Problem: Crash when evaluating an XPath expression against a document
that has no root element.
Cause: mirror_node()’s DOCUMENT_NODE branch unconditionally mirrored
document.document_element(). But a document may lack a root element —
in which case, document_element() returns null.
Fix: Return null from mirror_node() when the document has no root
element. (The caller already maps a null mirror result to a failed
evaluation, and raises an error in that case.)
Fixes https://github.com/LadybirdBrowser/ladybird/issues/10004
We were previously not setting any name or length properties on exported
functions. Some sites like https://squeel.frankmayer.dev/ rely on these
properties.
The name property is a bit strange. Exported wasm functions have a name
property which is its index in its module instance's function-address
list.
This patch is not enough for the squeel site to be fully functional; we
will need to implement navigator.locks.
Decode XML document bytes with TextCodec::ErrorMode::Fatal and treat
decode failure as an XML loading error.
This removes the separate decoder validation pass and lets the decode
operation itself enforce XML's requirement that documents contain only
properly encoded characters.
Add explicit IgnoreBOM and ErrorMode options to LibTextCodec decoders,
and thread them through TextDecoder and TextDecoderStream.
This lets Web-facing decoder APIs preserve BOMs when requested and use
fatal error handling without post-processing decoded output.
NB: RemoveBOM was renamed to IgnoreBOM as "RemoveBOM" is the name
used by encoding_rs and was previously an implementation detail.
The new name matches what is used by the encoding standard as it
is now also used in LibWeb.
Temporarily enter the TextEncoderStream/TextDecoderStream realm while
running their transform and flush algorithms.
This ensures objects and exceptions created through those algorithms are
associated with the constructor realm, matching the encoding streams
realm WPT.
I find this behaviour _somewhat_ strange, and this is only very loosely
specified, but all browsers have aligned on this behviour, so we may
as well match it.
Store parser errors, source range filenames, source code filenames,
module source, and Rust parser errors as UTF-16 where they flow back
into JavaScript-visible strings. Keep byte-oriented source buffers
byte-backed.
Remove temporary PrimitiveString, ByteString, and UTF-8 detours from
JSON, RegExp, module debug logging, print formatting, and tests.
Produce JS-visible string results as UTF-16 at their source, including
numeric formatting, BigInt and BigFraction formatting, URI encoding,
console formatting, parser errors, regular expression errors, Intl and
Temporal records, LibUnicode locale boundaries, and LibWeb bindings.
Handle fractional radix formatting through the UTF-16 builder view.
Thread UTF-16 string input through JSON, script parsing, Date parsing,
Intl option parsing, Temporal parsing, and the helper library boundaries
that feed those parsers. Preserve ASCII fast paths where the source data
is known to be ASCII.
Move the remaining LibJS primitive string users to UTF-16 views and
strings. Remove the primitive string UTF-8 accessors and byte-string
coercion paths so new callers cannot rely on the old storage model.
Keep primitive string storage in Utf16String and remove the UTF-8
storage path from PrimitiveString. ASCII strings still use compact
Utf16String ASCII storage, while UTF-16 becomes the only owned
representation.
Row subgrid contribution sizing reused the parent grid's available
width, so descendants in flexible columns could contribute an unwrapped
height and then wrap during layout.
Use the resolved subgrid item width when measuring row contributions.
When collecting row-axis contributions from subgrid descendants,
resolve the subgrid column metrics first so intrinsic height measurement
uses the correct inline size. This prevents text from being measured as
if it had no usable width, which inflated auto row sizes.
Some WebP files advertise ICC metadata in their VP8X feature flags even
though the ICCP chunk is absent or malformed. We accepted the bitstream
header and could decode the pixels, but the follow-up mux metadata
lookup failed during header decoding and made sniffing reject the image
entirely.
Treat mux and ICC metadata extraction as best-effort after libwebp
accepts the header. Images without readable optional ICC metadata now
decode normally and simply report no ICC profile.
Problem: CSSPixels::abs() invokes UB for the i32 minimum raw value.
Cause: abs() returned from_raw(::abs(m_value)) — and ::abs() of the i32
minimum isn’t representable as an int.
Fix: Compute the magnitude with saturating_sub(0, raw_value()) for
negative inputs — so the i32 minimum saturates to the maximum.
Remove the UTF-16 storage mode and make StringBuilder solely build
UTF-8 strings again. The remaining UTF-16 adoption path now goes
through Utf16StringBuilder, keeping the direct-adoption optimization
with the type that owns UTF-16 construction.
Move the remaining call sites that constructed StringBuilder in UTF-16
mode over to Utf16StringBuilder or explicit UTF-8 to UTF-16 conversion.
Teach FormatBuilder to target Utf16StringBuilder directly so formatted
Utf16String construction no longer needs StringBuilder's UTF-16 mode.
Update the Utf16String tests to cover Utf16StringBuilder adoption and
clear behavior directly.
Make CSS Typed OM to_string() implementations produce Utf16String
instead of building UTF-8 strings and converting at the JS binding
boundary. Use Utf16StringBuilder for numeric, math, and transform
serialization paths that already feed CSS Typed OM stringification.
Keep the older CSSOM StyleValue serializer on StringBuilder for now, and
convert only where Typed OM source values or parser re-entry still need
the existing UTF-8 representation.
Replace the remaining UTF-16-mode StringBuilder instances in LibWeb
with Utf16StringBuilder when they assemble Utf16String values or UTF-16
text views. This keeps those paths in UTF-16 throughout and uses
explicit ASCII append helpers for ASCII-only pieces.
Keep StringBuilder in place for JSON, markup, CSS serialization, and
other byte-oriented string construction paths.
Use a typed RegExp cache key instead of serializing the UTF-16
pattern and flags into a String. This avoids another StringBuilder
path for data that is already naturally represented as UTF-16 plus
flag bits.
Also make legacy unescape operate on UTF-16 code units and build its
result with Utf16StringBuilder. This preserves direct non-ASCII input
and %uXXXX escapes, including lone surrogate code units, without
routing the result through UTF-8 storage.
Accept Utf16View patterns at the LibRegex compile boundary and pass
UTF-16 or ASCII storage directly into the Rust regex parser. This keeps
JavaScript regular expression construction from converting patterns
through UTF-8 when LibRegex can consume the same UTF-16 representation
used by LibJS.
Update RegExp construction, HTML pattern validation, the regex fuzzer,
and LibRegex tests to use the UTF-16 compile API.
Build JSON.stringify, Date ISO strings, and Temporal string results with
Utf16StringBuilder when the result is consumed as a JavaScript string.
Keep UTF-8 conversion only at callers that explicitly need bytes outside
LibJS.
Port more UTF-16 string construction sites to Utf16StringBuilder.
This covers JSON serialization, URI escaping, RegExp replacement, date
and Temporal formatting, Uint8Array hex conversion, and stack string
formatting. Keep byte-oriented debug, bytecode, parser, and print
plumbing on StringBuilder.
Add a checked JS string length sum helper and use it for accumulation
paths that append JS-observable string pieces.
Port straightforward JS string construction sites to Utf16StringBuilder.
Make ASCII appends explicit with append_ascii(), and leave byte-output,
formatted-output, and printer plumbing on StringBuilder where that API
still matches the caller.
Add a small checked JS string length product helper. Use it for
String.prototype.repeat() before constructing the repeated result. Keep
the maximum string length policy in LibJS while allowing the UTF-16
builder to remain purpose-built and infallible. Cover overflow from the
final repeated code-unit length in the repeat tests.
Add vformat support for Utf16StringBuilder and expose appendff and
try_appendff helpers on the builder itself. This lets callers build a
Utf16String on the purpose-built UTF-16 path even when using formatting.
Use the new API for Utf16String::formatted and add AK coverage for
formatting directly into a Utf16StringBuilder.
Add a purpose-built builder for constructing Utf16String values.
It keeps ASCII storage while possible, widens to UTF-16 when needed,
and can hand outline storage to Utf16StringData for direct adoption.
Add AK coverage for ASCII strings, UTF-16 widening, code points,
trimming, and long string construction.
Problem: Intermittent TestWebDriverSessionHistory crashes in CI.
Cause: A process-swap navigation driven through the load-url-from-ui
test hook (introduced in 24f37c6732 / #10085) could tear down the
WebContent process before it replied to the sync LoadUrlFromUi message,
tripping an assert — even though the result is still delivered over the
driver-execution-complete channel separately. (The reply’s just an ACK.)
Fix: Send the message with send_sync_but_allow_failure. Treat a dropped
reply as the swap proceeding. Nothing’s lost: WebContent sends the async
completion before this, and early errors return before any swap.
Problem: The Worker-echo.html test flakes under load in CI on the
Sanitizer runners, printing its messages out of order.
Cause: The test asserts a fixed order for messages arriving over two
separate ports: “loaded” over the Worker’s own port, and the channel
messages over the transferred MessagePort. Those two race, with no
cross-port ordering guarantee. So the printed order is nondeterministic.
Fix: Sequence each message explicitly with an awaited helper — the same
approach used for SharedWorker-reuse in #9669 — so the printed order is
deterministic. port2 is left unstarted until after “loaded”.
Use Qt's platform shortcut bindings for back and forward navigation
instead of only installing the primary binding. On macOS this keeps
Command-[ and Command-] while also accepting Command-Left and
Command-Right.
Disable Qt quit-on-last-window behavior on macOS and install an
application-level menu so useful commands remain available after the
last browser window closes.
Reuse shared application actions and menus for Settings, Bookmarks,
History, Help, and global appearance controls. Centralize window-aware
commands such as New Tab, New Window, Open File, Open Location, and
Reopen Recently Closed so the browser window and windowless app menu
use the same behavior. Keep the location editor focused for new blank
windows after the native window has been activated.
Disable AppKit's native resize handling for client-side decorated macOS
windows so AppKit does not show a resize cursor for points it will not
deliver to Ladybird. Reapply this after Qt creates the native surface,
since Qt may restore the resizable style mask during Cocoa window setup.
Handle the resize gesture in BrowserWindow instead, with thin side edges
and a slightly larger corner target that avoids the rounded corner
cutouts.
Move the active macOS web selection color into LibWebView so AppKit
and Qt use the same value when building the WebContent system palette.
Qt now also asks AppKit for inactive selection colors on macOS, matching
the AppKit frontend while leaving other Qt platforms on QPalette.
macOS can be configured to drag windows with Cmd+Ctrl+click via
NSWindowShouldDragOnGesture. AppKit does not see its usual titlebar
drag path for our frameless Qt windows, so handle the native mouse
down in the AppKit event filter when that default is enabled.
Forward the event to performWindowDragWithEvent before Qt turns it into
normal widget input. This restores the system gesture without changing
behavior for users who have not enabled the default.
After web content has focus on macOS, its native QRhiWidget can
remain the AppKit first responder even after Qt focuses the location
edit.
Make the top-level Qt content view first responder before focusing the
location edit so keyboard input returns to chrome.
Allow highlighted rows that are not valid inline completions to preview
their full suggestion text in the location editor. This covers history
entries matched by title or URL substring, while ordinary typing stays
on the inline-only path.
Keep automatic inline autocomplete text when Escape closes the popup.
Escape still cancels hovered or keyboard-selected preview text.
Remember which query produced the visible autocomplete popup rows, and
only activate selected rows when the visible popup still belongs to the
current query.
When Enter is pressed while fresh results are pending, rerun
autocomplete for the current query and activate once matching results
arrive. Ignore late completions after focus leaves. Avoid canceling
autocomplete while its completion callback activates the pending result.
Open the autocomplete popup when the location editor is focused
through the browser action, such as Cmd+L. Keep the selected URL text
intact by skipping inline completion for that explicit popup request.
Position the native popup again after its first show so Qt has realized
the tooltip window before the final placement, avoiding the brief macOS
Y-coordinate jump.
Problem: UBSan crash when computing layout for an element with a giant
negative inset.
Cause: CSSPixels::operator-() returned from_raw(-raw_value()), and
negating the i32 minimum overflows int.
Fix: Negate with saturating_sub(0, raw_value()) — matching the
saturating arithmetic already used by the other CSSPixels operators.
Fixes https://github.com/LadybirdBrowser/ladybird/issues/9997
