buninu-browser 0.5.1 → 0.7.0

package/lib/renderer/resource-elements.js

@@ -0,0 +1,88 @@
+const SELECTORS = Object.freeze({
+  media: "video, audio",
+  images: "img",
+  sheets: "style, link[rel~='stylesheet']",
+  frames: "iframe",
+});
+
+/**
+ * Cache discovery, never resource state. Tag membership changes with DOM
+ * structure; only the stylesheet list also depends on an attribute (rel).
+ * Callers still read src/href, credentials, media/type/disabled, text and the
+ * document base URL on every pass. Ordinary data/ARIA/class mutations therefore
+ * do not cause four whole-document queries during a geometry flush.
+ */
+export function createResourceElements(document) {
+  const lists = new Map();
+  const ancestors = new Map();
+  let disposed = false;
+  const discard = kind => { lists.delete(kind); ancestors.delete(kind); };
+  const invalidate = records => {
+    let visited;
+    for (const record of records) {
+      if (!lists.size) return;
+      if (record.type === "attributes") discard("sheets");
+      if (record.type !== "childList") continue;
+      for (const node of record.removedNodes) {
+        if (node.nodeType !== 1) {
+          if (node.nodeType !== 3 && node.nodeType !== 8) { lists.clear(); ancestors.clear(); return; }
+          continue;
+        }
+        // Snapshot ancestry survives detached subtrees being emptied or moved
+        // before observer delivery, without scanning every cached resource.
+        for (const [kind, parents] of ancestors) if (parents.has(node)) discard(kind);
+      }
+      const pending = [...record.addedNodes];
+      while (pending.length && lists.size) {
+        const node = pending.pop();
+        if (node.nodeType !== 1) {
+          if (node.nodeType !== 3 && node.nodeType !== 8) { lists.clear(); ancestors.clear(); return; }
+          continue;
+        }
+        // Nested insertion records can name the same subtree many times.
+        visited ??= new Set();
+        if (visited.has(node)) continue;
+        visited.add(node);
+        // Match the selector engine's case folding, including foreign tags.
+        const tag = node.tagName.toUpperCase();
+        if (tag === "VIDEO" || tag === "AUDIO") discard("media");
+        else if (tag === "IMG") discard("images");
+        else if (tag === "IFRAME") discard("frames");
+        else if (tag === "STYLE" || (tag === "LINK" && node.matches("link[rel~='stylesheet']"))) discard("sheets");
+        if (lists.size) for (const child of node.children) pending.push(child);
+      }
+    }
+  };
+  // Use an independent observer: discovery precedes style computation and
+  // must not consume or reorder the CSS invalidation observer's records.
+  const observer = new document.defaultView.MutationObserver(invalidate);
+  observer.observe(document, { subtree: true, childList: true, attributes: true, attributeFilter: ["rel"] });
+  return {
+    get(kind) {
+      const selector = SELECTORS[kind];
+      if (!selector) throw new TypeError(`Unknown resource element kind: ${kind}`);
+      if (disposed) throw new Error("Resource element discovery is disposed");
+      // Script may insert an image/link and synchronously read geometry in
+      // the same task, before observer callbacks have been delivered.
+      invalidate(observer.takeRecords());
+      let list = lists.get(kind);
+      if (!list) {
+        list = Object.freeze(Array.from(document.querySelectorAll(selector)));
+        lists.set(kind, list);
+        const parents = new WeakSet();
+        for (const element of list) {
+          for (let node = element; node && !parents.has(node); node = node.parentNode) parents.add(node);
+        }
+        ancestors.set(kind, parents);
+      }
+      return list;
+    },
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      observer.disconnect();
+      lists.clear();
+      ancestors.clear();
+    },
+  };
+}

package/lib/renderer/script-rewrite.js

@@ -378,14 +378,22 @@ export function rewriteConstructorReads(source, sourceType = "script", parsed =
 
 /** Separates the tokens of `-->` and `<!--` in code (see escapeSesHtmlComments). */
 const HTML_COMMENT_MARK = "/*$buninu$h*/";
+// An escaped IdentifierName still denotes the property "import", but SES's
+// conservative import-expression regexp cannot mistake it for import().
+const IMPORT_NAME_REWRITE = "\\u0069mport/*$buninu$import*/";
 
 /**
  * SES rejects HTML comment delimiters anywhere in source, including inside
  * strings and regular expressions where browsers treat them as ordinary
  * data. Escape only those lexical values; their evaluated value is unchanged.
+ * Also protect property/method names named `import`: SES otherwise renames
+ * `static import()` and `object. import()` to `__import__`. Acorn distinguishes
+ * these IdentifierNames from actual ImportExpressions, which keep the existing
+ * dynamic-import routing through the page module loader.
  */
 export function escapeSesHtmlComments(source, sourceType = "script") {
-  if (!source.includes("<!--") && !source.includes("-->")) return source;
+  if (!source.includes("<!--") && !source.includes("-->")
+    && !/\bimport\s*(?:\(|\/[/*])/.test(source)) return source;
   let program;
   const tokens = [];
   try {
@@ -409,6 +417,14 @@ export function escapeSesHtmlComments(source, sourceType = "script") {
   }
   const visit = (node) => {
     if (!node || typeof node.type !== "string") return;
+    // `import.meta` is grammar, not an IdentifierName: escaping its keyword
+    // would make a valid module fail to parse (and new.target needs no edit).
+    if (node.type === "MetaProperty") return;
+    if (node.type === "Identifier" && node.name === "import"
+      && source.slice(node.start, node.end) === "import") {
+      edits.push({ start: node.start, end: node.end, text: IMPORT_NAME_REWRITE });
+      return;
+    }
     if ((node.type === "Literal" && (typeof node.value === "string" || node.regex))
       || node.type === "TemplateElement") {
       const text = source.slice(node.start, node.end);
@@ -986,6 +1002,7 @@ export function restoreSourceText(text) {
   }
   return code.replace(DIRECT_EVAL_CALL, "eval(")
     .replaceAll(HTML_COMMENT_MARK, "")
+    .replaceAll(IMPORT_NAME_REWRITE, "import")
     .replaceAll("<\\x21--", "<!--").replaceAll("-\\x2d>", "-->")
     .replace(/\b__import__(?=\s*(?:\(|\/[/*]))/g, "import");
 }

package/lib/renderer/seccomp.js

@@ -24,7 +24,7 @@ import { SYSCALL_NUMBERS } from "./syscall-numbers.js";
  * rest are syscalls Chromium allows with argument checks, allowed here
  * without them for now, plus what a strace of the renderer workload (load,
  * resize, raster, scroll, hints, hit testing) showed Bun/JSC need.
- * clone, clone3, kill, tgkill and prctl are handled separately with argument
+ * clone, clone3, kill, tkill, tgkill and prctl are handled separately with argument
  * checks.
  */
 export const ALLOWED_SYSCALLS = Object.freeze([
@@ -114,8 +114,10 @@ export function buildFilter(arch, pid, allowed = ALLOWED_SYSCALLS) {
     [LD_W_ABS, 0, 0, DATA_NR],
   );
   program.push([JEQ_K, 0, 1, nr("clone3")], [RET_K, 0, 0, retErrno(ENOSYS)]);
-  // kill(pid, ...) and tgkill(tgid, ...): only this process.
-  for (const name of ["kill", "tgkill"]) {
+  // kill(pid, ...) and tgkill(tgid, ...): only this process. tkill(tid, ...)
+  // has no thread-group argument, so only allow its main thread (tid == pid).
+  // Bun/JSC uses this to interrupt the main thread for profiling.
+  for (const name of ["kill", "tkill", "tgkill"]) {
     program.push(
       [JEQ_K, 0, 4, nr(name)],
       [LD_W_ABS, 0, 0, DATA_ARG0_LOW],
@@ -135,7 +137,7 @@ export function buildFilter(arch, pid, allowed = ALLOWED_SYSCALLS) {
     [LD_W_ABS, 0, 0, DATA_NR],
   );
   for (const name of new Set(allowed)) {
-    if (["clone", "clone3", "kill", "tgkill", "prctl"].includes(name)) continue;
+    if (["clone", "clone3", "kill", "tkill", "tgkill", "prctl"].includes(name)) continue;
     // Some syscalls exist on only one architecture (e.g. x86-64 open, poll).
     if (numbers[name] == null) continue;
     program.push([JEQ_K, 0, 1, numbers[name]], [RET_K, 0, 0, RET_ALLOW]);

package/lib/renderer/timers.js

@@ -0,0 +1,71 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+
+// Promise continuations within a timer's microtask checkpoint inherit its
+// nesting, but a later task must not inherit a long-finished timer callback.
+const taskContext = new AsyncLocalStorage();
+const hostSetTimer = globalThis.setTimeout, hostClearTimer = globalThis.clearTimeout;
+const hostQueueTask = globalThis.setImmediate, hostClearTask = globalThis.clearImmediate;
+
+/** Window/Worker timers: one Web IDL long conversion and the HTML nesting clamp. */
+export function createTimers({ invoke, nextId, setTimer = hostSetTimer, clearTimer = hostClearTimer,
+  queueTask = hostQueueTask, clearTask = hostClearTask }) {
+  const records = new Map(), checkpoints = new Set(), owner = {};
+  let disposed = false, checkpointTask = null;
+
+  function run(record, nesting) {
+    if (!nesting) return taskContext.run(null, () => invoke(record.callback));
+    const context = { owner, level: nesting, active: true };
+    checkpoints.add(context);
+    if (checkpointTask === null) checkpointTask = queueTask(() => {
+      checkpointTask = null;
+      for (const context of checkpoints) context.active = false;
+      checkpoints.clear();
+    });
+    return taskContext.run(context, () => invoke(record.callback));
+  }
+  function arm(record) {
+    const delay = record.nesting > 6 ? Math.max(4, record.delay) : record.delay;
+    record.handle = setTimer(() => {
+      if (disposed || records.get(record.id) !== record) return;
+      const nesting = record.nesting;
+      if (record.repeat) {
+        // Preserve interval cadence and its handle while advancing nesting;
+        // cancellation from inside the callback removes this next wakeup too.
+        record.nesting = Math.min(7, nesting + 1);
+        arm(record);
+      } else records.delete(record.id);
+      run(record, nesting);
+    }, delay);
+  }
+  return {
+    schedule(callback, delay, repeat = false, timerTask = true) {
+      // Unary + performs Web IDL ToNumber (unlike Number, it rejects BigInt),
+      // and |0 converts to a signed 32-bit long before negative delays clamp.
+      const milliseconds = Math.max(0, +delay | 0);
+      const id = nextId();
+      if (disposed) return id;
+      const current = taskContext.getStore();
+      const parent = current?.active && current.owner === owner ? current.level : 0;
+      const record = { id, callback, delay: milliseconds, repeat,
+        nesting: timerTask ? Math.min(7, parent + 1) : 0, handle: null };
+      records.set(id, record);
+      arm(record);
+      return id;
+    },
+    cancel(id) {
+      const key = Number(id), record = records.get(key);
+      if (!record) return;
+      records.delete(key);
+      clearTimer(record.handle);
+    },
+    dispose() {
+      disposed = true;
+      for (const record of records.values()) clearTimer(record.handle);
+      records.clear();
+      if (checkpointTask !== null) clearTask(checkpointTask);
+      checkpointTask = null;
+      for (const context of checkpoints) context.active = false;
+      checkpoints.clear();
+    },
+  };
+}

package/lib/renderer/video-channel.js

@@ -0,0 +1,94 @@
+function workerClosedError(event) {
+  return new Error(`Video worker closed${Number.isInteger(event?.code) ? ` (${event.code})` : ''}`);
+}
+
+/** Compositor-owned endpoint for the independent media decoder. */
+export class VideoChannel {
+  constructor(worker, changed, report) {
+    this.worker = worker;
+    this.changed = changed;
+    this.report = report;
+    this.config = null;
+    this.frame = null;
+    worker.addEventListener('message', ({data}) => {
+      if (this.failure) return;
+      if (data.type === 'frame') {
+        try {
+          if (this.config?.id === data.id) {
+            this.frame = data.frame;
+            changed();
+          }
+        } finally {
+          // ACK discarded generations too; an old frame may still be in
+          // flight when open/stop reaches the independent decoder.
+          if (Number.isSafeInteger(data.delivery))
+            this.send({type:'frame-ack', id:data.id, delivery:data.delivery});
+        }
+      } else if (data.type === 'report' && this.config?.id === data.report.id) report(data.report);
+    });
+    worker.addEventListener('error', error => this.fail(error));
+    // Bun silently ignores postMessage after a worker exits. Catch close too,
+    // or a dead decoder would retain its last picture without invoking fallback.
+    worker.addEventListener('close', event => this.fail(workerClosedError(event)));
+  }
+  send(message) {
+    if (this.failure) return;
+    try { this.worker.postMessage(message); }
+    catch (error) { this.fail(error); }
+  }
+  fail(error) {
+    if (this.failure) return;
+    const id = this.config?.id;
+    this.failure = String(error?.message ?? error) || 'Video worker failed';
+    this.config = null;
+    this.frame = null;
+    this.worker.terminate();
+    if (id !== undefined) this.report({id,error:this.failure});
+  }
+  open(config) {
+    this.config = config;
+    this.frame = null;
+    if (this.failure) { this.report({id:config.id,error:this.failure}); return; }
+    this.send({type:'open', config});
+  }
+  extend(request) {
+    if (this.config?.id !== request.id || this.failure) return;
+    // Existing pixels and their outstanding ACK belong to the same session.
+    this.send({ ...request, type: 'extend' });
+  }
+  stop(id) {
+    if (id !== undefined && this.config?.id !== id) return;
+    this.config = null;
+    this.frame = null;
+    this.send({type:'stop', id});
+  }
+  bind(id, audioId, audioStart, time, endTime) {
+    if (this.config?.id !== id || this.failure) return;
+    this.send({type:'bind', id, audioId, audioStart, time, endTime});
+  }
+  timing(id, seconds) {
+    this.send({type:'timing', id, seconds});
+  }
+}
+
+export async function startVideoChannel(changed, report) {
+  const worker = new Worker(new URL('./video-worker.js', import.meta.url).href);
+  const channel = new VideoChannel(worker, changed, report);
+  try {
+    await new Promise((resolve, reject) => {
+      const ready = ({data}) => { if(data.type === 'ready') {cleanup(); resolve();} };
+      const failed = error => {cleanup(); reject(error);};
+      const closed = event => failed(new Error(channel.failure || workerClosedError(event).message));
+      // Slow WASM initialization is not a failure; wait for ready or exit/error.
+      const cleanup = () => {
+        worker.removeEventListener('message', ready);
+        worker.removeEventListener('error', failed);
+        worker.removeEventListener('close', closed);
+      };
+      worker.addEventListener('message', ready);
+      worker.addEventListener('error', failed);
+      worker.addEventListener('close', closed);
+    });
+  } catch (error) { worker.terminate(); throw error; }
+  return channel;
+}

package/lib/renderer/video-mask.js

@@ -0,0 +1,115 @@
+import {visibleItems} from "../paint/display-list.js";
+
+/** The compositor's rounded device rect and the stricter geometry needed for replay. */
+export function videoLayerGeometry(item, region, scale) {
+  const source = item.rect, transformed = {...source};
+  const transform = item.transform;
+  if (transform) {
+    transformed.x = transformed.x * transform.a + transform.e;
+    transformed.y = transformed.y * transform.d + transform.f;
+    transformed.width *= transform.a;
+    transformed.height *= transform.d;
+  }
+  const rect = {
+    x:Math.round((transformed.x-region.x)*scale), y:Math.round((transformed.y-region.y)*scale),
+    width:Math.round(transformed.width*scale), height:Math.round(transformed.height*scale),
+  };
+  // Keep the existing layer rect for fallback painting. Black replay also
+  // needs finite painter intermediates: equivalent arithmetic can overflow
+  // in different orders, so check the final compositor coordinates directly.
+  const {a=1,b=0,c=0,d=1,e=0,f=0} = transform ?? {};
+  const x = Math.round((source?.x-region.x)*scale), y = Math.round((source?.y-region.y)*scale);
+  const width = Math.round(source?.width*scale), height = Math.round(source?.height*scale);
+  const tx = ((a-1)*region.x+e)*scale, ty = ((d-1)*region.y+f)*scale;
+  const replayable = !item.fixed && a>0 && d>0 && !b && !c && scale>0 && source?.width>0 && source?.height>0
+    && width>0 && height>0 && rect.width>0 && rect.height>0
+    && [source?.x,source?.y,source?.width,source?.height,a,b,c,d,e,f,scale,x,y,width,height,tx,ty,
+      x*a+tx,y*d+ty,(x+width)*a+tx,(y+height)*d+ty,rect.x,rect.y,rect.width,rect.height].every(Number.isFinite);
+  return {rect,replayable};
+}
+
+/** Device-space coverage of the scale/translate video draw used by the painter. */
+export function videoMaskBounds(item, region, scale, width, height) {
+  const rect = item?.rect, transform = item?.transform;
+  if (!rect || item.fixed || ![scale, rect.x, rect.y, rect.width, rect.height, region.x, region.y].every(Number.isFinite) || scale <= 0
+    || rect.width <= 0 || rect.height <= 0) return null;
+  const {a = 1, d = 1, e = 0, f = 0, b = 0, c = 0} = transform ?? {};
+  if (![a,d,e,f,b,c].every(Number.isFinite) || a <= 0 || d <= 0 || b || c) return null;
+  // Match deviceRect's separate rounding of origin and extent, then canvas.concat.
+  const x = Math.round((rect.x - region.x) * scale) * a + ((a - 1) * region.x + e) * scale;
+  const y = Math.round((rect.y - region.y) * scale) * d + ((d - 1) * region.y + f) * scale;
+  const right = x + Math.round(rect.width * scale) * a;
+  const bottom = y + Math.round(rect.height * scale) * d;
+  const left = Math.max(0, Math.min(width, Math.floor(x) - 1));
+  const top = Math.max(0, Math.min(height, Math.floor(y) - 1));
+  return {x:left, y:top, width:Math.max(0,Math.min(width,Math.ceil(right)+1)-left),
+    height:Math.max(0,Math.min(height,Math.ceil(bottom)+1)-top)};
+}
+
+/**
+ * Black/white passes need only replay the video's coverage. The ordinary
+ * raster is immutable and already supplies every unaffected background pixel.
+ * Unknown or full-tile bounds retain the original full-tile path. This leaves
+ * the scratch surface changed, like the original black/white passes; callers
+ * must not reuse it as an ordinary raster (canvasDamage excludes videos).
+ */
+export function rasterVideoMask({kit, canvas, surface, width, height, pixels, bounds, region, scale,
+  background, paint, hints, cullPadding = 2, blackAlreadyRasterized = false}) {
+  const cropped = bounds && pixels?.length === width * height * 4
+    && (bounds.x !== 0 || bounds.y !== 0 || bounds.width !== width || bounds.height !== height);
+  const area = cropped ? bounds : {x:0,y:0,width,height};
+  const base = cropped ? new Uint8Array(pixels) : null;
+  const mask = cropped ? new Uint8Array(width * height * 4) : null;
+  if (!area.width || !area.height) return {base, mask};
+  const dirtyView = cropped && Number.isFinite(cullPadding) ? {
+    x:region.x+(area.x-cullPadding)/scale, y:region.y+(area.y-cullPadding)/scale,
+    width:(area.width+cullPadding*2)/scale, height:(area.height+cullPadding*2)/scale,
+  } : region;
+  function raster(white) {
+    canvas.save();
+    try {
+      // Keep the canvas clip identical to the ordinary paint. Adding even an
+      // enclosing integer clip can change Skia's rounded-clip AA edge coverage.
+      // Cull replay items and crop readback instead; clear remains a cheap fill.
+      canvas.clear(background);
+      paint(white, dirtyView);
+      hints?.();
+    } finally { canvas.restore(); }
+    surface.flush();
+    const image = surface.makeImageSnapshot();
+    try {
+      const data = image.readPixels(area.x,area.y,{width:area.width,height:area.height,
+        colorType:kit.ColorType.RGBA_8888,alphaType:kit.AlphaType.Unpremul,colorSpace:kit.ColorSpace.SRGB});
+      if (!data) throw new Error('Unable to read video mask pixels');
+      return data;
+    } finally { image.delete(); }
+  }
+  let black;
+  if (blackAlreadyRasterized && pixels?.length === width * height * 4) {
+    black = new Uint8Array(area.width * area.height * 4);
+    for (let row = 0; row < area.height; row++) {
+      const start = ((area.y + row) * width + area.x) * 4;
+      black.set(pixels.subarray(start,start + area.width * 4),row * area.width * 4);
+    }
+  } else black = raster(false);
+  const white = raster(true);
+  if (!cropped) {
+    for(let i=0;i<white.length;i++) white[i]=Math.max(0,white[i]-black[i]);
+    return {base:black,mask:white};
+  }
+  const stride = area.width * 4;
+  for(let row=0;row<area.height;row++) {
+    const source=row*stride, target=((area.y+row)*width+area.x)*4;
+    base.set(black.subarray(source,source+stride),target);
+    for(let i=0;i<stride;i++) mask[target+i]=Math.max(0,white[source+i]-black[source+i]);
+  }
+  return {base,mask};
+}
+
+/** Preserve shadow tails beyond nominal display-list bounds during partial replay. */
+export function videoMaskItems(displayList, view, dirtyView, viewport) {
+  const nearby = new Set(visibleItems(displayList, dirtyView, viewport));
+  // Keep the full pass's ordering and membership. Gaussian shadows can reach
+  // farther than their CSS blur-radius bounds, so do not cull those again.
+  return visibleItems(displayList, view, viewport).filter(item => item.op === "drawShadow" || nearby.has(item));
+}