Commit graph

10498 commits

Author SHA1 Message Date
Tim van der Lippe
82ca2b92cd
Implement Trusted Type eval checks (#37834)
It implements the new codeForEvalGets callback to retrieve the
value for a trusted script object. Additionally, it implements
the new logic in can-compile-strings to call the policy
factory if required.

Note that parameter and argument checks aren't implemented yet,
as they require updates to binding generation (see TODO in
script_runtime).

Part of #36258

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
2025-08-11 12:26:56 +00:00
Mukilan Thiyagarajan
4c05758ded
script: support inline SVG by serializing the subtree (#38188)
This patch adds support for rendering static inline SVG documents in the
DOM tree by serializing the SVGElement's subtree and leveraging the
existing resvg based SVG stack for rendering. Serialiing the subtree is
necessary as resvg's tree representation (roxmltree) is immutable, so we
can't construct the tree incrementally.

Few other design choices here:
1. The `SVGSVGElement` is now treated as a replaced element and the
   layout code is responsible for plumbing the serialized SVG source
   (encoded as a base64 data: url) into the image cache, much like how
   background images are handled.
2. The serialization is done on the script thread after an initial
   layout pass. This is necessary because the serialization code asserts
that it is invoked from script thread i.e we can't call it from layout
   workers.
3. The serialized SVG data: url is cached to avoid recomputing it on
   subsequent layouts. The cache is invalidated when the SVGSVGElement's
   subtree is mutated.

The original SVGSVGElement code was behind the `dom_svg_enabled` pref.
This patch also removes the preference and make SVG support using resvg
available unconditionally.

Below is the analysis of the new test failures:

These tests use inline SVG but used to pass by accident.
They now fail because they contain SVG with no intrinsic
sizing which is not handled by resvg in a way that would
allows us to distinguish it from the sized case. The same
limitation applies to non-inline SVG.

 - /css/CSS2/positioning/absolute-replaced-width-003a.xht
 - /css/CSS2/positioning/absolute-replaced-width-003b.xht
 - /css/CSS2/positioning/absolute-replaced-width-003c.xht

These tests employ CSS styles in the HTML that
target the elements in inline SVG, which is not currently
supported.

-
/css/compositing/mix-blend-mode/mix-blend-mode-plus-lighter-svg-basic.html
 - /css/compositing/mix-blend-mode/mix-blend-mode-plus-lighter-svg.html

This is a tentative test that uses the unsupported 'border-shape' CSS
property. The ref uses SVG, so it used to pass accidentally. The ref
still doesn't render correctly since it also relies on styling SVG
elements using CSS classes in the HTML (instead of inline in SVG).

 - /css/css-borders/tentative/border-shape/border-shape-stroke.html

These tests use the attribute 'clip-path=circle(...)' in the
test, but this doesn't seem to work in resvg.

 - /css/css-masking/clip-path/clip-path-borderBox-1b.html
 - /css/css-masking/clip-path/clip-path-contentBox-1b.html
 - /css/css-masking/clip-path/clip-path-contentBox-1c.html
 - /css/css-masking/clip-path/clip-path-fillBox-1b.html
 - /css/css-masking/clip-path/clip-path-marginBox-1a.html
 - /css/css-masking/clip-path/clip-path-paddingBox-1b.html
 - /css/css-masking/clip-path/clip-path-strokeBox-1b.html
 - /css/css-masking/clip-path/clip-path-strokeBox-1c.html
 - /css/css-masking/clip-path/clip-path-viewBox-1a.html
 - /css/css-masking/clip-path/clip-path-viewBox-1b.html
 - /css/css-masking/clip-path/clip-path-viewBox-1d.html
 - /css/css-masking/clip-path/svg-clip-path-circle-offset.html
 - /css/css-masking/clip-path/svg-clip-path-ellipse-offset.html

Additionally, the below two tests use a `foreignObject` SVG element
which
embeds a html div fragment. This is also not supported by resvg.

 - /css/css-masking/clip-path/clip-path-viewBox-1d.html
 - /css/css-masking/clip-path/clip-path-fillBox-1b.html

The following test fails because of apparent pixel differences
between a circle rendered purely using CSS clip-path vs a circle
rendered in SVG using resvg.

 - /css/css-masking/clip-path/clip-path-contentBox-1c.html

These tests style the inline SVG elements using CSS in the HTML or
separate stylesheet. This is not supported by this implementation.

 - /css-transforms/document-styles/svg-document-styles-{001..004}.html
 - /css-transforms/document-styles/svg-document-styles-012.html
 - /css-transforms/external-styles/svg-external-styles-{001..004}.html
 - /css-transforms/external-styles/svg-external-styles-014.html

These tests seem like they should pass, but they fail because of what
seems like an anti-aliasing issue in the rendering engine. The
transformed element has a thin outline which is causing pixel difference
with the ref:

 - /css/css-transforms/group/svg-transform-group-008.html
 - /css/css-transforms/group/svg-transform-group-009.html
 - /css/css-transforms/group/svg-transform-nested-009.html
 - /css/css-transforms/group/svg-transform-nested-013.html
 - /css/css-transforms/group/svg-transform-nested-014.html
 - /css/css-transforms/group/svg-transform-nested-018.html
 - /css/css-transforms/group/svg-transform-nested-019.html
 - /css/css-transforms/group/svg-transform-nested-008.html

The below tests fail because resvg is calculating the wrong size for the
'rect' inside the SVG. The dimensions of the SVG are established via the
CSS in the HTML, so it seems resvg is using incorrect coordinates for
the children of the svg when explict width/height are not specified in
the root svg element.

 - /css/css-transforms/group/svg-transform-group-011.html
 - /css/css-transforms/group/svg-transform-nested-021.html
 - /css/css-transforms/group/svg-transform-nested-029.html

All these tests use an SVG that doesn't have width nor height attributes
and this causes resvg to use incorrect coordinates for the SVG's
children. In addition, the following tests use the CSS syntax for
transforms inside the SVG (using style attribute) which is not supported
by resvg (it only supports the SVG 1.1 transform syntax).

 - /css/css-transforms/inline-styles/svg-inline-styles-{001..004}.html
 - /css/css-transforms/inline-styles/svg-inline-styles-012.html

In the case of these four tests, the `style` attribute specifies an
invalid transform, but resvg doesn't fallback to the transform specified
via the `transform`  attribute on the same element.

 - /css/css-transforms/inline-styles/svg-inline-styles-005.html
 - /css/css-transforms/inline-styles/svg-inline-styles-006.html
 - /css/css-transforms/inline-styles/svg-inline-styles-010.html
 - /css/css-transforms/inline-styles/svg-inline-styles-013.html

The following test fails because of the lack of width/height in SVG as
described above but it also exposes gaps in our CSS tranform
implementation.

 - /css/css-transforms/preserve3d-and-filter-with-perspective.html

These tests failure because resvg doesn't handle the SVG without
explicit width and height, but specified via CSS in the HTML. In
addition, there are pixel differences between the ref due to
antialiasing issues.

 - /css/css-transforms/matrix/svg-matrix-{005...008}.html
 - /css/css-transforms/matrix/svg-matrix-010.html
 - /css/css-transforms/matrix/svg-matrix-012.html
 - /css/css-transforms/matrix/svg-matrix-{015..069}.html
 - /css/css-transforms/rotate/svg-rotate-angle-45-001.html
 - /css/css-transforms/rotate/svg-rotate-angle-45-011.html
 - /css/css-transforms/rotate/svg-rotate-angle-45-022.html
 - /css/css-transforms/scale/svg-scale-006.html
 - /css/css-transforms/scale/svg-scale-007.html

These tests seem to be failing due to some sort of antialiasing issue,
where a transformed SVG element has a thin border that causes pixel
differences compared to the solid colored reference.

 - /css/css-transforms/skewX/svg-skewx-001.html
 - /css/css-transforms/skewX/svg-skewx-006.html
 - /css/css-transforms/skewX/svg-skewx-011.html
 - /css/css-transforms/skewX/svg-skewx-016.html
 - /css/css-transforms/skewX/svg-skewx-021.html
 - /css/css-transforms/skewX/svg-skewxy-001.html
 - /css/css-transforms/skewY/svg-skewy-001.html
 - /css/css-transforms/skewY/svg-skewy-006.html
 - /css/css-transforms/skewY/svg-skewy-011.html
 - /css/css-transforms/skewY/svg-skewy-016.html
 - /css/css-transforms/skewY/svg-skewy-021.html

These tests specify several SVG attributes such as transform,
vector-effect etc via CSS in the HTML (rather than inline in SVG). The
current implementation doesn't support this.

 - /css/css-transforms/transform-box/stroke-box-mutation-001.html
 - /css/css-transforms/transform-box/stroke-box-mutation-002.html
 - /css/css-transforms/transform-box/stroke-box-mutation-003.html
 - /css/css-transforms/transform-box/stroke-box-mutation-004.html
 - /css/css-transforms/transform-box/svgbox-stroke-box-002.html
 - /css/css-transforms/transform-box/svgbox-stroke-box-003.html
 - /css/css-transforms/transform-box/svgbox-stroke-box-004.html
 - /css/css-transforms/transform-box/svgbox-stroke-box-005.html

These tests depend on 'transform-origin' specified on an element inside
an SVG, but this transform is influenced by the 'tranform-box' set via
CSS in the HTML itself (not the SVG). The current implementation doesn't
support styling the SVG using document styles, so these tests just fail.

- /css/css-transforms/transform-origin/svg-origin-relative-length-*.html

These tests check the fallback behaviour when invalid syntax is
encountered in the 'transform-origin' value. resvg doesn't correctly
fallback to 0,0 causing the tests to fail.

-
/css/css-transforms/transform-origin/svg-origin-relative-length-invalid-001.html
-
/css/css-transforms/transform-origin/svg-origin-relative-length-invalid-002.html
-
/css/css-transforms/transform-origin/svg-origin-relative-length-invalid-003.html
-
/css/css-transforms/transform-origin/svg-origin-relative-length-invalid-004.html

These tests use unimplemented Canvas APIs like 'beginLayer' and
the 'CanvasFilter' constructor and hence fail at runtime.

-
/html/canvas/element/filters/2d.filter.canvasFilterObject.gaussianBlur.tentative.html
-
/html/canvas/element/filters/2d.filter.layers.gaussianBlur.tentative.html
-
/html/canvas/element/layers/2d.layer.anisotropic-blur.isotropic.tentative.html
-
/html/canvas/element/layers/2d.layer.anisotropic-blur.mostly-x.tentative.html
-
/html/canvas/element/layers/2d.layer.anisotropic-blur.mostly-y.tentative.html
-
/html/canvas/element/layers/2d.layer.anisotropic-blur.x-only.tentative.html
-
/html/canvas/element/layers/2d.layer.anisotropic-blur.y-only.tentative.html
-
/html/canvas/element/layers/2d.layer.css-filters.blur-and-shadow.tentative.html
 - /html/canvas/element/layers/2d.layer.css-filters.blur.tentative.html
- /html/canvas/element/layers/2d.layer.css-filters.shadow.tentative.html
 - /html/canvas/element/layers/2d.layer.ctm.layer-filter.tentative.html
-
/html/canvas/offscreen/filters/2d.filter.canvasFilterObject.dropShadow.tentative.html
-
/html/canvas/offscreen/filters/2d.filter.canvasFilterObject.gaussianBlur.tentative.html
-
/html/canvas/offscreen/filters/2d.filter.layers.dropShadow.tentative.html
-
/html/canvas/offscreen/filters/2d.filter.layers.gaussianBlur.tentative.html
-
/html/canvas/offscreen/layers/2d.layer.anisotropic-blur.isotropic.tentative.html
-
/html/canvas/offscreen/layers/2d.layer.anisotropic-blur.mostly-x.tentative.html
-
/html/canvas/offscreen/layers/2d.layer.anisotropic-blur.mostly-y.tentative.html
-
/html/canvas/offscreen/layers/2d.layer.anisotropic-blur.x-only.tentative.html
-
/html/canvas/offscreen/layers/2d.layer.anisotropic-blur.y-only.tentative.html
-
/html/canvas/offscreen/layers/2d.layer.css-filters.blur-and-shadow.tentative.html
- /html/canvas/offscreen/layers/2d.layer.css-filters.blur.tentative.html
-
/html/canvas/offscreen/layers/2d.layer.css-filters.shadow.tentative.html
- /html/canvas/offscreen/layers/2d.layer.ctm.layer-filter.tentative.html

These tests fail because resvg doesn't seem to honour the 'translate'
CSS property specified on an SVG element using an inline 'style'
attribute.

 - /css/css-transforms/translate/svg-translate-with-units.html
-
/css/css-transforms/translate/translate-and-transform-attribute-in-svg.html
-
/css/css-transforms/translate/translate-and-transform-css-property-in-svg.html
 - /css/css-transforms/translate/translate-in-svg.html

These tests seem to fail due to the filter effect implementation in
resvg either not being complete or spec compliant.

 - /css/filter-effects/feconvolve-divisor.html
 - /css/filter-effects/feconvolve-region-001.html
 - /css/filter-effects/feconvolve-region-002.html
 - /css/filter-effects/filter-subregion-01.html
 - /css/filter-effects/svg-feimage-002.html
 - /css/filter-effects/svg-feimage-003.html
 - /css/filter-effects/svg-feimage-004.html
 - /css/filter-effects/svg-feoffset-001.html

The test /css/filter-effects/svg-feimage-004.html should ideally PASS
but currently fails because we don't propagate height/width set using
CSS in HTML element to the root SVG, so resvg uses the wrong dimensions
when rendering the children of the SVG.

These failures are due to deficienies in our current implementation
i.e we don't support styling SVG elements using CSS in HTML.

-
/css/css-transforms/gradientTransform/svg-gradientTransform-combination-001.html
 - /css/selectors/sharing-in-svg-use.html

The below test fails as our current implementation relies on resvg to
tell us the intrinsic ratio of the SVG, but this doesn't always work
correctly.

 - /css/css-sizing/svg-intrinsic-size-005.html

This failure is due to lack of proper fallback to no-op transform in
resvg when the `rotate()` syntax is specified with an invalid list e.g
`rotate(90,)`.

 - /css/css-transforms/rotate/svg-rotate-3args-invalid-002.html

This test only passes in CI and based on the raw log output, it seems
that no text inside the SVG is rendered in the CI. This could be an font
stack related issue.

 - /css/css-display/display-contents-svg-elements.html

This test asserts that the CSP blocks loads triggered using `use`
elements in SVG. It used to TIMEOUT as without inline SVG support, no
CSP violation event was triggered. It fails now since the event is now
triggered for the load of the SVG itself (our current implementation
loads inline SVGs as serialized base64 data: urls). This doesn't match
the blocked URL in the use element though.

 - /content-security-policy/img-src/svg-use-blocked.tentative.html

Signed-off-by: Mukilan Thiyagarajan <mukilan@igalia.com>

Signed-off-by: Mukilan Thiyagarajan <mukilan@igalia.com>
2025-08-11 11:07:59 +00:00
Martin Robinson
005164df4a
script: Move point_in_initial_containing_block calculation to script (#38520)
Instead of calculating this value in the compositor, calculate it in
`ScriptThread` now that it is straightforward to get this value from the
layout spatial tree. This allows removing some tricky callback code in
the Compositor.

Testing: This shouldn't change any observable behavior so is covered by
existing tests.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
2025-08-11 09:32:38 +00:00
Martin Robinson
9d4004135b
script: Properly fire input events for clipboard use in input elements (#37100)
When using the clipboard to paste or modify the contents of an input
element the specification says says[^1] to

> Queue tasks to fire any events that should fire due to the
> modification, see § 5.3 Integration with other scripts and events for
> details.

This change does that, by turning `handle_text_clipboard_action` into
`TextInput::handle_clipboard_event` and having the caller responsible
for executing events. In addition, when content is changed, the node is
dirtied, forcing a relayout.

[^1]: https://www.w3.org/TR/clipboard-apis/#paste-action

Testing: This is difficult to test because we do not have test harness
support for input events currently. There is a manual test for this in
the linked bug which is now passing.
Fixes: #37074.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
2025-08-11 09:23:58 +00:00
Adam
6ddcce4889
Replace Rc<RefCell<Option<RootedTraceableBox<Heap<JSVal>>>>> with Rc<RefCell<Option<Heap<JSVal>>>> in PipeTo::shutdown_error (#38562)
#38024 adds a rooted box around the Heap for safety, but this is not
necessary anymore after #38385. The solution is to replace
`Rc<RefCell<Option<RootedTraceableBox<Heap<JSVal>>>>>` with
`Rc<RefCell<Option<Heap<JSVal>>>>`. This changes replaces this type.

Signed-off-by: amotaouakkil123 <adam.motaouakkil@mail.mcgill.ca>
2025-08-11 08:58:54 +00:00
shuppy
4784668fa9
devtools: Create source actors from Debugger API notifications (#38334)
currently our devtools impl creates source actors in script, when
executing scripts in HTMLScriptElement or DedicatedWorkerGlobalScope.
this approach is cumbersome, and it means that many pathways to running
scripts are missed, such as imported ES modules.

with the [SpiderMonkey Debugger
API](https://firefox-source-docs.mozilla.org/js/Debugger/), we can pick
up all of the scripts and all of their sources without any extra code,
as long as we tell it about every global we create (#38333, #38551).
this patch adds a [Debugger#onNewScript()
hook](https://firefox-source-docs.mozilla.org/js/Debugger/Debugger.html#onnewscript-script-global)
to the debugger script, which calls
DebuggerGlobalScope#notifyNewSource() to notify our script system when a
new script runs. if the source is relevant to the file tree in the
Sources tab, script tells devtools to create a source actor.

Testing: adds several new automated devtools tests
Fixes: part of #36027

Signed-off-by: Delan Azabani <dazabani@igalia.com>
Co-authored-by: atbrakhi <atbrakhi@igalia.com>
2025-08-11 06:04:51 +00:00
Rodion Borovyk
4f8731d562
script: Return a Result from GlobalScope::evaluate_script_on_global_with_result (#38549)
Make GlobalScope::evaluate_script_on_global_with_result return a Result
instead of a boolean. This is the first step to resolve issue #37810.

Testing: Should not break or fix any existing tests

---------

Signed-off-by: Rodion Borovyk <rodion.borovyk@gmail.com>
2025-08-10 16:51:46 +00:00
Martin Robinson
d5d3ad6949
script: Replace allow(unused_imports) with conditional use statements (#38576)
A few places in the code are using a blanket `allow(unused_imports)`
compiler directive to silence errors about unused imports when the
`webxr` feature is disabled. Since this can hide other kinds of unused
imports, replace these directives with conditional `use` statements.

Testing: No behavior change, so existing tests suffice.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
2025-08-09 20:19:12 +00:00
Simon Wülker
4d7a0d3863
script: Tell devtools whether a node is displayed or not (#38575)
Doing so makes the devtools inspector display the nodes in gray, as it
is the case in firefox.
The relevant node parameter already exists but is hardcoded.

Before:
<img width="1108" height="408" alt="image"
src="https://github.com/user-attachments/assets/4a442fc9-92db-4a97-9e70-3b02f994a9d1"
/>


After:
<img width="1169" height="404" alt="image"
src="https://github.com/user-attachments/assets/ec1674a4-c025-4ceb-93c8-0cc3f695ddc7"
/>


Testing: We don't have tests for the devtools inspector.

Signed-off-by: Simon Wülker <simon.wuelker@arcor.de>
2025-08-09 18:12:20 +00:00
shuppy
c4044e17bb
script: Rename DebuggerEvent to DebuggerAddDebuggeeEvent (#38571)
the next debugger script event, `getPossibleBreakpoints` (#37667), will
contain a single attribute `unsigned long spidermonkeyId`, so it will
have nothing in common with `addDebuggee`. this patch renames the latter
accordingly.

Testing: no behaviour changes other than the rename, so no tests needed
Fixes: part of #36027

Signed-off-by: Delan Azabani <dazabani@igalia.com>
2025-08-09 18:01:00 +00:00
Labros
7b057be780
script: Replace usage of IntersectionObserverRootMargin with Stylo'sIntersectionObserverMargin (#38519)
@stevennovaryo 
Created wrapper for Stylo's IntersectionObserverMargin and cleaned up
repeated code.
Testing: Code compiles and `./mach test-unit tests/unit/style/` doesn't
have any errors. intersectionobserver.rs is able to utilize the struct.
Fixes: https://github.com/servo/servo/issues/35907

---------------------------
Signed-off-by: samir <samir.khan720a@gmail.com>

---------

Signed-off-by: samir <samir.khan720a@gmail.com>
2025-08-09 17:31:44 +00:00
minghuaw
ad18638534
script_bindings: Remove jsstring_to_str (#38527)
This PR removes `jsstring_to_str`, which is replaced with
`jsstr_to_string`, and updates `mozjs` to
6f3dcb99a7.

Given that servo now always replaces unpaired surrogate since
https://github.com/servo/servo/pull/35381, the internal conversion
function `jsstring_to_str` is functionally the same as `jsstr_to_string`
from `mozjs`. This PR removes `jsstring_to_str` and replaces with
`jsstr_to_string` with conversions to `DOMString` where necessary.

Testing: Passes all unit test. No regression was found in WPT test (see
try run: https://github.com/minghuaw/servo/actions/runs/16821156583)

---------

Signed-off-by: minghuaw <wuminghua7@huawei.com>
Signed-off-by: sagudev <16504129+sagudev@users.noreply.github.com>
Co-authored-by: sagudev <16504129+sagudev@users.noreply.github.com>
2025-08-09 11:50:14 +00:00
shuppy
a3e0a34802
script: Add new worker globals as debuggees (#38551)
to debug workers in a page with the [SpiderMonkey Debugger
API](https://firefox-source-docs.mozilla.org/js/Debugger/), we need to
pass the worker’s global object to
[Debugger.prototype.**addDebuggee()**](https://firefox-source-docs.mozilla.org/js/Debugger/Debugger.html#adddebuggee-global).
we could pick up the global via the [onNewGlobalObject()
hook](https://firefox-source-docs.mozilla.org/js/Debugger/Debugger.html#onnewglobalobject-global),
but if our script system passes the global to the debugger script
instead, we can later add details like the PipelineId that will help
servo identify debuggees that the API is notifying us about (#38334).

this patch creates a debugger global in worker threads, runs the
debugger script in those new globals, and plumbs new worker globals from
those threads into addDebuggee() via the debugger script. since worker
threads can’t generate PipelineId values, but they only ever run workers
on behalf of one pipeline, we use that pipeline’s PipelineId as the
PipelineId of the debugger global, rather than generating a unique
PipelineId like we do in script threads.

Testing: will undergo many automated tests in #38334
Fixes: part of #36027

Signed-off-by: Delan Azabani <dazabani@igalia.com>
Co-authored-by: atbrakhi <atbrakhi@igalia.com>
2025-08-09 11:28:06 +00:00
Euclid Ye
d50f02fa73
script: Cleanup unused import in htmlscriptelement.rs (#38567)
Testing: No behaviour change.

Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-09 08:12:48 +00:00
Euclid Ye
589d188a3f
script: Change signature of Event::dispatch to match the spec and simplify things (#38566)
- [Dispatch Event](https://dom.spec.whatwg.org/#concept-event-dispatch)
should return a Boolean. This function is used frequently in spec and
the change makes things easier to follow.
- Remove `enum EventStatus` and related functions.
- Update some dead spec link.
- Update some steps.

This is intended as cleanup before working on #38435 and reduces binary
size by 488KB in Release profile.

Testing: No behaviour change.

---------

Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-09 08:04:31 +00:00
Mukilan Thiyagarajan
21717158eb
script: mark innerHTML as fallible in ShadowRoot (#38565)
This is a follow-up to #38532 which simply defaulted to an empty string
as the spec's WebIDL doesn't mark `innerHTML` as `Throws`. However,
since the absence of `Throws` in the spec doesn't imply no-throw, we can
mark this as fallible in our WebIDL. This makes the `ShadowRoot`'s
implementation match `Element`'s `innerHTML`.

Testing: Same as #38532.

Signed-off-by: Mukilan Thiyagarajan <mukilan@igalia.com>
2025-08-09 06:45:52 +00:00
arthmis
86d7f4c793
add implementation for Path2D addPath method (#37838)
Add implementation for Path2D addPath method
Spec:
https://html.spec.whatwg.org/multipage/canvas.html#dom-path2d-addpath

Testing: WPT test -
`tests/wpt/tests/css/geometry/DOMMatrix2DInit-validate-fixup.html`
Fixes: #37695

---------

Signed-off-by: Lloyd Massiah <artmis9@protonmail.com>
Signed-off-by: arthmis <artmis9@protonmail.com>
2025-08-09 05:06:20 +00:00
shuppy
6471587fb4
script: Set correct introductionType values in more places (#38550)
to use the [SpiderMonkey Debugger
API](https://firefox-source-docs.mozilla.org/js/Debugger/) as the single
source of truth about scripts and their sources for devtools purposes
(servo/servo#38334), we need to keep track of whether scripts come from
an actual file or from things like setTimeout(), because for some
[introductionType](https://firefox-source-docs.mozilla.org/js/Debugger/Debugger.Source.html#introductiontype)
[values](https://firefox-source-docs.mozilla.org/devtools-user/debugger-api/debugger.source/#accessor-properties-of-the-debugger-source-prototype-object),
we want to disregard the script unless it has a [`//# sourceURL=`
override](https://tc39.es/ecma426/#sec-linking-eval)
([displayURL](https://firefox-source-docs.mozilla.org/js/Debugger/Debugger.Source.html#displayurl)).

this patch builds on #38363, setting the correct introductionType value
in several more cases.

Testing: will undergo many automated tests in #38334
Fixes: part of #36027

---------

Signed-off-by: Delan Azabani <dazabani@igalia.com>
Co-authored-by: atbrakhi <atbrakhi@igalia.com>
2025-08-09 05:05:54 +00:00
Kenzie Raditya Tirtarahardja
d33ae1549d
script(webdriver): Fix element clear for file (#38536)
When clearing input file with WebDriver, we should set input's filelist
with empty list instead of setting it with None.

Testing:
`./tests/wpt/tests/webdriver/tests/classic/element_send_keys/file_upload.py`

Signed-off-by: PotatoCP <Kenzie.Raditya.Tirtarahardja@huawei.com>
2025-08-08 18:38:35 +00:00
Martin Robinson
931025c16e
script: Wrap unsafe code in components/script/bindings in unsafe {} (#38544)
Clippy now checks to see if unsafe code is wrapped in unsafe blocks. We
have this lint disabled for `script` and `script_bindings` because of a
lot of legacy code that doesn't do this. The lint is useful though as it
makes it more obvious what code is unsafe. This is an incremental step
toward being able to turn this lint on for `script`.

This has the benefit of silencing warnings that show up in some IDEs
that use rust-analyzer.

Testing: This should not change behavior at all and is thus covered by
existing tests.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
2025-08-08 17:18:30 +00:00
shuppy
c9541f2906
devtools: Expose introductionType to devtools clients (#38541)
in the devtools protocol, [source
forms](https://firefox-source-docs.mozilla.org/devtools/backend/protocol.html#loading-script-sources)
announced in `resources-available-array` messages can include the
`introductionType`, which more or less mirrors the field of the same
name in SpiderMonkey’s CompileOptions.

this patch exposes `introductionType` accordingly, allowing us to check
for the correct values in automated tests.

Testing: new coverage in devtools tests
Fixes: part of #36027

---------

Signed-off-by: Delan Azabani <dazabani@igalia.com>
Co-authored-by: atbrakhi <atbrakhi@igalia.com>
2025-08-08 12:20:30 +00:00
Mukilan Thiyagarajan
23c0947072
script: make Node::xml_serialize fallible. (#38532)
Testing: [Try run][1] did not reveal any test failures. There doesn't
seem to be any straightforward failure scenarios that can be triggered
in `xml5ever` that are not IO errors and the xml_serialize method simply
serializes to a String buffer.

[1]:
https://github.com/servo/servo/actions/runs/16824267959/job/47657275606l

Signed-off-by: Mukilan Thiyagarajan <mukilan@igalia.com>
2025-08-08 11:52:59 +00:00
Martin Robinson
6651f37c05
script/compositor: Handle cursor updates from script (#38518)
Instead of using WebRender hit testing to update the cursor, base it on
layout hit tests. This allows removing the majority of WebRender hit
test items and finally opens up the possibility of adding support for
custom cursors. In addition, this change fixes an issue where cursors
were not set properly on areas of the viewport that extended past the
page content.

Testing: This is difficult to test as verifying that the cursor changed
properly is beyond the capabilities of Servo's test harnesses.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
Co-authored-by: Oriol Brufau <obrufau@igalia.com>
2025-08-07 18:49:38 +00:00
Josh Matthews
842dd99698
Update to SpiderMonkey 137. (#37077)
Incorporates the updates from https://github.com/servo/mozjs/pull/584.

Testing: Existing WPT coverage is enough.
Fixes: Part of #36258

---------

Signed-off-by: Josh Matthews <josh@joshmatthews.net>
2025-08-07 16:47:27 +00:00
Martin Robinson
ad805e3110
compositor/layout: Rely on layout for fine-grained input event hit testing (#38480)
Before, the compositor was responsible for doing the hit testing during
input events within a page. This change moves that hit testing to
layout.  With this change, epoch mismatches are no longer a bit deal and
we can simply ignore them, as the Constellation and Script will take
care of ignoring hit tests against scroll nodes and browsing contexts
that no longer exist. This means that hit testing retry support can be
removed.

Add the concept of a Script `HitTest` that transforms the coarse-grained
renderer hit test into one that hit tests against the actual layout
items.

Testing: Currently we do not have good tests for verifying the behavior
of
input events, but WebDriver tests should cover this.
Fixes: This is part of #37932.
Fixes: #26608.
Fixes: #25282.
Fixes: #38090.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
Co-authored-by: Oriol Brufau <obrufau@igalia.com>
Co-authored-by: kongbai1996 <1782765876@qq.com>
2025-08-07 08:38:43 +00:00
Euclid Ye
56033d844a
script: Rename some parent to child (#38498)
I believe there was some code migration but name's not been changed.

Testing: No behaviour change.

Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-06 17:39:38 +00:00
Martin Robinson
44a11a7c6c
script/layout: Ensure a StackingContextTree before IntersectionObserver geometry queries (#38473)
IntersectionObserver needs to be able to query node geometry without
forcing a layout. A previous layout could have run without needing a
`StackingContextTree`. In that case the layout-less query should finish
building the `StackingContextTree` before doing the query.  Add a new
type of layout API which requests that layout finishes building the
StackingContextTree.

This change also slightly simplifies and corrects the naming of
`Element` APIs around client box queries.

Testing: This should fix intermittent failures in WPT tests.
Fixes: #38380.
Fixes: #38390.
Closes: #38400.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
2025-08-06 13:46:43 +00:00
Abdelrahman Hossam
17a269a8ad
script: Implement scrollIntoView (#38230)
This is an implementation for `scrollIntoView`. For now, it is called
when a certain element gains focus.

Testing: Existing WPT tests
Fixes: #24059

Signed-off-by: abdelrahman1234567 <abdelrahman.hossameldin.awadalla@huawei.com>
2025-08-06 08:08:25 +00:00
shuppy
3eddfeaee2
script: Tell SpiderMonkey whether scripts are inline (#38363)
to use the [SpiderMonkey Debugger
API](https://firefox-source-docs.mozilla.org/js/Debugger/) as the single
source of truth about scripts and their sources for devtools purposes
(servo/servo#38334), the debugger script needs to be able to distinguish
inline scripts from other scripts, because inline scripts are a special
case where the source contents need to come from the Servo parser.

the mechanism for this is
[Debugger.Script.prototype.**introductionType**](https://firefox-source-docs.mozilla.org/js/Debugger/Debugger.Source.html#introductiontype),
which is `inlineScript` for inline scripts or a variety of other values
for other kinds of scripts, but only the embedder can provide this
information.

this patch bumps mozjs to servo/mozjs#603, which expands on
CompileOptionsWrapper, making it a safe wrapper around CompileOptions.
to construct one from safe code, use Runtime::new_compile_options().
then you can call `set_introduction_type(&'static CStr)` on the new
instance. we also make Runtime::evaluate_script() take a
CompileOptionsWrapper from the caller, instead of constructing one
internally.

in this patch, we set the introductionType to `c"inlineScript"` when
calling run_a_classic_script() and compile_module_script() for inline
scripts, and leave it unset all other cases.

Testing: will undergo automated tests in #38334
Fixes: part of #36027, part of servo/servo#38378

---------

Signed-off-by: Delan Azabani <dazabani@igalia.com>
Co-authored-by: atbrakhi <atbrakhi@igalia.com>
2025-08-05 12:41:14 +00:00
Martin Robinson
11844ca5af
layout: Add a layout hit test and use it for document.elementsFromPoint (#38463)
In #18933, hit testing was moved from layout to WebRender. This presents
some issues. For instance, the DOM can change at the same time that hit
test is happening. This can mean that hit test returns references to
defunct DOM nodes, introducing memory safety issues. Currently, Servo
will try to ensure that the epochs used for testing and those recorded
in the DOM match, but this is not very reliable and has led to code that
retries failed hit tests.

This change reintroduces (8 years later) a layout hit tester and turns
it on for `document.elementFromPoint` and `document.elementsFromPoint`.
The idea is that this hit tester will gradually replace the majority of
the WebRender hit testing happening in the renderer.

Testing: This shouldn't really change the behavior hit testing, but it
seems to improve one WPT test.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
Co-authored-by: Oriol Brufau <obrufau@igalia.com>
Co-authored-by: kongbai1996 <1782765876@qq.com>
2025-08-05 09:48:21 +00:00
Martin Robinson
3e856cbf11
layout: Introduce ReflowPhasesRun (#38467)
There were various booleans on `ReflowResults` that represented various
actions that might have been taken during a reflow request. Replace
those with a bitflags that better represents what reflow phases have
actually been run. Update variable names to reflect what they mean.

In addition, run some post-layout tasks unconditionally. They are
already contingent on the results returned from layout.

This simplifies and clarifies the code a good deal.

Testing: This should not change observable behavior and thus is covered
by existing WPT tests.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
2025-08-05 08:39:42 +00:00
shuppy
92a9d24a13
script: Add new Window globals as debuggees (#38333)
to debug the scripts in a page with the [SpiderMonkey Debugger
API](https://firefox-source-docs.mozilla.org/js/Debugger/), we need to
pass the page’s global object to
[Debugger.prototype.**addDebuggee()**](https://firefox-source-docs.mozilla.org/js/Debugger/Debugger.html#adddebuggee-global).
we could pick up the global via the [onNewGlobalObject()
hook](https://firefox-source-docs.mozilla.org/js/Debugger/Debugger.html#onnewglobalobject-global),
but if our script system passes the global to the debugger script
instead, we can later add details like the PipelineId that will help
servo identify debuggees that the API is notifying us about (#38334).

this patch plumbs new Window globals from script into addDebuggee() via
the debugger script. to call into the debugger script with structured
input, we create a new DOM event type, DebuggerEvent, that the debugger
script listens for as the “addDebuggee” event.

Testing: no testable effects yet, but will be used in #37667
Fixes: part of #36027

---------

Signed-off-by: Delan Azabani <dazabani@igalia.com>
Co-authored-by: atbrakhi <atbrakhi@igalia.com>
2025-08-05 05:48:53 +00:00
Gregory Terzian
7ad32f944f
script: allow for undefined chunks in stream piping (#38470)
Current code uses `undefined` as chunk value to identify the closing of
a stream, but this breaks once you start streaming a chunk that is
actually `undefined`, as shown in
https://github.com/servo/servo/pull/38466. This PR re-implement the
logic in a way that allows for chunks to be `undefined`.

Testing: Should maintain `streams/piping` WPT pass rates. Also makes the
`undefined` case of
[`/encoding/streams/encode-bad-chunks.any.js`](c59ee57b5d/tests/wpt/tests/encoding/streams/encode-bad-chunks.any.js (L29)),
but that is only noticeable in https://github.com/servo/servo/pull/38466
Fixes: None, but noted in https://github.com/servo/servo/pull/38466

Signed-off-by: gterzian <2792687+gterzian@users.noreply.github.com>
2025-08-04 21:42:25 +00:00
TIN TUN AUNG
778dc70181
script: fix set muted on html video element creation (#38462)
Set muted on html video element creation. On `video` element creation,
the `set_mute` function will be called before the media player is
created, hence the player will still act as not being muted. This PR fix
this behaviour by passing `muted` info after player is created as part
of `setup_media_player` process.

Testing: Locally test on Windows11
Fixes: https://github.com/servo/servo/issues/38448

---------

Signed-off-by: rayguo17 <tin.tun.aung1@huawei.com>
Signed-off-by: Jonathan Schwender <55576758+jschwe@users.noreply.github.com>
Co-authored-by: Jonathan Schwender <55576758+jschwe@users.noreply.github.com>
2025-08-04 18:57:20 +00:00
Taym Haddadi
04ec710e60
Add AsHandleValue trait to Heap<Value> and make Heap values rooted (#38024)
Encapsulates the unsafe conversion from Heap<Value> to HandleValue<'a>,
and reducing repetitive unsafe code at call.

fix #37258
2025-08-04 16:42:53 +00:00
Martin Robinson
9416251cab
script: Unify script-based "update the rendering" and throttle it to 60 FPS (#38431)
Instead of running "update the rendering" at every IPC message, only run
it when a timeout has occured in script. In addition, avoid updating the
rendering if a rendering update isn't necessary. This should greatly
reduce the amount of processing that has to happen in script.

Because we are running many fewer calls to "update the rendering" it is
reasonable now to ensure that these always work the same way. In
particular, we always run rAF and update the animation timeline when
updating the ernder

In addition, pull the following things out of reflow:

 - Code dealing with informing the Constellation that a Pipeline has
   become Idle when waiting for a screenshot.
 - Detecting when it is time to fulfill the `document.fonts.ready`
   promise.

The latter means that reflow can never cause a garbage collection,
making timing of reflows more consistent and simplifying many callsites
that need to do script queries.

Followup changes will seek to simplify the way that ScriptThread-driven
animation timeouts happen even simpler.

Testing: In general, this should not change testable behavior so much,
though it
does seem to fix one test.  The main improvement here should be that
the ScriptThread does less work.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
Co-authored-by: Oriol Brufau <obrufau@igalia.com>
2025-08-04 16:27:00 +00:00
Leo Ring
26d2d0f7d8
Add can_gc to HTMLDocument NamedGetter (#38455)
Just fixing something missed on my last PR
https://github.com/servo/servo/pull/38433#discussion_r2250744925

Signed-off-by: Leo Ring <leoring03@gmail.com>
2025-08-04 11:41:53 +00:00
Leo Ring
79a45c7da3
Implement HTMLDocument API (#38433)
This updates the pull request from here
https://github.com/servo/servo/pull/32553 that looks to be dormant. The
main change is that I've switched out `reflector` with `document` based
off this suggestion
https://github.com/servo/servo/pull/32553#issuecomment-2179568743, and
the `GetLocation` and `SupportedPropertyNames` methods pass through the
values from `Document`.

The implementation details are otherwise the same as the original PR

Testing: I don't see any WPT tests for this feature, I could make a
custom test if desired
Fixes: https://github.com/servo/servo/issues/32536

---------

Signed-off-by: Leo Ring <leoring03@gmail.com>
2025-08-04 03:42:54 +00:00
Tim van der Lippe
dbb886fad2
Implement initial version of navigator.sendBeacon (#38301)
Gated behind the feature flag `dom_navigator_sendbeacon_enabled` as the
`keep-alive` fetch parameter is crucial for real-life use cases such as
analytics requests.

Part of #4577
Part of #38302

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
2025-08-02 15:14:07 +00:00
Euclid Ye
ee1bfa61ce
script: Lazy init and reuse const BOOLEAN_ATTRIBUTES (#38423)
Follow up of  #38401.
- The constant String array was recreated for every invocation. Chromium
store this as a global const.
https://source.chromium.org/chromium/chromium/src/+/main:chrome/test/chromedriver/element_commands.cc;l=48-94?q=chrome%2Ftest%2Fchromedriver%2Felement_commands.cc
We now use static `LazyLock` to lazy init and avoid recreation.
- Clean up some comments

Testing: Just refactor.

---------

Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-02 02:45:52 +00:00
Gregory Terzian
5ac9f40625
script: in stream piping, ensure the heap is set only after it has been moved (#38385)
Setting a value on a `Heap` requires the heap to not be moved after the
call to `set`, the current code sets the value first, then moves it into
the `shutdown_error` refcell. It should be the other way around.

Testing: the core logic is covered by WPT tests, which should remain
unchanged.
 
Fixes: [38299](https://github.com/servo/servo/issues/38299)

---------

Signed-off-by: gterzian <2792687+gterzian@users.noreply.github.com>
2025-08-01 10:55:17 +00:00
Kingsley Yung
5e8754bb1d
webdriver: consider boolean attribute when get element attribute (#38401)
The function handle_get_attribute should act differently when the
attribute is a boolean attribute.

The full list of attributes can be found in [1]. All attributes marked
as "Boolean attribute" in the "Value" column are boolean attributes.
Note that "hidden" is effectively treated as a boolean attribute,
according to WPT test "test_global_boolean_attributes" in
webdriver/tests/classic/get_element_attribute/get.py

[1] https://html.spec.whatwg.org/multipage/#attributes-3

Testing: Updated WPT test expectation
Fixes: #38353

---------

Signed-off-by: Kingsley Yung <kingsley@kkoyung.dev>
2025-08-01 08:44:26 +00:00
Kenzie Raditya Tirtarahardja
05ad9026f5
cargo: Upgrade keyboard-types to 0.8.0 and xcomponent-sys to 0.3.4 (#38375)
With some adjustment for `NamedKey`. The two crates need to be bumped
together to avoid duplicate of `keyboard-types` action.

---------

Signed-off-by: PotatoCP <Kenzie.Raditya.Tirtarahardja@huawei.com>
2025-08-01 08:14:38 +00:00
Jo Steven Novaryo
a063b5e78a
script: Fire scroll event whenever JS scrolled (#38321)
Implement JS scroll event firing compliant to
https://drafts.csswg.org/cssom-view/#scrolling-events. Basically
whenever, the an element or the viewport is scrolled, we will fire a
scroll event. The changes push a scroll event whenever an API causes a
scroll position to change.

Testing: New WPT tests for basic APIs.
Part of: https://github.com/servo/servo/issues/31665

---------

Signed-off-by: Jo Steven Novaryo <jo.steven.novaryo@huawei.com>
2025-08-01 07:30:22 +00:00
shuppy
c09e117bfe
script: Create a debugger script for the SpiderMonkey Debugger API (#38331)
to use the [SpiderMonkey Debugger
API](https://firefox-source-docs.mozilla.org/js/Debugger/), we need to
call it from an internal debugger script that we will supply. this
script must run in the same runtime as the debuggee(s), but in a
separate
[compartment](https://udn.realityripple.com/docs/Mozilla/Projects/SpiderMonkey/Compartments)
([more
details](https://hacks.mozilla.org/2020/03/future-proofing-firefoxs-javascript-debugger-implementation/)).

this patch defines a new DebuggerGlobalScope type and a new debugger
script resource. when creating each script thread, we create a debugger
global, load the debugger script from resources/debugger.js, and run
that script in the global to initialise the Debugger API.

subsequent patches will use the debugger script as an RPC mechanism for
the Debugger API.

Testing: no testable effects yet, but will be used in #37667
Fixes: part of #36027

---------

Signed-off-by: Delan Azabani <dazabani@igalia.com>
Co-authored-by: atbrakhi <atbrakhi@igalia.com>
2025-07-31 06:17:23 +00:00
batu_hoang
37ac4ffeb4
Rework on webdriver wait for navigation complete (#38234)
For current implementation, when a command may trigger a navigation,
webdriver only waits for document readiness state.
However, not all navigations make change in document.
This PR handles more cases for waiting for a navigation, and apply to
`element_click`.

- Before sending a command which may trigger a navigation, `webdriver`
sets `load status send` to `embedder`, `constelltation` and `script
thread` to listen to `navigation events`.
- Webdriver check if there is a navigation with `script thread`.
- If the navigation is loading a new url, webdriver checks if the
request is approved with `constellation`, then waits for document
readiness state.
- If the navigation is a hashchange, webdriver waits untill all new
generated dom events have been processed.

Testing: 
`tests/wpt/tests/webdriver/tests/classic/element_click/navigate.py`
`tests/wpt/tests/webdriver/tests/classic/element_click/user_prompts.py`
https://github.com/longvatrong111/servo/actions/runs/16488690749

cc: @xiaochengh

---------

Signed-off-by: batu_hoang <hoang.binh.trong@huawei.com>
2025-07-30 07:24:07 +00:00
minghuaw
554b2da1ad
Script: Implement TextDecoderStream (#38112)
This PR implements the `TextDecoderStream`. Other than introducing the
necessary mod and webidl files corresponding to `TextDecoderStream`,
this PR also involves some changes in `TextDecoder` and
`TrasnformStream`:

- The common part that can be shared between `TextDecoder` and
`TextDecoderStream` are extracted into a separate type
`script::dom::textdecodercommon::TextDecoderCommon`. This type could
probably use a different name because there is an interface called
`TextDecoderCommon` in the spec
(https://encoding.spec.whatwg.org/#textdecodercommon) which just gets
included in `TextDecoder` and `TextDecoderStream`.
- The three algorithms in `TransformStream` (`cancel`, `flush`, and
`transform`) all have become `enum` that has a `Js` variant for a JS
function object and a `Native` variant for a rust trait object. Whether
the cancel algorithm needs this enum type is debatable as I did not find
any interface in the spec that explicitly sets the cancel algorithm.

Testing: Existing WPT tests `tests/wpt/tests/encoding/stream` should be
sufficient
Fixes: #37723

---------

Signed-off-by: minghuaw <michael.wu1107@gmail.com>
Signed-off-by: minghuaw <wuminghua7@huawei.com>
Signed-off-by: Minghua Wu <michael.wu1107@gmail.com>
2025-07-29 04:18:15 +00:00
sagudev
d410236c87
canvas: Send CanvasClose to canvas thread from canvas state (#38315)
Currently we only closed `CanvasRenderingContext2D` (and
`OffscreenCanvasRenderingContext2D` because it wraps
`CanvasRenderingContext2D`), but we didn't close last consumer of
`CanvasState` which is `PaintRenderingContext`. To prevent any future
leaks, let's just send `CanvasClose` in `CanvasState` drop.

Testing: Existing WPT tests

---------

Signed-off-by: sagudev <16504129+sagudev@users.noreply.github.com>
2025-07-28 20:09:47 +00:00
sagudev
ae69646371
canvas: Make 2D context state creation failable and use dom_canvas_backend pref for backend selection (#38310)
Before script just crashed in those cases because IPCSender was dropped,
now we send `None` to tell script about the failure and fail getContext
or registerPainter accordingly.
This PR also unifies `dom_canvas_{backends}_enabled` prefs into
`dom_canvas_backend` which is more flexible in multi-backends scenarios.

Reviewable per commit.

Testing: Added servo specific WPT test.

---------

Signed-off-by: sagudev <16504129+sagudev@users.noreply.github.com>
2025-07-28 09:13:07 +00:00
Kingsley Yung
ab6e151c89
script_binding: wrapper of JSAutoStructuredCloneBuffer (#38284)
Instead of using raw pointer of JSAutoStructuredCloneBuffer, use its
wrapper JSAutoStructuredCloneBufferWrapper, which implements the Drop
trait that can prevent leakage when structured cloning fails.

Testing: Refactoring. Existing tests should be enough.
Fixes: #37966

---------

Signed-off-by: Kingsley Yung <kingsley@kkoyung.dev>
2025-07-27 12:41:02 +00:00