Commit Graph
9542 Commits
Author SHA1 Message Date
Karl Seguin eaf809d46e remove out of date comment 2026-09-07 08:18:50 +08:00
Navid EMAD ed2a5c6eeb webapi: move the text entry cursor on caret movement keys
A trusted keydown for ArrowLeft/ArrowRight/Home/End (and ArrowUp/ArrowDown
on a single-line <input>) fell through Frame.user_input.editKey, which only
handled Backspace/Delete and printable keys, so the caret never moved, Shift
never extended the selection, and a plain arrow never collapsed one.
innerInsert's no-selection arm also appended to the end of the value instead
of inserting at the caret. Add a moveCaret helper to the shared text entry
mixin (byte offsets stepping over whole UTF-8 sequences, line moves bounded
by '\n'), route the keys to it from editKey, and insert at the caret.

Closes #3423
2026-09-07 08:16:52 +08:00
Karl Seguin b21ec60853 Merge pull request #3411 from lightpanda-io/remove-unused-imports
chore: remove unused imports
2026-09-07 07:20:50 +08:00
Karl Seguin 80f057c741 Merge pull request #3422 from navidemad/fix-a55-textarea-selection-default-value
webapi: clamp text entry selections against the current value
2026-09-07 07:20:31 +08:00
Karl Seguin 0ff64124ff Merge pull request #3403 from lightpanda-io/error-bridge-rejection
chore: leverage bridge for error rejection
2026-09-07 06:58:13 +08:00
Navid EMAD 172614d138 webapi: clamp text entry selections against the current value
`select()`, `setSelectionRange()` and `howSelected()` in the TextEntry mixin
read the `_value` slot directly. That slot only holds an *assigned* value, so
a `<textarea>abcdef</textarea>` straight out of the parser has none and every
selection call collapsed the caret to 0 — while `textarea.value` returned
"abcdef" all along, since `getValue()` falls back to the child text node.

Route the three sites through `getValue()`, matching `innerDelete()`, which
already did. Per HTML, "set the selection range" clamps against the element's
API value, and a textarea's API value is its raw value.

`howSelected()` now also clamps: `selectionStart`/`selectionEnd` store their
argument verbatim, so an offset can outlive a shorter value and reach
`innerInsert()`'s `.partial` arm as an out-of-range slice index.

Closes #3421
2026-09-07 06:48:48 +08:00
Karl Seguin 277df36068 Merge pull request #3418 from navidemad/fix/link-test-getfl-macos
link test: check the O_NONBLOCK bit, not the whole F_GETFL word
2026-09-06 20:42:01 +08:00
Navid EMAD ae6a646797 link test: check the O_NONBLOCK bit, not the whole F_GETFL word
macOS adds an internal 'was written' bit to F_GETFL once the fd has been
written to, so the exact comparison fails there (expected 6, found 65542)
even though the send timed out as intended and O_NONBLOCK is still set.
2026-09-06 20:06:27 +08:00
Karl Seguin 588ec5fcb7 Merge pull request #3420 from navidemad/fix-a56-value-setter-caret
webapi: move the text entry cursor to the end on value set
2026-09-06 20:01:48 +08:00
Karl Seguin 6029d98134 Merge pull request #3416 from navidemad/fix/server-tests-macos-loopback
server tests: wait for loopback readiness on macOS
2026-09-06 20:01:33 +08:00
Karl Seguin 8ba5cb16c3 perf: Micro-optimize pseudoclass parsing
This was already micro-optimizes, but (a) it was needless generic and (b) was
faster than std.mem.eql in some cases, but slower than others. It now applies
both the len/ptr check skip AND the block compare.
2026-09-06 18:16:55 +08:00
Karl Seguin cdf4f936dc Merge pull request #3414 from navidemad/fix-a54-beforeinput-cancelable
webapi: make trusted beforeinput cancelable
2026-09-06 18:14:11 +08:00
Karl Seguin faad885913 improve macos test stability 2026-09-06 18:13:08 +08:00
Navid EMAD c9d79fc46b server tests: wait for loopback readiness on macOS
macOS delivers loopback traffic asynchronously, so LoopTest.accept could
call Server.accept before the handshake ACK landed (NotAccepted) and the
tests could read before the request bytes landed (WouldBlock, RST, and a
double disconnect that cast a -1 socket to usize in KQueue.socketEvent).
Poll for readiness first. Also accept any non-zero SO_KEEPALIVE: BSD
getsockopt returns the option bit, not 1.
2026-09-06 18:13:08 +08:00
Karl Seguin 27a7c3e516 avoid value dupe if unchanged 2026-09-06 18:08:07 +08:00
Navid EMAD 31d0de777f webapi: move the text entry cursor to the end on value set
The `value` setter on <input> and <textarea> updated the value but left
the text entry cursor where it was. The HTML Standard requires it to move
the cursor to the end of the new value, unselect any selected text and
reset the selection direction to "none".

The visible consequence is that a set-then-Backspace sequence deletes
nothing: the caret is still at 0 on a fresh control, so innerDelete()
returns early.

Input.setValue moves the caret only for types that have a text entry
cursor (selectionAvailable), and uses the sanitized length so a text
input that stripped CR/LF lands on the right offset. TextArea.setValue
always has one.

setUserValue delegates to setValue, and the text_entry.zig edit paths
that need a specific caret (innerInsert's .full/.partial arms,
innerDelete) already assign the selection after calling it, so they are
unaffected. innerInsert's .none arm appends at the end and previously
left the caret behind; it now follows the inserted text.

Attribute-driven and form-reset updates assign _value directly rather
than through setValue, so they keep the caret untouched.

Closes #3419
2026-09-06 18:08:07 +08:00
Karl Seguin df34a01722 Merge pull request #3425 from lightpanda-io/orderfile
update orderfile
2026-09-06 18:07:36 +08:00
Karl Seguin 7667fb9a35 update orderfile 2026-09-06 17:22:34 +08:00
Navid EMAD 670ca1641e webapi: make trusted beforeinput cancelable
InputEvent.initWithTrusted overwrote _bubbles/_cancelable/_composed for
every InputEvent right after Event.populatePrototypes had applied the
caller's options, forcing _cancelable = false. user_input.zig#allowEdit
asks for a cancelable beforeinput so a listener can veto the edit, but
preventDefault() is a no-op on a non-cancelable event, so the character
was inserted and `input` fired regardless.

Guard the flag block with `if (trusted)` — the shape KeyboardEvent
already uses — and derive _cancelable from the event type: `beforeinput`
is cancelable, `input` is not. Constructed events and
document.createEvent('InputEvent') now follow the EventInit dictionary
defaults instead of being forced to bubbling and composed.

Closes #3413
2026-09-06 04:15:41 +02:00
Karl Seguin 26de9b1df0 zig fmt 2026-09-05 19:49:18 +08:00
Karl Seguin 042df66646 webapi: don't fire error event when a worker script fetch is aborted
terminate() can cancel a still-inflight script fetch. That's a cancellation, not
a failure: a terminated worker must fire no further events, and Chrome is silent
here. We logged an error and fired an ErrorEvent — observable by Cloudflare
challenge scripts, which create a blob-URL worker and terminate it in the same
tick.

On error.TransferCanceled, skip the log and the error event; same log skip in
SharedWorkerGlobalScope.

This was tried in https://github.com/lightpanda-io/browser/pull/3189, but is
now ambiguous thanks to https://github.com/lightpanda-io/browser/pull/3368
which introduced a distinct `error.TransferCanceled`.
2026-09-05 19:47:08 +08:00
Halil Durak 14d868486b Merge pull request #3217 from pasmud/gaz/lightpanda-io-browser-url-fix
fix: pop drive-letter lookalike segment for non-file schemes (#2794)
2026-09-05 14:13:24 +03:00
Pierre Tachoire 7c18f459ef Merge pull request #3410 from lightpanda-io/CORS-readme 2026-09-05 12:16:09 +02:00
Karl Seguin a5e27869d3 chore: remove unused imports 2026-09-05 17:51:47 +08:00
Karl Seguin 333887245e update readme to reference experimental nature of CORS support 2026-09-05 17:45:44 +08:00
Karl Seguin efe406e2bb fix name ownership, set isolated world context origin 2026-09-05 17:33:04 +08:00
Karl Seguin 3165fa8c82 Merge pull request #3407 from staylor/staylor-3319-watchdog-termination-segv
Disarm watchdog before protocol teardown
2026-09-05 17:32:32 +08:00
Karl Seguin 77594b7ce4 Merge pull request #3378 from lightpanda-io/matchmedia-change-events
webapi: matchMedia change events and real (add|remove)Listener
2026-09-05 16:03:35 +08:00
Karl Seguin 6b1f77981f tie MediaQueryList to the frame, not the page 2026-09-05 15:45:41 +08:00
Karl Seguin 523494ffe3 webapi: don't upgrade custom elements in a windowless document
A custom element created in a windowless document (think DOMParser, or new
Document(), ...) doesn't have a custom element registry and thus should remain
undefined.

This repurposes the existing Frame._skip_custom_element_upgrade boolean into a
tri-state enum to capture the 3 possible states: `construct` and `bare_context`
capture the previous boolean state, and `undefined` is now used for this third
state.

This fixes (non-fatal) errors on decathlon.com. It also fixes a few WPT cases
and advances a few more (which are now failing for a different reason).
2026-09-05 14:23:34 +08:00
Karl Seguin c5aaafe599 Merge pull request #3406 from lightpanda-io/nikneym/calm-heap-limit
Enable automatic restoration of initial heap limit
2026-09-05 06:56:14 +08:00
Karl Seguin 2f011997e1 Merge pull request #3402 from lightpanda-io/minor-select
webapi: minor fix to select
2026-09-05 06:54:51 +08:00
Karl Seguin 4ef679346d Merge pull request #3400 from lightpanda-io/idb-rename
indexeddb: Add setName to IDBObjectStore and IDBIndex
2026-09-05 06:54:32 +08:00
Karl Seguin e08108259e Merge pull request #3404 from lightpanda-io/uaf-indexdb
idb: fix use-after-free reading txn._db after releaseRef frees it
2026-09-05 06:54:09 +08:00
Scott Taylor ecc9cffa12 fix: disarm watchdog before protocol teardown 2026-09-04 13:18:37 -04:00
Pierre Tachoire 2f76e190f2 Merge pull request #3002 from lightpanda-io/cors-impl
CORS Implementation
2026-09-04 18:26:28 +02:00
Halil Durak 7211cfa6db enable automatic restoration of initial heap limit 2026-09-04 18:27:45 +03:00
Merge_Conflict - Pasi 04e2584f7a fix: pop drive-letter lookalike segment for non-file schemes (#2794)
rust-url treats a trailing 'C:'/'C|' path segment as a Windows drive
letter when shortening a path with '..', for every scheme. Per the URL
Standard that exemption only applies to file:. Work around it in the
Rust binding (fix pending upstream in servo/rust-url#1138) so that
new URL('..', 'abc://x/y/z/C:/') resolves to 'abc://x/y/z/'.
2026-09-04 18:05:13 +03:00
Muki Kiboigo 620df371d3 avoid total capacity reservation on opaque fetch 2026-09-04 07:02:02 -07:00
Muki Kiboigo 6bf77ad0f2 make test client buf larger to accomodate larger metrics 2026-09-04 07:02:02 -07:00
Muki Kiboigo 34b743fbd6 origin is tainted on cross origin redirects 2026-09-04 07:02:01 -07:00
Muki Kiboigo 54518383c0 enforce cors response on redirects as well 2026-09-04 07:00:03 -07:00
Muki Kiboigo 0610d5ecd1 collapse isCrossOriginModeAllowed check in pipeline 2026-09-04 07:00:02 -07:00
Muki Kiboigo 0aeba826b4 use credentials_mode instead of cookie bool 2026-09-04 07:00:02 -07:00
Muki Kiboigo 23c1c1018f properly use include on default corsSettings and image load 2026-09-04 07:00:02 -07:00
Muki Kiboigo 1f9342e92f add credentials to preflight key for cors 2026-09-04 07:00:02 -07:00
Muki Kiboigo 868882b0c8 add origin conditionally on no_cors 2026-09-04 07:00:02 -07:00
Muki Kiboigo db9ccfb7c9 fetch can't be navigate mode 2026-09-04 07:00:02 -07:00
Muki Kiboigo 827d0f0598 only check cross origin mode on obey cors 2026-09-04 07:00:02 -07:00
Muki Kiboigo 8a8bb3814f fix test running 2026-09-04 07:00:01 -07:00