown_callback (unset on these requests), not error_callback, leaving its
entry stuck `.loading` and hanging waitForImport/waitForPreload. Register a
JS-free shutdown_callback that moves the entry off `.loading` so the waiter
unblocks.
Follow-up to #2664: move the Emulation.setDeviceMetricsOverride viewport
override from the Page to the Browser so it persists across page navigations
for the whole CDP connection, instead of being lost when the page is replaced.
Page.getViewport now delegates to Browser.getViewport, so every viewport
consumer keeps reading through a single path unchanged.
Now that #2694 centralized the default viewport, store an optional override
on the Page and have every viewport consumer read it through
Page.getViewport(): window.innerWidth/innerHeight, screen.width/height/
availWidth, visualViewport.width/height, Page.getLayoutMetrics, the
IntersectionObserver root rect, and matchMedia / the StyleManager media
cascade. This keeps the viewport consistent across all of them instead of
the split-brain a single-property override would create.
Emulation.setDeviceMetricsOverride writes the override (a 0 width or height
keeps that dimension, per the CDP default); clearDeviceMetricsOverride resets
to the default. Not-yet-emulated params (deviceScaleFactor, mobile, scale,
screenWidth/Height) are accepted but logged as not_implemented.
Aimed at improving correctness of the innerText getter and setter. Driven by a
number of WPT tests, largely in html/dom/elements/the-innertext-and-outertext-properties/
Meant as a replacement for (1). Though, unlike that PR, this commit does not
consider CSS at all (todo in a follow up PR). The change just to get correct
space handling is big enough on its own. The short version is that, as we
traverse the children, we need to keep various state in order to (for example)
avoid double whitespace. Table cells and rows need their own special handling
(tabs and newlines inserted between items), pre needs to preserve whitespace,
etc.
This also adds outerText which, for the getter, is identical to innerText and
for the setter, can reuse Element.replaceWith, except for special whitespace
handling at its edges.
(1) https://github.com/lightpanda-io/browser/pull/2741
