capybara-simulated 0.5.0 → 0.7.0

data/lib/capybara/simulated/driver.rb

@@ -72,11 +72,23 @@ module Capybara
         # Browser still has its own sessionStorage + DOM + JS VM.
         @cookies         = {}
         @local_storage   = {}
+        # Capture the universal-server flag ONCE, at session construction — the WPT
+        # runner sets CSIM_LOCAL_ALL_HOSTS only while building the session, then
+        # restores it. Every window (incl. aux windows opened later) inherits this so
+        # cross-origin iframes eager-build consistently across the whole session.
+        @all_hosts_local = ENV['CSIM_LOCAL_ALL_HOSTS'] == '1'
         @browser         = build_window_browser
         @browser.window_handle = PRIMARY_HANDLE
         @aux_windows     = []  # [{handle:, browser:, name:, opener:}, …]
         @active_handle   = nil
         @next_window_seq = 0
+        # Driver-level blob URL partition map: url => {browser:, site:}. A blob URL's
+        # storage partition is its creating context's top-level SITE; another window
+        # can resolve the blob only from the same partition (and same origin, which
+        # the blob: URL embeds). Bytes aren't copied here — they're read back from the
+        # creating Browser's own store, so this stays a light reference map.
+        @blob_partitions      = {}
+        @blob_partitions_lock = Mutex.new
         @owner_thread    = Thread.current
         @@live_lock.synchronize { @@live << WeakRef.new(self) }
         @browser.default_viewport   = viewport   if viewport
@@ -85,10 +97,11 @@ module Capybara
 
       private def build_window_browser
         Browser.new(@app,
-                    driver:        self,
-                    js_engine:     @js_engine,
-                    cookies:       @cookies,
-                    local_storage: @local_storage)
+                    driver:          self,
+                    js_engine:       @js_engine,
+                    cookies:         @cookies,
+                    local_storage:   @local_storage,
+                    all_hosts_local: @all_hosts_local)
       end
 
       # Per-test trace recording. Mirrors capybara-playwright-driver's
@@ -203,16 +216,85 @@ module Capybara
       # `wait? = false` synchronize path.
       def wait?               = current_browser.polling?
 
+      # Run one real-cadence event-loop frame and return the loop's observable
+      # state. Drives "advance the page one frame" without the full poll tick
+      # `evaluate_script` would incur per read; the wpt_runner uses it to drain a
+      # page to completion at browser cadence.
+      #
+      # EVERY live window steps, not just the active one: an auxiliary window is a
+      # separate VM, but the cross-context orchestration the dispatcher framework
+      # builds on (a popup running an executor that polls a shared queue while the
+      # opener waits) needs those background windows to make progress autonomously.
+      # The active window's state leads; each aux window folds its progress / raf /
+      # async / nearest-timer in so the caller keeps pumping while any window works.
+      def run_event_loop_frame(frame_ms)
+        state = current_browser.run_event_loop_frame(frame_ms)
+        # Iterate a SNAPSHOT: a window's drain can open or close windows mid-loop (a
+        # popup spawning another, or window.close disposing one). Re-check each window
+        # is still open before stepping it, and isolate a per-window failure so one
+        # dead/half-torn-down VM can't abort the whole frame pump.
+        @aux_windows.dup.each do |w|
+          b = w[:browser]
+          next if b.equal?(current_browser)
+          next unless @aux_windows.include?(w)   # closed earlier this loop → skip
+          begin
+            state = merge_frame_state(state, b.run_event_loop_frame(frame_ms))
+          rescue StandardError
+            next
+          end
+        end
+        state
+      end
+
+      # Fold an aux window's frame state into the running aggregate: any window that
+      # progressed / has a queued rAF / has an async channel in flight keeps the
+      # whole loop live, and `next_timer` becomes the nearest pending timer across
+      # all windows (-1 only when every window is timer-idle).
+      private def merge_frame_state(a, b)
+        an = a['next_timer'].to_f
+        bn = b['next_timer'].to_f
+        merged =
+          if an.negative? then bn
+          elsif bn.negative? then an
+          else [an, bn].min
+          end
+        {
+          'raf'        => a['raf'] || b['raf'],
+          'async'      => a['async'] || b['async'],
+          'next_timer' => merged,
+          'progressed' => a['progressed'] || b['progressed']
+        }
+      end
+
+      # Clock-free read of a JS expression in the active browsing context (no
+      # virtual-time advance, unlike evaluate_script) — for polling page state
+      # between event-loop frames without perturbing the clock.
+      def peek_script(expr) = current_browser.peek_script(expr)
+
       def visit(path)          = current_browser.visit(path)
       def refresh              = current_browser.refresh
       def reset!
+        reset_windows!
+        browser.reset!
+      end
+
+      # Dispose every auxiliary window and return focus to the primary — a fresh
+      # browsing context has no sibling windows. Disposing each aux Browser tears
+      # down its worker / SSE / websocket threads and its V8 isolate eagerly; left
+      # alone they pile into V8Runtime's process-wide `@@live` set and are only
+      # reclaimed by the at_exit hook, which on a long-lived multi-file session
+      # (the WPT runner) means a slow — sometimes minutes-long — process exit. Split
+      # out of `reset!` so a caller can drop windows WITHOUT resetting the primary's
+      # page state (the WPT runner rebuilds the primary itself, per file, via visit).
+      def reset_windows!
         @aux_windows.each {|w| w[:browser].dispose rescue nil }
         @aux_windows.clear
         @active_handle = nil
-        browser.reset!
+        @blob_partitions_lock.synchronize { @blob_partitions.clear }
       end
       def go_back              = current_browser.go_back
       def go_forward           = current_browser.go_forward
+      def reset_history!       = current_browser.reset_history!
       def current_url          = current_browser.current_url || ''
       def html                 = current_browser.html
       def title                = current_browser.title
@@ -264,10 +346,22 @@ module Capybara
       # matches an existing window navigates that window instead of opening a
       # new one (HTML window-name targeting); `opener_handle` records the
       # opener so the new window's `window.opener` resolves back to it.
-      def open_aux_window(url = nil, name: nil, opener_handle: nil, source: nil, blob_snapshot: nil)
+      def open_aux_window(url = nil, name: nil, opener_handle: nil, source: nil, blob_snapshot: nil, post: nil, opener: false, referrer: nil)
         name = name.to_s
+        # A blob: URL opened from a different storage partition is forced noopener
+        # (cross-partition-navigation), overriding an explicit rel=opener — the new
+        # top-level window is the blob's own partition (so the blob still loads), but
+        # the opener relationship is severed.
+        opener = false if opener && url.to_s.start_with?('blob:') && source && cross_partition_blob?(url, source)
+        # A `<form target>` keeps its opener by default (unlike a `target=_blank`
+        # LINK, which is noopener) — resolve the opener handle from the source.
+        opener_handle ||= handle_for(source) if opener && source
         if !name.empty? && (existing = @aux_windows.find {|w| w[:name] == name })
-          navigate_window(existing[:browser], url, source: source)
+          if post
+            existing[:browser].navigate_post(url, post[:body], post[:content_type], referer: referrer)
+          else
+            navigate_window(existing[:browser], url, source: source)
+          end
           return existing[:handle]
         end
         @next_window_seq += 1
@@ -279,12 +373,18 @@ module Capybara
         # (with its opener) must exist before `visit` runs those scripts.
         @aux_windows << {handle: handle, browser: aux, name: name, opener: opener_handle}
         if url && !url.empty?
+          if post
+            # A `<form target=_blank method=post>` loads the new window via POST,
+            # carrying the opener's URL as referrer (unless rel=noreferrer → '').
+            aux.navigate_post(url, post[:body], post[:content_type], referer: referrer)
           # A blob: URL isn't rack-navigable and its bytes live in the OPENER's
           # isolate — load the document directly from a click-time snapshot (a
           # deferred target=_blank nav may revoke the URL first) or, failing that,
           # the opener's blob store.
-          unless url.to_s.start_with?('blob:') && load_blob_into_window(aux, url, source, snapshot: blob_snapshot)
-            aux.visit(url)
+          elsif !(url.to_s.start_with?('blob:') && load_blob_into_window(aux, url, source, snapshot: blob_snapshot))
+            # A form submission carries a referrer (the opener's URL) unless the
+            # form opted out via rel=noreferrer (referrer: '').
+            aux.visit(url, referer: referrer)
           end
         end
         handle
@@ -304,22 +404,94 @@ module Capybara
 
       # `window.open(url, name)` from the `opener` window's JS. Resolves the URL
       # against the opener's document and records the opener relationship.
-      def open_window_from_js(opener_browser, url, name)
+      def open_window_from_js(opener_browser, url, name, opener_realm_id = 0)
         resolved = url.to_s.empty? ? nil : opener_browser.resolve_document_url(url)
+        # Opening a blob: URL whose storage partition differs from the opener's
+        # top-level site is forced NOOPENER (cross-partition-navigation): the new
+        # auxiliary window is its own top-level context in the blob's partition, so the
+        # blob still loads — but there is no opener relationship and `window.open`
+        # returns null. Same-partition keeps the normal opener.
+        if resolved.to_s.start_with?('blob:') && cross_partition_blob?(resolved, opener_browser)
+          open_aux_window(resolved, name: name, source: opener_browser)   # no opener_handle ⇒ window.opener null
+          return nil                                                      # window.open(...) === null
+        end
+        # Same-origin window → a realm in the opener's isolate (shared heap); the
+        # returned realm-id context becomes a native WindowProxy on the JS side, so
+        # cross-window scripting/adoption need no cross-isolate RPC. The opener's realm
+        # id wires the popup's window.opener. Falls through to the separate-VM aux path
+        # (cross-origin, or a URL we don't yet realm-load).
+        if (rid = opener_browser.open_window_realm(resolved, name: name, opener_realm_id: opener_realm_id))
+          return rid
+        end
         open_aux_window(resolved, name: name, opener_handle: handle_for(opener_browser), source: opener_browser)
       end
 
-      # Load a blob: document into aux window `aux` from `source`'s (the opener's)
-      # local blob store — the bytes live in the opener's isolate, not the aux's.
-      # Returns false if `source`/bytes are unavailable (caller falls back).
-      private def load_blob_into_window(aux, url, source, snapshot: nil)
+      # The storage-partition site a blob: URL was created in (its creator's top-level
+      # site), or nil for an unknown / revoked / unpartitioned URL.
+      def blob_partition_site_of(url)
+        e = @blob_partitions_lock.synchronize { @blob_partitions[url.to_s] }
+        e && e[:site]
+      end
+
+      # Is this blob: URL in a different storage partition than `accessor`'s top-level
+      # site? Unknown blobs (no entry) are treated as same-partition (no extra gating
+      # beyond the existing same-origin behaviour).
+      def cross_partition_blob?(url, accessor)
+        site = blob_partition_site_of(url)
+        !site.nil? && site != accessor.blob_partition_site
+      end
+
+      # Resolve a blob: URL's bytes from whichever Browser created it (the bytes live
+      # in the creator's isolate, not necessarily the navigator's). Used to load a blob
+      # document into a TOP-LEVEL window (window.open / a window navigation): that new
+      # context is the blob's own partition, so no partition gate applies here — the
+      # cross-partition rule for windows is the noopener severing above, and for nested
+      # frames it is enforced at the frame-navigation site. Falls back to the
+      # accessor's own store for an unpartitioned URL (worker / legacy path).
+      def blob_bytes_for(url, accessor)
+        entry = @blob_partitions_lock.synchronize { @blob_partitions[url.to_s] }
+        creator = entry ? entry[:browser] : accessor
+        creator.respond_to?(:read_blob_for_window) ? creator.read_blob_for_window(url) : nil
+      end
+
+      # Record / drop a blob URL's storage partition (called by Browser#blob_register /
+      # #blob_unregister). `site` is the creating context's top-level site.
+      def register_blob_partition(url, browser, site)
+        @blob_partitions_lock.synchronize { @blob_partitions[url.to_s] = {browser: browser, site: site.to_s} }
+      end
+
+      def unregister_blob_partition(url)
+        @blob_partitions_lock.synchronize { @blob_partitions.delete(url.to_s) }
+      end
+
+      # A user `URL.revokeObjectURL(url)` from `source`. Storage-partitioned: a revoke
+      # from a different top-level site than the blob's is a NO-OP (cross-partition.https
+      # "shouldn't be revocable from a cross-partition iframe/worker"). A same-partition
+      # revoke drops the Driver entry AND invalidates the blob in the CREATOR's isolate
+      # (the blob may have been created in another window), so every window stops
+      # resolving it. Returns false when vetoed (caller leaves its local copy intact).
+      def revoke_blob_partitioned(url, source)
+        entry = @blob_partitions_lock.synchronize { @blob_partitions[url.to_s] }
+        return false if entry && entry[:site] != source.blob_partition_site
+        @blob_partitions_lock.synchronize { @blob_partitions.delete(url.to_s) }
+        creator = entry && entry[:browser]
+        creator.drop_local_blob(url.to_s) if creator && creator.respond_to?(:drop_local_blob) && !creator.equal?(source)
+        true
+      end
+
+      # Load a blob: document into top-level window `target`. The bytes live in
+      # whichever Browser created the blob, not the target's — `blob_bytes_for` fetches
+      # them cross-isolate. Returns false when the blob is unavailable (revoked), so
+      # the caller falls back. A click-time `snapshot` is the navigating context's own
+      # blob captured before a deferred nav could revoke it.
+      private def load_blob_into_window(target, url, source, snapshot: nil)
         data = if snapshot.is_a?(Hash) && snapshot['b64']
           { bytes: Base64.decode64(snapshot['b64'].to_s), type: snapshot['type'].to_s }
-        elsif source.respond_to?(:read_blob_for_window)
-          source.read_blob_for_window(url)
+        else
+          blob_bytes_for(url, source)
         end
         return false unless data
-        aux.boot_blob_document(url, data[:bytes], data[:type])
+        target.boot_blob_document(url, data[:bytes], data[:type])
         true
       rescue StandardError
         false
@@ -348,9 +520,42 @@ module Capybara
         b = window_browser(handle) or return nil
         b.read_property(prop, doc: doc)
       end
+      # Cross-window remote-ref RPC: route a node/object proxy op to the window
+      # that owns the ref (handle), executing in that window's VM.
+      def fire_aux_window_load(handle)             = ((b = window_browser(handle)) && b.fire_own_window_load)
+      def window_ref_get(handle, id, prop)         = (b = window_browser(handle)) ? b.remote_ref_get(id, prop) : nil
+      def window_ref_set(handle, id, prop, value)  = ((b = window_browser(handle)) && b.remote_ref_set(id, prop, value))
+      def window_ref_call(handle, id, method, args) = (b = window_browser(handle)) ? b.remote_ref_call(id, method, args) : nil
       def window_set_location(handle, url)
         b = window_browser(handle) or return
-        navigate_window(b, b.resolve_document_url(url), source: current_browser)
+        # Per HTML, `w.location = url` parses `url` relative to the ENTRY settings
+        # object — the document of the script doing the assignment (the active
+        # window) — NOT the target window's current document. So a cross-window
+        # `w.location.href = 'resources/x.html'` resolves against the opener's
+        # base, not the aux's (which would double a shared path segment).
+        navigate_window(b, current_browser.resolve_document_url(url), source: current_browser)
+      end
+      # A cross-window `w.history.back()/forward()/go(n)`: traverse the target
+      # window's history. The opener's VM is the one executing, so a non-active
+      # target can rebuild eagerly (like `navigate_window`); an active target
+      # (e.g. `opener.history.back()` from an aux) defers to avoid tearing down
+      # the running VM mid-call. Returns true when the traversal crossed a
+      # document boundary — the JS proxy then fires the target's deferred `load`
+      # (the same deferral as `navAux`) so the restored page's `window.onload`
+      # runs after the opener's current task. False for a same-document
+      # (pushState) traversal — popstate already fired — or a no-op.
+      def window_history_go(handle, delta)
+        b = window_browser(handle) or return false
+        if b.equal?(current_browser)
+          # `opener.history.back()` targeting the active window: defer (can't
+          # rebuild the running VM mid-call) and return false — the active
+          # window's load fires through its own navigation path when the pending
+          # traversal drains, NOT via the aux-load deferral the caller would run.
+          b.history_go(delta)
+          false
+        else
+          b.history_go(delta, force: true) == :cross_document
+        end
       end
       def window_closed?(handle)         = window_browser(handle).nil?
       def opener_handle_of(browser)
@@ -393,11 +598,21 @@ module Capybara
         return if h == PRIMARY_HANDLE
         @aux_windows.reject! {|w|
           next false unless w[:handle] == h
+          drop_blob_partitions_for(w[:browser])   # don't leave entries pointing at a disposed VM
           w[:browser].dispose rescue nil
           true
         }
         @active_handle = nil if @active_handle == h
       end
+
+      # Drop every blob-partition entry created by `browser` — its isolate is being
+      # disposed, so the bytes are gone and the reference must not linger (a stale
+      # entry would pin the dead Browser and route blob_bytes_for to a dead VM).
+      private def drop_blob_partitions_for(browser)
+        @blob_partitions_lock.synchronize do
+          @blob_partitions.reject! {|_url, e| e[:browser].equal?(browser) }
+        end
+      end
       def switch_to_window(h)
         if h == PRIMARY_HANDLE
           @active_handle = nil