Commit Graph
7466 Commits
Author SHA1 Message Date
Muki Kiboigo c3a71efca4 include modes on EchoDriver 2026-09-04 07:00:01 -07:00
Muki Kiboigo addba12426 add CORS metrics 2026-09-04 07:00:01 -07:00
Muki Kiboigo 15d27902ba use experimental features flag instead of obey cors 2026-09-04 07:00:01 -07:00
Muki Kiboigo 1fe8456cbd add modes to the tests 2026-09-04 07:00:01 -07:00
Muki Kiboigo 12ed38dfdd better no cors opaque behavior 2026-09-04 07:00:00 -07:00
Muki Kiboigo d1f4605459 non-default credentials and request mode 2026-09-04 07:00:00 -07:00
Muki Kiboigo b0fffe693a more comprehensive cors singleflight key 2026-09-04 06:59:40 -07:00
Muki Kiboigo 2b06583662 authorization header doesnt accept wildcard 2026-09-04 06:59:40 -07:00
Muki Kiboigo 8ee714418d proper safelist checking for CORS headers 2026-09-04 06:59:40 -07:00
Muki Kiboigo feebb889ad cors check before cache check 2026-09-04 06:59:40 -07:00
Muki Kiboigo 89df63e956 safelisted methods always pass in CORS 2026-09-04 06:59:39 -07:00
Muki Kiboigo 570a450163 ensure origin is added to requests 2026-09-04 06:59:39 -07:00
Muki Kiboigo f2f93d0bc5 fix ordering in Request.InitOpts 2026-09-04 06:59:39 -07:00
Muki Kiboigo c16a3b3585 fix warn log on preflight blocked 2026-09-04 06:59:39 -07:00
Muki Kiboigo e9449b2276 follow create a potential cors request rules in ScriptManager 2026-09-04 06:59:39 -07:00
Muki Kiboigo da00a90c02 set cors cross origin on transfer after no-cors check 2026-09-04 06:59:39 -07:00
Muki Kiboigo d3c0291bd1 add request mode for Fetch 2026-09-04 06:59:39 -07:00
Muki Kiboigo ddfa034310 add credentials_mode for proper CORS credentials handling 2026-09-04 06:59:39 -07:00
Muki Kiboigo f31b32ac4e don't store network in CorsGate 2026-09-04 06:59:38 -07:00
Muki Kiboigo cf37a94f16 get rid of blocked on CorsGate check result 2026-09-04 06:59:38 -07:00
Muki Kiboigo b976894315 properly hook up single flight for CorsGate 2026-09-04 06:59:38 -07:00
Muki Kiboigo 977874ce5f initial preflighting 2026-09-04 06:59:38 -07:00
Muki Kiboigo f428dc8e52 add origin header in CorsGate on cross origin 2026-09-04 06:59:38 -07:00
Muki Kiboigo 4e79f24814 basic validation without preflighting 2026-09-04 06:59:38 -07:00
Muki Kiboigo ec45dccacf add obey_cors option 2026-09-04 06:59:38 -07:00
Muki Kiboigo 212c806be5 add basic CorsGate scaffold 2026-09-04 06:59:37 -07:00
Muki Kiboigo b114382c44 add origin field to HttpClient Request 2026-09-04 06:59:37 -07:00
Karl Seguin 396cffa1c1 Merge pull request #3391 from lightpanda-io/resource-timing
webapi: resource-timing
2026-09-04 18:03:17 +08:00
Karl Seguin 1034ed8732 Performance capture schedule and notify when full 2026-09-04 17:01:48 +08:00
Karl Seguin 1d66b2fbc8 Merge pull request #3398 from lightpanda-io/link-ownership
chore: Move ownership of the Inbox from HttpClient to WebSocker Driver
2026-09-04 03:04:57 +08:00
Karl Seguin 8898d08045 null driver 2026-09-04 02:54:14 +08:00
Karl Seguin b0c8b034c0 Merge pull request #3394 from lightpanda-io/idb-request-conformance
indexeddb: WPT conformance
2026-09-04 02:32:03 +08:00
Karl Seguin cbff8e8ce3 Merge pull request #3389 from lightpanda-io/better-redirect
http: handle redirects better
2026-09-03 19:37:44 +08:00
Karl Seguin 87320a506d chore: Move ownership of the Inbox from HttpClient to WebSocker Driver
Currently, the HttpClient owns the inbox and its borrowed by the Link. This is
a bit backwards, but it also means that we can't eagerly create a Link: the
Link needs the inbox, so it needs the HttpClient, which is created by the
Browser (which creates an Isolate).

Remember, the Inbox is one of the few things shared between the main thread
and the worker, so either end can own it and the other can borrow it.

This switches the ownership so that the HttpClient now borrows the Inbox from
the Server's side of the Link (the WebSocket).

The main goal of this change is to prepare for more advanced HTTP WebDriver
flows. The more we can create _without_ a Browser, the fewer edge cases we have
to deal with (Browser because it's expensive and has to be created on the
Worker thread due to how V8::Isolate works).
2026-09-03 16:51:12 +08:00
Karl Seguin cb26e05533 Merge pull request #3383 from lightpanda-io/intersection-runaway-guard
stability: disconnect runaway intersection observers
2026-09-03 08:50:09 +08:00
Karl Seguin eb2eceb3d6 indexeddb: WPT conformance
Some low-hanging fruit from the IndexedDB tests. Added  IDBDatabase.close()
and IDBFactory.databases(). Map count to an f64 which can handle NaNs and such.
Plus some reordering so validation happens in the correct order.
2026-09-03 08:48:03 +08:00
Karl Seguin d2ea2396f5 Merge pull request #3392 from staylor/fix/heap-exhaustion-teardown-3319
Avoid rearming heap termination during teardown
2026-09-03 08:27:19 +08:00
Karl Seguin bb9f9b36e9 split IO reset and disconnect
Allows reset to be called without disconnect, which allows the runnaway check
to more efficiently do both.
2026-09-03 07:47:16 +08:00
Karl Seguin 2a977351d7 centralize teardown protection (covers every case this way) 2026-09-03 07:28:55 +08:00
Karl Seguin 658d350404 Merge pull request #3329 from lightpanda-io/better-server
Better server
2026-09-03 07:27:33 +08:00
Karl Seguin 37f31afec5 Merge pull request #3387 from lightpanda-io/idb-unique-cursor
indexeddb: support nextunique and prevunique cursor directions
2026-09-03 07:23:06 +08:00
Karl Seguin c189d72adf add safer shutdown 2026-09-03 07:11:26 +08:00
Karl Seguin 7f29bf6931 500 on write error and remove blocking writes 2026-09-03 06:47:53 +08:00
Karl Seguin 17c2aa7d1f Hardening
Give it one pass through some Claude fuzz testing. Add a max message size,
protect against weird interactions during a shutdown and we had some pending
accepts. Put a time limit on blocked writes.
2026-09-03 06:47:53 +08:00
Karl Seguin 116dab4c85 mac/bsd support (kqueue) 2026-09-03 06:47:53 +08:00
Karl Seguin e6241c1918 serve: Improve cdp/bidi server
Significant rework of the CDP/BiDi server. There are two main changes:

1 - poll replaced with EPoll/Kqueue (1)
2 - make http serving a first class citizen

The change from poll -> epoll/kqueue isn't performance driven, it's just about
tighter code. Both epoll and kqueue let you associate arbitrary data with a
socket, so we don't need to keep arrays in sync in order to associate a socket
with a CDP by index. They both provide some event/notification mechanism, which
is cleaner than the pipe required by poll.

The poll -> epoll/kqueue change could almost have been mechanical. Making HTTP
a first class citizen is the more significant of the two changes

In `main`, a new connection always spawns a thread and, until does its own
little read loop until the connection is upgraded. This is not efficient, it
uses up a connection slot, and it's inconsistent with the final WebSocket
connection which _is_ polled off the main loop. Using up a slot means that
keepalive isn't possible, else HTTP connections would quickly use up all
available slots/threads.

This commit parses and serves HTTP requests on the main thread (safe
because none of the processing is blocking). The approach is better streamlined
for HTTP requests which never upgrade (/metrics, WebDriver) without causing
any performance overhead for those that do. It simplifies some things (e.g. an
"http" socket or a "websocket" socket is monitored and read in a similar manner
(on the main loop)). It makes other things more complicated; the flow is no
longer accept -> spawn -> upgrade -> websocket loop. It's loop -> accept -> loop
-> process -> (http | ws).

This is built ontop of the BiDi branch because (a) WebDriver is what needs
better  HTTP support and (b) some of the more mechanical changes already exist
in that branch (e.g. src/cdp/, src/server.zig -> src/server/*)

(1) kqueue landing in 2 commits from now on this branch.
2026-09-03 06:47:49 +08:00
Pierre Tachoire 37a120cc77 event: keep keydown and worker error events alive past dispatch 2026-09-02 21:23:25 +02:00
Pierre Tachoire 3520065398 indexeddb: keep upgradeneeded event alive past dispatch 2026-09-02 21:13:06 +02:00
Scott Taylor 427960fd6c fix: avoid rearming heap termination during teardown
Assisted-By: devx/5efceed7-6cf0-4f8f-b1b4-5a1791ae8211
2026-09-02 09:23:11 -04:00
Karl Seguin 872fd7d5ff webapi: resource-timing
Adds resource timing, e.g. `performance.getEntriesByType("resource")`.

The `resource-timing` WPT category is currently at 4.6%, and this is a first
step at improving it. It also hopefully fixes https://github.com/lightpanda-io/browser/issues/3359

This is more complicated than I thought because there's a "Timing-Allow-Origin"
header that a server can include which hides some of the data if the request
doesn't come from the listed origin. And that, of course, interacts with
redirects.

(The DOMException change is seemingly random, but it came up in one of the WPT
cases I was looking at).
2026-09-02 20:39:51 +08:00