Use native Web API identity for ResizeObserver and IntersectionObserver targets and roots, accepting genuine cross-realm objects and registered native proxies while rejecting forged, inherited and author-Proxy values. Validate root membership during dictionary conversion, before later getters, and resolve native targets without reading public nodeType properties.
A 204-case regression matrix covers both observer interfaces and realms, native proxy acceptance, invalid targets, poisoned properties, option conversion order and original exception identity.
Expose the backing-object lookup from the existing native brand layer rather than unwrapping author Proxies in DOM callbacks. Extend its existing identity tests for cross-realm objects, forged objects, registered native Proxies, outer author Proxies and revocation.
Verify that explicitly empty request headers remain present while omitted Content-Type stays absent. Cover native HTTP transports and renderer Fetch/XHR requests, including bodyless, empty and non-empty uploads. No production transport behavior is changed.
Expose AudioProcessingEvent and OfflineAudioCompletionEvent as native Event subclasses with readonly branded payloads and WebIDL dictionary conversion. OfflineAudioContext emits a trusted completion event in its own realm, including when public constructors are replaced.
The regression matrix covers the main Window and same-origin child Window, subclassing, UTF-16 event types, malformed buffers, conversion order, callee-realm TypeErrors, dispatch identity and completion flags. This branch uses the AudioBuffer and OfflineAudioContext already on main.
IDBFactory.cmp preserves exceptions from key getters and reports invalid keys as DataError instead of rewriting both cases to TypeError. The generated receiver check continues to run before key conversion.
Schedule open/delete operations in the factory receiver’s realm after completing argument conversions in the callee realm. Borrowing an iframe method previously created a correctly branded request but scheduled its upgrade in the wrong context, leaving it pending.
Expand the factory regression fixture to exercise key conversion and request completion after removing the genuine factory prototype, using main Window, child Window and worker factories. Correct the ported cmp(undefined, key) expectation to DataError.
Keep redirect URL lookup available when the renderer follows HTTP hops itself. A transport request with follow_redirects=false must not reapply the automatic transport redirect limit to the renderer’s already-recorded URL chain; automatically followed requests retain their existing limit. CORS checks still run for every browser-managed hop.
The regression verifies manual lookup at the transport limit, rejection for automatic following at the same limit, and rejection when the manual hop lacks CORS permission.
Add an explicit UTF-16 DOMString converter for bindings that must preserve lone surrogates. Reuse the existing UTF-16 extraction helper and keep this change additive, without rerouting the existing DOMString converter.
Regressions cover code-unit preservation, scalar conversion, null-to-empty options, single string-hint coercion, exception identity and callee-realm TypeErrors. Existing DOMString and USVString behavior is also checked.
Add the WebIDL restricted float converter and f32 inference in generated argument and dictionary bindings. Round finite numbers to binary32, reject values that become nonfinite, and preserve exceptions from numeric conversion.
Regression coverage compares rounding with V8 Math.fround, including signed zero, subnormals and overflow, and checks implicit/explicit derived argument conversion, single coercion, exception identity and the callee TypeError realm. Extracted from the AudioBuffer commit without an audio runtime dependency.
Wait for the child document decoding result to arrive through its queued message task before reading the serialized parent document. Preserve the existing Shift_JIS content assertion and use the browser's bounded event-driven wait to remove the race between fetch completion and message delivery.
Preserve the trailing dot returned by the URL host parser when reading or assigning document.domain. Removing that dot incorrectly treats dotted and undotted hosts as the same origin-domain.
Keep the existing public-suffix and registrable-domain checks. Regressions cover literal, repeated, percent-encoded and IDNA dots, parent-domain relaxation, main documents, inherited or independently navigated frames, and navigated popups.
Validate Document appendChild and insertBefore before removal or adoption. Existing roots and doctypes remain in the validation sequence, including the detached bridge, so an invalid insertion fails without changing the tree.
Regressions cover main, iframe, windowless and parsed documents, root reinsertion, invalid fragments, allowed comments and processing instructions, and unchanged ranges, observer records and custom-element reactions. Initialize legacy fixtures with a valid HTML shell while preserving their feature assertions.
The validation order follows the DOM pre-insert algorithm: https://dom.spec.whatwg.org/#concept-node-ensure-pre-insertion-validity
Author properties can currently overwrite MutationObserver and IntersectionObserver identifiers or options, and invalid receivers can reach observer callbacks. Use the existing native receiver checks and V8 private slots for observer identity and configuration.
Freeze IntersectionObserver thresholds, return fresh chronological PerformanceObserverEntryList sequences, and correct observer method lengths. Regressions cover cross-realm genuine and forged receivers, conversion order, queue isolation, frozen thresholds, and independent result arrays. Update the local ported PerformanceObserver IDL fixture to its optional dictionary signature.
Keep duplicate IntersectionObserver thresholds after sorting, as required by the initialization algorithm: https://www.w3.org/TR/intersection-observer/#initialize-new-intersection-observer
An invalid receiver can reach Event callbacks, including a native initEvent path that can abort the process. Enable the existing WebIDL receiver checks on Event and the event interfaces already present on main, before callbacks and argument conversion.
Genuine events and inherited event interfaces remain usable across realms. The regression matrix rejects forged objects, author and revoked Proxies without evaluating conversion hooks or Proxy traps, and checks TypeError in the callee realm. Existing spoofing tests retain their real-object assertions and now require TypeError for invalid receivers.
Use the shared frontend admission and native terminal path for renderer
configuration. Keep Browser replay policy on its captured owner, record
admitted idle state, and project a fallback only if publication lost.
Verify mixed native replies precede later Inspector replay and that
isolate-entering configuration waits for the suspended owner to resume.
Migrate node queries, edits, focus, files, remote objects, DOMDebugger and
Autofill to renderer-owned terminals. Freeze document notifications and
object registry updates at the producer boundary, preserve object aliases,
and keep isolate-entering lookup chains on the owner turn.
Run native lookups and bounded continuations through the shared terminal
path. Publish stylesheet inventory notifications before ready responses,
and preserve exact owner routing in direct Page test fixtures.
Use the parsed fixture and stylesheet notification boundary to verify
Page and CSS commands preserve their independent isolate-entry requirements.
Share terminal authority with Inspector and publish ready native replies
after their renderer facts, independently of adapter polling. Keep typed
internal completions separate and settle caches against the exact residence.
Define exhaustive backend entry requirements for nested Main dispatch and
release Main and IO admission at backend entry. Bind native continuations
and preserve their owner lifecycle before terminal projection.
Migrate Page and DOMSnapshot through the generic operation boundary,
including live tree URLs, initial DocumentLoader identity, document capture
and isolated worlds. Cover cancellation, retirement and pause ordering,
and release held popup fixture routes before awaiting initialization.
Publish existing contexts, console messages and exceptions before the
Runtime.enable terminal for pages and workers. Check the enable boundary
without a compensating command, and retain deferred reply progress.
A joint traversal stores the initiating realm current entry only as an admission anchor. Resolve the stable joint step against the owning Window instead of rejecting an isolated-realm anchor against the default realm entry list. Preserve entry validation for traversals without a joint step.
ldm0