Fix MOL-554 by keeping renderer output fences for different Pages as
independent predecessors of the existing protocol output work item.
Preserve command correlation when publishing cleanup and detach events
after every original renderer prefix has crossed protocol ingress.
Cover continued and outstanding Fetch requests across two Pages, and prove
that projecting one Page's cursor cannot release another Page's output.
Validation: cargo fmt --all; workspace all-target/all-feature Clippy;
Nextest 21,987 passed, 19 skipped; Playwright reproduction passes 3/3.
Filter author-provided headers in Window and Worker fetch inputs for both
URL and Request override paths, using the guard selected by request mode.
Keep trusted extra HTTP headers separate from this filtering.
Add network coverage for header handling across fetch modes and input
forms, including Window/Worker behavior and trusted-header compatibility.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Apply a shared guard before HTTP and WebSocket routing across CDP,
WebDriver Classic and BiDi. Accept any IP literal, or localhost and its
subdomains (including a trailing root dot). Treat an empty port as
unspecified.
Allow requests without Origin, from the bound server's HTTP origin, or
from explicitly allowlisted origins. Support repeated and comma-separated
--remote-allow-origins values and the '*' wildcard. Reject ambiguous
headers and keep Host validation independent of Origin exceptions.
Cover the HTTP routers, CDP and BiDi WebSocket handshakes, and WebDriver
text/plain session creation, including same-origin compatibility.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Generate a fresh browser WebSocket UUID per server and random 128-bit page
and tab target IDs for network CDP owners. Keep discovery URLs and protocol
target IDs consistent, and make clients discover endpoints instead of
relying on fixed paths.
Cover endpoint rotation, guessed and foreign ID rejection, and target
lifecycle behavior.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Extend the opener-only popup completion regression to CSS synthetic modules alongside the existing JavaScript graphs and JSON. Exercise both initial about:blank and committed popup Documents without attaching a frontend to the auxiliary target, verify CSSStyleSheet identity and its rule, and assert both CSS requests reach the fixture. Preserve main's rejection of unsupported text module types.
Extracted from development commit 54189266c08bd7f23eb750d8b4a4f43566b0f2ae.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 146.470s] 22169 tests run: 22169 passed (9 slow), 20 skipped
Record and preserve cookie creation time across updates, browser imports and cache persistence. Apply modern Lax-by-default request inclusion, including the age-bounded unsafe top-level navigation allowance; keep explicit Lax and Strict semantics, raw cookie visibility and diagnostic exclusion reasons. Cover age boundaries, updates, imports, persistence and navigation contexts.
Start the held Fetch from interactive readystatechange so the fixture establishes its intended defer-wait boundary. A speculative script request is not an EOF signal. Retain both normal/crashed modes and every history, adoption and result assertion without changing timeouts or retry policy.
Validation (32 build jobs / test threads, zero retries):
- `cargo fmt --all`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo nextest run --no-fail-fast`: Summary [ 140.487s] 22001 tests run: 22001 passed (9 slow), 19 skipped
Page.enable must acknowledge a native Document that is already running while protocol Page adoption waits for resources. Reuse the prepared-document lifecycle state instead of starting another lazy initial navigation, which can revoke the existing work and deadlock behind Fetch interception. The regression holds a script response, enables Page before adoption, verifies the original paused Fetch remains valid, and checks the final URL for both normal and crashed targets.
Use Page residence and the stable Document token to deduplicate native
history registration and Page adoption. Keep lifecycle epochs in native
execution and cancellation identities. Adopt a restarted epoch's reply
title instead of retaining a title published by its predecessor epoch.
Cover asynchronous document.open/write/close before DCL on reused and
crash-recovery Pages, checking history length/index and replacement
content/title without requiring unchanged entry ids.
Dispatch late Fetch configuration and blocked URLs to the exact running native
Document before Page adoption. Apply admitted title facts to the published
history entry before later pushState operations can create another entry. The adoption path
retains the reply's exact Document identity even before native commit projection,
so journal and reply arrival order cannot register the same history entry twice.
Retire failed debugger-paused Worker targets and sessions when their prepared
owner is superseded, even after native destruction has already been deferred.
A new native commit also ends that deferral; stale Page destruction cannot
start it again. Reuse the existing retirement and session disposal paths.
Cover reused and crash-recovery Pages with four WebSocket regressions. Hold
response headers to enforce policy/title phases and require Worker retirement
before the replacement Document can commit.
Carry matching completion data in each Fetch operation instead of storing a
parallel dispatch kind. Restrict navigation termination to document work and
require native completion results directly, removing impossible fallbacks.
Move one owned workflow payload through execution, cancellation and recovery.
Derive renderer commit observation from its captured native Document.
Wait for the recovered session/frame/loader load in the cancellation integration
test before querying the new realm; a navigation ACK can precede Page adoption.
Capture weak command capabilities for the exact native Document behind early
Fetch pauses. Use them for request, response, authentication and cleanup work,
and restore pause records when dispatch is rejected.
Carry publication Page sources through owner-action projection. Register and
attach workers during handoff, revoke abandoned Page workers, and preserve
source identity for dialogs, choosers, popups and script navigation.
Record native navigation history once, retain observed URLs and titles at
adoption, and publish error-Document failure before its frozen frame commit.
Add controlled WebSocket regressions for handoff, cancellation and recovery.
Run CDP, BiDi, Classic and test workflows through finite synchronous state
access and revocable weak handles. Remove the mailbox, Inline driver,
exclusive completion branches and unused Fetch/Runtime connection APIs.
Keep original document, attachment and call identities through owned waits.
Preserve terminal responses for retired documents, settle empty renderer
boundaries and retain Fetch request announcements until terminal delivery.
Keep body/resource I/O outside shared state and preserve typed error causes.
Validation: cargo fmt --all; full workspace/all-targets/all-features Clippy;
21,456 Nextest tests (19 existing skips); five ownership doctests; same-source
CLI with Playwright, Puppeteer and CDP/BiDi/Classic workflow checks;
1,024 complete navigations; 128 cancelled waits and 4,096 peer commands.
Admit finite commands synchronously and route every asynchronous automation
command through the existing controller. Remove the server's duplicated
owned-command selector and exclusive-connection fallback. Restrict the old
automation and Runtime/Page inline entry points to the test harness.
Prepare desired preload registries before waiting and retain each original
host and Document for ordered Native updates. Reuse target preload/channel
execution and completion-owned recovery without adding task registries.
Pass actual ingress receivers into BiDi realm, layout and frame inventories.
Keep their accepted output prefixes in the original command's event sources;
perform context and target descriptor inventories synchronously.
Preserve original pending navigation replies from admission queries and realm
replay before projecting subscription events. Give the header-only network
baseline fixture its own URL so late baseline events cannot select the
collector request. Keep the original body and success assertions.
Validation: cargo fmt --all; default CLI Clippy; workspace all-targets
all-features Clippy with -D warnings; cargo nextest run --no-fail-fast
(21,413 passed, 19 existing skips); five protocol doctests.
Route navigation, reload and history traversal through the shared automation
owner and Page workflows. Retain the original typed result, navigation
identity and source response across auth handoff and lost ready results.
Reuse the Page completion body for exclusive compatibility and preserve
private task replies across independent renderer output boundaries. Remove
the duplicated protocol-neutral navigation dispatcher and completion loop.
Validate Direct state without a mailbox through the actual renderer
transport, accepted ready-result recovery and Inline compatibility.
Validation: root fmt, workspace Clippy, Nextest (21,393 passed, 19
existing skips), five borrow-boundary doctests, and source-matched
CDP/BiDi/Classic, Playwright, Puppeteer and navigation smoke checks.
Route DOM commands and Page frame inventories, layout metrics and screenshots
through the existing supervised automation workflow. Freeze the original
Page scope for child-frame queries and object registration, preserve typed
errors and exact Native cursors, and remove connection-borrowing dispatch
loops and query helpers. Independent Page inventories keep separate streams.
Exercise direct state access without a mailbox, child-frame projection and
unknown-node errors, recreated hosts with reused literal ids, and distinct
Native frame inventories. Existing DOM fixtures consume complete output
ownership while preserving their semantic assertions.
Run target creation, activation, closing and browser-context removal through
the existing automation workflow controller. Creation owns its admitted blank
document build and preload channel setup; activation reuses the finite surface
and visibility flow. Close and removal reuse the original Target retirement,
disposal, output and recovery owners through the common protocol adapter.
Keep creation and activation completion-owned after their finite admission so
waiter cancellation cannot abandon the original browser transition. Freeze
the actual target host for output projection and creation publication; retain
initial realm/listener and best-effort activation behavior. Delete the old
async automation wrappers and the resulting unused connection helpers.
Validation: root fmt, full workspace Clippy and unfiltered Nextest with default
parallelism; protocol doctests; source-built CLI CDP/Playwright/Puppeteer/BiDi
checks including user-context removal while an author promise is held. Direct
state regressions cover all four lifecycle commands, cancellation before the
first poll and discarded ready creation results.
Route six Input and seven Fetch automation commands through the shared owned
workflow controller. Reuse the existing finite domain admission, native waits,
recovery contexts and typed result owner; remove the old async wrapper loops.
Freeze the original page host for input settlement, downloads, file choosers
and output projection. Keep typed admission causes and canonical document
errors until the protocol boundary. Preserve Fetch metadata before its
independent navigation output boundary and consume only the internal reply.
Supervise Fetch handler revocation during the owned wait and before adopting
a queued ready receipt. Explicit revocation and owner teardown wake weak
lifetime observers without extending the original owner lifetime.
Validation: root fmt, full workspace Clippy and unfiltered Nextest with the
default parallelism; protocol doctests; source-built CLI with CDP, Playwright,
Puppeteer and BiDi, including real keyboard input and request/response-stage
interception with independent progress while blocked.
Run Browser permission, Storage and Emulation automation commands through
one shared supervised workflow and typed result owner. Prepare policy and
Native work synchronously, wait outside protocol state, then adopt results
in finite state turns. Remove the old family-specific async wrappers and
share the Emulation completion logic with CDP.
Keep original Page host and binding authority beside each receipt. Freeze
cookie owner routing and defaults across target activation, reject writes
into recreated contexts, and retain native error sources until transport
projection. Preserve the Runtime output and cancellation contracts.
Move all six neutral Runtime commands, including target/realm lookup,
node materialization, channels and locateNodes, into one ordinary async
workflow using finite state access and the existing command supervisor.
Remove the duplicated preparation/completion and server deferred-reply loops.
Keep the original Page/host/binding authority, typed result, accepted output
and cancellation with their command owner. Recover failed Native output
before adoption, hand channel listeners over at script admission, and release
temporary locateNodes object groups on cancellation. Classic and BiDi use
the same owned wait and move-only completion receipt.
Validate direct-owner before-poll and held-Promise cancellation, ready loss,
recreated hosts, channel progress, context close and actual Native proxy
release. Run root fmt, full workspace Clippy and Nextest, doctests and the
same-source CLI, Playwright, BiDi and Puppeteer suites before committing.
Admit Page and Worker Runtime listeners through the shared ordinary command
workflow and retain their exact target/session, output context and renderer
fence through waits and cancellation. Remove the dedicated listener loop and
its unused nested adapter; restrict the old raw-message async API to tests.
Drive adapter-internal commands with owned tasks while processing protocol
state, renderer and owner completions. Use AdapterReply for their original
responses, and wait for deferred Inspector results before finite completion.
Route every background navigation completion through finite admission and the
existing supervised workflows. Keep failure and download terminals in their
original output context before native cleanup, and remove production renderer
ingress and navigation-completion async fallbacks.
Make ordinary command joins and deferred Runtime response routing synchronous.
Prepare default-placeholder close at admission so native tracing cleanup cannot
revive the target; share the workflow with direct compatibility callers and
remove the replaced cleanup wrappers.
Decode legacy Target messages into ordinary commands with their real session,
renderer policy, cancellation and global reply route. Restore nested replies
for both immediate and background navigation completion without leaking ids.
Replace the raw command loop and exclusive Target execution body with the
shared owned command workflow. Retain accepted replies and renderer fences
across cancelled waiters and discarded state replies, and clear retired Fetch
lifetimes when the same in-flight entry transfers to protected recovery.
Run Page composite commands in the existing supervised command workflow.
Prepare preload, stop, crash and close ownership at admission; keep native
waits outside state access and complete finite commands synchronously.
Share owned navigation commit, streaming response and retirement logic with
Fetch. Preserve current, nested and background navigation reply ownership,
including accepted terminals during later waits, cancellation and ready loss.
Keep stop cleanup scoped to its original request and retain crashed Pages
before awaiting shutdown.
Remove the child-navigation Owned/Inline split, redundant world phases and
old exclusive Page completion/activation wrappers. Carry typed native errors
and use finite state operations for output, attachment and listener updates.
Keep original Native child facts routable through the unbound Document
handoff without granting business access. Preserve their exact Document tree
through adoption and use the captured owner for events and response bodies
when foreground selection changes.
Validate controlled renderer-held peer progress and recovery, successor
navigation ownership, stale world attachments, full workspace checks, source
CLI compatibility, Playwright, Puppeteer and parallel targeted stress. Replace an old stylesheet fixture clock check with
a script-released CSS gate while preserving the parser/DOM ordering checks.
Supervise existing-target sweeps, tab-child attachment and disable cascades in
the original command workflow. Keep initial Documents, binding updates and
session disposal waits outside connection borrows. Remove the old exclusive
sweep and detach loops; compatibility callers reuse the same async flow.
Retain installed policies by weak allocation identity so retired sweeps cannot
attach after disable, replacement or owner closure. Keep provisional sessions
in the original rollback transaction, remove actual commit receipts, and retain
recovery through waiter cancellation and discarded ready results.
Keep independent Page output on its original FIFO while completing the Browser
policy reply. Resolve provisional primaries through their exact Page source
until the frontend route commits, preserving existing sessions' responses.
Restrict retired frontend-release wrappers to tests and preserve typed
initial-Document error causes.
Run the BiDi slow-image HTTP fixture independently of the protocol executor,
retaining its original one-second completion budget and load assertions.
Validate controlled Native holds, synchronous XHR peer progress, replacement
policies, cancellation, ready loss and output order. Run required workspace
checks, parallel stress, and Playwright/Puppeteer against the current CLI.
Run Target.createTarget and Target.attachToTarget completion in the original
supervised command workflow. Keep initial Document installation, binding
updates, surface activation, initial navigation and rollback outside connection
borrows, and reuse that flow in exclusive compatibility callers.
Commit the attachment in the consuming owner turn so a target or parent that
started closing cannot gain a late session. Retain newly admitted rollback in
the original command recovery scope and preserve attached-event-before-reply
ordering through cancellation and discarded ready results.
Box composite waits at their invocation boundaries to keep the legacy actor
stacks bounded. Remove obsolete exclusive background-surface, initial-navigation
and uncommitted-session-disposal wrappers. Preserve Native binding output fences;
use the actual session registry for primary and attached bindings.
Validate controlled Native holds, ready-loss and closing interleavings, an
explicit WebSocket synchronous-XHR gate with peer progress, full workspace
checks, parallel stress, and real clients against the source-built CLI.
Route production scheduler command completion through finite state access and
owned workflows. Move Page Inspector response and Runtime.disable binding waits
outside connection borrows, retaining the original deferred-reply registry,
renderer correlations, output fences and command recovery context. Reuse the
same completion flow in compatibility callers, including Worker completion.
Make protocol-local DOMStorage flushing synchronous and remove its private
prepared payload/slot pipeline and obsolete async projection wrappers. Preserve
typed Native binding failures and their source context. Fence child lifecycle
observation against output already published before its ready response,
without widening unrelated command response boundaries.
Synchronize await correlation snapshots with renderer lease rotation and
consumption so context teardown retires the current call.
Use one async I/O worker per CLI HTTP fixture rather than a CPU-sized pool
in each parallel test process. Keep existing timeout and behavior assertions.
Validate held Native progress, cancelled waiters and lost ready replies, full
workspace checks, protocol doctests, parallel stress, and the source-built CLI
with explicit Worker promise barriers across three Worker types and two clients.
Run main-document lifecycle and download emission plus popup navigation through the existing owner-work supervisor. Retain each exact load interest in the scheduler queue until output handoff, and remove the adapter's private load tasks and completion channel.
Limit production ready-work completion to finite observations. Reuse the renderer navigation workflow and fenced output finalizer for compatibility callers. Classify explicit child frame navigation by its original owner instead of attachment observation timing, preserving Native validation and the parent document.
Validation: root cargo fmt, full workspace Clippy, full Nextest and protocol doctests; source-built CLI compatibility and controlled popup replacement and independent load/cancellation scenarios; parallel stress of owned output and child navigation.
Run complete Page and Worker publications in supervised async workflows with finite state access. Keep each original cursor and Runtime FIFO reservation until output handoff, and remove the duplicate renderer ingress and slot drivers.
Reuse owned Fetch continuations, popup and initial-document installation, navigation and close workflows. Preserve exact load dependencies, independent Native fences, Input automation predecessors, and cancellation output before replacement load. Retain released Runtime output in its existing route FIFO and retire closed Page resources only after their original output tail is projected.
Validation: root cargo fmt, full workspace Clippy, full Nextest and protocol doctests; source-built CLI compatibility, history/Fetch, real clients and worker lifecycle smoke; parallel stress of the observed races.
Keep SharedWorker and ServiceWorker publication cursors outstanding until their retained output is handed off once. Run cleanup and binding replay as ordinary async workflows through finite state access; share the same business bodies with Page retirement and existing projection callers.
Move owner-work supervision from the CDP actor into the common scheduler. Cursor waits continue processing state operations and task terminals, and background navigation stays Running through its final publication. Store Runtime output barriers on the connection, reserve each active route projection's FIFO position, and make finite projection leaves synchronous.
Validation: cargo fmt --all; full workspace/all-targets/all-features Clippy with -D warnings; root Nextest (21,034 passed, 19 skipped); five state-access doctests. Fixed-source CLI checks cover Fetch continuations, Playwright, BiDi, all three Worker runtime kinds, natural and command-driven Worker retirement, and background navigation metadata.
Run preload proxy/listener admission and object-group release as ordinary
async workflows outside protocol state. Supervise initial dispatch in the
existing owner-work task, hand long promises to the original response lane,
and retain exact binding, host, native attachment and group ownership.
Keep materialized events and their renderer cursor in the existing protocol
queue until typed projection completes. Preserve navigation response/commit
boundaries, cancellation cleanup and original output after Page retirement;
reject rebound-session replies before they can consume a successor journal.
Validation: root fmt, complete workspace/all-targets/all-features Clippy,
root Nextest (20,996 passed; 19 skipped), five lifecycle doctests, and
3,973 focused protocol/scheduler tests. Real CLI CDP, captured/auth, child
navigation, Playwright and debugger-held peer progress checks passed, as
did 18 sequential BiDi messages across two realms with 16 peer requests.
Run internal Inspector helpers and realm inventory through finite state
operations, preserving native error causes and the original session, host,
Page and renderer-call identities through completion and cancellation.
Separate navigation Page installation from retirement of the previous Page.
Route popup activation through the existing supervised owner-work path. An
activation waiting on a pending Document commit now leaves the actor free to
consume that commit and discovery control requests. Reuse the same native
wait and terminal output after cancellation or ready-result loss.
Make CLI readiness regressions wait for the initialized successor DOM and
exercise a shared deadline with stages that each fit a fresh budget, including
a direct-load success control and exact timeout-phase/output assertions.
Move session disposal, frontend teardown, target activation and closure waits
out of connection borrows into supervised workflows. Retain exact binding
identities and command output ownership through cancellation and discarded
ready results.
Complete Native and finite query results synchronously and run Input
download and file chooser completion as owned async work. Preserve response
and renderer publication order, and release the actor while Tab auto-attach
joins an existing initial-document installation.
Make the meta-refresh shutdown regression wait for its successor document
before asserting exact DOM output.
Validation: cargo fmt --all; full workspace Clippy with warnings denied;
cargo nextest run --no-fail-fast (20,973 passed, 19 skipped); real CLI,
Playwright, paused-renderer, Fetch-close and Input checks.
Keep intercepted document requests, authentication, captured responses and native
commit/adoption in ordinary async workflows with exact navigation ownership.
Move child lifecycle waits and Fetch.disable cleanup out of actor completion,
retain source response obligations through cancellation, and preserve ACK timing.
Prepare owned session policy/script/worker cleanup and a synchronous state owner
with weak handles and compile-time borrowing constraints. Retain explicit legacy
inline drivers until disposal, frontend control and adapter paths migrate.
Preserve typed error contexts and share the inline Fetch driver with BiDi adapters
so they cannot wait on their own unserviced state mailbox.
Validation: cargo fmt --all; complete workspace Clippy with all targets/features
and warnings denied; root nextest 20,941 passed, 19 skipped; protocol doctests
1 positive and 4 compile-fail cases passed.
ldm0
