Retain response type and timing authorization through Response materialization, clone, SW settlement, and direct Worker Fetch completion. Report delivered body bytes without a client network transfer, preserve forwarded CORS restrictions, and avoid re-filtering synthetic Default responses by their request URL.
Run the existing child input-stream readiness regression after the initial load callback has returned. This exercises a fully loaded Document rather than an in-load document.open operation that resumes the current load.
Source-commit: 36456eeea3
Extend redirect-sibling coverage to main documents, shared intermediate
sheets and a policy delivered between the alias and direct requests.
Verify complete independent CSSOM paths, cycle termination, cascade and
request counts with the existing collector implementation.
Exercise linked and inline child stylesheet graphs in both sibling source
orders. Verify independent CSSOM children, owner links, final cascade, and
separate no-store responses with request-driven synchronization.
Allow an alias redirect under a CSP path allowlist while rejecting the direct
sibling request to its destination. Assert its violation and empty imported
sheet so response aliasing cannot bypass request-specific admission.
Use the stylesheet owner's Document policy for the shared inline check and run
it when child parser style contents are complete. Reject blocked owners before
registering import work or acquiring a load-delay token, keeping rejected CSS
out of both CSSOM and the cascade.
Queue child violations through the existing exact Window task target instead
of executing author code during parser admission. Reuse the same owner-aware
policy path for declarative CSS modules.
Cover missing, incorrect and accepted nonces, meta policy, report-only policy,
plain styles, child event attribution, and parser/frame-load completion.
Prepare linked and inline requests at parser admission, then read the current
delivered Document policy for each newly discovered import. Each request keeps
its own policy through redirects, so later meta policies constrain new imports
without retroactively rejecting requests that were already admitted.
Reuse the existing meta policy registry and import collector. Register the
request and final URL of every completed sheet before expanding its imports,
and skip graph installation and repeated CSSOM refresh for links without
imports.
Cover dynamic and parser-delivered meta policies, same- and cross-origin
roots, inline imports, blocked data imports, and nested redirect cycles.
Retain the original root resource URL alongside the response parser base when
installing live import graphs, so a redirected link cannot import its root
response again through the original URL.
Capture the exact child Document's CSP for parser stylesheet graphs. Check
network and data imports before loading, apply policy to redirect targets, and
validate cached or Service Worker redirect chains for the current consumer.
Queue violations through the existing exact-Document Page task path and target
the child Document. Refused imports still settle parser and load blockers.
Use inherited native origins for local Documents' CSP self checks, independently
of their live base URL. Cover redirected cycles, linked and inline import graphs,
enforced/meta/report-only policies, redirect targets, data imports and srcdoc.
Reject integrity-failed parser stylesheet responses in child Documents before preparing or installing an owner CSSStyleSheet. Complete the failed load and release its blocker through the existing terminal path.
Add eight end-to-end URL iframe/srcdoc cases covering initial and cached integrity rejection, matching hashes, CSSOM and computed style, dependent import suppression, and parser/DCL/iframe-load progress.
The regression reproduced the empty-sheet bug at the previous PR head. Validation at 32 build jobs, test threads and Tokio workers: cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 146.212s] 22163 tests run: 22163 passed (9 slow), 20 skipped
Support type: text through the shared module map, Window, child Documents and workers. Export UTF-8 decoded strings without executing their contents, preserve typed-module identity, and carry text request metadata through network, preload and Service Worker loaders. Regressions cover static/dynamic import sharing, BOM and invalid UTF-8, CORS, integrity, worker environments and unsupported-type rejection.
Extracted from development commit a6de018613.
Base: main (62e527cd34).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 146.817s] 22203 tests run: 22203 passed (9 slow), 20 skipped
Read effective policies from native Document delivery state and preserve them in Fetch and both XHR transport paths. Remove obsolete subtree rescanning and response-only owner lookups.
Validation (32 build jobs / test threads, zero retries):
- `cargo fmt --all`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo nextest run --no-fail-fast`: Summary [ 141.923s] 21998 tests run: 21998 passed (9 slow), 19 skipped
Async scripts still fetching at parser EOF previously entered a queue
behind DOMContentLoaded, allowing a slow defer script to block a ready
async script or its error event. Transfer remaining async work to the
exact Document runtime producer and publish each task when its source
completes, retaining its load-delay lease.
Preserve observed async completion order across parser handoff. Add gated
success, failure, and out-of-order completion tests, and update the WPT
ledger for execution-timing/085.html.
Validation:
- cargo fmt --all
- cargo clippy --workspace --all-targets --all-features -- -D warnings
- cargo nextest run --no-fail-fast: 17,879 passed, 13 skipped
- 270 WPT cases: 257 to 258 passes, no case or subtest regressions
Generate Origin independently of browser destination metadata, and attach script
metadata at classic, module, and preload request builders. Share redirect URL-list
rules across request generation and response validation, and remove final-only
CORS validation from manifests, stylesheets, and request interception.
Reject failed CORS checks even without supported integrity metadata. Preserve CSP
reporting before dynamic script fetches and use committed Window origins for
srcdoc and sandboxed child script/module requests.
Add wire-level Origin, Cookie, and Fetch Metadata regressions, plus manifest,
stylesheet CSSOM, CSP, and child module/preload coverage.
Keep redirect history in Request so Service Worker handoffs, network
redirects, preflights, Origin serialization, cookies, and TLS credentials
share the same state. Avoid reusing another request's response URL list
from the renderer memory cache.
Validate and filter network responses using their full history while
preserving readable Service Worker response filters across streaming and
buffered delivery. Returning to the initiating origin keeps network CORS
tainting; worker-produced responses retain their own filtering.
Add wire-header, credentials, cache, and worker response regressions, and
correct the local Fetch/XHR redirect fixtures to authorize and expose CORS
responses after a cross-origin round trip.
Distinguish network, service worker, and browser-internal redirects so synthetic responses are not subjected to network CORS checks. Preserve every hop for redirect taint and Origin validation, including across navigation response conversions.
Add seven cross-origin service worker script scenarios and guard CORS checks for cached network redirects without ExtraInfo. The new integration regression fails before the fix and passes afterward.
Validated with cargo fmt --all, workspace Clippy across all targets and features with warnings denied, and cargo nextest run --no-fail-fast: 17459 passed, 13 skipped. Used one build job for the full test run after a parallel-build rustc process was killed.
Preserve response filtering through script and service worker loading, validate CORS authorization across redirects, and reject opaque responses before computing supported integrity digests. Keep empty and unsupported metadata behavior unchanged.
Add parser, dynamic script, module, and service worker regressions covering 39 scenarios. Validated with cargo fmt --all, full workspace Clippy, and cargo nextest run --no-fail-fast (17457 passed, 13 skipped).
Extract an independently mergeable topic from wpt-misc-fix at
a70a96f9d1.
Register the child text content regression module without including later script test modules.
Include the XML document fixture route used by the CDATA regression so this branch does not depend on the separate XML input-stream changes.
Source commits:
- 7f587e1251
- ae3a3f1096
Validation:
- cargo fmt --all
- cargo clippy --workspace --all-targets --all-features -- -D warnings
- cargo nextest run --no-fail-fast
ldm0