Pinned V8 15.2 can reuse Function and indirect-eval compilation entries
from a script with a different nonce or base URL. This rejects valid
dynamic imports once module CSP admission checks the inherited metadata.
Append a precomputed referrer-specific trailing comment after the existing
CSP and Trusted Types checks. Keep untracked cache keys separate, preserve
UTF-16 and Function source text, and retain creator metadata when generated
functions outlive their compiling script.
Cover dynamic Function variants, direct and indirect eval, cross-realm
reuse, retained functions, lexical scope and source preservation.
A newer navigation can cancel a replacement response while its Document is
already installed and still completing its requested lifecycle stage.
Detach that observer and continue on the existing Page, preserving its
navigation reply policy and original close owner.
Cover cancellation after the native Document is installed but before
protocol adoption, followed by beforeunload for the successor navigation.
Check ordinary ready timers before admitting an unexpired idle callback. An earlier idle transport deadline must not overtake later ready work in the same heap, including queued popup javascript navigation.
Keep expired idle callbacks runnable. Cover the real owner loop with an HTTP completion witness and six function, source, child-window, expired, cancelled, and future timer scenarios.
Window.close marks a browsing context closed before its queued document
cleanup. Do not admit ServiceWorker requests during that gap, where
cleanup can retire their resolvers before a surviving caller sees them.
Cover lightweight popups and renderer-owned auxiliary Pages, including
reentrant URL conversion. Preserve requests made during beforeunload,
document owner retirement, and stale completion authorization.
Wait for the load lifecycle event matching the session, frame and navigation loader rather than assuming a Page.navigate response means the DOM is ready. Keep binding and removed-script assertions after that boundary.
Carry the retained Window's clock anchors into the new Document without inheriting lifecycle slots or rematerializing cached Performance objects. Add Chromium-backed timing and identity regressions with an intentionally delayed navigation response.
Invalidate handler state at the shared attribute mutation boundary, including Attr and namespace-aware APIs. Route main-document body and frameset aliases through the same Window target used for registration and lookup, release retired callbacks, and retain adopted wrapper fallback behavior.
Exercise native Page and DOM access before Runtime, first evaluation and realm publication, isolated worlds, preloads, delayed scripts, native IO commands and navigation/close. Match lifecycle completion by frame and loader identity.
Keep the native Document and per-Page isolate live while deferring the main Window Context, V8 Inspector and wrapper templates. Activate through existing script and automation boundaries, preserve native lifecycle and history state, and provide an explicit eager initialization flag.
Prevent concurrent Page owner drains from delivering later chunks or
completion before a response head finishes. Claim one bounded batch at a
time without holding the queue mutex through callbacks, then rearm arrivals
after releasing the claim.
Add controlled concurrency and reentrant-drain regression tests.
Wait for the exact frame and loader's renderer-owned load fact before
reading the new DOM. Page.navigate only acknowledges acceptance, so an
immediate evaluation can still observe the prior document under contention.
Remove each Fetch ID together with its matching response or authentication pause. Keep other request and Page owners untouched, and reject late actions after retirement.
Cover owner isolation and repeated iframe pause/remove cycles without consuming stale IDs between cancellations.
Route child navigation responses through the existing response and authentication pauses before redirects or document commit. Preserve upload bytes and Service Worker clients across retries, and resume valid navigations when handlers disable or detach.
Release paused state on native cancellation and keep transport futures off deeply nested V8 callback stacks. Cover response actions, redirects, authentication, multi-session cleanup and Service Worker interception with real HTTP regressions.
ldm0
Mert Kaya