dommy 0.8.0 → 0.9.0

data/lib/dommy/event.rb

@@ -130,7 +130,11 @@ module Dommy
           end
         end
 
-        CallableInvoker.invoke_listener(entry.listener, event)
+        if entry.passive?
+          event.__internal_run_passive__ { invoke_listener_isolated(entry.listener, event) }
+        else
+          invoke_listener_isolated(entry.listener, event)
+        end
 
         break if event.immediate_propagation_stopped?
       end
@@ -138,6 +142,36 @@ module Dommy
       nil
     end
 
+    # Run one listener, isolating a throw so it can't escape the dispatch.
+    # WHATWG "inner invoke": if a listener's callback throws, the exception is
+    # *reported* (to the global error handler) and event dispatch continues with
+    # the remaining listeners — a broken handler must not derail the others or
+    # abort whatever Ruby drove the dispatch (a synthetic click from the host).
+    # The engine already swallows this for a JS-initiated dispatchEvent
+    # (HostBridge#invoke_callback, raising:false), but that has proven
+    # engine/Ruby-version-dependent — on some QuickJS/Ruby combinations a JS
+    # listener's throw surfaces as a Ruby exception here — so guard the
+    # host-initiated path too, mirroring MutationObserver#flush.
+    def invoke_listener_isolated(listener, event)
+      CallableInvoker.invoke_listener(listener, event)
+    rescue StandardError => e
+      __dommy_dump_event_failure__(event, listener, e) if ENV["DOMMY_EVENT_DEBUG"]
+      nil
+    end
+
+    # Diagnostic only (DOMMY_EVENT_DEBUG=<file>): when a listener throws, append
+    # the event type + error to a log file so an otherwise-unreproducible page
+    # failure can be traced to the handler that choked.
+    def __dommy_dump_event_failure__(event, listener, error)
+      path = ENV["DOMMY_EVENT_DEBUG"]
+      line = "=== event listener raised on #{event.type}: #{error.class}: #{error.message.to_s[0, 200]} " \
+             "(listener=#{listener.class})\n"
+      # `::File` — inside `module Dommy`, bare `File` is Dommy's DOM File.
+      ::File.write(path, line, mode: "a")
+    rescue StandardError
+      nil
+    end
+
     # The next target up the propagation path. The default (no parent) suits
     # EventTargets that aren't tree nodes (AbortSignal, XHR, …); Element /
     # Document / ShadowRoot override it to walk the node tree.
@@ -163,6 +197,17 @@ module Dommy
       def capture?
         EventTarget.capture_flag(options)
       end
+
+      # `{ passive: true }` — the listener promises not to call preventDefault,
+      # so the event's preventDefault() is neutralized while it runs.
+      def passive?
+        case options
+        when Hash
+          EventTarget.js_truthy?(options.key?("passive") ? options["passive"] : options[:passive])
+        else
+          false
+        end
+      end
     end
 
     # The capture flag for an addEventListener/removeEventListener options
@@ -184,6 +229,9 @@ module Dommy
       return false if value.nil? || value == false
       return false if defined?(Bridge::UNDEFINED) && value.equal?(Bridge::UNDEFINED)
       return false if value.is_a?(Numeric) && (value.zero? || (value.respond_to?(:nan?) && value.nan?))
+      # The bridge marshals JS NaN as the symbol :NaN (it has no Ruby Float
+      # equivalent that survives the round-trip), which ToBoolean treats as false.
+      return false if value == :NaN
       return false if value == ""
 
       true
@@ -286,6 +334,9 @@ module Dommy
       @default_prevented = false
       @propagation_stopped = false
       @immediate_propagation_stopped = false
+      # Set while a passive listener runs, so preventDefault() is a no-op (per
+      # the passive listener flag in the DOM spec).
+      @in_passive_listener = false
       @target = nil
       @current_target = nil
       @event_phase = NONE
@@ -322,6 +373,16 @@ module Dommy
       @immediate_propagation_stopped
     end
 
+    # Run a block with the passive-listener flag set, so any preventDefault()
+    # inside it is neutralized. Restores the prior flag afterward.
+    def __internal_run_passive__
+      previous = @in_passive_listener
+      @in_passive_listener = true
+      yield
+    ensure
+      @in_passive_listener = previous
+    end
+
     def __internal_prepare_for_dispatch__(target)
       @target ||= target
     end
@@ -373,14 +434,23 @@ module Dommy
         @time_stamp
       when "cancelBubble"
         @propagation_stopped
+      when "immediatePropagationStopped"
+        # Non-standard, but real frameworks feature-detect it: Stimulus's
+        # extendEvent does `"immediatePropagationStopped" in event` and, when
+        # present, reads the flag directly instead of installing its own
+        # tracking shim. Expose the live flag so that path stays correct (it
+        # also keeps `"immediatePropagationStopped" in event` from being a
+        # present-but-undefined no-op).
+        @immediate_propagation_stopped
       when "eventPhase"
         event_phase
       else
-        # An unknown property reads back as JS `undefined`, not `null` — e.g. a
-        # non-dictionary member passed to the constructor (`new Event("x", {sweet:
-        # 1}).sweet`) is not reflected on the event. Genuinely-null DOM attributes
-        # (target/currentTarget/…) are explicit cases above and still return nil.
-        Bridge::UNDEFINED
+        # An unknown property is genuinely absent: JS `undefined` and
+        # `"x" in event` false — e.g. a non-dictionary member passed to the
+        # constructor (`new Event("x", {sweet: 1}).sweet`) is not reflected on the
+        # event. Genuinely-null DOM attributes (target/currentTarget/…) are
+        # explicit cases above and still return nil.
+        Bridge::ABSENT
       end
     end
 
@@ -406,7 +476,10 @@ module Dommy
     def __js_call__(method, args)
       case method
       when "preventDefault"
-        @default_prevented = true if @cancelable
+        # A passive listener's preventDefault() is a no-op (DOM "passive listener
+        # flag"), so the default action proceeds — what Stimulus's :passive
+        # action option relies on.
+        @default_prevented = true if @cancelable && !@in_passive_listener
         nil
       when "stopPropagation"
         @propagation_stopped = true
@@ -531,6 +604,60 @@ module Dommy
     end
   end
 
+  # `ErrorEvent` — the event interface for an uncaught error (fired at
+  # `window.onerror`). Error-reporting code constructs it directly
+  # (`new ErrorEvent("error", { message, error, … })`); without the constructor
+  # that call is "not a function" and takes the whole app down before it renders
+  # (x.com's client bootstrap does exactly this).
+  class ErrorEvent < Event
+    attr_reader :message, :filename, :lineno, :colno, :error
+
+    def initialize(type, init = nil)
+      super
+      @message = read_init(init, "message") || ""
+      @filename = read_init(init, "filename") || ""
+      @lineno = read_init(init, "lineno") || 0
+      @colno = read_init(init, "colno") || 0
+      @error = read_init(init, "error")
+    end
+
+    def __js_get__(key)
+      case key
+      when "message" then @message
+      when "filename" then @filename
+      when "lineno" then @lineno
+      when "colno" then @colno
+      when "error" then @error
+      else super
+      end
+    end
+  end
+
+  # `PromiseRejectionEvent` — fired as `unhandledrejection` / `rejectionhandled`
+  # when a promise rejects with no handler (`event.promise` / `event.reason`).
+  # Critically, its mere existence is what Promise feature-detection (core-js
+  # et al.) checks: without it, libraries decide the native Promise is
+  # incomplete and swap in a polyfill whose microtask queue the host scheduler
+  # cannot flush — silently starving every `.then`/await and hanging SPA
+  # hydration (this is why note.com rendered only a shell).
+  class PromiseRejectionEvent < Event
+    attr_reader :promise, :reason
+
+    def initialize(type, init = nil)
+      super
+      @promise = read_init(init, "promise")
+      @reason = read_init(init, "reason")
+    end
+
+    def __js_get__(key)
+      case key
+      when "promise" then @promise
+      when "reason" then @reason
+      else super
+      end
+    end
+  end
+
   class MouseEvent < Event
     def initialize(type, init = nil)
       super
@@ -771,6 +898,8 @@ module Dommy
         @rotation_angle
       when "force"
         @force
+      else
+        Bridge::ABSENT
       end
     end
   end
@@ -1028,8 +1157,18 @@ module Dommy
         return composite
       end
 
+      composite.__internal_make_dependent__
       list.each do |sig|
-        sig.add_event_listener("abort", proc { composite.__internal_mark_aborted__(sig.reason) })
+        # A plain source signal links directly; a composite is flattened to its
+        # own (already-flat) source signals, so the dependency graph stays one
+        # level deep and abort order is well-defined.
+        sources = sig.__internal_dependent__? ? sig.__internal_source_signals__ : [sig]
+        sources.each do |source|
+          next if composite.__internal_source_signals__.include?(source)
+
+          composite.__internal_add_source__(source)
+          source.__internal_add_dependent__(composite)
+        end
       end
 
       composite
@@ -1038,6 +1177,17 @@ module Dommy
     def initialize
       @aborted = false
       @reason = nil
+      # The WHATWG "dependent signal" model backing AbortSignal.any: a composite
+      # signal flattens to its original (non-dependent) source signals, and each
+      # source holds an ordered list of the composites depending on it — so abort
+      # propagation fires in source-then-dependents order, not via event chaining.
+      @dependent = false
+      @source_signals = []
+      @dependent_signals = []
+      # WHATWG "abort algorithms": callbacks run synchronously during abort,
+      # BEFORE the "abort" event — so a consumer (e.g. an Observable subscription)
+      # can tear down ahead of any externally-registered abort listener.
+      @abort_algorithms = []
     end
 
     # Background-thread timeout used by `AbortSignal.timeout` when no
@@ -1084,6 +1234,8 @@ module Dommy
         @aborted ? @reason : Bridge::UNDEFINED
       when "onabort"
         @onabort_handler
+      else
+        Bridge::ABSENT
       end
     end
 
@@ -1101,7 +1253,7 @@ module Dommy
     end
 
     include Bridge::Methods
-    js_methods %w[addEventListener removeEventListener dispatchEvent throwIfAborted]
+    js_methods %w[addEventListener removeEventListener dispatchEvent throwIfAborted __internalAddAbortAlgorithm]
     def __js_call__(method, args)
       case method
       when "addEventListener"
@@ -1112,22 +1264,101 @@ module Dommy
         dispatch_event(args[0])
       when "throwIfAborted"
         throw_if_aborted
+      when "__internalAddAbortAlgorithm"
+        __internal_add_abort_algorithm__(args[0])
       end
     end
 
+    # Register an abort algorithm (WHATWG "add an algorithm to a signal"): it runs
+    # synchronously when the signal aborts, before the "abort" event. A no-op once
+    # already aborted — the caller handles that case itself. Exposed to the JS
+    # Observable polyfill so a subscription's consumer-abort fires ahead of any
+    # external abort listener (the spec's downstream-before-upstream ordering).
+    def __internal_add_abort_algorithm__(callback)
+      @abort_algorithms << callback unless @aborted
+      nil
+    end
+
     # Sentinel meaning "no reason argument was supplied" — distinct from an
     # explicit `null` reason (`abort(null)` keeps reason null, but `abort()` /
     # `abort(undefined)` default to a fresh AbortError).
     NO_REASON = Object.new
 
+    # WHATWG "signal abort": set the reason, then propagate to dependent signals
+    # — firing "abort" at this signal FIRST and then at each dependent in the
+    # order it was registered (the reasons are all stamped before any event
+    # fires, so a handler observing a sibling sees it already aborted).
     def __internal_mark_aborted__(reason = NO_REASON)
       return if @aborted
 
       @aborted = true
       no_reason = reason.equal?(NO_REASON) || (defined?(Bridge::UNDEFINED) && reason.equal?(Bridge::UNDEFINED))
       @reason = no_reason ? DOMException::AbortError.new("signal is aborted without reason") : reason
+
+      dependents_to_abort = []
+      @dependent_signals.each do |dependent|
+        next if dependent.aborted?
+
+        dependent.__internal_set_reason__(@reason)
+        dependents_to_abort << dependent
+      end
+
+      __internal_run_abort_steps__
+      dependents_to_abort.each(&:__internal_run_abort_steps__)
+    end
+
+    # ----- dependent-signal plumbing (package-private, used by .any) -----
+
+    def __internal_make_dependent__
+      @dependent = true
+    end
+
+    def __internal_dependent__?
+      @dependent
+    end
+
+    def __internal_source_signals__
+      @source_signals
+    end
+
+    def __internal_add_source__(source)
+      @source_signals << source
+    end
+
+    def __internal_add_dependent__(dependent)
+      @dependent_signals << dependent
+    end
+
+    # Mark aborted with a reason WITHOUT firing — the orchestrating source stamps
+    # every dependent's reason up front, then fires the events in order.
+    def __internal_set_reason__(reason)
+      @aborted = true
+      @reason = reason
+    end
+
+    # The spec's "abort steps": run the registered abort algorithms first
+    # (synchronously, ahead of any listener), then fire the trusted "abort" event.
+    def __internal_run_abort_steps__
+      algorithms = @abort_algorithms
+      @abort_algorithms = []
+      algorithms.each { |algo| invoke_abort_algorithm(algo) }
       dispatch_event(Event.new("abort", "bubbles" => false, "cancelable" => false).__internal_mark_trusted__)
     end
+
+    # Run one abort algorithm (a JS callback over the bridge, or a Ruby proc).
+    # A throw is swallowed deliberately: WHATWG runs every abort algorithm and
+    # then fires the "abort" event regardless, so one algorithm's failure must
+    # not abort the run. (The sole caller — the Observable polyfill — already
+    # catches inside its own teardown, so this is a defensive backstop.)
+    def invoke_abort_algorithm(algo)
+      if algo.respond_to?(:__js_call__)
+        algo.__js_call__("call", [])
+      elsif algo.respond_to?(:call)
+        algo.call
+      end
+    rescue StandardError
+      nil
+    end
   end
 
   class AbortController

data/lib/dommy/fetch.rb

@@ -2,17 +2,26 @@
 
 require "json"
 require "securerandom"
+require_relative "data_uri"
 
 module Dommy
-  # `fetch` polyfill. No real network — instead consults
-  # `JS.global[:__fetchy_stub__]` (a Hash{url => entry}) installed by
-  # the test. Mirrors the same fixture protocol that `test_fetchy.rb`'s
-  # JavaScript installer uses, so tests don't need a JS engine to drive
-  # the stub.
+  # `fetch` polyfill. No real network — instead resolves a response
+  # *entry* and synthesizes a Response from it. Entries come from, in
+  # order:
   #
-  # Each entry in the stub hash supports:
+  #   1. `window.globals["__fetch_handler__"]` — a callable
+  #      `call(url, init) -> entry-or-nil`. This is the seam host
+  #      environments use to serve real requests (e.g. dommy-rack's
+  #      NetworkBridge routes same-origin URLs to the Rack app).
+  #      Returning nil falls through to the stub maps.
+  #   2. `JS.global[:__fetchy_stub__]` (a Hash{url => entry})
+  #      installed by the test. Mirrors the same fixture protocol that
+  #      `test_fetchy.rb`'s JavaScript installer uses, so tests don't
+  #      need a JS engine to drive the stub.
+  #
+  # Each entry supports:
   #   "status" / "statusText" / "body" / "contentType" /
-  #   "headers" (Hash) / "delay" (ms)
+  #   "headers" (Hash) / "url" / "redirected" / "delay" (ms)
   # plus AbortController signal propagation when `init[:signal]` is
   # passed.
   class FetchFn
@@ -24,17 +33,12 @@ module Dommy
     # `__js_call__("fetch", ...)` or as a callable handle. Both routes
     # delegate to `call(args)` so behavior is identical.
     def __js_call__(_method, args)
-      url = args[0].to_s
+      # Per Fetch, the request URL is resolved against the document base URL up
+      # front; the handler, stub maps, and response.url all see the absolute
+      # URL (no per-handler resolution).
+      url = @window.__internal_resolve_url__(args[0].to_s)
       init = normalize_init(args[1] || {})
 
-      # Each spec file installs its stub under its own global name.
-      # `test_fetchy.rb` uses `__fetchy_stub__`; `test_resource*.rb`
-      # use `__resource_fetch_stub__` and `__inject_fetch_stub__`.
-      # Check them in order — only one should be set at a time.
-      stub_map = @window.globals["__fetchy_stub__"] ||
-        @window.globals["__resource_fetch_stub__"] ||
-        @window.globals["__inject_fetch_stub__"] ||
-        {}
       # `js_eval`'s JS installer increments these globals; mirror so
       # specs that probe `__fetch_count__` / `__last_url__` / etc.
       # observe the same state shape they'd see from a real injector.
@@ -43,13 +47,43 @@ module Dommy
       @window.globals["__last_init__"] = init
       @window.globals["__last_body__"] = init["body"] if init.is_a?(Hash)
 
-      entry = stub_map[url] if stub_map.is_a?(Hash)
       promise = PromiseValue.new(@window)
+      result = resolve_entry(url, init)
+      # A handler may answer asynchronously (live network off-thread): it returns
+      # a deferred whose response arrives later and is applied on the page thread
+      # (via the scheduler inbox). The sync path (stubs / cache / data:) resolves
+      # the promise inline, exactly as before.
+      if result.respond_to?(:on_complete)
+        result.on_complete { |entry| fulfill_from_entry(promise, entry, url, init) }
+      else
+        fulfill_from_entry(promise, result, url, init)
+      end
+      promise
+    end
+
+    private
 
+    # Resolve `promise` from a response entry (nil -> 404), honoring a simulated
+    # `delay`. Used both for a synchronous entry and for an async one delivered
+    # later on the page thread.
+    def fulfill_from_entry(promise, entry, url, init)
+      # WHATWG: a fetch is resolved by a networking *task*, never inline during
+      # the fetch() call — so the initiating script runs to completion and its
+      # microtask checkpoint happens first. Defer the fulfillment onto the
+      # scheduler as a task so the synchronous data path gets the same event-loop
+      # semantics as the async DeferredResponse path. Without a scheduler (rare
+      # embedder), fall back to inline.
+      if (sched = @window.respond_to?(:scheduler) ? @window.scheduler : nil)
+        sched.set_timeout(proc { deliver_entry(promise, entry, url, init) }, 0)
+      else
+        deliver_entry(promise, entry, url, init)
+      end
+    end
+
+    def deliver_entry(promise, entry, url, init)
       if entry.nil?
-        response = Response.new(@window, body: "not found", status: 404, status_text: "Not Found", type: "basic")
-        promise.fulfill(response)
-        return promise
+        promise.fulfill(Response.new(@window, body: "not found", status: 404, status_text: "Not Found", type: "basic"))
+        return
       end
 
       body = entry["body"]
@@ -58,14 +92,15 @@ module Dommy
       content_type = entry["contentType"] || "text/plain"
       headers = entry["headers"] || {"Content-Type" => content_type}
       # Simulate a followed redirect: `[:url]` overrides the response URL (the
-      # final location) and `[:redirected]` flags it, so consumers that branch
-      # on `response.redirected` / `response.url` (e.g. Turbo updating history to
-      # the redirected location) see a realistic response.
+      # final location) and `[:redirected]` flags it, so consumers that branch on
+      # `response.redirected` / `response.url` (e.g. Turbo updating history to the
+      # redirected location) see a realistic response.
       response_url = entry["url"] || url
       redirected = entry["redirected"] ? true : false
 
-      delay = entry["delay"]
-      if delay
+      __dommy_dump_fetch__(url, init, status, headers, body) if ENV["DOMMY_FETCH_DEBUG"]
+
+      if (delay = entry["delay"])
         install_delayed_resolve(promise, body, status, status_text, headers, init, delay)
       else
         promise.fulfill(
@@ -73,11 +108,36 @@ module Dommy
             headers: headers, url: response_url, redirected: redirected, type: "basic")
         )
       end
-
-      promise
     end
 
-    private
+    # Resolve the response entry for a request: a `__fetch_handler__`
+    # callable gets first refusal; a nil from it (or no handler) falls
+    # through to the stub maps. Each spec file installs its stub under
+    # its own global name — `test_fetchy.rb` uses `__fetchy_stub__`;
+    # `test_resource*.rb` use `__resource_fetch_stub__` and
+    # `__inject_fetch_stub__`. Checked in order; only one should be set
+    # at a time.
+    def resolve_entry(url, init)
+      if (decoded = DataUri.parse(url))
+        return {"body" => decoded[:body], "status" => 200, "statusText" => "OK",
+                "contentType" => decoded[:content_type]}
+      end
+
+      handler = @window.globals["__fetch_handler__"]
+      if handler.respond_to?(:call)
+        entry = handler.call(url, init)
+        return entry if entry
+      end
+
+      stub_map = @window.globals["__fetchy_stub__"] ||
+        @window.globals["__resource_fetch_stub__"] ||
+        @window.globals["__inject_fetch_stub__"]
+      return nil unless stub_map.is_a?(Hash)
+
+      # The URL is now absolute; a stub keyed by a path ("/api") still matches
+      # its resolved form ("http://host/api").
+      stub_map[url] || stub_map[@window.__internal_url_path__(url)]
+    end
 
     # Coerce `init` into a Hash with string keys so the rest of the
     # pipeline (and the `__last_init__` globals) sees a uniform shape.
@@ -97,6 +157,33 @@ module Dommy
       h
     end
 
+    # Diagnostic only (DOMMY_FETCH_DEBUG=<file>): append a record of what the
+    # page's fetch() received, so a response that an app's data layer can't
+    # consume (e.g. Apollo's "link chain completed without emitting a value",
+    # #95) can be traced to the actual request/response bytes Dommy handed it.
+    # Every fetch is logged compactly; a GraphQL request also dumps full bodies
+    # (that is where the emission breaks), which is the exchange we need to see.
+    def __dommy_dump_fetch__(url, init, status, headers, body)
+      path = ENV["DOMMY_FETCH_DEBUG"]
+      graphql = url.include?("graphql")
+      req_headers = init.is_a?(Hash) ? init["headers"] : nil
+      req_body = init.is_a?(Hash) ? init["body"] : nil
+      content_type = headers.is_a?(Hash) ? headers.find { |k, _| k.to_s.downcase == "content-type" }&.last : nil
+      method = (init.is_a?(Hash) ? (init["method"] || "GET") : "GET").to_s.upcase
+      cap = graphql ? 8000 : 300
+
+      lines = ["=== fetch #{graphql ? "[graphql] " : ""}#{method} #{url}"]
+      lines << "> req-headers: #{req_headers.inspect}" if graphql && req_headers
+      lines << "> req-body: #{req_body.to_s[0, cap]}" if req_body
+      lines << "< #{status} #{content_type} (#{body.to_s.bytesize} bytes)"
+      lines << "< res-headers: #{headers.inspect}" if graphql
+      lines << "< res-body: #{body.to_s[0, cap]}"
+      # `::File` — inside `module Dommy`, bare `File` resolves to Dommy's DOM File.
+      ::File.write(path, "#{lines.join("\n")}\n\n", mode: "a")
+    rescue StandardError
+      nil
+    end
+
     def install_delayed_resolve(promise, body, status, status_text, headers, init, delay_ms)
       # AbortController cancellation: when init.signal is present and
       # `.abort()` fires before the timer, reject with an AbortError.
@@ -146,9 +233,16 @@ module Dommy
       @mode = (opts["mode"] || opts[:mode] || "cors").to_s
       @cache = (opts["cache"] || opts[:cache] || "default").to_s
       @redirect = (opts["redirect"] || opts[:redirect] || "follow").to_s
+      # WHATWG: a Request ALWAYS has an associated signal (an AbortSignal). Use a
+      # provided signal when present (so `request.signal` is the caller's own
+      # controller signal — react-router add/removeEventListener's it directly),
+      # else a fresh, never-aborted one. Never undefined, or consumers that read
+      # `request.signal.removeEventListener` crash.
+      sig = opts["signal"] || opts[:signal]
+      @signal = sig.respond_to?(:__js_call__) ? sig : AbortSignal.new
     end
 
-    attr_reader :headers, :credentials, :mode, :cache, :redirect
+    attr_reader :headers, :credentials, :mode, :cache, :redirect, :signal
 
     def __js_get__(key)
       case key
@@ -168,6 +262,10 @@ module Dommy
         @cache
       when "redirect"
         @redirect
+      when "signal"
+        @signal
+      else
+        Bridge::ABSENT
       end
     end
 
@@ -184,7 +282,8 @@ module Dommy
           "credentials" => @credentials,
           "mode" => @mode,
           "cache" => @cache,
-          "redirect" => @redirect
+          "redirect" => @redirect,
+          "signal" => @signal
         )
       end
     end
@@ -202,13 +301,20 @@ module Dommy
     # Redirect statuses accepted by `Response.redirect(url, status)`.
     REDIRECT_STATUSES = [301, 302, 303, 307, 308].freeze
 
+    # Forbidden response-header names (WHATWG Fetch): never exposed on a
+    # Response's Headers. `Set-Cookie` is handled by the network layer's cookie
+    # jar, not JS — and a real server often sends MULTIPLE Set-Cookie headers
+    # folded into one newline-joined value, which is an invalid Headers value and
+    # used to crash Response construction (e.g. doubleclick's IDE+test_cookie).
+    FORBIDDEN_RESPONSE_HEADERS = %w[set-cookie set-cookie2].freeze
+
     def initialize(window, body:, status: 200, status_text: "", headers: nil, url: "",
                    redirected: false, type: "default", has_body: true)
       @window = window
       @body = body.to_s
       @status = status
       @status_text = status_text.to_s
-      @headers = Headers.new(headers || {})
+      @headers = Headers.new(strip_forbidden_headers(headers))
       @url = url.to_s
       @redirected = redirected ? true : false
       @type = type
@@ -217,6 +323,16 @@ module Dommy
       @body_stream = nil
     end
 
+    # Drop forbidden response headers (Set-Cookie/Set-Cookie2) before they reach
+    # the Headers object. Only a Hash (the network path) carries them; a Headers
+    # or nil passes through unchanged.
+    def strip_forbidden_headers(headers)
+      return {} if headers.nil?
+      return headers unless headers.is_a?(Hash)
+
+      headers.reject { |name, _| FORBIDDEN_RESPONSE_HEADERS.include?(name.to_s.downcase) }
+    end
+
     # WHATWG `new Response(body, init)`. Validates the status (200–599, else a
     # RangeError; a null-body status 204/205/304 with a body is a TypeError),
     # defaults statusText to "" and status to 200, accepts `init.headers` as a
@@ -414,6 +530,8 @@ module Dommy
         body_stream
       when "bodyUsed"
         body_used?
+      else
+        Bridge::ABSENT
       end
     end
 
@@ -622,7 +740,7 @@ module Dommy
     def fill(init)
       case init
       when Headers
-        init.__raw_pairs__.each { |name, value| append_value(name, value) }
+        init.__internal_raw_pairs__.each { |name, value| append_value(name, value) }
       when Array
         init.each do |pair|
           unless pair.is_a?(Array) && pair.length == 2
@@ -639,7 +757,7 @@ module Dommy
 
     # Internal: a copy of the raw [name, value] pairs — lets one Headers be
     # filled from another without losing duplicates or split Set-Cookie values.
-    def __raw_pairs__
+    def __internal_raw_pairs__
       @list.map(&:dup)
     end
 
@@ -653,7 +771,7 @@ module Dommy
     end
 
     def __js_get__(_key)
-      nil
+      Bridge::ABSENT # Headers exposes only methods; any property read is absent
     end
 
     def __js_set__(_key, _value)

data/lib/dommy/form_data.rb

@@ -105,6 +105,8 @@ module Dommy
       case key
       when "size", "length"
         size
+      else
+        Bridge::ABSENT
       end
     end