Transfer owned font payloads into shared blobs, register new faces in the live collection, and preserve slot ordering for segmented font selection. Keep invalid-font rejection and replacement/removal isolation covered by regression tests, with an opt-in release benchmark.
Retain the exact open request until normal transaction request draining and checkpoint deactivation complete. Publish open success or error in a separate task, handle aborted/closed provisional connections, and preserve FIFO among waiting open/delete requests.
Remove eager upgrade-completion and duplicate blocked-request dispatch paths. Update selected-task boundary regressions and add Chromium-calibrated CDP coverage for migration, microtasks, rollback, deletion order and SVG-gated application startup.
Keep frame ownership independent of mutable document bases, share the Request and XHR API base lookup, and validate referrers against the Window origin.
Cover live base changes in initial about:blank, srcdoc, and HTTP iframes from both parent and child realms.
Use native Web API identity for ResizeObserver and IntersectionObserver targets and roots, accepting genuine cross-realm objects and registered native proxies while rejecting forged, inherited and author-Proxy values. Validate root membership during dictionary conversion, before later getters, and resolve native targets without reading public nodeType properties.
A 204-case regression matrix covers both observer interfaces and realms, native proxy acceptance, invalid targets, poisoned properties, option conversion order and original exception identity.
Expose the backing-object lookup from the existing native brand layer rather than unwrapping author Proxies in DOM callbacks. Extend its existing identity tests for cross-realm objects, forged objects, registered native Proxies, outer author Proxies and revocation.
Verify that explicitly empty request headers remain present while omitted Content-Type stays absent. Cover native HTTP transports and renderer Fetch/XHR requests, including bodyless, empty and non-empty uploads. No production transport behavior is changed.
Expose AudioProcessingEvent and OfflineAudioCompletionEvent as native Event subclasses with readonly branded payloads and WebIDL dictionary conversion. OfflineAudioContext emits a trusted completion event in its own realm, including when public constructors are replaced.
The regression matrix covers the main Window and same-origin child Window, subclassing, UTF-16 event types, malformed buffers, conversion order, callee-realm TypeErrors, dispatch identity and completion flags. This branch uses the AudioBuffer and OfflineAudioContext already on main.
IDBFactory.cmp preserves exceptions from key getters and reports invalid keys as DataError instead of rewriting both cases to TypeError. The generated receiver check continues to run before key conversion.
Schedule open/delete operations in the factory receiver’s realm after completing argument conversions in the callee realm. Borrowing an iframe method previously created a correctly branded request but scheduled its upgrade in the wrong context, leaving it pending.
Expand the factory regression fixture to exercise key conversion and request completion after removing the genuine factory prototype, using main Window, child Window and worker factories. Correct the ported cmp(undefined, key) expectation to DataError.
Keep redirect URL lookup available when the renderer follows HTTP hops itself. A transport request with follow_redirects=false must not reapply the automatic transport redirect limit to the renderer’s already-recorded URL chain; automatically followed requests retain their existing limit. CORS checks still run for every browser-managed hop.
The regression verifies manual lookup at the transport limit, rejection for automatic following at the same limit, and rejection when the manual hop lacks CORS permission.
Add an explicit UTF-16 DOMString converter for bindings that must preserve lone surrogates. Reuse the existing UTF-16 extraction helper and keep this change additive, without rerouting the existing DOMString converter.
Regressions cover code-unit preservation, scalar conversion, null-to-empty options, single string-hint coercion, exception identity and callee-realm TypeErrors. Existing DOMString and USVString behavior is also checked.
Add the WebIDL restricted float converter and f32 inference in generated argument and dictionary bindings. Round finite numbers to binary32, reject values that become nonfinite, and preserve exceptions from numeric conversion.
Regression coverage compares rounding with V8 Math.fround, including signed zero, subnormals and overflow, and checks implicit/explicit derived argument conversion, single coercion, exception identity and the callee TypeError realm. Extracted from the AudioBuffer commit without an audio runtime dependency.
ldm0