A newly committed native Document can execute before its commit output has
been projected into protocol state. Routing Fetch.enable through the
projected binding then updates a loaded predecessor or no Page at all,
allowing requests to bypass interception after a successful ACK.
Address restricted request-policy updates to the synchronously admitted
renderer Page and wait for native completion. Reuse this route for Fetch
cleanup and blocked URLs without granting general unbound Document access.
Hold actual native commit publications in the regression and inspect the
exact evaluation output fence. Cover new/replaced Pages with interception
enable/disable and blocked URLs, with no external I/O in negative controls.
The original controlled reproducer fails 3/3 on the rebase baseline.
Validation: fmt; workspace/all-targets/all-features Clippy; 23,026 Nextest
passed, 20 skipped; three targeted tests x20 and 30 module tests x5, all
without retries.
Honor closedby=none before dispatch and after cancel listeners. Match Chromium case handling and invalid-value defaults, keep script closure available, and cover dynamic policies and a disabled topmost modal.
Clear native modal state and the old Document registration when connected nodes are removed or adopted. Keep validated atomic moves in their original opening and priority, including the split DOMDebugger path. Cover light and shadow subtrees, adoption and background inertness.
Capture the Document, dialog and opening generation before cancel dispatch and verify them before closure. Removing open invalidates the request without clearing modal registration. Cover close/reopen, nonmodal reopen, raw attribute toggles, no-op operations and exact queued close-event counts.
Read and update transaction status directly in Rust. Keep request readiness
and cursor positions as an enum and Option<usize>, and access database
lifecycle state through typed operations.
Preserve traced request values in the V8 heap behind a closed field enum
so request/result cycles remain collectible. Remove string slot dispatch,
property shims, the unused blocked marker and duplicate database scope.
Use typed metadata as the only store name source. Remove retired metadata
slots, descriptor projection, swallowed writes and the mutable index marker;
classify cursor sources by their native wrapper kind.
Make queue scope types explicit, exercise StoreId in admission tests, and
centralize renderer metadata lookup by schema ID. Retain failed schema
handle attributes and immutable metadata needed for rollback.
Use the persisted StoreId and IndexId in SQL commands, transaction scopes and renderer handles. Reserve IDs without waiting for the SQL owner and recover their counters with committed disk metadata.
Remove name-based request targets, separate renderer identity tokens and cursor name refresh. Cover concurrent reservations, abort, idle reconnect, catalog recovery, restart, stale IDs and old-name reuse.
Expose native name accessors and queue the existing SQL rename commands with schema validation. Keep stable schema identities across metadata edits and rollback, and capture cursor source names at operation admission. Preserve names on finished handles.
Sweep link candidates by full target and reject impossible containment using polygon bounds. Keep the original clipped regions when optional deduplication exhausts its work budget. Cover dense HTML printing, PDF annotations, partial-work fallback, and target identity.
Keep the Window fixture alive through the negative cases and assert the exact credentials error. Exercise real Worker fetch forwarding for native Request variants, including POST bodies, and reject converted URLs before networking.
Replace the preparation error enum with anyhow::Result. Preserve context error messages, direct URL/WebIDL error propagation, and the existing Promise rejection path.
Extracted from development commit b0e803695e.
Adapted to the target branch APIs. Validated with cargo fmt --all, full workspace Clippy (-D warnings), and cargo nextest run --no-fail-fast before committing.
Keep captured policy origins ahead of native-origin and Document URL
fallbacks without cloning and mutating a shared parsed policy for each
check. Reuse the same connect check entry point for the top Document.
Cover fallback priority, per-check isolation, and report attribution and
relative endpoint resolution for both policy dispositions.
Resolve iframe creators through owner_dispatch_scope_for_node for initial
policy inheritance, CSP parent lookup, and inherited secure-context checks.
Preserve the existing initial-policy fallback during auxiliary-page
handoff and popup retirement, when dispatch mappings can be unavailable.
Pass DocumentPolicyContainer directly into connect CSP checks.
Preserve the first accepted header spelling through Header mutations, Request copies and network serialization while keeping public iteration lowercase and case-insensitive lookup. Include twelve real HTTP request cases in both Window and Worker.
Extracted from development commit 55e94176e33e801bb4ca96fe805c3771d153d577.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 147.813s] 22171 tests run: 22171 passed (9 slow), 20 skipped
Extracted from development commit 7f7d222c41.
Adapted to the target branch APIs. Validated with cargo fmt --all, full workspace Clippy (-D warnings), and cargo nextest run --no-fail-fast before committing.
Resolve the creator from the iframe element's owning Document and read that
Document's committed native origin. This includes popup roots and inherited
about documents, rather than falling back to the host page URL. Use the same
creator origin for initial-empty initialization and navigation commit inputs.
Initial empty policy containers also inherit from the owning popup, rather
than the host page. Window.open takes creator policy from its already selected
opener Window, keeping policy and native origin inheritance aligned.
Capture real TLS WebSocket handshake headers from cross-origin popup child
frames for both constructors, initial about:blank and committed srcdoc,
direct and nested frames, and sandboxed srcdoc with Origin: null. Contrast
host connect-src none with popup connect-src self to protect policy inheritance.
Resolve relative report-uri endpoints against the full response URL at policy
delivery, and retain them with the policy across popup and srcdoc inheritance.
Keep the actual Document URL in connect checks and supply native origin only
as a self-matching fallback for unbound local policies.
Reuse the existing owner policy snapshot for child and popup checks. Capture
actual report POST paths for both WebSocket constructors, cover policy clones
and report-only disposition, and preserve local popup meta CSP matching.
Capture response policy self-origins at delivery and use them independently
of the protected document URL for source-list checks. Inherited policies
retain this identity when sandboxing makes the request origin opaque.
Use effective inherited connect policies for child documents and resolve
their popup owner before falling back to the host document. Cover real TLS
handshakes with Origin: null, base changes, popup ownership, and blocked
foreign targets with CSP violation events and no network request.
Follow inherited child documents through their actual frame parents and
stop at a lightweight popup's saved native security state. This prevents
the unrelated host page from disabling or adding mixed-content checks.
Cover both trust directions, about:blank and srcdoc documents, and nested
frames using WebSocket constructors executed in the inner frame itself.
Keep live URL resolution separate from native document attribution, origin,
cookie context and mixed-content state for Window WebSocket constructors.
Preserve inherited popup CSP self matching and share the existing API-base
selector with Service Worker registration lookups.
Cover real WSS handshake Origin and SameSite cookies, popup mixed-content
checks and relative URL resolution after argument conversion.
Resolve getRegistration URLs using the receiver Window's current API base URL and validate them against its native origin. Reuse the source branch's shared registration URL helpers; retain the dynamic-base, borrowed-method, inherited iframe, popup and srcdoc regression coverage.
Source-commit: bfee69b3f1
ldm0
BibekPathak
lanyue-llk