Commit graph

8367 commits

Author SHA1 Message Date
Ashwin Naren
9d5aa9973a
webcrypto: implement raw hmac export (#39059)
Implement raw export of HMAC keys. JWT export of HMAC keys will come in
a separate PR.

Testing: WPT
Fixes: Partially #39060

---------

Signed-off-by: Ashwin Naren <arihant2math@gmail.com>
2025-09-01 05:34:29 +00:00
Oriol Brufau
6e92e1d7d5
layout: Avoid setting baseline for phantom line boxes (#39055)
Phantom line boxes should be treated as non-existing for most purposes,
so don't let them affect the baseline of their block container.

Testing: An existing test passes, and also adding a new one which
doesn't rely on `<button>`

Signed-off-by: Oriol Brufau <obrufau@igalia.com>
2025-09-01 02:52:17 +00:00
Ashwin Naren
91b2ab5458
indexeddb: Implement autoincremented keys and report autoincrementedness properly through DOM interface (#38723)
Autoincrementedness was previously being reported as always false. This
PR makes the state become queried from the backend, as the spec
specifies. Additionally this PR ensures the backend correctly handles an
object store which autoincrements.

Testing: WPT
Fixes: None

---------

Signed-off-by: Ashwin Naren <arihant2math@gmail.com>
2025-08-31 03:54:18 +00:00
Servo WPT Sync
ce35161a6e
Sync WPT with upstream (31-08-2025) (#39049)
Automated downstream sync of changes from upstream as of 31-08-2025
[no-wpt-sync]

Signed-off-by: WPT Sync Bot <ghbot+wpt-sync@servo.org>
2025-08-31 01:40:16 +00:00
Kingsley Yung
4571cc1b3b
script: Initialize IDBCursor and IDBCursorWithValue interfaces (#38850)
Testing: Update WPT test expectation
Fixes: Part of #38111

---------

Signed-off-by: Kingsley Yung <kingsley@kkoyung.dev>
2025-08-30 14:33:01 +00:00
Kot
2e1b2e7260
script: Clear all associated event listeners when removing an event listener content attribute. (#39011)
This change allows callers of `remove_event_listener` to specify `None`
for the `options` argument to skip phase (bubble/capture) checking (and
remove either type of listener).

Notably, this changes the HTMLElement `attribute_mutated` code to remove
all event listeners rather than ones with just `capture: false`, which
should be [correct
behavior](https://html.spec.whatwg.org/multipage/webappapis.html#deactivate-an-event-handler).

Testing: `mach try linux-wpt`:
https://github.com/kotx/servo/actions/runs/17313405730
Fixes: https://github.com/servo/servo/issues/38742

---------

Signed-off-by: Kot <kot@kot.pink>
2025-08-30 05:38:32 +00:00
Sam
8beef6c21f
compositor: Allow canvas to upload rendered contents asynchronously (#37776)
Adds epoch to each WR image op command that is sent to compositor. The
renderer now has a `FrameDelayer` data structure that is responsible for
tracking when a frame is ready to be displayed. When asking canvases to
update their rendering, they are given an optional `Epoch` which denotes
the `Document`'s canvas epoch. When all image updates for that `Epoch`
are seen in the renderer, the frame can be displayed.

Testing: Existing WPT tests
Fixes: #35733

Signed-off-by: sagudev <16504129+sagudev@users.noreply.github.com>
Signed-off-by: Martin Robinson <mrobinson@igalia.com>
Co-authored-by: Martin Robinson <mrobinson@igalia.com>
2025-08-29 10:04:41 +00:00
Euclid Ye
8305064522
webdriver: Improve parsing of Frame and Window (#39012)
In #38745, we changed the id of Frame and Window as the result of
`ToString` trait. This PR
- adapts the parsing of frame/window accordingly.
- for frame, return the
[WindowProxy](https://developer.mozilla.org/en-US/docs/Web/API/WindowProxy)
object of the iframe as it's supposed to do.

Testing: `execute_{async_}script/arguments.py`

---------

Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-29 09:37:48 +00:00
Tim van der Lippe
6205c07114
Disallow invalid trusted type policy names (#38886)
Actual fix is in the CSP crate.

Part of #36258

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
2025-08-28 17:49:33 +00:00
Gae24
908c392219
XMLHttpRequest Send: fix Content-Type failures (#38993)
Replaced usage of `typed_insert` since it ended converting `UTF-8` to
lowercase.
Removed one of the test cases since it wasn't following spec since
[xhr/205](https://github.com/whatwg/xhr/pull/205).

Testing: Changes covered by wpt
Fixes: #20436

---------

Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com>
2025-08-28 12:44:42 +00:00
Martin Robinson
cb64def7e6
canvas: Move font selection and text shaping to script (#38979)
Instead of doing font selection and text shaping in `canvas`, move this
to `script`. This allows canvas to use the shared `Document`
`FontContext`, which has access to web fonts. In addition, ensure that
there is a font style accessible for `OffscreenCanvas` in workers.

Testing: This causes a number of WPT tests to start to pass as web fonts
are
supported on canvas again. In addition, some start to fail as they
expose other
issues:
 - The lack of support for the `Context2D.fontStretch` property
 - Issues with zerosize gradient interpolation.
- Differences between quoted and unquoted font family names. This seems
like
a timing issue with the way we are handling web fonts. The test seems to
be
expecting Local fonts to be available immediately (without waiting for
them
to load). This isn't how Servo works ATM. Seems like an issue with the
test.

Signed-off-by: Martin Robinson <mrobinson@igalia.com>
2025-08-28 10:30:34 +00:00
Ashwin Naren
91b27d98a2
script: correctly handle indexeddb backend errors (#38740)
Sets the indexeddb request error when the backend errors out. This also
matches statements to the spec.

Testing: Covered by WPT
Fixes: General indexeddb

---------

Signed-off-by: Ashwin Naren <arihant2math@gmail.com>
Co-authored-by: Josh Matthews <josh@joshmatthews.net>
2025-08-28 07:49:17 +00:00
Euclid Ye
3ac226e841
script: Support decomposing ShadowRoot from mozjs HandleValue (#38984)
- Add `ShadowRoot` to `JSValue` to avoid
`WebDriverJSError::UnknownType`, and
`JavaScriptEvaluationError::SerializationError` when execute JS from
embedder.
- Add unit test.
- Move [is_detached](https://w3c.github.io/webdriver/#dfn-is-detached)
to `fn is_detached` to be reused.
- Other random simplification.

Testing: WebDriver conformance tests.

---------

Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-28 04:31:06 +00:00
Sebastian C
e5c83ec419
script: Do not include fragments when comparing URLs in CookieStore (#38876)
Fixes a check for empty options in `getAll(options)` and makes url
comparison with exclude fragments set to true.

Testing: New passing WPT tests
Part of #37674

---------

Signed-off-by: Sebastian C <sebsebmc@gmail.com>
2025-08-27 23:41:11 +00:00
Tim van der Lippe
84f478a47a
Implement trusted types processing for JavaScript URL (#38623)
We pass in the new trait implementation to process the value,
which the CSP crate calls in its implementation. Additionally,
since the request url can change, we need to propagate that
to load_data as well.

This also avoids a crash when a discarded browsing context is
accessed while navigating the iframes in the WPT tests. This
is a known issue, but hampers investigation into actual
Trusted Types support.

All tests using iframes don't work, as they don't have the
correct browsing context. The other tests do work, but some
fail on header ascii parsing (#36801) or error while handling
errors. That last one I don't understand based on the current
code and I would need to do a deep-dive in the existing code
to understand better what's going on.

Part of #36258
Part of #37920

---------

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
2025-08-27 21:53:18 +00:00
Simon Wülker
04dd74dddb
script: Support custom element states (#38564)
Also adds support for `:state`.

Testing: Covered by existing tests

---------

Signed-off-by: Simon Wülker <simon.wuelker@arcor.de>
2025-08-27 17:25:16 +00:00
Simon Wülker
dcd25072d3
script: Load and rasterize favicons before passing them to the embedder (#38949)
Currently the embedding API only provides the embedder with the URL for
a favicon. This is not great, for multiple reasons:
* Loading the icon should happen according to the fetch spec which is
not easy for the embedder to recreate (consider CSP, timing information
etc)
* Rasterizing a svg favicon is not trivial

With this change, servo fetches and rasterizes the icon to a bitmap
which is then passed to the embedder.

Testing: I'm not sure how I can write tests for the embedding api. I've
tested the correctness manually using
https://github.com/servo/servo/pull/36680.
Prepares for https://github.com/servo/servo/pull/36680

---------

Signed-off-by: Simon Wülker <simon.wuelker@arcor.de>
2025-08-27 14:28:42 +00:00
araya
ebaf78116a
net: Ignore pragma: no-cache if cache-control is understood (#38946)
This PR fixes a failed WPT:
https://wpt.fyi/results/fetch/http-cache/pragma-no-cache-with-cache-control.html?product=servo

[As RFC9111
mentions,](https://www.rfc-editor.org/rfc/rfc9111.html#section-5.4) the
Pragma header field is deprecated. And, in WPT, it expects the Pragma
header field is ignored if a cache-control header field is specified and
understood by UA.



Testing: running `./mach test-wpt
fetch/http-cache/pragma-no-cache-with-cache-control.html`

---------

Signed-off-by: araya <araya@araya.dev>
2025-08-27 10:11:45 +00:00
Sam
3dc9184121
canvas: Use vello_cpu as default canvas backend (#38844)
We really want to remove font-kit from dep tree, so this is the first
step into removing raqote from servo. While vello_cpu is not perfect
replacement, I am confident that we will resolve all issues eventually:
https://github.com/servo/servo/issues/38345 (most important ones already
have PRs).

Reviewable per commit.

Testing: Existing WPT tests.
Try run: https://github.com/sagudev/servo/actions/runs/17138369290

---------

Signed-off-by: sagudev <16504129+sagudev@users.noreply.github.com>
2025-08-27 07:22:20 +00:00
Tim van der Lippe
3708d493b9
script: Implement trusted types for Range.createContextualFragment (#38874)
Part of #36258

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
2025-08-27 06:18:04 +00:00
Tim van der Lippe
d94929dbed
script: Implement trusted types for DOMParser.parseFromString (#38872)
Part of #36258

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
2025-08-27 06:10:16 +00:00
dependabot[bot]
c2f664d16e
build(deps): bump data-url from 0.3.1 to 0.3.2 (#38862)
Bumps [data-url](https://github.com/servo/rust-url) from 0.3.1 to 0.3.2.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/servo/rust-url/commits">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=data-url&package-manager=cargo&previous-version=0.3.1&new-version=0.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Martin Robinson <mrobinson@igalia.com>
Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Martin Robinson <mrobinson@igalia.com>
Co-authored-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-27 03:22:13 +00:00
Jo Steven Novaryo
10ca3b6fde
layout: Parameterize content box query (#38935)
Parameterize and rename both `Layout::content_box_query` and
`Layout::content_boxes_query` to support the query of rendered padding
area and content area that accounts for transform and scroll. Both of
these query have been misleading for a time since they are using border
box, instead of content box of a Node.

This PR adds a new type `layout_api::BoxAreaType` to be passed from
`ScriptThread` to `LayoutThread` to query the respective area. It is
then used for the query within `IntersectionObserver` to pass several
WPTs.

Testing: Existing WPT Coverage.

---------

Signed-off-by: Jo Steven Novaryo <jo.steven.novaryo@huawei.com>
2025-08-27 02:27:53 +00:00
Simon Wülker
c4dcd17214
Update image to 0.25 (#38950)
Testing: These changes should be covered by existing web platform tests
and `image`'s own test suite.

---------

Signed-off-by: Simon Wülker <simon.wuelker@arcor.de>
2025-08-27 00:51:14 +00:00
Euclid Ye
26fb603d15
script: Fix wrong procedure when deserializing JSValue from mozjs HandleValue (#38943)
Spec: https://w3c.github.io/webdriver/#dfn-internal-json-clone

This PR 
1. moves [clone an
object](https://w3c.github.io/webdriver/#dfn-clone-an-object) to `fn
clone_an_object` to make things clearer.
2. Fixes the bug where we wrongly put `element` and `WindowProxy` as
part of [clone an
object](https://w3c.github.io/webdriver/#dfn-clone-an-object), which
leads to false-positive `JSError` before.
3. Update spec links to correct ones.

Testing: New passing in `{execute_async_script,execute_script}/node.py`

---------

Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-26 13:48:48 +00:00
Tim van der Lippe
d38533530b
script: Add remaining unique element event listeners (#38888)
This adds the remaining window as well as specific svg and animation
listeners. The test suite was erroring before, as we don't implement
`SVGAnimationElement` yet. Now, the test gracefully checks if the
interface exists before doing a lookup.

Part of #36258

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
2025-08-26 06:51:27 +00:00
Gregory Terzian
ddf5f1eb2f
script: when handling page headers, stop if pipeline closed already (#38739)
Previously, the script-thread would assert the pipeline was closed if no
pending load was found, but it did not check whether the pipeline was
closed before processing the page headers. Since incomplete loads are
removed only when page headers are processed, this means the page
headers were processed even if the pipeline had been closed before the
page headers were available. If the pipeline had been closed as part of
exiting the constellation, it was possible for the constellation to have
exited by the time the page headers became available(since the
script-thread closes a pipeline independently from ongoing navigation
fetches), which would produce a panic on trying to communicate with the
constellation to obtain the browsing context info.

Note: due to the nature of the problem, I cannot verify that this fixes
the crash test, although logically this appears to make sense, and a
couple of days of WPT runs should tell us more.

Testing: A crash test was added; unfortunately the crash was
intermittent.
Fixes: https://github.com/servo/servo/issues/36747

---------

Signed-off-by: gterzian <2792687+gterzian@users.noreply.github.com>
2025-08-25 19:04:39 +00:00
Euclid Ye
0b5bcfbf17
webdriver: Focus when "switch to window" (#38889)
Add logic that was accidentally removed in #38745. Otherwise it is very
weird when using webdriver as a human, as we still stays on the original
tab.

Testing: ~this should not affect any test. Even if the tab is not
"visible" previously, all programmatic interaction works fine.~ Stably
pass `test_history_pushstate` in `back.py` and `forward.py`.

---------

Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-24 13:36:58 +00:00
dependabot[bot]
71db9494bb
build(deps): bump url from 2.5.3 to 2.5.6 (#38879)
Bumps [url](https://github.com/servo/rust-url) from 2.5.3 to 2.5.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/servo/rust-url/releases">url's
releases</a>.</em></p>
<blockquote>
<h2>v2.5.5</h2>
<h2>What's Changed</h2>
<ul>
<li>ci: downgrade crates when building for Rust 1.67.0 by <a
href="https://github.com/mxinden"><code>@​mxinden</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1003">servo/rust-url#1003</a></li>
<li>ci: run unit tests with sanitizers by <a
href="https://github.com/mxinden"><code>@​mxinden</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1002">servo/rust-url#1002</a></li>
<li>fix small typo by <a
href="https://github.com/hkBst"><code>@​hkBst</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1011">servo/rust-url#1011</a></li>
<li>chore: fix clippy errors on main by <a
href="https://github.com/dsherret"><code>@​dsherret</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1019">servo/rust-url#1019</a></li>
<li>perf: remove heap allocation in parse_query by <a
href="https://github.com/dsherret"><code>@​dsherret</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1020">servo/rust-url#1020</a></li>
<li>perf: slightly improve parsing a port by <a
href="https://github.com/dsherret"><code>@​dsherret</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1022">servo/rust-url#1022</a></li>
<li>perf: improve to_file_path() by <a
href="https://github.com/dsherret"><code>@​dsherret</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1018">servo/rust-url#1018</a></li>
<li>perf: make parse_scheme slightly faster by <a
href="https://github.com/dsherret"><code>@​dsherret</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1025">servo/rust-url#1025</a></li>
<li>update LICENSE-MIT by <a
href="https://github.com/wmjae"><code>@​wmjae</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1029">servo/rust-url#1029</a></li>
<li>perf: url encode path segments in longer string slices by <a
href="https://github.com/dsherret"><code>@​dsherret</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1026">servo/rust-url#1026</a></li>
<li>Disable the default features on serde by <a
href="https://github.com/rilipco"><code>@​rilipco</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1033">servo/rust-url#1033</a></li>
<li>docs: base url relative join by <a
href="https://github.com/tisonkun"><code>@​tisonkun</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1013">servo/rust-url#1013</a></li>
<li>perf: remove heap allocation in parse_host by <a
href="https://github.com/dsherret"><code>@​dsherret</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1021">servo/rust-url#1021</a></li>
<li>Update tests to Unicode 16.0 by <a
href="https://github.com/hsivonen"><code>@​hsivonen</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1045">servo/rust-url#1045</a></li>
<li>Add some some basic functions to <code>Mime</code> by <a
href="https://github.com/mrobinson"><code>@​mrobinson</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1047">servo/rust-url#1047</a></li>
<li>ran <code>cargo clippy --fix -- -Wclippy::use_self</code> by <a
href="https://github.com/mrobinson"><code>@​mrobinson</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1048">servo/rust-url#1048</a></li>
<li>Fix MSRV and clippy CI by <a
href="https://github.com/Manishearth"><code>@​Manishearth</code></a> in
<a
href="https://redirect.github.com/servo/rust-url/pull/1058">servo/rust-url#1058</a></li>
<li>Update <code>Url::domain</code> docs to show that it includes
subdomain by <a
href="https://github.com/supercoolspy"><code>@​supercoolspy</code></a>
in <a
href="https://redirect.github.com/servo/rust-url/pull/1057">servo/rust-url#1057</a></li>
<li>set_hostname should error when encountering colon ':' by <a
href="https://github.com/edgul"><code>@​edgul</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1060">servo/rust-url#1060</a></li>
<li>version bump to 2.5.5 by <a
href="https://github.com/edgul"><code>@​edgul</code></a> in <a
href="https://redirect.github.com/servo/rust-url/pull/1061">servo/rust-url#1061</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mxinden"><code>@​mxinden</code></a> made
their first contribution in <a
href="https://redirect.github.com/servo/rust-url/pull/1003">servo/rust-url#1003</a></li>
<li><a href="https://github.com/hkBst"><code>@​hkBst</code></a> made
their first contribution in <a
href="https://redirect.github.com/servo/rust-url/pull/1011">servo/rust-url#1011</a></li>
<li><a href="https://github.com/wmjae"><code>@​wmjae</code></a> made
their first contribution in <a
href="https://redirect.github.com/servo/rust-url/pull/1029">servo/rust-url#1029</a></li>
<li><a href="https://github.com/rilipco"><code>@​rilipco</code></a> made
their first contribution in <a
href="https://redirect.github.com/servo/rust-url/pull/1033">servo/rust-url#1033</a></li>
<li><a href="https://github.com/tisonkun"><code>@​tisonkun</code></a>
made their first contribution in <a
href="https://redirect.github.com/servo/rust-url/pull/1013">servo/rust-url#1013</a></li>
<li><a
href="https://github.com/supercoolspy"><code>@​supercoolspy</code></a>
made their first contribution in <a
href="https://redirect.github.com/servo/rust-url/pull/1057">servo/rust-url#1057</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/servo/rust-url/compare/v2.5.4...v2.5.5">https://github.com/servo/rust-url/compare/v2.5.4...v2.5.5</a></p>
<h2>v2.5.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Revert &quot;Normalize URL paths: convert /.//p, /..//p, and //p to
p (<a
href="https://redirect.github.com/servo/rust-url/issues/943">#943</a>)&quot;
by <a href="https://github.com/valenting"><code>@​valenting</code></a>
in <a
href="https://redirect.github.com/servo/rust-url/pull/999">servo/rust-url#999</a></li>
<li>Updates the MSRV to 1.63 required though the libc v0.2.164
dependency</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/servo/rust-url/compare/v2.5.3...v2.5.4">https://github.com/servo/rust-url/compare/v2.5.3...v2.5.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/servo/rust-url/commits">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=url&package-manager=cargo&previous-version=2.5.3&new-version=2.5.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Martin Robinson <mrobinson@igalia.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Martin Robinson <mrobinson@igalia.com>
2025-08-24 11:27:40 +00:00
Servo WPT Sync
fa42968a61
Sync WPT with upstream (24-08-2025) (#38893)
Automated downstream sync of changes from upstream as of 24-08-2025
[no-wpt-sync]

Signed-off-by: WPT Sync Bot <ghbot+wpt-sync@servo.org>
2025-08-24 01:41:18 +00:00
Josh Matthews
b7cdd88b8e
IndexedDB: Handle missing object stores in object store operations (#38115)
These changes fix a large number of panics that can manifest as
intermittent test failures. They also add more specification text to
various IDBObjectStore methods and implement missing steps that check
for whether an object store is deleted.

Testing: Existing test coverage.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>
2025-08-22 22:04:34 +00:00
Tim van der Lippe
f334a56b07
Remove event handlers when attribute is removed (#38734)
We wouldn't handle the AttributeMutation::Removed for
attribute event listeners and wouldn't remove the
corresponding event listener. Added the necessary
logic (using the newly EventTarget::is_content_event_handler
to correctly only do this for known event handlers) and
added links to the relevant parts of the spec.

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
2025-08-22 19:43:04 +00:00
Tim van der Lippe
10ac177aa5
Propagate Trusted Types errors for Node.textContent (#38871)
Part of #36258

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
2025-08-22 19:41:50 +00:00
Abdelrahman Hossam
176e42d36d
script: Add FocusOptions argument to Element.focus and implement FocusOptions.preventScroll (#38495)
This is an implementation of the `prevent_scroll` feature in the focus
transaction system. It allows to control whether focusing an element
should prevent scrolling or not.

Spec:
https://html.spec.whatwg.org/multipage/interaction.html#dom-focusoptions-preventscroll
Testing: Existing WPT tests

Signed-off-by: abdelrahman1234567 <abdelrahman.hossameldin.awadalla@huawei.com>
2025-08-22 14:05:32 +00:00
Shubham Gupta
09db6b8669
layout: Remove workaround for body while building overflow frame for StackingContextTree construction. (#38825)
While building the stacking context tree we were assuming that `<body>`
would have propagated its `overflow` value to the viewport, and thus its
used `overflow` would be `visible`.

However, the element that propagates `overflow` can be the root element
instead. Since #38598 we are correctly taking this into account in
`effective_overflow()`, so we no longer need to do anything special in
the stacking context logic.

Testing: `css/css-overflow/overflow-body-propagation-012.html`

Fixes: #38799

Signed-off-by: Shubham Gupta <shubham13297@gmail.com>
2025-08-22 07:59:02 +00:00
Euclid Ye
66adf2bf9f
webdriver: Consider shadow including descendant when computing "obscured" step of “element click” (#38841)
Testing: WebDriver Conformance test. In addition to fixing all "Element
Intercepted" errors in
https://github.com/yezhizhen/servo/actions/runs/17142506541, we are able
to fix many other tests.
Fixes: #38837

---------

Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-22 07:22:00 +00:00
Kenzie Raditya Tirtarahardja
cae8d22823
webdriver: Element Send keys use dispatch actions for KeyboardEvent (#38444)
Previously we immediately passed the KeyboardEvent to embedder. Now we
make element send keys go through the dispatch action which required by
spec. CompositionEvent still immediately passed through embedder

Testing: Should make
`./tests/wpt/tests/webdriver/tests/classic/element_send_keys/` more
stable.
Fixes: https://github.com/servo/servo/issues/38354
Fixes: https://github.com/servo/servo/issues/38442

---------

Signed-off-by: PotatoCP <Kenzie.Raditya.Tirtarahardja@huawei.com>
Co-authored-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-22 05:20:54 +00:00
Gregory Terzian
ede9db2e18
script: abort planned form navigations (#38676)
Servo shows a behavior unlike FF and Safari(I don't have Chrome), where
stopping a window does not cancel planned form navigation, resulting in
an infinite navigation loop. The current behavior of Servo does seem to
follow the wording of the spec, so I will open a [companion issue at the
spec](https://github.com/whatwg/html/issues/11562), and I have also
written a WPT tests for the non-standard but widely followed behavior.
This PR also adds a beginning of an implementation of the "ongoing
navigation" concept, which is used by the spec to cancel navigations,
and which is used in this PR only to cancel planned form navigations.
The generation id concept, which corresponds to the planned navigation
concept in the spec, is turned into a simple struct private cell, and is
documented per the spec.

Testing: A new WPT test is added
Fixes: Only one part of https://github.com/servo/servo/issues/36747

---------

Signed-off-by: gterzian <2792687+gterzian@users.noreply.github.com>
Signed-off-by: Gregory Terzian <2792687+gterzian@users.noreply.github.com>
Co-authored-by: Martin Robinson <mrobinson@igalia.com>
2025-08-22 05:02:53 +00:00
lumiscosity
39f3ce7a2e
Make DOM geometry structs serializable (#38828)
Makes the following DOM geometry structs serializable:
- `DOMRect`
- `DOMRectReadOnly`
- `DOMQuad`
- `DOMMatrix`
- `DOMMatrixReadOnly`

Testing: Covered by WPT (`css/geometry/structured-serialization.html`).

---------

Signed-off-by: lumiscosity <averyrudelphe@gmail.com>
2025-08-21 23:19:42 +00:00
Ashwin Naren
f30be4e1ab
Stub out IDBIndex (#38813)
Stubs the IDBIndex interface.

Testing: Mostly stubbing. Eventually covered by WPT.
Fixes: Partially #38100

---------

Signed-off-by: Ashwin Naren <arihant2math@gmail.com>
2025-08-21 22:54:19 +00:00
Josh Matthews
18230e9630
indexeddb: Initialize DB version to zero. (#38819)
None of our automated tests were executing the initial DB setup code
because the requested version always matched.

Testing: Existing WPT coverage.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>
2025-08-21 22:49:57 +00:00
batu_hoang
bce9f06cf8
webdriver: Refactor webdriver session and improve window handles (#38745)
This PR contains 2 parts:

1. Refactor webdriver session.
2. Improve webdriver window handles:
- Webdriver always get window handles from script thread by default.
- If script thread is blocked by user prompt, embedder stores the window
handle before user prompt appears, then webdriver can get window handle
from embedder.

Testing: Clear timeout cause by user prompt blocking script thread:
https://github.com/longvatrong111/servo/actions/runs/17033900026

---------

Signed-off-by: batu_hoang <hoang.binh.trong@huawei.com>
Signed-off-by: batu_hoang <longvatrong111@gmail.com>
Co-authored-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-21 22:46:13 +00:00
Jo Steven Novaryo
5cb1f37843
layout: Stretch <input> inner container to its containing block (#38775)
The `<input>` element inner container should be stretch to its
containing block. This would allow the alignment of the text. This is
done by adding `min-width: 100%`. It is required because we are not
using a custom layout contrary to Firefox and Chrome.

Testing: New Servo specific WPT.

---------

Signed-off-by: Jo Steven Novaryo <jo.steven.novaryo@huawei.com>
2025-08-21 07:26:32 +00:00
lumiscosity
913066d2e5
Add legacy window aliases SVGMatrix/SVGPoint for DOMMatrix/DOMPoint (#38810)
Adds the legacy window aliases `SVGMatrix`/`SVGPoint` for
`DOMMatrix`/`DOMPoint`.

Testing: Covered by WPT (`css/geometry`).

---------

Signed-off-by: lumiscosity <averyrudelphe@gmail.com>
2025-08-21 07:19:25 +00:00
Tim van der Lippe
3c89763b77
Implement trusted types for remaining attribute sinks (#38784)
Additionally, several methods were updated with
spec comments. That's because the "adopt the document
from the element document" step was missing.

By adding these spec comments, I also restructured
some code to avoid duplication of mutation records
and custom element reaction queueing.

Node.textContent doesn't propagate the error yet,
as that method has a lot of separate callers of
elements that wouldn't fail. I will refactor those
in a follow-up PR to keep things manageable.

This implements part of the DOM integration from
https://github.com/whatwg/dom/pull/1268

Part of #36258

---------

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
Signed-off-by: Tim van der Lippe <TimvdLippe@users.noreply.github.com>
2025-08-21 05:37:34 +00:00
Ashwin Naren
dd7b2a5ee2
Enable access to transaction from idbobjectstore (#38737)
Adds the transaction property to IDBObjectStore, as per spec.

Testing: WPT
Fixes: None

---------

Signed-off-by: Ashwin Naren <arihant2math@gmail.com>
2025-08-21 02:26:40 +00:00
Sebastian C
b869b7eb96
script: initial CookieStore implementation (#37968)
This is a first draft at implementing the required infrastructure for
CookieStore, which requires setting up IPC between script and the
resource thread to allow for async/"in parallel" handling of cookie
changes that have a promise API.

Cookie Store also will need to receive change events when cookies for a
url are changed so the architecture needs to support that.

Expect this PR to be reworked once the architecture becomes more
settled, cookie change events will be implemented in follow up PRs

Testing: WPT tests exist for this API
Part of #37674

---------

Signed-off-by: Sebastian C <sebsebmc@gmail.com>
2025-08-21 01:00:24 +00:00
Kenzie Raditya Tirtarahardja
a75f3fd09b
script(webdriver): Element send keys append to the end of filelist if Multiple (#38407)
Step 8.6 of [Element Send
Keys](https://w3c.github.io/webdriver/#dfn-element-send-keys) remote
end's implementation.
> 6. Complete implementation specific steps equivalent to setting the
[selected files](https://w3c.github.io/webdriver/#dfn-selected-files) on
the [input](https://w3c.github.io/webdriver/#dfn-input) element. **If
multiple is true files are be appended to element's [selected
files](https://w3c.github.io/webdriver/#dfn-selected-files).**

Testing: `webdriver/tests/classic/element_send_keys/file_upload.py`
Fixes: https://github.com/servo/servo/issues/38190

---------

Signed-off-by: PotatoCP <Kenzie.Raditya.Tirtarahardja@huawei.com>
Co-authored-by: Euclid Ye <euclid.ye@huawei.com>
2025-08-20 19:10:07 +00:00
lumiscosity
8e2f65bd16
Add matrixTransform for DOMPointReadOnly (#38801)
Adds the `matrixTransform` function for `DOMPointReadOnly`.

Testing: Covered by WPT tests (`css/geometry`)

---------

Signed-off-by: lumiscosity <averyrudelphe@gmail.com>
2025-08-20 16:36:59 +00:00
Shubham Gupta
d8ff9c7a08
layout: Use overflow: visible if overflow was propagated to viewport (#38598)
The `overflow-*` values of either the root element or the `<body>` get
propagated to the viewport. However, we were missing this part:
> The element from which the value is propagated must then have a used
`overflow` value of `visible`.

See https://drafts.csswg.org/css-overflow/#overflow-propagation

Testing:
 - `css/cssom-view/scrolling-quirks-vs-nonquirks.html`
 - `css/css-overflow/overflow-body-propagation-007.html`
 - `css/css-overflow/overflow-body-propagation-008.html`
 - `css/css-overflow/overflow-body-propagation-009.html`
 - `css/css-overflow/scrollable-overflow-with-nested-elements-001.html` 
 - `css/css-overflow/scrollable-overflow-with-nested-elements-002.html` 
 - `css/css-overflow/scrollable-overflow-with-nested-elements-003.html`
 - `css/css-overflow/scrollable-overflow-with-nested-elements-004.html`
 - `css/css-overflow/scrollbar-gutter-scroll-into-view.html`

Failures:
 - `css/css-overflow/overflow-body-propagation-010.html`
   Failing because of missing support for `contain: paint`.
- `css/css-overflow/scrollable-overflow-with-nested-elements-005.html`
Failing because of wrong `data-expected-height`, but correct
`data-expected-scroll-height` which is core of this PR.
`data-expected-height` can be dealt separately.


Fixes: #38248

---------

Signed-off-by: Shubham Gupta <shubham13297@gmail.com>
Signed-off-by: Oriol Brufau <obrufau@igalia.com>
Co-authored-by: Oriol Brufau <obrufau@igalia.com>
2025-08-20 14:21:51 +00:00