buninu-browser 0.2.0 → 0.2.2

package/patches/happy-dom/0002-use-bun-platform-adapters.patch

@@ -9,7 +9,7 @@ index 2de8270..0c5034b 100644
  import ProgressEvent from '../event/events/ProgressEvent.js';
  import DOMExceptionNameEnum from '../exception/DOMExceptionNameEnum.js';
 diff --git a/packages/happy-dom/src/nodes/html-image-element/HTMLImageElement.ts b/packages/happy-dom/src/nodes/html-image-element/HTMLImageElement.ts
-index f2c85d6..961edb1 100644
+index f2c85d6..dcef8e0 100644
 --- a/packages/happy-dom/src/nodes/html-image-element/HTMLImageElement.ts
 +++ b/packages/happy-dom/src/nodes/html-image-element/HTMLImageElement.ts
 @@ -4,7 +4,7 @@ import type ICanvasShape from '../../canvas/ICanvasShape.js';
@@ -21,39 +21,159 @@ index f2c85d6..961edb1 100644
  import type Response from '../../fetch/Response.js';
  import type Attr from '../attr/Attr.js';
  
-@@ -424,15 +424,18 @@ export default class HTMLImageElement extends HTMLElement implements ICanvasShap
- 			const buffer = Buffer.from(dataUrlMatch[2], 'base64');
+@@ -19,6 +19,8 @@ const DATA_URL_REGEX = /^\s*data:([^,]+)?,(.*)/;
+ export default class HTMLImageElement extends HTMLElement implements ICanvasShape {
+ 	public [PropertySymbol.tagName] = 'IMG';
+ 	public [PropertySymbol.complete] = true;
++	// Bumped whenever src changes: an image decoded for an earlier src is dropped.
++	#loadGeneration = 0;
+ 	public [PropertySymbol.naturalHeight] = 0;
+ 	public [PropertySymbol.naturalWidth] = 0;
+ 	public [PropertySymbol.loading] = 'auto';
+@@ -357,6 +359,7 @@ export default class HTMLImageElement extends HTMLElement implements ICanvasShap
+ 		super[PropertySymbol.onSetAttribute](attribute, replacedAttribute);
+ 
+ 		if (attribute[PropertySymbol.name] === 'src') {
++			const generation = ++this.#loadGeneration;
+ 			const url = this.#parseUrl(attribute[PropertySymbol.value]);
+ 
+ 			if (!url) {
+@@ -367,13 +370,13 @@ export default class HTMLImageElement extends HTMLElement implements ICanvasShap
+ 				return;
+ 			}
+ 
+-			if (this.#loadDataUrl(url)) {
++			if (this.#loadDataUrl(url, generation)) {
+ 				return;
+ 			}
+ 
+ 			const settings = new WindowBrowserContext(this[PropertySymbol.window]).getSettings();
+ 			if (settings?.enableImageFileLoading) {
+-				this.#loadUrlSource(this.src);
++				this.#loadUrlSource(this.src, generation);
+ 			}
+ 		}
+ 	}
+@@ -385,6 +388,7 @@ export default class HTMLImageElement extends HTMLElement implements ICanvasShap
+ 		super[PropertySymbol.onRemoveAttribute](removedAttribute);
+ 
+ 		if (removedAttribute[PropertySymbol.name] === 'src') {
++			this.#loadGeneration++;
  			this[PropertySymbol.complete] = true;
+ 			this[PropertySymbol.naturalHeight] = 0;
+ 			this[PropertySymbol.naturalWidth] = 0;
+@@ -415,24 +419,37 @@ export default class HTMLImageElement extends HTMLElement implements ICanvasShap
+ 	 * Loads the image from the given data URL.
+ 	 *
+ 	 * @param src Source.
++	 * @param generation The load this is (see #loadGeneration).
+ 	 * @returns True if the image was loaded, false otherwise.
+ 	 */
+-	#loadDataUrl(src: string): boolean {
++	#loadDataUrl(src: string, generation: number): boolean {
+ 		const dataUrlMatch = src.match(DATA_URL_REGEX);
+ 
+ 		if (dataUrlMatch) {
+ 			const buffer = Buffer.from(dataUrlMatch[2], 'base64');
+-			this[PropertySymbol.complete] = true;
  			this[PropertySymbol.buffer] = buffer;
 -			try {
 -				const dimensions = BufferImageSize(buffer);
-+			this[PropertySymbol.complete] = false;
-+			ImageSize(buffer).then((dimensions) => {
- 				this[PropertySymbol.naturalHeight] = dimensions.height;
- 				this[PropertySymbol.naturalWidth] = dimensions.width;
+-				this[PropertySymbol.naturalHeight] = dimensions.height;
+-				this[PropertySymbol.naturalWidth] = dimensions.width;
 -			} catch (e) {
-+				this[PropertySymbol.complete] = true;
-+				this.dispatchEvent(new this[PropertySymbol.window].Event('load'));
-+			}).catch(() => {
- 				this[PropertySymbol.naturalHeight] = 0;
- 				this[PropertySymbol.naturalWidth] = 0;
+-				this[PropertySymbol.naturalHeight] = 0;
+-				this[PropertySymbol.naturalWidth] = 0;
 -			}
 -			this.dispatchEvent(new this[PropertySymbol.window].Event('load'));
-+				this[PropertySymbol.complete] = true;
-+				this.dispatchEvent(new this[PropertySymbol.window].Event('error'));
-+			});
++			this[PropertySymbol.complete] = false;
++			// The size is read asynchronously; a src set meanwhile wins.
++			ImageSize(buffer).then(
++				(dimensions) => {
++					if (generation !== this.#loadGeneration) {
++						return;
++					}
++					this[PropertySymbol.naturalHeight] = dimensions.height;
++					this[PropertySymbol.naturalWidth] = dimensions.width;
++					this[PropertySymbol.complete] = true;
++					this.dispatchEvent(new this[PropertySymbol.window].Event('load'));
++				},
++				() => {
++					if (generation !== this.#loadGeneration) {
++						return;
++					}
++					this[PropertySymbol.naturalHeight] = 0;
++					this[PropertySymbol.naturalWidth] = 0;
++					this[PropertySymbol.complete] = true;
++					this.dispatchEvent(new this[PropertySymbol.window].Event('error'));
++				}
++			);
  			return true;
  		}
  		return false;
-@@ -484,7 +487,7 @@ export default class HTMLImageElement extends HTMLElement implements ICanvasShap
+@@ -442,8 +459,9 @@ export default class HTMLImageElement extends HTMLElement implements ICanvasShap
+ 	 * Loads the image from the given source.
+ 	 *
+ 	 * @param src Source.
++	 * @param generation The load this is (see #loadGeneration).
+ 	 */
+-	async #loadUrlSource(src: string): Promise<void> {
++	async #loadUrlSource(src: string, generation: number): Promise<void> {
+ 		this[PropertySymbol.complete] = false;
+ 		this[PropertySymbol.naturalHeight] = 0;
+ 		this[PropertySymbol.naturalWidth] = 0;
+@@ -457,6 +475,10 @@ export default class HTMLImageElement extends HTMLElement implements ICanvasShap
+ 			error = <Error>e;
+ 		}
+ 
++		if (generation !== this.#loadGeneration) {
++			return;
++		}
++
+ 		if (error || !response?.ok) {
+ 			this[PropertySymbol.complete] = true;
+ 			this.dispatchEvent(new this[PropertySymbol.window].Event('error'));
+@@ -475,23 +497,34 @@ export default class HTMLImageElement extends HTMLElement implements ICanvasShap
+ 		try {
+ 			buffer = await response.buffer();
+ 		} catch (e) {
++			if (generation !== this.#loadGeneration) {
++				return;
++			}
+ 			this[PropertySymbol.complete] = true;
+ 			this.dispatchEvent(new this[PropertySymbol.window].Event('error'));
+ 			return;
+ 		}
+ 
+-		this[PropertySymbol.complete] = true;
++		if (generation !== this.#loadGeneration) {
++			return;
++		}
++
  		this[PropertySymbol.buffer] = buffer;
  
++		let dimensions = { width: 0, height: 0 };
  		try {
 -			const dimensions = BufferImageSize(buffer);
-+			const dimensions = await ImageSize(buffer);
- 			this[PropertySymbol.naturalHeight] = dimensions.height;
- 			this[PropertySymbol.naturalWidth] = dimensions.width;
+-			this[PropertySymbol.naturalHeight] = dimensions.height;
+-			this[PropertySymbol.naturalWidth] = dimensions.width;
++			dimensions = await ImageSize(buffer);
  		} catch (e) {
+-			this[PropertySymbol.naturalHeight] = 0;
+-			this[PropertySymbol.naturalWidth] = 0;
++			// Undecodable: no natural size.
+ 		}
+ 
++		if (generation !== this.#loadGeneration) {
++			return;
++		}
++
++		this[PropertySymbol.naturalHeight] = dimensions.height;
++		this[PropertySymbol.naturalWidth] = dimensions.width;
++		this[PropertySymbol.complete] = true;
+ 		this.dispatchEvent(new this[PropertySymbol.window].Event('load'));
+ 	}
+ }
 diff --git a/packages/happy-dom/src/web-socket/WebSocket.ts b/packages/happy-dom/src/web-socket/WebSocket.ts
 index 3075e3a..bea5f97 100644
 --- a/packages/happy-dom/src/web-socket/WebSocket.ts

package/patches/happy-dom/0006-parse-css-escapes-in-selectors.patch

@@ -0,0 +1,115 @@
+diff --git a/packages/happy-dom/src/query-selector/SelectorParser.ts b/packages/happy-dom/src/query-selector/SelectorParser.ts
+index 60cc951..62cf4b9 100644
+--- a/packages/happy-dom/src/query-selector/SelectorParser.ts
++++ b/packages/happy-dom/src/query-selector/SelectorParser.ts
+@@ -12,10 +12,11 @@ import type { TGlobalMatchFunction } from './TGlobalMatchFunction.js';
+ /**
+  * Selector group RegExp.
+  *
+- * Group 1: Combinator (" ", ",", "+", ">", "̣~")
+- * Group 2: Parentheses or brackets.
++ * Group 1: An escaped character (e.g. "\:", "\31 "), skipped.
++ * Group 2: Combinator (" ", ",", "+", ">", "̣~")
++ * Group 3: Parentheses, brackets or quotes.
+  */
+-const SELECTOR_GROUP_REGEXP = /(\s*[\s,+>~]\s*)|([\[\]\(\)"'])/g;
++const SELECTOR_GROUP_REGEXP = /(\\[0-9a-fA-F]{1,6}\s?|\\[\s\S])|(\s*[\s,+>~]\s*)|([\[\]\(\)"'])/g;
+ 
+ /**
+  * Selector RegExp.
+@@ -45,7 +46,7 @@ const SELECTOR_GROUP_REGEXP = /(\s*[\s,+>~]\s*)|([\[\]\(\)"'])/g;
+  * Group 23: Pseudo element (e.g. "::after", "::-webkit-inner-spin-button").
+  */
+ const SELECTOR_REGEXP =
+-	/(\*)|([a-zA-Z0-9\u00A0-\uFFFF-]+)|#(([a-zA-Z0-9\u00A0-\uFFFF_-]|\\.)+)|\.(([a-zA-Z0-9\u00A0-\uFFFF_-]|\\.)+)|\[(([a-zA-Z0-9-_]|\\.)+)\]|\[(([a-zA-Z0-9-_]|\\.)+)\s*([~|^$*]{0,1})\s*=\s*("([^"]*)"|'([^']*)')\s*(s|i){0,1}\]|\[(([a-zA-Z0-9-_]|\\.)+)\s*([~|^$*]{0,1})\s*=\s*(([a-zA-Z0-9\u00A0-\uFFFF_¤£-]|\\.)+)\]|:([a-zA-Z-]+)\s*\(.+\)|:([a-zA-Z-]+)|::([a-zA-Z-]+)/g;
++	/(\*)|((?:[a-zA-Z0-9\u00A0-\uFFFF-]|\\[0-9a-fA-F]{1,6}\s?|\\.)+)|#(([a-zA-Z0-9\u00A0-\uFFFF_-]|\\[0-9a-fA-F]{1,6}\s?|\\.)+)|\.(([a-zA-Z0-9\u00A0-\uFFFF_-]|\\[0-9a-fA-F]{1,6}\s?|\\.)+)|\[(([a-zA-Z0-9-_]|\\[0-9a-fA-F]{1,6}\s?|\\.)+)\]|\[(([a-zA-Z0-9-_]|\\[0-9a-fA-F]{1,6}\s?|\\.)+)\s*([~|^$*]{0,1})\s*=\s*("((?:[^"\\]|\\[\s\S])*)"|'((?:[^'\\]|\\[\s\S])*)')\s*(s|i){0,1}\]|\[(([a-zA-Z0-9-_]|\\[0-9a-fA-F]{1,6}\s?|\\.)+)\s*([~|^$*]{0,1})\s*=\s*(([a-zA-Z0-9\u00A0-\uFFFF_¤£-]|\\[0-9a-fA-F]{1,6}\s?|\\.)+)\]|:([a-zA-Z-]+)\s*\(.+\)|:([a-zA-Z-]+)|::([a-zA-Z-]+)/g;
+ 
+ /**
+  * Selector pseudo RegExp.
+@@ -55,11 +56,6 @@ const SELECTOR_REGEXP =
+  */
+ const SELECTOR_PSEUDO_REGEXP = /:([a-zA-Z-]+)|([()])/g;
+ 
+-/**
+- * Escaped Character RegExp.
+- */
+-const ESCAPED_CHARACTER_REGEXP = /\\/g;
+-
+ /**
+  * CSS Escape RegExp.
+  *
+@@ -187,6 +183,11 @@ export default class SelectorParser {
+ 
+ 		while ((match = regExp.exec(selector))) {
+ 			if (match[1]) {
++				// An escaped character (CSS Syntax §4.3.7) is part of the selector it is in,
++				// never a combinator, bracket or quote.
++				continue;
++			}
++			if (match[2]) {
+ 				// Matches combinator (" ", ",", "+", ">", "̣~")
+ 				// We should ignore combinators that are inside parentheses, brackets or apostrophes
+ 
+@@ -198,7 +199,7 @@ export default class SelectorParser {
+ 				) {
+ 					const childSelector = selector.substring(lastIndex, match.index).trim();
+ 
+-					switch (match[1].trim()) {
++					switch (match[2].trim()) {
+ 						case ',':
+ 							selectorItem = this.getSelectorGroupItem(childSelector, combinator);
+ 							if (!selectorItem) {
+@@ -262,7 +263,7 @@ export default class SelectorParser {
+ 			} else {
+ 				// Matches parentheses or brackets.
+ 
+-				switch (match[2]) {
++				switch (match[3]) {
+ 					case '(':
+ 						if (depth.singleApostrophe === 0 && depth.doubleApostrophe === 0) {
+ 							depth.parentheses++;
+@@ -365,22 +366,22 @@ export default class SelectorParser {
+ 			} else if (match[2]) {
+ 				// Matches tag name, e.g. "div"
+ 
+-				selectorItem.tagName = match[2].toUpperCase();
++				selectorItem.tagName = SelectorParser.cssUnescape(match[2]).toUpperCase();
+ 			} else if (match[3]) {
+ 				// Matches ID, e.g. "#id"
+ 
+-				selectorItem.id = match[3].replace(ESCAPED_CHARACTER_REGEXP, '');
++				selectorItem.id = SelectorParser.cssUnescape(match[3]);
+ 			} else if (match[5]) {
+ 				// Matches class names, e.g. ".class1"
+ 
+ 				selectorItem.classNames = selectorItem.classNames || [];
+-				selectorItem.classNames.push(match[5].replace(ESCAPED_CHARACTER_REGEXP, ''));
++				selectorItem.classNames.push(SelectorParser.cssUnescape(match[5]));
+ 			} else if (match[7]) {
+ 				// Matches attributes without value, e.g. [attr]
+ 
+ 				selectorItem.attributes = selectorItem.attributes || [];
+ 				selectorItem.attributes.push({
+-					name: match[7].replace(ESCAPED_CHARACTER_REGEXP, ''),
++					name: SelectorParser.cssUnescape(match[7]),
+ 					operator: null,
+ 					value: null,
+ 					modifier: null,
+@@ -393,7 +394,7 @@ export default class SelectorParser {
+ 				const unescapedValue = SelectorParser.cssUnescape(value);
+ 				selectorItem.attributes = selectorItem.attributes || [];
+ 				selectorItem.attributes.push({
+-					name: match[9].replace(ESCAPED_CHARACTER_REGEXP, ''),
++					name: SelectorParser.cssUnescape(match[9]),
+ 					operator: match[11] || null,
+ 					value: unescapedValue,
+ 					modifier: <'s'>match[15] || null,
+@@ -409,7 +410,7 @@ export default class SelectorParser {
+ 				const unescapedValue = SelectorParser.cssUnescape(match[19]);
+ 				selectorItem.attributes = selectorItem.attributes || [];
+ 				selectorItem.attributes.push({
+-					name: match[16].replace(ESCAPED_CHARACTER_REGEXP, ''),
++					name: SelectorParser.cssUnescape(match[16]),
+ 					operator: match[18] || null,
+ 					value: unescapedValue,
+ 					modifier: null,

package/patches/happy-dom/README.md

@@ -21,6 +21,8 @@ git -C vendor/happy-dom apply --check ../../patches/happy-dom/0004-insert-adjace
 git -C vendor/happy-dom apply ../../patches/happy-dom/0004-insert-adjacent-html-in-order.patch
 git -C vendor/happy-dom apply --check ../../patches/happy-dom/0005-invalidate-matches-on-structure-changes.patch
 git -C vendor/happy-dom apply ../../patches/happy-dom/0005-invalidate-matches-on-structure-changes.patch
+git -C vendor/happy-dom apply --check ../../patches/happy-dom/0006-parse-css-escapes-in-selectors.patch
+git -C vendor/happy-dom apply ../../patches/happy-dom/0006-parse-css-escapes-in-selectors.patch
 ```
 
 For the already-patched vendored tree, verify that the recorded patch can be
@@ -32,6 +34,7 @@ git -C vendor/happy-dom apply --reverse --check ../../patches/happy-dom/0002-use
 git -C vendor/happy-dom apply --reverse --check ../../patches/happy-dom/0003-defer-script-events-to-renderer.patch
 git -C vendor/happy-dom apply --reverse --check ../../patches/happy-dom/0004-insert-adjacent-html-in-order.patch
 git -C vendor/happy-dom apply --reverse --check ../../patches/happy-dom/0005-invalidate-matches-on-structure-changes.patch
+git -C vendor/happy-dom apply --reverse --check ../../patches/happy-dom/0006-parse-css-escapes-in-selectors.patch
 ```
 
 ## Patch manifest
@@ -43,6 +46,29 @@ git -C vendor/happy-dom apply --reverse --check ../../patches/happy-dom/0005-inv
 | `0003-defer-script-events-to-renderer.patch` | `packages/happy-dom/src/nodes/html-script-element/HTMLScriptElement.ts` | Suppress Happy DOM's synthetic load/error event when its own script loader is disabled; the renderer fetches and executes scripts and dispatches the real outcome itself. | `bun test test/page-scripts.test.js` (`page-inserted scripts run; innerHTML scripts do not; on* handlers fire`) |
 | `0004-insert-adjacent-html-in-order.patch` | `packages/happy-dom/src/nodes/element/Element.ts` | `insertAdjacentHTML` inserted the parsed nodes one at a time, which reversed their order at `afterbegin` and `afterend`; insert the parsed fragment as a whole. | `bun test test/page-scripts.test.js` (`insertAdjacentHTML keeps the order of the inserted nodes at every position`) |
 | `0005-invalidate-matches-on-structure-changes.patch` | `packages/happy-dom/src/query-selector/QuerySelector.ts` | `Element.matches()` cached results that were invalidated only by changes to the elements the matcher visited, so structural pseudo-classes and sibling combinators stayed stale after a child list change, and `:has()` after any change in the subtree; register the parent of every visited element, and do not cache `:has()` matches. | `bun test test/happy-dom-matches.test.js` |
+| `0006-parse-css-escapes-in-selectors.patch` | `packages/happy-dom/src/query-selector/SelectorParser.ts` | The group scan treated a comma, space, quote, or parenthesis that belonged to a CSS escape (`\,`, `\31 `, `\"`, `\(`) as a combinator or grouping character, and a type selector stopped at the first backslash, so `\64 iv` and `my\-el` did not parse. Escapes are consumed first (CSS Syntax §4.3.7) and a type selector is unescaped with the existing `cssUnescape` before it is uppercased. Identifiers, classes, and attribute values already accepted a backslash; this patch does not change how those are decoded. | `bun test test/page-scripts.test.js -t "selectors with CSS escapes"` |
+
+### `0006` against upstream `SelectorParser.ts`
+
+Upstream `v20.14.5` splits a selector with `SELECTOR_GROUP_REGEXP`. Its groups
+are a combinator (` `, `,`, `+`, `>`, `~`) and a grouping character (`(`, `)`,
+`[`, `]`, `"` or `'`). A backslash is not special there, so the character after
+it is what the scan sees. The type-selector alternative is
+`[a-zA-Z0-9\u00A0-\uFFFF-]+`, which also stops at `\`.
+
+| Selector | Upstream | With `0006` |
+|---|---|---|
+| `style\=\"\"` | each `"` changes the quote depth, then the type selector stops at `\`, so the selector is rejected | both escapes stay in one type selector; `cssUnescape` yields `style=""` |
+| `.x\,y > span` | the comma starts another selector in the list | `\,` stays in the class; `>` is still the child combinator |
+| `\64 iv` | the space after the hex escape is a descendant combinator, and `\` is not a type-selector character | `\64 ` is one escape (U+0064), so the type is `div` |
+| `my\-el` | the type selector matches `my` and then fails on `\-el` | the type is `my-el` |
+
+The patched group expression matches an escape first
+(`\[0-9a-fA-F]{1,6}\s?` or `\[\s\S]`) and skips it. Combinators and grouping
+characters move to groups 2 and 3. A type selector may contain the same
+escapes and is passed through `cssUnescape`, the helper upstream already uses
+for attribute values, before `toUpperCase()`. Classes and ids still drop a
+backslash with `replace(/\\/g, '')`; hex escapes in those are unchanged.
 
 Keep each local Happy DOM change in a separate numbered patch and add it to
 this table with its reason and focused test. When updating Happy DOM, regenerate

package/patches/ses/0002-embedder-native-functions-source-text-sloppy-code.patch

@@ -0,0 +1,106 @@
+diff --git a/dist/ses.mjs b/dist/ses.mjs
+index 8bda46b..d7b18ff 100644
+--- a/dist/ses.mjs
++++ b/dist/ses.mjs
+@@ -9568,7 +9568,7 @@ function buildOptimizer(constants, name) {
+             ${globalObjectOptimizer}
+             ${moduleLexicalOptimizer}
+             return function() {
+-              'use strict';
++              ${context.sloppyCode ? '' : "'use strict';"}
+               return eval(arguments[0]);
+             };
+           }
+@@ -9611,6 +9611,7 @@ const { Fail } = assert;
+   moduleLexicals = {},
+   globalTransforms = [],
+   sloppyGlobalsMode = false,
++  sloppyCode = false,
+ }) => {
+   const scopeTerminator = sloppyGlobalsMode
+     ? createSloppyGlobalsScopeTerminator(globalObject)
+@@ -9623,6 +9624,7 @@ const { Fail } = assert;
+     moduleLexicals,
+     globalObject,
+     scopeTerminator,
++    sloppyCode,
+   });
+ 
+   // Defer creating the actual evaluator to first use.
+@@ -9715,6 +9717,14 @@ const nativeSuffix = ') { [native code] }';
+ // use this top level state so that multiple calls to `tameFunctionToString` are
+ // idempotent, rather than creating redundant indirections.
+ let markVirtualizedNativeFunction;
++let sourceTextTransform;
++// Taken (and deleted) by the embedder, like the native-function marker.
++Object.defineProperty(globalThis, Symbol.for('ses.setFunctionSourceTextTransform'), {
++  value: transform => {
++    sourceTextTransform = transform;
++  },
++  configurable: true,
++});
+ 
+ /**
+  * Replace `Function.prototype.toString` with one that recognizes
+@@ -9726,7 +9736,10 @@ let markVirtualizedNativeFunction;
+ 
+     const tamingMethods = {
+       toString() {
+-        const str = functionToString(this);
++        let str = functionToString(this);
++        // The embedder may map the text of source it rewrote back to the
++        // text the page wrote (see the registered symbol below).
++        if (sourceTextTransform !== undefined) str = sourceTextTransform(str);
+         if (
+           stringEndsWith(str, nativeSuffix) ||
+           !weaksetHas(virtualizedNativeFunctions, this)
+@@ -9744,6 +9757,8 @@ let markVirtualizedNativeFunction;
+     markVirtualizedNativeFunction = freeze(func =>
+       weaksetAdd(virtualizedNativeFunctions, func),
+     );
++    // Function.prototype.toString is itself a built-in function.
++    markVirtualizedNativeFunction(tamingMethods.toString);
+   }
+   return markVirtualizedNativeFunction;
+ };$h͏_once.tameFunctionToString(tameFunctionToString);
+@@ -12523,12 +12538,15 @@ const { quote: q } = assert;
+ 
+ 
+        const provideCompartmentEvaluator = (compartmentFields, options) => {
+-  const { sloppyGlobalsMode = false, __moduleShimLexicals__ = undefined } =
+-    options;
++  const {
++    sloppyGlobalsMode = false,
++    __moduleShimLexicals__ = undefined,
++    __sloppyCode__ = false,
++  } = options;
+ 
+   let safeEvaluate;
+ 
+-  if (__moduleShimLexicals__ === undefined && !sloppyGlobalsMode) {
++  if (__moduleShimLexicals__ === undefined && !sloppyGlobalsMode && !__sloppyCode__) {
+     ({ safeEvaluate } = compartmentFields);
+   } else {
+     // The scope proxy or global lexicals are different from the
+@@ -12560,6 +12578,7 @@ const { quote: q } = assert;
+       moduleLexicals,
+       globalTransforms,
+       sloppyGlobalsMode,
++      sloppyCode: __sloppyCode__,
+     }));
+   }
+ 
+@@ -15138,6 +15157,13 @@ globalThis.repairIntrinsics = options => {
+ 
+ const markVirtualizedNativeFunction = tameFunctionToString();
+ 
++// The embedder takes this once (and deletes it) to present its own
++// host-implemented Web APIs as built-in functions, as browsers do.
++Object.defineProperty(globalThis, Symbol.for('ses.markVirtualizedNativeFunction'), {
++  value: markVirtualizedNativeFunction,
++  configurable: true,
++});
++
+ const muteReporter = chooseReporter('none');
+ 
+ // @ts-ignore Compartment is definitely on globalThis.

package/patches/ses/0003-cache-sloppy-evaluators.patch

@@ -0,0 +1,47 @@
+diff --git a/dist/ses.mjs b/dist/ses.mjs
+index d7b18ff..31d23ad 100644
+--- a/dist/ses.mjs
++++ b/dist/ses.mjs
+@@ -12537,7 +12537,13 @@ const { quote: q } = assert;
+ 
+ 
+ 
+-       const provideCompartmentEvaluator = (compartmentFields, options) => {
++       // Evaluators for sloppyGlobalsMode / __sloppyCode__, one per compartment and
++// combination: building one scans the global object and compiles a new
++// evaluator function, which made every such evaluate() call cost hundreds of
++// microseconds.
++const sloppyEvaluators = new WeakMap();
++
++const provideCompartmentEvaluator = (compartmentFields, options) => {
+   const {
+     sloppyGlobalsMode = false,
+     __moduleShimLexicals__ = undefined,
+@@ -12546,6 +12552,13 @@ const { quote: q } = assert;
+ 
+   let safeEvaluate;
+ 
++  const cacheKey = __moduleShimLexicals__ === undefined
++    ? `${Boolean(sloppyGlobalsMode)}:${Boolean(__sloppyCode__)}` : undefined;
++  let cached = sloppyEvaluators.get(compartmentFields);
++  if (cacheKey !== undefined && cached && cached.has(cacheKey)) {
++    return { safeEvaluate: cached.get(cacheKey) };
++  }
++
+   if (__moduleShimLexicals__ === undefined && !sloppyGlobalsMode && !__sloppyCode__) {
+     ({ safeEvaluate } = compartmentFields);
+   } else {
+@@ -12580,6 +12593,13 @@ const { quote: q } = assert;
+       sloppyGlobalsMode,
+       sloppyCode: __sloppyCode__,
+     }));
++    if (cacheKey !== undefined) {
++      if (!cached) {
++        cached = new Map();
++        sloppyEvaluators.set(compartmentFields, cached);
++      }
++      cached.set(cacheKey, safeEvaluate);
++    }
+   }
+ 
+   return { safeEvaluate };

package/patches/ses/README.md

@@ -6,11 +6,15 @@ relative to `vendor/ses`.
 For the already-patched tree, verify the recorded patch without changing files:
 
 ```sh
+git -C vendor/ses apply --reverse --check ../../patches/ses/0003-cache-sloppy-evaluators.patch
+git -C vendor/ses apply --reverse --check ../../patches/ses/0002-embedder-native-functions-source-text-sloppy-code.patch
 git -C vendor/ses apply --reverse --check ../../patches/ses/0001-allow-regexp-own-tostring.patch
 ```
 
 | Patch | Modified file | Reason | Verification |
 |---|---|---|---|
 | `0001-allow-regexp-own-tostring.patch` | `dist/ses.mjs` | Allow a page script to assign an own `toString` method to a `RegExp` instance despite the frozen prototype. This does not make the prototype writable. | `bun test test/page-scripts.test.js` |
+| `0002-embedder-native-functions-source-text-sloppy-code.patch` | `dist/ses.mjs` | Three embedder hooks for browser fidelity: (1) the toString taming's `markVirtualizedNativeFunction` is left on the host global under `Symbol.for("ses.markVirtualizedNativeFunction")` (taken and deleted by `lib/renderer/native-functions.js`) so Web APIs print as `[native code]`, and the taming's own `toString` is marked native; (2) a `Symbol.for("ses.setFunctionSourceTextTransform")` setter lets the embedder map rewritten source text back to the page's text in `Function.prototype.toString`; (3) an `__sloppyCode__` evaluate option drops the evaluator's `'use strict'`, so classic scripts run as sloppy-mode code. Page code only gets (3) for sources the rewriter parsed, which routes every sloppy `this` through a helper that never yields the host global. | `bun test test/page-scripts.test.js test/script-rewrite.test.js` |
+| `0003-cache-sloppy-evaluators.patch` | `dist/ses.mjs` | `evaluate()` with `sloppyGlobalsMode` or `__sloppyCode__` built a new safe evaluator on every call (scanning the global object for constants and compiling a new evaluator function), which made each page `eval`, `Function` and classic script cost hundreds of microseconds. The evaluator is now kept per compartment and option combination; it only binds non-writable, non-configurable globals as constants, which cannot change. `__moduleShimLexicals__` evaluations are not cached. | `bun test test/page-scripts.test.js test/script-rewrite.test.js` |
 
 Keep future local SES changes in numbered patches and update this manifest.

package/test/canvas-2d.test.js

@@ -0,0 +1,55 @@
+import { beforeAll, expect, test } from "bun:test";
+import CanvasKitInit from "../usr/lib/canvaskit/canvaskit.js";
+import { canvasContext, resetCanvas, setCanvasKit } from "../lib/renderer/canvas-2d.js";
+
+beforeAll(async () => {
+  const wasmBinary = await Bun.file(new URL("../usr/lib/canvaskit/canvaskit.wasm", import.meta.url)).arrayBuffer();
+  setCanvasKit(await CanvasKitInit({ wasmBinary }));
+});
+
+function canvas(width = 1, height = 1) {
+  return { width, height };
+}
+
+/**
+ * The probe web-animations-next-lite uses to accept a CSS colour.
+ * CanvasKit turns a string it cannot parse into black, so the two reads match
+ * and the sample is opaque black. A string it can parse reads back the same
+ * way both times.
+ */
+function sample(context, color) {
+  context.fillStyle = "#000";
+  context.fillStyle = color;
+  const first = context.fillStyle;
+  context.fillStyle = "#fff";
+  context.fillStyle = color;
+  if (first !== context.fillStyle) return null;
+  context.fillRect(0, 0, 1, 1);
+  const data = [...context.getImageData(0, 0, 1, 1).data];
+  context.clearRect(0, 0, 1, 1);
+  return data;
+}
+
+test("a colour reads back stably, and one CanvasKit cannot parse is black", () => {
+  const context = canvasContext(canvas(), "2d");
+  expect(context.fillStyle).toBe("#000000");
+  expect(sample(context, "not-a-color")).toEqual([0, 0, 0, 255]);
+  expect(sample(context, "red")).toEqual([255, 0, 0, 255]);
+  expect(sample(context, "rgba(1, 2, 3, 0.5)")).toEqual([1, 2, 3, 128]);
+  expect(context.getImageData(0, 0, 1, 1).data.length).toBe(4);
+  expect(context.getImageData(0, 0, 1, 1).data[3]).toBe(0);
+  expect(canvasContext(canvas(), "webgl")).toBeNull();
+});
+
+test("the same canvas keeps one context, and changing width clears it", () => {
+  const node = canvas(2, 2);
+  const context = canvasContext(node, "2d");
+  expect(canvasContext(node, "2d")).toBe(context);
+  context.fillStyle = "blue";
+  context.fillRect(0, 0, 2, 2);
+  expect(context.getImageData(1, 1, 1, 1).data[2]).toBe(255);
+  node.width = 1;
+  resetCanvas(node);
+  expect(context.fillStyle).toBe("#000000");
+  expect([...context.getImageData(0, 0, 1, 1).data]).toEqual([0, 0, 0, 0]);
+});

package/test/compositor.test.js

@@ -106,7 +106,9 @@ test("a preview is shown while stylesheets load, then the styled page, then scri
   try {
     await context.resize(320, 200, 1);
     await context.navigate(`http://127.0.0.1:${server.port}/`);
-    // navigate returned at the first paint: the stylesheet is still pending.
+    // navigate returned at the first paint: the stylesheet is still pending
+    // (held by the server; under load its request may only now be arriving).
+    for (const deadline = Date.now() + 10_000; !releaseStyles && Date.now() < deadline;) await Bun.sleep(20);
     expect(releaseStyles).toBeFunction();
     expect(events).toEqual([]);
     expect(context.lifecycleState()).toEqual([]);