dommy-js-quickjs 0.12.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e78c3781c9d334b0ec8bd70fb68b0fa285685e5de516ff5b72d073aa74800ca1
-  data.tar.gz: 9278f706bd5d0929b3c74130e188c90f5bb07e2c8213f84130a21a0b3acce671
+  metadata.gz: 2e6b8409eac9474ca6bd31c48e4225296f6bdd646d1582fbd7971e40918f3fda
+  data.tar.gz: da8deb2816c76b5a98932321957bb60411d338a86cd5a3322feff937d71c43cf
 SHA512:
-  metadata.gz: e09091050fc6e2d6512708a5cf105da37ae9e30b3edc33da6258d3ac83981837ba52b6d4c4d152e099f7c19cdb146d2e8046b005227227cb54fc98e12447b45b
-  data.tar.gz: cd6dd057505db8978757a52d7a52a99d2060b957ea3538db112013d4129178b81a9535bb9ec69ef2c88bc4dccc29ab8aeaa99a847e801c127d0898587dbcbbba
+  metadata.gz: 56fcec71210297cfa232936f6abb9a046bbd4174034567407c9a6d843978edd242eb2a1f0a975ff78b434d16600baf2fdad0dbc849c37d8f7f79b0cf0a57de64
+  data.tar.gz: bd4f983f1baf57ea48d10190953f0ab824899395a7650ffc11bebb49d042bf7ba308f119c8aae09a9bbdbb040e048deac390323a2d9e1d425b6738739a7a9dc2

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.13.0 — 2026-10-20
+
+Requires `dommy >= 0.17.0, < 0.18` and `quickjs ~> 0.22.0`.
+
+### Changed
+
+- Requires `dommy >= 0.17.0, < 0.18` (was `>= 0.16.0, < 0.17`). dommy 0.17.0 requires makiri `~> 0.16.0`.
+- The bare `self`, `top`, `parent` and `frames` are the window: `self === window` and `top === window` hold. `self`, `parent` and `frames` are [Replaceable]; `top` is readonly, so assigning it in strict code throws.
+- An assignment to the bare `location` navigates, as `window.location = url` does.
+- The bare `history`, `navigator` and `crypto` are readonly: `history = 1` leaves the window's History, and throws in strict code. `indexedDB` and `caches`, which dommy does not implement, are not globals, so `"indexedDB" in globalThis` is false and a page can define its own.
+- A bare global that forwards to the window (`fetch`, `setTimeout`, `localStorage`, …) reaches the window's own member: replacing `window.fetch` replaces the bare `fetch`, and a wrapper that calls a saved `fetch` calls the original instead of itself.
+- The bare `queueMicrotask` reports what its callback throws at the window (`reportError`), as `window.queueMicrotask` does, instead of rejecting a promise nobody holds.
+
+### Fixed
+
+- The shims (`browser_globals.js`, `timer_globals.js`, `intl_polyfill.js`, `wasm_stub.js`) no longer declare their helpers at the top level of the page's realm. A page's own top-level `let group`, `class Collator` or `let __rbDefer` was a redeclaration SyntaxError, and a page's `let __rbTimerOrigins` made every bare `setTimeout` throw `TypeError: not a function`. Each shim now runs in an IIFE; the timers keep their origin map in a local. `test/dommy/js/test_shim_scope.rb` declares every former helper name from a page.
+
 ## 0.12.0 — 2026-10-10
 
 Requires `dommy >= 0.16.0, < 0.17` and `quickjs ~> 0.22.0`.

data/lib/dommy/js/quickjs/js/browser_globals.js

@@ -1,16 +1,82 @@
 // The bare browser globals frameworks reach for, aliased onto the installed
 // window. This is what lets real frontend bundles (Turbo, …) run unmodified.
-globalThis.self = globalThis;
-// Top-level window: parent/top are the window itself (spec), so frame-walking
-// loops terminate instead of dereferencing undefined.
-globalThis.parent = globalThis;
-globalThis.top = globalThis;
-// `frames` is the window itself, indexable by child-frame number
-// (`frames[0]` === the first <iframe>'s contentWindow).
-globalThis.frames = window;
-globalThis.location = window.location;
-globalThis.history = window.history;
-globalThis.navigator = window.navigator;
+//
+// The window's names for itself are the window proxy, as everywhere else a
+// window is handed out (`window.self`, `document.defaultView`, a frame's
+// `parent`): globalThis is the one object that is not, since QuickJS makes the
+// global. For the top-level window, parent and top are the window itself
+// (spec), so frame-walking loops terminate. `frames` is indexable by
+// child-frame number (`frames[0]` === the first <iframe>'s contentWindow).
+// They read the live `window`, which a host can rebind. self, parent and
+// frames are [Replaceable]: an assignment replaces the accessor with the
+// value. top is [LegacyUnforgeable]: an assignment leaves it (a strict-mode one
+// throws).
+//
+// Every bare global here that stands for a window member reaches the
+// window's own implementation (dommy's `__rbWindowMember`), not whatever the
+// window answers for the name: the window answers with the bare global
+// itself, and a page that saved the bare `fetch` before wrapping
+// `window.fetch` must get the original back, as from a browser's native
+// function. Each is declared so to dommy (`__rbWindowForward`). Against a
+// dommy without them, they read the window as before.
+//
+// The IIFE keeps the helpers below out of the page's global scope.
+(function () {
+const __rbForward = globalThis.__rbWindowForward || ((fn) => fn);
+const __rbMember = globalThis.__rbWindowMember || ((name) => window[name]);
+// A [Replaceable] attribute: read through `get`, replaced by an assignment.
+const __rbReplaceable = (name, get) => {
+  Object.defineProperty(globalThis, name, {
+    get,
+    set(value) {
+      Object.defineProperty(globalThis, name, { value, writable: true, enumerable: true, configurable: true });
+    },
+    enumerable: true,
+    configurable: true,
+  });
+};
+for (const __n of ["self", "parent", "frames"]) {
+  __rbReplaceable(__n, __rbForward(function () { return window; }));
+}
+// Getter only, so a strict-mode assignment throws, as on a browser's window.
+Object.defineProperty(globalThis, "top", {
+  get: __rbForward(function () { return window; }),
+  enumerable: true,
+  configurable: true,
+});
+// `location` is the window's own [LegacyUnforgeable] attribute with
+// [PutForwards=href]: an assignment navigates, as `window.location = url`
+// does. A window has one Location for its life (a cross-document navigation
+// makes a new realm), so it is read again only when a host rebinds `window`.
+let __rbLocationWindow = null;
+let __rbLocation = null;
+Object.defineProperty(globalThis, "location", {
+  get: __rbForward(function () {
+    if (__rbLocationWindow !== window) {
+      __rbLocationWindow = window;
+      __rbLocation = __rbMember("location");
+    }
+    return __rbLocation;
+  }),
+  set(value) { window.location = value; },
+  enumerable: true,
+  configurable: true,
+});
+// The objects a window keeps for its life, aliased by reference. history,
+// navigator, crypto, indexedDB and caches are plain readonly attributes, so
+// assigning the bare name leaves them (a strict-mode assignment throws);
+// performance, screen and visualViewport are [Replaceable], so an assignment
+// replaces them. A name the window has no object for (dommy implements
+// neither indexedDB nor caches) is left undefined: pinning a read-only
+// `undefined` would make `"indexedDB" in globalThis` claim the feature and
+// refuse the polyfill a page assigns in its place.
+for (const __n of ["history", "navigator", "crypto", "indexedDB", "caches"]) {
+  try {
+    const value = window[__n];
+    if (value == null) continue;
+    Object.defineProperty(globalThis, __n, { value, writable: false, enumerable: true, configurable: true });
+  } catch (__e) {}
+}
 // Web Storage is read from the window on each access, not copied at boot: the
 // sessionStorage / localStorage getters throw a SecurityError when "obtain a
 // session/local storage bottle map" fails (HTML, Web storage), which it does
@@ -23,7 +89,7 @@ globalThis.navigator = window.navigator;
 // `globalThis` to the host, as window_builtins.js does, reads each of them).
 for (const __n of ["sessionStorage", "localStorage"]) {
   Object.defineProperty(globalThis, __n, {
-    get() { return window[__n]; },
+    get: __rbForward(function () { return __rbMember(__n); }),
     enumerable: false,
     configurable: true,
   });
@@ -43,7 +109,7 @@ const __rbWindowOperation = (name) => {
   return null;
 };
 const __rbForwardWindowMethod = (name) => {
-  const forward = function (...args) { return window[name](...args); };
+  const forward = __rbForward(function (...args) { return __rbMember(name).apply(window, args); });
   const operation = __rbWindowOperation(name);
   Object.defineProperty(forward, "name", { value: name });
   Object.defineProperty(forward, "length", { value: operation ? operation.required : 0 });
@@ -54,11 +120,10 @@ for (const __m of ["getComputedStyle", "matchMedia", "fetch",
   __rbForwardWindowMethod(__m);
 }
 
-// More bare globals frameworks read directly (e.g. performance.now(), crypto,
-// screen). Objects the window always returns the same of are aliased by
-// reference; methods forward (above) so `this` binds to the window.
-for (const __n of ["performance", "crypto", "screen", "visualViewport",
-                   "indexedDB", "caches"]) {
+// The [Replaceable] objects frameworks read directly (performance.now(),
+// screen), aliased by reference as plain data properties, which an assignment
+// replaces; methods forward (above) so `this` binds to the window.
+for (const __n of ["performance", "screen", "visualViewport"]) {
   try { globalThis[__n] = window[__n]; } catch (__e) {}
 }
 // Values that change (a resize, a scroll) are read from the window each time
@@ -66,22 +131,13 @@ for (const __n of ["performance", "crypto", "screen", "visualViewport",
 // replaces the accessor with the assigned value, as on a real window.
 for (const __n of ["devicePixelRatio", "innerWidth", "innerHeight",
                    "scrollX", "scrollY", "pageXOffset", "pageYOffset"]) {
-  try {
-    Object.defineProperty(globalThis, __n, {
-      get() { return window[__n]; },
-      set(value) {
-        Object.defineProperty(globalThis, __n, { value, writable: true, enumerable: true, configurable: true });
-      },
-      enumerable: true,
-      configurable: true,
-    });
-  } catch (__e) {}
+  try { __rbReplaceable(__n, __rbForward(function () { return __rbMember(__n); })); } catch (__e) {}
 }
 // `frameElement` is a plain readonly attribute: read from the window each
 // time (a frame's container can change), never replaced by an assignment.
 try {
   Object.defineProperty(globalThis, "frameElement", {
-    get() { return window.frameElement; },
+    get: __rbForward(function () { return __rbMember("frameElement"); }),
     enumerable: false,
     configurable: true,
   });
@@ -91,3 +147,4 @@ for (const __m of ["scrollTo", "scrollBy", "requestIdleCallback", "cancelIdleCal
                    "alert", "confirm", "prompt", "open", "postMessage"]) {
   try { __rbForwardWindowMethod(__m); } catch (__e) {}
 }
+})();

data/lib/dommy/js/quickjs/js/intl_polyfill.js

@@ -3,6 +3,9 @@
 // defined` (nuxt.com, i18n libraries, …). Install a small locale-naive
 // polyfill: it formats reasonably (grouped numbers, ISO-ish dates) so pages run
 // instead of crashing, without pulling in full ICU.
+// The IIFE keeps its helpers and constructors (I, group, Collator, …) out of
+// the page's global scope, where a page's own `let group` would collide.
+(function () {
 if (typeof globalThis.Intl === "undefined") {
   var I = {};
   var group = function (s) {
@@ -54,3 +57,4 @@ if (typeof globalThis.Intl === "undefined") {
   I.getCanonicalLocales = function (locs) { return Array.isArray(locs) ? locs.slice() : locs ? [String(locs)] : []; };
   globalThis.Intl = I;
 }
+})();

data/lib/dommy/js/quickjs/js/timer_globals.js

@@ -9,49 +9,70 @@
 // and only stringified if the callback actually throws (see
 // __rbFetchTimerOrigin + Runtime#handle_timer_error); a successful callback
 // forgets its origin and the map is size-capped, so this stays cheap.
-globalThis.__rbTimerOrigins = new Map();
+//
+// The IIFE keeps the helpers out of the page's global scope: a page's own
+// `let __rbDefer` would be a redeclaration, and a page's `let` of a name the
+// helpers looked up globally would take its place. __rbDefer keeps its name,
+// which marks the frame ErrorTranslator strips from origin stacks.
+(function () {
+const origins = new Map();
 const __rbDefer = (schedule, fn, delay) => {
   if (typeof fn !== "function") return schedule(fn, delay);
   const origin = new Error();
   let id;
   const wrapped = function () {
     const result = fn.apply(this, arguments);
-    __rbTimerOrigins.delete(id); // ran cleanly — no need to keep it
+    origins.delete(id); // ran cleanly — no need to keep it
     return result;
   };
   id = schedule(wrapped, delay);
-  __rbTimerOrigins.set(id, origin);
-  if (__rbTimerOrigins.size > 4096) __rbTimerOrigins.delete(__rbTimerOrigins.keys().next().value);
+  origins.set(id, origin);
+  if (origins.size > 4096) origins.delete(origins.keys().next().value);
   return id;
 };
 globalThis.__rbFetchTimerOrigin = (id) => {
-  const origin = __rbTimerOrigins.get(id);
+  const origin = origins.get(id);
   if (!origin) return "";
-  __rbTimerOrigins.delete(id);
+  origins.delete(id);
   return origin.stack || "";
 };
+// Each stands for the window's own and reaches it directly (dommy's
+// `__rbWindowMember`), not through whatever the window answers for the name,
+// which is this very function (see browser_globals.js).
+const __rbTimerForward = globalThis.__rbWindowForward || ((fn) => fn);
+const __rbTimerMember = globalThis.__rbWindowMember || ((name) => window[name]);
 // The signatures are the IDL's (HTML "timers"): `setTimeout(handler, timeout
 // = 0, ...arguments)` hands the extra arguments to the handler, and the
 // defaults keep each function's `length` the IDL's (1, 0, 1, 0, 1, 1).
-globalThis.setTimeout = function setTimeout(handler, timeout = 0, ...args) {
-  return __rbDefer((f, d) => window.setTimeout(f, d, ...args), handler, timeout);
-};
-globalThis.clearTimeout = function clearTimeout(id = 0) { return window.clearTimeout(id); };
-globalThis.setInterval = function setInterval(handler, timeout = 0, ...args) {
-  return __rbDefer((f, d) => window.setInterval(f, d, ...args), handler, timeout);
-};
-globalThis.clearInterval = function clearInterval(id = 0) { return window.clearInterval(id); };
-globalThis.requestAnimationFrame = function requestAnimationFrame(callback) {
-  return __rbDefer((f) => window.requestAnimationFrame(f), callback);
-};
-globalThis.cancelAnimationFrame = function cancelAnimationFrame(handle) {
-  return window.cancelAnimationFrame(handle);
-};
+globalThis.setTimeout = __rbTimerForward(function setTimeout(handler, timeout = 0, ...args) {
+  return __rbDefer((f, d) => __rbTimerMember("setTimeout").call(window, f, d, ...args), handler, timeout);
+});
+globalThis.clearTimeout = __rbTimerForward(function clearTimeout(id = 0) { return __rbTimerMember("clearTimeout").call(window, id); });
+globalThis.setInterval = __rbTimerForward(function setInterval(handler, timeout = 0, ...args) {
+  return __rbDefer((f, d) => __rbTimerMember("setInterval").call(window, f, d, ...args), handler, timeout);
+});
+globalThis.clearInterval = __rbTimerForward(function clearInterval(id = 0) { return __rbTimerMember("clearInterval").call(window, id); });
+globalThis.requestAnimationFrame = __rbTimerForward(function requestAnimationFrame(callback) {
+  return __rbDefer((f) => __rbTimerMember("requestAnimationFrame").call(window, f), callback);
+});
+globalThis.cancelAnimationFrame = __rbTimerForward(function cancelAnimationFrame(handle) {
+  return __rbTimerMember("cancelAnimationFrame").call(window, handle);
+});
 // queueMicrotask must share the engine's promise-job (microtask) queue so its
 // callbacks are FIFO-ordered with Promise reactions (the WHATWG
 // single-microtask-queue model). Routing through the Ruby scheduler instead
 // would drain on a separate pass, reordering it after all native promise jobs.
-globalThis.queueMicrotask = function queueMicrotask(callback) {
+// What the callback throws is reported at the window (HTML "report an
+// exception"), as window.queueMicrotask's is, rather than rejecting a promise
+// nobody holds.
+globalThis.queueMicrotask = __rbTimerForward(function queueMicrotask(callback) {
   if (typeof callback !== "function") throw new TypeError("queueMicrotask requires a function");
-  Promise.resolve().then(() => { callback(); });
-};
+  Promise.resolve().then(() => {
+    try {
+      callback();
+    } catch (error) {
+      __rbTimerMember("reportError").call(window, error);
+    }
+  });
+});
+})();

data/lib/dommy/js/quickjs/js/wasm_stub.js

@@ -7,6 +7,9 @@
 // `Memory` honors `{shared:true}` with a SharedArrayBuffer, which the engine
 // does ship. That is also what WPT's common/sab.js needs: it derives the SAB
 // constructor from `new WebAssembly.Memory({shared:true}).buffer.constructor`.
+// The IIFE keeps its helpers (unsupported, throwUnsupported) out of the
+// page's global scope.
+(function () {
 if (typeof globalThis.WebAssembly === "undefined") {
   var unsupported = function () { return Promise.reject(new Error("WebAssembly is not supported")); };
   var throwUnsupported = function () { throw new Error("WebAssembly is not supported"); };
@@ -24,3 +27,4 @@ if (typeof globalThis.WebAssembly === "undefined") {
     CompileError: Error, LinkError: Error, RuntimeError: Error,
   };
 }
+})();

data/lib/dommy/js/quickjs/version.rb

@@ -3,7 +3,7 @@
 module Dommy
   module Js
     module Quickjs
-      VERSION = "0.12.0"
+      VERSION = "0.13.0"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dommy-js-quickjs
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.13.0
 platform: ruby
 authors:
 - takahashim
@@ -29,20 +29,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.16.0
+        version: 0.17.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.17'
+        version: '0.18'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.16.0
+        version: 0.17.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.17'
+        version: '0.18'
 description: |
   dommy-js-quickjs lets JavaScript drive a Dommy DOM by embedding QuickJS (via
   the quickjs gem) and bridging DOM nodes to JS through an ES Proxy that routes
@@ -97,7 +97,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.20
+rubygems_version: 3.6.9
 specification_version: 4
 summary: QuickJS backend for running JavaScript against a Dommy DOM.
 test_files: []