A newly committed native Document can execute before its commit output has
been projected into protocol state. Routing Fetch.enable through the
projected binding then updates a loaded predecessor or no Page at all,
allowing requests to bypass interception after a successful ACK.
Address restricted request-policy updates to the synchronously admitted
renderer Page and wait for native completion. Reuse this route for Fetch
cleanup and blocked URLs without granting general unbound Document access.
Hold actual native commit publications in the regression and inspect the
exact evaluation output fence. Cover new/replaced Pages with interception
enable/disable and blocked URLs, with no external I/O in negative controls.
The original controlled reproducer fails 3/3 on the rebase baseline.
Validation: fmt; workspace/all-targets/all-features Clippy; 23,026 Nextest
passed, 20 skipped; three targeted tests x20 and 30 module tests x5, all
without retries.
Sweep link candidates by full target and reject impossible containment using polygon bounds. Keep the original clipped regions when optional deduplication exhausts its work budget. Cover dense HTML printing, PDF annotations, partial-work fallback, and target identity.
Preserve the first accepted header spelling through Header mutations, Request copies and network serialization while keeping public iteration lowercase and case-insensitive lookup. Include twelve real HTTP request cases in both Window and Worker.
Extracted from development commit 55e94176e33e801bb4ca96fe805c3771d153d577.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 147.813s] 22171 tests run: 22171 passed (9 slow), 20 skipped
Resolve relative report-uri endpoints against the full response URL at policy
delivery, and retain them with the policy across popup and srcdoc inheritance.
Keep the actual Document URL in connect checks and supply native origin only
as a self-matching fallback for unbound local policies.
Reuse the existing owner policy snapshot for child and popup checks. Capture
actual report POST paths for both WebSocket constructors, cover policy clones
and report-only disposition, and preserve local popup meta CSP matching.
Capture response policy self-origins at delivery and use them independently
of the protected document URL for source-list checks. Inherited policies
retain this identity when sandboxing makes the request origin opaque.
Use effective inherited connect policies for child documents and resolve
their popup owner before falling back to the host document. Cover real TLS
handshakes with Origin: null, base changes, popup ownership, and blocked
foreign targets with CSP violation events and no network request.
Keep live URL resolution separate from native document attribution, origin,
cookie context and mixed-content state for Window WebSocket constructors.
Preserve inherited popup CSP self matching and share the existing API-base
selector with Service Worker registration lookups.
Cover real WSS handshake Origin and SameSite cookies, popup mixed-content
checks and relative URL resolution after argument conversion.
Apply negotiated per-type policies through Page-owned one-shot dialog completion, including Classic-attached BiDi sessions. Publish required auxiliary Page predecessors only at a modal wait, keep normal popup completion ordering, and resolve dialogs against their captured Page owner.
Capture the owning child Document's import-map integrity before external parser module roots enter queued script work. Preserve explicit attribute precedence and reject retired owners. Retain the source native-store regression and its real iframe hash, parent/child map isolation and attribute-precedence cases.
Source-commit: ef72d8f2d2
Validate the select target and complete value set before mutation, derive multiplicity from the live element, and emit change events only when selected options change. Define submit as requestSubmit-style submission, preserving validation and explicit submitter overrides while reusing the keyboard path for Enter.
Require explicit task kinds and reject input from read-only tasks. Collect each input outcome in the host and settle retained effects independently of the task result. Report ordinary pending navigations and cover multiple effects, task errors, and screenshots.
Add opt-in ace-protocol support with AcePageTask and PageExtensionHost
for renderer-owner-thread inspection, native input, and screenshots.
Expose BrowserRuntimeHandle through a runtime-ready callback so embedders
can discover targets and submit tasks without CDP request/response envelopes.
Reuse supervised page workflows for output ordering, input effects, and
target/document lifetime checks. Recover lost waiters without replaying
admitted tasks, and revoke runtime access on browser shutdown.
Runtime ownership and local-owner scheduling repeat optional deadline selection. Share the pure helper, keeping minimum selection and the existing one-sided/absent deadline behavior.
Page transport payloads and renderer output records repeat conservative header memory accounting. Reuse the page-types implementation for byte and string header values while retaining tuple overhead, doubled payload charges and saturating arithmetic.
Renderer stylesheet snapshots and CDP stylesheet headers repeat text end-position calculation. Put it in the existing shared CSS utility crate and use it from both paths, preserving the current line, character and empty-input behavior.
Require a single graph payload and derive network attribution when consuming
it, including retired-owner output. Remove the graph-less fallback, per-result
attribution copies and logging-only installation counts.
Combine import installation with its accepted-root refresh, keeping partial
graphs eligible to contribute CSS. Strengthen stale-owner coverage to retain
every physical network result without affecting the replacement Document.
Retain the original root resource URL alongside the response parser base when
installing live import graphs, so a redirected link cannot import its root
response again through the original URL.
Capture the exact child Document's CSP for parser stylesheet graphs. Check
network and data imports before loading, apply policy to redirect targets, and
validate cached or Service Worker redirect chains for the current consumer.
Queue violations through the existing exact-Document Page task path and target
the child Document. Refused imports still settle parser and load blockers.
Use inherited native origins for local Documents' CSP self checks, independently
of their live base URL. Cover redirected cycles, linked and inline import graphs,
enforced/meta/report-only policies, redirect targets, data imports and srcdoc.
A form task can record a renderer-local javascript URL while its owner
handoff or lifecycle turn is still queued. Idle admission considered typed
sources and due timers, letting requestIdleCallback run before the URL's
Trusted Types check. A CSP collector could then finish its connect-src
barrier before the navigation violation was queued.
Count that pending URL as runnable work when admitting unexpired idle
callbacks. Keep ordinary timers and expired idle callbacks eligible.
Cover observable policy, script, and idle ordering in the real owner loop
with standalone and browser-delegated navigation dispatch. The new test
fails on the old implementation with idle, policy, javascript ordering.
A VM created while dialog waiting was enabled cached that value locally. The
cached true value survived disabling or detaching the final Page observer,
so later dialogs could still wait after the shared context flag was false.
Read the BrowserContext shared switch for every dialog. Remove the VM-local
Boolean, its constructor snapshot, the ScriptVm/JsContextHost setters, and the
obsolete Page setter and renderer command. Page domain commands now rely on
the existing shared subscription aggregation.
Cover enabled-at-construction VMs and interleaved disable/detach across two
Pages and different sessions. Verify that confirm returns without a modal wait
while a native handler remains available to handle the prompt. Keep standalone
headless dialog fallback coverage through the shared switch.
A newer navigation can cancel a replacement response while its Document is
already installed and still completing its requested lifecycle stage.
Detach that observer and continue on the existing Page, preserving its
navigation reply policy and original close owner.
Cover cancellation after the native Document is installed but before
protocol adoption, followed by beforeunload for the successor navigation.
Check ordinary ready timers before admitting an unexpired idle callback. An earlier idle transport deadline must not overtake later ready work in the same heap, including queued popup javascript navigation.
Keep expired idle callbacks runnable. Cover the real owner loop with an HTTP completion witness and six function, source, child-window, expired, cancelled, and future timer scenarios.
Keep the native Document and per-Page isolate live while deferring the main Window Context, V8 Inspector and wrapper templates. Activate through existing script and automation boundaries, preserve native lifecycle and history state, and provide an explicit eager initialization flag.
Reuse the exact-source-Document pending-navigation reconciliation for post-parse waits as well as Page creation. Consecutive form navigation can replace a Document before Load without retiring the Page as failed. Detachment and unrelated supersession still interrupt the wait; the existing observer tests preserve those boundaries.
ldm0
lanyue-llk
guojinghua