Commit Graph

6951 Commits

Author SHA1 Message Date
Tim Ledbetter
3991555439 LibWeb: Block opaque origins in CSP frame-ancestors check
This matches the behavior of other engines.
2026-02-21 12:30:48 +01:00
Callum Law
21c7de49f8 LibWeb: Remove outdated FIXME
As of 020c4aa we parse all shorthands as `ShorthandStyleValue`s and thus
this FIXME is irrelevant
2026-02-21 06:33:40 +00:00
Tim Ledbetter
83bd30b957 LibWeb: Stop inline elements after table-cell being swallowed into table
The `is_ignorable_whitespace()` check in table fixup traverses anonymous
block wrappers to see if they contain only whitespace. It rejected
out-of-flow and text descendants but silently skipped in-flow non-text
elements like `<span>`, misclassifying wrappers with real content as
ignorable and absorbing them into the table structure.
2026-02-21 05:48:53 +00:00
Tim Ledbetter
8240fa0dc8 LibWeb: Resolve percentage table widths in wrapper width computation
Previously, a table with `width: 100%` and `margin: auto` whose content
was narrower than the viewport would be centered based on content
width rather than filling the containing block. Resizing the viewport
wider than the content would shift the table progressively further to
the right.

Co-authored-by: Aliaksandr Kalenik <kalenik.aliaksandr@gmail.com>
2026-02-21 05:16:56 +01:00
Aliaksandr Kalenik
e87fece8c6 LibWeb: Force position:static on non-root SVG elements
SVG elements (except the outermost <svg>) use SVG's coordinate system,
not the CSS box model, so CSS positioning doesn't apply to them.

This adds SVGElement::adjust_computed_style() to force position:static
on all SVG elements except the outermost <svg> element (which has no
owner_svg_element()). SVGSymbolElement's existing override now calls
Base::adjust_computed_style() to inherit this behavior.

With this in place, the FIXME in layout_absolutely_positioned_element()
for SVG boxes becomes unreachable and is replaced with
VERIFY_NOT_REACHED().
2026-02-21 05:12:55 +01:00
Andreas Kling
5fdcf207f8 LibWeb: Avoid GC allocation in ResizeObservation::is_active()
Extract the box size computation into a new compute_box_size() that
returns a plain struct with two doubles, and use it in is_active()
instead of calculate_box_size() which allocates a GC-managed
ResizeObserverSize object.

Since is_active() only needs to compare sizes and immediately discards
the result, there's no reason to involve the GC. The GC-allocating
calculate_box_size() now delegates to compute_box_size() internally.

This was 2.6% of CPU time while playing a YouTube video.
2026-02-21 03:51:28 +01:00
Andreas Kling
935f76f88e LibWeb: Cache visibility in Paintable::resolve_paint_properties()
Cache the result of the visibility+opacity check as a bit field
(m_visible) computed in resolve_paint_properties(), which already runs
before each paint when paint properties need updating.

This makes Paintable::is_visible() a simple inline bit field read
instead of chasing through layout_node->computed_values() every time.

This was 3.3% of CPU time while playing a YouTube video.
2026-02-21 03:51:28 +01:00
Andreas Kling
ab64676742 LibWeb: Make Node::moved_from() MUST_UPCALL
Since we now maintain cached state (m_in_editable_subtree) in the base
Node::moved_from(), subclasses must always call up to ensure the flag
is recomputed. Mark it MUST_UPCALL like inserted() and removed_from().
2026-02-21 03:51:28 +01:00
Andreas Kling
5fd608b7cd LibWeb: Cache editability flag on DOM nodes for O(1) lookups
Add a cached m_in_editable_subtree flag to Node, updated on tree
mutations and contenteditable/designMode changes.

This replaces the recursive parent walk in is_editable() and
is_editing_host() with an O(1) flag check. The flag is recomputed
in inserted(), moved_from(), and cleared in removed_from(). Subtree
walks recompute the flag when contenteditable attributes change or
design mode is toggled.

This was 4% of CPU time while playing a YouTube video.
2026-02-21 03:51:28 +01:00
Zaggy1024
d9eafc8edc LibWeb: Use one method to cancel media elements' fetches
This should help avoid the footgun of forgetting to check for null on
m_fetch_controller. We had missed this check when firing off an error
due to an unsupported format in the PlaybackManager, so we could call
stop_fetch() on a null pointer if the download had completed already.
2026-02-20 19:11:31 -06:00
Zaggy1024
c1c51079a8 LibWeb: Don't stop fetches in FetchController if it was aborted already
If we've already fired off an error, calling stop_fetch() should
make no difference, other than stopping the Requests::Request.
Eventually, we'll probably want abort() and terminate() to
eventually stop the Requests::Request in an unobservable way.
2026-02-20 19:11:31 -06:00
Timothy Flynn
a112eb4881 LibWeb: Ensure empty contenteditable boxes contain the hit test position
There are actually a couple of bugs here:

1. As of commit ebda8fcf11, editing hosts
   are now excluded from Node::is_editable. Since this special hit test
   handling is specifically for contenteditable nodes, we would not
   enter this branch for these nodes.

2. We were not checking if the contenteditable node actually contained
   the hit testing position. So if a page had multiple empty editable
   nodes, we would just return whichever was hit test first.

These bugs were exposed by 7c9b3c08fa.
This commit resulted in the text cursor hit test node being set as the
document focus node. If we returned the wrong result, we would not set
the correct node.

This was seen on discord, where clicking the message box would result in
the search box being focused.
2026-02-21 01:02:06 +00:00
Timothy Flynn
f0ecadfae1 LibWeb: Set an ibeam cursor over editable / editing host DOM nodes
This matches the behavior of other browsers.
2026-02-21 01:02:06 +00:00
Callum Law
e6669482e6 LibWeb: Parse font-variant-alternates functions 2026-02-20 22:01:44 +00:00
Callum Law
1be9f1ae9d LibWeb: Move Gfx::FontVariantAlternates to CSS namespace
This is only ever used in the CSS namespace
2026-02-20 22:01:44 +00:00
Callum Law
630117e111 LibWeb: Reuse logic for parsing font-variant-alternates
This means that we only need to add support for parsing of alternates
functions in one place
2026-02-20 22:01:44 +00:00
Callum Law
1faaf83121 LibWeb: Move Gfx::FontVariantLigatures to the CSS namespace
This is only ever used in the CSS namespace and having it there allows
us to reuse existing enums
2026-02-20 22:01:44 +00:00
Callum Law
849e55b7ae LibWeb: Simplify parsing of font-variant-numeric 2026-02-20 22:01:44 +00:00
Callum Law
04fd7e00e9 LibWeb: Disallow disjointed numeric component of font-variant
The grammar groups this component together meaning that all
sub-components must occur together i.e.
`ordinal slashed-zero small-caps` is valid but
`ordinal small-caps slashed-zero` is not.

We also reuse the logic for parsing from the longhand
`font-variant-numeric` property for simplicity.
2026-02-20 22:01:44 +00:00
Callum Law
afc6b7b24c LibWeb: Move Gfx::FontVariantLigatures to the CSS namespace
This is only ever used in the CSS namespace and having it there allows
us to reuse existing enums
2026-02-20 22:01:44 +00:00
Callum Law
f511b95b81 LibWeb: Simplify parsing of font-variant-ligatures 2026-02-20 22:01:44 +00:00
Callum Law
d97098ec80 LibWeb: Disallow disjointed ligatures component of font-variant
The grammar groups this component together meaning that all
sub-components must occur together i.e.
`common-ligatures no-contextual small-caps` is valid but
`common-ligatures small-caps no-contextual` is not.

We also reuse the logic for parsing from the longhand
`font-variant-ligatures` property for simplicity.
2026-02-20 22:01:44 +00:00
Callum Law
f0dd7ec4e9 LibWeb: Move Gfx::FontVariantEastAsian to CSS namespace
This is only ever used in the CSS namespace and having it there allows
us to reuse existing enums
2026-02-20 22:01:44 +00:00
Callum Law
d6b94951cf LibWeb: Simplify parsing of font-variant-east-asian 2026-02-20 22:01:44 +00:00
Callum Law
75dd7b767f LibWeb: Disallow disjointed east asian component of font-variant
The grammar groups this component together meaning that all
sub-components must occur together i.e. `jis78 full-width small-caps` is
valid but `jis78 small-caps full-width` is not.

We also reuse the logic for parsing from the longhand
`font-variant-east-asian` property for simplicity.
2026-02-20 22:01:44 +00:00
Callum Law
a287df4620 LibWeb: Improve formatting of font-variant grammar comment
Fix indentation and wrapping to clearly show grouped components
2026-02-20 22:01:44 +00:00
Callum Law
893eac18dd LibWeb: Add TupleStyleValue
Many CSS grammars call for us to parse `Foo || Bar` but we don't have a
good way to represent this unless we have a custom style value. Usually
we store the values in a `StyleValueList` but since that can only store
non-null elements we have to manually recheck which elements we have at
which index whenever we use it.

This style value holds a Vector of `RefPtr<StyleValue const>` so that we
can represent null values and know what values are at what index without
manually rechecking.
2026-02-20 22:01:44 +00:00
Callum Law
4f3303b12f AK: Use AK namespace for ValueComparingRefPtr
These were moved in 0f04c6d but the namespace remained the same. We also
now forward declare these in `AK/Forward.h` rather than
`LibWeb/Forward.h` (or not at all in the case of `ValueComparingRefPtr`)
2026-02-20 22:01:44 +00:00
Zaggy1024
ebda8fcf11 LibWeb: Clarify the capture safety in HTMLMediaElement::fetch_resource
These tasks' captures aren't clearly safe as written, since raw
references don't make it apparent that we're capturing a GC-aware
reference. Conservative scanning made this safe, but let's make it a
bit clearer.
2026-02-20 12:46:17 -06:00
Aliaksandr Kalenik
c7dc2ba0d3 LibWeb: Remove DrawPaintingSurface
No callers of draw_painting_surface remain after the previous commits
migrated canvas, video, and SVG to use ExternalContentSource or
ImmutableBitmap snapshots.
2026-02-20 18:41:33 +01:00
Aliaksandr Kalenik
d9e04ec9e8 LibWeb: Snapshot SVG surface into ImmutableBitmap before painting
The last consumer of draw_painting_surface now snapshots the surface
into an ImmutableBitmap and uses draw_scaled_immutable_bitmap instead,
removing the final dependency on DrawPaintingSurface.
2026-02-20 18:41:33 +01:00
Aliaksandr Kalenik
004e5f851e LibWeb: Use ExternalContentSource for canvas painting
present() now snapshots the PaintingSurface into an ImmutableBitmap
and publishes it to the ExternalContentSource, so the rendering thread
never touches the live GPU surface — eliminating the data race
described in the ExternalContentSource commit (problem 1).

Canvas elements are registered with Page and presented once per frame
from the event loop, rather than on every individual draw call in
CRC2D::did_draw(). A dirty flag on HTMLCanvasElement ensures the
snapshot is only taken when content has actually changed, and makes
the present() call in CanvasPaintable::paint() a no-op when the
surface has already been snapshotted for the current frame.
2026-02-20 18:41:33 +01:00
Aliaksandr Kalenik
8a31ecdf39 LibWeb: Use ExternalContentSource for video painting
Publish new video frames to an ExternalContentSource, and switch
VideoPaintable from draw_scaled_immutable_bitmap to
draw_external_content.

Because DrawExternalContent reads the latest bitmap at replay time,
frame-only updates (no timeline or control change) now call
set_needs_display(InvalidateDisplayList::No) — skipping display list
rebuilds entirely. This addresses problem 2 from the previous commit.
2026-02-20 18:41:33 +01:00
Aliaksandr Kalenik
291078dd87 LibWeb: Introduce ExternalContentSource
Two related problems exist in the current display list architecture:

1. DrawPaintingSurface thread safety: CanvasPaintable::paint() records
   the *same* PaintingSurface that the canvas rendering context draws
   to. The rendering thread later reads from it, but the main thread
   may be concurrently drawing — a data race.

2. Video frames force display list rebuilds: each new video frame
   triggers set_needs_display() → full display list rebuild.

Both stem from display list commands holding direct references to
content (surface/bitmap) rather than going through an indirection
layer.

ExternalContentSource is a thread-safe, atomically-refcounted
container that holds an ImmutableBitmap snapshot. The accompanying
DrawExternalContent display list command reads from it during replay,
so producers can swap in new content without rebuilding the list.

Subsequent commits migrate canvas, video, and SVG painting to
ExternalContentSource and then remove DrawPaintingSurface.
2026-02-20 18:41:33 +01:00
Jelle Raaijmakers
ca45464c87 LibWeb: Scale down perspective transformation by DPR in DisplayList
By doing so, we attenuate the perspective transform on higher resolution
devices such as Retina displays (2x).

This fixes the perspective transform on sites such as
https://poke-holo.simey.me/.
2026-02-19 21:31:21 +01:00
Tim Ledbetter
fd24ca898c LibWeb: Skip hit-testing for elements with non-invertible transforms 2026-02-19 14:33:31 +00:00
Tim Ledbetter
8c5d081cdd LibWeb: Ensure elements with non-invertible transforms are not rendered 2026-02-19 14:33:31 +00:00
Luke Wilde
fc13f15193 LibWeb/CSP: Apply strict-dynamic to inline scripts
This implements https://github.com/w3c/webappsec-csp/pull/787 that
fixed the linked spec issue.
2026-02-19 14:58:09 +01:00
Aliaksandr Kalenik
65704e57fb LibWeb: Fix abspos replaced element constraint equations
The constraint equations for absolutely positioned replaced elements
only subtracted content width/height from the containing block size,
omitting padding and border.

Fixes https://github.com/LadybirdBrowser/ladybird/issues/7820
2026-02-19 12:56:40 +01:00
Callum Law
b8f2989ccb LibWeb: Reduce recompilation from editing CascadedProperties.h
This reduces the recompilation of editing `Properties.json` from ~1429
to ~158
2026-02-19 11:27:06 +00:00
Callum Law
f0434655f9 LibWeb: Reduce recompilation from editing Enums.json
Reduces the recompilation caused by editing `Enums.json` from ~1528 to
~327
2026-02-19 11:27:06 +00:00
Callum Law
6705bd187c LibWeb: Account for generic font families in FontFaceSet::load()
Fixes a regression in d998a0a which was crashing the imported test
2026-02-19 12:00:52 +01:00
Tim Ledbetter
918937231e LibWeb: Use premultiplied alpha when interpolating legacy sRGB colors
Previously, we were only using premultiplied alpha for non-legacy
colors after converting them to the Oklab color space.
2026-02-19 10:45:32 +00:00
Rocco Corsi
7eb0bb7c70 LibWeb: Reset animated frame index when loading new img element src
When an img element is changed from animated image to static image, the
animation briefly continues into the new image, even if the new image
has only a single frame (static image).

Could also impact when going from animated image to another animated
image, but the new image has less frames versus the previously animated
image.

In some cases a newly loaded static image would continue to be animated,
so that is also stopped.

fixes: #7879
fixes: #7945
2026-02-19 10:51:29 +01:00
Jonathan Gamble
d065f6bf00 LibWeb: Perform a microtask checkpoint - VERIFY after reentrancy return
The HTML event loop spec explicitly provides guidance for reentrancy in
the "perform a microtask checkpoint" algorithm, so we cannot VERIFY
for empty execution context before this early exit (as much as we'd
like to).

https://html.spec.whatwg.org/multipage/webappapis.html#perform-a-microtask-checkpoint

See the microtask-checkpoint-reentrancy-via-responsexml-script test for
an example of how this can happen from user scripts.
2026-02-19 08:12:31 +01:00
Aliaksandr Kalenik
a19db375b5 LibWeb: Only zero scroll container min-content in columns
The previous fix for scroll containers in grid unconditionally set the
min-content contribution to 0 in both dimensions. This caused grids with
height:min-content to collapse rows containing scroll container items to
0 height. Restrict the check to the column dimension only, since scroll
containers can overflow and scroll horizontally but must still
contribute their content height for correct row sizing.
2026-02-19 03:07:15 +01:00
Zaggy1024
ad92622cf4 LibWeb: Make HTMLMediaElement's FetchController reference weak
This allows the FetchController to be reclaimed when the fetch
completes.
2026-02-18 13:13:32 -06:00
Zaggy1024
7c0802bd4f LibWeb: Make FetchController's Requests::Request reference weak
This allows the Request to be cleaned up when it becomes inactive,
which in turn allows the GC to clean up the FetchController which is
indirectly captured by a root in the Request callbacks.
2026-02-18 13:13:32 -06:00
Zaggy1024
b25562ead7 LibWeb: Break a reference loop on HTMLMediaElement::FetchData
The stream's data request callback can't hold a strong reference to
FetchData, as that will create a reference loop:

FetchData -> IncrementallyPopulatedStream -> (lambda) -> FetchData

To prevent a use-after-free on the FetchData& capture, we clear the
data request callback in ~FetchData().
2026-02-18 13:13:32 -06:00
Zaggy1024
a283489799 LibWeb: Close the media element's stream when it is destroyed
This prevents the PlaybackManager's init thread from hanging waiting
for data that will never come after the media element gets GCed.
2026-02-18 13:13:32 -06:00