dommy-js-quickjs 0.11.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: df093cff1000de6ad73f27367c17845c2b6846b87785913d70695b0d38938daf
-  data.tar.gz: aab8821f4e6974306d7e47b35730f32d7340cec51437d0926e94986e692bbb4d
+  metadata.gz: 2e6b8409eac9474ca6bd31c48e4225296f6bdd646d1582fbd7971e40918f3fda
+  data.tar.gz: da8deb2816c76b5a98932321957bb60411d338a86cd5a3322feff937d71c43cf
 SHA512:
-  metadata.gz: efe4b423fc15fc33f2e3a77108f145cadf0d4d072b69c9447f958cbdcb872b367cd7857ce07a975bacb2d7a64a36c3bee760a4070ebfcc893bff8e6df8ea8441
-  data.tar.gz: c5fa56f132d9df6e4c067f96f0fa5c1e915c63d9ff641832c72aac75307e6fad57d7e671e4585e0cdffe73419cba0e965a08d750e2c50e5dfbad223b5987c6f1
+  metadata.gz: 56fcec71210297cfa232936f6abb9a046bbd4174034567407c9a6d843978edd242eb2a1f0a975ff78b434d16600baf2fdad0dbc849c37d8f7f79b0cf0a57de64
+  data.tar.gz: bd4f983f1baf57ea48d10190953f0ab824899395a7650ffc11bebb49d042bf7ba308f119c8aae09a9bbdbb040e048deac390323a2d9e1d425b6738739a7a9dc2

data/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 0.13.0 — 2026-10-20
+
+Requires `dommy >= 0.17.0, < 0.18` and `quickjs ~> 0.22.0`.
+
+### Changed
+
+- Requires `dommy >= 0.17.0, < 0.18` (was `>= 0.16.0, < 0.17`). dommy 0.17.0 requires makiri `~> 0.16.0`.
+- The bare `self`, `top`, `parent` and `frames` are the window: `self === window` and `top === window` hold. `self`, `parent` and `frames` are [Replaceable]; `top` is readonly, so assigning it in strict code throws.
+- An assignment to the bare `location` navigates, as `window.location = url` does.
+- The bare `history`, `navigator` and `crypto` are readonly: `history = 1` leaves the window's History, and throws in strict code. `indexedDB` and `caches`, which dommy does not implement, are not globals, so `"indexedDB" in globalThis` is false and a page can define its own.
+- A bare global that forwards to the window (`fetch`, `setTimeout`, `localStorage`, …) reaches the window's own member: replacing `window.fetch` replaces the bare `fetch`, and a wrapper that calls a saved `fetch` calls the original instead of itself.
+- The bare `queueMicrotask` reports what its callback throws at the window (`reportError`), as `window.queueMicrotask` does, instead of rejecting a promise nobody holds.
+
+### Fixed
+
+- The shims (`browser_globals.js`, `timer_globals.js`, `intl_polyfill.js`, `wasm_stub.js`) no longer declare their helpers at the top level of the page's realm. A page's own top-level `let group`, `class Collator` or `let __rbDefer` was a redeclaration SyntaxError, and a page's `let __rbTimerOrigins` made every bare `setTimeout` throw `TypeError: not a function`. Each shim now runs in an IIFE; the timers keep their origin map in a local. `test/dommy/js/test_shim_scope.rb` declares every former helper name from a page.
+
+## 0.12.0 — 2026-10-10
+
+Requires `dommy >= 0.16.0, < 0.17` and `quickjs ~> 0.22.0`.
+
+### Added
+
+- A bare `frameElement` global, read from the window on each access (a frame's container can change). It is a plain readonly attribute, so unlike the [Replaceable] ones below an assignment does not replace it.
+
+### Changed
+
+- Requires `dommy >= 0.16.0, < 0.17` (was `>= 0.15.0, < 0.16`). dommy 0.16.0 needs makiri 0.16.0 and changes what `Session#click_link` and `#click_button` return; the suite passes against it, and the boot-cost bound below needs its lazy interface seeding.
+- The realm's bootstrap bundles no longer hand their completion value to Ruby. `window_builtins.js` ends by assigning `window.globalThis`, so every page load converted the whole global object to a Ruby value: 184 host reads and about 6 ms. `Backend#run_bundle` now discards it (the compiled bundle ends with `void 0`). `test/dommy/js/test_window_boot.rb` checks that lazily seeded interfaces resolve like eager ones and bounds the bridge crossings of opening a window (`install_window` under 60; it was 424).
+- The bare timer globals follow the IDL: `setTimeout(handler, timeout = 0, ...arguments)` and `setInterval` hand the extra arguments to the handler, and every timer global has the IDL's `length` (`setTimeout.length` is 1, `clearTimeout.length` 0).
+- The bare forwards to window methods (`structuredClone`, `fetch`, `postMessage`, `addEventListener`, …) carry the operation's name and `length` from dommy's generated WebIDL signatures, instead of being 0-length `(...args)` wrappers.
+- `innerWidth`, `innerHeight`, `scrollX`/`scrollY`, `pageXOffset`/`pageYOffset` and `devicePixelRatio` are read from the window on each access rather than copied once at boot, and an assignment replaces them ([Replaceable]).
+- The WPT file runner boots its browser with `navigable: true`, so an `<iframe src>` loads through dommy's child navigables and the browser's resources (dommy now gives every iframe an initial `about:blank` document and navigates it from a task). `dom/nodes/Element-matches.html` and `Element-webkitMatchesSelector.html` are back to 669/669 and `ParentNode-querySelector-All.html` to 1975/1975.
+- Tests follow dommy's spec changes: a srcless or `about:blank` iframe fires `load` during `appendChild`; boot runs HTML's "the end" to the load task, so a `setTimeout(0)` queued while parsing has fired before `Dommy::Browser.new` / `Session#visit` return, even with `settle: false` (which still leaves what the load handler queued pending); an unhandled rejection fails from the queued "notify about rejected promises" task, at the next `settle`, not from `execute`; and the custom element construction-stack test defines through a `CustomElementRegistry` host object and runs `__rbHost.ceUpgrade`.
+
+### Fixed
+
+- The bare `localStorage` and `sessionStorage` globals are read from the window on each access instead of being copied at boot, so a window on an opaque origin (`about:blank`, which `Dommy::Browser.visit` starts from, `data:`, a sandboxed frame) no longer fails to install its globals with `SecurityError: Storage is disabled for an opaque origin`; the page gets that `SecurityError` when it reads them, as the HTML spec says. They are no longer enumerable own properties of the global.
+
 ## 0.11.0 — 2026-10-04
 
 Requires `dommy >= 0.15.0, < 0.16` and `quickjs ~> 0.22.0`.

data/lib/dommy/js/quickjs/backend.rb

@@ -96,8 +96,14 @@ module Dommy
         @bundle_cache = {}
         @bundle_mutex = Mutex.new
 
+        # A bundle runs for its side effects, so its completion value is
+        # discarded (the trailing `void 0`, on a line of its own so a final
+        # line comment cannot swallow it). Whatever its last statement
+        # evaluated to would otherwise be converted to a Ruby value on every
+        # VM — for window_builtins.js, whose last statement assigns
+        # `window.globalThis`, the entire global object.
         def self.compiled_bundle(cache_key, source)
-          @bundle_mutex.synchronize { @bundle_cache[cache_key] ||= compile(source, filename: cache_key.to_s) }
+          @bundle_mutex.synchronize { @bundle_cache[cache_key] ||= compile("#{source}\n;void 0;", filename: cache_key.to_s) }
         end
 
         # Execute precompiled bytecode (a Quickjs::Runnable) on this VM in global

data/lib/dommy/js/quickjs/js/browser_globals.js

@@ -1,36 +1,150 @@
 // The bare browser globals frameworks reach for, aliased onto the installed
 // window. This is what lets real frontend bundles (Turbo, …) run unmodified.
-globalThis.self = globalThis;
-// Top-level window: parent/top are the window itself (spec), so frame-walking
-// loops terminate instead of dereferencing undefined.
-globalThis.parent = globalThis;
-globalThis.top = globalThis;
-// `frames` is the window itself, indexable by child-frame number
-// (`frames[0]` === the first <iframe>'s contentWindow).
-globalThis.frames = window;
-globalThis.location = window.location;
-globalThis.history = window.history;
-globalThis.navigator = window.navigator;
-globalThis.sessionStorage = window.sessionStorage;
-globalThis.localStorage = window.localStorage;
+//
+// The window's names for itself are the window proxy, as everywhere else a
+// window is handed out (`window.self`, `document.defaultView`, a frame's
+// `parent`): globalThis is the one object that is not, since QuickJS makes the
+// global. For the top-level window, parent and top are the window itself
+// (spec), so frame-walking loops terminate. `frames` is indexable by
+// child-frame number (`frames[0]` === the first <iframe>'s contentWindow).
+// They read the live `window`, which a host can rebind. self, parent and
+// frames are [Replaceable]: an assignment replaces the accessor with the
+// value. top is [LegacyUnforgeable]: an assignment leaves it (a strict-mode one
+// throws).
+//
+// Every bare global here that stands for a window member reaches the
+// window's own implementation (dommy's `__rbWindowMember`), not whatever the
+// window answers for the name: the window answers with the bare global
+// itself, and a page that saved the bare `fetch` before wrapping
+// `window.fetch` must get the original back, as from a browser's native
+// function. Each is declared so to dommy (`__rbWindowForward`). Against a
+// dommy without them, they read the window as before.
+//
+// The IIFE keeps the helpers below out of the page's global scope.
+(function () {
+const __rbForward = globalThis.__rbWindowForward || ((fn) => fn);
+const __rbMember = globalThis.__rbWindowMember || ((name) => window[name]);
+// A [Replaceable] attribute: read through `get`, replaced by an assignment.
+const __rbReplaceable = (name, get) => {
+  Object.defineProperty(globalThis, name, {
+    get,
+    set(value) {
+      Object.defineProperty(globalThis, name, { value, writable: true, enumerable: true, configurable: true });
+    },
+    enumerable: true,
+    configurable: true,
+  });
+};
+for (const __n of ["self", "parent", "frames"]) {
+  __rbReplaceable(__n, __rbForward(function () { return window; }));
+}
+// Getter only, so a strict-mode assignment throws, as on a browser's window.
+Object.defineProperty(globalThis, "top", {
+  get: __rbForward(function () { return window; }),
+  enumerable: true,
+  configurable: true,
+});
+// `location` is the window's own [LegacyUnforgeable] attribute with
+// [PutForwards=href]: an assignment navigates, as `window.location = url`
+// does. A window has one Location for its life (a cross-document navigation
+// makes a new realm), so it is read again only when a host rebinds `window`.
+let __rbLocationWindow = null;
+let __rbLocation = null;
+Object.defineProperty(globalThis, "location", {
+  get: __rbForward(function () {
+    if (__rbLocationWindow !== window) {
+      __rbLocationWindow = window;
+      __rbLocation = __rbMember("location");
+    }
+    return __rbLocation;
+  }),
+  set(value) { window.location = value; },
+  enumerable: true,
+  configurable: true,
+});
+// The objects a window keeps for its life, aliased by reference. history,
+// navigator, crypto, indexedDB and caches are plain readonly attributes, so
+// assigning the bare name leaves them (a strict-mode assignment throws);
+// performance, screen and visualViewport are [Replaceable], so an assignment
+// replaces them. A name the window has no object for (dommy implements
+// neither indexedDB nor caches) is left undefined: pinning a read-only
+// `undefined` would make `"indexedDB" in globalThis` claim the feature and
+// refuse the polyfill a page assigns in its place.
+for (const __n of ["history", "navigator", "crypto", "indexedDB", "caches"]) {
+  try {
+    const value = window[__n];
+    if (value == null) continue;
+    Object.defineProperty(globalThis, __n, { value, writable: false, enumerable: true, configurable: true });
+  } catch (__e) {}
+}
+// Web Storage is read from the window on each access, not copied at boot: the
+// sessionStorage / localStorage getters throw a SecurityError when "obtain a
+// session/local storage bottle map" fails (HTML, Web storage), which it does
+// for an opaque origin (Storage Standard, "obtain a storage key": an opaque
+// origin is failure). A page on about:blank, data: or a sandboxed frame must
+// see that when it reads `localStorage`, and it must not abort installing the
+// rest of the globals. Not enumerable: on a real window they are accessors of
+// Window.prototype, not own keys of the global — and an enumerable throwing
+// getter would break whatever walks the global's own properties (handing
+// `globalThis` to the host, as window_builtins.js does, reads each of them).
+for (const __n of ["sessionStorage", "localStorage"]) {
+  Object.defineProperty(globalThis, __n, {
+    get: __rbForward(function () { return __rbMember(__n); }),
+    enumerable: false,
+    configurable: true,
+  });
+}
 globalThis.CSS = window.CSS;
-globalThis.getComputedStyle = (...args) => window.getComputedStyle(...args);
-globalThis.matchMedia = (...args) => window.matchMedia(...args);
-globalThis.fetch = (...args) => window.fetch(...args);
-globalThis.addEventListener = (...args) => window.addEventListener(...args);
-globalThis.removeEventListener = (...args) => window.removeEventListener(...args);
-globalThis.dispatchEvent = (event) => window.dispatchEvent(event);
+// A bare window method forwards to the window, named and sized as the IDL
+// declares it (`structuredClone.length` is 1, not a rest wrapper's 0): the
+// generated signatures dommy loads give each operation's required-argument
+// count, looked up along the interface's inheritance (EventTarget's
+// addEventListener).
+const __rbWindowOperation = (name) => {
+  const signatures = globalThis.__rbIdlSignatures || {};
+  for (let iface = "Window"; iface && signatures[iface]; iface = signatures[iface].inherits) {
+    const operation = (signatures[iface].operations || {})[name];
+    if (operation) return operation;
+  }
+  return null;
+};
+const __rbForwardWindowMethod = (name) => {
+  const forward = __rbForward(function (...args) { return __rbMember(name).apply(window, args); });
+  const operation = __rbWindowOperation(name);
+  Object.defineProperty(forward, "name", { value: name });
+  Object.defineProperty(forward, "length", { value: operation ? operation.required : 0 });
+  globalThis[name] = forward;
+};
+for (const __m of ["getComputedStyle", "matchMedia", "fetch",
+                   "addEventListener", "removeEventListener", "dispatchEvent"]) {
+  __rbForwardWindowMethod(__m);
+}
 
-// More bare globals frameworks read directly (e.g. performance.now(), crypto,
-// screen). Objects/values are aliased by reference; methods are wrapped so
-// `this` binds to the window. All already exist on window.
-for (const __n of ["performance", "crypto", "screen", "visualViewport",
-                   "indexedDB", "caches", "devicePixelRatio",
-                   "innerWidth", "innerHeight", "scrollX", "scrollY", "pageXOffset"]) {
+// The [Replaceable] objects frameworks read directly (performance.now(),
+// screen), aliased by reference as plain data properties, which an assignment
+// replaces; methods forward (above) so `this` binds to the window.
+for (const __n of ["performance", "screen", "visualViewport"]) {
   try { globalThis[__n] = window[__n]; } catch (__e) {}
 }
+// Values that change (a resize, a scroll) are read from the window each time
+// rather than copied once at boot. They are [Replaceable]: an assignment
+// replaces the accessor with the assigned value, as on a real window.
+for (const __n of ["devicePixelRatio", "innerWidth", "innerHeight",
+                   "scrollX", "scrollY", "pageXOffset", "pageYOffset"]) {
+  try { __rbReplaceable(__n, __rbForward(function () { return __rbMember(__n); })); } catch (__e) {}
+}
+// `frameElement` is a plain readonly attribute: read from the window each
+// time (a frame's container can change), never replaced by an assignment.
+try {
+  Object.defineProperty(globalThis, "frameElement", {
+    get: __rbForward(function () { return __rbMember("frameElement"); }),
+    enumerable: false,
+    configurable: true,
+  });
+} catch (__e) {}
 for (const __m of ["scrollTo", "scrollBy", "requestIdleCallback", "cancelIdleCallback",
                    "getSelection", "structuredClone", "reportError", "btoa", "atob",
                    "alert", "confirm", "prompt", "open", "postMessage"]) {
-  try { globalThis[__m] = (...args) => window[__m](...args); } catch (__e) {}
+  try { __rbForwardWindowMethod(__m); } catch (__e) {}
 }
+})();

data/lib/dommy/js/quickjs/js/intl_polyfill.js

@@ -3,6 +3,9 @@
 // defined` (nuxt.com, i18n libraries, …). Install a small locale-naive
 // polyfill: it formats reasonably (grouped numbers, ISO-ish dates) so pages run
 // instead of crashing, without pulling in full ICU.
+// The IIFE keeps its helpers and constructors (I, group, Collator, …) out of
+// the page's global scope, where a page's own `let group` would collide.
+(function () {
 if (typeof globalThis.Intl === "undefined") {
   var I = {};
   var group = function (s) {
@@ -54,3 +57,4 @@ if (typeof globalThis.Intl === "undefined") {
   I.getCanonicalLocales = function (locs) { return Array.isArray(locs) ? locs.slice() : locs ? [String(locs)] : []; };
   globalThis.Intl = I;
 }
+})();

data/lib/dommy/js/quickjs/js/timer_globals.js

@@ -9,38 +9,70 @@
 // and only stringified if the callback actually throws (see
 // __rbFetchTimerOrigin + Runtime#handle_timer_error); a successful callback
 // forgets its origin and the map is size-capped, so this stays cheap.
-globalThis.__rbTimerOrigins = new Map();
+//
+// The IIFE keeps the helpers out of the page's global scope: a page's own
+// `let __rbDefer` would be a redeclaration, and a page's `let` of a name the
+// helpers looked up globally would take its place. __rbDefer keeps its name,
+// which marks the frame ErrorTranslator strips from origin stacks.
+(function () {
+const origins = new Map();
 const __rbDefer = (schedule, fn, delay) => {
   if (typeof fn !== "function") return schedule(fn, delay);
   const origin = new Error();
   let id;
   const wrapped = function () {
     const result = fn.apply(this, arguments);
-    __rbTimerOrigins.delete(id); // ran cleanly — no need to keep it
+    origins.delete(id); // ran cleanly — no need to keep it
     return result;
   };
   id = schedule(wrapped, delay);
-  __rbTimerOrigins.set(id, origin);
-  if (__rbTimerOrigins.size > 4096) __rbTimerOrigins.delete(__rbTimerOrigins.keys().next().value);
+  origins.set(id, origin);
+  if (origins.size > 4096) origins.delete(origins.keys().next().value);
   return id;
 };
 globalThis.__rbFetchTimerOrigin = (id) => {
-  const origin = __rbTimerOrigins.get(id);
+  const origin = origins.get(id);
   if (!origin) return "";
-  __rbTimerOrigins.delete(id);
+  origins.delete(id);
   return origin.stack || "";
 };
-globalThis.setTimeout = (fn, delay) => __rbDefer((f, d) => window.setTimeout(f, d), fn, delay);
-globalThis.clearTimeout = (id) => window.clearTimeout(id);
-globalThis.setInterval = (fn, delay) => __rbDefer((f, d) => window.setInterval(f, d), fn, delay);
-globalThis.clearInterval = (id) => window.clearInterval(id);
-globalThis.requestAnimationFrame = (fn) => __rbDefer((f) => window.requestAnimationFrame(f), fn);
-globalThis.cancelAnimationFrame = (id) => window.cancelAnimationFrame(id);
+// Each stands for the window's own and reaches it directly (dommy's
+// `__rbWindowMember`), not through whatever the window answers for the name,
+// which is this very function (see browser_globals.js).
+const __rbTimerForward = globalThis.__rbWindowForward || ((fn) => fn);
+const __rbTimerMember = globalThis.__rbWindowMember || ((name) => window[name]);
+// The signatures are the IDL's (HTML "timers"): `setTimeout(handler, timeout
+// = 0, ...arguments)` hands the extra arguments to the handler, and the
+// defaults keep each function's `length` the IDL's (1, 0, 1, 0, 1, 1).
+globalThis.setTimeout = __rbTimerForward(function setTimeout(handler, timeout = 0, ...args) {
+  return __rbDefer((f, d) => __rbTimerMember("setTimeout").call(window, f, d, ...args), handler, timeout);
+});
+globalThis.clearTimeout = __rbTimerForward(function clearTimeout(id = 0) { return __rbTimerMember("clearTimeout").call(window, id); });
+globalThis.setInterval = __rbTimerForward(function setInterval(handler, timeout = 0, ...args) {
+  return __rbDefer((f, d) => __rbTimerMember("setInterval").call(window, f, d, ...args), handler, timeout);
+});
+globalThis.clearInterval = __rbTimerForward(function clearInterval(id = 0) { return __rbTimerMember("clearInterval").call(window, id); });
+globalThis.requestAnimationFrame = __rbTimerForward(function requestAnimationFrame(callback) {
+  return __rbDefer((f) => __rbTimerMember("requestAnimationFrame").call(window, f), callback);
+});
+globalThis.cancelAnimationFrame = __rbTimerForward(function cancelAnimationFrame(handle) {
+  return __rbTimerMember("cancelAnimationFrame").call(window, handle);
+});
 // queueMicrotask must share the engine's promise-job (microtask) queue so its
 // callbacks are FIFO-ordered with Promise reactions (the WHATWG
 // single-microtask-queue model). Routing through the Ruby scheduler instead
 // would drain on a separate pass, reordering it after all native promise jobs.
-globalThis.queueMicrotask = (fn) => {
-  if (typeof fn !== "function") throw new TypeError("queueMicrotask requires a function");
-  Promise.resolve().then(() => { fn(); });
-};
+// What the callback throws is reported at the window (HTML "report an
+// exception"), as window.queueMicrotask's is, rather than rejecting a promise
+// nobody holds.
+globalThis.queueMicrotask = __rbTimerForward(function queueMicrotask(callback) {
+  if (typeof callback !== "function") throw new TypeError("queueMicrotask requires a function");
+  Promise.resolve().then(() => {
+    try {
+      callback();
+    } catch (error) {
+      __rbTimerMember("reportError").call(window, error);
+    }
+  });
+});
+})();

data/lib/dommy/js/quickjs/js/wasm_stub.js

@@ -7,6 +7,9 @@
 // `Memory` honors `{shared:true}` with a SharedArrayBuffer, which the engine
 // does ship. That is also what WPT's common/sab.js needs: it derives the SAB
 // constructor from `new WebAssembly.Memory({shared:true}).buffer.constructor`.
+// The IIFE keeps its helpers (unsupported, throwUnsupported) out of the
+// page's global scope.
+(function () {
 if (typeof globalThis.WebAssembly === "undefined") {
   var unsupported = function () { return Promise.reject(new Error("WebAssembly is not supported")); };
   var throwUnsupported = function () { throw new Error("WebAssembly is not supported"); };
@@ -24,3 +27,4 @@ if (typeof globalThis.WebAssembly === "undefined") {
     CompileError: Error, LinkError: Error, RuntimeError: Error,
   };
 }
+})();

data/lib/dommy/js/quickjs/version.rb

@@ -3,7 +3,7 @@
 module Dommy
   module Js
     module Quickjs
-      VERSION = "0.11.0"
+      VERSION = "0.13.0"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dommy-js-quickjs
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.13.0
 platform: ruby
 authors:
 - takahashim
@@ -29,20 +29,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.15.0
+        version: 0.17.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.16'
+        version: '0.18'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.15.0
+        version: 0.17.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.16'
+        version: '0.18'
 description: |
   dommy-js-quickjs lets JavaScript drive a Dommy DOM by embedding QuickJS (via
   the quickjs gem) and bridging DOM nodes to JS through an ES Proxy that routes
@@ -97,7 +97,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.20
+rubygems_version: 3.6.9
 specification_version: 4
 summary: QuickJS backend for running JavaScript against a Dommy DOM.
 test_files: []