Repository navigation
fix(window): replace cross-origin surface caches with native bindings - #1594
Merged
Merged
Conversation
Spider Bench A/B✅ All benchmark browser service runs completed; results are informational. Public HEAD: 184 / 240 rows; 38 / 48 sites produced rows; 10 unexpected empty sites. ✅ Deterministic fixture contract is clean. Common ancestor Public 48-site run · informational
Public-site content, timing, and memory are noisy. This single A/B run reports evidence only; site outcome counts explain missing rows without treating them as a deterministic regression. CPU and memory timelinesThese are bounded 40-point views of the same complete process-tree samples used by the HTML report. CPU uses 100% per occupied logical core; memory lines are RSS first and PSS second when complete PSS samples are available. Basexychart-beta
title "Base CPU"
x-axis "Elapsed seconds" [1.537, 2.538, 3.039, 4.04, 4.542, 6.044, 7.546, 9.047, 10.048, 11.55, 13.051, 14.554, 16.056, 17.557, 19.059, 20.562, 22.064, 23.566, 25.068, 26.571, 27.571, 29.072, 30.574, 32.077, 33.579, 35.081, 36.582, 38.084, 39.586, 41.088, 42.59, 44.092, 45.092, 46.594, 48.095, 49.597, 51.099, 52.099]
y-axis "CPU percent" 0 --> 500
line [69.84, 117.94, 129.74, 145.73, 129.68, 139.98, 165.59, 157.94, 155.85, 143.96, 119.89, 119.78, 33.98, 29.97, 2, 11.97, 0, 87.92, 95.89, 2, 39.98, 79.99, 111.93, 99.85, 131.71, 125.91, 83.95, 137.82, 157.81, 99.88, 11.98, 139.87, 89.97, 17.98, 115.9, 125.83, 125.89, 200.05]
xychart-beta
title "Base memory: RSS then PSS"
x-axis "Elapsed seconds" [0.034, 1.537, 2.538, 3.039, 4.04, 4.542, 6.044, 7.546, 9.047, 10.048, 11.55, 13.051, 14.554, 16.056, 17.557, 19.059, 20.562, 22.064, 23.566, 25.068, 26.571, 27.571, 29.072, 30.574, 32.077, 33.579, 35.081, 36.582, 38.084, 39.586, 41.088, 42.59, 44.092, 45.092, 46.594, 48.095, 49.597, 51.099, 52.099, 52.562]
y-axis "Memory MiB" 0 --> 500
line [12.35, 92.7, 126.96, 141.38, 154.4, 144.25, 170.68, 163.87, 193.9, 194.06, 188.09, 198.88, 166.02, 169.74, 176.26, 176.59, 150.18, 149.23, 184.16, 168.45, 161.54, 162.39, 150.93, 169.16, 279.63, 214.73, 242.55, 162.1, 197.88, 167.14, 169.39, 152.93, 206.49, 195.93, 163.7, 187.52, 187.45, 176.02, 204.78, 0]
line [9.16, 89.18, 123.57, 137.85, 150.91, 140.75, 167.17, 160.32, 190.36, 190.26, 184.87, 195.33, 162.46, 166.21, 172.68, 173.01, 146.6, 145.66, 180.58, 164.87, 157.96, 158.76, 147.35, 165.25, 276.62, 211.16, 237.93, 158.54, 194.34, 163.76, 165.08, 149.35, 202.78, 192.37, 160.12, 183.94, 184.25, 172.47, 201.21, 0]
HEADxychart-beta
title "HEAD CPU"
x-axis "Elapsed seconds" [1.541, 3.043, 3.543, 4.545, 5.045, 6.548, 8.55, 10.051, 12.055, 13.557, 15.058, 17.062, 18.562, 20.065, 22.069, 23.569, 25.07, 27.07, 28.571, 30.575, 32.077, 33.58, 35.583, 37.085, 38.588, 40.589, 42.091, 43.592, 45.594, 47.097, 48.599, 50.601, 52.102, 54.105, 55.607, 57.107, 59.111, 60.112]
y-axis "CPU percent" 0 --> 500
line [115.96, 123.79, 129.96, 105.93, 137.79, 139.67, 95.87, 192.09, 141.64, 115.84, 0, 2, 2, 0, 93.98, 117.97, 65.99, 0, 41.96, 81.95, 1.99, 2, 129.86, 103.85, 135.69, 147.91, 123.64, 105.85, 36, 79.76, 53.94, 119.87, 79.88, 2, 125.81, 202, 125.75, 209.65]
xychart-beta
title "HEAD memory: RSS then PSS"
x-axis "Elapsed seconds" [0.04, 1.541, 3.043, 3.543, 4.545, 5.045, 6.548, 8.55, 10.051, 12.055, 13.557, 15.058, 17.062, 18.562, 20.065, 22.069, 23.569, 25.07, 27.07, 28.571, 30.575, 32.077, 33.58, 35.583, 37.085, 38.588, 40.589, 42.091, 43.592, 45.594, 47.097, 48.599, 50.601, 52.102, 54.105, 55.607, 57.107, 59.111, 60.112, 60.487]
y-axis "Memory MiB" 0 --> 500
line [12.11, 110.45, 137.81, 138.45, 124.52, 164.04, 182.69, 153.64, 184.91, 191.89, 171.8, 165.39, 150.07, 150.07, 150, 162.54, 188.98, 155.09, 150.54, 150.17, 147.12, 148.43, 146.6, 163.66, 287.63, 212, 239.24, 168.82, 166.39, 155.66, 167.06, 143.9, 200.49, 174.73, 161.25, 175.41, 170.86, 171.49, 198.75, 0]
line [9.22, 107.02, 134.36, 134.99, 121.14, 160.68, 179.2, 150.11, 181.51, 188.26, 168.34, 161.88, 146.56, 146.56, 146.48, 159.3, 184.97, 151.56, 147.01, 146.64, 143.6, 144.91, 143.07, 160.05, 285.04, 208.55, 235.84, 165.22, 162.79, 152.13, 163.41, 140.37, 197.32, 171.2, 157.73, 171.89, 167.33, 168, 195.23, 0]
Deterministic fixture · required contractThe fixture exercises 15 routes: 8 are expected to emit rows and 7 intentionally exercise empty, loading, or timeout behavior.
Full HTML, JSON, CSV, logs, and page snapshots: workflow run and full The public-web A/B is informational. The exact HEAD fixture contract runs as a separate required CI check; timing and public-site content deltas remain non-blocking. |
CI Regression ReportSource CI run · source state at render:
Release regression — ✅ HEAD/base failures 0/0; raw binary +0.007222%Package and image size
Startup latency and PSS
Concurrency matrix
Frontend differential — ✅ 1,020/1,020 cases matched; 0 issues
Agent episodes · Moli vs Chromium — ✅ 8/8 Moli episodes passed; 0 failures
Runtime and CDP session contracts — ✅ 26 contract cases; 0 failures
CDP smoke — ✅ 52/52 groups passed; 621 scenariosWorkers: 4 · cumulative group time: 138.26 s · failed groups: 0
WebMainBench · 545 pages — ✅ 545/545 completed; 0 unexpected failures
Frozen HTML · Linux · Diagnostics: All artifact fields are parsed by the trusted default-branch renderer; missing or invalid inputs remain visible as unavailable. |
Sequential Navigation Soak A/BOne browser process, one target, and one CDP session navigate CSDN → SegmentFault → Huaban → example.com repeatedly. This run issued 200 Common ancestor Session resilience
A public-page failure is reported separately from an unrecoverable session. The soak requires all navigation attempts, zero failed recovery, zero lifecycle/network ordering violations, and complete resource evidence. Process-tree memory
HEAD memory by 50-navigation quarter
Raw reports and per-navigation boundary samples: workflow run and full Public-site timing and memory are observational. Use the A/B deltas and trend shape as evidence, not as a deterministic performance threshold. |
ldm0
force-pushed
the
panic-fix39192
branch
2 times, most recently
from
October 16, 2026 11:23
dcdd687 to
107156b
Compare
Cross-origin child realms used caller-local top projections while following parent reached the actual top WindowProxy. Ancestor searches could then loop on the real top's self-parent until the watchdog terminated execution. Use the stable top WindowProxy throughout the ancestor chain and message endpoint resolution. Add a bounded nested-frame regression for the Adform ancestor search observed on personalshop.ch.
Generate stateless method and accessor tables with receiver checks and native value callbacks. Cache FunctionTemplates per isolate and use V8's per-context function instances, without retaining target Windows or observer realms. Cover function identity, realm prototypes, descriptors, receiver validation, exception and termination propagation, and context collection.
Replace WeakMap-backed Window surfaces with native access-check dispatch. Keep per-Window Location identity and resolve dynamic children from the current frame tree. Reuse the ordinary Window accessor value helpers. Apply cross-origin descriptor and fallback rules, preserve borrowed receiver behavior, and cover navigation, named collisions, removal, and realm teardown.
ldm0
changed the title
Share fallible Location initialization across live, detached, and shared wrappers. Propagate key, Proxy, and private-slot failures through Window construction and publish cached facades only after initialization succeeds. Cover rejected property initialization and V8 termination after a partial installation, including recovery without publishing an incomplete Location identity.
Select the first named child in current document-tree order, then compare its committed Document origin with the target parent. Keep opaque origin identity and tuple-origin comparisons separate from document.domain access relaxation. Apply the property-set rule to native bindings and facade names while preserving numeric access and same-origin Document id/name fallbacks. Cover three origins, nested parents, duplicate reordering, removal, navigation, descriptors, queries, and fallback collisions through the real task executor.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cross-origin Window access builds JavaScript surfaces and calls captured WeakMap intrinsics. Watchdog termination can fail those calls and panic. On personalshop.ch, Adform's ancestor search also loops because
topis a caller-local projection while followingparentreaches the actual top WindowProxy.This change fixes the ancestor identity bug and dispatches cross-origin access-check handlers through generated native member tables. It replaces the earlier WeakMap termination fix by removing that cache entirely.
The first three commits separate the behavior fix, reusable binding infrastructure, and Window/Location migration:
WebApiCrossOrigindeclarations. Cache stateless FunctionTemplates per isolate and let V8 provide each accessing Context's function instances. Callbacks resolve their actual receiver without capturing a target or observer.Two follow-up commits address review findings:
d919e889a6: Propagate Location key installation, Proxy wrapping, and private-slot failures through shared, live, detached, and popup construction. Cache the Window facade only after initialization succeeds. Regression tests reject property initialization and interrupt V8 during partial initialization, then verify recovery without a partial Location identity.9f13d2cab9: Restrict named child Window properties to the first matching child in current document-tree order whose committed Document origin matches the target parent's origin. Compare origin tuples and opaque identities without document.domain relaxation. Preserve numeric access and same-origin DOM id/name handling. Cover three origins, nested parents, duplicate ordering, removal, navigation, descriptors, queries, and fallback collisions; avoid constructing a discarded children list during named lookup.The migration also applies cross-origin descriptor/fallback rules: configurable, non-enumerable descriptors; undefined symbol fallbacks; SecurityError for unsupported descriptors; named child windows precede fallbacks and may shadow names such as document. Tests cover removal, navigation, borrowed receivers, function realms/identity, termination, and garbage collection.
The design follows Blink's native cross-origin member support and the HTML WindowProxy rules. The controlled Chromium comparison also checked receiver errors, mutation restrictions, Location identity, and named collisions. The new named-child origin restriction follows the current HTML rule; local Chromium 145.0.7632.116 still exposes explicitly named cross-origin children in the three-origin fixture, so this restriction is a deliberate conformance difference.
Validation (24 Cargo build jobs, each commit checked separately):
cargo fmt --allcargo clippy --workspace --all-targets --all-features -- -D warningscargo nextest run --no-fail-fast: 20,223 passed, 18 skipped at the Location follow-up; 20,225 passed, 18 skipped at the named-child follow-up.cargo build -p moliand the three-origin differential fixture.At native bindings commit 817e17d, three independent 40-second personalshop.ch runs loaded trackpoint-async.js and recorded no panic or watchdog termination. The previous profile spent approximately 8 seconds in Adform's ancestor loop before termination. The page still remained interactive at the end of these observations; this does not claim complete third-party resource loading.
At follow-up HEAD
9f13d2cab9, the three-origin fixture returns SecurityError for foreign named getters/descriptors and the first duplicate, while valid named access and cross-origin numeric indexing remain available.A new 40-second personalshop.ch observation at the follow-up HEAD loaded Adform trackpoint-async.js, recorded no panic or watchdog termination, and reached document.readyState=complete.
CLI
moli fetch https://personalshop.ch --timeout 60000: exit 0, 211,338 bytes of rendered HTML, empty stderr. The timeout value is in milliseconds.Supersedes #1586, whose WeakMap cache failure path is removed by the native bindings.