Snapshot the initiating script nonce when scheduling string timeouts and intervals, then restore it on the compiled timer source. Cover dynamic imports, nested timers, identical source scheduled under different nonces, and functions invoked by another script.
Serve raw XHR header inspection and echo endpoints with exact name/value filters, original ordering and duplicate fields. Reuse arbitrary-method routing and return early without reading unused uploads; cover CORS metadata, HEAD and discovery boundaries.
Serve JSON module load/error dependencies and the per-key JSON-to-JavaScript response sequence. Keep counters shared across fixture origins and isolated between servers, with exact resource discovery and HEAD behavior.
Allow ws sources to match http and https, and wss sources to match https.
Distinguish WebSocket-to-HTTP compatibility from exact scheme matching and
secure upgrades so same-security ports remain constrained and self does not
mistake distinct origins for the same origin.
Cover scheme sources and exact/wildcard hosts with wildcard ports in both
Window and Worker checks, plus numeric ports, host/path restrictions and
asymmetric scheme transitions.
Parse CSP host-source syntax before matching, retaining raw host and path
components instead of normalizing them through the URL parser. Match paths
by percent-decoding individual segments for exact and wildcard sources.
Cover invalid tokens, encoded delimiters, distinct non-UTF-8 bytes, dot
segments, redirect restrictions, ports and hostname boundaries. Preserve
existing support for ordinary IPv4 sources.
(cherry picked from commit 889babcac9)
Split response CSP and report-only fields into independent policies in wire order. Preserve policy disposition and CSP whitespace behavior, and enforce every policy in a field. Preserve source token whitespace after directive splitting so invalid vertical tabs cannot become wildcard permissions.
Source: dcb55392f5, 889babcac9
Exclude partitioned cookies from the unpartitioned global quota and scope
per-domain counting and eviction to the complete partition key. Loading a
Chrome profile with CHIPS cookies now preserves ordinary login cookies
such as V2EX A2.
Add regression coverage for independent global and partition quotas,
partition-local eviction, and replacement at the limit.
Validation: cargo fmt --all and workspace/all-targets/all-features clippy
with -D warnings passed. The three new regressions passed, and a real
Chrome profile retained A2 unchanged and restored the V2EX login.
The full nextest run was stopped at the user's request; an unrelated
non-UTF-8 SQLite filename test failed on this macOS filesystem before
cancellation.
Use the native Window brand to recognize child globals across method realms. Distinguish valid detached child Windows from invalid receivers when adding or removing event listeners; detachment has already cleared their event state.
Cover retained child references, borrowed EventTarget methods, invalid receivers, and parent listener isolation. Restore the verified iframe promise-rejection WPT to the passed list.
Return text mutation effects from parser sinks and deliver them through the shared notification pipeline after releasing the structural borrow. This keeps stylesheets and layout current when parser input is merged into existing text nodes, and delivers characterData records without replacing node identity.
Add main-document and iframe regressions for split stylesheet input, hit testing, and MutationObserver delivery. Restore the verified elementsFromPoint iframe WPT to the passed list.
Record the full 12,905-case run at 4f7c4ffc0: 8,766 passed, 3,792 failed, 285 timed out, 53 stalled, and 9 errors. Preserve the measured full-run classifications, including the two independently confirmed stable regressions.
Serve the upstream CORS echo endpoint for standard and custom methods, including original query/body metadata, repeated allow-headers fields, delay errors, HEAD, and exact resource discovery.
Source: 9b27c82fb5
Synthesize empty headings for simple headerless tables and keep complex tables readable as blocks. Use owned output fragments to avoid repeated copying through nested fallback tables.
Cover escaping, alignment, layouts, CLI output and linear copy growth. Validated with cargo fmt, workspace Clippy, and 18,114 passing nextest tests (13 skipped).
Store validated clipboard representations in the BrowserContext instead of retaining page-owned V8 objects. Reconstruct fresh items and blobs on reads, commit all representations together, and recheck write permission after pending data settles. Cover child realms, document teardown, independent contexts, and rejected writes.
Source: 331945eaf9
Share parser mutation notifications between the main document and child
frames, with each owner retaining its resource and lifecycle work. Update
stylesheet owners incrementally so parser mutations preserve CSSOM edits.
Keep tokenizer pause reasons separate from DOM handle identity.
Add main/iframe regressions for reaction and observer ordering, form
association, stylesheet visibility, CSSOM edits, and nested frame identity.
Validation: cargo fmt --all; strict workspace clippy; cargo nextest run
--no-fail-fast (18,118 passed, 13 skipped).
Enable shared receiver checks for Document structure, CharacterData, Text,
ProcessingInstruction and affected HTML element templates. Keep registered
native Proxies valid EventTargets while rejecting author-created Proxies.
Preserve windowless node identity and UTF-16 data when routing CharacterData
through native handles, including Text/CDATA wholeText, live ranges and XPath
iterator invalidation. Validate raw reflected/event handler receivers before
conversion or mutation, with the LegacyLenientThis mouse event exceptions.
Cover cross-realm error constructors, forged and proxy receivers, conversion
ordering, native Proxy event dispatch and detached CharacterData mutation.
Apply integer truncation before range validation and constrain 64-bit EnforceRange to JavaScript exact integers. Cover negative fractions, finite endpoints, non-finite values, and OPFS offset range rejection.
Source: 1a1ca5af42
Flush parser insertion reactions after the tree builder completes its current
token so connected callbacks run before children without retaining parser
borrows across JavaScript execution.
Keep one DocumentParserSession and expose a restricted insertion handle for
nested writes. Share input, suspension, cancellation, and close state so
blocked writes remain queued and outer feeds stop when nested parsing blocks
or replaces the document. Let the owning session finish deferred close and
dispatch readiness transitions once.
Reuse form-owner mutation detection for child parser insertions and add
regressions for reaction order, form association, nested writes, gated external
scripts, document replacement, and deferred close.
Validation: cargo fmt --all; strict workspace Clippy; cargo nextest run
--no-fail-fast (18,104 passed, 13 existing skips); release build.
Let an undefined element with a queued upgrade participate in a nested
appendChild() or customElements.upgrade() reaction scope. Use construction
state at execution time to prevent duplicate constructors, and keep failed
upgrade cleanup intact.
Remove pending-upgrade checks from lifecycle enqueueing so a remaining
duplicate upgrade cannot suppress a successful upgrade's form callback.
Drop the unused queue membership helpers.
Add regressions for nested insertion and explicit upgrade, initial form
association, and constructor failure. Correct two fragment parser ordering
assertions after verifying the same scripts against local Chromium 147.
Validation: cargo fmt --all; workspace clippy with all targets and features
and -D warnings; 17,803 nextest tests passed, 13 skipped. All 75 subtests in
the seven affected WPT pages pass. The custom-elements directory passes
163/165 pages, with the same two remaining failures as the prior run.
Queue either a connected callback for an existing custom element or an upgrade for an undefined element. Let the upgrade own its initial connection callback instead of synchronously upgrading the subtree and enqueueing connections again.
Cover option and ordinary containers, reconnection, and mixed upgraded/undefined sibling order against Chromium. HTMLOptionElement WPT passes; workspace fmt, clippy, and all 17800 nextest tests pass.
Use the shared custom element construction path in the child realm and deliver parser mutation records and lifecycle reactions. Give child document streams CEReactions scopes so writes finish reactions without premature microtask checkpoints.
Add regressions for synchronous construction, parser mutation batches, nested JavaScript, and dynamic markup guards. The five affected WPT pages pass all 46 subtests; workspace fmt, clippy, and all 17798 nextest tests pass.
Ignore unknown responseType values after string conversion and before XHR state checks. Preserve conversion exceptions, ignore document in workers, and validate the native receiver in the accessor realm.
Source: db79f4a746
Propagate WebIDL sequence conversion errors without IteratorClose. Convert all inner sequences before validating URLSearchParams pair lengths or normalizing Headers, preserving getter order and conversion exceptions.
Source: afe693c9a3, 4a420981c3
Store the URL creator’s browser partition and storage key separately from its backing Blob, and check authorization atomically with URL removal. Use the Worker environment storage key and a shared opaque-origin nonce allocator for Windows and Workers.
Source: e090f2b070
Preserve status text, raw payloads, method headers, XML contents and file modification times for the two upstream XHR fixtures. Support HEAD and custom methods and close responses without waiting for unused uploads.
Source: 3d04d737e7
Compile inline modules with their document base URL and read import.meta.url from the V8 module resource name. Preserve separate internal module-map identities and cover both page and child inline modules.
Source: f8de9b7ed0
Configure an empty upload for a bodyless PUT and suppress libcurl’s implicit Content-Type on that path. Recompute framing across redirects, retaining PUT for 301/302/307/308 and dropping the body headers when 303 changes it to GET.
Source: f84c99d671
Pass the normalized request method through local resource resolution for Window and Worker fetch, XMLHttpRequest, navigation, streaming and callback consumers. Reject non-GET blob requests locally while preserving data URL behavior and asynchronous XHR completion.
Source: 0ee4db49df
Replace --cdp-screencast-fps with --screencast-interval. Accept positive
integer milliseconds, retain the --layout requirement, and default to
1000 ms. Pass the interval through server configuration and multiply the
Duration by everyNthFrame without converting through integer FPS.
Update CLI help and English/Chinese docs. Cover parsing, defaults, rejected
values and the removed flag, precise deadlines, and interval multiplication.
Validation:
- cargo fmt --all
- cargo clippy --workspace --all-targets --all-features -- -D warnings
- cargo nextest run --no-fail-fast
ldm0