Retain response type and timing authorization through Response materialization, clone, SW settlement, and direct Worker Fetch completion. Report delivered body bytes without a client network transfer, preserve forwarded CORS restrictions, and avoid re-filtering synthetic Default responses by their request URL.
Reject integrity-failed parser stylesheet responses in child Documents before preparing or installing an owner CSSStyleSheet. Complete the failed load and release its blocker through the existing terminal path.
Add eight end-to-end URL iframe/srcdoc cases covering initial and cached integrity rejection, matching hashes, CSSOM and computed style, dependent import suppression, and parser/DCL/iframe-load progress.
The regression reproduced the empty-sheet bug at the previous PR head. Validation at 32 build jobs, test threads and Tokio workers: cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 146.212s] 22163 tests run: 22163 passed (9 slow), 20 skipped
Support type: text through the shared module map, Window, child Documents and workers. Export UTF-8 decoded strings without executing their contents, preserve typed-module identity, and carry text request metadata through network, preload and Service Worker loaders. Regressions cover static/dynamic import sharing, BOM and invalid UTF-8, CORS, integrity, worker environments and unsupported-type rejection.
Extracted from development commit a6de018613.
Base: main (62e527cd34).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 146.817s] 22203 tests run: 22203 passed (9 slow), 20 skipped
Read effective policies from native Document delivery state and preserve them in Fetch and both XHR transport paths. Remove obsolete subtree rescanning and response-only owner lookups.
Validation (32 build jobs / test threads, zero retries):
- `cargo fmt --all`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo nextest run --no-fail-fast`: Summary [ 141.923s] 21998 tests run: 21998 passed (9 slow), 19 skipped
Generate Origin independently of browser destination metadata, and attach script
metadata at classic, module, and preload request builders. Share redirect URL-list
rules across request generation and response validation, and remove final-only
CORS validation from manifests, stylesheets, and request interception.
Reject failed CORS checks even without supported integrity metadata. Preserve CSP
reporting before dynamic script fetches and use committed Window origins for
srcdoc and sandboxed child script/module requests.
Add wire-level Origin, Cookie, and Fetch Metadata regressions, plus manifest,
stylesheet CSSOM, CSP, and child module/preload coverage.
Keep redirect history in Request so Service Worker handoffs, network
redirects, preflights, Origin serialization, cookies, and TLS credentials
share the same state. Avoid reusing another request's response URL list
from the renderer memory cache.
Validate and filter network responses using their full history while
preserving readable Service Worker response filters across streaming and
buffered delivery. Returning to the initiating origin keeps network CORS
tainting; worker-produced responses retain their own filtering.
Add wire-header, credentials, cache, and worker response regressions, and
correct the local Fetch/XHR redirect fixtures to authorize and expose CORS
responses after a cross-origin round trip.
Distinguish network, service worker, and browser-internal redirects so synthetic responses are not subjected to network CORS checks. Preserve every hop for redirect taint and Origin validation, including across navigation response conversions.
Add seven cross-origin service worker script scenarios and guard CORS checks for cached network redirects without ExtraInfo. The new integration regression fails before the fix and passes afterward.
Validated with cargo fmt --all, workspace Clippy across all targets and features with warnings denied, and cargo nextest run --no-fail-fast: 17459 passed, 13 skipped. Used one build job for the full test run after a parallel-build rustc process was killed.
Preserve response filtering through script and service worker loading, validate CORS authorization across redirects, and reject opaque responses before computing supported integrity digests. Keep empty and unsupported metadata behavior unchanged.
Add parser, dynamic script, module, and service worker regressions covering 39 scenarios. Validated with cargo fmt --all, full workspace Clippy, and cargo nextest run --no-fail-fast (17457 passed, 13 skipped).
ldm0