Implement HarfRust shaping backend

Signed-off-by: Nico Burns <nico@nicoburns.com>

.github/actions/parse_msrv/action.yml

@@ -0,0 +1,21 @@
+name: Parse rust-version from libservo
+description: "Parse rust-version from libservo. Requires cargo-metadata."
+outputs:
+  rust_version:
+    description: "Minimum rust-version defined by libservo"
+    value: ${{ steps.parse_version.outputs.LIBSERVO_RUST_VERSION }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Parse libservo version
+      id: parse_version
+      shell: bash
+      run:  |
+        msrv=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "libservo") | .rust_version')
+        if [[ "${msrv}" == "null" ]]; then
+          echo "Failed to determine MSRV of libservo"
+          exit 1
+        fi
+        echo "libservo has a minimum supported Rust version of ${msrv}."
+        echo "LIBSERVO_RUST_VERSION=${msrv}" >> "$GITHUB_OUTPUT"

.github/actions/runner-timeout/action.yml

@@ -0,0 +1,37 @@
+# In the unlikely event a self-hosted runner was selected and reserved but it
+# goes down before the workload starts, cancel the workflow run.
+name: Detect self-hosted runner assigment timeout
+description: "Cancel the workflow run if a self-hosted runner was selected, but the job failed to start"
+inputs:
+  unique-id:
+    required: true
+    description: "Unique ID of the runner"
+  github_token:
+    required: true
+    description: "Must be able to do github API calls and cancel jobs."
+
+runs:
+  using: "composite"
+  steps:
+    - name: Wait a bit
+      shell: bash
+      run: sleep 120
+
+    - name: Cancel if workload job is still queued
+      shell: bash
+      run: |
+        run_url=/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        export GH_TOKEN=${{ inputs.github_token }}
+  
+        if [ "$(gh api "$run_url/jobs" \
+          | jq -er --arg id '${{ inputs.unique-id }}' \
+            '.jobs[] | select(.name | contains("[" + $id + "]")) | .status'
+        )" = queued ]; then
+          echo 'Timeout waiting for runner assignment!'
+          echo 'Hint: does this repo have permission to access the runner group?'
+          echo 'Hint: https://github.com/organizations/servo/settings/actions/runner-groups'
+          echo
+          echo 'Cancelling workflow run'
+          gh api "$run_url/cancel" --method POST
+          exit 1
+        fi

.github/dependabot.yml

@@ -2,6 +2,9 @@ version: 2
 updates:
 - package-ecosystem: cargo
   directory: "/"
+  exclude-paths:
+    - "tests/blink_perf/**"
+    - "tests/wpt/**"
   schedule:
     interval: daily
   open-pull-requests-limit: 10
@@ -18,6 +21,8 @@ updates:
         - "emath"
         - "epaint"
         - "epaint_default_fonts"
+        - "accesskit_winit"
+        - "egui-file-dialog"
     gstreamer-related:
       patterns:
         - "gio*"

.github/workflows/android.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        target: ['aarch64-linux-android', 'armv7-linux-androideabi', 'i686-linux-android', 'x86_64-linux-android']
+        target: ['aarch64-linux-android', 'armv7-linux-androideabi', 'x86_64-linux-android']
     steps:
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@main
@@ -81,7 +81,7 @@ jobs:
         uses: nttld/setup-ndk@v1
         id: setup-ndk
         with:
-          ndk-version: r26c
+          ndk-version: r28b
       - name: Setup Gradle caches
         uses: gradle/actions/setup-gradle@v4
       - name: Trigger initial download of Gradle with retries
@@ -152,7 +152,7 @@ jobs:
     needs: ["build"]
     strategy:
       matrix:
-        target: ['aarch64-linux-android', 'armv7-linux-androideabi', 'i686-linux-android', 'x86_64-linux-android']
+        target: ['aarch64-linux-android', 'armv7-linux-androideabi', 'x86_64-linux-android']
     if: ${{ inputs.bencher && inputs.profile != 'debug' && github.event_name != 'workflow_dispatch' && github.event_name != 'merge_group' }}
     name: 'Bencher (${{ matrix.target }})'
     uses: ./.github/workflows/bencher.yml
@@ -160,8 +160,8 @@ jobs:
       target: android-${{ matrix.target }}
       profile: ${{ inputs.profile }}
       compressed-file-path: ${{ inputs.profile }}-binary-android-${{ matrix.target }}/servoapp.apk
-      binary-path: lib/${{ matrix.target == 'aarch64-linux-android' && 'arm64-v8a' || matrix.target == 'armv7-linux-androideabi' && 'armeabi-v7a' || matrix.target == 'i686-linux-android' && 'x86' || matrix.target == 'x86_64-linux-android' && 'x86_64'}}/libservoshell.so
+      binary-path: lib/${{ matrix.target == 'aarch64-linux-android' && 'arm64-v8a' || matrix.target == 'armv7-linux-androideabi' && 'armeabi-v7a' || matrix.target == 'x86_64-linux-android' && 'x86_64'}}/libservoshell.so
       file-size: true
       speedometer: false
       dromaeo: false
-    secrets: inherit
+    secrets: inherit

.github/workflows/bencher.yml

@@ -113,9 +113,10 @@ jobs:
         if: github.event_name == 'pull_request_target'
         run: |
             echo "RUN_BENCHER_OPTIONS=--branch ${{ github.event.number }}/PR \
-            --branch-start-point ${{ github.base_ref }} \
-            --branch-start-point-hash ${{ github.event.pull_request.base.sha }} \
-            --branch-reset \
+            --start-point ${{ github.base_ref }} \
+            --start-point-hash ${{ github.event.pull_request.base.sha }} \
+            --start-point-reset \
+            --start-point-clone-thresholds \
             --github-actions ${{ secrets.GITHUB_TOKEN }}" >> "$GITHUB_ENV"
       - name: Set bencher opts for main
         if: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
@@ -130,8 +131,9 @@ jobs:
             echo "RUN_BENCHER_OPTIONS=--branch try \
             --github-actions ${{ secrets.GITHUB_TOKEN }} \
             --hash $(git rev-parse HEAD~1) \
-            --branch-start-point main \
-            --branch-start-point-hash $(git merge-base upstream/main HEAD) \
+            --start-point main \
+            --start-point-hash $(git merge-base upstream/main HEAD) \
+            --start-point-clone-thresholds \
             --branch-reset" >> "$GITHUB_ENV"
       # we join results and send all data once to have it all in one report
       - name: Send results
@@ -140,4 +142,4 @@ jobs:
           ./etc/ci/bencher.py merge ${{ env.SERVO_FILE_SIZE_RESULT }} ${{ env.SERVO_STRIPPED_FILE_SIZE_RESULT }} ${{ env.SERVO_SPEEDOMETER_RESULT }} ${{ env.SERVO_DROMAEO_RESULT }} --bmf-output b.json
           bencher run --adapter json --file b.json \
             --project ${{ env.BENCHER_PROJECT }} --token ${{ secrets.BENCHER_API_TOKEN }} --testbed ubuntu-22.04 \
-            $RUN_BENCHER_OPTIONS
+            $RUN_BENCHER_OPTIONS

.github/workflows/dispatch-workflow.yml

@@ -75,8 +75,8 @@ jobs:
   lint:
     if: ${{ inputs.workflow == 'lint' }}
     name: Lint
+    # Note: The lint workflow does not need access to any secrets.
     uses: ./.github/workflows/lint.yml
-    secrets: inherit
 
   android:
     if: ${{ inputs.workflow == 'android' }}

.github/workflows/lint.yml

@@ -37,7 +37,7 @@ jobs:
         uses: baptiste0928/cargo-install@v3
         with:
           crate: cargo-deny
-          version: 0.18
+          version: 0.18.3
           locked: true
       - name: Bootstrap dependencies
         run: |

.github/workflows/linux-wpt.yml

@@ -65,6 +65,7 @@ jobs:
       - name: Setup Python
         uses: ./.github/actions/setup-python
       - name: Bootstrap dependencies
+        timeout-minutes: 60
         run: |
           sudo apt update
           sudo apt install -qy --no-install-recommends mesa-vulkan-drivers fonts-noto-cjk

.github/workflows/linux.yml

@@ -111,11 +111,18 @@ jobs:
   runner-timeout:
     needs:
       - runner-select
-    uses: ./.github/workflows/self-hosted-runner-timeout.yml
-    secrets: inherit
-    with:
-      unique-id: ${{ needs.runner-select.outputs.unique-id }}
-      is-self-hosted: ${{ fromJSON(needs.runner-select.outputs.is-self-hosted) }}
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: '.github'
+      - name: Runner timeout
+        uses: ./.github/actions/runner-timeout
+        if: ${{ fromJSON(needs.runner-select.outputs.is-self-hosted) }}
+        with:
+          github_token: '${{ secrets.GITHUB_TOKEN }}'
+          unique-id: '${{ needs.runner-select.outputs.unique-id }}'
 
   build:
     needs:
@@ -183,10 +190,6 @@ jobs:
           timeout_minutes: 20
           max_attempts: 2 # https://github.com/servo/servo/issues/30683
           command: ./mach test-unit --${{ inputs.profile }}
-      - name: Build libservo with examples
-        if: ${{ inputs.build-libservo }}
-        continue-on-error: true
-        run: cargo build -p libservo --all-targets
       - name: Archive build timing
         uses: actions/upload-artifact@v4
         with:
@@ -244,3 +247,34 @@ jobs:
       speedometer: ${{ inputs.profile == 'release' }}
       dromaeo: ${{ inputs.profile == 'release' }}
     secrets: inherit
+
+  build-libservo:
+    if: ${{ inputs.build-libservo }}
+    name: Build libservo and MSRV check
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        if: github.event_name != 'pull_request_target'
+        with:
+          fetch-depth: 1
+      # This is necessary to checkout the pull request if this run was triggered via a
+      # `pull_request_target` event.
+      - uses: actions/checkout@v4
+        if: github.event_name == 'pull_request_target'
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 1
+      - name: Set LIBCLANG_PATH env # needed for bindgen in mozangle
+        run: echo "LIBCLANG_PATH=/usr/lib/llvm-14/lib" >> $GITHUB_ENV
+      - name: Setup Python
+        uses: ./.github/actions/setup-python
+      - name: Determine MSRV
+        id: msrv
+        uses: ./.github/actions/parse_msrv
+      - name: Install MSRV
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ steps.msrv.outputs.rust_version }}
+      - name: Compile libservo with MSRV
+        run: |
+          cargo +${{ steps.msrv.outputs.rust_version }} build -p libservo --locked --all-targets

.github/workflows/mac-wpt.yml

@@ -40,6 +40,7 @@ jobs:
       - name: Setup Python
         uses: ./.github/actions/setup-python
       - name: Prep test environment
+        timeout-minutes: 60
         run: |
           gtar -xzf target.tar.gz
           ./mach bootstrap --skip-lints

.github/workflows/mac.yml

@@ -94,11 +94,18 @@ jobs:
   runner-timeout:
     needs:
       - runner-select
-    uses: ./.github/workflows/self-hosted-runner-timeout.yml
-    secrets: inherit
-    with:
-      unique-id: ${{ needs.runner-select.outputs.unique-id }}
-      is-self-hosted: ${{ fromJSON(needs.runner-select.outputs.is-self-hosted) }}
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: '.github'
+      - name: Runner timeout
+        uses: ./.github/actions/runner-timeout
+        if: ${{ fromJSON(needs.runner-select.outputs.is-self-hosted) }}
+        with:
+          github_token: '${{ secrets.GITHUB_TOKEN }}'
+          unique-id: '${{ needs.runner-select.outputs.unique-id }}'
 
   build:
     needs:
@@ -167,10 +174,6 @@ jobs:
           timeout_minutes: 40 # https://github.com/servo/servo/issues/30275
           max_attempts: 3 # https://github.com/servo/servo/issues/30683
           command: ./mach test-unit --${{ inputs.profile }}
-      - name: Build libservo with examples
-        if: ${{ inputs.build-libservo }}
-        continue-on-error: true
-        run: cargo build -p libservo --all-targets
       - name: Build mach package
         run: ./mach package --${{ inputs.profile }}
       - name: Run DMG smoketest
@@ -231,3 +234,32 @@ jobs:
       speedometer: false
       dromaeo: false
     secrets: inherit
+
+  build-libservo:
+    if: ${{ inputs.build-libservo }}
+    name: Build libservo and MSRV check
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+        if: github.event_name != 'pull_request_target'
+        with:
+          fetch-depth: 1
+      # This is necessary to checkout the pull request if this run was triggered via a
+      # `pull_request_target` event.
+      - uses: actions/checkout@v4
+        if: github.event_name == 'pull_request_target'
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 1
+      - name: Setup Python
+        uses: ./.github/actions/setup-python
+      - name: Determine MSRV
+        id: msrv
+        uses: ./.github/actions/parse_msrv
+      - name: Install MSRV
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ steps.msrv.outputs.rust_version }}
+      - name: Compile libservo with MSRV
+        run: |
+          cargo +${{ steps.msrv.outputs.rust_version }} build -p libservo --locked --all-targets

.github/workflows/ohos.yml

@@ -67,7 +67,7 @@ jobs:
         run: sudo apt update && ./mach bootstrap --skip-lints
       - name: Setup OpenHarmony SDK
         id: setup_sdk
-        uses: openharmony-rs/setup-ohos-sdk@v0.2.1
+        uses: openharmony-rs/setup-ohos-sdk@v0.2.3
         with:
           version: "5.0.2"
           fixup-path: true
@@ -269,14 +269,14 @@ jobs:
       - uses: actions/checkout@v4
         if: github.event_name != 'pull_request_target'
         with:
-          fetch-depth: 2
+          fetch-depth: 0
       # This is necessary to checkout the pull request if this run was triggered via a
       # `pull_request_target` event.
       - uses: actions/checkout@v4
         if: github.event_name == 'pull_request_target'
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 2
+          fetch-depth: 0
       - name: Setup Python
         uses: ./.github/actions/setup-python
       - name: Getting hitrace-bench version
@@ -289,26 +289,53 @@ jobs:
         continue-on-error: true
       - name: Run speedometer
         id: BencherRun
-        run: python3 ./mach test-speedometer-ohos --bmf-output speedometer.json
+        run: python3 ./mach test-speedometer-ohos --bmf-output speedometer.json --profile ${{ inputs.profile }}
         continue-on-error: true
       - name: Create empty speedometer.json if failed
         run: touch speedometer.json
         if: ${{ steps.BencherRun.outcome == 'failure' }}
       - name: Getting model name
+        # awk is used to remove trailing spaces
         run: |
-          echo "MODEL_NAME=$(hdc bugreport | head -n 20 | grep MarketName | awk '{for (i=2; i<NF; i++) printf $i " "; print $NF}' -)" >> $GITHUB_ENV
+          echo "MODEL_NAME=$(hdc shell param get const.product.name | awk '{$1=$1;print}' )" >> $GITHUB_ENV
       - name: Combining bencher files
         run: jq --compact-output --slurp add speedometer.json bench.json > combined-bencher.json
       - uses: bencherdev/bencher@main
+        # set options
+      - name: Set bencher opts for PRs (label try run)
+        if: github.event_name == 'pull_request_target'
+        run: |
+          echo "RUN_BENCHER_OPTIONS=--branch ${{ github.event.number }}/PR \
+          --start-point ${{ github.base_ref }} \
+          --start-point-hash ${{ github.event.pull_request.base.sha }} \
+          --start-point-reset \
+          --start-point-clone-thresholds"  >> "$GITHUB_ENV"
+      - name: Set bencher opts for main
+        if: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
+        run: |
+          echo "RUN_BENCHER_OPTIONS=--branch main" >> "$GITHUB_ENV"
+      - name: Set bencher opts for try branch
+        if: ${{ github.event_name == 'push' && github.ref_name == 'try' }}
+        run: |
+          git remote add upstream https://github.com/servo/servo
+          git fetch upstream main
+          echo "RUN_BENCHER_OPTIONS=--branch try \
+          --hash $(git rev-parse HEAD~1) \
+          --start-point main \
+          --start-point-hash $(git merge-base upstream/main HEAD) \
+          --start-point-clone-thresholds \
+          --start-point-reset" >> "$GITHUB_ENV"
       - name: Uploading to bencher.dev
+        # Note: That e.g. `--start-point` is ignored if it is an empty string,
+        # which should be the case on e.g. normal push workflows on main.
         run: |
           bencher run --adapter json \
                       --file combined-bencher.json \
                       --project '${{ env.BENCHER_PROJECT }}' \
-                      --hash '${{ github.sha }}' \
                       --token '${{ secrets.BENCHER_API_TOKEN }}' \
                       --github-actions '${{ secrets.GITHUB_TOKEN }}' \
-                      --testbed="$MODEL_NAME"
+                      --testbed="$MODEL_NAME" \
+                      $RUN_BENCHER_OPTIONS
       - name: Success
         if: ${{ !contains(steps.*.outcome, 'failure') && !contains(steps.*.outcome, 'cancelled') }}
         run: exit 0

.github/workflows/self-hosted-runner-timeout.yml

@@ -1,39 +0,0 @@
-name: Detect Self-hosted Runner Timeout
-on:
-  workflow_call:
-    inputs:
-      unique-id:
-        required: true
-        type: string
-      is-self-hosted:
-        required: true
-        type: boolean
-
-jobs:
-  # In the unlikely event a self-hosted runner was selected and reserved but it
-  # goes down before the workload starts, cancel the workflow run.
-  runner-timeout:
-    if: ${{ inputs.is-self-hosted }}
-    name: Detect Runner Timeout
-    runs-on: ubuntu-latest
-    steps:
-      - name: Wait a bit
-        run: sleep 120
-
-      - name: Cancel if workload job is still queued
-        run: |
-          run_url=/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          export GH_TOKEN=${{ secrets.GITHUB_TOKEN }}
-
-          if [ "$(gh api "$run_url/jobs" \
-            | jq -er --arg id '${{ inputs.unique-id }}' \
-              '.jobs[] | select(.name | contains("[" + $id + "]")) | .status'
-          )" = queued ]; then
-            echo 'Timeout waiting for runner assignment!'
-            echo 'Hint: does this repo have permission to access the runner group?'
-            echo 'Hint: https://github.com/organizations/servo/settings/actions/runner-groups'
-            echo
-            echo 'Cancelling workflow run'
-            gh api "$run_url/cancel" --method POST
-            exit 1
-          fi

.github/workflows/windows.yml

@@ -85,11 +85,18 @@ jobs:
   runner-timeout:
     needs:
       - runner-select
-    uses: ./.github/workflows/self-hosted-runner-timeout.yml
-    secrets: inherit
-    with:
-      unique-id: ${{ needs.runner-select.outputs.unique-id }}
-      is-self-hosted: ${{ fromJSON(needs.runner-select.outputs.is-self-hosted) }}
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: '.github'
+      - name: Runner timeout
+        uses: ./.github/actions/runner-timeout
+        if: ${{ fromJSON(needs.runner-select.outputs.is-self-hosted) }}
+        with:
+          github_token: '${{ secrets.GITHUB_TOKEN }}'
+          unique-id: '${{ needs.runner-select.outputs.unique-id }}'
 
   build:
     needs:
@@ -180,10 +187,6 @@ jobs:
           timeout_minutes: 30
           max_attempts: 3 # https://github.com/servo/servo/issues/30683
           command: .\mach test-unit --${{ inputs.profile }} -- -- --test-threads=1
-      - name: Build libservo with examples
-        if: ${{ inputs.build-libservo }}
-        continue-on-error: true
-        run: cargo build -p libservo --all-targets
       - name: Archive build timing
         uses: actions/upload-artifact@v4
         with:
@@ -223,3 +226,35 @@ jobs:
       speedometer: false
       dromaeo: false
     secrets: inherit
+
+  build-libservo:
+    if: ${{ inputs.build-libservo }}
+    name: Build libservo and MSRV check
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@v4
+        if: github.event_name != 'pull_request_target'
+        with:
+          fetch-depth: 1
+      # This is necessary to checkout the pull request if this run was triggered via a
+      # `pull_request_target` event.
+      - uses: actions/checkout@v4
+        if: github.event_name == 'pull_request_target'
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 1
+      - name: Setup Python
+        uses: ./.github/actions/setup-python
+      - name: Upgrade llvm
+        if: ${{ runner.environment != 'self-hosted' }}
+        run: choco upgrade llvm
+      - name: Determine MSRV
+        id: msrv
+        uses: ./.github/actions/parse_msrv
+      - name: Install MSRV
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ steps.msrv.outputs.rust_version }}
+      - name: Compile libservo with MSRV
+        run: |
+          cargo +${{ steps.msrv.outputs.rust_version }} build -p libservo --locked --all-targets

Cargo.toml

@@ -13,6 +13,11 @@ authors = ["The Servo Project Developers"]
 license = "MPL-2.0"
 edition = "2024"
 publish = false
+# We have yet to decide on a policy for updating the minimum supported rust version.
+# Before increasing this, please open a discussion on zulip explaining the reason
+# why we should consider increasing our minimum supported rust version.
+# Please also note, that the **default** rust version in rust-toolchain.toml may be
+# bumped freely.
 rust-version = "1.85.0"
 
 [workspace.dependencies]
@@ -33,15 +38,16 @@ base64 = "0.22.1"
 bincode = "1"
 bitflags = "2.9"
 bluetooth_traits = { path = "components/shared/bluetooth" }
+bytemuck = "1"
 byteorder = "1.5"
 canvas_traits = { path = "components/shared/canvas" }
 cbc = "0.1.2"
-cfg-if = "1.0.1"
+cfg-if = "1.0.3"
 chrono = { version = "0.4", features = ["serde"] }
 cipher = { version = "0.4.4", features = ["alloc"] }
 compositing_traits = { path = "components/shared/compositing" }
 constellation_traits = { path = "components/shared/constellation" }
-content-security-policy = { git = "https://github.com/servo/rust-content-security-policy/", branch = "servo-csp", features = ["serde"] }
+content-security-policy = { git = "https://github.com/servo/rust-content-security-policy", branch = "servo-csp", features = ["serde"] }
 cookie = { package = "cookie", version = "0.18" }
 crossbeam-channel = "0.5"
 cssparser = { version = "0.35", features = ["serde"] }
@@ -69,12 +75,13 @@ gstreamer-gl-sys = "0.23"
 gstreamer-sys = "0.23"
 gstreamer-video = "0.23"
 harfbuzz-sys = "0.6.1"
+harfrust = "0.1.1"
 headers = "0.4"
 hitrace = "0.1.5"
 html5ever = "0.35"
 http = "1.3"
 http-body-util = "0.1"
-hyper = "1.6"
+hyper = "1.7"
 hyper-rustls = { version = "0.27", default-features = false, features = ["http1", "http2", "logging", "tls12", "webpki-tokio"] }
 hyper-util = { version = "0.1", features = ["client-legacy", "http2", "tokio"] }
 hyper_serde = { path = "components/hyper_serde" }
@@ -86,8 +93,9 @@ indexmap = { version = "2.10.0", features = ["std"] }
 ipc-channel = "0.20"
 itertools = "0.14"
 js = { package = "mozjs", git = "https://github.com/servo/mozjs" }
-keyboard-types = "0.7"
-kurbo = "0.11"
+keyboard-types = { version = "0.8.1", features = ["serde", "webdriver"] }
+kurbo = { version = "0.11.3", features = ["euclid"] }
+layout_api = { path = "components/shared/layout" }
 libc = "0.2"
 log = "0.4"
 mach2 = "0.4"
@@ -99,12 +107,13 @@ mime = "0.3.13"
 mime_guess = "2.0.5"
 mozangle = "0.5.3"
 net_traits = { path = "components/shared/net" }
-nix = "0.29"
-nom = "7.1.3"
+nix = "0.30"
+nom = "8.0.0"
 num-traits = "0.2"
 num_cpus = "1.17.0"
 openxr = "0.19"
 parking_lot = "0.12"
+peniko = "0.4"
 percent-encoding = "2.3"
 proc-macro2 = "1"
 profile_traits = { path = "components/shared/profile" }
@@ -120,9 +129,8 @@ resvg = "0.45.0"
 rustls = { version = "0.23", default-features = false, features = ["logging", "std", "tls12"] }
 rustls-pemfile = "2.0"
 rustls-pki-types = "1.12"
-layout_api = { path = "components/shared/layout" }
 script_traits = { path = "components/shared/script" }
-selectors = { git = "https://github.com/servo/stylo", branch = "2025-07-01" }
+selectors = { git = "https://github.com/servo/stylo", branch = "2025-08-01" }
 serde = "1.0.219"
 serde_bytes = "0.11"
 serde_json = "1.0"
@@ -130,24 +138,24 @@ servo-media = { git = "https://github.com/servo/media" }
 servo-media-dummy = { git = "https://github.com/servo/media" }
 servo-media-gstreamer = { git = "https://github.com/servo/media" }
 servo-tracing = { path = "components/servo_tracing" }
-servo_arc = { git = "https://github.com/servo/stylo", branch = "2025-07-01" }
+servo_arc = { git = "https://github.com/servo/stylo", branch = "2025-08-01" }
+skrifa = "0.31.3"
 smallbitvec = "2.6.0"
-smallvec = { version = "1.15", features = ["union", "serde"] }
-static_assertions = "1.1"
+smallvec = { version = "1.15", features = ["serde", "union"] }
 string_cache = "0.8"
 string_cache_codegen = "0.5"
 strum = "0.26"
 strum_macros = "0.26"
-stylo = { git = "https://github.com/servo/stylo", branch = "2025-07-01" }
-stylo_atoms = { git = "https://github.com/servo/stylo", branch = "2025-07-01" }
-stylo_config = { git = "https://github.com/servo/stylo", branch = "2025-07-01" }
-stylo_dom = { git = "https://github.com/servo/stylo", branch = "2025-07-01" }
-stylo_malloc_size_of = { git = "https://github.com/servo/stylo", branch = "2025-07-01" }
-stylo_traits = { git = "https://github.com/servo/stylo", branch = "2025-07-01" }
+stylo = { git = "https://github.com/servo/stylo", branch = "2025-08-01" }
+stylo_atoms = { git = "https://github.com/servo/stylo", branch = "2025-08-01" }
+stylo_config = { git = "https://github.com/servo/stylo", branch = "2025-08-01" }
+stylo_dom = { git = "https://github.com/servo/stylo", branch = "2025-08-01" }
+stylo_malloc_size_of = { git = "https://github.com/servo/stylo", branch = "2025-08-01" }
+stylo_traits = { git = "https://github.com/servo/stylo", branch = "2025-08-01" }
 surfman = { git = "https://github.com/servo/surfman", rev = "f7688b4585f9e0b5d4bf8ee8e4a91e82349610b1", features = ["chains"] }
 syn = { version = "2", default-features = false, features = ["clone-impls", "derive", "parsing"] }
 synstructure = "0.13"
-taffy = { version = "0.8.3", default-features = false, features = ["detailed_layout_info", "grid", "serde", "std"] }
+taffy = { version = "0.9", default-features = false, features = ["calc", "detailed_layout_info", "grid", "std"] }
 tikv-jemalloc-sys = "0.6.0"
 tikv-jemallocator = "0.6.0"
 time = { package = "time", version = "0.3", features = ["large-dates", "local-offset", "serde"] }
@@ -165,7 +173,9 @@ unicode-script = "0.5"
 unicode-segmentation = "1.12.0"
 url = "2.5"
 urlpattern = "0.3"
-uuid = { version = "1.12.1", features = ["v4"] }
+uuid = { version = "1.18.0", features = ["v4"] }
+vello = { git = "https://github.com/linebender/vello", rev = "b0e2e598ac62c7b3d04d8660e7b1b7659b596970" }
+vello_cpu = { git = "https://github.com/linebender/vello", rev = "b0e2e598ac62c7b3d04d8660e7b1b7659b596970" }
 webdriver = "0.53.0"
 webgpu_traits = { path = "components/shared/webgpu" }
 webpki-roots = "1.0"
@@ -176,6 +186,7 @@ wgpu-core = "25"
 wgpu-types = "25"
 winapi = "0.3"
 windows-sys = "0.59"
+winit = "0.30.12"
 wio = "0.2"
 wr_malloc_size_of = { git = "https://github.com/servo/webrender", branch = "0.67" }
 xi-unicode = "0.3.0"
@@ -221,8 +232,8 @@ codegen-units = 1
 #
 # html5ever = { path = "../html5ever/html5ever" }
 # markup5ever = { path = "../html5ever/markup5ever" }
-# xml5ever = { path = "../html5ever/xml5ever" }
 # web_atoms = { path = "../html5ever/web_atoms" }
+# xml5ever = { path = "../html5ever/xml5ever" }
 #
 # Or for Stylo:
 #
@@ -249,4 +260,4 @@ codegen-units = 1
 # <crate> = { path = "/path/to/local/checkout" }
 #
 # [patch."https://github.com/servo/rust-content-security-policy"]
-# content-security-policy = { path = "../rust-content-security-policy/" }
+# content-security-policy = { path = "../rust-content-security-policy" }

README.md

@@ -90,4 +90,4 @@ For more detailed build instructions, see the Servo book under [Setting up your
   - `OHOS_SDK_NATIVE` (e.g. `${DEVECO_SDK_HOME}/default/openharmony/native` or `${OHOS_BASE_SDK_HOME}/${API_VERSION}/native`)
   - `SERVO_OHOS_SIGNING_CONFIG`: Path to json file containing a valid signing configuration for the demo app.
 - Review the detailed instructions at [Building for OpenHarmony].
-- The target distribution can be modified by passing `--flavor=<default|harmonyos>` to `mach <build|package|install>.
+- The target distribution can be modified by passing `--flavor=<default|harmonyos>` to `mach <build|package|install>`.

components/allocator/Cargo.toml

@@ -11,8 +11,13 @@ rust-version.workspace = true
 path = "lib.rs"
 
 [features]
+allocation-tracking = ["backtrace", "fnv"]
 use-system-allocator = ["libc"]
 
+[dependencies]
+backtrace = { workspace = true, optional = true }
+fnv = { workspace = true, optional = true }
+
 [target.'cfg(not(any(windows, target_env = "ohos")))'.dependencies]
 libc = { workspace = true, optional = true }
 tikv-jemalloc-sys = { workspace = true }

components/allocator/lib.rs

@@ -2,13 +2,53 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
-//! Selecting the default global allocator for Servo
+//! Selecting the default global allocator for Servo, and exposing common
+//! allocator introspection APIs for memory profiling.
 
+use std::os::raw::c_void;
+
+#[cfg(not(feature = "allocation-tracking"))]
 #[global_allocator]
 static ALLOC: Allocator = Allocator;
 
+#[cfg(feature = "allocation-tracking")]
+#[global_allocator]
+static ALLOC: crate::tracking::AccountingAlloc<Allocator> =
+    crate::tracking::AccountingAlloc::with_allocator(Allocator);
+
+#[cfg(feature = "allocation-tracking")]
+mod tracking;
+
+pub fn dump_unmeasured() {
+    #[cfg(feature = "allocation-tracking")]
+    ALLOC.dump_unmeasured_allocations();
+}
+
 pub use crate::platform::*;
 
+type EnclosingSizeFn = unsafe extern "C" fn(*const c_void) -> usize;
+
+/// # Safety
+/// No restrictions. The passed pointer is never dereferenced.
+/// This function is only marked unsafe because the MallocSizeOfOps APIs
+/// requires an unsafe function pointer.
+#[cfg(feature = "allocation-tracking")]
+unsafe extern "C" fn enclosing_size_impl(ptr: *const c_void) -> usize {
+    let (adjusted, size) = crate::ALLOC.enclosing_size(ptr);
+    if size != 0 {
+        crate::ALLOC.note_allocation(adjusted, size);
+    }
+    size
+}
+
+#[allow(non_upper_case_globals)]
+#[cfg(feature = "allocation-tracking")]
+pub static enclosing_size: Option<EnclosingSizeFn> = Some(crate::enclosing_size_impl);
+
+#[allow(non_upper_case_globals)]
+#[cfg(not(feature = "allocation-tracking"))]
+pub static enclosing_size: Option<EnclosingSizeFn> = None;
+
 #[cfg(not(any(windows, feature = "use-system-allocator", target_env = "ohos")))]
 mod platform {
     use std::os::raw::c_void;
@@ -21,7 +61,10 @@ mod platform {
     ///
     /// Passing a non-heap allocated pointer to this function results in undefined behavior.
     pub unsafe extern "C" fn usable_size(ptr: *const c_void) -> usize {
-        unsafe { tikv_jemallocator::usable_size(ptr) }
+        let size = unsafe { tikv_jemallocator::usable_size(ptr) };
+        #[cfg(feature = "allocation-tracking")]
+        crate::ALLOC.note_allocation(ptr, size);
+        size
     }
 
     /// Memory allocation APIs compatible with libc
@@ -46,12 +89,18 @@ mod platform {
     pub unsafe extern "C" fn usable_size(ptr: *const c_void) -> usize {
         #[cfg(target_vendor = "apple")]
         unsafe {
-            return libc::malloc_size(ptr);
+            let size = libc::malloc_size(ptr);
+            #[cfg(feature = "allocation-tracking")]
+            crate::ALLOC.note_allocation(ptr, size);
+            size
         }
 
         #[cfg(not(target_vendor = "apple"))]
         unsafe {
-            return libc::malloc_usable_size(ptr as *mut _);
+            let size = libc::malloc_usable_size(ptr as *mut _);
+            #[cfg(feature = "allocation-tracking")]
+            crate::ALLOC.note_allocation(ptr, size);
+            size
         }
     }
 
@@ -81,7 +130,10 @@ mod platform {
                 ptr = *(ptr as *const *const c_void).offset(-1)
             }
 
-            HeapSize(heap, 0, ptr) as usize
+            let size = HeapSize(heap, 0, ptr) as usize;
+            #[cfg(feature = "allocation-tracking")]
+            crate::ALLOC.note_allocation(ptr, size);
+            size
         }
     }
 }

components/allocator/tracking.rs

@@ -0,0 +1,211 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+//! An allocator wrapper that records metadata about each live allocation.
+//! This metadata can then be used to identify allocations that are not visible
+//! through any existing MallocSizeOf path.
+
+use std::alloc::{GlobalAlloc, Layout, System};
+use std::cell::Cell;
+use std::collections::hash_map::Entry;
+use std::os::raw::c_void;
+use std::sync::Mutex;
+
+use fnv::{FnvBuildHasher, FnvHashMap};
+
+/// The maximum number of allocations that we'll keep track of. Once the limit
+/// is reached, we'll evict the first allocation that is smaller than the new addition.
+const MAX_TRACKED_ALLOCATIONS: usize = usize::MAX;
+/// Cap the number of stack frames that we'll store per allocation.
+const MAX_FRAMES: usize = 50;
+/// A certain number of frames at the top of the allocation stack are just
+/// just internal liballoc implementation details or AccountingAlloc functions.
+/// We can skip them without losing any meaningful information.
+const SKIPPED_FRAMES: usize = 5;
+/// The minimum size of allocation that we'll track. Can be used to reduce overhead
+/// by skipping bookkeeping for small allocations.
+const MIN_SIZE: usize = 0;
+
+thread_local! {
+    static IN_ALLOCATION: Cell<bool> = Cell::new(false);
+}
+
+#[derive(PartialEq, Eq)]
+struct AllocSite {
+    /// The stack at the time this allocation was recorded.
+    frames: [*mut std::ffi::c_void; MAX_FRAMES],
+    /// The start of the allocated memory.
+    ptr: *mut u8,
+    /// The size of the allocated memory.
+    size: usize,
+    /// True if this allocation site's size is ever queried after the initial
+    /// allocation. If false, it means that the allocation is not visible from
+    /// any of the MallocSizeOf roots.
+    noted: bool,
+}
+
+impl AllocSite {
+    fn contains(&self, ptr: *mut u8) -> bool {
+        ptr >= self.ptr && ptr < unsafe { self.ptr.offset(self.size as isize) }
+    }
+}
+
+unsafe impl Send for AllocSite {}
+
+/// A map of pointers to allocation callsite metadata.
+static ALLOCATION_SITES: Mutex<FnvHashMap<usize, AllocSite>> =
+    const { Mutex::new(FnvHashMap::with_hasher(FnvBuildHasher::new())) };
+
+#[derive(Default)]
+pub struct AccountingAlloc<A = System> {
+    allocator: A,
+}
+
+impl<A> AccountingAlloc<A> {
+    pub const fn with_allocator(allocator: A) -> Self {
+        Self { allocator }
+    }
+
+    fn remove_allocation(&self, ptr: *const c_void, size: usize) {
+        if size < MIN_SIZE {
+            return;
+        }
+        let old = IN_ALLOCATION.with(|status| status.replace(true));
+        if old {
+            return;
+        }
+        let mut sites = ALLOCATION_SITES.lock().unwrap();
+        if let Entry::Occupied(e) = sites.entry(ptr as usize) {
+            e.remove();
+        }
+        IN_ALLOCATION.with(|status| status.set(old));
+    }
+
+    fn record_allocation(&self, ptr: *mut u8, size: usize) {
+        if size < MIN_SIZE {
+            return;
+        }
+        let old = IN_ALLOCATION.with(|status| status.replace(true));
+        if old {
+            return;
+        }
+        let mut num_skipped = 0;
+        let mut num_frames = 0;
+        let mut frames = [std::ptr::null_mut(); MAX_FRAMES];
+        backtrace::trace(|frame| {
+            if num_skipped < SKIPPED_FRAMES {
+                num_skipped += 1;
+                return true;
+            }
+            frames[num_frames] = frame.ip();
+            num_frames += 1;
+            num_frames < MAX_FRAMES
+        });
+        let site = AllocSite {
+            frames,
+            size,
+            ptr,
+            noted: false,
+        };
+        let mut sites = ALLOCATION_SITES.lock().unwrap();
+
+        if sites.len() < MAX_TRACKED_ALLOCATIONS {
+            sites.insert(ptr as usize, site);
+        } else if let Some(key) = sites
+            .iter()
+            .find(|(_, s)| s.size < site.size)
+            .map(|(k, _)| k.clone())
+        {
+            sites.remove(&key);
+            sites.insert(ptr as usize, site);
+        }
+
+        IN_ALLOCATION.with(|status| status.set(old));
+    }
+
+    pub(crate) fn enclosing_size(&self, ptr: *const c_void) -> (*const c_void, usize) {
+        ALLOCATION_SITES
+            .lock()
+            .unwrap()
+            .iter()
+            .find(|(_, site)| site.contains(ptr.cast_mut().cast()))
+            .map_or((std::ptr::null_mut(), 0), |(_, site)| {
+                (site.ptr.cast(), site.size)
+            })
+    }
+
+    pub(crate) fn note_allocation(&self, ptr: *const c_void, size: usize) {
+        if size < MIN_SIZE {
+            return;
+        }
+        IN_ALLOCATION.with(|status| status.set(true));
+        if let Some(site) = ALLOCATION_SITES.lock().unwrap().get_mut(&(ptr as usize)) {
+            site.noted = true;
+        }
+        IN_ALLOCATION.with(|status| status.set(false));
+    }
+
+    pub(crate) fn dump_unmeasured_allocations(&self) {
+        // Ensure that we ignore all allocations triggered while processing
+        // the existing allocation data.
+        IN_ALLOCATION.with(|status| status.set(true));
+        {
+            let sites = ALLOCATION_SITES.lock().unwrap();
+            let default = "???";
+            for site in sites
+                .values()
+                .filter(|site| site.size > MIN_SIZE && !site.noted)
+            {
+                let mut resolved = vec![];
+                for ip in site.frames.iter().filter(|ip| !ip.is_null()) {
+                    backtrace::resolve(*ip, |symbol| {
+                        resolved.push((
+                            symbol.filename().map(|f| f.to_owned()),
+                            symbol.lineno(),
+                            symbol.name().map(|n| format!("{}", n)),
+                        ));
+                    });
+                }
+
+                println!("---\n{}\n", site.size);
+                for (filename, line, symbol) in &resolved {
+                    let fname = filename.as_ref().map(|f| f.display().to_string());
+                    println!(
+                        "{}:{} ({})",
+                        fname.as_deref().unwrap_or(default),
+                        line.unwrap_or_default(),
+                        symbol.as_deref().unwrap_or(default),
+                    );
+                }
+            }
+        }
+        IN_ALLOCATION.with(|status| status.set(false));
+    }
+}
+
+unsafe impl<A: GlobalAlloc> GlobalAlloc for AccountingAlloc<A> {
+    unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
+        let ptr = unsafe { self.allocator.alloc(layout) };
+        self.record_allocation(ptr, layout.size());
+        ptr
+    }
+
+    unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
+        unsafe { self.allocator.dealloc(ptr, layout) };
+        self.remove_allocation(ptr.cast(), layout.size());
+    }
+
+    unsafe fn alloc_zeroed(&self, layout: Layout) -> *mut u8 {
+        let ptr = unsafe { self.allocator.alloc_zeroed(layout) };
+        self.record_allocation(ptr, layout.size());
+        ptr
+    }
+
+    unsafe fn realloc(&self, ptr: *mut u8, layout: Layout, new_size: usize) -> *mut u8 {
+        self.remove_allocation(ptr.cast(), layout.size());
+        let ptr = unsafe { self.allocator.realloc(ptr, layout, new_size) };
+        self.record_allocation(ptr, new_size);
+        ptr
+    }
+}

components/background_hang_monitor/background_hang_monitor.rs

@@ -2,10 +2,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
-use std::cell::Cell;
 use std::collections::{HashMap, VecDeque};
-use std::sync::{Arc, Weak};
-use std::thread;
+use std::thread::{self, Builder, JoinHandle};
 use std::time::{Duration, Instant};
 
 use background_hang_monitor_api::{
@@ -16,46 +14,33 @@ use background_hang_monitor_api::{
 use crossbeam_channel::{Receiver, Sender, after, never, select, unbounded};
 use ipc_channel::ipc::{IpcReceiver, IpcSender};
 use ipc_channel::router::ROUTER;
-use log::warn;
 
 use crate::sampler::{NativeStack, Sampler};
 
 #[derive(Clone)]
 pub struct HangMonitorRegister {
-    sender: Weak<Sender<(MonitoredComponentId, MonitoredComponentMsg)>>,
-    tether: Sender<Never>,
+    sender: MonitoredComponentSender,
     monitoring_enabled: bool,
 }
 
 impl HangMonitorRegister {
-    /// Start a new hang monitor worker, and return a handle to register components for monitoring.
+    /// Start a new hang monitor worker, and return a handle to register components for monitoring,
+    /// as well as a join handle on the worker thread.
     pub fn init(
         constellation_chan: IpcSender<HangMonitorAlert>,
         control_port: IpcReceiver<BackgroundHangMonitorControlMsg>,
         monitoring_enabled: bool,
-    ) -> Box<dyn BackgroundHangMonitorRegister> {
-        // Create a channel to pass messages of type `MonitoredComponentMsg`.
-        // See the discussion in `<HangMonitorRegister as
-        // BackgroundHangMonitorRegister>::register_component` for why we wrap
-        // the sender with `Arc` and why `HangMonitorRegister` only maintains
-        // a weak reference to it.
+    ) -> (Box<dyn BackgroundHangMonitorRegister>, JoinHandle<()>) {
         let (sender, port) = unbounded();
-        let sender = Arc::new(sender);
-        let sender_weak = Arc::downgrade(&sender);
+        let sender_clone = sender.clone();
 
-        // Create a "tether" channel, whose sole purpose is to keep the worker
-        // thread alive. The worker thread will terminates when all copies of
-        // `tether` are dropped.
-        let (tether, tether_port) = unbounded();
-
-        let _ = thread::Builder::new()
+        let join_handle = Builder::new()
             .name("BackgroundHangMonitor".to_owned())
             .spawn(move || {
                 let mut monitor = BackgroundHangMonitorWorker::new(
                     constellation_chan,
                     control_port,
-                    (sender, port),
-                    tether_port,
+                    port,
                     monitoring_enabled,
                 );
                 while monitor.run() {
@@ -63,11 +48,13 @@ impl HangMonitorRegister {
                 }
             })
             .expect("Couldn't start BHM worker.");
-        Box::new(HangMonitorRegister {
-            sender: sender_weak,
-            tether,
-            monitoring_enabled,
-        })
+        (
+            Box::new(HangMonitorRegister {
+                sender: sender_clone,
+                monitoring_enabled,
+            }),
+            join_handle,
+        )
     }
 }
 
@@ -80,11 +67,10 @@ impl BackgroundHangMonitorRegister for HangMonitorRegister {
         component_id: MonitoredComponentId,
         transient_hang_timeout: Duration,
         permanent_hang_timeout: Duration,
-        exit_signal: Option<Box<dyn BackgroundHangMonitorExitSignal>>,
+        exit_signal: Box<dyn BackgroundHangMonitorExitSignal>,
     ) -> Box<dyn BackgroundHangMonitor> {
         let bhm_chan = BackgroundHangMonitorChan::new(
             self.sender.clone(),
-            self.tether.clone(),
             component_id,
             self.monitoring_enabled,
         );
@@ -124,54 +110,12 @@ impl BackgroundHangMonitorRegister for HangMonitorRegister {
         ))]
         let sampler = crate::sampler::DummySampler::new_boxed();
 
-        // When a component is registered, and there's an exit request that
-        // reached BHM, we want an exit signal to be delivered to the
-        // component's exit signal handler eventually. However, there's a race
-        // condition between the reception of `BackgroundHangMonitorControlMsg::
-        // Exit` and `MonitoredComponentMsg::Register` that needs to handled
-        // carefully. When the worker receives an `Exit` message, it stops
-        // processing messages, and any further `Register` messages sent to the
-        // worker thread are ignored. If the submissions of `Exit` and
-        // `Register` messages are far apart enough, the channel is closed by
-        // the time the client attempts to send a `Register` message, and
-        // therefore the client can figure out by `Sender::send`'s return value
-        // that it must deliver an exit signal. However, if these message
-        // submissions are close enough, the `Register` message is still sent,
-        // but the worker thread might exit before it sees the message, leaving
-        // the message unprocessed and the exit signal unsent.
-        //
-        // To fix this, we wrap the exit signal handler in an RAII wrapper of
-        // type `SignalToExitOnDrop` to automatically send a signal when it's
-        // dropped. This way, we can make sure the exit signal is sent even if
-        // the message couldn't reach the worker thread and be processed.
-        //
-        // However, as it turns out, `crossbeam-channel`'s channels don't drop
-        // remaining messages until all associated senders *and* receivers are
-        // dropped. This means the exit signal won't be delivered as long as
-        // there's at least one `HangMonitorRegister` or
-        // `BackgroundHangMonitorChan` maintaining a copy of the sender. To work
-        // around this and guarantee a rapid delivery of the exit signal, the
-        // sender is wrapped in `Arc`, and only the worker thread maintains a
-        // strong reference, thus ensuring both the sender and receiver are
-        // dropped as soon as the worker thread exits.
-        let exit_signal = SignalToExitOnDrop(exit_signal);
-
-        // If the tether is dropped after this call, the worker thread might
-        // exit before processing the `Register` message because there's no
-        // implicit ordering guarantee between two channels. If this happens,
-        // an exit signal will be sent despite we haven't received a
-        // corresponding exit request. To enforce the correct ordering and
-        // prevent a false exit signal from being sent, we include a copy of
-        // `self.tether` in the `Register` message.
-        let tether = self.tether.clone();
-
         bhm_chan.send(MonitoredComponentMsg::Register(
             sampler,
             thread::current().name().map(str::to_owned),
             transient_hang_timeout,
             permanent_hang_timeout,
             exit_signal,
-            tether,
         ));
         Box::new(bhm_chan)
     }
@@ -191,8 +135,7 @@ enum MonitoredComponentMsg {
         Option<String>,
         Duration,
         Duration,
-        SignalToExitOnDrop,
-        Sender<Never>,
+        Box<dyn BackgroundHangMonitorExitSignal>,
     ),
     /// Unregister component for monitoring.
     Unregister,
@@ -202,54 +145,32 @@ enum MonitoredComponentMsg {
     NotifyWait,
 }
 
-/// Stable equivalent to the `!` type
-enum Never {}
-
 /// A wrapper around a sender to the monitor,
 /// which will send the Id of the monitored component along with each message,
 /// and keep track of whether the monitor is still listening on the other end.
 struct BackgroundHangMonitorChan {
-    sender: Weak<Sender<(MonitoredComponentId, MonitoredComponentMsg)>>,
-    _tether: Sender<Never>,
+    sender: MonitoredComponentSender,
     component_id: MonitoredComponentId,
-    disconnected: Cell<bool>,
     monitoring_enabled: bool,
 }
 
 impl BackgroundHangMonitorChan {
     fn new(
-        sender: Weak<Sender<(MonitoredComponentId, MonitoredComponentMsg)>>,
-        tether: Sender<Never>,
+        sender: MonitoredComponentSender,
         component_id: MonitoredComponentId,
         monitoring_enabled: bool,
     ) -> Self {
         BackgroundHangMonitorChan {
             sender,
-            _tether: tether,
             component_id,
-            disconnected: Default::default(),
             monitoring_enabled,
         }
     }
 
     fn send(&self, msg: MonitoredComponentMsg) {
-        if self.disconnected.get() {
-            return;
-        }
-
-        // The worker thread owns both the receiver *and* the only strong
-        // reference to the sender. An `upgrade` failure means the latter is
-        // gone, and a `send` failure means the former is gone. They are dropped
-        // simultaneously, but we might observe an intermediate state.
-        if self
-            .sender
-            .upgrade()
-            .and_then(|sender| sender.send((self.component_id.clone(), msg)).ok())
-            .is_none()
-        {
-            warn!("BackgroundHangMonitor has gone away");
-            self.disconnected.set(true);
-        }
+        self.sender
+            .send((self.component_id.clone(), msg))
+            .expect("BHM is gone");
     }
 }
 
@@ -272,33 +193,6 @@ impl BackgroundHangMonitor for BackgroundHangMonitorChan {
     }
 }
 
-/// Wraps [`BackgroundHangMonitorExitSignal`] and calls `signal_to_exit` when
-/// dropped.
-struct SignalToExitOnDrop(Option<Box<dyn BackgroundHangMonitorExitSignal>>);
-
-impl SignalToExitOnDrop {
-    /// Call `BackgroundHangMonitorExitSignal::signal_to_exit` now.
-    fn signal_to_exit(&mut self) {
-        if let Some(signal) = self.0.take() {
-            signal.signal_to_exit();
-        }
-    }
-
-    /// Disassociate `BackgroundHangMonitorExitSignal` from itself, preventing
-    /// `BackgroundHangMonitorExitSignal::signal_to_exit` from being called in
-    /// the future.
-    fn release(&mut self) {
-        self.0 = None;
-    }
-}
-
-impl Drop for SignalToExitOnDrop {
-    #[inline]
-    fn drop(&mut self) {
-        self.signal_to_exit();
-    }
-}
-
 struct MonitoredComponent {
     sampler: Box<dyn Sampler>,
     last_activity: Instant,
@@ -308,7 +202,7 @@ struct MonitoredComponent {
     sent_transient_alert: bool,
     sent_permanent_alert: bool,
     is_waiting: bool,
-    exit_signal: SignalToExitOnDrop,
+    exit_signal: Box<dyn BackgroundHangMonitorExitSignal>,
 }
 
 struct Sample(MonitoredComponentId, Instant, NativeStack);
@@ -318,8 +212,6 @@ struct BackgroundHangMonitorWorker {
     monitored_components: HashMap<MonitoredComponentId, MonitoredComponent>,
     constellation_chan: IpcSender<HangMonitorAlert>,
     port: Receiver<(MonitoredComponentId, MonitoredComponentMsg)>,
-    _port_sender: Arc<Sender<(MonitoredComponentId, MonitoredComponentMsg)>>,
-    tether_port: Receiver<Never>,
     control_port: Receiver<BackgroundHangMonitorControlMsg>,
     sampling_duration: Option<Duration>,
     sampling_max_duration: Option<Duration>,
@@ -328,6 +220,7 @@ struct BackgroundHangMonitorWorker {
     sampling_baseline: Instant,
     samples: VecDeque<Sample>,
     monitoring_enabled: bool,
+    shutting_down: bool,
 }
 
 type MonitoredComponentSender = Sender<(MonitoredComponentId, MonitoredComponentMsg)>;
@@ -337,8 +230,7 @@ impl BackgroundHangMonitorWorker {
     fn new(
         constellation_chan: IpcSender<HangMonitorAlert>,
         control_port: IpcReceiver<BackgroundHangMonitorControlMsg>,
-        (port_sender, port): (Arc<MonitoredComponentSender>, MonitoredComponentReceiver),
-        tether_port: Receiver<Never>,
+        port: MonitoredComponentReceiver,
         monitoring_enabled: bool,
     ) -> Self {
         let control_port = ROUTER.route_ipc_receiver_to_new_crossbeam_receiver(control_port);
@@ -347,8 +239,6 @@ impl BackgroundHangMonitorWorker {
             monitored_components: Default::default(),
             constellation_chan,
             port,
-            _port_sender: port_sender,
-            tether_port,
             control_port,
             sampling_duration: None,
             sampling_max_duration: None,
@@ -357,6 +247,7 @@ impl BackgroundHangMonitorWorker {
             creation: Instant::now(),
             samples: Default::default(),
             monitoring_enabled,
+            shutting_down: Default::default(),
         }
     }
 
@@ -415,19 +306,14 @@ impl BackgroundHangMonitorWorker {
 
         let received = select! {
             recv(self.port) -> event => {
-                // Since we own the `Arc<Sender<_>>`, the channel never
-                // gets disconnected.
-                Some(event.unwrap())
-            },
-            recv(self.tether_port) -> _ => {
-                // This arm can only reached by a tether disconnection
-                // All associated `HangMonitorRegister` and
-                // `BackgroundHangMonitorChan` have been dropped. Suppress
-                // `signal_to_exit` and exit the BHM.
-                for component in self.monitored_components.values_mut() {
-                    component.exit_signal.release();
+                if let Ok(event) = event {
+                    Some(event)
+                } else {
+                    // All senders have dropped,
+                    // which means all monitored components have shut down,
+                    // and so we can as well.
+                    return false;
                 }
-                return false;
             },
             recv(self.control_port) -> event => {
                 match event {
@@ -444,16 +330,21 @@ impl BackgroundHangMonitorWorker {
                         }
                         None
                     },
-                    Ok(BackgroundHangMonitorControlMsg::Exit(sender)) => {
+                    Ok(BackgroundHangMonitorControlMsg::Exit) => {
                         for component in self.monitored_components.values_mut() {
                             component.exit_signal.signal_to_exit();
                         }
 
-                        // Confirm exit with to the constellation.
-                        let _ = sender.send(());
+                        // Note the start of shutdown,
+                        // to ensure exit propagates,
+                        // even to components that have yet to register themselves,
+                        // from this point on.
+                        self.shutting_down = true;
 
-                        // Also exit the BHM.
-                        return false;
+                        // Keep running; this worker thread will shutdown
+                        // when the monitored components have shutdown,
+                        // which we know has happened when `self.port` disconnects.
+                        None
                     },
                     Err(_) => return false,
                 }
@@ -492,9 +383,16 @@ impl BackgroundHangMonitorWorker {
                     transient_hang_timeout,
                     permanent_hang_timeout,
                     exit_signal,
-                    _tether,
                 ),
             ) => {
+                // If we are shutting down,
+                // propagate it to the component,
+                // and register it(the component will unregister itself
+                // as part of handling the exit).
+                if self.shutting_down {
+                    exit_signal.signal_to_exit();
+                }
+
                 let component = MonitoredComponent {
                     sampler,
                     last_activity: Instant::now(),
@@ -517,13 +415,9 @@ impl BackgroundHangMonitorWorker {
                 );
             },
             (component_id, MonitoredComponentMsg::Unregister) => {
-                let (_, mut component) = self
-                    .monitored_components
+                self.monitored_components
                     .remove_entry(&component_id)
                     .expect("Received Unregister for an unknown component");
-
-                // Prevent `signal_to_exit` from being called
-                component.exit_signal.release();
             },
             (component_id, MonitoredComponentMsg::NotifyActivity(annotation)) => {
                 let component = self

components/background_hang_monitor/sampler_linux.rs

@@ -173,7 +173,7 @@ impl Sampler for LinuxSampler {
                     let ip = frame.ip();
                     let sp = frame.sp();
 
-                    //This return value here determines whether we proceed to the next stack frame or not.
+                    // This return value here determines whether we proceed to the next stack frame or not.
                     native_stack.process_register(ip, sp).is_ok()
                 })
             };

components/background_hang_monitor/tests/hang_monitor_tests.rs

@@ -27,16 +27,23 @@ fn test_hang_monitoring() {
         ipc::channel().expect("ipc channel failure");
     let (_sampler_sender, sampler_receiver) = ipc::channel().expect("ipc channel failure");
 
-    let background_hang_monitor_register = HangMonitorRegister::init(
+    let (background_hang_monitor_register, join_handle) = HangMonitorRegister::init(
         background_hang_monitor_ipc_sender.clone(),
         sampler_receiver,
         true,
     );
+
+    struct BHMExitSignal;
+
+    impl BackgroundHangMonitorExitSignal for BHMExitSignal {
+        fn signal_to_exit(&self) {}
+    }
+
     let background_hang_monitor = background_hang_monitor_register.register_component(
         MonitoredComponentId(TEST_PIPELINE_ID, MonitoredComponentType::Script),
         Duration::from_millis(10),
         Duration::from_millis(1000),
-        None,
+        Box::new(BHMExitSignal),
     );
 
     // Start an activity.
@@ -119,6 +126,11 @@ fn test_hang_monitoring() {
 
     // Still no new alerts because the hang monitor has shut-down already.
     assert!(background_hang_monitor_receiver.try_recv().is_err());
+
+    // Join on the worker thread(channels are dropped above).
+    join_handle
+        .join()
+        .expect("Failed to join on the BHM worker thread");
 }
 
 #[test]
@@ -131,16 +143,23 @@ fn test_hang_monitoring_unregister() {
         ipc::channel().expect("ipc channel failure");
     let (_sampler_sender, sampler_receiver) = ipc::channel().expect("ipc channel failure");
 
-    let background_hang_monitor_register = HangMonitorRegister::init(
+    let (background_hang_monitor_register, join_handle) = HangMonitorRegister::init(
         background_hang_monitor_ipc_sender.clone(),
         sampler_receiver,
         true,
     );
+
+    struct BHMExitSignal;
+
+    impl BackgroundHangMonitorExitSignal for BHMExitSignal {
+        fn signal_to_exit(&self) {}
+    }
+
     let background_hang_monitor = background_hang_monitor_register.register_component(
         MonitoredComponentId(TEST_PIPELINE_ID, MonitoredComponentType::Script),
         Duration::from_millis(10),
         Duration::from_millis(1000),
-        None,
+        Box::new(BHMExitSignal),
     );
 
     // Start an activity.
@@ -155,6 +174,13 @@ fn test_hang_monitoring_unregister() {
 
     // No new alert yet
     assert!(background_hang_monitor_receiver.try_recv().is_err());
+
+    // Drop the channels and join on the worker thread.
+    drop(background_hang_monitor);
+    drop(background_hang_monitor_register);
+    join_handle
+        .join()
+        .expect("Failed to join on the BHM worker thread");
 }
 
 // Perform two certain steps in `test_hang_monitoring_exit_signal_inner` in
@@ -218,15 +244,13 @@ fn test_hang_monitoring_exit_signal_inner(op_order: fn(&mut dyn FnMut(), &mut dy
     }));
 
     // Init a worker, without active monitoring.
-    let background_hang_monitor_register = HangMonitorRegister::init(
+    let (background_hang_monitor_register, join_handle) = HangMonitorRegister::init(
         background_hang_monitor_ipc_sender.clone(),
         control_receiver,
         false,
     );
 
     let mut background_hang_monitor = None;
-    let (exit_sender, exit_receiver) = ipc::channel().expect("Failed to create IPC channel!");
-    let mut exit_sender = Some(exit_sender);
 
     // `op_order` determines the order in which these two closures are
     // executed.
@@ -237,24 +261,26 @@ fn test_hang_monitoring_exit_signal_inner(op_order: fn(&mut dyn FnMut(), &mut dy
                 MonitoredComponentId(TEST_PIPELINE_ID, MonitoredComponentType::Script),
                 Duration::from_millis(10),
                 Duration::from_millis(1000),
-                Some(signal.take().unwrap()),
+                signal.take().unwrap(),
             ));
         },
         &mut || {
             // Send the exit message.
             control_sender
-                .send(BackgroundHangMonitorControlMsg::Exit(
-                    exit_sender.take().unwrap(),
-                ))
+                .send(BackgroundHangMonitorControlMsg::Exit)
                 .unwrap();
         },
     );
 
-    // Assert we receive a confirmation back.
-    assert!(exit_receiver.recv().is_ok());
-
     // Assert we get the exit signal.
     while !closing.load(Ordering::SeqCst) {
         thread::sleep(Duration::from_millis(10));
     }
+
+    // Drop the channels and join on the worker thread.
+    drop(background_hang_monitor);
+    drop(background_hang_monitor_register);
+    join_handle
+        .join()
+        .expect("Failed to join on the BHM worker thread");
 }

components/canvas/Cargo.toml

@@ -11,24 +11,39 @@ rust-version.workspace = true
 name = "canvas"
 path = "lib.rs"
 
+[features]
+vello = ["dep:vello", "dep:pollster", "dep:futures-intrusive", "dep:peniko"]
+vello_cpu = ["dep:vello_cpu", "dep:peniko"]
+raqote = ["dep:raqote", "dep:font-kit"]
+tracing = ["dep:tracing"]
+
 [dependencies]
 app_units = { workspace = true }
+bytemuck = { workspace = true, features = ["extern_crate_alloc"] }
 canvas_traits = { workspace = true }
 compositing_traits = { workspace = true }
 crossbeam-channel = { workspace = true }
 cssparser = { workspace = true }
 euclid = { workspace = true }
-font-kit = "0.14"
-fonts = { path = "../fonts" }
+font-kit = { version = "0.14", optional = true }
+fonts = { path = "../fonts", default-features = false }
 ipc-channel = { workspace = true }
 kurbo = { workspace = true }
 log = { workspace = true }
-lyon_geom = "1.0.4"
 net_traits = { workspace = true }
+peniko = { workspace = true, optional = true }
 pixels = { path = "../pixels" }
 range = { path = "../range" }
-raqote = "0.8.5"
+raqote = { version = "0.8.5", optional = true }
 servo_arc = { workspace = true }
 stylo = { workspace = true }
 unicode-script = { workspace = true }
 webrender_api = { workspace = true }
+servo_config = { path = "../config" }
+vello = { workspace = true, optional = true }
+vello_cpu = { workspace = true, optional = true }
+pollster = { version = "0.4", optional = true }
+futures-intrusive = { version = "0.5", optional = true }
+
+tracing = { workspace = true, optional = true }
+servo-tracing = { workspace = true }

components/canvas/backend.rs

@@ -3,135 +3,100 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
 use canvas_traits::canvas::{
-    CompositionOrBlending, FillOrStrokeStyle, LineCapStyle, LineJoinStyle, Path,
+    CompositionOptions, FillOrStrokeStyle, FillRule, LineOptions, Path, ShadowOptions,
 };
 use compositing_traits::SerializableImageData;
-use euclid::default::{Point2D, Rect, Size2D, Transform2D, Vector2D};
+use euclid::default::{Point2D, Rect, Size2D, Transform2D};
 use pixels::Snapshot;
-use style::color::AbsoluteColor;
 use webrender_api::ImageDescriptor;
 
-use crate::canvas_data::{CanvasPaintState, Filter, TextRun};
-
-pub(crate) trait Backend: Clone + Sized {
-    type Pattern<'a>: PatternHelpers + Clone;
-    type StrokeOptions: StrokeOptionsHelpers + Clone;
-    type Color: Clone;
-    type DrawOptions: DrawOptionsHelpers + Clone;
-    type CompositionOp;
-    type DrawTarget: GenericDrawTarget<Self>;
-    type SourceSurface;
-    type GradientStop;
-    type GradientStops;
-
-    fn get_composition_op(&self, opts: &Self::DrawOptions) -> Self::CompositionOp;
-    fn need_to_draw_shadow(&self, color: &Self::Color) -> bool;
-    fn set_shadow_color(&mut self, color: AbsoluteColor, state: &mut CanvasPaintState<'_, Self>);
-    fn set_fill_style(
-        &mut self,
-        style: FillOrStrokeStyle,
-        state: &mut CanvasPaintState<'_, Self>,
-        drawtarget: &Self::DrawTarget,
-    );
-    fn set_stroke_style(
-        &mut self,
-        style: FillOrStrokeStyle,
-        state: &mut CanvasPaintState<'_, Self>,
-        drawtarget: &Self::DrawTarget,
-    );
-    fn set_global_composition(
-        &mut self,
-        op: CompositionOrBlending,
-        state: &mut CanvasPaintState<'_, Self>,
-    );
-    fn create_drawtarget(&self, size: Size2D<u64>) -> Self::DrawTarget;
-    fn new_paint_state<'a>(&self) -> CanvasPaintState<'a, Self>;
-}
+use crate::canvas_data::{Filter, TextRun};
 
 // This defines required methods for a DrawTarget (currently only implemented for raqote).  The
 // prototypes are derived from the now-removed Azure backend's methods.
-pub(crate) trait GenericDrawTarget<B: Backend> {
-    fn clear_rect(&mut self, rect: &Rect<f32>);
+pub(crate) trait GenericDrawTarget {
+    type SourceSurface;
+
+    fn new(size: Size2D<u32>) -> Self;
+    fn create_similar_draw_target(&self, size: &Size2D<i32>) -> Self;
+
+    fn clear_rect(&mut self, rect: &Rect<f32>, transform: Transform2D<f64>);
     fn copy_surface(
         &mut self,
-        surface: B::SourceSurface,
+        surface: Self::SourceSurface,
         source: Rect<i32>,
         destination: Point2D<i32>,
     );
-    fn create_similar_draw_target(&self, size: &Size2D<i32>) -> Self;
-    fn create_source_surface_from_data(&self, data: Snapshot) -> Option<B::SourceSurface>;
+    fn create_source_surface_from_data(&self, data: Snapshot) -> Option<Self::SourceSurface>;
     fn draw_surface(
         &mut self,
-        surface: B::SourceSurface,
+        surface: Self::SourceSurface,
         dest: Rect<f64>,
         source: Rect<f64>,
         filter: Filter,
-        draw_options: &B::DrawOptions,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     );
     fn draw_surface_with_shadow(
         &self,
-        surface: B::SourceSurface,
+        surface: Self::SourceSurface,
         dest: &Point2D<f32>,
-        color: &B::Color,
-        offset: &Vector2D<f32>,
-        sigma: f32,
-        operator: B::CompositionOp,
+        shadow_options: ShadowOptions,
+        composition_options: CompositionOptions,
+    );
+    fn fill(
+        &mut self,
+        path: &Path,
+        fill_rule: FillRule,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     );
-    fn fill(&mut self, path: &Path, pattern: &B::Pattern<'_>, draw_options: &B::DrawOptions);
     fn fill_text(
         &mut self,
         text_runs: Vec<TextRun>,
         start: Point2D<f32>,
-        pattern: &B::Pattern<'_>,
-        draw_options: &B::DrawOptions,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     );
     fn fill_rect(
         &mut self,
         rect: &Rect<f32>,
-        pattern: &B::Pattern<'_>,
-        draw_options: &B::DrawOptions,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     );
     fn get_size(&self) -> Size2D<i32>;
-    fn get_transform(&self) -> Transform2D<f32>;
     fn pop_clip(&mut self);
-    fn push_clip(&mut self, path: &Path);
+    fn push_clip(&mut self, path: &Path, fill_rule: FillRule, transform: Transform2D<f64>);
     fn push_clip_rect(&mut self, rect: &Rect<i32>);
-    fn set_transform(&mut self, matrix: &Transform2D<f32>);
     fn stroke(
         &mut self,
         path: &Path,
-        pattern: &B::Pattern<'_>,
-        stroke_options: &B::StrokeOptions,
-        draw_options: &B::DrawOptions,
+        style: FillOrStrokeStyle,
+        line_options: LineOptions,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     );
     fn stroke_rect(
         &mut self,
         rect: &Rect<f32>,
-        pattern: &B::Pattern<'_>,
-        stroke_options: &B::StrokeOptions,
-        draw_options: &B::DrawOptions,
+        style: FillOrStrokeStyle,
+        line_options: LineOptions,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     );
-    fn surface(&self) -> B::SourceSurface;
-    fn image_descriptor_and_serializable_data(&self) -> (ImageDescriptor, SerializableImageData);
-    fn snapshot(&self) -> Snapshot;
+    fn surface(&mut self) -> Self::SourceSurface;
+    fn image_descriptor_and_serializable_data(
+        &mut self,
+    ) -> (ImageDescriptor, SerializableImageData);
+    fn snapshot(&mut self) -> Snapshot;
 }
 
-pub(crate) trait PatternHelpers {
-    fn is_zero_size_gradient(&self) -> bool;
-    fn x_bound(&self) -> Option<u32>;
-    fn y_bound(&self) -> Option<u32>;
-}
-
-pub(crate) trait StrokeOptionsHelpers {
-    fn set_line_width(&mut self, _val: f32);
-    fn set_miter_limit(&mut self, _val: f32);
-    fn set_line_join(&mut self, val: LineJoinStyle);
-    fn set_line_cap(&mut self, val: LineCapStyle);
-    fn set_line_dash(&mut self, items: Vec<f32>);
-    fn set_line_dash_offset(&mut self, offset: f32);
-}
-
-pub(crate) trait DrawOptionsHelpers {
-    fn set_alpha(&mut self, val: f32);
-    fn is_clear(&self) -> bool;
+#[allow(dead_code)] // used by gated backends
+/// A version of the `Into<T>` trait from the standard library that can be used
+/// to convert between two types that are not defined in the canvas crate.
+pub(crate) trait Convert<T> {
+    fn convert(self) -> T;
 }

components/canvas/lib.rs

@@ -5,7 +5,18 @@
 #![deny(unsafe_code)]
 
 mod backend;
+
+#[cfg(feature = "raqote")]
 mod raqote_backend;
 
+#[cfg(any(feature = "vello", feature = "vello_cpu"))]
+mod peniko_conversions;
+
+#[cfg(feature = "vello")]
+mod vello_backend;
+
+#[cfg(feature = "vello_cpu")]
+mod vello_cpu_backend;
+
 pub mod canvas_data;
 pub mod canvas_paint_thread;

components/canvas/peniko_conversions.rs

@@ -0,0 +1,225 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+use canvas_traits::canvas::*;
+use pixels::{SnapshotAlphaMode, SnapshotPixelFormat};
+use style::color::AbsoluteColor;
+
+use crate::backend::Convert;
+use crate::canvas_data::Filter;
+
+impl Convert<peniko::Font> for fonts::FontDataAndIndex {
+    fn convert(self) -> peniko::Font {
+        use std::sync::Arc;
+        peniko::Font::new(peniko::Blob::new(Arc::new(self.data)), self.index)
+    }
+}
+
+impl Convert<kurbo::Join> for LineJoinStyle {
+    fn convert(self) -> kurbo::Join {
+        match self {
+            LineJoinStyle::Round => kurbo::Join::Round,
+            LineJoinStyle::Bevel => kurbo::Join::Bevel,
+            LineJoinStyle::Miter => kurbo::Join::Miter,
+        }
+    }
+}
+
+impl Convert<kurbo::Cap> for LineCapStyle {
+    fn convert(self) -> kurbo::Cap {
+        match self {
+            LineCapStyle::Butt => kurbo::Cap::Butt,
+            LineCapStyle::Round => kurbo::Cap::Round,
+            LineCapStyle::Square => kurbo::Cap::Square,
+        }
+    }
+}
+
+impl Convert<peniko::Color> for AbsoluteColor {
+    fn convert(self) -> peniko::Color {
+        let srgb = self.into_srgb_legacy();
+        peniko::Color::new([
+            srgb.components.0,
+            srgb.components.1,
+            srgb.components.2,
+            srgb.alpha,
+        ])
+    }
+}
+
+impl Convert<peniko::BlendMode> for CompositionOrBlending {
+    fn convert(self) -> peniko::BlendMode {
+        match self {
+            CompositionOrBlending::Composition(composition_style) => {
+                composition_style.convert().into()
+            },
+            CompositionOrBlending::Blending(blending_style) => blending_style.convert().into(),
+        }
+    }
+}
+
+impl Convert<peniko::Compose> for CompositionStyle {
+    fn convert(self) -> peniko::Compose {
+        match self {
+            CompositionStyle::SourceIn => peniko::Compose::SrcIn,
+            CompositionStyle::SourceOut => peniko::Compose::SrcOut,
+            CompositionStyle::SourceOver => peniko::Compose::SrcOver,
+            CompositionStyle::SourceAtop => peniko::Compose::SrcAtop,
+            CompositionStyle::DestinationIn => peniko::Compose::DestIn,
+            CompositionStyle::DestinationOut => peniko::Compose::DestOut,
+            CompositionStyle::DestinationOver => peniko::Compose::DestOver,
+            CompositionStyle::DestinationAtop => peniko::Compose::DestAtop,
+            CompositionStyle::Copy => peniko::Compose::Copy,
+            CompositionStyle::Lighter => peniko::Compose::Plus,
+            CompositionStyle::Xor => peniko::Compose::Xor,
+            CompositionStyle::Clear => peniko::Compose::Clear,
+        }
+    }
+}
+
+impl Convert<peniko::Mix> for BlendingStyle {
+    fn convert(self) -> peniko::Mix {
+        match self {
+            BlendingStyle::Multiply => peniko::Mix::Multiply,
+            BlendingStyle::Screen => peniko::Mix::Screen,
+            BlendingStyle::Overlay => peniko::Mix::Overlay,
+            BlendingStyle::Darken => peniko::Mix::Darken,
+            BlendingStyle::Lighten => peniko::Mix::Lighten,
+            BlendingStyle::ColorDodge => peniko::Mix::ColorDodge,
+            BlendingStyle::ColorBurn => peniko::Mix::ColorBurn,
+            BlendingStyle::HardLight => peniko::Mix::HardLight,
+            BlendingStyle::SoftLight => peniko::Mix::SoftLight,
+            BlendingStyle::Difference => peniko::Mix::Difference,
+            BlendingStyle::Exclusion => peniko::Mix::Exclusion,
+            BlendingStyle::Hue => peniko::Mix::Hue,
+            BlendingStyle::Saturation => peniko::Mix::Saturation,
+            BlendingStyle::Color => peniko::Mix::Color,
+            BlendingStyle::Luminosity => peniko::Mix::Luminosity,
+        }
+    }
+}
+
+impl Convert<kurbo::Stroke> for LineOptions {
+    fn convert(self) -> kurbo::Stroke {
+        let LineOptions {
+            width,
+            cap_style,
+            join_style,
+            miter_limit,
+            dash,
+            dash_offset,
+        } = self;
+        kurbo::Stroke {
+            width,
+            join: join_style.convert(),
+            miter_limit,
+            start_cap: cap_style.convert(),
+            end_cap: cap_style.convert(),
+            dash_pattern: dash.iter().map(|x| *x as f64).collect(),
+            dash_offset,
+        }
+    }
+}
+
+impl Convert<peniko::Brush> for FillOrStrokeStyle {
+    fn convert(self) -> peniko::Brush {
+        use canvas_traits::canvas::FillOrStrokeStyle::*;
+        match self {
+            Color(absolute_color) => peniko::Brush::Solid(absolute_color.convert()),
+            LinearGradient(style) => {
+                let start = kurbo::Point::new(style.x0, style.y0);
+                let end = kurbo::Point::new(style.x1, style.y1);
+                let mut gradient = peniko::Gradient::new_linear(start, end);
+                gradient.stops = style.stops.convert();
+                peniko::Brush::Gradient(gradient)
+            },
+            RadialGradient(style) => {
+                let center1 = kurbo::Point::new(style.x0, style.y0);
+                let center2 = kurbo::Point::new(style.x1, style.y1);
+                let mut gradient = peniko::Gradient::new_two_point_radial(
+                    center1,
+                    style.r0 as f32,
+                    center2,
+                    style.r1 as f32,
+                );
+                gradient.stops = style.stops.convert();
+                peniko::Brush::Gradient(gradient)
+            },
+            Surface(surface_style) => {
+                let data = surface_style
+                    .surface_data
+                    .to_owned()
+                    .to_vec(
+                        Some(SnapshotAlphaMode::Transparent {
+                            premultiplied: false,
+                        }),
+                        Some(SnapshotPixelFormat::RGBA),
+                    )
+                    .0;
+                peniko::Brush::Image(peniko::Image {
+                    data: peniko::Blob::from(data),
+                    format: peniko::ImageFormat::Rgba8,
+                    width: surface_style.surface_size.width,
+                    height: surface_style.surface_size.height,
+                    x_extend: if surface_style.repeat_x {
+                        peniko::Extend::Repeat
+                    } else {
+                        peniko::Extend::Pad
+                    },
+                    y_extend: if surface_style.repeat_y {
+                        peniko::Extend::Repeat
+                    } else {
+                        peniko::Extend::Pad
+                    },
+                    quality: peniko::ImageQuality::Low,
+                    alpha: 1.0,
+                })
+            },
+        }
+    }
+}
+
+impl Convert<peniko::color::DynamicColor> for AbsoluteColor {
+    fn convert(self) -> peniko::color::DynamicColor {
+        peniko::color::DynamicColor::from_alpha_color(self.convert())
+    }
+}
+
+impl Convert<peniko::ColorStop> for CanvasGradientStop {
+    fn convert(self) -> peniko::ColorStop {
+        peniko::ColorStop {
+            offset: self.offset as f32,
+            color: self.color.convert(),
+        }
+    }
+}
+
+impl Convert<peniko::ColorStops> for Vec<CanvasGradientStop> {
+    fn convert(self) -> peniko::ColorStops {
+        let mut stops = peniko::ColorStops(self.into_iter().map(|item| item.convert()).collect());
+        // https://www.w3.org/html/test/results/2dcontext/annotated-spec/canvas.html#testrefs.2d.gradient.interpolate.overlap
+        stops
+            .0
+            .sort_by(|a, b| a.offset.partial_cmp(&b.offset).unwrap());
+        stops
+    }
+}
+
+impl Convert<peniko::ImageQuality> for Filter {
+    fn convert(self) -> peniko::ImageQuality {
+        match self {
+            Filter::Bilinear => peniko::ImageQuality::Medium,
+            Filter::Nearest => peniko::ImageQuality::Low,
+        }
+    }
+}
+
+impl Convert<peniko::Fill> for FillRule {
+    fn convert(self) -> peniko::Fill {
+        match self {
+            FillRule::Nonzero => peniko::Fill::NonZero,
+            FillRule::Evenodd => peniko::Fill::EvenOdd,
+        }
+    }
+}

components/canvas/raqote_backend.rs

@@ -8,21 +8,19 @@ use std::collections::HashMap;
 use canvas_traits::canvas::*;
 use compositing_traits::SerializableImageData;
 use cssparser::color::clamp_unit_f32;
-use euclid::default::{Point2D, Rect, Size2D, Transform2D, Vector2D};
+use euclid::default::{Point2D, Rect, Size2D, Transform2D};
 use font_kit::font::Font;
 use fonts::{ByteIndex, FontIdentifier, FontTemplateRefMethods};
 use ipc_channel::ipc::IpcSharedMemory;
 use log::warn;
 use pixels::{Snapshot, SnapshotAlphaMode, SnapshotPixelFormat};
 use range::Range;
-use raqote::PathBuilder;
+use raqote::{DrawOptions, PathBuilder, StrokeStyle};
 use style::color::AbsoluteColor;
 use webrender_api::{ImageDescriptor, ImageDescriptorFlags, ImageFormat};
 
-use crate::backend::{
-    Backend, DrawOptionsHelpers, GenericDrawTarget, PatternHelpers, StrokeOptionsHelpers,
-};
-use crate::canvas_data::{CanvasPaintState, Filter, TextRun};
+use crate::backend::GenericDrawTarget;
+use crate::canvas_data::{Filter, TextRun};
 
 thread_local! {
     /// The shared font cache used by all canvases that render on a thread. It would be nicer
@@ -32,86 +30,6 @@ thread_local! {
     static SHARED_FONT_CACHE: RefCell<HashMap<FontIdentifier, Font>> = RefCell::default();
 }
 
-#[derive(Clone, Default)]
-pub(crate) struct RaqoteBackend;
-
-impl Backend for RaqoteBackend {
-    type Pattern<'a> = Pattern;
-    type StrokeOptions = raqote::StrokeStyle;
-    type Color = raqote::SolidSource;
-    type DrawOptions = raqote::DrawOptions;
-    type CompositionOp = raqote::BlendMode;
-    type DrawTarget = raqote::DrawTarget;
-    type SourceSurface = Vec<u8>; // TODO: See if we can avoid the alloc (probably?)
-    type GradientStop = raqote::GradientStop;
-    type GradientStops = Vec<raqote::GradientStop>;
-
-    fn get_composition_op(&self, opts: &Self::DrawOptions) -> Self::CompositionOp {
-        opts.blend_mode
-    }
-
-    fn need_to_draw_shadow(&self, color: &Self::Color) -> bool {
-        color.a != 0
-    }
-
-    fn set_shadow_color(&mut self, color: AbsoluteColor, state: &mut CanvasPaintState<'_, Self>) {
-        state.shadow_color = color.to_raqote_style();
-    }
-
-    fn set_fill_style(
-        &mut self,
-        style: FillOrStrokeStyle,
-        state: &mut CanvasPaintState<'_, Self>,
-        _drawtarget: &Self::DrawTarget,
-    ) {
-        if let Some(pattern) = style.to_raqote_pattern() {
-            state.fill_style = pattern;
-        }
-    }
-
-    fn set_stroke_style(
-        &mut self,
-        style: FillOrStrokeStyle,
-        state: &mut CanvasPaintState<'_, Self>,
-        _drawtarget: &Self::DrawTarget,
-    ) {
-        if let Some(pattern) = style.to_raqote_pattern() {
-            state.stroke_style = pattern;
-        }
-    }
-
-    fn set_global_composition(
-        &mut self,
-        op: CompositionOrBlending,
-        state: &mut CanvasPaintState<'_, Self>,
-    ) {
-        state.draw_options.blend_mode = op.to_raqote_style();
-    }
-
-    fn create_drawtarget(&self, size: Size2D<u64>) -> Self::DrawTarget {
-        raqote::DrawTarget::new(size.width as i32, size.height as i32)
-    }
-
-    fn new_paint_state<'a>(&self) -> CanvasPaintState<'a, Self> {
-        let pattern = Pattern::Color(255, 0, 0, 0);
-        CanvasPaintState {
-            draw_options: raqote::DrawOptions::new(),
-            fill_style: pattern.clone(),
-            stroke_style: pattern,
-            stroke_opts: Default::default(),
-            transform: Transform2D::identity(),
-            shadow_offset_x: 0.0,
-            shadow_offset_y: 0.0,
-            shadow_blur: 0.0,
-            shadow_color: raqote::SolidSource::from_unpremultiplied_argb(0, 0, 0, 0),
-            font_style: None,
-            text_align: TextAlign::default(),
-            text_baseline: TextBaseline::default(),
-            _backend: std::marker::PhantomData,
-        }
-    }
-}
-
 #[derive(Clone)]
 pub enum Pattern {
     // argb
@@ -170,7 +88,6 @@ pub struct SurfacePattern {
     image: Snapshot,
     filter: raqote::FilterMode,
     extend: raqote::ExtendMode,
-    repeat: Repetition,
     transform: Transform2D<f32>,
 }
 
@@ -191,14 +108,9 @@ impl SurfacePattern {
             image,
             filter,
             extend,
-            repeat,
             transform,
         }
     }
-
-    pub fn repetition(&self) -> &Repetition {
-        &self.repeat
-    }
 }
 
 #[derive(Clone, Copy, Debug)]
@@ -223,7 +135,7 @@ impl Repetition {
     }
 }
 
-pub fn source(pattern: &Pattern) -> raqote::Source {
+pub fn source(pattern: &Pattern) -> raqote::Source<'_> {
     match pattern {
         Pattern::Color(a, r, g, b) => raqote::Source::Solid(
             raqote::SolidSource::from_unpremultiplied_argb(*a, *r, *g, *b),
@@ -242,93 +154,16 @@ pub fn source(pattern: &Pattern) -> raqote::Source {
             pattern.radius2,
             raqote::Spread::Pad,
         ),
-        Pattern::Surface(pattern) => {
-            #[allow(unsafe_code)]
-            let data = unsafe {
-                let data = pattern.image.as_raw_bytes();
-                std::slice::from_raw_parts(
-                    data.as_ptr() as *const u32,
-                    data.len() / std::mem::size_of::<u32>(),
-                )
-            };
-            raqote::Source::Image(
-                raqote::Image {
-                    width: pattern.image.size().width as i32,
-                    height: pattern.image.size().height as i32,
-                    data,
-                },
-                pattern.extend,
-                pattern.filter,
-                pattern.transform,
-            )
-        },
-    }
-}
-
-impl PatternHelpers for Pattern {
-    fn is_zero_size_gradient(&self) -> bool {
-        match self {
-            Pattern::RadialGradient(pattern) => {
-                let centers_equal = pattern.center1 == pattern.center2;
-                let radii_equal = pattern.radius1 == pattern.radius2;
-                (centers_equal && radii_equal) || pattern.gradient.stops.is_empty()
+        Pattern::Surface(pattern) => raqote::Source::Image(
+            raqote::Image {
+                width: pattern.image.size().width as i32,
+                height: pattern.image.size().height as i32,
+                data: bytemuck::cast_slice(pattern.image.as_raw_bytes()),
             },
-            Pattern::LinearGradient(pattern) => {
-                (pattern.start == pattern.end) || pattern.gradient.stops.is_empty()
-            },
-            Pattern::Color(..) | Pattern::Surface(..) => false,
-        }
-    }
-
-    fn x_bound(&self) -> Option<u32> {
-        match self {
-            Pattern::Surface(pattern) => match pattern.repetition() {
-                Repetition::RepeatX | Repetition::Repeat => None, // x is not bounded
-                Repetition::RepeatY | Repetition::NoRepeat => Some(pattern.image.size().width),
-            },
-            Pattern::Color(..) | Pattern::LinearGradient(..) | Pattern::RadialGradient(..) => None,
-        }
-    }
-
-    fn y_bound(&self) -> Option<u32> {
-        match self {
-            Pattern::Surface(pattern) => match pattern.repetition() {
-                Repetition::RepeatY | Repetition::Repeat => None, // y is not bounded
-                Repetition::RepeatX | Repetition::NoRepeat => Some(pattern.image.size().height),
-            },
-            Pattern::Color(..) | Pattern::LinearGradient(..) | Pattern::RadialGradient(..) => None,
-        }
-    }
-}
-
-impl StrokeOptionsHelpers for raqote::StrokeStyle {
-    fn set_line_width(&mut self, _val: f32) {
-        self.width = _val;
-    }
-    fn set_miter_limit(&mut self, _val: f32) {
-        self.miter_limit = _val;
-    }
-    fn set_line_join(&mut self, val: LineJoinStyle) {
-        self.join = val.to_raqote_style();
-    }
-    fn set_line_cap(&mut self, val: LineCapStyle) {
-        self.cap = val.to_raqote_style();
-    }
-    fn set_line_dash(&mut self, items: Vec<f32>) {
-        self.dash_array = items;
-    }
-    fn set_line_dash_offset(&mut self, offset: f32) {
-        self.dash_offset = offset;
-    }
-}
-
-impl DrawOptionsHelpers for raqote::DrawOptions {
-    fn set_alpha(&mut self, val: f32) {
-        self.alpha = val;
-    }
-
-    fn is_clear(&self) -> bool {
-        matches!(self.blend_mode, raqote::BlendMode::Clear)
+            pattern.extend,
+            pattern.filter,
+            pattern.transform,
+        ),
     }
 }
 
@@ -342,150 +177,133 @@ fn create_gradient_stops(gradient_stops: Vec<CanvasGradientStop>) -> Vec<raqote:
     stops
 }
 
-impl GenericDrawTarget<RaqoteBackend> for raqote::DrawTarget {
-    fn clear_rect(&mut self, rect: &Rect<f32>) {
-        let rect = rect.cast();
-        let mut pb = canvas_traits::canvas::Path::new();
-        pb.rect(
-            rect.origin.x,
-            rect.origin.y,
-            rect.size.width,
-            rect.size.height,
-        );
-        let mut options = raqote::DrawOptions::new();
-        options.blend_mode = raqote::BlendMode::Clear;
-        let pattern = Pattern::Color(0, 0, 0, 0);
-        <Self as GenericDrawTarget<RaqoteBackend>>::fill(self, &pb, &pattern, &options);
+impl GenericDrawTarget for raqote::DrawTarget {
+    type SourceSurface = Vec<u32>; // TODO: See if we can avoid the alloc (probably?)
+
+    fn new(size: Size2D<u32>) -> Self {
+        raqote::DrawTarget::new(size.width as i32, size.height as i32)
+    }
+
+    fn clear_rect(&mut self, rect: &Rect<f32>, transform: Transform2D<f64>) {
+        <Self as GenericDrawTarget>::fill_rect(
+            self,
+            rect,
+            FillOrStrokeStyle::Color(AbsoluteColor::TRANSPARENT_BLACK),
+            CompositionOptions {
+                alpha: 1.0,
+                composition_operation: CompositionOrBlending::Composition(CompositionStyle::Clear),
+            },
+            transform,
+        );
     }
-    #[allow(unsafe_code)]
     fn copy_surface(
         &mut self,
-        surface: <RaqoteBackend as Backend>::SourceSurface,
+        surface: Self::SourceSurface,
         source: Rect<i32>,
         destination: Point2D<i32>,
     ) {
-        let mut dt = raqote::DrawTarget::new(source.size.width, source.size.height);
-        let data = surface;
-        let s = unsafe { std::slice::from_raw_parts(data.as_ptr() as *const u32, data.len() / 4) };
-        dt.get_data_mut().copy_from_slice(s);
+        let dt = raqote::DrawTarget::from_vec(source.size.width, source.size.height, surface);
         raqote::DrawTarget::copy_surface(self, &dt, source.to_box2d(), destination);
     }
 
-    fn create_similar_draw_target(
-        &self,
-        size: &Size2D<i32>,
-    ) -> <RaqoteBackend as Backend>::DrawTarget {
+    fn create_similar_draw_target(&self, size: &Size2D<i32>) -> Self {
         raqote::DrawTarget::new(size.width, size.height)
     }
-    fn create_source_surface_from_data(
-        &self,
-        data: Snapshot,
-    ) -> Option<<RaqoteBackend as Backend>::SourceSurface> {
+    fn create_source_surface_from_data(&self, data: Snapshot) -> Option<Self::SourceSurface> {
         Some(
-            data.to_vec(
-                Some(SnapshotAlphaMode::Transparent {
-                    premultiplied: true,
-                }),
-                Some(SnapshotPixelFormat::BGRA),
+            bytemuck::try_cast_vec(
+                data.to_vec(
+                    Some(SnapshotAlphaMode::Transparent {
+                        premultiplied: true,
+                    }),
+                    Some(SnapshotPixelFormat::BGRA),
+                )
+                .0,
             )
-            .0,
+            .unwrap_or_else(|(_, surface)| bytemuck::pod_collect_to_vec(&surface)),
         )
     }
-    #[allow(unsafe_code)]
     fn draw_surface(
         &mut self,
-        surface: <RaqoteBackend as Backend>::SourceSurface,
+        surface: Self::SourceSurface,
         dest: Rect<f64>,
-        source: Rect<f64>,
+        src: Rect<f64>,
         filter: Filter,
-        draw_options: &<RaqoteBackend as Backend>::DrawOptions,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     ) {
-        let image = Snapshot::from_vec(
-            source.size.cast(),
-            SnapshotPixelFormat::BGRA,
-            SnapshotAlphaMode::Transparent {
-                premultiplied: true,
-            },
-            surface,
-        );
-
-        let transform =
+        let paint_transform =
             raqote::Transform::translation(-dest.origin.x as f32, -dest.origin.y as f32)
                 .then_scale(
-                    source.size.width as f32 / dest.size.width as f32,
-                    source.size.height as f32 / dest.size.height as f32,
+                    src.size.width as f32 / dest.size.width as f32,
+                    src.size.height as f32 / dest.size.height as f32,
                 );
 
-        let pattern = Pattern::Surface(SurfacePattern::new(
-            image,
-            filter.to_raqote(),
-            Repetition::NoRepeat,
-            transform,
-        ));
-
-        let mut pb = canvas_traits::canvas::Path::new();
+        self.set_transform(&transform.cast());
+        let dest = dest.cast();
+        let mut pb = raqote::PathBuilder::new();
         pb.rect(
             dest.origin.x,
             dest.origin.y,
             dest.size.width,
             dest.size.height,
         );
-
-        <Self as GenericDrawTarget<RaqoteBackend>>::fill(self, &pb, &pattern, draw_options);
+        let size = src.size.cast();
+        fill_draw_target(
+            self,
+            draw_options(composition_options),
+            &raqote::Source::Image(
+                raqote::Image {
+                    width: size.width,
+                    height: size.height,
+                    data: &surface,
+                },
+                raqote::ExtendMode::Pad,
+                filter.to_raqote(),
+                paint_transform,
+            ),
+            pb.finish(),
+        );
     }
     fn draw_surface_with_shadow(
         &self,
-        _surface: <RaqoteBackend as Backend>::SourceSurface,
+        _surface: Self::SourceSurface,
         _dest: &Point2D<f32>,
-        _color: &<RaqoteBackend as Backend>::Color,
-        _offset: &Vector2D<f32>,
-        _sigma: f32,
-        _operator: <RaqoteBackend as Backend>::CompositionOp,
+        _shadow_options: ShadowOptions,
+        _composition_options: CompositionOptions,
     ) {
         warn!("no support for drawing shadows");
     }
     fn fill(
         &mut self,
         path: &canvas_traits::canvas::Path,
-        pattern: &Pattern,
-        draw_options: &<RaqoteBackend as Backend>::DrawOptions,
+        fill_rule: FillRule,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     ) {
-        let path = to_path(path);
-        match draw_options.blend_mode {
-            raqote::BlendMode::Src => {
-                self.clear(raqote::SolidSource::from_unpremultiplied_argb(0, 0, 0, 0));
-                self.fill(&path, &source(pattern), draw_options);
-            },
-            raqote::BlendMode::Clear |
-            raqote::BlendMode::SrcAtop |
-            raqote::BlendMode::DstOut |
-            raqote::BlendMode::Add |
-            raqote::BlendMode::Xor |
-            raqote::BlendMode::DstOver |
-            raqote::BlendMode::SrcOver => {
-                self.fill(&path, &source(pattern), draw_options);
-            },
-            raqote::BlendMode::SrcIn |
-            raqote::BlendMode::SrcOut |
-            raqote::BlendMode::DstIn |
-            raqote::BlendMode::DstAtop => {
-                let mut options = *draw_options;
-                self.push_layer_with_blend(1., options.blend_mode);
-                options.blend_mode = raqote::BlendMode::SrcOver;
-                self.fill(&path, &source(pattern), &options);
-                self.pop_layer();
-            },
-            _ => warn!("unrecognized blend mode: {:?}", draw_options.blend_mode),
-        }
+        self.set_transform(&transform.cast());
+        let draw_options = draw_options(composition_options);
+        let pattern = style.to_raqote_pattern();
+        let mut path = to_path(path);
+        path.winding = match fill_rule {
+            FillRule::Nonzero => raqote::Winding::NonZero,
+            FillRule::Evenodd => raqote::Winding::EvenOdd,
+        };
+        fill_draw_target(self, draw_options, &source(&pattern), path);
     }
 
     fn fill_text(
         &mut self,
         text_runs: Vec<TextRun>,
         start: Point2D<f32>,
-        pattern: &Pattern,
-        draw_options: &<RaqoteBackend as Backend>::DrawOptions,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     ) {
+        self.set_transform(&transform.cast());
+        let draw_options = draw_options(composition_options);
+        let pattern = style.to_raqote_pattern();
         let mut advance = 0.;
         for run in text_runs.iter() {
             let mut positions = Vec::new();
@@ -515,8 +333,11 @@ impl GenericDrawTarget<RaqoteBackend> for raqote::DrawTarget {
             SHARED_FONT_CACHE.with(|font_cache| {
                 let identifier = template.identifier();
                 if !font_cache.borrow().contains_key(&identifier) {
-                    let data = std::sync::Arc::new(run.font.data().as_ref().to_vec());
-                    let Ok(font) = Font::from_bytes(data, identifier.index()) else {
+                    let Ok(font_data_and_index) = run.font.font_data_and_index() else {
+                        return;
+                    };
+                    let data = std::sync::Arc::new(font_data_and_index.data.as_ref().to_vec());
+                    let Ok(font) = Font::from_bytes(data, font_data_and_index.index) else {
                         return;
                     };
                     font_cache.borrow_mut().insert(identifier.clone(), font);
@@ -532,8 +353,8 @@ impl GenericDrawTarget<RaqoteBackend> for raqote::DrawTarget {
                     run.font.descriptor.pt_size.to_f32_px(),
                     &ids,
                     &positions,
-                    &source(pattern),
-                    draw_options,
+                    &source(&pattern),
+                    &draw_options,
                 );
             })
         }
@@ -542,8 +363,9 @@ impl GenericDrawTarget<RaqoteBackend> for raqote::DrawTarget {
     fn fill_rect(
         &mut self,
         rect: &Rect<f32>,
-        pattern: &<RaqoteBackend as Backend>::Pattern<'_>,
-        draw_options: &<RaqoteBackend as Backend>::DrawOptions,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     ) {
         let rect = rect.cast();
         let mut pb = canvas_traits::canvas::Path::new();
@@ -554,50 +376,70 @@ impl GenericDrawTarget<RaqoteBackend> for raqote::DrawTarget {
             rect.size.height,
         );
 
-        <Self as GenericDrawTarget<RaqoteBackend>>::fill(self, &pb, pattern, draw_options);
+        <Self as GenericDrawTarget>::fill(
+            self,
+            &pb,
+            FillRule::Nonzero,
+            style,
+            composition_options,
+            transform,
+        );
     }
     fn get_size(&self) -> Size2D<i32> {
         Size2D::new(self.width(), self.height())
     }
-    fn get_transform(&self) -> Transform2D<f32> {
-        *self.get_transform()
-    }
     fn pop_clip(&mut self) {
         self.pop_clip();
     }
-    fn push_clip(&mut self, path: &canvas_traits::canvas::Path) {
-        self.push_clip(&to_path(path));
+    fn push_clip(
+        &mut self,
+        path: &canvas_traits::canvas::Path,
+        fill_rule: FillRule,
+        transform: Transform2D<f64>,
+    ) {
+        self.set_transform(&transform.cast());
+        let mut path = to_path(path);
+        path.winding = match fill_rule {
+            FillRule::Nonzero => raqote::Winding::NonZero,
+            FillRule::Evenodd => raqote::Winding::EvenOdd,
+        };
+        self.push_clip(&path);
     }
     fn push_clip_rect(&mut self, rect: &Rect<i32>) {
         self.push_clip_rect(rect.to_box2d());
     }
-    fn set_transform(&mut self, matrix: &Transform2D<f32>) {
-        self.set_transform(matrix);
-    }
-    fn surface(&self) -> <RaqoteBackend as Backend>::SourceSurface {
-        self.get_data_u8().to_vec()
+    fn surface(&mut self) -> Self::SourceSurface {
+        self.get_data().to_vec()
     }
     fn stroke(
         &mut self,
         path: &canvas_traits::canvas::Path,
-        pattern: &Pattern,
-        stroke_options: &<RaqoteBackend as Backend>::StrokeOptions,
-        draw_options: &<RaqoteBackend as Backend>::DrawOptions,
+        style: FillOrStrokeStyle,
+        line_options: LineOptions,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     ) {
+        let pattern = style.to_raqote_pattern();
+        let options = draw_options(composition_options);
+        self.set_transform(&transform.cast());
         self.stroke(
             &to_path(path),
-            &source(pattern),
-            stroke_options,
-            draw_options,
+            &source(&pattern),
+            &line_options.to_raqote_style(),
+            &options,
         );
     }
     fn stroke_rect(
         &mut self,
         rect: &Rect<f32>,
-        pattern: &<RaqoteBackend as Backend>::Pattern<'_>,
-        stroke_options: &<RaqoteBackend as Backend>::StrokeOptions,
-        draw_options: &<RaqoteBackend as Backend>::DrawOptions,
+        style: FillOrStrokeStyle,
+        line_options: LineOptions,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
     ) {
+        self.set_transform(&transform.cast());
+        let pattern = style.to_raqote_pattern();
+        let options = draw_options(composition_options);
         let mut pb = raqote::PathBuilder::new();
         pb.rect(
             rect.origin.x,
@@ -606,11 +448,16 @@ impl GenericDrawTarget<RaqoteBackend> for raqote::DrawTarget {
             rect.size.height,
         );
 
-        self.stroke(&pb.finish(), &source(pattern), stroke_options, draw_options);
+        self.stroke(
+            &pb.finish(),
+            &source(&pattern),
+            &line_options.to_raqote_style(),
+            &options,
+        );
     }
 
     fn image_descriptor_and_serializable_data(
-        &self,
+        &mut self,
     ) -> (
         webrender_api::ImageDescriptor,
         compositing_traits::SerializableImageData,
@@ -626,7 +473,7 @@ impl GenericDrawTarget<RaqoteBackend> for raqote::DrawTarget {
         (descriptor, data)
     }
 
-    fn snapshot(&self) -> Snapshot {
+    fn snapshot(&mut self) -> Snapshot {
         Snapshot::from_vec(
             self.get_size().cast(),
             SnapshotPixelFormat::BGRA,
@@ -638,6 +485,40 @@ impl GenericDrawTarget<RaqoteBackend> for raqote::DrawTarget {
     }
 }
 
+fn fill_draw_target(
+    draw_target: &mut raqote::DrawTarget,
+    draw_options: DrawOptions,
+    source: &raqote::Source<'_>,
+    path: raqote::Path,
+) {
+    match draw_options.blend_mode {
+        raqote::BlendMode::Src => {
+            draw_target.clear(raqote::SolidSource::from_unpremultiplied_argb(0, 0, 0, 0));
+            draw_target.fill(&path, source, &draw_options);
+        },
+        raqote::BlendMode::Clear |
+        raqote::BlendMode::SrcAtop |
+        raqote::BlendMode::DstOut |
+        raqote::BlendMode::Add |
+        raqote::BlendMode::Xor |
+        raqote::BlendMode::DstOver |
+        raqote::BlendMode::SrcOver => {
+            draw_target.fill(&path, source, &draw_options);
+        },
+        raqote::BlendMode::SrcIn |
+        raqote::BlendMode::SrcOut |
+        raqote::BlendMode::DstIn |
+        raqote::BlendMode::DstAtop => {
+            let mut options = draw_options;
+            draw_target.push_layer_with_blend(1., options.blend_mode);
+            options.blend_mode = raqote::BlendMode::SrcOver;
+            draw_target.fill(&path, source, &options);
+            draw_target.pop_layer();
+        },
+        _ => warn!("unrecognized blend mode: {:?}", draw_options.blend_mode),
+    }
+}
+
 impl Filter {
     fn to_raqote(self) -> raqote::FilterMode {
         match self {
@@ -676,6 +557,29 @@ pub trait ToRaqoteStyle {
     fn to_raqote_style(self) -> Self::Target;
 }
 
+impl ToRaqoteStyle for LineOptions {
+    type Target = StrokeStyle;
+
+    fn to_raqote_style(self) -> Self::Target {
+        let LineOptions {
+            width,
+            cap_style,
+            join_style,
+            miter_limit,
+            dash,
+            dash_offset,
+        } = self;
+        StrokeStyle {
+            width: width as f32,
+            cap: cap_style.to_raqote_style(),
+            join: join_style.to_raqote_style(),
+            miter_limit: miter_limit as f32,
+            dash_array: dash,
+            dash_offset: dash_offset as f32,
+        }
+    }
+}
+
 impl ToRaqoteStyle for LineJoinStyle {
     type Target = raqote::LineJoin;
 
@@ -701,7 +605,7 @@ impl ToRaqoteStyle for LineCapStyle {
 }
 
 pub trait ToRaqotePattern {
-    fn to_raqote_pattern(self) -> Option<Pattern>;
+    fn to_raqote_pattern(self) -> Pattern;
 }
 
 pub trait ToRaqoteGradientStop {
@@ -723,39 +627,36 @@ impl ToRaqoteGradientStop for CanvasGradientStop {
 }
 
 impl ToRaqotePattern for FillOrStrokeStyle {
-    #[allow(unsafe_code)]
-    fn to_raqote_pattern(self) -> Option<Pattern> {
+    fn to_raqote_pattern(self) -> Pattern {
         use canvas_traits::canvas::FillOrStrokeStyle::*;
 
         match self {
             Color(color) => {
                 let srgb = color.into_srgb_legacy();
-                Some(Pattern::Color(
+                Pattern::Color(
                     clamp_unit_f32(srgb.alpha),
                     clamp_unit_f32(srgb.components.0),
                     clamp_unit_f32(srgb.components.1),
                     clamp_unit_f32(srgb.components.2),
-                ))
+                )
             },
             LinearGradient(style) => {
                 let start = Point2D::new(style.x0 as f32, style.y0 as f32);
                 let end = Point2D::new(style.x1 as f32, style.y1 as f32);
                 let stops = create_gradient_stops(style.stops);
-                Some(Pattern::LinearGradient(LinearGradientPattern::new(
-                    start, end, stops,
-                )))
+                Pattern::LinearGradient(LinearGradientPattern::new(start, end, stops))
             },
             RadialGradient(style) => {
                 let center1 = Point2D::new(style.x0 as f32, style.y0 as f32);
                 let center2 = Point2D::new(style.x1 as f32, style.y1 as f32);
                 let stops = create_gradient_stops(style.stops);
-                Some(Pattern::RadialGradient(RadialGradientPattern::new(
+                Pattern::RadialGradient(RadialGradientPattern::new(
                     center1,
                     style.r0 as f32,
                     center2,
                     style.r1 as f32,
                     stops,
-                )))
+                ))
             },
             Surface(style) => {
                 let repeat = Repetition::from_xy(style.repeat_x, style.repeat_y);
@@ -766,12 +667,12 @@ impl ToRaqotePattern for FillOrStrokeStyle {
                     },
                     SnapshotPixelFormat::BGRA,
                 );
-                Some(Pattern::Surface(SurfacePattern::new(
+                Pattern::Surface(SurfacePattern::new(
                     snapshot,
                     raqote::FilterMode::Nearest,
                     repeat,
                     style.transform,
-                )))
+                ))
             },
         }
     }
@@ -869,3 +770,11 @@ fn to_path(path: &canvas_traits::canvas::Path) -> raqote::Path {
     }
     pb.finish()
 }
+
+fn draw_options(composition_options: CompositionOptions) -> DrawOptions {
+    DrawOptions {
+        blend_mode: composition_options.composition_operation.to_raqote_style(),
+        alpha: composition_options.alpha as f32,
+        ..Default::default()
+    }
+}

components/canvas/vello_backend.rs

@@ -0,0 +1,705 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+//! Vello implementation of 2D canvas backend.
+//!
+//! Vello only encodes commands for GPU, then runs rendering when
+//! image is explicitly requested. This requires to copy image
+//! from texture to buffer, then download buffer to CPU
+//! (where we also need to un pad it).
+//!
+//! All Vello images are in no alpha premultiplied RGBA8 pixel format.
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::num::NonZeroUsize;
+use std::rc::Rc;
+
+use canvas_traits::canvas::{
+    CompositionOptions, CompositionOrBlending, CompositionStyle, FillOrStrokeStyle, FillRule,
+    LineOptions, Path, ShadowOptions,
+};
+use compositing_traits::SerializableImageData;
+use euclid::default::{Point2D, Rect, Size2D, Transform2D};
+use fonts::{ByteIndex, FontIdentifier, FontTemplateRefMethods as _};
+use ipc_channel::ipc::IpcSharedMemory;
+use kurbo::Shape as _;
+use pixels::{Snapshot, SnapshotAlphaMode, SnapshotPixelFormat};
+use range::Range;
+use vello::wgpu::{
+    BackendOptions, Backends, Buffer, BufferDescriptor, BufferUsages, COPY_BYTES_PER_ROW_ALIGNMENT,
+    CommandEncoderDescriptor, Device, Extent3d, Instance, InstanceDescriptor, InstanceFlags,
+    MapMode, Origin3d, Queue, TexelCopyBufferInfo, TexelCopyBufferLayout, TexelCopyTextureInfoBase,
+    Texture, TextureDescriptor, TextureDimension, TextureFormat, TextureUsages, TextureView,
+    TextureViewDescriptor,
+};
+use vello::{kurbo, peniko};
+use webrender_api::{ImageDescriptor, ImageDescriptorFlags};
+
+use crate::backend::{Convert as _, GenericDrawTarget};
+use crate::canvas_data::{Filter, TextRun};
+
+thread_local! {
+    /// The shared font cache used by all canvases that render on a thread. It would be nicer
+    /// to have a global cache, but it looks like font-kit uses a per-thread FreeType, so
+    /// in order to ensure that fonts are particular to a thread we have to make our own
+    /// cache thread local as well.
+    static SHARED_FONT_CACHE: RefCell<HashMap<FontIdentifier, peniko::Font>> = RefCell::default();
+}
+
+pub(crate) struct VelloDrawTarget {
+    device: Device,
+    queue: Queue,
+    renderer: Rc<RefCell<vello::Renderer>>,
+    scene: vello::Scene,
+    size: Size2D<u32>,
+    clips: Vec<Path>,
+    state: State,
+    render_texture: Texture,
+    render_texture_view: TextureView,
+    render_image: peniko::Image,
+    padded_byte_width: u32,
+    rendered_buffer: Buffer,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, PartialOrd)]
+enum State {
+    /// Scene is drawing. It will be consumed when rendered.
+    Drawing,
+    /// Scene is already rendered
+    /// Before next draw we need to put current rendering
+    /// in the background by calling [`VelloDrawTarget::ensure_drawing`].
+    RenderedToTexture,
+    RenderedToBuffer,
+}
+
+impl VelloDrawTarget {
+    fn new_with_renderer(
+        device: Device,
+        queue: Queue,
+        renderer: Rc<RefCell<vello::Renderer>>,
+        size: Size2D<u32>,
+    ) -> Self {
+        let render_texture = device.create_texture(&TextureDescriptor {
+            label: None,
+            size: extend3d(size),
+            mip_level_count: 1,
+            sample_count: 1,
+            dimension: TextureDimension::D2,
+            format: TextureFormat::Rgba8Unorm,
+            usage: TextureUsages::COPY_SRC | TextureUsages::STORAGE_BINDING,
+            view_formats: &[],
+        });
+        let render_texture_view = render_texture.create_view(&TextureViewDescriptor::default());
+        let render_image = peniko::Image {
+            data: vec![].into(),
+            format: peniko::ImageFormat::Rgba8,
+            width: size.width,
+            height: size.height,
+            x_extend: peniko::Extend::Pad,
+            y_extend: peniko::Extend::Pad,
+            quality: peniko::ImageQuality::Low,
+            alpha: 1.0,
+        };
+        renderer.borrow_mut().override_image(
+            &render_image,
+            Some(TexelCopyTextureInfoBase {
+                texture: render_texture.clone(),
+                mip_level: 0,
+                origin: Origin3d::ZERO,
+                aspect: vello::wgpu::TextureAspect::All,
+            }),
+        );
+        let padded_byte_width = (size.width * 4).next_multiple_of(COPY_BYTES_PER_ROW_ALIGNMENT);
+        let buffer_size = padded_byte_width as u64 * size.height as u64;
+        let rendered_buffer = device.create_buffer(&BufferDescriptor {
+            label: Some("val"),
+            size: buffer_size,
+            usage: BufferUsages::MAP_READ | BufferUsages::COPY_DST,
+            mapped_at_creation: false,
+        });
+        Self {
+            device,
+            queue,
+            renderer,
+            scene: vello::Scene::new(),
+            size,
+            clips: Vec::new(),
+            state: State::RenderedToBuffer,
+            render_texture,
+            render_texture_view,
+            render_image,
+            padded_byte_width,
+            rendered_buffer,
+        }
+    }
+
+    fn with_composition<F: FnOnce(&mut Self)>(
+        &mut self,
+        composition_operation: CompositionOrBlending,
+        f: F,
+    ) {
+        // Fast-path for default and most common composition operation
+        if composition_operation == CompositionOrBlending::Composition(CompositionStyle::SourceOver)
+        {
+            f(self);
+            return;
+        }
+        self.scene.push_layer(
+            composition_operation.convert(),
+            1.0,
+            kurbo::Affine::IDENTITY,
+            &kurbo::Rect::ZERO.with_size(self.size.cast()),
+        );
+        f(self);
+        self.scene.pop_layer();
+    }
+
+    fn ignore_clips(&mut self, f: impl FnOnce(&mut Self)) {
+        // pop all clip layers
+        for _ in &self.clips {
+            self.scene.pop_layer();
+        }
+        f(self);
+        // push all clip layers back
+        for path in &self.clips {
+            self.scene
+                .push_layer(peniko::Mix::Clip, 1.0, kurbo::Affine::IDENTITY, &path.0);
+        }
+    }
+
+    fn is_viewport_cleared(&mut self, rect: &Rect<f32>, transform: Transform2D<f64>) -> bool {
+        let transformed_rect = transform.outer_transformed_rect(&rect.cast());
+        if transformed_rect.is_empty() {
+            return false;
+        }
+        let viewport: Rect<f64> = Rect::from_size(self.get_size().cast());
+        let Some(clip) = self.clips.iter().try_fold(viewport, |acc, e| {
+            acc.intersection(&e.0.bounding_box().into())
+        }) else {
+            // clip makes no visible side effects
+            return false;
+        };
+        transformed_rect.cast().contains_rect(&viewport) && // whole viewport is cleared
+            clip.contains_rect(&viewport) // viewport is not clipped
+    }
+
+    fn ensure_drawing(&mut self) {
+        match self.state {
+            State::Drawing => {},
+            State::RenderedToBuffer | State::RenderedToTexture => {
+                self.ignore_clips(|self_| {
+                    self_
+                        .scene
+                        .draw_image(&self_.render_image, kurbo::Affine::IDENTITY);
+                });
+                self.state = State::Drawing;
+            },
+        }
+    }
+}
+
+impl GenericDrawTarget for VelloDrawTarget {
+    type SourceSurface = Vec<u8>; // TODO: this should be texture
+
+    fn new(size: Size2D<u32>) -> Self {
+        // TODO: we should read prefs instead of env
+
+        // we forbid GL because it clashes with servo's GL usage
+        let backends = Backends::from_env().unwrap_or_default() - Backends::GL;
+        let flags = InstanceFlags::from_build_config().with_env();
+        let backend_options = BackendOptions::from_env_or_default();
+        let instance = Instance::new(&InstanceDescriptor {
+            backends,
+            flags,
+            backend_options,
+        });
+        let mut context = vello::util::RenderContext {
+            instance,
+            devices: Vec::new(),
+        };
+        let device_id = pollster::block_on(context.device(None)).unwrap();
+        let device_handle = &mut context.devices[device_id];
+        let device = device_handle.device.clone();
+        let queue = device_handle.queue.clone();
+        let renderer = vello::Renderer::new(
+            &device,
+            vello::RendererOptions {
+                use_cpu: false,
+                num_init_threads: NonZeroUsize::new(1),
+                antialiasing_support: vello::AaSupport::area_only(),
+                pipeline_cache: None,
+            },
+        )
+        .unwrap();
+        device.on_uncaptured_error(Box::new(|error| {
+            log::error!("VELLO WGPU ERROR: {error}");
+        }));
+        Self::new_with_renderer(device, queue, Rc::new(RefCell::new(renderer)), size)
+    }
+
+    fn clear_rect(&mut self, rect: &Rect<f32>, transform: Transform2D<f64>) {
+        // vello scene only ever grows,
+        // so we use every opportunity to shrink it
+        if self.is_viewport_cleared(rect, transform) {
+            self.scene.reset();
+            self.clips.clear(); // no clips are affecting rendering
+            self.state = State::Drawing;
+            return;
+        }
+        self.ensure_drawing();
+        let rect: kurbo::Rect = rect.cast().into();
+        let transform = transform.into();
+        self.scene
+            .push_layer(peniko::Compose::Clear, 0.0, transform, &rect);
+        self.scene.fill(
+            peniko::Fill::NonZero,
+            transform,
+            peniko::BrushRef::Solid(peniko::color::AlphaColor::TRANSPARENT),
+            None,
+            &rect,
+        );
+        self.scene.pop_layer();
+    }
+
+    fn copy_surface(&mut self, surface: Vec<u8>, source: Rect<i32>, destination: Point2D<i32>) {
+        self.ensure_drawing();
+        let destination: kurbo::Point = destination.cast::<f64>().into();
+        let rect = kurbo::Rect::from_origin_size(destination, source.size.cast());
+
+        self.ignore_clips(|self_| {
+            self_
+                .scene
+                .push_layer(peniko::Compose::Copy, 1.0, kurbo::Affine::IDENTITY, &rect);
+
+            self_.scene.fill(
+                peniko::Fill::NonZero,
+                kurbo::Affine::IDENTITY,
+                &peniko::Image {
+                    data: peniko::Blob::from(surface),
+                    format: peniko::ImageFormat::Rgba8,
+                    width: source.size.width as u32,
+                    height: source.size.height as u32,
+                    x_extend: peniko::Extend::Pad,
+                    y_extend: peniko::Extend::Pad,
+                    quality: peniko::ImageQuality::Low,
+                    alpha: 1.0,
+                },
+                Some(kurbo::Affine::translate(destination.to_vec2())),
+                &rect,
+            );
+
+            self_.scene.pop_layer();
+        });
+    }
+
+    fn create_similar_draw_target(&self, size: &Size2D<i32>) -> Self {
+        Self::new_with_renderer(
+            self.device.clone(),
+            self.queue.clone(),
+            self.renderer.clone(),
+            size.cast(),
+        )
+    }
+
+    fn draw_surface(
+        &mut self,
+        surface: Vec<u8>,
+        dest: Rect<f64>,
+        source: Rect<f64>,
+        filter: Filter,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        let scale_up = dest.size.width > source.size.width || dest.size.height > source.size.height;
+        let shape: kurbo::Rect = dest.into();
+        self.with_composition(composition_options.composition_operation, move |self_| {
+            self_.scene.fill(
+                peniko::Fill::NonZero,
+                transform.cast().into(),
+                &peniko::Image {
+                    data: peniko::Blob::from(surface),
+                    format: peniko::ImageFormat::Rgba8,
+                    width: source.size.width as u32,
+                    height: source.size.height as u32,
+                    x_extend: peniko::Extend::Pad,
+                    y_extend: peniko::Extend::Pad,
+                    // we should only do bicubic when scaling up
+                    quality: if scale_up {
+                        filter.convert()
+                    } else {
+                        peniko::ImageQuality::Low
+                    },
+                    alpha: composition_options.alpha as f32,
+                },
+                Some(
+                    kurbo::Affine::translate((dest.origin.x, dest.origin.y)).pre_scale_non_uniform(
+                        dest.size.width / source.size.width,
+                        dest.size.height / source.size.height,
+                    ),
+                ),
+                &shape,
+            )
+        })
+    }
+
+    fn draw_surface_with_shadow(
+        &self,
+        _surface: Vec<u8>,
+        _dest: &Point2D<f32>,
+        _shadow_options: ShadowOptions,
+        _composition_options: CompositionOptions,
+    ) {
+        log::warn!("no support for drawing shadows");
+        /*
+        We will need to do some changes to support drawing shadows with vello, as current abstraction is made for azure.
+        In vello we do not need new draw target (we will use layers) and we need to pass whole rect.
+        offsets will be applied to rect directly. shadow blur will be passed directly to let backend do transforms.
+        */
+        // self_.scene.draw_blurred_rounded_rect(self_.transform, rect, color, 0.0, sigma);
+    }
+
+    fn fill(
+        &mut self,
+        path: &Path,
+        fill_rule: FillRule,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        self.with_composition(composition_options.composition_operation, |self_| {
+            self_.scene.fill(
+                fill_rule.convert(),
+                transform.cast().into(),
+                &convert_to_brush(style, composition_options),
+                None,
+                &path.0,
+            );
+        })
+    }
+
+    fn fill_text(
+        &mut self,
+        text_runs: Vec<TextRun>,
+        start: Point2D<f32>,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        let pattern = convert_to_brush(style, composition_options);
+        let transform = transform.cast().into();
+        self.with_composition(composition_options.composition_operation, |self_| {
+            let mut advance = 0.;
+            for run in text_runs.iter() {
+                let glyphs = &run.glyphs;
+
+                let template = &run.font.template;
+
+                SHARED_FONT_CACHE.with(|font_cache| {
+                    let identifier = template.identifier();
+                    if !font_cache.borrow().contains_key(&identifier) {
+                        let Ok(font) = run.font.font_data_and_index() else {
+                            return;
+                        };
+                        let font = font.clone().convert();
+                        font_cache.borrow_mut().insert(identifier.clone(), font);
+                    }
+
+                    let font_cache = font_cache.borrow();
+                    let Some(font) = font_cache.get(&identifier) else {
+                        return;
+                    };
+
+                    self_
+                        .scene
+                        .draw_glyphs(font)
+                        .transform(transform)
+                        .brush(&pattern)
+                        .font_size(run.font.descriptor.pt_size.to_f32_px())
+                        .draw(
+                            peniko::Fill::NonZero,
+                            glyphs
+                                .iter_glyphs_for_byte_range(&Range::new(ByteIndex(0), glyphs.len()))
+                                .map(|glyph| {
+                                    let glyph_offset = glyph.offset().unwrap_or(Point2D::zero());
+                                    let x = advance + start.x + glyph_offset.x.to_f32_px();
+                                    let y = start.y + glyph_offset.y.to_f32_px();
+                                    advance += glyph.advance().to_f32_px();
+                                    vello::Glyph {
+                                        id: glyph.id(),
+                                        x,
+                                        y,
+                                    }
+                                }),
+                        );
+                });
+            }
+        })
+    }
+
+    fn fill_rect(
+        &mut self,
+        rect: &Rect<f32>,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        let pattern = convert_to_brush(style, composition_options);
+        let transform = transform.cast().into();
+        let rect: kurbo::Rect = rect.cast().into();
+        self.with_composition(composition_options.composition_operation, |self_| {
+            self_
+                .scene
+                .fill(peniko::Fill::NonZero, transform, &pattern, None, &rect);
+        })
+    }
+
+    fn get_size(&self) -> Size2D<i32> {
+        self.size.cast()
+    }
+
+    fn pop_clip(&mut self) {
+        if self.clips.pop().is_some() {
+            self.scene.pop_layer();
+        }
+    }
+
+    fn push_clip(&mut self, path: &Path, _fill_rule: FillRule, transform: Transform2D<f64>) {
+        self.scene
+            .push_layer(peniko::Mix::Clip, 1.0, transform.cast().into(), &path.0);
+        let mut path = path.clone();
+        path.transform(transform.cast());
+        self.clips.push(path);
+    }
+
+    fn push_clip_rect(&mut self, rect: &Rect<i32>) {
+        let mut path = Path::new();
+        let rect = rect.cast();
+        path.rect(
+            rect.origin.x,
+            rect.origin.y,
+            rect.size.width,
+            rect.size.height,
+        );
+        self.push_clip(&path, FillRule::Nonzero, Transform2D::identity());
+    }
+
+    fn stroke(
+        &mut self,
+        path: &Path,
+        style: FillOrStrokeStyle,
+        line_options: LineOptions,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        self.with_composition(composition_options.composition_operation, |self_| {
+            self_.scene.stroke(
+                &line_options.convert(),
+                transform.cast().into(),
+                &convert_to_brush(style, composition_options),
+                None,
+                &path.0,
+            );
+        })
+    }
+
+    fn stroke_rect(
+        &mut self,
+        rect: &Rect<f32>,
+        style: FillOrStrokeStyle,
+        line_options: LineOptions,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        let rect: kurbo::Rect = rect.cast().into();
+        self.with_composition(composition_options.composition_operation, |self_| {
+            self_.scene.stroke(
+                &line_options.convert(),
+                transform.cast().into(),
+                &convert_to_brush(style, composition_options),
+                None,
+                &rect,
+            );
+        })
+    }
+
+    fn image_descriptor_and_serializable_data(
+        &mut self,
+    ) -> (ImageDescriptor, SerializableImageData) {
+        let size = self.size;
+        let stride = self.padded_byte_width;
+        self.map_read(|data| {
+            let image_desc = ImageDescriptor {
+                format: webrender_api::ImageFormat::RGBA8,
+                size: size.cast().cast_unit(),
+                stride: data.map(|_| stride as i32),
+                offset: 0,
+                flags: ImageDescriptorFlags::empty(),
+            };
+            let data = SerializableImageData::Raw(if let Some(data) = data {
+                let mut data = IpcSharedMemory::from_bytes(data);
+                #[allow(unsafe_code)]
+                unsafe {
+                    pixels::generic_transform_inplace::<1, false, false>(data.deref_mut());
+                };
+                data
+            } else {
+                IpcSharedMemory::from_byte(0, size.area() as usize * 4)
+            });
+            (image_desc, data)
+        })
+    }
+
+    fn snapshot(&mut self) -> pixels::Snapshot {
+        let size = self.size;
+        let padded_byte_width = self.padded_byte_width;
+        self.map_read(|data| {
+            let data = data
+                .map(|data| {
+                    let mut result_unpadded = Vec::<u8>::with_capacity(size.area() as usize * 4);
+                    for row in 0..size.height {
+                        let start = (row * padded_byte_width).try_into().unwrap();
+                        result_unpadded.extend(&data[start..start + (size.width * 4) as usize]);
+                    }
+                    result_unpadded
+                })
+                .unwrap_or_else(|| vec![0; size.area() as usize * 4]);
+            Snapshot::from_vec(
+                size,
+                SnapshotPixelFormat::RGBA,
+                SnapshotAlphaMode::Transparent {
+                    premultiplied: false,
+                },
+                data,
+            )
+        })
+    }
+
+    fn surface(&mut self) -> Vec<u8> {
+        self.snapshot().to_vec(None, None).0
+    }
+
+    fn create_source_surface_from_data(&self, data: Snapshot) -> Option<Vec<u8>> {
+        let (data, _, _) = data.to_vec(
+            Some(SnapshotAlphaMode::Transparent {
+                premultiplied: false,
+            }),
+            Some(SnapshotPixelFormat::RGBA),
+        );
+        Some(data)
+    }
+}
+
+impl Drop for VelloDrawTarget {
+    fn drop(&mut self) {
+        self.renderer
+            .borrow_mut()
+            .override_image(&self.render_image, None);
+    }
+}
+
+fn convert_to_brush(
+    style: FillOrStrokeStyle,
+    composition_options: CompositionOptions,
+) -> peniko::Brush {
+    let brush: peniko::Brush = style.convert();
+    brush.multiply_alpha(composition_options.alpha as f32)
+}
+
+impl VelloDrawTarget {
+    fn render_to_texture(&mut self) {
+        if matches!(
+            self.state,
+            State::RenderedToTexture | State::RenderedToBuffer
+        ) {
+            return;
+        }
+
+        self.renderer
+            .borrow_mut()
+            .render_to_texture(
+                &self.device,
+                &self.queue,
+                &self.scene,
+                &self.render_texture_view,
+                &vello::RenderParams {
+                    base_color: peniko::color::AlphaColor::TRANSPARENT,
+                    width: self.size.width,
+                    height: self.size.height,
+                    antialiasing_method: vello::AaConfig::Area,
+                },
+            )
+            .unwrap();
+        self.state = State::RenderedToTexture;
+        // prune scene
+        self.scene.reset();
+        // push all clip layers back
+        for path in &self.clips {
+            self.scene
+                .push_layer(peniko::Mix::Clip, 1.0, kurbo::Affine::IDENTITY, &path.0);
+        }
+    }
+
+    fn render_to_buffer(&mut self) {
+        if matches!(self.state, State::RenderedToBuffer) {
+            return;
+        }
+        self.render_to_texture();
+
+        let size = extend3d(self.size);
+        // TODO(perf): do a render pass that will multiply with alpha on GPU
+        let mut encoder = self
+            .device
+            .create_command_encoder(&CommandEncoderDescriptor {
+                label: Some("Copy out buffer"),
+            });
+        encoder.copy_texture_to_buffer(
+            self.render_texture.as_image_copy(),
+            TexelCopyBufferInfo {
+                buffer: &self.rendered_buffer,
+                layout: TexelCopyBufferLayout {
+                    offset: 0,
+                    bytes_per_row: Some(self.padded_byte_width),
+                    rows_per_image: None,
+                },
+            },
+            size,
+        );
+        self.queue.submit([encoder.finish()]);
+        self.state = State::RenderedToBuffer;
+    }
+
+    fn map_read<R>(&mut self, f: impl FnOnce(Option<&[u8]>) -> R) -> R {
+        self.render_to_buffer();
+        let result = {
+            let buf_slice = self.rendered_buffer.slice(..);
+            let (sender, receiver) = futures_intrusive::channel::shared::oneshot_channel();
+            buf_slice.map_async(MapMode::Read, move |v| sender.send(v).unwrap());
+            if let Err(error) =
+                vello::util::block_on_wgpu(&self.device, receiver.receive()).unwrap()
+            {
+                log::warn!("VELLO WGPU MAP ASYNC ERROR {error}");
+                return f(None);
+            }
+            let data = buf_slice.get_mapped_range();
+            f(Some(&data))
+        };
+        self.rendered_buffer.unmap();
+        result
+    }
+}
+
+fn extend3d(size: Size2D<u32>) -> Extent3d {
+    Extent3d {
+        width: size.width,
+        height: size.height,
+        depth_or_array_layers: 1,
+    }
+}

components/canvas/vello_cpu_backend.rs

@@ -0,0 +1,548 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use canvas_traits::canvas::{
+    CompositionOptions, CompositionOrBlending, CompositionStyle, FillOrStrokeStyle, FillRule,
+    LineOptions, Path, ShadowOptions,
+};
+use compositing_traits::SerializableImageData;
+use euclid::default::{Point2D, Rect, Size2D, Transform2D};
+use fonts::{ByteIndex, FontIdentifier, FontTemplateRefMethods as _};
+use ipc_channel::ipc::IpcSharedMemory;
+use kurbo::Shape;
+use pixels::{Snapshot, SnapshotAlphaMode, SnapshotPixelFormat};
+use range::Range;
+use vello_cpu::{kurbo, peniko};
+use webrender_api::{ImageDescriptor, ImageDescriptorFlags};
+
+use crate::backend::{Convert, GenericDrawTarget};
+use crate::canvas_data::{Filter, TextRun};
+
+thread_local! {
+    /// The shared font cache used by all canvases that render on a thread. It would be nicer
+    /// to have a global cache, but it looks like font-kit uses a per-thread FreeType, so
+    /// in order to ensure that fonts are particular to a thread we have to make our own
+    /// cache thread local as well.
+    static SHARED_FONT_CACHE: RefCell<HashMap<FontIdentifier, peniko::Font>> = RefCell::default();
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, PartialOrd)]
+enum State {
+    /// Scene is drawing. It will be consumed when rendered.
+    Drawing,
+    /// Scene is already rendered
+    /// Before next draw we need to put current rendering
+    /// in the background by calling [`VelloCPUDrawTarget::ensure_drawing`].
+    Rendered,
+}
+
+pub(crate) struct VelloCPUDrawTarget {
+    /// Because this is stateful context
+    /// caller cannot assume anything about transform, paint, stroke,
+    /// so it should provide it's own used by each command
+    /// but it can assume paint_transform to be identity
+    /// and fill rule to be `peniko::Fill::NonZero`
+    ///
+    /// This is because paint_transform is rarely set,
+    /// so it's cheaper to always reset it after use.
+    ctx: vello_cpu::RenderContext,
+    pixmap: vello_cpu::Pixmap,
+    clips: Vec<Path>,
+    state: State,
+}
+
+impl VelloCPUDrawTarget {
+    fn with_composition(
+        &mut self,
+        composition_operation: CompositionOrBlending,
+        f: impl FnOnce(&mut Self),
+    ) {
+        // Fast-path for default and most common composition operation
+        if composition_operation == CompositionOrBlending::Composition(CompositionStyle::SourceOver)
+        {
+            f(self);
+            return;
+        }
+        self.ctx.push_blend_layer(composition_operation.convert());
+        f(self);
+        self.ctx.pop_layer();
+    }
+
+    fn ignore_clips(&mut self, f: impl FnOnce(&mut Self)) {
+        // pop all clip layers
+        for _ in &self.clips {
+            self.ctx.pop_layer();
+        }
+        f(self);
+        // push all clip layers back
+        for path in &self.clips {
+            self.ctx.push_clip_layer(&path.0);
+        }
+    }
+
+    fn ensure_drawing(&mut self) {
+        match self.state {
+            State::Drawing => {},
+            State::Rendered => {
+                self.ignore_clips(|self_| {
+                    self_.ctx.set_transform(kurbo::Affine::IDENTITY);
+                    self_.ctx.set_paint(vello_cpu::Image {
+                        source: vello_cpu::ImageSource::Pixmap(Arc::new(self_.pixmap.clone())),
+                        x_extend: peniko::Extend::Pad,
+                        y_extend: peniko::Extend::Pad,
+                        quality: peniko::ImageQuality::Low,
+                    });
+                    self_.ctx.fill_rect(&kurbo::Rect::from_origin_size(
+                        (0., 0.),
+                        self_.size().cast(),
+                    ));
+                });
+                self.state = State::Drawing;
+            },
+        }
+    }
+
+    fn pixmap(&mut self) -> &[u8] {
+        if self.state == State::Drawing {
+            self.ignore_clips(|self_| {
+                self_.ctx.flush();
+                self_
+                    .ctx
+                    .render_to_pixmap(&mut self_.pixmap, vello_cpu::RenderMode::OptimizeSpeed);
+                self_.ctx.reset();
+                self_.state = State::Rendered;
+            });
+        }
+
+        self.pixmap.data_as_u8_slice()
+    }
+
+    fn size(&self) -> Size2D<u32> {
+        Size2D::new(self.ctx.width(), self.ctx.height()).cast()
+    }
+
+    fn is_viewport_cleared(&mut self, rect: &Rect<f32>, transform: Transform2D<f64>) -> bool {
+        let transformed_rect = transform.outer_transformed_rect(&rect.cast());
+        if transformed_rect.is_empty() {
+            return false;
+        }
+        let viewport: Rect<f64> = Rect::from_size(self.get_size().cast());
+        let Some(clip) = self.clips.iter().try_fold(viewport, |acc, e| {
+            acc.intersection(&e.0.bounding_box().into())
+        }) else {
+            // clip makes no visible side effects
+            return false;
+        };
+        transformed_rect.cast().contains_rect(&viewport) && // whole viewport is cleared
+            clip.contains_rect(&viewport) // viewport is not clipped
+    }
+}
+
+impl GenericDrawTarget for VelloCPUDrawTarget {
+    type SourceSurface = Arc<vello_cpu::Pixmap>;
+
+    fn new(size: Size2D<u32>) -> Self {
+        let size = size.cast();
+        Self {
+            ctx: vello_cpu::RenderContext::new(size.width, size.height),
+            pixmap: vello_cpu::Pixmap::new(size.width, size.height),
+            clips: Vec::new(),
+            state: State::Rendered,
+        }
+    }
+
+    fn clear_rect(&mut self, rect: &Rect<f32>, transform: Transform2D<f64>) {
+        // vello_cpu RenderingContext only ever grows,
+        // so we need to use every opportunity to shrink it
+        if self.is_viewport_cleared(rect, transform) {
+            self.ctx.reset();
+            self.clips.clear(); // no clips are affecting rendering
+            self.state = State::Drawing;
+            return;
+        }
+        self.ensure_drawing();
+        let rect: kurbo::Rect = rect.cast().into();
+        let mut clip_path = rect.to_path(0.1);
+        clip_path.apply_affine(transform.cast().into());
+        let blend_mode = peniko::Compose::Clear;
+        self.ctx.push_layer(
+            Some(&clip_path.to_path(0.1)),
+            Some(blend_mode.into()),
+            None,
+            None,
+        );
+        self.ctx.pop_layer();
+    }
+
+    fn copy_surface(
+        &mut self,
+        surface: Self::SourceSurface,
+        source: Rect<i32>,
+        destination: Point2D<i32>,
+    ) {
+        self.ensure_drawing();
+        let destination: kurbo::Point = destination.cast::<f64>().into();
+        let rect = kurbo::Rect::from_origin_size(destination, source.size.cast());
+        self.ctx.set_transform(kurbo::Affine::IDENTITY);
+        self.ignore_clips(|self_| {
+            // Clipped blending does not work correctly:
+            // https://github.com/linebender/vello/issues/1119
+            // self_.push_layer(Some(rect.to_path(0.1)), Some(peniko::Compose::Copy.into()), None, None);
+
+            self_.ctx.set_paint(vello_cpu::Image {
+                source: vello_cpu::ImageSource::Pixmap(surface),
+                x_extend: peniko::Extend::Pad,
+                y_extend: peniko::Extend::Pad,
+                quality: peniko::ImageQuality::Low,
+            });
+            self_.ctx.fill_rect(&rect);
+
+            // self_.ctx.pop_layer();
+        });
+    }
+
+    fn create_similar_draw_target(&self, size: &Size2D<i32>) -> Self {
+        Self::new(size.cast())
+    }
+
+    fn draw_surface(
+        &mut self,
+        mut surface: Self::SourceSurface,
+        dest: Rect<f64>,
+        source: Rect<f64>,
+        filter: Filter,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        let scale_up = dest.size.width > source.size.width || dest.size.height > source.size.height;
+        if composition_options.alpha != 1.0 {
+            Arc::get_mut(&mut surface)
+                .expect("surface should be owned")
+                .multiply_alpha((composition_options.alpha * 255.0) as u8);
+        }
+        self.with_composition(composition_options.composition_operation, move |self_| {
+            self_.ctx.set_transform(transform.cast().into());
+            self_.ctx.set_paint(vello_cpu::Image {
+                source: vello_cpu::ImageSource::Pixmap(surface),
+                x_extend: peniko::Extend::Pad,
+                y_extend: peniko::Extend::Pad,
+                // we should only do bicubic when scaling up
+                quality: if scale_up {
+                    filter.convert()
+                } else {
+                    peniko::ImageQuality::Low
+                },
+            });
+            self_.ctx.set_paint_transform(
+                kurbo::Affine::translate((dest.origin.x, dest.origin.y)).pre_scale_non_uniform(
+                    dest.size.width / source.size.width,
+                    dest.size.height / source.size.height,
+                ),
+            );
+            self_.ctx.fill_rect(&dest.into());
+            self_.ctx.reset_paint_transform();
+        })
+    }
+
+    fn draw_surface_with_shadow(
+        &self,
+        _surface: Self::SourceSurface,
+        _dest: &Point2D<f32>,
+        _shadow_options: ShadowOptions,
+        _composition_options: CompositionOptions,
+    ) {
+        log::warn!("no support for drawing shadows");
+        /*
+        We will need to do some changes to support drawing shadows with vello, as current abstraction is made for azure.
+        In vello we do not need new draw target (we will use layers) and we need to pass whole rect.
+        offsets will be applied to rect directly. shadow blur will be passed directly to let backend do transforms.
+        */
+        // self_.scene.draw_blurred_rounded_rect(self_.transform, rect, color, 0.0, sigma);
+    }
+
+    fn fill(
+        &mut self,
+        path: &Path,
+        fill_rule: FillRule,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        self.with_composition(composition_options.composition_operation, |self_| {
+            self_.ctx.set_transform(transform.cast().into());
+            self_.ctx.set_fill_rule(fill_rule.convert());
+            self_.ctx.set_paint(paint(style, composition_options.alpha));
+            self_.ctx.fill_path(&path.0);
+        });
+        self.ctx.set_fill_rule(peniko::Fill::NonZero);
+    }
+
+    fn fill_text(
+        &mut self,
+        text_runs: Vec<TextRun>,
+        start: Point2D<f32>,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        self.ctx.set_paint(paint(style, composition_options.alpha));
+        self.ctx.set_transform(transform.cast().into());
+        self.with_composition(composition_options.composition_operation, |self_| {
+            let mut advance = 0.;
+            for run in text_runs.iter() {
+                let glyphs = &run.glyphs;
+
+                let template = &run.font.template;
+
+                SHARED_FONT_CACHE.with(|font_cache| {
+                    let identifier = template.identifier();
+                    if !font_cache.borrow().contains_key(&identifier) {
+                        let Ok(font) = run.font.font_data_and_index() else {
+                            return;
+                        };
+                        let font = font.clone().convert();
+                        font_cache.borrow_mut().insert(identifier.clone(), font);
+                    }
+
+                    let font_cache = font_cache.borrow();
+                    let Some(font) = font_cache.get(&identifier) else {
+                        return;
+                    };
+
+                    self_
+                        .ctx
+                        .glyph_run(font)
+                        .font_size(run.font.descriptor.pt_size.to_f32_px())
+                        .fill_glyphs(
+                            glyphs
+                                .iter_glyphs_for_byte_range(&Range::new(ByteIndex(0), glyphs.len()))
+                                .map(|glyph| {
+                                    let glyph_offset = glyph.offset().unwrap_or(Point2D::zero());
+                                    let x = advance + start.x + glyph_offset.x.to_f32_px();
+                                    let y = start.y + glyph_offset.y.to_f32_px();
+                                    advance += glyph.advance().to_f32_px();
+                                    vello_cpu::Glyph {
+                                        id: glyph.id(),
+                                        x,
+                                        y,
+                                    }
+                                }),
+                        );
+                });
+            }
+        })
+    }
+
+    fn fill_rect(
+        &mut self,
+        rect: &Rect<f32>,
+        style: FillOrStrokeStyle,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        self.with_composition(composition_options.composition_operation, |self_| {
+            self_.ctx.set_transform(transform.cast().into());
+            self_.ctx.set_paint(paint(style, composition_options.alpha));
+            self_.ctx.fill_rect(&rect.cast().into());
+        })
+    }
+
+    fn get_size(&self) -> Size2D<i32> {
+        self.size().cast()
+    }
+
+    fn pop_clip(&mut self) {
+        if self.clips.pop().is_some() {
+            self.ctx.pop_layer();
+        }
+    }
+
+    fn push_clip(&mut self, path: &Path, fill_rule: FillRule, transform: Transform2D<f64>) {
+        self.ctx.set_transform(transform.cast().into());
+        let mut path = path.clone();
+        path.transform(transform.cast());
+        self.ctx.set_fill_rule(fill_rule.convert());
+        self.ctx.push_clip_layer(&path.0);
+        self.clips.push(path);
+        self.ctx.set_fill_rule(peniko::Fill::NonZero);
+    }
+
+    fn push_clip_rect(&mut self, rect: &Rect<i32>) {
+        let mut path = Path::new();
+        let rect = rect.cast();
+        path.rect(
+            rect.origin.x,
+            rect.origin.y,
+            rect.size.width,
+            rect.size.height,
+        );
+        self.push_clip(&path, FillRule::Nonzero, Transform2D::identity());
+    }
+
+    fn stroke(
+        &mut self,
+        path: &Path,
+        style: FillOrStrokeStyle,
+        line_options: LineOptions,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        self.with_composition(composition_options.composition_operation, |self_| {
+            self_.ctx.set_transform(transform.cast().into());
+            self_.ctx.set_paint(paint(style, composition_options.alpha));
+            self_.ctx.set_stroke(line_options.convert());
+            self_.ctx.stroke_path(&path.0);
+        })
+    }
+
+    fn stroke_rect(
+        &mut self,
+        rect: &Rect<f32>,
+        style: FillOrStrokeStyle,
+        line_options: LineOptions,
+        composition_options: CompositionOptions,
+        transform: Transform2D<f64>,
+    ) {
+        self.ensure_drawing();
+        self.with_composition(composition_options.composition_operation, |self_| {
+            self_.ctx.set_transform(transform.cast().into());
+            self_.ctx.set_paint(paint(style, composition_options.alpha));
+            self_.ctx.set_stroke(line_options.convert());
+            self_.ctx.stroke_rect(&rect.cast().into());
+        })
+    }
+
+    fn image_descriptor_and_serializable_data(
+        &mut self,
+    ) -> (ImageDescriptor, SerializableImageData) {
+        let image_desc = ImageDescriptor {
+            format: webrender_api::ImageFormat::RGBA8,
+            size: self.size().cast().cast_unit(),
+            stride: None,
+            offset: 0,
+            flags: ImageDescriptorFlags::empty(),
+        };
+        let data = SerializableImageData::Raw(IpcSharedMemory::from_bytes(self.pixmap()));
+        (image_desc, data)
+    }
+
+    fn snapshot(&mut self) -> pixels::Snapshot {
+        Snapshot::from_vec(
+            self.size().cast(),
+            SnapshotPixelFormat::RGBA,
+            SnapshotAlphaMode::Transparent {
+                premultiplied: true,
+            },
+            self.pixmap().to_vec(),
+        )
+    }
+
+    fn surface(&mut self) -> Self::SourceSurface {
+        self.pixmap(); // sync pixmap
+        Arc::new(vello_cpu::Pixmap::from_parts(
+            self.pixmap.clone().take(),
+            self.pixmap.width(),
+            self.pixmap.height(),
+        ))
+    }
+
+    fn create_source_surface_from_data(&self, data: Snapshot) -> Option<Self::SourceSurface> {
+        Some(snapshot_as_pixmap(data))
+    }
+}
+
+fn snapshot_as_pixmap(data: Snapshot) -> Arc<vello_cpu::Pixmap> {
+    let size = data.size().cast();
+    let (data, _, _) = data.to_vec(
+        Some(SnapshotAlphaMode::Transparent {
+            premultiplied: true,
+        }),
+        Some(SnapshotPixelFormat::RGBA),
+    );
+    Arc::new(vello_cpu::Pixmap::from_parts(
+        bytemuck::cast_vec(data),
+        size.width,
+        size.height,
+    ))
+}
+
+impl Convert<vello_cpu::PaintType> for FillOrStrokeStyle {
+    fn convert(self) -> vello_cpu::PaintType {
+        use canvas_traits::canvas::FillOrStrokeStyle::*;
+        match self {
+            Color(absolute_color) => vello_cpu::PaintType::Solid(absolute_color.convert()),
+            LinearGradient(style) => {
+                let start = kurbo::Point::new(style.x0, style.y0);
+                let end = kurbo::Point::new(style.x1, style.y1);
+                let mut gradient = peniko::Gradient::new_linear(start, end);
+                gradient.stops = style.stops.convert();
+                vello_cpu::PaintType::Gradient(gradient)
+            },
+            RadialGradient(style) => {
+                let center1 = kurbo::Point::new(style.x0, style.y0);
+                let center2 = kurbo::Point::new(style.x1, style.y1);
+                let mut gradient = peniko::Gradient::new_two_point_radial(
+                    center1,
+                    style.r0 as f32,
+                    center2,
+                    style.r1 as f32,
+                );
+                gradient.stops = style.stops.convert();
+                vello_cpu::PaintType::Gradient(gradient)
+            },
+            Surface(surface_style) => {
+                let pixmap = snapshot_as_pixmap(surface_style.surface_data.to_owned());
+                vello_cpu::PaintType::Image(vello_cpu::Image {
+                    source: vello_cpu::ImageSource::Pixmap(pixmap),
+                    x_extend: if surface_style.repeat_x {
+                        peniko::Extend::Repeat
+                    } else {
+                        peniko::Extend::Pad
+                    },
+                    y_extend: if surface_style.repeat_y {
+                        peniko::Extend::Repeat
+                    } else {
+                        peniko::Extend::Pad
+                    },
+                    quality: peniko::ImageQuality::Low,
+                })
+            },
+        }
+    }
+}
+
+fn paint(style: FillOrStrokeStyle, alpha: f64) -> vello_cpu::PaintType {
+    assert!((0.0..=1.0).contains(&alpha));
+    let paint = style.convert();
+    if alpha == 1.0 {
+        paint
+    } else {
+        match paint {
+            vello_cpu::PaintType::Solid(alpha_color) => {
+                vello_cpu::PaintType::Solid(alpha_color.multiply_alpha(alpha as f32))
+            },
+            vello_cpu::PaintType::Gradient(gradient) => {
+                vello_cpu::PaintType::Gradient(gradient.multiply_alpha(alpha as f32))
+            },
+            vello_cpu::PaintType::Image(mut image) => {
+                match &mut image.source {
+                    vello_cpu::ImageSource::Pixmap(pixmap) => Arc::get_mut(pixmap)
+                        .expect("pixmap should not be shared with anyone at this point")
+                        .multiply_alpha((alpha * 255.0) as u8),
+                    vello_cpu::ImageSource::OpaqueId(_) => unimplemented!(),
+                };
+                vello_cpu::PaintType::Image(image)
+            },
+        }
+    }
+}

components/compositing/Cargo.toml

@@ -16,6 +16,10 @@ default = []
 tracing = ["dep:tracing"]
 webxr = ["dep:webxr"]
 
+[lints.clippy]
+unwrap_used = "deny"
+panic = "deny"
+
 [dependencies]
 base = { workspace = true }
 bincode = { workspace = true }
@@ -31,12 +35,12 @@ gleam = { workspace = true }
 ipc-channel = { workspace = true }
 libc = { workspace = true }
 log = { workspace = true }
-net = { path = "../net" }
 pixels = { path = "../pixels" }
 profile_traits = { workspace = true }
 servo_allocator = { path = "../allocator" }
 servo_config = { path = "../config" }
 servo_geometry = { path = "../geometry" }
+servo-tracing = { workspace = true }
 stylo_traits = { workspace = true }
 timers = { path = "../timers" }
 tracing = { workspace = true, optional = true }
@@ -44,7 +48,6 @@ webrender = { workspace = true }
 webrender_api = { workspace = true }
 webxr = { path = "../webxr", optional = true }
 wr_malloc_size_of = { workspace = true }
-servo-tracing = { workspace = true }
 
 [dev-dependencies]
 surfman = { workspace = true }

components/compositing/compositor.rs

@@ -11,13 +11,11 @@ use std::rc::Rc;
 use std::sync::Arc;
 use std::time::{SystemTime, UNIX_EPOCH};
 
+use base::Epoch;
 use base::cross_process_instant::CrossProcessInstant;
 use base::id::{PipelineId, WebViewId};
-use base::{Epoch, WebRenderEpochToU16};
 use bitflags::bitflags;
-use compositing_traits::display_list::{
-    CompositorDisplayListInfo, HitTestInfo, ScrollTree, ScrollType,
-};
+use compositing_traits::display_list::{CompositorDisplayListInfo, ScrollTree, ScrollType};
 use compositing_traits::rendering_context::RenderingContext;
 use compositing_traits::{
     CompositionPipeline, CompositorMsg, ImageUpdate, PipelineExitSource, SendableFrameTree,
@@ -26,13 +24,9 @@ use compositing_traits::{
 use constellation_traits::{EmbedderToConstellationMessage, PaintMetricEvent};
 use crossbeam_channel::{Receiver, Sender};
 use dpi::PhysicalSize;
-use embedder_traits::{
-    CompositorHitTestResult, Cursor, InputEvent, ShutdownState, UntrustedNodeAddress,
-    ViewportDetails,
-};
+use embedder_traits::{CompositorHitTestResult, InputEvent, ShutdownState, ViewportDetails};
 use euclid::{Point2D, Rect, Scale, Size2D, Transform3D};
-use ipc_channel::ipc::{self, IpcSharedMemory};
-use libc::c_void;
+use ipc_channel::ipc::{self, IpcSender, IpcSharedMemory};
 use log::{debug, info, trace, warn};
 use pixels::{CorsStatus, ImageFrame, ImageMetadata, PixelFormat, RasterImage};
 use profile_traits::mem::{ProcessReports, ProfilerRegistration, Report, ReportKind};
@@ -48,10 +42,10 @@ use webrender_api::units::{
 };
 use webrender_api::{
     self, BuiltDisplayList, DirtyRect, DisplayListPayload, DocumentId, Epoch as WebRenderEpoch,
-    FontInstanceFlags, FontInstanceKey, FontInstanceOptions, FontKey, HitTestFlags,
-    PipelineId as WebRenderPipelineId, PropertyBinding, ReferenceFrameKind, RenderReasons,
-    SampledScrollOffset, ScrollLocation, SpaceAndClipInfo, SpatialId, SpatialTreeItemKey,
-    TransformStyle,
+    ExternalScrollId, FontInstanceFlags, FontInstanceKey, FontInstanceOptions, FontKey,
+    FontVariation, HitTestFlags, PipelineId as WebRenderPipelineId, PropertyBinding,
+    ReferenceFrameKind, RenderReasons, SampledScrollOffset, ScrollLocation, SpaceAndClipInfo,
+    SpatialId, SpatialTreeItemKey, TransformStyle,
 };
 
 use crate::InitialCompositorState;
@@ -60,12 +54,12 @@ use crate::webview_manager::WebViewManager;
 use crate::webview_renderer::{PinchZoomResult, UnknownWebView, WebViewRenderer};
 
 #[derive(Debug, PartialEq)]
-enum UnableToComposite {
+pub enum UnableToComposite {
     NotReadyToPaintImage(NotReadyToPaint),
 }
 
 #[derive(Debug, PartialEq)]
-enum NotReadyToPaint {
+pub enum NotReadyToPaint {
     JustNotifiedConstellation,
     WaitingOnConstellation,
 }
@@ -91,11 +85,6 @@ pub struct ServoRenderer {
     /// The [`RefreshDriver`] which manages the rythym of painting.
     refresh_driver: RefreshDriver,
 
-    /// This is a temporary map between [`PipelineId`]s and their associated [`WebViewId`]. Once
-    /// all renderer operations become per-`WebView` this map can be removed, but we still sometimes
-    /// need to work backwards to figure out what `WebView` is associated with a `Pipeline`.
-    pub(crate) pipeline_to_webview_map: HashMap<PipelineId, WebViewId>,
-
     /// Tracks whether we are in the process of shutting down, or have shut down and should close
     /// the compositor. This is shared with the `Servo` instance.
     shutdown_state: Rc<Cell<ShutdownState>>,
@@ -125,11 +114,9 @@ pub struct ServoRenderer {
     /// True to translate mouse input into touch events.
     pub(crate) convert_mouse_to_touch: bool,
 
-    /// Current mouse cursor.
-    cursor: Cursor,
-
-    /// Current cursor position.
-    cursor_pos: DevicePoint,
+    /// The last position in the rendered view that the mouse moved over. This becomes `None`
+    /// when the mouse leaves the rendered view.
+    pub(crate) last_mouse_move_position: Option<DevicePoint>,
 }
 
 /// NB: Never block on the constellation, because sometimes the constellation blocks on us.
@@ -150,7 +137,7 @@ pub struct IOCompositor {
     /// The webrender renderer.
     webrender: Option<webrender::Renderer>,
 
-    /// The surfman instance that webrender targets
+    /// The [`RenderingContext`] instance that webrender targets, which is the viewport.
     rendering_context: Rc<dyn RenderingContext>,
 
     /// The number of frames pending to receive from WebRender.
@@ -200,10 +187,6 @@ pub(crate) struct PipelineDetails {
     /// The id of the parent pipeline, if any.
     pub parent_pipeline_id: Option<PipelineId>,
 
-    /// The epoch of the most recent display list for this pipeline. Note that this display
-    /// list might not be displayed, as WebRender processes display lists asynchronously.
-    pub most_recent_display_list_epoch: Option<WebRenderEpoch>,
-
     /// Whether animations are running
     pub animations_running: bool,
 
@@ -213,10 +196,6 @@ pub(crate) struct PipelineDetails {
     /// Whether to use less resources by stopping animations.
     pub throttled: bool,
 
-    /// Hit test items for this pipeline. This is used to map WebRender hit test
-    /// information to the full information necessary for Servo.
-    pub hit_test_items: Vec<HitTestInfo>,
-
     /// The compositor-side [ScrollTree]. This is used to allow finding and scrolling
     /// nodes in the compositor before forwarding new offsets to WebRender.
     pub scroll_tree: ScrollTree,
@@ -227,6 +206,11 @@ pub(crate) struct PipelineDetails {
     /// The paint metric status of the first contentful paint.
     pub first_contentful_paint_metric: PaintMetricState,
 
+    /// The CSS pixel to device pixel scale of the viewport of this pipeline, including
+    /// page zoom, but not including any pinch zoom amount. This is used to detect
+    /// situations where the current display list is for an old scale.
+    pub viewport_scale: Option<Scale<f32, CSSPixel, DevicePixel>>,
+
     /// Which parts of Servo have reported that this `Pipeline` has exited. Only when all
     /// have done so will it be discarded.
     pub exited: PipelineExitSource,
@@ -247,11 +231,10 @@ impl PipelineDetails {
         PipelineDetails {
             pipeline: None,
             parent_pipeline_id: None,
-            most_recent_display_list_epoch: None,
+            viewport_scale: None,
             animations_running: false,
             animation_callbacks_running: false,
             throttled: false,
-            hit_test_items: Vec::new(),
             scroll_tree: ScrollTree::default(),
             first_paint_metric: PaintMetricState::Waiting,
             first_contentful_paint_metric: PaintMetricState::Waiting,
@@ -266,146 +249,49 @@ impl PipelineDetails {
     }
 }
 
-pub enum HitTestError {
-    EpochMismatch,
-    Others,
-}
-
 impl ServoRenderer {
     pub fn shutdown_state(&self) -> ShutdownState {
         self.shutdown_state.get()
     }
 
-    pub(crate) fn hit_test_at_point<'a>(
-        &self,
-        point: DevicePoint,
-        details_for_pipeline: impl Fn(PipelineId) -> Option<&'a PipelineDetails>,
-    ) -> Result<CompositorHitTestResult, HitTestError> {
-        match self.hit_test_at_point_with_flags_and_pipeline(
-            point,
-            HitTestFlags::empty(),
-            None,
-            details_for_pipeline,
-        ) {
-            Ok(hit_test_results) => hit_test_results
-                .first()
-                .cloned()
-                .ok_or(HitTestError::Others),
-            Err(error) => Err(error),
-        }
+    pub(crate) fn hit_test_at_point(&self, point: DevicePoint) -> Vec<CompositorHitTestResult> {
+        self.hit_test_at_point_with_flags(point, HitTestFlags::empty())
     }
 
     // TODO: split this into first half (global) and second half (one for whole compositor, one for webview)
-    pub(crate) fn hit_test_at_point_with_flags_and_pipeline<'a>(
+    pub(crate) fn hit_test_at_point_with_flags(
         &self,
         point: DevicePoint,
         flags: HitTestFlags,
-        pipeline_id: Option<WebRenderPipelineId>,
-        details_for_pipeline: impl Fn(PipelineId) -> Option<&'a PipelineDetails>,
-    ) -> Result<Vec<CompositorHitTestResult>, HitTestError> {
+    ) -> Vec<CompositorHitTestResult> {
         // DevicePoint and WorldPoint are the same for us.
         let world_point = WorldPoint::from_untyped(point.to_untyped());
-        let results =
-            self.webrender_api
-                .hit_test(self.webrender_document, pipeline_id, world_point, flags);
+        let results = self.webrender_api.hit_test(
+            self.webrender_document,
+            None, /* pipeline_id */
+            world_point,
+            flags,
+        );
 
-        let mut epoch_mismatch = false;
-        let results = results
+        results
             .items
             .iter()
-            .filter_map(|item| {
+            .map(|item| {
                 let pipeline_id = item.pipeline.into();
-                let details = details_for_pipeline(pipeline_id)?;
-
-                // If the epoch in the tag does not match the current epoch of the pipeline,
-                // then the hit test is against an old version of the display list.
-                match details.most_recent_display_list_epoch {
-                    Some(epoch) => {
-                        if epoch.as_u16() != item.tag.1 {
-                            // It's too early to hit test for now.
-                            // New scene building is in progress.
-                            epoch_mismatch = true;
-                            return None;
-                        }
-                    },
-                    _ => return None,
-                }
-
-                let offset = details
-                    .scroll_tree
-                    .scroll_offset(pipeline_id.root_scroll_id())
-                    .unwrap_or_default();
-                let point_in_initial_containing_block =
-                    (item.point_in_viewport + offset).to_untyped();
-
-                let info = &details.hit_test_items[item.tag.0 as usize];
-                Some(CompositorHitTestResult {
+                let external_scroll_id = ExternalScrollId(item.tag.0, item.pipeline);
+                CompositorHitTestResult {
                     pipeline_id,
                     point_in_viewport: Point2D::from_untyped(item.point_in_viewport.to_untyped()),
-                    point_relative_to_initial_containing_block: Point2D::from_untyped(
-                        point_in_initial_containing_block,
-                    ),
-                    point_relative_to_item: Point2D::from_untyped(
-                        item.point_relative_to_item.to_untyped(),
-                    ),
-                    node: UntrustedNodeAddress(info.node as *const c_void),
-                    cursor: info.cursor,
-                    scroll_tree_node: info.scroll_tree_node,
-                })
+                    external_scroll_id,
+                }
             })
-            .collect();
-
-        if epoch_mismatch {
-            return Err(HitTestError::EpochMismatch);
-        }
-
-        Ok(results)
+            .collect()
     }
 
     pub(crate) fn send_transaction(&mut self, transaction: Transaction) {
         self.webrender_api
             .send_transaction(self.webrender_document, transaction);
     }
-
-    pub(crate) fn update_cursor_from_hittest(
-        &mut self,
-        pos: DevicePoint,
-        result: &CompositorHitTestResult,
-    ) {
-        if let Some(webview_id) = self
-            .pipeline_to_webview_map
-            .get(&result.pipeline_id)
-            .copied()
-        {
-            self.update_cursor(pos, webview_id, result.cursor);
-        } else {
-            warn!("Couldn't update cursor for non-WebView-associated pipeline");
-        };
-    }
-
-    pub(crate) fn update_cursor(
-        &mut self,
-        pos: DevicePoint,
-        webview_id: WebViewId,
-        cursor: Option<Cursor>,
-    ) {
-        self.cursor_pos = pos;
-
-        let cursor = match cursor {
-            Some(cursor) if cursor != self.cursor => cursor,
-            _ => return,
-        };
-
-        self.cursor = cursor;
-        if let Err(e) = self
-            .constellation_sender
-            .send(EmbedderToConstellationMessage::SetCursor(
-                webview_id, cursor,
-            ))
-        {
-            warn!("Sending event to constellation failed ({:?}).", e);
-        }
-    }
 }
 
 impl IOCompositor {
@@ -422,7 +308,6 @@ impl IOCompositor {
                     state.event_loop_waker,
                 ),
                 shutdown_state: state.shutdown_state,
-                pipeline_to_webview_map: Default::default(),
                 compositor_receiver: state.receiver,
                 constellation_sender: state.constellation_chan,
                 time_profiler_chan: state.time_profiler_chan,
@@ -432,8 +317,7 @@ impl IOCompositor {
                 #[cfg(feature = "webxr")]
                 webxr_main_thread: state.webxr_main_thread,
                 convert_mouse_to_touch,
-                cursor: Cursor::None,
-                cursor_pos: DevicePoint::new(0.0, 0.0),
+                last_mouse_move_position: None,
             })),
             webview_renderers: WebViewManager::default(),
             needs_repaint: Cell::default(),
@@ -591,18 +475,6 @@ impl IOCompositor {
                 };
                 webview_renderer.on_touch_event_processed(result);
             },
-
-            CompositorMsg::CreatePng(webview_id, page_rect, reply) => {
-                let res = self.render_to_shared_memory(webview_id, page_rect);
-                if let Err(ref e) = res {
-                    info!("Error retrieving PNG: {:?}", e);
-                }
-                let img = res.unwrap_or(None);
-                if let Err(e) = reply.send(img) {
-                    warn!("Sending reply to create png failed ({:?}).", e);
-                }
-            },
-
             CompositorMsg::IsReadyToSaveImageReply(is_ready) => {
                 assert_eq!(
                     self.ready_to_save_state,
@@ -640,25 +512,7 @@ impl IOCompositor {
             },
 
             CompositorMsg::NewWebRenderFrameReady(_document_id, recomposite_needed) => {
-                self.pending_frames -= 1;
-                let point: DevicePoint = self.global.borrow().cursor_pos;
-
-                if recomposite_needed {
-                    let details_for_pipeline = |pipeline_id| self.details_for_pipeline(pipeline_id);
-                    let result = self
-                        .global
-                        .borrow()
-                        .hit_test_at_point(point, details_for_pipeline);
-                    if let Ok(result) = result {
-                        self.global
-                            .borrow_mut()
-                            .update_cursor_from_hittest(point, &result);
-                    }
-                }
-
-                if recomposite_needed || self.animation_callbacks_running() {
-                    self.set_needs_repaint(RepaintReason::NewWebRenderFrame);
-                }
+                self.handle_new_webrender_frame_ready(recomposite_needed);
             },
 
             CompositorMsg::LoadComplete(_) => {
@@ -773,14 +627,14 @@ impl IOCompositor {
                 let Some(webview_renderer) = self.webview_renderers.get_mut(webview_id) else {
                     return warn!("Could not find WebView for incoming display list");
                 };
-                // WebRender is not ready until we receive "NewWebRenderFrameReady"
-                webview_renderer.webrender_frame_ready.set(false);
+
+                let old_scale = webview_renderer.device_pixels_per_page_pixel();
 
                 let pipeline_id = display_list_info.pipeline_id;
                 let details = webview_renderer.ensure_pipeline_details(pipeline_id.into());
-                details.most_recent_display_list_epoch = Some(display_list_info.epoch);
-                details.hit_test_items = display_list_info.hit_test_info;
                 details.install_new_scroll_tree(display_list_info.scroll_tree);
+                details.viewport_scale =
+                    Some(display_list_info.viewport_details.hidpi_scale_factor);
 
                 let epoch = display_list_info.epoch;
                 let first_reflow = display_list_info.first_reflow;
@@ -795,6 +649,14 @@ impl IOCompositor {
                 }
 
                 let mut transaction = Transaction::new();
+
+                let is_root_pipeline =
+                    Some(pipeline_id.into()) == webview_renderer.root_pipeline_id;
+                if is_root_pipeline && old_scale != webview_renderer.device_pixels_per_page_pixel()
+                {
+                    self.send_root_pipeline_display_list_in_transaction(&mut transaction);
+                }
+
                 transaction
                     .set_display_list(display_list_info.epoch, (pipeline_id, built_display_list));
                 self.update_transaction_with_all_scroll_offsets(&mut transaction);
@@ -802,33 +664,6 @@ impl IOCompositor {
                 self.global.borrow_mut().send_transaction(transaction);
             },
 
-            CompositorMsg::HitTest(pipeline, point, flags, sender) => {
-                // When a display list is sent to WebRender, it starts scene building in a
-                // separate thread and then that display list is available for hit testing.
-                // Without flushing scene building, any hit test we do might be done against
-                // a previous scene, if the last one we sent hasn't finished building.
-                //
-                // TODO(mrobinson): Flushing all scene building is a big hammer here, because
-                // we might only be interested in a single pipeline. The only other option
-                // would be to listen to the TransactionNotifier for previous per-pipeline
-                // transactions, but that isn't easily compatible with the event loop wakeup
-                // mechanism from libserver.
-                self.global.borrow().webrender_api.flush_scene_builder();
-
-                let details_for_pipeline = |pipeline_id| self.details_for_pipeline(pipeline_id);
-                let result = self
-                    .global
-                    .borrow()
-                    .hit_test_at_point_with_flags_and_pipeline(
-                        point,
-                        flags,
-                        pipeline,
-                        details_for_pipeline,
-                    )
-                    .unwrap_or_default();
-                let _ = sender.send(result);
-            },
-
             CompositorMsg::GenerateImageKey(sender) => {
                 let _ = sender.send(self.global.borrow().webrender_api.generate_image_key());
             },
@@ -872,8 +707,14 @@ impl IOCompositor {
                 self.global.borrow_mut().send_transaction(transaction);
             },
 
-            CompositorMsg::AddFontInstance(font_instance_key, font_key, size, flags) => {
-                self.add_font_instance(font_instance_key, font_key, size, flags);
+            CompositorMsg::AddFontInstance(
+                font_instance_key,
+                font_key,
+                size,
+                flags,
+                variations,
+            ) => {
+                self.add_font_instance(font_instance_key, font_key, size, flags, variations);
             },
 
             CompositorMsg::RemoveFonts(keys, instance_keys) => {
@@ -894,18 +735,11 @@ impl IOCompositor {
                 number_of_font_instance_keys,
                 result_sender,
             ) => {
-                let font_keys = (0..number_of_font_keys)
-                    .map(|_| self.global.borrow().webrender_api.generate_font_key())
-                    .collect();
-                let font_instance_keys = (0..number_of_font_instance_keys)
-                    .map(|_| {
-                        self.global
-                            .borrow()
-                            .webrender_api
-                            .generate_font_instance_key()
-                    })
-                    .collect();
-                let _ = result_sender.send((font_keys, font_instance_keys));
+                self.handle_generate_font_keys(
+                    number_of_font_keys,
+                    number_of_font_instance_keys,
+                    result_sender,
+                );
             },
             CompositorMsg::Viewport(webview_id, viewport_description) => {
                 if let Some(webview) = self.webview_renderers.get_mut(webview_id) {
@@ -943,18 +777,11 @@ impl IOCompositor {
                 number_of_font_instance_keys,
                 result_sender,
             ) => {
-                let font_keys = (0..number_of_font_keys)
-                    .map(|_| self.global.borrow().webrender_api.generate_font_key())
-                    .collect();
-                let font_instance_keys = (0..number_of_font_instance_keys)
-                    .map(|_| {
-                        self.global
-                            .borrow()
-                            .webrender_api
-                            .generate_font_instance_key()
-                    })
-                    .collect();
-                let _ = result_sender.send((font_keys, font_instance_keys));
+                self.handle_generate_font_keys(
+                    number_of_font_keys,
+                    number_of_font_instance_keys,
+                    result_sender,
+                );
             },
             CompositorMsg::NewWebRenderFrameReady(..) => {
                 // Subtract from the number of pending frames, but do not do any compositing.
@@ -966,6 +793,27 @@ impl IOCompositor {
         }
     }
 
+    /// Generate the font keys and send them to the `result_sender`.
+    fn handle_generate_font_keys(
+        &self,
+        number_of_font_keys: usize,
+        number_of_font_instance_keys: usize,
+        result_sender: IpcSender<(Vec<FontKey>, Vec<FontInstanceKey>)>,
+    ) {
+        let font_keys = (0..number_of_font_keys)
+            .map(|_| self.global.borrow().webrender_api.generate_font_key())
+            .collect();
+        let font_instance_keys = (0..number_of_font_instance_keys)
+            .map(|_| {
+                self.global
+                    .borrow()
+                    .webrender_api
+                    .generate_font_instance_key()
+            })
+            .collect();
+        let _ = result_sender.send((font_keys, font_instance_keys));
+    }
+
     /// Queue a new frame in the transaction and increase the pending frames count.
     pub(crate) fn generate_frame(&mut self, transaction: &mut Transaction, reason: RenderReasons) {
         self.pending_frames += 1;
@@ -1239,9 +1087,8 @@ impl IOCompositor {
         }
 
         if let Some(webview_renderer) = self.webview_renderers.get_mut(webview_id) {
-            webview_renderer.set_page_zoom(1.0);
+            webview_renderer.set_page_zoom(Scale::new(1.0));
         }
-        self.send_root_pipeline_display_list();
     }
 
     pub fn on_zoom_window_event(&mut self, webview_id: WebViewId, magnification: f32) {
@@ -1250,22 +1097,9 @@ impl IOCompositor {
         }
 
         if let Some(webview_renderer) = self.webview_renderers.get_mut(webview_id) {
-            webview_renderer.set_page_zoom(magnification);
+            let current_page_zoom = webview_renderer.page_zoom();
+            webview_renderer.set_page_zoom(current_page_zoom * Scale::new(magnification));
         }
-        self.send_root_pipeline_display_list();
-    }
-
-    fn details_for_pipeline(&self, pipeline_id: PipelineId) -> Option<&PipelineDetails> {
-        let webview_id = self
-            .global
-            .borrow()
-            .pipeline_to_webview_map
-            .get(&pipeline_id)
-            .cloned()?;
-        self.webview_renderers
-            .get(webview_id)?
-            .pipelines
-            .get(&pipeline_id)
     }
 
     /// Returns true if any animation callbacks (ie `requestAnimationFrame`) are waiting for a response.
@@ -1351,7 +1185,7 @@ impl IOCompositor {
 
     /// Render the WebRender scene to the shared memory, without updating other state of this
     /// [`IOCompositor`]. If succesful return the output image in shared memory.
-    fn render_to_shared_memory(
+    pub fn render_to_shared_memory(
         &mut self,
         webview_id: WebViewId,
         page_rect: Option<Rect<f32, CSSPixel>>,
@@ -1543,7 +1377,7 @@ impl IOCompositor {
     }
 
     /// Get the message receiver for this [`IOCompositor`].
-    pub fn receiver(&self) -> Ref<Receiver<CompositorMsg>> {
+    pub fn receiver(&self) -> Ref<'_, Receiver<CompositorMsg>> {
         Ref::map(self.global.borrow(), |global| &global.compositor_receiver)
     }
 
@@ -1561,15 +1395,6 @@ impl IOCompositor {
                 },
                 CompositorMsg::NewWebRenderFrameReady(..) => {
                     found_recomposite_msg = true;
-
-                    // Process all pending events
-                    // FIXME: Shouldn't `webview_frame_ready` be stored globally and why can't `pending_frames`
-                    // be used here?
-                    self.webview_renderers.iter().for_each(|webview| {
-                        webview.dispatch_pending_point_input_events();
-                        webview.webrender_frame_ready.set(true);
-                    });
-
                     true
                 },
                 _ => true,
@@ -1688,7 +1513,14 @@ impl IOCompositor {
         font_key: FontKey,
         size: f32,
         flags: FontInstanceFlags,
+        variations: Vec<FontVariation>,
     ) {
+        let variations = if pref!(layout_variable_fonts_enabled) {
+            variations
+        } else {
+            vec![]
+        };
+
         let mut transaction = Transaction::new();
 
         let font_instance_options = FontInstanceOptions {
@@ -1701,7 +1533,7 @@ impl IOCompositor {
             size,
             Some(font_instance_options),
             None,
-            Vec::new(),
+            variations,
         );
 
         self.global.borrow_mut().send_transaction(transaction);
@@ -1749,4 +1581,39 @@ impl IOCompositor {
     fn shutdown_state(&self) -> ShutdownState {
         self.global.borrow().shutdown_state()
     }
+
+    fn refresh_cursor(&self) {
+        let global = self.global.borrow();
+        let Some(last_mouse_move_position) = global.last_mouse_move_position else {
+            return;
+        };
+
+        let Some(hit_test_result) = global
+            .hit_test_at_point(last_mouse_move_position)
+            .first()
+            .cloned()
+        else {
+            return;
+        };
+
+        if let Err(error) =
+            global
+                .constellation_sender
+                .send(EmbedderToConstellationMessage::RefreshCursor(
+                    hit_test_result.pipeline_id,
+                ))
+        {
+            warn!("Sending event to constellation failed ({:?}).", error);
+        }
+    }
+
+    fn handle_new_webrender_frame_ready(&mut self, recomposite_needed: bool) {
+        self.pending_frames -= 1;
+        if recomposite_needed {
+            self.refresh_cursor();
+        }
+        if recomposite_needed || self.animation_callbacks_running() {
+            self.set_needs_repaint(RepaintReason::NewWebRenderFrame);
+        }
+    }
 }

components/compositing/tracing.rs

@@ -34,7 +34,6 @@ mod from_constellation {
                 Self::CreateOrUpdateWebView(..) => target!("CreateOrUpdateWebView"),
                 Self::RemoveWebView(..) => target!("RemoveWebView"),
                 Self::TouchEventProcessed(..) => target!("TouchEventProcessed"),
-                Self::CreatePng(..) => target!("CreatePng"),
                 Self::IsReadyToSaveImageReply(..) => target!("IsReadyToSaveImageReply"),
                 Self::SetThrottled(..) => target!("SetThrottled"),
                 Self::NewWebRenderFrameReady(..) => target!("NewWebRenderFrameReady"),
@@ -43,7 +42,6 @@ mod from_constellation {
                 Self::SendInitialTransaction(..) => target!("SendInitialTransaction"),
                 Self::SendScrollNode(..) => target!("SendScrollNode"),
                 Self::SendDisplayList { .. } => target!("SendDisplayList"),
-                Self::HitTest(..) => target!("HitTest"),
                 Self::GenerateImageKey(..) => target!("GenerateImageKey"),
                 Self::UpdateImages(..) => target!("UpdateImages"),
                 Self::GenerateFontKeys(..) => target!("GenerateFontKeys"),

components/compositing/webview_manager.rs

@@ -127,7 +127,7 @@ mod test {
         webviews: &WebViewManager<WebView>,
     ) -> Vec<(WebViewId, WebView)> {
         let mut keys = webviews.webviews.keys().collect::<Vec<_>>();
-        keys.sort();
+        keys.sort_unstable();
         keys.iter()
             .map(|&id| (*id, webviews.webviews.get(id).cloned().unwrap()))
             .collect()

components/compositing/webview_renderer.rs

@@ -2,15 +2,15 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
-use std::cell::{Cell, RefCell};
+use std::cell::RefCell;
+use std::collections::HashMap;
 use std::collections::hash_map::{Entry, Keys};
-use std::collections::{HashMap, VecDeque};
 use std::rc::Rc;
 
 use base::id::{PipelineId, WebViewId};
 use compositing_traits::display_list::ScrollType;
 use compositing_traits::viewport_description::{
-    DEFAULT_ZOOM, MAX_ZOOM, MIN_ZOOM, ViewportDescription,
+    DEFAULT_PAGE_ZOOM, MAX_PAGE_ZOOM, MIN_PAGE_ZOOM, ViewportDescription,
 };
 use compositing_traits::{PipelineExitSource, SendableFrameTree, WebViewTrait};
 use constellation_traits::{EmbedderToConstellationMessage, WindowSizeType};
@@ -27,7 +27,7 @@ use style_traits::{CSSPixel, PinchZoomFactor};
 use webrender_api::units::{DeviceIntPoint, DevicePixel, DevicePoint, DeviceRect, LayoutVector2D};
 use webrender_api::{ExternalScrollId, HitTestFlags, ScrollLocation};
 
-use crate::compositor::{HitTestError, PipelineDetails, ServoRenderer};
+use crate::compositor::{PipelineDetails, ServoRenderer};
 use crate::touch::{TouchHandler, TouchMoveAction, TouchMoveAllowed, TouchSequenceState};
 
 #[derive(Clone, Copy)]
@@ -76,6 +76,7 @@ pub(crate) struct WebViewRenderer {
     pub webview: Box<dyn WebViewTrait>,
     /// The root [`PipelineId`] of the currently displayed page in this WebView.
     pub root_pipeline_id: Option<PipelineId>,
+    /// The rectangle of the [`WebView`] in device pixels, which is the viewport.
     pub rect: DeviceRect,
     /// Tracks details about each active pipeline that the compositor knows about.
     pub pipelines: HashMap<PipelineId, PipelineDetails>,
@@ -88,30 +89,18 @@ pub(crate) struct WebViewRenderer {
     /// "Desktop-style" zoom that resizes the viewport to fit the window.
     pub page_zoom: Scale<f32, CSSPixel, DeviceIndependentPixel>,
     /// "Mobile-style" zoom that does not reflow the page.
-    viewport_zoom: PinchZoomFactor,
+    pinch_zoom: PinchZoomFactor,
     /// The HiDPI scale factor for the `WebView` associated with this renderer. This is controlled
     /// by the embedding layer.
     hidpi_scale_factor: Scale<f32, DeviceIndependentPixel, DevicePixel>,
     /// Whether or not this [`WebViewRenderer`] isn't throttled and has a pipeline with
     /// active animations or animation frame callbacks.
     animating: bool,
-    /// Pending input events queue. Priavte and only this thread pushes events to it.
-    pending_point_input_events: RefCell<VecDeque<InputEvent>>,
-    /// WebRender is not ready between `SendDisplayList` and `WebRenderFrameReady` messages.
-    pub webrender_frame_ready: Cell<bool>,
-    /// Viewport Description
+    /// A [`ViewportDescription`] for this [`WebViewRenderer`], which contains the limitations
+    /// and initial values for zoom derived from the `viewport` meta tag in web content.
     viewport_description: Option<ViewportDescription>,
 }
 
-impl Drop for WebViewRenderer {
-    fn drop(&mut self) {
-        self.global
-            .borrow_mut()
-            .pipeline_to_webview_map
-            .retain(|_, webview_id| self.id != *webview_id);
-    }
-}
-
 impl WebViewRenderer {
     pub(crate) fn new(
         global: Rc<RefCell<ServoRenderer>>,
@@ -129,12 +118,10 @@ impl WebViewRenderer {
             touch_handler: TouchHandler::new(),
             global,
             pending_scroll_zoom_events: Default::default(),
-            page_zoom: Scale::new(1.0),
-            viewport_zoom: PinchZoomFactor::new(DEFAULT_ZOOM),
+            page_zoom: DEFAULT_PAGE_ZOOM,
+            pinch_zoom: PinchZoomFactor::new(1.0),
             hidpi_scale_factor: Scale::new(hidpi_scale_factor.0),
             animating: false,
-            pending_point_input_events: Default::default(),
-            webrender_frame_ready: Cell::default(),
             viewport_description: None,
         }
     }
@@ -158,13 +145,9 @@ impl WebViewRenderer {
         &mut self,
         pipeline_id: PipelineId,
     ) -> &mut PipelineDetails {
-        self.pipelines.entry(pipeline_id).or_insert_with(|| {
-            self.global
-                .borrow_mut()
-                .pipeline_to_webview_map
-                .insert(pipeline_id, self.id);
-            PipelineDetails::new()
-        })
+        self.pipelines
+            .entry(pipeline_id)
+            .or_insert_with(PipelineDetails::new)
     }
 
     pub(crate) fn pipeline_exited(&mut self, pipeline_id: PipelineId, source: PipelineExitSource) {
@@ -183,15 +166,11 @@ impl WebViewRenderer {
         }
 
         pipeline.remove_entry();
-        self.global
-            .borrow_mut()
-            .pipeline_to_webview_map
-            .remove(&pipeline_id);
     }
 
     pub(crate) fn set_frame_tree(&mut self, frame_tree: &SendableFrameTree) {
         let pipeline_id = frame_tree.pipeline.id;
-        let old_pipeline_id = std::mem::replace(&mut self.root_pipeline_id, Some(pipeline_id));
+        let old_pipeline_id = self.root_pipeline_id.replace(pipeline_id);
 
         if old_pipeline_id != self.root_pipeline_id {
             debug!(
@@ -263,11 +242,7 @@ impl WebViewRenderer {
         self.pipelines
             .iter_mut()
             .filter(|(id, _)| !attached_pipelines.contains(id))
-            .for_each(|(_, details)| {
-                details.scroll_tree.nodes.iter_mut().for_each(|node| {
-                    node.set_offset(LayoutVector2D::zero());
-                })
-            })
+            .for_each(|(_, details)| details.scroll_tree.reset_all_scroll_offsets());
     }
 
     /// Sets or unsets the animations-running flag for the given pipeline. Returns
@@ -337,78 +312,41 @@ impl WebViewRenderer {
         }
     }
 
-    pub(crate) fn dispatch_point_input_event(&self, event: InputEvent) -> bool {
-        self.dispatch_point_input_event_internal(event, true)
-    }
-
-    pub(crate) fn dispatch_pending_point_input_events(&self) {
-        while let Some(event) = self.pending_point_input_events.borrow_mut().pop_front() {
-            // TODO: Add multiple retry later if needed.
-            self.dispatch_point_input_event_internal(event, false);
-        }
-    }
-
-    pub(crate) fn dispatch_point_input_event_internal(
-        &self,
-        mut event: InputEvent,
-        retry_on_error: bool,
-    ) -> bool {
-        // Events that do not need to do hit testing are sent directly to the
-        // constellation to filter down.
-        let Some(point) = event.point() else {
-            return false;
-        };
-
-        // Delay the event if the epoch is not synchronized yet (new frame is not ready),
-        // or hit test result would fail and the event is rejected anyway.
-        if retry_on_error &&
-            (!self.webrender_frame_ready.get() ||
-                !self.pending_point_input_events.borrow().is_empty())
-        {
-            self.pending_point_input_events
-                .borrow_mut()
-                .push_back(event);
-            return false;
-        }
-
-        // If we can't find a pipeline to send this event to, we cannot continue.
-        let get_pipeline_details = |pipeline_id| self.pipelines.get(&pipeline_id);
-        let result = match self
-            .global
-            .borrow()
-            .hit_test_at_point(point, get_pipeline_details)
-        {
-            Ok(hit_test_results) => Some(hit_test_results),
-            Err(HitTestError::EpochMismatch) if retry_on_error => {
-                self.pending_point_input_events
-                    .borrow_mut()
-                    .push_back(event.clone());
-                return false;
+    pub(crate) fn dispatch_input_event_with_hit_testing(&self, mut event: InputEvent) -> bool {
+        let event_point = event.point();
+        let hit_test_result = match event_point {
+            Some(point) => {
+                let hit_test_result = self
+                    .global
+                    .borrow()
+                    .hit_test_at_point(point)
+                    .into_iter()
+                    .nth(0);
+                if hit_test_result.is_none() {
+                    warn!("Empty hit test result for input event, ignoring.");
+                    return false;
+                }
+                hit_test_result
             },
-            _ => None,
+            None => None,
         };
 
         match event {
             InputEvent::Touch(ref mut touch_event) => {
                 touch_event.init_sequence_id(self.touch_handler.current_sequence_id);
             },
-            InputEvent::MouseButton(_) |
-            InputEvent::MouseLeave(_) |
-            InputEvent::MouseMove(_) |
-            InputEvent::Wheel(_) => {
-                if let Some(ref result) = result {
-                    self.global
-                        .borrow_mut()
-                        .update_cursor_from_hittest(point, result);
-                } else {
-                    warn!("Not hit test result.");
-                }
+            InputEvent::MouseMove(_) => {
+                self.global.borrow_mut().last_mouse_move_position = event_point;
             },
+            InputEvent::MouseLeftViewport(_) => {
+                self.global.borrow_mut().last_mouse_move_position = None;
+            },
+            InputEvent::MouseButton(_) | InputEvent::Wheel(_) => {},
             _ => unreachable!("Unexpected input event type: {event:?}"),
         }
 
         if let Err(error) = self.global.borrow().constellation_sender.send(
-            EmbedderToConstellationMessage::ForwardInputEvent(self.id, event, result),
+            EmbedderToConstellationMessage::ForwardInputEvent(self.id, event, hit_test_result),
         ) {
             warn!("Sending event to constellation failed ({error:?}).");
             false
@@ -483,11 +421,11 @@ impl WebViewRenderer {
             }
         }
 
-        self.dispatch_point_input_event(event);
+        self.dispatch_input_event_with_hit_testing(event);
     }
 
     fn send_touch_event(&mut self, event: TouchEvent) -> bool {
-        self.dispatch_point_input_event(InputEvent::Touch(event))
+        self.dispatch_input_event_with_hit_testing(InputEvent::Touch(event))
     }
 
     pub(crate) fn on_touch_event(&mut self, event: TouchEvent) {
@@ -751,13 +689,15 @@ impl WebViewRenderer {
     /// <http://w3c.github.io/touch-events/#mouse-events>
     fn simulate_mouse_click(&mut self, point: DevicePoint) {
         let button = MouseButton::Left;
-        self.dispatch_point_input_event(InputEvent::MouseMove(MouseMoveEvent::new(point)));
-        self.dispatch_point_input_event(InputEvent::MouseButton(MouseButtonEvent::new(
+        self.dispatch_input_event_with_hit_testing(InputEvent::MouseMove(MouseMoveEvent::new(
+            point,
+        )));
+        self.dispatch_input_event_with_hit_testing(InputEvent::MouseButton(MouseButtonEvent::new(
             MouseButtonAction::Down,
             button,
             point,
         )));
-        self.dispatch_point_input_event(InputEvent::MouseButton(MouseButtonEvent::new(
+        self.dispatch_input_event_with_hit_testing(InputEvent::MouseButton(MouseButtonEvent::new(
             MouseButtonAction::Up,
             button,
             point,
@@ -896,17 +836,10 @@ impl WebViewRenderer {
             ScrollLocation::Start | ScrollLocation::End => scroll_location,
         };
 
-        let get_pipeline_details = |pipeline_id| self.pipelines.get(&pipeline_id);
         let hit_test_results = self
             .global
             .borrow()
-            .hit_test_at_point_with_flags_and_pipeline(
-                cursor,
-                HitTestFlags::FIND_ALL,
-                None,
-                get_pipeline_details,
-            )
-            .unwrap_or_default();
+            .hit_test_at_point_with_flags(cursor, HitTestFlags::FIND_ALL);
 
         // Iterate through all hit test results, processing only the first node of each pipeline.
         // This is needed to propagate the scroll events from a pipeline representing an iframe to
@@ -918,7 +851,7 @@ impl WebViewRenderer {
                 Some(&hit_test_result.pipeline_id)
             {
                 let scroll_result = pipeline_details.scroll_tree.scroll_node_or_ancestor(
-                    &hit_test_result.scroll_tree_node,
+                    &hit_test_result.external_scroll_id,
                     scroll_location,
                     ScrollType::InputEvents,
                 );
@@ -951,7 +884,7 @@ impl WebViewRenderer {
     }
 
     pub(crate) fn pinch_zoom_level(&self) -> Scale<f32, DevicePixel, DevicePixel> {
-        Scale::new(self.viewport_zoom.get())
+        Scale::new(self.pinch_zoom.get())
     }
 
     fn set_pinch_zoom_level(&mut self, mut zoom: f32) -> bool {
@@ -959,19 +892,43 @@ impl WebViewRenderer {
             zoom = viewport.clamp_zoom(zoom);
         }
 
-        let old_zoom = std::mem::replace(&mut self.viewport_zoom, PinchZoomFactor::new(zoom));
-        old_zoom != self.viewport_zoom
+        let old_zoom = std::mem::replace(&mut self.pinch_zoom, PinchZoomFactor::new(zoom));
+        old_zoom != self.pinch_zoom
     }
 
-    pub(crate) fn set_page_zoom(&mut self, magnification: f32) {
-        self.page_zoom =
-            Scale::new((self.page_zoom.get() * magnification).clamp(MIN_ZOOM, MAX_ZOOM));
+    pub(crate) fn page_zoom(&mut self) -> Scale<f32, CSSPixel, DeviceIndependentPixel> {
+        self.page_zoom
     }
 
+    pub(crate) fn set_page_zoom(
+        &mut self,
+        new_page_zoom: Scale<f32, CSSPixel, DeviceIndependentPixel>,
+    ) {
+        let new_page_zoom = new_page_zoom.clamp(MIN_PAGE_ZOOM, MAX_PAGE_ZOOM);
+        let old_zoom = std::mem::replace(&mut self.page_zoom, new_page_zoom);
+        if old_zoom != self.page_zoom {
+            self.send_window_size_message();
+        }
+    }
+
+    /// The scale to use when displaying this [`WebViewRenderer`] in WebRender
+    /// including both viewport scale (page zoom and hidpi scale) as well as any
+    /// pinch zoom applied. This is based on the latest display list received,
+    /// as page zoom changes are applied asynchronously and the rendered view
+    /// should reflect the latest display list.
     pub(crate) fn device_pixels_per_page_pixel(&self) -> Scale<f32, CSSPixel, DevicePixel> {
-        self.page_zoom * self.hidpi_scale_factor * self.pinch_zoom_level()
+        let viewport_scale = self
+            .root_pipeline_id
+            .and_then(|pipeline_id| self.pipelines.get(&pipeline_id))
+            .and_then(|pipeline| pipeline.viewport_scale)
+            .unwrap_or_else(|| self.page_zoom * self.hidpi_scale_factor);
+        viewport_scale * self.pinch_zoom_level()
     }
 
+    /// The current viewport scale (hidpi scale and page zoom and not pinch
+    /// zoom) based on the current setting of the WebView. Note that this may
+    /// not be the rendered viewport zoom as that is based on the latest display
+    /// list and zoom changes are applied asynchronously.
     pub(crate) fn device_pixels_per_page_pixel_not_including_pinch_zoom(
         &self,
     ) -> Scale<f32, CSSPixel, DevicePixel> {

components/config/macro/lib.rs

@@ -34,6 +34,12 @@ fn servo_preferences_derive(input: synstructure::Structure) -> TokenStream {
         set_match_cases.extend(quote!(stringify!(#name) => self.#name = value.try_into().unwrap(),))
     }
 
+    let mut comparisons = quote!();
+    for field in named_fields.named.iter() {
+        let name = field.ident.as_ref().unwrap();
+        comparisons.extend(quote!(if self.#name != other.#name { changes.push((stringify!(#name), self.#name.clone().into(),)) }))
+    }
+
     let structure_name = &ast.ident;
     quote! {
         impl #structure_name {
@@ -50,6 +56,12 @@ fn servo_preferences_derive(input: synstructure::Structure) -> TokenStream {
                     _ => { panic!("Unknown preference: {:?}", name); }
                 }
             }
+
+            pub fn diff(&self, other: &Self) -> Vec<(&'static str, PrefValue)> {
+                let mut changes = vec![];
+                #comparisons
+                changes
+            }
         }
     }
 }

components/config/opts.rs

@@ -7,7 +7,7 @@
 
 use std::default::Default;
 use std::path::PathBuf;
-use std::sync::{LazyLock, RwLock, RwLockReadGuard};
+use std::sync::OnceLock;
 
 use serde::{Deserialize, Serialize};
 use servo_url::ServoUrl;
@@ -47,6 +47,10 @@ pub struct Opts {
     /// Whether we're running in multiprocess mode.
     pub multiprocess: bool,
 
+    /// Whether to force using ipc_channel instead of crossbeam_channel in singleprocess mode. Does
+    /// nothing in multiprocess mode.
+    pub force_ipc: bool,
+
     /// Whether we want background hang monitor enabled or not
     pub background_hang_monitor: bool,
 
@@ -189,6 +193,7 @@ impl Default for Opts {
             user_stylesheets: Vec::new(),
             hard_fail: true,
             multiprocess: false,
+            force_ipc: false,
             background_hang_monitor: false,
             random_pipeline_closure_probability: None,
             random_pipeline_closure_seed: None,
@@ -209,13 +214,27 @@ impl Default for Opts {
 // Make Opts available globally. This saves having to clone and pass
 // opts everywhere it is used, which gets particularly cumbersome
 // when passing through the DOM structures.
-static OPTIONS: LazyLock<RwLock<Opts>> = LazyLock::new(|| RwLock::new(Opts::default()));
+static OPTIONS: OnceLock<Opts> = OnceLock::new();
 
-pub fn set_options(opts: Opts) {
-    *OPTIONS.write().unwrap() = opts;
+/// Initialize options.
+///
+/// Should only be called once at process startup.
+/// Must be called before the first call to [get].
+pub fn initialize_options(opts: Opts) {
+    OPTIONS.set(opts).expect("Already initialized");
 }
 
+/// Get the servo options
+///
+/// If the servo options have not been initialized by calling [initialize_options], then the
+/// options will be initialized to default values. Outside of tests the options should
+/// be explicitly initialized.
 #[inline]
-pub fn get() -> RwLockReadGuard<'static, Opts> {
-    OPTIONS.read().unwrap()
+pub fn get() -> &'static Opts {
+    // In unit-tests using default options reduces boilerplate.
+    // We can't use `cfg(test)` since that only is enabled when this crate
+    // is compiled in test mode.
+    // We rely on the `expect` in `initialize_options` to inform us if refactoring
+    // causes a `get` call to move before `initialize_options`.
+    OPTIONS.get_or_init(Default::default)
 }

components/config/prefs.rs

@@ -11,12 +11,22 @@ pub use crate::pref_util::PrefValue;
 
 static PREFERENCES: RwLock<Preferences> = RwLock::new(Preferences::const_default());
 
+pub trait Observer: Send + Sync {
+    fn prefs_changed(&self, _changes: &[(&'static str, PrefValue)]) {}
+}
+
+static OBSERVERS: RwLock<Vec<Box<dyn Observer>>> = RwLock::new(Vec::new());
+
 #[inline]
 /// Get the current set of global preferences for Servo.
 pub fn get() -> RwLockReadGuard<'static, Preferences> {
     PREFERENCES.read().unwrap()
 }
 
+pub fn add_observer(observer: Box<dyn Observer>) {
+    OBSERVERS.write().unwrap().push(observer);
+}
+
 pub fn set(preferences: Preferences) {
     // Map between Stylo preference names and Servo preference names as the This should be
     // kept in sync with components/script/dom/bindings/codegen/run.py which generates the
@@ -38,8 +48,18 @@ pub fn set(preferences: Preferences) {
         "layout.container-queries.enabled",
         preferences.layout_container_queries_enabled,
     );
+    stylo_config::set_bool(
+        "layout.variable_fonts.enabled",
+        preferences.layout_variable_fonts_enabled,
+    );
+
+    let changed = preferences.diff(&PREFERENCES.read().unwrap());
 
     *PREFERENCES.write().unwrap() = preferences;
+
+    for observer in &*OBSERVERS.read().unwrap() {
+        observer.prefs_changed(&changed);
+    }
 }
 
 /// A convenience macro for accessing a preference value using its static path.
@@ -69,14 +89,24 @@ pub struct Preferences {
     /// List of comma-separated backends to be used by wgpu.
     pub dom_webgpu_wgpu_backend: String,
     pub dom_abort_controller_enabled: bool,
+    pub dom_adoptedstylesheet_enabled: bool,
     pub dom_async_clipboard_enabled: bool,
     pub dom_bluetooth_enabled: bool,
     pub dom_bluetooth_testing_enabled: bool,
     pub dom_allow_scripts_to_close_windows: bool,
     pub dom_canvas_capture_enabled: bool,
     pub dom_canvas_text_enabled: bool,
+    /// Selects canvas backend
+    ///
+    /// Available values:
+    /// - ` `/`auto`
+    /// - raqote
+    /// - vello
+    /// - vello_cpu
+    pub dom_canvas_backend: String,
     pub dom_clipboardevent_enabled: bool,
     pub dom_composition_event_enabled: bool,
+    pub dom_cookiestore_enabled: bool,
     pub dom_crypto_subtle_enabled: bool,
     pub dom_customelements_enabled: bool,
     pub dom_document_dblclick_timeout: i64,
@@ -89,6 +119,7 @@ pub struct Preferences {
     pub dom_microdata_testing_enabled: bool,
     pub dom_mouse_event_which_enabled: bool,
     pub dom_mutation_observer_enabled: bool,
+    pub dom_navigator_sendbeacon_enabled: bool,
     pub dom_notification_enabled: bool,
     pub dom_offscreen_canvas_enabled: bool,
     pub dom_permissions_enabled: bool,
@@ -99,7 +130,6 @@ pub struct Preferences {
     pub dom_serviceworker_timeout_seconds: i64,
     pub dom_servo_helpers_enabled: bool,
     pub dom_servoparser_async_html_tokenizer_enabled: bool,
-    pub dom_svg_enabled: bool,
     pub dom_testable_crash_enabled: bool,
     pub dom_testbinding_enabled: bool,
     pub dom_testbinding_prefcontrolled_enabled: bool,
@@ -171,7 +201,6 @@ pub struct Preferences {
     pub js_mem_gc_decommit_threshold_mb: i64,
     pub js_mem_gc_dynamic_heap_growth_enabled: bool,
     pub js_mem_gc_dynamic_mark_slice_enabled: bool,
-    pub js_mem_gc_empty_chunk_count_max: i64,
     pub js_mem_gc_empty_chunk_count_min: i64,
     pub js_mem_gc_high_frequency_heap_growth_max: i64,
     pub js_mem_gc_high_frequency_heap_growth_min: i64,
@@ -187,7 +216,6 @@ pub struct Preferences {
     pub js_mem_max: i64,
     pub js_native_regex_enabled: bool,
     pub js_offthread_compilation_enabled: bool,
-    pub js_parallel_parsing_enabled: bool,
     pub js_shared_memory: bool,
     pub js_throw_on_asmjs_validation_failure: bool,
     pub js_throw_on_debuggee_would_run: bool,
@@ -204,6 +232,7 @@ pub struct Preferences {
     pub layout_flexbox_enabled: bool,
     pub layout_threads: i64,
     pub layout_unimplemented: bool,
+    pub layout_variable_fonts_enabled: bool,
     pub layout_writing_mode_enabled: bool,
     /// Enable hardware acceleration for video playback.
     pub media_glvideo_enabled: bool,
@@ -246,14 +275,17 @@ impl Preferences {
             devtools_server_enabled: false,
             devtools_server_port: 0,
             dom_abort_controller_enabled: false,
+            dom_adoptedstylesheet_enabled: false,
             dom_allow_scripts_to_close_windows: false,
             dom_async_clipboard_enabled: false,
             dom_bluetooth_enabled: false,
             dom_bluetooth_testing_enabled: false,
             dom_canvas_capture_enabled: false,
             dom_canvas_text_enabled: true,
+            dom_canvas_backend: String::new(),
             dom_clipboardevent_enabled: true,
             dom_composition_event_enabled: false,
+            dom_cookiestore_enabled: false,
             dom_crypto_subtle_enabled: true,
             dom_customelements_enabled: true,
             dom_document_dblclick_dist: 1,
@@ -266,6 +298,7 @@ impl Preferences {
             dom_microdata_testing_enabled: false,
             dom_mouse_event_which_enabled: false,
             dom_mutation_observer_enabled: true,
+            dom_navigator_sendbeacon_enabled: false,
             dom_notification_enabled: false,
             dom_offscreen_canvas_enabled: false,
             dom_permissions_enabled: false,
@@ -276,7 +309,6 @@ impl Preferences {
             dom_serviceworker_timeout_seconds: 60,
             dom_servo_helpers_enabled: false,
             dom_servoparser_async_html_tokenizer_enabled: false,
-            dom_svg_enabled: false,
             dom_testable_crash_enabled: false,
             dom_testbinding_enabled: false,
             dom_testbinding_prefcontrolled2_enabled: false,
@@ -346,7 +378,6 @@ impl Preferences {
             js_mem_gc_decommit_threshold_mb: 32,
             js_mem_gc_dynamic_heap_growth_enabled: true,
             js_mem_gc_dynamic_mark_slice_enabled: true,
-            js_mem_gc_empty_chunk_count_max: 30,
             js_mem_gc_empty_chunk_count_min: 1,
             js_mem_gc_high_frequency_heap_growth_max: 300,
             js_mem_gc_high_frequency_heap_growth_min: 150,
@@ -362,7 +393,6 @@ impl Preferences {
             js_mem_max: -1,
             js_native_regex_enabled: true,
             js_offthread_compilation_enabled: true,
-            js_parallel_parsing_enabled: true,
             js_shared_memory: true,
             js_throw_on_asmjs_validation_failure: false,
             js_throw_on_debuggee_would_run: false,
@@ -380,6 +410,7 @@ impl Preferences {
             // TODO(mrobinson): This should likely be based on the number of processors.
             layout_threads: 3,
             layout_unimplemented: false,
+            layout_variable_fonts_enabled: false,
             layout_writing_mode_enabled: false,
             media_glvideo_enabled: false,
             media_testing_enabled: false,
@@ -450,12 +481,12 @@ impl UserAgentPlatform {
                 const ARCHITECTURE: &str = "";
 
                 format!(
-                    "Mozilla/5.0 (Windows NT 10.0; Win64; {ARCHITECTURE}rv:128.0) Servo/{SERVO_VERSION} Firefox/128.0"
+                    "Mozilla/5.0 (Windows NT 10.0; Win64; {ARCHITECTURE}rv:140.0) Servo/{SERVO_VERSION} Firefox/140.0"
                 )
             },
             UserAgentPlatform::Desktop if cfg!(target_os = "macos") => {
                 format!(
-                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Servo/{SERVO_VERSION} Firefox/128.0"
+                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Servo/{SERVO_VERSION} Firefox/140.0"
                 )
             },
             UserAgentPlatform::Desktop => {
@@ -466,19 +497,19 @@ impl UserAgentPlatform {
                 const ARCHITECTURE: &str = "i686";
 
                 format!(
-                    "Mozilla/5.0 (X11; Linux {ARCHITECTURE}; rv:128.0) Servo/{SERVO_VERSION} Firefox/128.0"
+                    "Mozilla/5.0 (X11; Linux {ARCHITECTURE}; rv:140.0) Servo/{SERVO_VERSION} Firefox/140.0"
                 )
             },
             UserAgentPlatform::Android => {
                 format!(
-                    "Mozilla/5.0 (Android 10; Mobile; rv:128.0) Servo/{SERVO_VERSION} Firefox/128.0"
+                    "Mozilla/5.0 (Android 10; Mobile; rv:140.0) Servo/{SERVO_VERSION} Firefox/140.0"
                 )
             },
             UserAgentPlatform::OpenHarmony => format!(
-                "Mozilla/5.0 (OpenHarmony; Mobile; rv:128.0) Servo/{SERVO_VERSION} Firefox/128.0"
+                "Mozilla/5.0 (OpenHarmony; Mobile; rv:140.0) Servo/{SERVO_VERSION} Firefox/140.0"
             ),
             UserAgentPlatform::Ios => format!(
-                "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X; rv:128.0) Servo/{SERVO_VERSION} Firefox/128.0"
+                "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X; rv:140.0) Servo/{SERVO_VERSION} Firefox/140.0"
             ),
         }
     }

components/constellation/Cargo.toml

@@ -14,8 +14,15 @@ path = "lib.rs"
 [features]
 bluetooth = ["bluetooth_traits"]
 default = []
-tracing = ["dep:tracing"]
+tracing = ["dep:tracing", "canvas/tracing"]
 webgpu = ["script_traits/webgpu"]
+vello = ["canvas/vello"]
+vello_cpu = ["canvas/vello_cpu"]
+raqote = ["canvas/raqote"]
+
+[lints.clippy]
+unwrap_used = "deny"
+panic = "deny"
 
 [dependencies]
 background_hang_monitor = { path = "../background_hang_monitor" }
@@ -31,7 +38,7 @@ crossbeam-channel = { workspace = true }
 devtools_traits = { workspace = true }
 embedder_traits = { workspace = true }
 euclid = { workspace = true }
-fonts = { path = "../fonts" }
+fonts = { path = "../fonts", default-features = false }
 ipc-channel = { workspace = true }
 keyboard-types = { workspace = true }
 layout_api = { workspace = true }

components/constellation/constellation.rs

@@ -92,6 +92,7 @@ use std::marker::PhantomData;
 use std::mem::replace;
 use std::rc::{Rc, Weak};
 use std::sync::{Arc, Mutex};
+use std::thread::JoinHandle;
 use std::{process, thread};
 
 use background_hang_monitor::HangMonitorRegister;
@@ -129,11 +130,11 @@ use devtools_traits::{
 use embedder_traits::resources::{self, Resource};
 use embedder_traits::user_content_manager::UserContentManager;
 use embedder_traits::{
-    AnimationState, CompositorHitTestResult, Cursor, EmbedderMsg, EmbedderProxy,
+    AnimationState, CompositorHitTestResult, EmbedderMsg, EmbedderProxy, FocusId,
     FocusSequenceNumber, InputEvent, JSValue, JavaScriptEvaluationError, JavaScriptEvaluationId,
     KeyboardEvent, MediaSessionActionType, MediaSessionEvent, MediaSessionPlaybackState,
     MouseButton, MouseButtonAction, MouseButtonEvent, Theme, ViewportDetails, WebDriverCommandMsg,
-    WebDriverCommandResponse, WebDriverLoadStatus,
+    WebDriverCommandResponse, WebDriverLoadStatus, WebDriverScriptCommand,
 };
 use euclid::Size2D;
 use euclid::default::Size2D as UntypedSize2D;
@@ -141,14 +142,17 @@ use fonts::SystemFontServiceProxy;
 use ipc_channel::Error as IpcError;
 use ipc_channel::ipc::{self, IpcReceiver, IpcSender};
 use ipc_channel::router::ROUTER;
-use keyboard_types::{Key, KeyState, Modifiers};
+use keyboard_types::{Key, KeyState, Modifiers, NamedKey};
 use layout_api::{LayoutFactory, ScriptThreadFactory};
 use log::{debug, error, info, trace, warn};
 use media::WindowGLContext;
 use net_traits::pub_domains::reg_host;
 use net_traits::request::Referrer;
 use net_traits::storage_thread::{StorageThreadMsg, StorageType};
-use net_traits::{self, IpcSend, ReferrerPolicy, ResourceThreads};
+use net_traits::{
+    self, AsyncRuntime, IpcSend, ReferrerPolicy, ResourceThreads, exit_fetch_thread,
+    start_fetch_thread,
+};
 use profile_traits::mem::ProfilerMsg;
 use profile_traits::{mem, time};
 use script_traits::{
@@ -156,10 +160,10 @@ use script_traits::{
     ScriptThreadMessage, UpdatePipelineIdReason,
 };
 use serde::{Deserialize, Serialize};
+use servo_config::prefs::{self, PrefValue};
 use servo_config::{opts, pref};
 use servo_rand::{Rng, ServoRng, SliceRandom, random};
 use servo_url::{Host, ImmutableOrigin, ServoUrl};
-use style_traits::CSSPixel;
 #[cfg(feature = "webgpu")]
 use webgpu::swapchain::WGPUImageMap;
 #[cfg(feature = "webgpu")]
@@ -250,6 +254,18 @@ struct BrowsingContextGroup {
     webgpus: HashMap<Host, WebGPU>,
 }
 
+struct PreferenceForwarder(Sender<EmbedderToConstellationMessage>);
+
+impl prefs::Observer for PreferenceForwarder {
+    fn prefs_changed(&self, changes: &[(&'static str, PrefValue)]) {
+        let _ = self
+            .0
+            .send(EmbedderToConstellationMessage::PreferencesUpdated(
+                changes.to_owned(),
+            ));
+    }
+}
+
 /// The `Constellation` itself. In the servo browser, there is one
 /// constellation, which maintains all of the browser global data.
 /// In embedded applications, there may be more than one constellation,
@@ -282,6 +298,9 @@ pub struct Constellation<STF, SWF> {
     /// None when in multiprocess mode.
     background_monitor_register: Option<Box<dyn BackgroundHangMonitorRegister>>,
 
+    /// In single process mode, a join handle on the BHM worker thread.
+    background_monitor_register_join_handle: Option<JoinHandle<()>>,
+
     /// Channels to control all background-hang monitors.
     /// TODO: store them on the relevant BrowsingContextGroup,
     /// so that they could be controlled on a "per-tab/event-loop" basis.
@@ -397,8 +416,11 @@ pub struct Constellation<STF, SWF> {
     /// and the namespaces are allocated by the constellation.
     next_pipeline_namespace_id: PipelineNamespaceId,
 
-    /// Bits of state used to interact with the webdriver implementation
-    webdriver: WebDriverData,
+    /// An [`IpcSender`] to notify navigation events to webdriver.
+    webdriver_load_status_sender: Option<(IpcSender<WebDriverLoadStatus>, PipelineId)>,
+
+    /// An [`IpcSender`] to forward responses from the `ScriptThread` to the WebDriver server.
+    webdriver_input_command_reponse_sender: Option<IpcSender<WebDriverCommandResponse>>,
 
     /// Document states for loaded pipelines (used only when writing screenshots).
     document_states: HashMap<PipelineId, DocumentState>,
@@ -452,6 +474,12 @@ pub struct Constellation<STF, SWF> {
 
     /// The process manager.
     process_manager: ProcessManager,
+
+    /// The async runtime.
+    async_runtime: Box<dyn AsyncRuntime>,
+
+    /// When in single-process mode, join handles for script-threads.
+    script_join_handles: HashMap<WebViewId, JoinHandle<()>>,
 }
 
 /// State needed to construct a constellation.
@@ -504,24 +532,9 @@ pub struct InitialConstellationState {
 
     /// User content manager
     pub user_content_manager: UserContentManager,
-}
 
-/// Data needed for webdriver
-struct WebDriverData {
-    load_channel: Option<(PipelineId, IpcSender<WebDriverLoadStatus>)>,
-    resize_channel: Option<IpcSender<Size2D<f32, CSSPixel>>>,
-    // Forward responses from the script thread to the webdriver server.
-    input_command_response_sender: Option<IpcSender<WebDriverCommandResponse>>,
-}
-
-impl WebDriverData {
-    fn new() -> WebDriverData {
-        WebDriverData {
-            load_channel: None,
-            resize_channel: None,
-            input_command_response_sender: None,
-        }
-    }
+    /// The async runtime.
+    pub async_runtime: Box<dyn AsyncRuntime>,
 }
 
 /// When we are running reftests, we save an image to compare against a reference.
@@ -582,6 +595,7 @@ where
         hard_fail: bool,
     ) -> Sender<EmbedderToConstellationMessage> {
         let (compositor_sender, compositor_receiver) = unbounded();
+        let compositor_sender_self = compositor_sender.clone();
 
         // service worker manager to communicate with constellation
         let (swmanager_ipc_sender, swmanager_ipc_receiver) =
@@ -614,23 +628,28 @@ where
                 // If we are in multiprocess mode,
                 // a dedicated per-process hang monitor will be initialized later inside the content process.
                 // See run_content_process in servo/lib.rs
-                let (background_monitor_register, background_hang_monitor_control_ipc_senders) =
-                    if opts::get().multiprocess {
-                        (None, vec![])
-                    } else {
-                        let (
-                            background_hang_monitor_control_ipc_sender,
-                            background_hang_monitor_control_ipc_receiver,
-                        ) = ipc::channel().expect("ipc channel failure");
-                        (
-                            Some(HangMonitorRegister::init(
-                                background_hang_monitor_ipc_sender.clone(),
-                                background_hang_monitor_control_ipc_receiver,
-                                opts::get().background_hang_monitor,
-                            )),
-                            vec![background_hang_monitor_control_ipc_sender],
-                        )
-                    };
+                let (
+                    background_monitor_register,
+                    background_monitor_register_join_handle,
+                    background_hang_monitor_control_ipc_senders,
+                ) = if opts::get().multiprocess {
+                    (None, None, vec![])
+                } else {
+                    let (
+                        background_hang_monitor_control_ipc_sender,
+                        background_hang_monitor_control_ipc_receiver,
+                    ) = ipc::channel().expect("ipc channel failure");
+                    let (register, join_handle) = HangMonitorRegister::init(
+                        background_hang_monitor_ipc_sender.clone(),
+                        background_hang_monitor_control_ipc_receiver,
+                        opts::get().background_hang_monitor,
+                    );
+                    (
+                        Some(register),
+                        Some(join_handle),
+                        vec![background_hang_monitor_control_ipc_sender],
+                    )
+                };
 
                 let swmanager_receiver =
                     route_ipc_receiver_to_new_crossbeam_receiver_preserving_errors(
@@ -648,6 +667,10 @@ where
 
                 let rippy_data = resources::read_bytes(Resource::RippyPNG);
 
+                if opts::get().multiprocess {
+                    prefs::add_observer(Box::new(PreferenceForwarder(compositor_sender_self)));
+                }
+
                 let mut constellation: Constellation<STF, SWF> = Constellation {
                     namespace_receiver,
                     namespace_ipc_sender,
@@ -655,6 +678,7 @@ where
                     background_hang_monitor_sender: background_hang_monitor_ipc_sender,
                     background_hang_monitor_receiver,
                     background_monitor_register,
+                    background_monitor_register_join_handle,
                     background_monitor_control_senders: background_hang_monitor_control_ipc_senders,
                     script_receiver,
                     compositor_receiver,
@@ -685,7 +709,8 @@ where
                     time_profiler_chan: state.time_profiler_chan,
                     mem_profiler_chan: state.mem_profiler_chan.clone(),
                     phantom: PhantomData,
-                    webdriver: WebDriverData::new(),
+                    webdriver_load_status_sender: None,
+                    webdriver_input_command_reponse_sender: None,
                     document_states: HashMap::new(),
                     #[cfg(feature = "webgpu")]
                     webrender_wgpu,
@@ -709,6 +734,8 @@ where
                     rippy_data,
                     user_content_manager: state.user_content_manager,
                     process_manager: ProcessManager::new(state.mem_profiler_chan),
+                    async_runtime: state.async_runtime,
+                    script_join_handles: Default::default(),
                 };
 
                 constellation.run();
@@ -720,6 +747,11 @@ where
 
     /// The main event loop for the constellation.
     fn run(&mut self) {
+        // Start a fetch thread.
+        // In single-process mode this will be the global fetch thread;
+        // in multi-process mode this will be used only by the canvas paint thread.
+        let join_handle = start_fetch_thread();
+
         while !self.shutting_down || !self.pipelines.is_empty() {
             // Randomly close a pipeline if --random-pipeline-closure-probability is set
             // This is for testing the hardening of the constellation.
@@ -727,6 +759,12 @@ where
             self.handle_request();
         }
         self.handle_shutdown();
+
+        // Shut down the fetch thread started above.
+        exit_fetch_thread();
+        join_handle
+            .join()
+            .expect("Failed to join on the fetch thread in the constellation");
     }
 
     /// Generate a new pipeline id namespace.
@@ -970,6 +1008,10 @@ where
             self.background_monitor_control_senders.push(chan);
         }
 
+        if let Some(join_handle) = pipeline.join_handle {
+            self.script_join_handles.insert(webview_id, join_handle);
+        }
+
         if let Some(host) = host {
             debug!("{}: Adding new host entry {}", webview_id, host,);
             self.set_event_loop(
@@ -994,7 +1036,7 @@ where
     fn fully_active_descendant_browsing_contexts_iter(
         &self,
         browsing_context_id: BrowsingContextId,
-    ) -> FullyActiveBrowsingContextsIterator {
+    ) -> FullyActiveBrowsingContextsIterator<'_> {
         FullyActiveBrowsingContextsIterator {
             stack: vec![browsing_context_id],
             pipelines: &self.pipelines,
@@ -1006,7 +1048,7 @@ where
     fn fully_active_browsing_contexts_iter(
         &self,
         webview_id: WebViewId,
-    ) -> FullyActiveBrowsingContextsIterator {
+    ) -> FullyActiveBrowsingContextsIterator<'_> {
         self.fully_active_descendant_browsing_contexts_iter(BrowsingContextId::from(webview_id))
     }
 
@@ -1014,7 +1056,7 @@ where
     fn all_descendant_browsing_contexts_iter(
         &self,
         browsing_context_id: BrowsingContextId,
-    ) -> AllBrowsingContextsIterator {
+    ) -> AllBrowsingContextsIterator<'_> {
         AllBrowsingContextsIterator {
             stack: vec![browsing_context_id],
             pipelines: &self.pipelines,
@@ -1132,6 +1174,7 @@ where
     /// Handles loading pages, navigation, and granting access to the compositor
     #[servo_tracing::instrument(skip_all)]
     fn handle_request(&mut self) {
+        #[allow(clippy::large_enum_variant)]
         #[derive(Debug)]
         enum Request {
             PipelineNamespace(PipelineNamespaceRequest),
@@ -1273,6 +1316,12 @@ where
                         if allowed {
                             self.load_url(webview_id, pipeline_id, load_data, history_handling);
                         } else {
+                            if let Some((sender, id)) = &self.webdriver_load_status_sender {
+                                if pipeline_id == *id {
+                                    let _ = sender.send(WebDriverLoadStatus::NavigationStop);
+                                }
+                            }
+
                             let pipeline_is_top_level_pipeline = self
                                 .browsing_contexts
                                 .get(&BrowsingContextId::from(webview_id))
@@ -1352,7 +1401,7 @@ where
             // Create a new top level browsing context. Will use response_chan to return
             // the browsing context id.
             EmbedderToConstellationMessage::NewWebView(url, webview_id, viewport_details) => {
-                self.handle_new_top_level_browsing_context(url, webview_id, viewport_details, None);
+                self.handle_new_top_level_browsing_context(url, webview_id, viewport_details);
             },
             // Close a top level browsing context.
             EmbedderToConstellationMessage::CloseWebView(webview_id) => {
@@ -1366,8 +1415,8 @@ where
                 }
                 self.handle_panic(webview_id, error, None);
             },
-            EmbedderToConstellationMessage::FocusWebView(webview_id) => {
-                self.handle_focus_web_view(webview_id);
+            EmbedderToConstellationMessage::FocusWebView(webview_id, focus_id) => {
+                self.handle_focus_web_view(webview_id, focus_id);
             },
             EmbedderToConstellationMessage::BlurWebView => {
                 self.webviews.unfocus();
@@ -1415,8 +1464,8 @@ where
             EmbedderToConstellationMessage::ForwardInputEvent(webview_id, event, hit_test) => {
                 self.forward_input_event(webview_id, event, hit_test);
             },
-            EmbedderToConstellationMessage::SetCursor(webview_id, cursor) => {
-                self.handle_set_cursor_msg(webview_id, cursor)
+            EmbedderToConstellationMessage::RefreshCursor(pipeline_id) => {
+                self.handle_refresh_cursor(pipeline_id)
             },
             EmbedderToConstellationMessage::ToggleProfiler(rate, max_duration) => {
                 for background_monitor_control_sender in &self.background_monitor_control_senders {
@@ -1473,7 +1522,21 @@ where
                 }
             },
             EmbedderToConstellationMessage::SetWebDriverResponseSender(sender) => {
-                self.webdriver.input_command_response_sender = Some(sender);
+                self.webdriver_input_command_reponse_sender = Some(sender);
+            },
+            EmbedderToConstellationMessage::PreferencesUpdated(updates) => {
+                let event_loops = self
+                    .pipelines
+                    .values()
+                    .map(|pipeline| pipeline.event_loop.clone());
+                for event_loop in event_loops {
+                    let _ = event_loop.send(ScriptThreadMessage::PreferencesUpdated(
+                        updates
+                            .iter()
+                            .map(|(name, value)| (String::from(*name), value.clone()))
+                            .collect(),
+                    ));
+                }
             },
         }
     }
@@ -1874,14 +1937,14 @@ where
                 self.handle_finish_javascript_evaluation(evaluation_id, result)
             },
             ScriptToConstellationMessage::WebDriverInputComplete(msg_id) => {
-                if let Some(ref reply_sender) = self.webdriver.input_command_response_sender {
+                if let Some(ref reply_sender) = self.webdriver_input_command_reponse_sender {
                     reply_sender
                         .send(WebDriverCommandResponse { id: msg_id })
                         .unwrap_or_else(|_| {
                             warn!("Failed to send WebDriverInputComplete {:?}", msg_id);
                         });
                 } else {
-                    warn!("No WebDriver input_command_response_sender");
+                    warn!("No webdriver_input_command_reponse_sender");
                 }
             },
         }
@@ -2449,15 +2512,13 @@ where
         // even when currently hanging(on JS or sync XHR).
         // This must be done before starting the process of closing all pipelines.
         for chan in &self.background_monitor_control_senders {
-            let (exit_ipc_sender, exit_ipc_receiver) =
-                ipc::channel().expect("Failed to create IPC channel!");
-            if let Err(e) = chan.send(BackgroundHangMonitorControlMsg::Exit(exit_ipc_sender)) {
+            // Note: the bhm worker thread will continue to run
+            // until all monitored components have exited,
+            // at which point we can join on the thread(done in `handle_shutdown`).
+            if let Err(e) = chan.send(BackgroundHangMonitorControlMsg::Exit) {
                 warn!("error communicating with bhm: {}", e);
                 continue;
             }
-            if exit_ipc_receiver.recv().is_err() {
-                warn!("Failed to receive exit confirmation from BHM.");
-            }
         }
 
         // Close the top-level browsing contexts
@@ -2517,6 +2578,22 @@ where
     fn handle_shutdown(&mut self) {
         debug!("Handling shutdown.");
 
+        // In single process mode, join on script-threads
+        // from webview which haven't been manually closed before.
+        for (_, join_handle) in self.script_join_handles.drain() {
+            if join_handle.join().is_err() {
+                error!("Failed to join on a script-thread.");
+            }
+        }
+
+        // In single process mode, join on the background hang monitor worker thread.
+        drop(self.background_monitor_register.take());
+        if let Some(join_handle) = self.background_monitor_register_join_handle.take() {
+            if join_handle.join().is_err() {
+                error!("Failed to join on the bhm background thread.");
+            }
+        }
+
         // At this point, there are no active pipelines,
         // so we can safely block on other threads, without worrying about deadlock.
         // Channels to receive signals when threads are done exiting.
@@ -2644,6 +2721,9 @@ where
 
         debug!("Shutting-down IPC router thread in constellation.");
         ROUTER.shutdown();
+
+        debug!("Shutting-down the async runtime in constellation.");
+        self.async_runtime.shutdown();
     }
 
     fn handle_pipeline_exited(&mut self, pipeline_id: PipelineId) {
@@ -2774,13 +2854,13 @@ where
     }
 
     #[servo_tracing::instrument(skip_all)]
-    fn handle_focus_web_view(&mut self, webview_id: WebViewId) {
-        if self.webviews.get(webview_id).is_none() {
-            return warn!("{webview_id}: FocusWebView on unknown top-level browsing context");
+    fn handle_focus_web_view(&mut self, webview_id: WebViewId, focus_id: FocusId) {
+        let focused = self.webviews.focus(webview_id).is_ok();
+        if !focused {
+            warn!("{webview_id}: FocusWebView on unknown top-level browsing context");
         }
-        self.webviews.focus(webview_id);
         self.embedder_proxy
-            .send(EmbedderMsg::WebViewFocused(webview_id));
+            .send(EmbedderMsg::WebViewFocused(webview_id, focus_id, focused));
     }
 
     #[servo_tracing::instrument(skip_all)]
@@ -2828,6 +2908,7 @@ where
         }
     }
 
+    #[allow(deprecated)]
     fn update_active_keybord_modifiers(&mut self, event: &KeyboardEvent) {
         self.active_keyboard_modifiers = event.event.modifiers;
 
@@ -2835,23 +2916,27 @@ where
         // either pressed or released, but `active_keyboard_modifiers` should track the subsequent
         // state. If this event will update that state, we need to ensure that we are tracking what
         // the event changes.
-        let modified_modifier = match event.event.key {
-            Key::Alt => Modifiers::ALT,
-            Key::AltGraph => Modifiers::ALT_GRAPH,
-            Key::CapsLock => Modifiers::CAPS_LOCK,
-            Key::Control => Modifiers::CONTROL,
-            Key::Fn => Modifiers::FN,
-            Key::FnLock => Modifiers::FN_LOCK,
-            Key::Meta => Modifiers::META,
-            Key::NumLock => Modifiers::NUM_LOCK,
-            Key::ScrollLock => Modifiers::SCROLL_LOCK,
-            Key::Shift => Modifiers::SHIFT,
-            Key::Symbol => Modifiers::SYMBOL,
-            Key::SymbolLock => Modifiers::SYMBOL_LOCK,
-            Key::Hyper => Modifiers::HYPER,
+        let Key::Named(named_key) = event.event.key else {
+            return;
+        };
+
+        let modified_modifier = match named_key {
+            NamedKey::Alt => Modifiers::ALT,
+            NamedKey::AltGraph => Modifiers::ALT_GRAPH,
+            NamedKey::CapsLock => Modifiers::CAPS_LOCK,
+            NamedKey::Control => Modifiers::CONTROL,
+            NamedKey::Fn => Modifiers::FN,
+            NamedKey::FnLock => Modifiers::FN_LOCK,
+            NamedKey::Meta => Modifiers::META,
+            NamedKey::NumLock => Modifiers::NUM_LOCK,
+            NamedKey::ScrollLock => Modifiers::SCROLL_LOCK,
+            NamedKey::Shift => Modifiers::SHIFT,
+            NamedKey::Symbol => Modifiers::SYMBOL,
+            NamedKey::SymbolLock => Modifiers::SYMBOL_LOCK,
+            NamedKey::Hyper => Modifiers::HYPER,
             // The web doesn't make a distinction between these keys (there is only
             // "meta") so map "super" to "meta".
-            Key::Super => Modifiers::META,
+            NamedKey::Super => Modifiers::META,
             _ => return,
         };
         match event.event.state {
@@ -2886,34 +2971,8 @@ where
             }
         }
 
-        let pipeline_id = match &hit_test_result {
-            Some(hit_test) => hit_test.pipeline_id,
-            None => {
-                // If there's no hit test, send to the focused browsing context of the given webview.
-                let Some(browsing_context_id) = self
-                    .webviews
-                    .get(webview_id)
-                    .map(|webview| webview.focused_browsing_context_id)
-                else {
-                    warn!("Handling InputEvent for an unknown webview: {webview_id}");
-                    return;
-                };
-
-                let Some(pipeline_id) = self
-                    .browsing_contexts
-                    .get(&browsing_context_id)
-                    .map(|context| context.pipeline_id)
-                else {
-                    warn!("{browsing_context_id}: Got InputEvent for nonexistent browsing context");
-                    return;
-                };
-
-                pipeline_id
-            },
-        };
-
-        let Some(pipeline) = self.pipelines.get(&pipeline_id) else {
-            debug!("Got event for pipeline ({pipeline_id}) after closure");
+        let Some(webview) = self.webviews.get_mut(webview_id) else {
+            warn!("Got input event for unknown WebViewId: {webview_id:?}");
             return;
         };
 
@@ -2923,13 +2982,7 @@ where
             active_keyboard_modifiers,
             event,
         };
-
-        if let Err(error) = pipeline
-            .event_loop
-            .send(ScriptThreadMessage::SendInputEvent(pipeline_id, event))
-        {
-            self.handle_send_error(pipeline_id, error);
-        }
+        webview.forward_input_event(event, &self.pipelines, &self.browsing_contexts);
     }
 
     #[servo_tracing::instrument(skip_all)]
@@ -2938,7 +2991,6 @@ where
         url: ServoUrl,
         webview_id: WebViewId,
         viewport_details: ViewportDetails,
-        response_sender: Option<IpcSender<WebDriverLoadStatus>>,
     ) {
         let pipeline_id = PipelineId::new();
         let browsing_context_id = BrowsingContextId::from(webview_id);
@@ -2995,10 +3047,6 @@ where
             }),
             viewport_details,
         });
-
-        if let Some(response_sender) = response_sender {
-            self.webdriver.load_channel = Some((pipeline_id, response_sender));
-        }
     }
 
     #[servo_tracing::instrument(skip_all)]
@@ -3036,6 +3084,11 @@ where
                 .remove(&browsing_context.bc_group_id);
         }
 
+        // Note: In single-process mode,
+        // if the webview is manually closed, we drop the join handle without joining on it.
+        // It is unlikely the thread will still run when the constellation shuts-down.
+        self.script_join_handles.remove(&webview_id);
+
         debug!("{webview_id}: Closed");
     }
 
@@ -3153,7 +3206,8 @@ where
                     );
                 },
             };
-            let is_parent_private = match self.browsing_contexts.get(&parent_browsing_context_id) {
+
+            match self.browsing_contexts.get(&parent_browsing_context_id) {
                 Some(ctx) => ctx.is_private,
                 None => {
                     return warn!(
@@ -3161,8 +3215,7 @@ where
                         parent_browsing_context_id, browsing_context_id,
                     );
                 },
-            };
-            is_parent_private
+            }
         };
         let is_private = is_private || is_parent_private;
 
@@ -3386,9 +3439,17 @@ where
     }
 
     #[servo_tracing::instrument(skip_all)]
-    fn handle_set_cursor_msg(&mut self, webview_id: WebViewId, cursor: Cursor) {
-        self.embedder_proxy
-            .send(EmbedderMsg::SetCursor(webview_id, cursor));
+    fn handle_refresh_cursor(&self, pipeline_id: PipelineId) {
+        let Some(pipeline) = self.pipelines.get(&pipeline_id) else {
+            return;
+        };
+
+        if let Err(error) = pipeline
+            .event_loop
+            .send(ScriptThreadMessage::RefreshCursor(pipeline_id))
+        {
+            warn!("Could not send RefreshCursor message to pipeline: {error:?}");
+        }
     }
 
     #[servo_tracing::instrument(skip_all)]
@@ -3542,7 +3603,12 @@ where
                 };
                 if let Err(e) = result {
                     self.handle_send_error(parent_pipeline_id, e);
+                } else if let Some((sender, id)) = &self.webdriver_load_status_sender {
+                    if source_id == *id {
+                        let _ = sender.send(WebDriverLoadStatus::NavigationStop);
+                    }
                 }
+
                 None
             },
             None => {
@@ -3621,18 +3687,6 @@ where
 
     #[servo_tracing::instrument(skip_all)]
     fn handle_load_complete_msg(&mut self, webview_id: WebViewId, pipeline_id: PipelineId) {
-        let mut webdriver_reset = false;
-        if let Some((expected_pipeline_id, ref reply_chan)) = self.webdriver.load_channel {
-            if expected_pipeline_id == pipeline_id {
-                debug!("Sending load for {:?} to WebDriver", expected_pipeline_id);
-                let _ = reply_chan.send(WebDriverLoadStatus::Complete);
-                webdriver_reset = true;
-            }
-        }
-        if webdriver_reset {
-            self.webdriver.load_channel = None;
-        }
-
         if let Some(pipeline) = self.pipelines.get_mut(&pipeline_id) {
             debug!("{}: Marking as loaded", pipeline_id);
             pipeline.completely_loaded = true;
@@ -4113,7 +4167,7 @@ where
             source_browsing_context,
             target_origin: origin,
             source_origin,
-            data,
+            data: Box::new(data),
         };
         let result = match self.pipelines.get(&pipeline_id) {
             Some(pipeline) => pipeline.event_loop.send(msg),
@@ -4150,9 +4204,12 @@ where
         }
 
         // Focus the top-level browsing context.
-        self.webviews.focus(webview_id);
-        self.embedder_proxy
-            .send(EmbedderMsg::WebViewFocused(webview_id));
+        let focused = self.webviews.focus(webview_id);
+        self.embedder_proxy.send(EmbedderMsg::WebViewFocused(
+            webview_id,
+            FocusId::new(),
+            focused.is_ok(),
+        ));
 
         // If a container with a non-null nested browsing context is focused,
         // the nested browsing context's active document becomes the focused
@@ -4401,24 +4458,32 @@ where
     fn handle_create_canvas_paint_thread_msg(
         &mut self,
         size: UntypedSize2D<u64>,
-        response_sender: IpcSender<(IpcSender<CanvasMsg>, CanvasId, ImageKey)>,
+        response_sender: IpcSender<Option<(IpcSender<CanvasMsg>, CanvasId, ImageKey)>>,
     ) {
         let (canvas_data_sender, canvas_data_receiver) = unbounded();
         let (canvas_sender, canvas_ipc_sender) = self
             .canvas
             .get_or_init(|| self.create_canvas_paint_thread());
 
-        if let Err(e) = canvas_sender.send(ConstellationCanvasMsg::Create {
+        let response = if let Err(e) = canvas_sender.send(ConstellationCanvasMsg::Create {
             sender: canvas_data_sender,
             size,
         }) {
-            return warn!("Create canvas paint thread failed ({})", e);
-        }
-        let (canvas_id, image_key) = match canvas_data_receiver.recv() {
-            Ok(canvas_data) => canvas_data,
-            Err(e) => return warn!("Create canvas paint thread id response failed ({})", e),
+            warn!("Create canvas paint thread failed ({})", e);
+            None
+        } else {
+            match canvas_data_receiver.recv() {
+                Ok(Some((canvas_id, image_key))) => {
+                    Some((canvas_ipc_sender.clone(), canvas_id, image_key))
+                },
+                Ok(None) => None,
+                Err(e) => {
+                    warn!("Create canvas paint thread id response failed ({})", e);
+                    None
+                },
+            }
         };
-        if let Err(e) = response_sender.send((canvas_ipc_sender.clone(), canvas_id, image_key)) {
+        if let Err(e) = response_sender.send(response) {
             warn!("Create canvas paint thread response failed ({})", e);
         }
     }
@@ -4434,11 +4499,24 @@ where
             },
             // TODO: This should use the ScriptThreadMessage::EvaluateJavaScript command
             WebDriverCommandMsg::ScriptCommand(browsing_context_id, cmd) => {
-                let pipeline_id = self
-                    .browsing_contexts
-                    .get(&browsing_context_id)
-                    .expect("ScriptCommand: Browsing context must exist at this point")
-                    .pipeline_id;
+                let pipeline_id = if let Some(browsing_context) =
+                    self.browsing_contexts.get(&browsing_context_id)
+                {
+                    browsing_context.pipeline_id
+                } else {
+                    return warn!("{}: Browsing context is not ready", browsing_context_id);
+                };
+
+                match &cmd {
+                    WebDriverScriptCommand::AddLoadStatusSender(_, sender) => {
+                        self.webdriver_load_status_sender = Some((sender.clone(), pipeline_id));
+                    },
+                    WebDriverScriptCommand::RemoveLoadStatusSender(_) => {
+                        self.webdriver_load_status_sender = None;
+                    },
+                    _ => {},
+                };
+
                 let control_msg = ScriptThreadMessage::WebDriverScriptCommand(pipeline_id, cmd);
                 let result = match self.pipelines.get(&pipeline_id) {
                     Some(pipeline) => pipeline.event_loop.send(control_msg),
@@ -4448,27 +4526,22 @@ where
                     self.handle_send_error(pipeline_id, e);
                 }
             },
-            WebDriverCommandMsg::TakeScreenshot(webview_id, rect, response_sender) => {
-                self.compositor_proxy.send(CompositorMsg::CreatePng(
-                    webview_id,
-                    rect,
-                    response_sender,
-                ));
-            },
             WebDriverCommandMsg::CloseWebView(..) |
             WebDriverCommandMsg::NewWebView(..) |
             WebDriverCommandMsg::FocusWebView(..) |
             WebDriverCommandMsg::IsWebViewOpen(..) |
             WebDriverCommandMsg::GetWindowRect(..) |
             WebDriverCommandMsg::GetViewportSize(..) |
-            WebDriverCommandMsg::SetWindowSize(..) |
+            WebDriverCommandMsg::SetWindowRect(..) |
+            WebDriverCommandMsg::MaximizeWebView(..) |
             WebDriverCommandMsg::LoadUrl(..) |
             WebDriverCommandMsg::Refresh(..) |
-            WebDriverCommandMsg::SendKeys(..) |
+            WebDriverCommandMsg::DispatchComposition(..) |
             WebDriverCommandMsg::KeyboardAction(..) |
             WebDriverCommandMsg::MouseButtonAction(..) |
             WebDriverCommandMsg::MouseMoveAction(..) |
-            WebDriverCommandMsg::WheelScrollAction(..) => {
+            WebDriverCommandMsg::WheelScrollAction(..) |
+            WebDriverCommandMsg::TakeScreenshot(..) => {
                 unreachable!("This command should be send directly to the embedder.");
             },
             _ => {
@@ -4929,10 +5002,6 @@ where
 
         let browsing_context_id = BrowsingContextId::from(webview_id);
         self.resize_browsing_context(new_viewport_details, size_type, browsing_context_id);
-
-        if let Some(response_sender) = self.webdriver.resize_channel.take() {
-            let _ = response_sender.send(new_viewport_details.size);
-        }
     }
 
     /// Called when the window exits from fullscreen mode
@@ -5388,7 +5457,7 @@ where
         };
         // In order to get repeatability, we sort the pipeline ids.
         let mut pipeline_ids: Vec<&PipelineId> = self.pipelines.keys().collect();
-        pipeline_ids.sort();
+        pipeline_ids.sort_unstable();
         if let Some((ref mut rng, probability)) = self.random_pipeline_closure {
             if let Some(pipeline_id) = pipeline_ids.choose(rng) {
                 if let Some(pipeline) = self.pipelines.get(pipeline_id) {

components/constellation/constellation_webview.rs

@@ -2,9 +2,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
-use base::id::BrowsingContextId;
-use embedder_traits::Theme;
+use std::collections::HashMap;
 
+use base::id::{BrowsingContextId, PipelineId};
+use embedder_traits::{InputEvent, MouseLeftViewportEvent, Theme};
+use euclid::Point2D;
+use log::warn;
+use script_traits::{ConstellationInputEvent, ScriptThreadMessage};
+use style_traits::CSSPixel;
+
+use crate::browsingcontext::BrowsingContext;
+use crate::pipeline::Pipeline;
 use crate::session_history::JointSessionHistory;
 
 /// The `Constellation`'s view of a `WebView` in the embedding layer. This tracks all of the
@@ -15,6 +23,14 @@ pub(crate) struct ConstellationWebView {
     /// context.
     pub focused_browsing_context_id: BrowsingContextId,
 
+    /// The [`BrowsingContextId`] of the currently hovered browsing context, to use for
+    /// knowing which frame is currently receiving cursor events.
+    pub hovered_browsing_context_id: Option<BrowsingContextId>,
+
+    /// The last mouse move point in the coordinate space of the Pipeline that it
+    /// happened int.
+    pub last_mouse_move_point: Point2D<f32, CSSPixel>,
+
     /// The joint session history for this webview.
     pub session_history: JointSessionHistory,
 
@@ -27,6 +43,8 @@ impl ConstellationWebView {
     pub(crate) fn new(focused_browsing_context_id: BrowsingContextId) -> Self {
         Self {
             focused_browsing_context_id,
+            hovered_browsing_context_id: None,
+            last_mouse_move_point: Default::default(),
             session_history: JointSessionHistory::new(),
             theme: Theme::Light,
         }
@@ -42,4 +60,93 @@ impl ConstellationWebView {
     pub(crate) fn theme(&self) -> Theme {
         self.theme
     }
+
+    fn target_pipeline_id_for_input_event(
+        &self,
+        event: &ConstellationInputEvent,
+        browsing_contexts: &HashMap<BrowsingContextId, BrowsingContext>,
+    ) -> Option<PipelineId> {
+        if let Some(hit_test_result) = &event.hit_test_result {
+            return Some(hit_test_result.pipeline_id);
+        }
+
+        // If there's no hit test, send the event to either the hovered or focused browsing context,
+        // depending on the event type.
+        let browsing_context_id = if matches!(event.event, InputEvent::MouseLeftViewport(_)) {
+            self.hovered_browsing_context_id
+                .unwrap_or(self.focused_browsing_context_id)
+        } else {
+            self.focused_browsing_context_id
+        };
+
+        Some(browsing_contexts.get(&browsing_context_id)?.pipeline_id)
+    }
+
+    pub(crate) fn forward_input_event(
+        &mut self,
+        event: ConstellationInputEvent,
+        pipelines: &HashMap<PipelineId, Pipeline>,
+        browsing_contexts: &HashMap<BrowsingContextId, BrowsingContext>,
+    ) {
+        let Some(pipeline_id) = self.target_pipeline_id_for_input_event(&event, browsing_contexts)
+        else {
+            warn!("Unknown pipeline for input event. Ignoring.");
+            return;
+        };
+        let Some(pipeline) = pipelines.get(&pipeline_id) else {
+            warn!("Unknown pipeline id {pipeline_id:?} for input event. Ignoring.");
+            return;
+        };
+
+        let mut update_hovered_browsing_context =
+            |newly_hovered_browsing_context_id, focus_moving_to_another_iframe: bool| {
+                let old_hovered_context_id = std::mem::replace(
+                    &mut self.hovered_browsing_context_id,
+                    newly_hovered_browsing_context_id,
+                );
+                if old_hovered_context_id == newly_hovered_browsing_context_id {
+                    return;
+                }
+                let Some(old_hovered_context_id) = old_hovered_context_id else {
+                    return;
+                };
+                let Some(pipeline) = browsing_contexts
+                    .get(&old_hovered_context_id)
+                    .and_then(|browsing_context| pipelines.get(&browsing_context.pipeline_id))
+                else {
+                    return;
+                };
+
+                let mut synthetic_mouse_leave_event = event.clone();
+                synthetic_mouse_leave_event.event =
+                    InputEvent::MouseLeftViewport(MouseLeftViewportEvent {
+                        focus_moving_to_another_iframe,
+                    });
+
+                let _ = pipeline
+                    .event_loop
+                    .send(ScriptThreadMessage::SendInputEvent(
+                        pipeline.id,
+                        synthetic_mouse_leave_event,
+                    ));
+            };
+
+        if let InputEvent::MouseLeftViewport(_) = &event.event {
+            update_hovered_browsing_context(None, false);
+            return;
+        }
+
+        if let InputEvent::MouseMove(_) = &event.event {
+            update_hovered_browsing_context(Some(pipeline.browsing_context_id), true);
+            self.last_mouse_move_point = event
+                .hit_test_result
+                .as_ref()
+                .expect("MouseMove events should always have hit tests.")
+                .point_in_viewport;
+        }
+
+        let _ = pipeline
+            .event_loop
+            .send(ScriptThreadMessage::SendInputEvent(pipeline.id, event));
+    }
 }

components/constellation/event_loop.rs

@@ -11,15 +11,15 @@ use std::marker::PhantomData;
 use std::rc::Rc;
 use std::sync::atomic::{AtomicUsize, Ordering};
 
+use base::generic_channel::GenericSender;
 use ipc_channel::Error;
-use ipc_channel::ipc::IpcSender;
 use script_traits::ScriptThreadMessage;
 
 static CURRENT_EVENT_LOOP_ID: AtomicUsize = AtomicUsize::new(0);
 
 /// <https://html.spec.whatwg.org/multipage/#event-loop>
 pub struct EventLoop {
-    script_chan: IpcSender<ScriptThreadMessage>,
+    script_chan: GenericSender<ScriptThreadMessage>,
     dont_send_or_sync: PhantomData<Rc<()>>,
     id: usize,
 }
@@ -46,7 +46,7 @@ impl Drop for EventLoop {
 
 impl EventLoop {
     /// Create a new event loop from the channel to its script thread.
-    pub fn new(script_chan: IpcSender<ScriptThreadMessage>) -> Rc<EventLoop> {
+    pub fn new(script_chan: GenericSender<ScriptThreadMessage>) -> Rc<EventLoop> {
         let id = CURRENT_EVENT_LOOP_ID.fetch_add(1, Ordering::Relaxed);
         Rc::new(EventLoop {
             script_chan,
@@ -57,6 +57,8 @@ impl EventLoop {
 
     /// Send a message to the event loop.
     pub fn send(&self, msg: ScriptThreadMessage) -> Result<(), Error> {
-        self.script_chan.send(msg)
+        self.script_chan
+            .send(msg)
+            .map_err(|_err| Box::new(ipc_channel::ErrorKind::Custom("SendError".into())))
     }
 }

components/constellation/pipeline.rs

@@ -5,12 +5,14 @@
 use std::collections::HashSet;
 use std::rc::Rc;
 use std::sync::Arc;
+use std::thread::JoinHandle;
 
 use background_hang_monitor::HangMonitorRegister;
 use background_hang_monitor_api::{
     BackgroundHangMonitorControlMsg, BackgroundHangMonitorRegister, HangMonitorAlert,
 };
 use base::Epoch;
+use base::generic_channel::{GenericReceiver, GenericSender};
 use base::id::{
     BrowsingContextId, HistoryStateId, PipelineId, PipelineNamespace, PipelineNamespaceId,
     PipelineNamespaceRequest, WebViewId,
@@ -34,8 +36,8 @@ use layout_api::{LayoutFactory, ScriptThreadFactory};
 use log::{debug, error, warn};
 use media::WindowGLContext;
 use net::image_cache::ImageCacheImpl;
-use net_traits::ResourceThreads;
 use net_traits::image_cache::ImageCache;
+use net_traits::{CoreResourceThread, ResourceThreads};
 use profile::system_reporter;
 use profile_traits::mem::{ProfilerMsg, Reporter};
 use profile_traits::{mem as profile_mem, time};
@@ -208,6 +210,7 @@ pub struct NewPipeline {
     pub pipeline: Pipeline,
     pub bhm_control_chan: Option<IpcSender<BackgroundHangMonitorControlMsg>>,
     pub lifeline: Option<(IpcReceiver<()>, Process)>,
+    pub join_handle: Option<JoinHandle<()>>,
 }
 
 impl Pipeline {
@@ -217,7 +220,7 @@ impl Pipeline {
     ) -> Result<NewPipeline, Error> {
         // Note: we allow channel creation to panic, since recovering from this
         // probably requires a general low-memory strategy.
-        let (script_chan, (bhm_control_chan, lifeline)) = match state.event_loop {
+        let (script_chan, (bhm_control_chan, lifeline, join_handle)) = match state.event_loop {
             Some(script_chan) => {
                 let new_layout_info = NewLayoutInfo {
                     parent_info: state.parent_pipeline_id,
@@ -234,10 +237,11 @@ impl Pipeline {
                 {
                     warn!("Sending to script during pipeline creation failed ({})", e);
                 }
-                (script_chan, (None, None))
+                (script_chan, (None, None, None))
             },
             None => {
-                let (script_chan, script_port) = ipc::channel().expect("Pipeline script chan");
+                let (script_chan, script_port) =
+                    base::generic_channel::channel().expect("Pipeline script chan");
 
                 // Route messages coming from content to devtools as appropriate.
                 let script_to_devtools_ipc_sender =
@@ -314,18 +318,18 @@ impl Pipeline {
                         ipc::channel().expect("Failed to create lifeline channel");
                     unprivileged_pipeline_content.lifeline_sender = Some(sender);
                     let process = unprivileged_pipeline_content.spawn_multiprocess()?;
-                    (Some(bhm_control_chan), Some((receiver, process)))
+                    (Some(bhm_control_chan), Some((receiver, process)), None)
                 } else {
                     // Should not be None in single-process mode.
                     let register = state
                         .background_monitor_register
                         .expect("Couldn't start content, no background monitor has been initiated");
-                    unprivileged_pipeline_content.start_all::<STF>(
+                    let join_handle = unprivileged_pipeline_content.start_all::<STF>(
                         false,
                         state.layout_factory,
                         register,
                     );
-                    (None, None)
+                    (None, None, Some(join_handle))
                 };
 
                 (EventLoop::new(script_chan), multiprocess_data)
@@ -346,6 +350,7 @@ impl Pipeline {
             pipeline,
             bhm_control_chan,
             lifeline,
+            join_handle,
         })
     }
 
@@ -479,9 +484,9 @@ pub struct UnprivilegedPipelineContent {
     mem_profiler_chan: profile_mem::ProfilerChan,
     viewport_details: ViewportDetails,
     theme: Theme,
-    script_chan: IpcSender<ScriptThreadMessage>,
+    script_chan: GenericSender<ScriptThreadMessage>,
     load_data: LoadData,
-    script_port: IpcReceiver<ScriptThreadMessage>,
+    script_port: GenericReceiver<ScriptThreadMessage>,
     opts: Opts,
     prefs: Box<Preferences>,
     pipeline_namespace_id: PipelineNamespaceId,
@@ -500,7 +505,7 @@ impl UnprivilegedPipelineContent {
         wait_for_completion: bool,
         layout_factory: Arc<dyn LayoutFactory>,
         background_hang_monitor_register: Box<dyn BackgroundHangMonitorRegister>,
-    ) {
+    ) -> JoinHandle<()> {
         // Setup pipeline-namespace-installing for all threads in this process.
         // Idempotent in single-process mode.
         PipelineNamespace::set_installer_sender(self.namespace_request_sender);
@@ -510,7 +515,7 @@ impl UnprivilegedPipelineContent {
             self.rippy_data,
         ));
         let (content_process_shutdown_chan, content_process_shutdown_port) = unbounded();
-        STF::create(
+        let join_handle = STF::create(
             InitialScriptState {
                 id: self.id,
                 browsing_context_id: self.browsing_context_id,
@@ -550,6 +555,8 @@ impl UnprivilegedPipelineContent {
                 Err(_) => error!("Script-thread shut-down unexpectedly"),
             }
         }
+
+        join_handle
     }
 
     pub fn spawn_multiprocess(self) -> Result<Process, Error> {
@@ -558,7 +565,7 @@ impl UnprivilegedPipelineContent {
 
     pub fn register_with_background_hang_monitor(
         &mut self,
-    ) -> Box<dyn BackgroundHangMonitorRegister> {
+    ) -> (Box<dyn BackgroundHangMonitorRegister>, JoinHandle<()>) {
         HangMonitorRegister::init(
             self.background_hang_monitor_to_constellation_chan.clone(),
             self.bhm_control_port.take().expect("no sampling profiler?"),
@@ -570,6 +577,10 @@ impl UnprivilegedPipelineContent {
         &self.script_to_constellation_chan
     }
 
+    pub fn core_resource_thread(&self) -> &CoreResourceThread {
+        &self.resource_threads.core_thread
+    }
+
     pub fn opts(&self) -> Opts {
         self.opts.clone()
     }

components/constellation/tracing.rs

@@ -67,7 +67,7 @@ mod from_compositor {
                 Self::FocusWebView(..) => target!("FocusWebView"),
                 Self::BlurWebView => target!("BlurWebView"),
                 Self::ForwardInputEvent(_webview_id, event, ..) => event.log_target(),
-                Self::SetCursor(..) => target!("SetCursor"),
+                Self::RefreshCursor(..) => target!("RefreshCursor"),
                 Self::ToggleProfiler(..) => target!("EnableProfiler"),
                 Self::ExitFullScreen(_) => target!("ExitFullScreen"),
                 Self::MediaSessionAction(_) => target!("MediaSessionAction"),
@@ -78,6 +78,7 @@ mod from_compositor {
                 Self::CreateMemoryReport(..) => target!("CreateMemoryReport"),
                 Self::SendImageKeysForPipeline(..) => target!("SendImageKeysForPipeline"),
                 Self::SetWebDriverResponseSender(..) => target!("SetWebDriverResponseSender"),
+                Self::PreferencesUpdated(..) => target!("PreferencesUpdated"),
             }
         }
     }
@@ -96,7 +97,7 @@ mod from_compositor {
                 InputEvent::Keyboard(..) => target_variant!("Keyboard"),
                 InputEvent::MouseButton(..) => target_variant!("MouseButton"),
                 InputEvent::MouseMove(..) => target_variant!("MouseMove"),
-                InputEvent::MouseLeave(..) => target_variant!("MouseLeave"),
+                InputEvent::MouseLeftViewport(..) => target_variant!("MouseLeftViewport"),
                 InputEvent::Touch(..) => target_variant!("Touch"),
                 InputEvent::Wheel(..) => target_variant!("Wheel"),
                 InputEvent::Scroll(..) => target_variant!("Scroll"),

components/constellation/webview_manager.rs

@@ -67,11 +67,14 @@ impl<WebView> WebViewManager<WebView> {
         }
     }
 
-    pub fn focus(&mut self, webview_id: WebViewId) {
-        debug_assert!(self.webviews.contains_key(&webview_id));
+    pub fn focus(&mut self, webview_id: WebViewId) -> Result<(), ()> {
+        if !self.webviews.contains_key(&webview_id) {
+            return Err(());
+        }
         self.focus_order.retain(|b| *b != webview_id);
         self.focus_order.push(webview_id);
         self.is_focused = true;
+        Ok(())
     }
 
     pub fn unfocus(&mut self) {
@@ -96,7 +99,7 @@ mod test {
         webviews: &WebViewManager<WebView>,
     ) -> Vec<(WebViewId, WebView)> {
         let mut keys = webviews.webviews.keys().collect::<Vec<_>>();
-        keys.sort();
+        keys.sort_unstable();
         keys.iter()
             .map(|&id| {
                 (
@@ -128,13 +131,13 @@ mod test {
         assert_eq!(webviews.is_focused, false);
 
         // focus() makes the given webview the latest in focus order.
-        webviews.focus(id(0, 2));
+        let _ = webviews.focus(id(0, 2));
         assert_eq!(webviews.focus_order, vec![id(0, 2)]);
         assert_eq!(webviews.is_focused, true);
-        webviews.focus(id(0, 1));
+        let _ = webviews.focus(id(0, 1));
         assert_eq!(webviews.focus_order, vec![id(0, 2), id(0, 1)]);
         assert_eq!(webviews.is_focused, true);
-        webviews.focus(id(0, 3));
+        let _ = webviews.focus(id(0, 3));
         assert_eq!(webviews.focus_order, vec![id(0, 2), id(0, 1), id(0, 3)]);
         assert_eq!(webviews.is_focused, true);
 
@@ -144,7 +147,7 @@ mod test {
         assert_eq!(webviews.is_focused, false);
 
         // focus() avoids duplicates in focus order, when the given webview has been focused before.
-        webviews.focus(id(0, 1));
+        let _ = webviews.focus(id(0, 1));
         assert_eq!(webviews.focus_order, vec![id(0, 2), id(0, 3), id(0, 1)]);
         assert_eq!(webviews.is_focused, true);
 

components/devtools/Cargo.toml

@@ -13,6 +13,7 @@ path = "lib.rs"
 
 [dependencies]
 base = { workspace = true }
+base64 = { workspace = true }
 chrono = { workspace = true }
 crossbeam-channel = { workspace = true }
 devtools_traits = { workspace = true }
@@ -21,6 +22,7 @@ headers = { workspace = true }
 http = { workspace = true }
 ipc-channel = { workspace = true }
 log = { workspace = true }
+net = { path = "../net" }
 net_traits = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
@@ -29,5 +31,6 @@ servo_rand = { path = "../rand" }
 servo_url = { path = "../url" }
 uuid = { workspace = true }
 
+
 [build-dependencies]
 chrono = { workspace = true }

components/devtools/actor.rs

@@ -11,7 +11,7 @@ use std::sync::{Arc, Mutex};
 
 use base::cross_process_instant::CrossProcessInstant;
 use base::id::PipelineId;
-use log::debug;
+use log::{debug, warn};
 use serde_json::{Map, Value, json};
 
 use crate::StreamId;
@@ -84,6 +84,8 @@ pub struct ActorRegistry {
 
     /// Lookup table for SourceActor names associated with a given PipelineId.
     source_actor_names: RefCell<HashMap<PipelineId, Vec<String>>>,
+    /// Lookup table for inline source content associated with a given PipelineId.
+    inline_source_content: RefCell<HashMap<PipelineId, String>>,
 
     shareable: Option<Arc<Mutex<ActorRegistry>>>,
     next: Cell<u32>,
@@ -99,6 +101,7 @@ impl ActorRegistry {
             old_actors: RefCell::new(vec![]),
             script_actors: RefCell::new(HashMap::new()),
             source_actor_names: RefCell::new(HashMap::new()),
+            inline_source_content: RefCell::new(HashMap::new()),
             shareable: None,
             next: Cell::new(0),
             start_stamp: CrossProcessInstant::now(),
@@ -220,9 +223,11 @@ impl ActorRegistry {
                     actor.handle_message(req, self, msg_type, msg, stream_id)
                 }) {
                     // <https://firefox-source-docs.mozilla.org/devtools/backend/protocol.html#error-packets>
-                    let _ = stream.write_json_packet(&json!({
+                    let error = json!({
                         "from": actor.name(), "error": error.name()
-                    }));
+                    });
+                    warn!("Sending devtools protocol error: error={error:?} request={msg:?}");
+                    let _ = stream.write_json_packet(&error);
                 }
             },
         }
@@ -262,4 +267,20 @@ impl ActorRegistry {
 
         vec![]
     }
+
+    pub fn set_inline_source_content(&mut self, pipeline_id: PipelineId, content: String) {
+        assert!(
+            self.inline_source_content
+                .borrow_mut()
+                .insert(pipeline_id, content)
+                .is_none()
+        );
+    }
+
+    pub fn inline_source_content(&mut self, pipeline_id: PipelineId) -> Option<String> {
+        self.inline_source_content
+            .borrow()
+            .get(&pipeline_id)
+            .cloned()
+    }
 }

components/devtools/actors/breakpoint.rs

@@ -31,6 +31,9 @@ impl Actor for BreakpointListActor {
         _stream_id: crate::StreamId,
     ) -> Result<(), ActorError> {
         match msg_type {
+            // Client wants to set a breakpoint.
+            // Seems to be infallible, unlike the thread actor’s `setBreakpoint`.
+            // <https://firefox-source-docs.mozilla.org/devtools/backend/protocol.html#breakpoints>
             "setBreakpoint" => {
                 let msg = EmptyReplyMsg { from: self.name() };
                 request.reply_final(&msg)?
@@ -39,6 +42,10 @@ impl Actor for BreakpointListActor {
                 let msg = EmptyReplyMsg { from: self.name() };
                 request.reply_final(&msg)?
             },
+            "removeBreakpoint" => {
+                let msg = EmptyReplyMsg { from: self.name() };
+                request.reply_final(&msg)?
+            },
             _ => return Err(ActorError::UnrecognizedPacketType),
         };
         Ok(())
@@ -49,4 +56,8 @@ impl BreakpointListActor {
     pub fn new(name: String) -> Self {
         Self { name }
     }
+
+    pub fn encodable(&self) -> BreakpointListActorMsg {
+        BreakpointListActorMsg { actor: self.name() }
+    }
 }

components/devtools/actors/console.rs

@@ -373,7 +373,7 @@ impl Actor for ConsoleActor {
             },
 
             "startListeners" => {
-                //TODO: actually implement listener filters that support starting/stopping
+                // TODO: actually implement listener filters that support starting/stopping
                 let listeners = msg.get("listeners").unwrap().as_array().unwrap().to_owned();
                 let msg = StartedListenersReply {
                     from: self.name(),
@@ -388,7 +388,7 @@ impl Actor for ConsoleActor {
             },
 
             "stopListeners" => {
-                //TODO: actually implement listener filters that support starting/stopping
+                // TODO: actually implement listener filters that support starting/stopping
                 let msg = StopListenersReply {
                     from: self.name(),
                     stopped_listeners: msg
@@ -403,7 +403,7 @@ impl Actor for ConsoleActor {
                 request.reply_final(&msg)?
             },
 
-            //TODO: implement autocompletion like onAutocomplete in
+            // TODO: implement autocompletion like onAutocomplete in
             //      http://mxr.mozilla.org/mozilla-central/source/toolkit/devtools/server/actors/webconsole.js
             "autocomplete" => {
                 let msg = AutocompleteReply {

components/devtools/actors/inspector.rs

@@ -92,13 +92,8 @@ impl Actor for InspectorActor {
                     .clone()
                     .unwrap_or_else(|| registry.new_name("walker"));
 
-                let root = root_info.encode(
-                    registry,
-                    false,
-                    self.script_chan.clone(),
-                    pipeline,
-                    name.clone(),
-                );
+                let root =
+                    root_info.encode(registry, self.script_chan.clone(), pipeline, name.clone());
 
                 if self.walker.borrow().is_none() {
                     let walker = WalkerActor {

components/devtools/actors/inspector/node.rs

@@ -59,6 +59,9 @@ pub struct NodeActorMsg {
     is_anonymous: bool,
     is_before_pseudo_element: bool,
     is_direct_shadow_host_child: Option<bool>,
+    /// Whether or not this node is displayed.
+    ///
+    /// Setting this value to `false` will cause the devtools to render the node name in gray.
     is_displayed: bool,
     #[serde(rename = "isInHTMLDocument")]
     is_in_html_document: Option<bool>,
@@ -158,7 +161,6 @@ impl Actor for NodeActor {
                     .ok_or(ActorError::Internal)?;
                 let node = doc_elem_info.encode(
                     registry,
-                    true,
                     self.script_chan.clone(),
                     self.pipeline,
                     self.walker.clone(),
@@ -181,7 +183,6 @@ pub trait NodeInfoToProtocol {
     fn encode(
         self,
         actors: &ActorRegistry,
-        display: bool,
         script_chan: IpcSender<DevtoolScriptControlMsg>,
         pipeline: PipelineId,
         walker: String,
@@ -192,7 +193,6 @@ impl NodeInfoToProtocol for NodeInfo {
     fn encode(
         self,
         actors: &ActorRegistry,
-        display: bool,
         script_chan: IpcSender<DevtoolScriptControlMsg>,
         pipeline: PipelineId,
         walker: String,
@@ -239,7 +239,7 @@ impl NodeInfoToProtocol for NodeInfo {
             let mut children = rx.recv().ok()??;
 
             let child = children.pop()?;
-            let msg = child.encode(actors, true, script_chan.clone(), pipeline, walker);
+            let msg = child.encode(actors, script_chan.clone(), pipeline, walker);
 
             // If the node child is not a text node, do not represent it inline.
             if msg.node_type != TEXT_NODE {
@@ -267,7 +267,7 @@ impl NodeInfoToProtocol for NodeInfo {
             is_anonymous: false,
             is_before_pseudo_element: false,
             is_direct_shadow_host_child: None,
-            is_displayed: display,
+            is_displayed: self.is_displayed,
             is_in_html_document: Some(true),
             is_marker_pseudo_element: false,
             is_native_anonymous: false,

components/devtools/actors/inspector/page_style.rs

@@ -175,42 +175,41 @@ impl PageStyleActor {
 
             // For each selector (plus an empty one that represents the style attribute)
             // get all of the rules associated with it.
-            let entries =
-                once(("".into(), usize::MAX))
-                    .chain(selectors)
-                    .filter_map(move |selector| {
-                        let rule = match node_actor.style_rules.borrow_mut().entry(selector) {
-                            Entry::Vacant(e) => {
-                                let name = registry.new_name("style-rule");
-                                let actor = StyleRuleActor::new(
-                                    name.clone(),
-                                    node_actor.name(),
-                                    (!e.key().0.is_empty()).then_some(e.key().clone()),
-                                );
-                                let rule = actor.applied(registry)?;
 
-                                registry.register_later(Box::new(actor));
-                                e.insert(name);
-                                rule
-                            },
-                            Entry::Occupied(e) => {
-                                let actor = registry.find::<StyleRuleActor>(e.get());
-                                actor.applied(registry)?
-                            },
-                        };
-                        if inherited.is_some() && rule.declarations.is_empty() {
-                            return None;
-                        }
+            once(("".into(), usize::MAX))
+                .chain(selectors)
+                .filter_map(move |selector| {
+                    let rule = match node_actor.style_rules.borrow_mut().entry(selector) {
+                        Entry::Vacant(e) => {
+                            let name = registry.new_name("style-rule");
+                            let actor = StyleRuleActor::new(
+                                name.clone(),
+                                node_actor.name(),
+                                (!e.key().0.is_empty()).then_some(e.key().clone()),
+                            );
+                            let rule = actor.applied(registry)?;
 
-                        Some(AppliedEntry {
-                            rule,
-                            // TODO: Handle pseudo elements
-                            pseudo_element: None,
-                            is_system: false,
-                            inherited: inherited.clone(),
-                        })
-                    });
-            entries
+                            registry.register_later(Box::new(actor));
+                            e.insert(name);
+                            rule
+                        },
+                        Entry::Occupied(e) => {
+                            let actor = registry.find::<StyleRuleActor>(e.get());
+                            actor.applied(registry)?
+                        },
+                    };
+                    if inherited.is_some() && rule.declarations.is_empty() {
+                        return None;
+                    }
+
+                    Some(AppliedEntry {
+                        rule,
+                        // TODO: Handle pseudo elements
+                        pseudo_element: None,
+                        is_system: false,
+                        inherited: inherited.clone(),
+                    })
+                })
         })
         .collect();
         let msg = GetAppliedReply {

components/devtools/actors/inspector/walker.rs

@@ -156,7 +156,6 @@ impl Actor for WalkerActor {
                         .map(|child| {
                             child.encode(
                                 registry,
-                                true,
                                 self.script_chan.clone(),
                                 self.pipeline,
                                 self.name(),
@@ -182,7 +181,6 @@ impl Actor for WalkerActor {
                     .ok_or(ActorError::Internal)?;
                 let node = doc_elem_info.encode(
                     registry,
-                    true,
                     self.script_chan.clone(),
                     self.pipeline,
                     self.name(),
@@ -319,7 +317,7 @@ pub fn find_child(
     let children = rx.recv().unwrap().ok_or(vec![])?;
 
     for child in children {
-        let msg = child.encode(registry, true, script_chan.clone(), pipeline, name.into());
+        let msg = child.encode(registry, script_chan.clone(), pipeline, name.into());
         if compare_fn(&msg) {
             hierarchy.push(msg);
             return Ok(hierarchy);

components/devtools/actors/long_string.rs

@@ -0,0 +1,87 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+use serde::Serialize;
+use serde_json::{Map, Value};
+
+use crate::StreamId;
+use crate::actor::{Actor, ActorError, ActorRegistry};
+use crate::protocol::ClientRequest;
+
+const INITIAL_LENGTH: usize = 500;
+
+pub struct LongStringActor {
+    name: String,
+    full_string: String,
+}
+
+#[derive(Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct LongStringObj {
+    #[serde(rename = "type")]
+    type_: String,
+    actor: String,
+    length: usize,
+    initial: String,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct SubstringReply {
+    from: String,
+    substring: String,
+}
+
+impl Actor for LongStringActor {
+    fn name(&self) -> String {
+        self.name.clone()
+    }
+
+    fn handle_message(
+        &self,
+        request: ClientRequest,
+        _registry: &ActorRegistry,
+        msg_type: &str,
+        msg: &Map<String, Value>,
+        _id: StreamId,
+    ) -> Result<(), ActorError> {
+        match msg_type {
+            "substring" => {
+                let start = msg.get("start").and_then(|v| v.as_u64()).unwrap_or(0) as usize;
+                let end = msg
+                    .get("end")
+                    .and_then(|v| v.as_u64())
+                    .unwrap_or(self.full_string.len() as u64) as usize;
+                let substring: String = self
+                    .full_string
+                    .chars()
+                    .skip(start)
+                    .take(end - start)
+                    .collect();
+                let reply = SubstringReply {
+                    from: self.name(),
+                    substring,
+                };
+                request.reply_final(&reply)?
+            },
+            _ => return Err(ActorError::UnrecognizedPacketType),
+        }
+        Ok(())
+    }
+}
+
+impl LongStringActor {
+    pub fn new(registry: &ActorRegistry, full_string: String) -> Self {
+        let name = registry.new_name("longStringActor");
+        LongStringActor { name, full_string }
+    }
+
+    pub fn long_string_obj(&self) -> LongStringObj {
+        LongStringObj {
+            type_: "longString".to_string(),
+            actor: self.name.clone(),
+            length: self.full_string.len(),
+            initial: self.full_string.chars().take(INITIAL_LENGTH).collect(),
+        }
+    }
+}

components/devtools/actors/network_event.rs

@@ -7,15 +7,22 @@
 
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
+use base64::engine::Engine;
+use base64::engine::general_purpose::STANDARD;
 use chrono::{Local, LocalResult, TimeZone};
 use devtools_traits::{HttpRequest as DevtoolsHttpRequest, HttpResponse as DevtoolsHttpResponse};
-use headers::{ContentType, Cookie, HeaderMapExt};
-use http::{HeaderMap, Method, header};
+use headers::{ContentLength, ContentType, Cookie, HeaderMapExt};
+use http::{HeaderMap, Method};
+use net::cookie::ServoCookie;
+use net_traits::CookieSource;
+use net_traits::request::Destination as RequestDestination;
 use serde::Serialize;
 use serde_json::{Map, Value};
+use servo_url::ServoUrl;
 
 use crate::StreamId;
 use crate::actor::{Actor, ActorError, ActorRegistry};
+use crate::actors::long_string::LongStringActor;
 use crate::network_handler::Cause;
 use crate::protocol::ClientRequest;
 
@@ -27,6 +34,7 @@ pub struct NetworkEventActor {
     pub request_method: Method,
     pub request_started: SystemTime,
     pub request_time_stamp: i64,
+    pub request_destination: RequestDestination,
     pub request_headers_raw: Option<HeaderMap>,
     pub request_body: Option<Vec<u8>>,
     pub request_cookies: Option<RequestCookiesMsg>,
@@ -69,7 +77,7 @@ pub struct EventActor {
 
 #[derive(Serialize)]
 pub struct ResponseCookiesMsg {
-    pub cookies: usize,
+    pub cookies: Vec<ResponseCookieObj>,
 }
 
 #[derive(Serialize)]
@@ -102,7 +110,7 @@ pub struct ResponseHeadersMsg {
 
 #[derive(Serialize)]
 pub struct RequestCookiesMsg {
-    pub cookies: usize,
+    pub cookies: Vec<RequestCookieObj>,
 }
 
 #[derive(Serialize)]
@@ -140,7 +148,7 @@ struct GetResponseHeadersReply {
 #[serde(rename_all = "camelCase")]
 struct GetResponseContentReply {
     from: String,
-    content: Option<Vec<u8>>,
+    content: Option<ResponseContentObj>,
     content_discarded: bool,
 }
 
@@ -155,13 +163,46 @@ struct GetRequestPostDataReply {
 #[derive(Serialize)]
 struct GetRequestCookiesReply {
     from: String,
-    cookies: Vec<u8>,
+    cookies: Vec<RequestCookieObj>,
 }
 
 #[derive(Serialize)]
 struct GetResponseCookiesReply {
     from: String,
-    cookies: Vec<u8>,
+    cookies: Vec<ResponseCookieObj>,
+}
+#[derive(Clone, Serialize)]
+pub struct ResponseCookieObj {
+    pub name: String,
+    pub value: String,
+    pub path: Option<String>,
+    pub domain: Option<String>,
+    pub expires: Option<String>,
+    #[serde(rename = "httpOnly")]
+    pub http_only: Option<bool>,
+    pub secure: Option<bool>,
+    #[serde(rename = "sameSite")]
+    pub same_site: Option<String>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ResponseContentObj {
+    mime_type: String,
+    text: Value,
+    body_size: usize,
+    decoded_body_size: usize,
+    size: usize,
+    headers_size: usize,
+    transferred_size: usize,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    encoding: Option<String>,
+}
+
+#[derive(Clone, Serialize)]
+pub struct RequestCookieObj {
+    pub name: String,
+    pub value: String,
 }
 
 #[derive(Clone, Default, Serialize)]
@@ -202,7 +243,7 @@ impl Actor for NetworkEventActor {
     fn handle_message(
         &self,
         request: ClientRequest,
-        _registry: &ActorRegistry,
+        registry: &ActorRegistry,
         msg_type: &str,
         _msg: &Map<String, Value>,
         _id: StreamId,
@@ -234,14 +275,11 @@ impl Actor for NetworkEventActor {
                 request.reply_final(&msg)?
             },
             "getRequestCookies" => {
-                let mut cookies = Vec::new();
-                if let Some(ref headers) = self.request_headers_raw {
-                    for cookie in headers.get_all(header::COOKIE) {
-                        if let Ok(cookie_value) = String::from_utf8(cookie.as_bytes().to_vec()) {
-                            cookies = cookie_value.into_bytes();
-                        }
-                    }
-                }
+                let cookies = self
+                    .request_cookies
+                    .as_ref()
+                    .map(|msg| msg.cookies.clone())
+                    .unwrap_or_default();
                 let msg = GetRequestCookiesReply {
                     from: self.name(),
                     cookies,
@@ -285,15 +323,11 @@ impl Actor for NetworkEventActor {
                 }
             },
             "getResponseCookies" => {
-                let mut cookies = Vec::new();
-                // TODO: This seems quite broken
-                if let Some(ref headers) = self.response_headers_raw {
-                    for cookie in headers.get_all(header::SET_COOKIE) {
-                        if let Ok(cookie_value) = String::from_utf8(cookie.as_bytes().to_vec()) {
-                            cookies = cookie_value.into_bytes();
-                        }
-                    }
-                }
+                let cookies = self
+                    .response_cookies
+                    .as_ref()
+                    .map(|msg| msg.cookies.clone())
+                    .unwrap_or_default();
                 let msg = GetResponseCookiesReply {
                     from: self.name(),
                     cookies,
@@ -301,9 +335,61 @@ impl Actor for NetworkEventActor {
                 request.reply_final(&msg)?
             },
             "getResponseContent" => {
+                let content_obj = self.response_body.as_ref().map(|body| {
+                    let mime_type = self
+                        .response_content
+                        .as_ref()
+                        .map(|c| c.mime_type.clone())
+                        .unwrap_or_default();
+                    let headers_size = self
+                        .response_headers
+                        .as_ref()
+                        .map(|h| h.headers_size)
+                        .unwrap_or(0);
+                    let transferred_size = self
+                        .response_content
+                        .as_ref()
+                        .map(|c| c.transferred_size as usize)
+                        .unwrap_or(0);
+                    let body_size = body.len();
+                    let decoded_body_size = body.len();
+                    let size = body.len();
+
+                    if Self::is_text_mime(&mime_type) {
+                        let full_str = String::from_utf8_lossy(body).to_string();
+
+                        // Queue a LongStringActor for this body
+                        let long_string_actor = LongStringActor::new(registry, full_str);
+                        let long_string_obj = long_string_actor.long_string_obj();
+                        registry.register_later(Box::new(long_string_actor));
+
+                        ResponseContentObj {
+                            mime_type,
+                            text: serde_json::to_value(long_string_obj).unwrap(),
+                            body_size,
+                            decoded_body_size,
+                            size,
+                            headers_size,
+                            transferred_size,
+                            encoding: None,
+                        }
+                    } else {
+                        let b64 = STANDARD.encode(body);
+                        ResponseContentObj {
+                            mime_type,
+                            text: serde_json::to_value(b64).unwrap(),
+                            body_size,
+                            decoded_body_size,
+                            size,
+                            headers_size,
+                            transferred_size,
+                            encoding: Some("base64".to_string()),
+                        }
+                    }
+                });
                 let msg = GetResponseContentReply {
                     from: self.name(),
-                    content: self.response_body.clone(),
+                    content: content_obj,
                     content_discarded: self.response_body.is_none(),
                 };
                 request.reply_final(&msg)?
@@ -350,6 +436,7 @@ impl NetworkEventActor {
                 .duration_since(UNIX_EPOCH)
                 .unwrap_or_default()
                 .as_secs() as i64,
+            request_destination: RequestDestination::None,
             request_headers_raw: None,
             request_body: None,
             request_cookies: None,
@@ -369,7 +456,7 @@ impl NetworkEventActor {
 
     pub fn add_request(&mut self, request: DevtoolsHttpRequest) {
         self.is_xhr = request.is_xhr;
-        self.request_cookies = Some(Self::request_cookies(&request));
+        self.request_cookies = Self::request_cookies(&request);
         self.request_headers = Some(Self::request_headers(&request));
         self.total_time = Self::total_time(&request);
         self.event_timing = Some(Self::event_timing(&request));
@@ -377,16 +464,21 @@ impl NetworkEventActor {
         self.request_method = request.method;
         self.request_started = request.started_date_time;
         self.request_time_stamp = request.time_stamp;
+        self.request_destination = request.destination;
         self.request_body = request.body.clone();
         self.request_headers_raw = Some(request.headers.clone());
     }
 
     pub fn add_response(&mut self, response: DevtoolsHttpResponse) {
         self.response_headers = Some(Self::response_headers(&response));
-        self.response_cookies = Some(Self::response_cookies(&response));
+        self.response_cookies = ServoUrl::parse(&self.request_url)
+            .ok()
+            .as_ref()
+            .and_then(|url| Self::response_cookies(&response, url));
         self.response_start = Some(Self::response_start(&response));
-        self.response_content = Some(Self::response_content(&response));
-        self.response_body = response.body.clone();
+        if let Some(response_content) = Self::response_content(self, &response) {
+            self.response_content = Some(response_content);
+        }
         self.response_headers_raw = response.headers.clone();
     }
 
@@ -404,14 +496,6 @@ impl NetworkEventActor {
             LocalResult::Ambiguous(date_time, _) => date_time.to_rfc3339().to_string(),
         };
 
-        let cause_type = match self.request_url.as_str() {
-            // Adjust based on request data
-            url if url.ends_with(".css") => "stylesheet",
-            url if url.ends_with(".js") => "script",
-            url if url.ends_with(".png") || url.ends_with(".jpg") => "img",
-            _ => "document",
-        };
-
         EventActor {
             actor: self.name(),
             resource_id: self.resource_id,
@@ -422,7 +506,7 @@ impl NetworkEventActor {
             is_xhr: self.is_xhr,
             private: false,
             cause: Cause {
-                type_: cause_type.to_string(),
+                type_: self.request_destination.as_str().to_string(),
                 loading_document_uri: None, // Set if available
             },
         }
@@ -445,7 +529,13 @@ impl NetworkEventActor {
         }
     }
 
-    pub fn response_content(response: &DevtoolsHttpResponse) -> ResponseContentMsg {
+    pub fn response_content(
+        &mut self,
+        response: &DevtoolsHttpResponse,
+    ) -> Option<ResponseContentMsg> {
+        let body = response.body.as_ref()?;
+        self.response_body = Some(body.clone());
+
         let mime_type = response
             .headers
             .as_ref()
@@ -453,24 +543,49 @@ impl NetworkEventActor {
             .map(|ct| ct.to_string())
             .unwrap_or_default();
 
-        // TODO: Set correct values when response's body is sent to the devtools in http_loader.
-        ResponseContentMsg {
-            mime_type,
-            content_size: 0,
-            transferred_size: 0,
-            discard_response_body: true,
-        }
-    }
-
-    pub fn response_cookies(response: &DevtoolsHttpResponse) -> ResponseCookiesMsg {
-        let cookies_size = response
+        let transferred_size = response
             .headers
             .as_ref()
-            .map(|headers| headers.get_all("set-cookie").iter().count())
-            .unwrap_or(0);
-        ResponseCookiesMsg {
-            cookies: cookies_size,
-        }
+            .and_then(|hdrs| hdrs.typed_get::<ContentLength>())
+            .map(|cl| cl.0);
+
+        let content_size = response.body.as_ref().map(|body| body.len() as u64);
+
+        Some(ResponseContentMsg {
+            mime_type,
+            content_size: content_size.unwrap_or(0) as u32,
+            transferred_size: transferred_size.unwrap_or(0) as u32,
+            discard_response_body: false,
+        })
+    }
+
+    pub fn response_cookies(
+        response: &DevtoolsHttpResponse,
+        url: &ServoUrl,
+    ) -> Option<ResponseCookiesMsg> {
+        let headers = response.headers.as_ref()?;
+        let cookies = headers
+            .get_all("set-cookie")
+            .iter()
+            .filter_map(|cookie| {
+                let cookie_str = String::from_utf8(cookie.as_bytes().to_vec()).ok()?;
+                ServoCookie::from_cookie_string(cookie_str, url, CookieSource::HTTP)
+            })
+            .map(|servo_cookie| {
+                let c = &servo_cookie.cookie;
+                ResponseCookieObj {
+                    name: c.name().to_string(),
+                    value: c.value().to_string(),
+                    path: c.path().map(|p| p.to_string()),
+                    domain: c.domain().map(|d| d.to_string()),
+                    expires: c.expires().map(|dt| format!("{:?}", dt)),
+                    http_only: c.http_only(),
+                    secure: c.secure(),
+                    same_site: c.same_site().map(|s| s.to_string()),
+                }
+            })
+            .collect::<Vec<_>>();
+        Some(ResponseCookiesMsg { cookies })
     }
 
     pub fn response_headers(response: &DevtoolsHttpResponse) -> ResponseHeadersMsg {
@@ -498,15 +613,16 @@ impl NetworkEventActor {
         }
     }
 
-    pub fn request_cookies(request: &DevtoolsHttpRequest) -> RequestCookiesMsg {
-        let cookies_size = request
-            .headers
-            .typed_get::<Cookie>()
-            .map(|c| c.len())
-            .unwrap_or(0);
-        RequestCookiesMsg {
-            cookies: cookies_size,
-        }
+    pub fn request_cookies(request: &DevtoolsHttpRequest) -> Option<RequestCookiesMsg> {
+        let header_value = request.headers.typed_get::<Cookie>()?;
+        let cookies = header_value
+            .iter()
+            .map(|cookie| RequestCookieObj {
+                name: cookie.0.to_string(),
+                value: cookie.1.to_string(),
+            })
+            .collect::<Vec<_>>();
+        Some(RequestCookiesMsg { cookies })
     }
 
     pub fn total_time(request: &DevtoolsHttpRequest) -> Duration {
@@ -524,6 +640,16 @@ impl NetworkEventActor {
         }
     }
 
+    pub fn is_text_mime(mime: &str) -> bool {
+        let lower = mime.to_ascii_lowercase();
+        lower.starts_with("text/") ||
+            lower.contains("json") ||
+            lower.contains("javascript") ||
+            lower.contains("xml") ||
+            lower.contains("csv") ||
+            lower.contains("html")
+    }
+
     fn insert_serialized_map<T: Serialize>(map: &mut Map<String, Value>, obj: &Option<T>) {
         if let Some(value) = obj {
             if let Ok(Value::Object(serialized)) = serde_json::to_value(value) {

components/devtools/actors/source.rs

@@ -3,9 +3,11 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
 use std::cell::RefCell;
-use std::collections::BTreeSet;
+use std::collections::{BTreeMap, BTreeSet};
 
 use base::id::PipelineId;
+use devtools_traits::DevtoolScriptControlMsg;
+use ipc_channel::ipc::{IpcSender, channel};
 use serde::Serialize;
 use serde_json::{Map, Value};
 use servo_url::ServoUrl;
@@ -27,6 +29,8 @@ pub(crate) struct SourceForm {
     /// URL of the script, or URL of the page for inline scripts.
     pub url: String,
     pub is_black_boxed: bool,
+    /// `introductionType` in SpiderMonkey `CompileOptionsWrapper`.
+    pub introduction_type: String,
 }
 
 #[derive(Serialize)]
@@ -52,17 +56,43 @@ pub struct SourceActor {
     pub is_black_boxed: bool,
 
     pub content: Option<String>,
-    pub content_type: String,
+    pub content_type: Option<String>,
+
+    // TODO: use it in #37667, then remove this allow
+    #[allow(unused)]
+    pub spidermonkey_id: u32,
+    /// `introductionType` in SpiderMonkey `CompileOptionsWrapper`.
+    pub introduction_type: String,
+
+    script_sender: IpcSender<DevtoolScriptControlMsg>,
 }
 
 #[derive(Serialize)]
 struct SourceContentReply {
     from: String,
     #[serde(rename = "contentType")]
-    content_type: String,
+    content_type: Option<String>,
     source: String,
 }
 
+#[derive(Serialize)]
+struct GetBreakableLinesReply {
+    from: String,
+    // Line numbers are one-based.
+    // <https://firefox-source-docs.mozilla.org/devtools/backend/protocol.html#source-locations>
+    lines: BTreeSet<u32>,
+}
+
+#[derive(Serialize)]
+struct GetBreakpointPositionsCompressedReply {
+    from: String,
+    // Column numbers are in UTF-16 code units, not Unicode scalar values or grapheme clusters.
+    // Line number are one-based. Column numbers are zero-based.
+    // FIXME: the docs say column numbers are one-based, but this appears to be incorrect.
+    // <https://firefox-source-docs.mozilla.org/devtools/backend/protocol.html#source-locations>
+    positions: BTreeMap<u32, BTreeSet<u32>>,
+}
+
 impl SourceManager {
     pub fn new() -> Self {
         Self {
@@ -90,7 +120,10 @@ impl SourceActor {
         name: String,
         url: ServoUrl,
         content: Option<String>,
-        content_type: String,
+        content_type: Option<String>,
+        spidermonkey_id: u32,
+        introduction_type: String,
+        script_sender: IpcSender<DevtoolScriptControlMsg>,
     ) -> SourceActor {
         SourceActor {
             name,
@@ -98,19 +131,34 @@ impl SourceActor {
             content,
             content_type,
             is_black_boxed: false,
+            spidermonkey_id,
+            introduction_type,
+            script_sender,
         }
     }
 
+    #[allow(clippy::too_many_arguments)]
     pub fn new_registered(
         actors: &mut ActorRegistry,
         pipeline_id: PipelineId,
         url: ServoUrl,
         content: Option<String>,
-        content_type: String,
+        content_type: Option<String>,
+        spidermonkey_id: u32,
+        introduction_type: String,
+        script_sender: IpcSender<DevtoolScriptControlMsg>,
     ) -> &SourceActor {
         let source_actor_name = actors.new_name("source");
 
-        let source_actor = SourceActor::new(source_actor_name.clone(), url, content, content_type);
+        let source_actor = SourceActor::new(
+            source_actor_name.clone(),
+            url,
+            content,
+            content_type,
+            spidermonkey_id,
+            introduction_type,
+            script_sender,
+        );
         actors.register(Box::new(source_actor));
         actors.register_source_actor(pipeline_id, &source_actor_name);
 
@@ -122,6 +170,7 @@ impl SourceActor {
             actor: self.name.clone(),
             url: self.url.to_string(),
             is_black_boxed: self.is_black_boxed,
+            introduction_type: self.introduction_type.clone(),
         }
     }
 }
@@ -145,6 +194,10 @@ impl Actor for SourceActor {
                 let reply = SourceContentReply {
                     from: self.name(),
                     content_type: self.content_type.clone(),
+                    // TODO: if needed, fetch the page again, in the same way as in the original request.
+                    // Fetch it from cache, even if the original request was non-idempotent (e.g. POST).
+                    // If we can’t fetch it from cache, we should probably give up, because with a real
+                    // fetch, the server could return a different response.
                     // TODO: do we want to wait instead of giving up immediately, in cases where the content could
                     // become available later (e.g. after a fetch)?
                     source: self
@@ -155,6 +208,54 @@ impl Actor for SourceActor {
                 };
                 request.reply_final(&reply)?
             },
+            // Client wants to know which lines can have breakpoints.
+            // Sent when opening a source in the Sources panel, and controls whether the line numbers can be clicked.
+            "getBreakableLines" => {
+                let (tx, rx) = channel().map_err(|_| ActorError::Internal)?;
+                self.script_sender
+                    .send(DevtoolScriptControlMsg::GetPossibleBreakpoints(
+                        self.spidermonkey_id,
+                        tx,
+                    ))
+                    .map_err(|_| ActorError::Internal)?;
+                let result = rx.recv().map_err(|_| ActorError::Internal)?;
+                let lines = result
+                    .into_iter()
+                    .map(|entry| entry.line_number)
+                    .collect::<BTreeSet<_>>();
+                let reply = GetBreakableLinesReply {
+                    from: self.name(),
+                    lines,
+                };
+                request.reply_final(&reply)?
+            },
+            // Client wants to know which columns in the line can have breakpoints.
+            // Sent when the user tries to set a breakpoint by clicking a line number in a source.
+            "getBreakpointPositionsCompressed" => {
+                let (tx, rx) = channel().map_err(|_| ActorError::Internal)?;
+                self.script_sender
+                    .send(DevtoolScriptControlMsg::GetPossibleBreakpoints(
+                        self.spidermonkey_id,
+                        tx,
+                    ))
+                    .map_err(|_| ActorError::Internal)?;
+                let result = rx.recv().map_err(|_| ActorError::Internal)?;
+                let mut positions: BTreeMap<u32, BTreeSet<u32>> = BTreeMap::default();
+                for entry in result {
+                    // Line number are one-based. Column numbers are zero-based.
+                    // FIXME: the docs say column numbers are one-based, but this appears to be incorrect.
+                    // <https://firefox-source-docs.mozilla.org/devtools/backend/protocol.html#source-locations>
+                    positions
+                        .entry(entry.line_number)
+                        .or_default()
+                        .insert(entry.column_number - 1);
+                }
+                let reply = GetBreakpointPositionsCompressedReply {
+                    from: self.name(),
+                    positions,
+                };
+                request.reply_final(&reply)?
+            },
             _ => return Err(ActorError::UnrecognizedPacketType),
         };
         Ok(())

components/devtools/actors/timeline.rs

@@ -126,7 +126,7 @@ impl Serialize for HighResolutionStamp {
     }
 }
 
-static DEFAULT_TIMELINE_DATA_PULL_TIMEOUT: u64 = 200; //ms
+static DEFAULT_TIMELINE_DATA_PULL_TIMEOUT: u64 = 200; // ms
 
 impl TimelineActor {
     pub fn new(
@@ -209,7 +209,7 @@ impl Actor for TimelineActor {
                     ))
                     .unwrap();
 
-                //TODO: support multiple connections by using root actor's streams instead.
+                // TODO: support multiple connections by using root actor's streams instead.
                 *self.stream.borrow_mut() = request.try_clone_stream().ok();
 
                 // init memory actor
@@ -268,7 +268,7 @@ impl Actor for TimelineActor {
                     ))
                     .unwrap();
 
-                //TODO: move this to the cleanup method.
+                // TODO: move this to the cleanup method.
                 if let Some(ref actor_name) = *self.framerate_actor.borrow() {
                     registry.drop_actor_later(actor_name.clone());
                 }

components/devtools/actors/watcher.rs

@@ -25,6 +25,7 @@ use super::breakpoint::BreakpointListActor;
 use super::thread::ThreadActor;
 use super::worker::WorkerMsg;
 use crate::actor::{Actor, ActorError, ActorRegistry};
+use crate::actors::breakpoint::BreakpointListActorMsg;
 use crate::actors::browsing_context::{BrowsingContextActor, BrowsingContextActorMsg};
 use crate::actors::root::RootActor;
 use crate::actors::watcher::target_configuration::{
@@ -151,12 +152,7 @@ struct GetThreadConfigurationActorReply {
 #[serde(rename_all = "camelCase")]
 struct GetBreakpointListActorReply {
     from: String,
-    breakpoint_list: GetBreakpointListActorReplyInner,
-}
-
-#[derive(Serialize)]
-struct GetBreakpointListActorReplyInner {
-    actor: String,
+    breakpoint_list: BreakpointListActorMsg,
 }
 
 #[derive(Serialize)]
@@ -191,6 +187,7 @@ pub struct WatcherActor {
     network_parent: String,
     target_configuration: String,
     thread_configuration: String,
+    breakpoint_list: String,
     session_context: SessionContext,
 }
 
@@ -376,15 +373,10 @@ impl Actor for WatcherActor {
                 request.reply_final(&msg)?
             },
             "getBreakpointListActor" => {
-                let breakpoint_list_name = registry.new_name("breakpoint-list");
-                let breakpoint_list = BreakpointListActor::new(breakpoint_list_name.clone());
-                registry.register_later(Box::new(breakpoint_list));
-
+                let breakpoint_list = registry.find::<BreakpointListActor>(&self.breakpoint_list);
                 request.reply_final(&GetBreakpointListActorReply {
                     from: self.name(),
-                    breakpoint_list: GetBreakpointListActorReplyInner {
-                        actor: breakpoint_list_name,
-                    },
+                    breakpoint_list: breakpoint_list.encodable(),
                 })?
             },
             _ => return Err(ActorError::UnrecognizedPacketType),
@@ -410,6 +402,7 @@ impl WatcherActor {
             TargetConfigurationActor::new(actors.new_name("target-configuration"));
         let thread_configuration =
             ThreadConfigurationActor::new(actors.new_name("thread-configuration"));
+        let breakpoint_list = BreakpointListActor::new(actors.new_name("breakpoint-list"));
 
         let watcher = Self {
             name: actors.new_name("watcher"),
@@ -417,12 +410,14 @@ impl WatcherActor {
             network_parent: network_parent.name(),
             target_configuration: target_configuration.name(),
             thread_configuration: thread_configuration.name(),
+            breakpoint_list: breakpoint_list.name(),
             session_context,
         };
 
         actors.register(Box::new(network_parent));
         actors.register(Box::new(target_configuration));
         actors.register(Box::new(thread_configuration));
+        actors.register(Box::new(breakpoint_list));
 
         watcher
     }

components/devtools/lib.rs

@@ -13,7 +13,6 @@
 
 use std::borrow::ToOwned;
 use std::collections::HashMap;
-use std::collections::hash_map::Entry::{Occupied, Vacant};
 use std::io::Read;
 use std::net::{Shutdown, TcpListener, TcpStream};
 use std::sync::{Arc, Mutex};
@@ -60,6 +59,7 @@ mod actors {
     pub mod device;
     pub mod framerate;
     pub mod inspector;
+    pub mod long_string;
     pub mod memory;
     pub mod network_event;
     pub mod object;
@@ -256,9 +256,10 @@ impl DevtoolsInstance {
                     worker_id,
                 )) => self.handle_console_message(pipeline_id, worker_id, console_message),
                 DevtoolsControlMsg::FromScript(ScriptToDevtoolsControlMsg::CreateSourceActor(
+                    script_sender,
                     pipeline_id,
                     source_info,
-                )) => self.handle_create_source_actor(pipeline_id, source_info),
+                )) => self.handle_create_source_actor(script_sender, pipeline_id, source_info),
                 DevtoolsControlMsg::FromScript(
                     ScriptToDevtoolsControlMsg::UpdateSourceContent(pipeline_id, source_content),
                 ) => self.handle_update_source_content(pipeline_id, source_content),
@@ -509,7 +510,10 @@ impl DevtoolsInstance {
             .watcher
             .clone();
 
-        let netevent_actor_name = self.find_network_event_actor(request_id, watcher_name);
+        let netevent_actor_name = match self.actor_requests.get(&request_id) {
+            Some(name) => name.clone(),
+            None => self.create_network_event_actor(request_id, watcher_name),
+        };
 
         handle_network_event(
             Arc::clone(&self.actors),
@@ -519,36 +523,41 @@ impl DevtoolsInstance {
         )
     }
 
-    // Find the name of NetworkEventActor corresponding to request_id
-    // Create a new one if it does not exist, add it to the actor_requests hashmap
-    fn find_network_event_actor(&mut self, request_id: String, watcher_name: String) -> String {
+    /// Create a new NetworkEventActor for a given request ID and watcher name.
+    fn create_network_event_actor(&mut self, request_id: String, watcher_name: String) -> String {
         let mut actors = self.actors.lock().unwrap();
-        match self.actor_requests.entry(request_id) {
-            Occupied(name) => {
-                //TODO: Delete from map like Firefox does?
-                name.into_mut().clone()
-            },
-            Vacant(entry) => {
-                let resource_id = self.next_resource_id;
-                self.next_resource_id += 1;
-                let actor_name = actors.new_name("netevent");
-                let actor = NetworkEventActor::new(actor_name.clone(), resource_id, watcher_name);
-                entry.insert(actor_name.clone());
-                actors.register(Box::new(actor));
-                actor_name
-            },
-        }
+        let resource_id = self.next_resource_id;
+        self.next_resource_id += 1;
+
+        let actor_name = actors.new_name("netevent");
+        let actor = NetworkEventActor::new(actor_name.clone(), resource_id, watcher_name);
+
+        self.actor_requests.insert(request_id, actor_name.clone());
+        actors.register(Box::new(actor));
+
+        actor_name
     }
 
-    fn handle_create_source_actor(&mut self, pipeline_id: PipelineId, source_info: SourceInfo) {
+    fn handle_create_source_actor(
+        &mut self,
+        script_sender: IpcSender<DevtoolScriptControlMsg>,
+        pipeline_id: PipelineId,
+        source_info: SourceInfo,
+    ) {
         let mut actors = self.actors.lock().unwrap();
 
+        let source_content = source_info
+            .content
+            .or_else(|| actors.inline_source_content(pipeline_id));
         let source_actor = SourceActor::new_registered(
             &mut actors,
             pipeline_id,
             source_info.url,
-            source_info.content,
-            source_info.content_type.unwrap(),
+            source_content,
+            source_info.content_type,
+            source_info.spidermonkey_id,
+            source_info.introduction_type,
+            script_sender,
         );
         let source_actor_name = source_actor.name.clone();
         let source_form = source_actor.source_form();
@@ -613,6 +622,10 @@ impl DevtoolsInstance {
                 source_actor.content = Some(source_content.clone());
             }
         }
+
+        // Store the source content separately for any future source actors that get created *after* we finish parsing
+        // the HTML. For example, adding an `import` to an inline module script can delay it until after parsing.
+        actors.set_inline_source_content(pipeline_id, source_content);
     }
 }
 

components/fonts/Cargo.toml

@@ -14,6 +14,9 @@ test = true
 doctest = false
 
 [features]
+default = ["harfbuzz"]
+harfbuzz = ["dep:harfbuzz-sys"]
+harfrust = ["dep:harfrust"]
 tracing = ["dep:tracing"]
 
 [dependencies]
@@ -27,7 +30,8 @@ fnv = { workspace = true }
 fonts_traits = { workspace = true }
 fontsan = { git = "https://github.com/servo/fontsan" }
 # FIXME (#34517): macOS only needs this when building libservo without `--features media-gstreamer`
-harfbuzz-sys = { workspace = true, features = ["bundled"] }
+harfbuzz-sys = { workspace = true, optional = true, features = ["bundled"] }
+harfrust = { workspace = true, optional = true }
 ipc-channel = { workspace = true }
 itertools = { workspace = true }
 libc = { workspace = true }
@@ -45,6 +49,7 @@ serde = { workspace = true }
 servo_arc = { workspace = true }
 servo_config = { path = "../config" }
 servo_url = { path = "../url" }
+skrifa = { workspace = true }
 smallvec = { workspace = true }
 stylo = { workspace = true }
 stylo_atoms = { workspace = true }
@@ -72,8 +77,8 @@ fontconfig_sys = { package = "yeslogic-fontconfig-sys", version = "6" }
 xml-rs = "0.8"
 
 [target.'cfg(target_os = "windows")'.dependencies]
-dwrote = "0.11.2"
-truetype = { version = "0.47.3", features = ["ignore-invalid-language-ids"] }
+dwrote = "0.11.4"
+winapi = { workspace = true }
 
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(ohos_mock)'] }

components/fonts/font.rs

@@ -4,6 +4,8 @@
 
 use std::borrow::ToOwned;
 use std::collections::HashMap;
+use std::hash::Hash;
+use std::ops::Deref;
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::{Arc, OnceLock};
 use std::time::Instant;
@@ -16,6 +18,7 @@ use euclid::num::Zero;
 use log::debug;
 use malloc_size_of_derive::MallocSizeOf;
 use parking_lot::RwLock;
+use read_fonts::tables::os2::{Os2, SelectionFlags};
 use serde::{Deserialize, Serialize};
 use smallvec::SmallVec;
 use style::computed_values::font_variant_caps;
@@ -25,14 +28,14 @@ use style::values::computed::font::{
 };
 use style::values::computed::{FontStretch, FontStyle, FontWeight};
 use unicode_script::Script;
-use webrender_api::{FontInstanceFlags, FontInstanceKey};
+use webrender_api::{FontInstanceFlags, FontInstanceKey, FontVariation};
 
 use crate::platform::font::{FontTable, PlatformFont};
 pub use crate::platform::font_list::fallback_font_families;
 use crate::{
     ByteIndex, EmojiPresentationPreference, FallbackFontSelectionOptions, FontContext, FontData,
-    FontIdentifier, FontTemplateDescriptor, FontTemplateRef, FontTemplateRefMethods, GlyphData,
-    GlyphId, GlyphStore, LocalFontIdentifier, Shaper,
+    FontDataAndIndex, FontDataError, FontIdentifier, FontTemplateDescriptor, FontTemplateRef,
+    FontTemplateRefMethods, GlyphData, GlyphId, GlyphStore, LocalFontIdentifier, Shaper,
 };
 
 #[macro_export]
@@ -42,13 +45,15 @@ macro_rules! ot_tag {
     };
 }
 
-pub const GPOS: u32 = ot_tag!('G', 'P', 'O', 'S');
-pub const GSUB: u32 = ot_tag!('G', 'S', 'U', 'B');
-pub const KERN: u32 = ot_tag!('k', 'e', 'r', 'n');
-pub const SBIX: u32 = ot_tag!('s', 'b', 'i', 'x');
-pub const CBDT: u32 = ot_tag!('C', 'B', 'D', 'T');
-pub const COLR: u32 = ot_tag!('C', 'O', 'L', 'R');
-pub const BASE: u32 = ot_tag!('B', 'A', 'S', 'E');
+pub type OpenTypeTableTag = u32;
+pub const GPOS: OpenTypeTableTag = ot_tag!('G', 'P', 'O', 'S');
+pub const GSUB: OpenTypeTableTag = ot_tag!('G', 'S', 'U', 'B');
+pub const KERN: OpenTypeTableTag = ot_tag!('k', 'e', 'r', 'n');
+pub const SBIX: OpenTypeTableTag = ot_tag!('s', 'b', 'i', 'x');
+pub const CBDT: OpenTypeTableTag = ot_tag!('C', 'B', 'D', 'T');
+pub const COLR: OpenTypeTableTag = ot_tag!('C', 'O', 'L', 'R');
+pub const BASE: OpenTypeTableTag = ot_tag!('B', 'A', 'S', 'E');
+pub const LIGA: OpenTypeTableTag = ot_tag!('l', 'i', 'g', 'a');
 
 pub const LAST_RESORT_GLYPH_ADVANCE: FractionalPixel = 10.0;
 
@@ -65,6 +70,7 @@ pub trait PlatformFontMethods: Sized {
     fn new_from_template(
         template: FontTemplateRef,
         pt_size: Option<Au>,
+        variations: &[FontVariation],
         data: &Option<FontData>,
     ) -> Result<PlatformFont, &'static str> {
         let template = template.borrow();
@@ -72,13 +78,14 @@ pub trait PlatformFontMethods: Sized {
 
         match font_identifier {
             FontIdentifier::Local(font_identifier) => {
-                Self::new_from_local_font_identifier(font_identifier, pt_size)
+                Self::new_from_local_font_identifier(font_identifier, pt_size, variations)
             },
             FontIdentifier::Web(_) => Self::new_from_data(
                 font_identifier,
                 data.as_ref()
                     .expect("Should never create a web font without data."),
                 pt_size,
+                variations,
             ),
         }
     }
@@ -86,12 +93,14 @@ pub trait PlatformFontMethods: Sized {
     fn new_from_local_font_identifier(
         font_identifier: LocalFontIdentifier,
         pt_size: Option<Au>,
+        variations: &[FontVariation],
     ) -> Result<PlatformFont, &'static str>;
 
     fn new_from_data(
         font_identifier: FontIdentifier,
         data: &FontData,
         pt_size: Option<Au>,
+        variations: &[FontVariation],
     ) -> Result<PlatformFont, &'static str>;
 
     /// Get a [`FontTemplateDescriptor`] from a [`PlatformFont`]. This is used to get
@@ -108,6 +117,32 @@ pub trait PlatformFontMethods: Sized {
 
     /// Get the necessary [`FontInstanceFlags`]` for this font.
     fn webrender_font_instance_flags(&self) -> FontInstanceFlags;
+
+    /// Return all the variation values that the font was instantiated with.
+    fn variations(&self) -> &[FontVariation];
+
+    fn descriptor_from_os2_table(os2: &Os2) -> FontTemplateDescriptor {
+        let mut style = FontStyle::NORMAL;
+        if os2.fs_selection().contains(SelectionFlags::ITALIC) {
+            style = FontStyle::ITALIC;
+        }
+
+        let weight = FontWeight::from_float(os2.us_weight_class() as f32);
+        let stretch = match os2.us_width_class() {
+            1 => FontStretch::ULTRA_CONDENSED,
+            2 => FontStretch::EXTRA_CONDENSED,
+            3 => FontStretch::CONDENSED,
+            4 => FontStretch::SEMI_CONDENSED,
+            5 => FontStretch::NORMAL,
+            6 => FontStretch::SEMI_EXPANDED,
+            7 => FontStretch::EXPANDED,
+            8 => FontStretch::EXTRA_EXPANDED,
+            9 => FontStretch::ULTRA_EXPANDED,
+            _ => FontStretch::NORMAL,
+        };
+
+        FontTemplateDescriptor::new(weight, stretch, style)
+    }
 }
 
 // Used to abstract over the shaper's choice of fixed int representation.
@@ -191,18 +226,29 @@ pub struct FontDescriptor {
     pub style: FontStyle,
     pub variant: font_variant_caps::T,
     pub pt_size: Au,
+    pub variation_settings: Vec<FontVariation>,
 }
 
 impl Eq for FontDescriptor {}
 
 impl<'a> From<&'a FontStyleStruct> for FontDescriptor {
     fn from(style: &'a FontStyleStruct) -> Self {
+        let variation_settings = style
+            .clone_font_variation_settings()
+            .0
+            .into_iter()
+            .map(|setting| FontVariation {
+                tag: setting.tag.0,
+                value: setting.value,
+            })
+            .collect();
         FontDescriptor {
             weight: style.font_weight,
             stretch: style.font_stretch,
             style: style.font_style,
             variant: style.font_variant_caps,
             pt_size: Au::from_f32_px(style.font_size.computed_size().px()),
+            variation_settings,
         }
     }
 }
@@ -233,8 +279,9 @@ pub struct Font {
     pub metrics: FontMetrics,
     pub descriptor: FontDescriptor,
 
-    /// The data for this font. This might be uninitialized for system fonts.
-    data: OnceLock<FontData>,
+    /// The data for this font. And the index of the font within the data (in case it's a TTC)
+    /// This might be uninitialized for system fonts.
+    data_and_index: OnceLock<FontDataAndIndex>,
 
     shaper: OnceLock<Shaper>,
     cached_shape_data: RwLock<CachedShapeData>,
@@ -279,8 +326,12 @@ impl Font {
         data: Option<FontData>,
         synthesized_small_caps: Option<FontRef>,
     ) -> Result<Font, &'static str> {
-        let handle =
-            PlatformFont::new_from_template(template.clone(), Some(descriptor.pt_size), &data)?;
+        let handle = PlatformFont::new_from_template(
+            template.clone(),
+            Some(descriptor.pt_size),
+            &descriptor.variation_settings,
+            &data,
+        )?;
         let metrics = handle.metrics();
 
         Ok(Font {
@@ -288,7 +339,9 @@ impl Font {
             template,
             metrics,
             descriptor,
-            data: data.map(OnceLock::from).unwrap_or_default(),
+            data_and_index: data
+                .map(|data| OnceLock::from(FontDataAndIndex { data, index: 0 }))
+                .unwrap_or_default(),
             shaper: OnceLock::new(),
             cached_shape_data: Default::default(),
             font_instance_key: Default::default(),
@@ -323,17 +376,24 @@ impl Font {
 
     /// Return the data for this `Font`. Note that this is currently highly inefficient for system
     /// fonts and should not be used except in legacy canvas code.
-    pub fn data(&self) -> &FontData {
-        self.data.get_or_init(|| {
-            let FontIdentifier::Local(local_font_identifier) = self.identifier() else {
-                unreachable!("All web fonts should already have initialized data");
-            };
-            FontData::from_bytes(
-                &local_font_identifier
-                    .read_data_from_file()
-                    .unwrap_or_default(),
-            )
-        })
+    pub fn font_data_and_index(&self) -> Result<&FontDataAndIndex, FontDataError> {
+        if let Some(data_and_index) = self.data_and_index.get() {
+            return Ok(data_and_index);
+        }
+
+        let FontIdentifier::Local(local_font_identifier) = self.identifier() else {
+            unreachable!("All web fonts should already have initialized data");
+        };
+        let Some(data_and_index) = local_font_identifier.font_data_and_index() else {
+            return Err(FontDataError::FailedToLoad);
+        };
+
+        let data_and_index = self.data_and_index.get_or_init(move || data_and_index);
+        Ok(data_and_index)
+    }
+
+    pub fn variations(&self) -> &[FontVariation] {
+        self.handle.variations()
     }
 }
 
@@ -425,9 +485,8 @@ impl Font {
     }
 
     fn shape_text_harfbuzz(&self, text: &str, options: &ShapingOptions, glyphs: &mut GlyphStore) {
-        let this = self as *const Font;
         self.shaper
-            .get_or_init(|| Shaper::new(this))
+            .get_or_init(|| Shaper::new(self))
             .shape_text(text, options, glyphs);
     }
 
@@ -456,14 +515,11 @@ impl Font {
                 None => continue,
             };
 
-            let mut advance = Au::from_f64_px(self.glyph_h_advance(glyph_id));
-            if character == ' ' {
-                // https://drafts.csswg.org/css-text-3/#word-spacing-property
-                advance += options.word_spacing;
-            }
-            if let Some(letter_spacing) = options.letter_spacing {
-                advance += letter_spacing;
-            }
+            let mut advance = advance_for_shaped_glyph(
+                Au::from_f64_px(self.glyph_h_advance(glyph_id)),
+                character,
+                options,
+            );
             let offset = prev_glyph_id.map(|prev| {
                 let h_kerning = Au::from_f64_px(self.glyph_h_kerning(prev, glyph_id));
                 advance += h_kerning;
@@ -546,12 +602,19 @@ impl Font {
 
     /// Get the [`FontBaseline`] for this font.
     pub fn baseline(&self) -> Option<FontBaseline> {
-        let this = self as *const Font;
-        self.shaper.get_or_init(|| Shaper::new(this)).baseline()
+        self.shaper.get_or_init(|| Shaper::new(self)).baseline()
     }
 }
 
-pub type FontRef = Arc<Font>;
+#[derive(Clone, MallocSizeOf)]
+pub struct FontRef(#[conditional_malloc_size_of] pub(crate) Arc<Font>);
+
+impl Deref for FontRef {
+    type Target = Arc<Font>;
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
 
 /// A `FontGroup` is a prioritised list of fonts for a given set of font styles. It is used by
 /// `TextRun` to decide which font to render a character with. If none of the fonts listed in the
@@ -914,7 +977,10 @@ pub struct FontBaseline {
 /// ];
 /// let mapped_weight = apply_font_config_to_style_mapping(&mapping, weight as f64);
 /// ```
-#[cfg(any(target_os = "linux", target_os = "macos"))]
+#[cfg(all(
+    any(target_os = "linux", target_os = "macos"),
+    not(target_env = "ohos")
+))]
 pub(crate) fn map_platform_values_to_style_values(mapping: &[(f64, f64)], value: f64) -> f64 {
     if value < mapping[0].0 {
         return mapping[0].1;
@@ -932,3 +998,25 @@ pub(crate) fn map_platform_values_to_style_values(mapping: &[(f64, f64)], value:
 
     mapping[mapping.len() - 1].1
 }
+
+/// Computes the total advance for a glyph, taking `letter-spacing` and `word-spacing` into account.
+pub(super) fn advance_for_shaped_glyph(
+    mut advance: Au,
+    character: char,
+    options: &ShapingOptions,
+) -> Au {
+    if let Some(letter_spacing) = options.letter_spacing {
+        advance += letter_spacing;
+    };
+
+    // CSS 2.1 § 16.4 states that "word spacing affects each space (U+0020) and non-breaking
+    // space (U+00A0) left in the text after the white space processing rules have been
+    // applied. The effect of the property on other word-separator characters is undefined."
+    // We elect to only space the two required code points.
+    if character == ' ' || character == '\u{a0}' {
+        // https://drafts.csswg.org/css-text-3/#word-spacing-property
+        advance += options.word_spacing;
+    }
+
+    advance
+}

components/fonts/font_context.rs

@@ -5,6 +5,7 @@
 use std::collections::{HashMap, HashSet};
 use std::default::Default;
 use std::hash::{BuildHasherDefault, Hash, Hasher};
+use std::ops::Deref;
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
 
@@ -14,12 +15,12 @@ use compositing_traits::CrossProcessCompositorApi;
 use fnv::FnvHasher;
 use fonts_traits::StylesheetWebFontLoadFinishedCallback;
 use log::{debug, trace};
-use malloc_size_of::{MallocSizeOf, MallocSizeOfOps};
 use malloc_size_of_derive::MallocSizeOf;
 use net_traits::request::{Destination, Referrer, RequestBuilder};
 use net_traits::{CoreResourceThread, FetchResponseMsg, ResourceThreads, fetch_async};
 use parking_lot::{Mutex, RwLock};
 use servo_arc::Arc as ServoArc;
+use servo_config::pref;
 use servo_url::ServoUrl;
 use style::Atom;
 use style::computed_values::font_variant_caps::T as FontVariantCaps;
@@ -32,7 +33,7 @@ use style::shared_lock::SharedRwLockReadGuard;
 use style::stylesheets::{CssRule, DocumentStyleSheet, FontFaceRule, StylesheetInDocument};
 use style::values::computed::font::{FamilyName, FontFamilyNameSyntax, SingleFontFamily};
 use url::Url;
-use webrender_api::{FontInstanceFlags, FontInstanceKey, FontKey};
+use webrender_api::{FontInstanceFlags, FontInstanceKey, FontKey, FontVariation};
 
 use crate::font::{
     Font, FontDescriptor, FontFamilyDescriptor, FontGroup, FontRef, FontSearchScope,
@@ -45,12 +46,27 @@ use crate::{FontData, LowercaseFontFamilyName, PlatformFontMethods, SystemFontSe
 
 static SMALL_CAPS_SCALE_FACTOR: f32 = 0.8; // Matches FireFox (see gfxFont.h)
 
+pub type FontParameters = (FontKey, Au, Vec<FontVariation>);
+
+#[derive(MallocSizeOf)]
+struct FontGroupRef(#[conditional_malloc_size_of] Arc<RwLock<FontGroup>>);
+
+impl Deref for FontGroupRef {
+    type Target = Arc<RwLock<FontGroup>>;
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
 /// The FontContext represents the per-thread/thread state necessary for
 /// working with fonts. It is the public API used by the layout and
 /// paint code. It talks directly to the system font service where
 /// required.
+#[derive(MallocSizeOf)]
 pub struct FontContext {
+    #[conditional_malloc_size_of]
     system_font_service_proxy: Arc<SystemFontServiceProxy>,
+
     resource_threads: Mutex<CoreResourceThread>,
 
     /// A sender that can send messages and receive replies from the compositor.
@@ -64,7 +80,7 @@ pub struct FontContext {
     /// resolved [`FontGroup`] which contains information about all fonts that
     /// can be selected with that style.
     resolved_font_groups:
-        RwLock<HashMap<FontGroupCacheKey, Arc<RwLock<FontGroup>>, BuildHasherDefault<FnvHasher>>>,
+        RwLock<HashMap<FontGroupCacheKey, FontGroupRef, BuildHasherDefault<FnvHasher>>>,
 
     web_fonts: CrossThreadFontStore,
 
@@ -74,7 +90,7 @@ pub struct FontContext {
 
     /// A collection of WebRender [`FontInstanceKey`]s generated for the web fonts that
     /// this [`FontContext`] controls.
-    webrender_font_instance_keys: RwLock<HashMap<(FontKey, Au), FontInstanceKey>>,
+    webrender_font_instance_keys: RwLock<HashMap<FontParameters, FontInstanceKey>>,
 
     /// The data for each web font [`FontIdentifier`]. This data might be used by more than one
     /// [`FontTemplate`] as each identifier refers to a URL.
@@ -83,26 +99,6 @@ pub struct FontContext {
     have_removed_web_fonts: AtomicBool,
 }
 
-impl MallocSizeOf for FontContext {
-    fn size_of(&self, ops: &mut MallocSizeOfOps) -> usize {
-        let font_cache_size = self
-            .fonts
-            .read()
-            .iter()
-            .map(|(key, font)| {
-                key.size_of(ops) + font.as_ref().map_or(0, |font| (*font).size_of(ops))
-            })
-            .sum::<usize>();
-        let font_group_cache_size = self
-            .resolved_font_groups
-            .read()
-            .iter()
-            .map(|(key, font_group)| key.size_of(ops) + (*font_group.read()).size_of(ops))
-            .sum::<usize>();
-        font_cache_size + font_group_cache_size
-    }
-}
-
 impl FontContext {
     pub fn new(
         system_font_service_proxy: Arc<SystemFontServiceProxy>,
@@ -116,7 +112,7 @@ impl FontContext {
             compositor_api: Mutex::new(compositor_api),
             fonts: Default::default(),
             resolved_font_groups: Default::default(),
-            web_fonts: Arc::new(RwLock::default()),
+            web_fonts: Default::default(),
             webrender_font_keys: RwLock::default(),
             webrender_font_instance_keys: RwLock::default(),
             have_removed_web_fonts: AtomicBool::new(false),
@@ -152,7 +148,7 @@ impl FontContext {
     ) -> Arc<RwLock<FontGroup>> {
         let cache_key = FontGroupCacheKey { size, style };
         if let Some(font_group) = self.resolved_font_groups.read().get(&cache_key) {
-            return font_group.clone();
+            return font_group.0.clone();
         }
 
         let mut descriptor = FontDescriptor::from(&*cache_key.style);
@@ -161,7 +157,7 @@ impl FontContext {
         let font_group = Arc::new(RwLock::new(FontGroup::new(&cache_key.style, descriptor)));
         self.resolved_font_groups
             .write()
-            .insert(cache_key, font_group.clone());
+            .insert(cache_key, FontGroupRef(font_group.clone()));
         font_group
     }
 
@@ -275,12 +271,12 @@ impl FontContext {
         font_descriptor: FontDescriptor,
         synthesized_small_caps: Option<FontRef>,
     ) -> Result<FontRef, &'static str> {
-        Ok(Arc::new(Font::new(
+        Ok(FontRef(Arc::new(Font::new(
             font_template.clone(),
-            font_descriptor.clone(),
+            font_descriptor,
             self.get_font_data(&font_template.identifier()),
             synthesized_small_caps,
-        )?))
+        )?)))
     }
 
     pub(crate) fn create_font_instance_key(&self, font: &Font) -> FontInstanceKey {
@@ -289,11 +285,13 @@ impl FontContext {
                 font.template.identifier(),
                 font.descriptor.pt_size,
                 font.webrender_font_instance_flags(),
+                font.variations().to_owned(),
             ),
             FontIdentifier::Web(_) => self.create_web_font_instance(
                 font.template.clone(),
                 font.descriptor.pt_size,
                 font.webrender_font_instance_flags(),
+                font.variations().to_owned(),
             ),
         }
     }
@@ -303,6 +301,7 @@ impl FontContext {
         font_template: FontTemplateRef,
         pt_size: Au,
         flags: FontInstanceFlags,
+        variations: Vec<FontVariation>,
     ) -> FontInstanceKey {
         let identifier = font_template.identifier().clone();
         let font_data = self
@@ -322,10 +321,10 @@ impl FontContext {
                 font_key
             });
 
-        let key = *self
+        *self
             .webrender_font_instance_keys
             .write()
-            .entry((font_key, pt_size))
+            .entry((font_key, pt_size, variations.clone()))
             .or_insert_with(|| {
                 let font_instance_key = self.system_font_service_proxy.generate_font_instance_key();
                 self.compositor_api.lock().add_font_instance(
@@ -333,10 +332,10 @@ impl FontContext {
                     font_key,
                     pt_size.to_f32_px(),
                     flags,
+                    variations,
                 );
                 font_instance_key
-            });
-        key
+            })
     }
 
     fn invalidate_font_groups_after_web_font_load(&self) {
@@ -366,10 +365,16 @@ impl FontContext {
         }
 
         if let FontFaceSourceFormat::String(string) = format_hint {
-            return string == "truetype" ||
-                string == "opentype" ||
-                string == "woff" ||
-                string == "woff2";
+            if string == "truetype" || string == "opentype" || string == "woff" || string == "woff2"
+            {
+                return true;
+            }
+
+            return pref!(layout_variable_fonts_enabled) &&
+                (string == "truetype-variations" ||
+                    string == "opentype-variations" ||
+                    string == "woff-variations" ||
+                    string == "woff2-variations");
         }
 
         false
@@ -619,7 +624,7 @@ impl FontContextWebFontMethods for Arc<FontContext> {
         });
 
         let mut removed_instance_keys: HashSet<FontInstanceKey> = HashSet::new();
-        webrender_font_instance_keys.retain(|(font_key, _), instance_key| {
+        webrender_font_instance_keys.retain(|(font_key, _, _), instance_key| {
             if removed_keys.contains(font_key) {
                 removed_instance_keys.insert(*instance_key);
                 false
@@ -864,11 +869,11 @@ impl RemoteWebFontDownloader {
 
         let url: ServoUrl = self.url.clone().into();
         let identifier = FontIdentifier::Web(url.clone());
-        let Ok(handle) = PlatformFont::new_from_data(identifier, &font_data, None) else {
+        let Ok(handle) = PlatformFont::new_from_data(identifier, &font_data, None, &[]) else {
             return false;
         };
-
         let state = self.take_state();
+
         let mut descriptor = handle.descriptor();
         descriptor
             .override_values_with_css_font_template_descriptors(&state.css_font_face_descriptors);

components/fonts/font_store.rs

@@ -3,6 +3,7 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
 use std::collections::HashMap;
+use std::ops::Deref;
 use std::sync::Arc;
 
 use log::warn;
@@ -21,7 +22,16 @@ pub struct FontStore {
     web_fonts_loading_for_stylesheets: Vec<(DocumentStyleSheet, usize)>,
     web_fonts_loading_for_script: usize,
 }
-pub(crate) type CrossThreadFontStore = Arc<RwLock<FontStore>>;
+
+#[derive(Default, MallocSizeOf)]
+pub(crate) struct CrossThreadFontStore(#[conditional_malloc_size_of] Arc<RwLock<FontStore>>);
+
+impl Deref for CrossThreadFontStore {
+    type Target = Arc<RwLock<FontStore>>;
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
 
 impl FontStore {
     pub(crate) fn clear(&mut self) {

components/fonts/glyph.rs

@@ -315,7 +315,7 @@ impl<'a> DetailedGlyphStore {
 
 // This struct is used by GlyphStore clients to provide new glyph data.
 // It should be allocated on the stack and passed by reference to GlyphStore.
-#[derive(Clone, Copy)]
+#[derive(Clone, Copy, Debug)]
 pub struct GlyphData {
     id: GlyphId,
     advance: Au,
@@ -606,7 +606,7 @@ impl GlyphStore {
     pub fn iter_glyphs_for_byte_range(
         &self,
         range: &Range<ByteIndex>,
-    ) -> impl Iterator<Item = GlyphInfo> + use<'_> {
+    ) -> impl Iterator<Item = GlyphInfo<'_>> + use<'_> {
         if range.begin() >= self.len() {
             panic!("iter_glyphs_for_range: range.begin beyond length!");
         }

components/fonts/lib.rs

@@ -11,44 +11,20 @@ mod font_template;
 mod glyph;
 #[allow(unsafe_code)]
 pub mod platform;
-mod shaper;
+mod shapers;
 mod system_font_service;
 
-use std::sync::Arc;
-
 pub use font::*;
 pub use font_context::*;
 pub use font_store::*;
 pub use font_template::*;
+pub use fonts_traits::*;
 pub use glyph::*;
-use ipc_channel::ipc::IpcSharedMemory;
 pub use platform::LocalFontIdentifier;
-pub use shaper::*;
+pub use shapers::*;
 pub use system_font_service::*;
 use unicode_properties::{EmojiStatus, UnicodeEmoji, emoji};
 
-/// A data structure to store data for fonts. Data is stored internally in an
-/// [`IpcSharedMemory`] handle, so that it can be send without serialization
-/// across IPC channels.
-#[derive(Clone)]
-pub struct FontData(pub(crate) Arc<IpcSharedMemory>);
-
-impl FontData {
-    pub fn from_bytes(bytes: &[u8]) -> Self {
-        Self(Arc::new(IpcSharedMemory::from_bytes(bytes)))
-    }
-
-    pub(crate) fn as_ipc_shared_memory(&self) -> Arc<IpcSharedMemory> {
-        self.0.clone()
-    }
-}
-
-impl AsRef<[u8]> for FontData {
-    fn as_ref(&self) -> &[u8] {
-        &self.0
-    }
-}
-
 /// Whether or not font fallback selection prefers the emoji or text representation
 /// of a character. If `None` then either presentation is acceptable.
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -106,6 +82,7 @@ impl FallbackFontSelectionOptions {
     }
 }
 
+#[cfg(feature = "harfbuzz")]
 pub(crate) fn float_to_fixed(before: usize, f: f64) -> i32 {
     ((1i32 << before) as f64 * f) as i32
 }

components/fonts/platform/freetype/font.rs

@@ -4,28 +4,22 @@
 
 use std::ffi::CString;
 use std::fs::File;
-use std::os::raw::c_long;
-use std::{mem, ptr};
 
 use app_units::Au;
 use euclid::default::{Point2D, Rect, Size2D};
 use freetype_sys::{
-    FT_Byte, FT_Done_Face, FT_Error, FT_F26Dot6, FT_FACE_FLAG_COLOR, FT_FACE_FLAG_FIXED_SIZES,
-    FT_FACE_FLAG_SCALABLE, FT_Face, FT_Get_Char_Index, FT_Get_Kerning, FT_GlyphSlot, FT_Int32,
-    FT_KERNING_DEFAULT, FT_LOAD_COLOR, FT_LOAD_DEFAULT, FT_LOAD_NO_HINTING, FT_Load_Glyph, FT_Long,
-    FT_New_Face, FT_New_Memory_Face, FT_Pos, FT_Select_Size, FT_Set_Char_Size, FT_Size_Metrics,
-    FT_SizeRec, FT_UInt, FT_ULong, FT_Vector,
+    FT_F26Dot6, FT_Get_Char_Index, FT_Get_Kerning, FT_GlyphSlot, FT_KERNING_DEFAULT,
+    FT_LOAD_DEFAULT, FT_LOAD_NO_HINTING, FT_Load_Glyph, FT_Size_Metrics, FT_SizeRec, FT_UInt,
+    FT_ULong, FT_Vector,
 };
 use log::debug;
 use memmap2::Mmap;
 use parking_lot::ReentrantMutex;
-use read_fonts::tables::os2::SelectionFlags;
+use read_fonts::types::Tag;
 use read_fonts::{FontRef, ReadError, TableProvider};
+use servo_arc::Arc;
 use style::Zero;
-use style::computed_values::font_stretch::T as FontStretch;
-use style::computed_values::font_weight::T as FontWeight;
-use style::values::computed::font::FontStyle;
-use webrender_api::FontInstanceFlags;
+use webrender_api::{FontInstanceFlags, FontVariation};
 
 use super::LocalFontIdentifier;
 use super::library_handle::FreeTypeLibraryHandle;
@@ -35,13 +29,9 @@ use crate::font::{
 };
 use crate::font_template::FontTemplateDescriptor;
 use crate::glyph::GlyphId;
+use crate::platform::freetype::freetype_face::FreeTypeFace;
 use crate::system_font_service::FontIdentifier;
 
-// This constant is not present in the freetype
-// bindings due to bindgen not handling the way
-// the macro is defined.
-const FT_LOAD_TARGET_LIGHT: FT_UInt = 1 << 16;
-
 /// Convert FreeType-style 26.6 fixed point to an [`f64`].
 fn fixed_26_dot_6_to_float(fixed: FT_F26Dot6) -> f64 {
     fixed as f64 / 64.0
@@ -49,70 +39,44 @@ fn fixed_26_dot_6_to_float(fixed: FT_F26Dot6) -> f64 {
 
 #[derive(Debug)]
 pub struct FontTable {
-    buffer: Vec<u8>,
+    data: FreeTypeFaceTableProviderData,
+    tag: Tag,
 }
 
 impl FontTableMethods for FontTable {
     fn buffer(&self) -> &[u8] {
-        &self.buffer
+        let font_ref = self.data.font_ref().expect("Font checked before creating");
+        let table_data = font_ref
+            .table_data(self.tag)
+            .expect("Table existence checked before creating");
+        table_data.as_bytes()
     }
 }
 
 #[derive(Debug)]
 #[allow(unused)]
 pub struct PlatformFont {
-    face: ReentrantMutex<FT_Face>,
+    face: ReentrantMutex<FreeTypeFace>,
     requested_face_size: Au,
     actual_face_size: Au,
+    variations: Vec<FontVariation>,
 
     /// A member that allows using `skrifa` to read values from this font.
     table_provider_data: FreeTypeFaceTableProviderData,
 }
 
-// FT_Face can be used in multiple threads, but from only one thread at a time.
-// It's protected with a ReentrantMutex for PlatformFont.
-// See https://freetype.org/freetype2/docs/reference/ft2-face_creation.html#ft_face.
-unsafe impl Sync for PlatformFont {}
-unsafe impl Send for PlatformFont {}
-
-impl Drop for PlatformFont {
-    fn drop(&mut self) {
-        let face = self.face.lock();
-        assert!(!face.is_null());
-        unsafe {
-            // The FreeType documentation says that both `FT_New_Face` and `FT_Done_Face`
-            // should be protected by a mutex.
-            // See https://freetype.org/freetype2/docs/reference/ft2-library_setup.html.
-            let _guard = FreeTypeLibraryHandle::get().lock();
-            if FT_Done_Face(*face) != 0 {
-                panic!("FT_Done_Face failed");
-            }
-        }
-    }
-}
-
 impl PlatformFontMethods for PlatformFont {
     fn new_from_data(
         _font_identifier: FontIdentifier,
         font_data: &FontData,
         requested_size: Option<Au>,
+        variations: &[FontVariation],
     ) -> Result<PlatformFont, &'static str> {
         let library = FreeTypeLibraryHandle::get().lock();
         let data: &[u8] = font_data.as_ref();
-        let mut face: FT_Face = ptr::null_mut();
-        let result = unsafe {
-            FT_New_Memory_Face(
-                library.freetype_library,
-                data.as_ptr(),
-                data.len() as FT_Long,
-                0, /* face_index */
-                &mut face,
-            )
-        };
+        let face = FreeTypeFace::new_from_memory(&library, data)?;
 
-        if 0 != result || face.is_null() {
-            return Err("Could not create FreeType face");
-        }
+        let normalized_variations = face.set_variations_for_font(variations, &library)?;
 
         let (requested_face_size, actual_face_size) = match requested_size {
             Some(requested_size) => (requested_size, face.set_size(requested_size)?),
@@ -124,29 +88,21 @@ impl PlatformFontMethods for PlatformFont {
             requested_face_size,
             actual_face_size,
             table_provider_data: FreeTypeFaceTableProviderData::Web(font_data.clone()),
+            variations: normalized_variations,
         })
     }
 
     fn new_from_local_font_identifier(
         font_identifier: LocalFontIdentifier,
         requested_size: Option<Au>,
+        variations: &[FontVariation],
     ) -> Result<PlatformFont, &'static str> {
-        let mut face: FT_Face = ptr::null_mut();
         let library = FreeTypeLibraryHandle::get().lock();
         let filename = CString::new(&*font_identifier.path).expect("filename contains NUL byte!");
 
-        let result = unsafe {
-            FT_New_Face(
-                library.freetype_library,
-                filename.as_ptr(),
-                font_identifier.index() as FT_Long,
-                &mut face,
-            )
-        };
+        let face = FreeTypeFace::new_from_file(&library, &filename, font_identifier.index())?;
 
-        if 0 != result || face.is_null() {
-            return Err("Could not create FreeType face");
-        }
+        let normalized_variations = face.set_variations_for_font(variations, &library)?;
 
         let (requested_face_size, actual_face_size) = match requested_size {
             Some(requested_size) => (requested_size, face.set_size(requested_size)?),
@@ -164,9 +120,10 @@ impl PlatformFontMethods for PlatformFont {
             requested_face_size,
             actual_face_size,
             table_provider_data: FreeTypeFaceTableProviderData::Local(
-                memory_mapped_font_data,
+                Arc::new(memory_mapped_font_data),
                 font_identifier.index(),
             ),
+            variations: normalized_variations,
         })
     }
 
@@ -174,39 +131,17 @@ impl PlatformFontMethods for PlatformFont {
         let Ok(font_ref) = self.table_provider_data.font_ref() else {
             return FontTemplateDescriptor::default();
         };
-
         let Ok(os2) = font_ref.os2() else {
             return FontTemplateDescriptor::default();
         };
-
-        let mut style = FontStyle::NORMAL;
-        if os2.fs_selection().contains(SelectionFlags::ITALIC) {
-            style = FontStyle::ITALIC;
-        }
-
-        let weight = FontWeight::from_float(os2.us_weight_class() as f32);
-        let stretch = match os2.us_width_class() {
-            1 => FontStretch::ULTRA_CONDENSED,
-            2 => FontStretch::EXTRA_CONDENSED,
-            3 => FontStretch::CONDENSED,
-            4 => FontStretch::SEMI_CONDENSED,
-            5 => FontStretch::NORMAL,
-            6 => FontStretch::SEMI_EXPANDED,
-            7 => FontStretch::EXPANDED,
-            8 => FontStretch::EXTRA_EXPANDED,
-            9 => FontStretch::ULTRA_EXPANDED,
-            _ => FontStretch::NORMAL,
-        };
-
-        FontTemplateDescriptor::new(weight, stretch, style)
+        Self::descriptor_from_os2_table(&os2)
     }
 
     fn glyph_index(&self, codepoint: char) -> Option<GlyphId> {
         let face = self.face.lock();
-        assert!(!face.is_null());
 
         unsafe {
-            let idx = FT_Get_Char_Index(*face, codepoint as FT_ULong);
+            let idx = FT_Get_Char_Index(face.as_ptr(), codepoint as FT_ULong);
             if idx != 0 as FT_UInt {
                 Some(idx as GlyphId)
             } else {
@@ -221,12 +156,11 @@ impl PlatformFontMethods for PlatformFont {
 
     fn glyph_h_kerning(&self, first_glyph: GlyphId, second_glyph: GlyphId) -> FractionalPixel {
         let face = self.face.lock();
-        assert!(!face.is_null());
 
         let mut delta = FT_Vector { x: 0, y: 0 };
         unsafe {
             FT_Get_Kerning(
-                *face,
+                face.as_ptr(),
                 first_glyph,
                 second_glyph,
                 FT_KERNING_DEFAULT,
@@ -238,16 +172,15 @@ impl PlatformFontMethods for PlatformFont {
 
     fn glyph_h_advance(&self, glyph: GlyphId) -> Option<FractionalPixel> {
         let face = self.face.lock();
-        assert!(!face.is_null());
 
         let load_flags = face.glyph_load_flags();
-        let result = unsafe { FT_Load_Glyph(*face, glyph as FT_UInt, load_flags) };
+        let result = unsafe { FT_Load_Glyph(face.as_ptr(), glyph as FT_UInt, load_flags) };
         if 0 != result {
             debug!("Unable to load glyph {}. reason: {:?}", glyph, result);
             return None;
         }
 
-        let void_glyph = unsafe { (**face).glyph };
+        let void_glyph = face.as_ref().glyph;
         let slot: FT_GlyphSlot = void_glyph;
         assert!(!slot.is_null());
 
@@ -256,12 +189,11 @@ impl PlatformFontMethods for PlatformFont {
     }
 
     fn metrics(&self) -> FontMetrics {
-        let face_ptr = *self.face.lock();
-        let face = unsafe { &*face_ptr };
+        let face = self.face.lock();
         let font_ref = self.table_provider_data.font_ref();
 
         // face.size is a *c_void in the bindings, presumably to avoid recursive structural types
-        let freetype_size: &FT_SizeRec = unsafe { mem::transmute(&(*face.size)) };
+        let freetype_size: &FT_SizeRec = unsafe { &*face.as_ref().size };
         let freetype_metrics: &FT_Size_Metrics = &(freetype_size).metrics;
 
         let mut max_advance;
@@ -270,7 +202,7 @@ impl PlatformFontMethods for PlatformFont {
         let mut line_height;
         let mut y_scale = 0.0;
         let mut em_height;
-        if face_ptr.scalable() {
+        if face.scalable() {
             // Prefer FT_Size_Metrics::y_scale to y_ppem as y_ppem does not have subpixel accuracy.
             //
             // FT_Size_Metrics::y_scale is in 16.16 fixed point format.  Its (fractional) value is a
@@ -280,11 +212,11 @@ impl PlatformFontMethods for PlatformFont {
             // This converts the value to a float without losing precision.
             y_scale = freetype_metrics.y_scale as f64 / 65535.0 / 64.0;
 
-            max_advance = (face.max_advance_width as f64) * y_scale;
-            max_ascent = (face.ascender as f64) * y_scale;
-            max_descent = -(face.descender as f64) * y_scale;
-            line_height = (face.height as f64) * y_scale;
-            em_height = (face.units_per_EM as f64) * y_scale;
+            max_advance = (face.as_ref().max_advance_width as f64) * y_scale;
+            max_ascent = (face.as_ref().ascender as f64) * y_scale;
+            max_descent = -(face.as_ref().descender as f64) * y_scale;
+            line_height = (face.as_ref().height as f64) * y_scale;
+            em_height = (face.as_ref().units_per_EM as f64) * y_scale;
         } else {
             max_advance = fixed_26_dot_6_to_float(freetype_metrics.max_advance);
             max_ascent = fixed_26_dot_6_to_float(freetype_metrics.ascender);
@@ -300,7 +232,7 @@ impl PlatformFontMethods for PlatformFont {
                 // Bug 1267909 - Even if the font is not explicitly scalable, if the face has color
                 // bitmaps, it should be treated as scalable and scaled to the desired size. Metrics
                 // based on y_ppem need to be rescaled for the adjusted size.
-                if face_ptr.color() {
+                if face.color() {
                     em_height = self.requested_face_size.to_f64_px();
                     let adjust_scale = em_height / (freetype_metrics.y_ppem as f64);
                     max_advance *= adjust_scale;
@@ -320,8 +252,8 @@ impl PlatformFontMethods for PlatformFont {
         // Convert using a formula similar to what CTFont returns for consistency.
         let leading = line_height - (max_ascent + max_descent);
 
-        let underline_size = face.underline_thickness as f64 * y_scale;
-        let underline_offset = face.underline_position as f64 * y_scale + 0.5;
+        let underline_size = face.as_ref().underline_thickness as f64 * y_scale;
+        let underline_offset = face.as_ref().underline_position as f64 * y_scale + 0.5;
 
         // The default values for strikeout size and offset. Use OpenType spec's suggested position
         // for Roman font as the default for offset.
@@ -393,36 +325,26 @@ impl PlatformFontMethods for PlatformFont {
     }
 
     fn table_for_tag(&self, tag: FontTableTag) -> Option<FontTable> {
-        let face = self.face.lock();
-        let tag = tag as FT_ULong;
-
-        unsafe {
-            // Get the length
-            let mut len = 0;
-            if 0 != FT_Load_Sfnt_Table(*face, tag, 0, ptr::null_mut(), &mut len) {
-                return None;
-            }
-            // Get the bytes
-            let mut buf = vec![0u8; len as usize];
-            if 0 != FT_Load_Sfnt_Table(*face, tag, 0, buf.as_mut_ptr(), &mut len) {
-                return None;
-            }
-            Some(FontTable { buffer: buf })
-        }
+        let tag = Tag::from_u32(tag);
+        let font_ref = self.table_provider_data.font_ref().ok()?;
+        let _table_data = font_ref.table_data(tag)?;
+        Some(FontTable {
+            data: self.table_provider_data.clone(),
+            tag,
+        })
     }
 
     fn typographic_bounds(&self, glyph_id: GlyphId) -> Rect<f32> {
         let face = self.face.lock();
-        assert!(!face.is_null());
 
         let load_flags = FT_LOAD_DEFAULT | FT_LOAD_NO_HINTING;
-        let result = unsafe { FT_Load_Glyph(*face, glyph_id as FT_UInt, load_flags) };
+        let result = unsafe { FT_Load_Glyph(face.as_ptr(), glyph_id as FT_UInt, load_flags) };
         if 0 != result {
             debug!("Unable to load glyph {}. reason: {:?}", glyph_id, result);
             return Rect::default();
         }
 
-        let metrics = unsafe { &(*(**face).glyph).metrics };
+        let metrics = unsafe { &(*face.as_ref().glyph).metrics };
 
         Rect::new(
             Point2D::new(
@@ -439,6 +361,10 @@ impl PlatformFontMethods for PlatformFont {
         // loading bitmaps. There's no harm to always passing it.
         FontInstanceFlags::EMBEDDED_BITMAPS
     }
+
+    fn variations(&self) -> &[FontVariation] {
+        &self.variations
+    }
 }
 
 impl PlatformFont {
@@ -450,104 +376,16 @@ impl PlatformFont {
     }
 }
 
-trait FreeTypeFaceHelpers {
-    fn scalable(self) -> bool;
-    fn color(self) -> bool;
-    fn set_size(self, pt_size: Au) -> Result<Au, &'static str>;
-    fn glyph_load_flags(self) -> FT_Int32;
-}
-
-impl FreeTypeFaceHelpers for FT_Face {
-    fn scalable(self) -> bool {
-        unsafe { (*self).face_flags & FT_FACE_FLAG_SCALABLE as c_long != 0 }
-    }
-
-    fn color(self) -> bool {
-        unsafe { (*self).face_flags & FT_FACE_FLAG_COLOR as c_long != 0 }
-    }
-
-    fn set_size(self, requested_size: Au) -> Result<Au, &'static str> {
-        if self.scalable() {
-            let size_in_fixed_point = (requested_size.to_f64_px() * 64.0 + 0.5) as FT_F26Dot6;
-            let result = unsafe { FT_Set_Char_Size(self, size_in_fixed_point, 0, 72, 72) };
-            if 0 != result {
-                return Err("FT_Set_Char_Size failed");
-            }
-            return Ok(requested_size);
-        }
-
-        let requested_size = (requested_size.to_f64_px() * 64.0) as FT_Pos;
-        let get_size_at_index = |index| unsafe {
-            (
-                (*(*self).available_sizes.offset(index as isize)).x_ppem,
-                (*(*self).available_sizes.offset(index as isize)).y_ppem,
-            )
-        };
-
-        let mut best_index = 0;
-        let mut best_size = get_size_at_index(0);
-        let mut best_dist = best_size.1 - requested_size;
-        for strike_index in 1..unsafe { (*self).num_fixed_sizes } {
-            let new_scale = get_size_at_index(strike_index);
-            let new_distance = new_scale.1 - requested_size;
-
-            // Distance is positive if strike is larger than desired size,
-            // or negative if smaller. If previously a found smaller strike,
-            // then prefer a larger strike. Otherwise, minimize distance.
-            if (best_dist < 0 && new_distance >= best_dist) || new_distance.abs() <= best_dist {
-                best_dist = new_distance;
-                best_size = new_scale;
-                best_index = strike_index;
-            }
-        }
-
-        if 0 == unsafe { FT_Select_Size(self, best_index) } {
-            Ok(Au::from_f64_px(best_size.1 as f64 / 64.0))
-        } else {
-            Err("FT_Select_Size failed")
-        }
-    }
-
-    fn glyph_load_flags(self) -> FT_Int32 {
-        let mut load_flags = FT_LOAD_DEFAULT;
-
-        // Default to slight hinting, which is what most
-        // Linux distros use by default, and is a better
-        // default than no hinting.
-        // TODO(gw): Make this configurable.
-        load_flags |= FT_LOAD_TARGET_LIGHT as i32;
-
-        let face_flags = unsafe { (*self).face_flags };
-        if (face_flags & (FT_FACE_FLAG_FIXED_SIZES as FT_Long)) != 0 {
-            // We only set FT_LOAD_COLOR if there are bitmap strikes; COLR (color-layer) fonts
-            // will be handled internally in Servo. In that case WebRender will just be asked to
-            // paint individual layers.
-            load_flags |= FT_LOAD_COLOR;
-        }
-
-        load_flags as FT_Int32
-    }
-}
-
-unsafe extern "C" {
-    fn FT_Load_Sfnt_Table(
-        face: FT_Face,
-        tag: FT_ULong,
-        offset: FT_Long,
-        buffer: *mut FT_Byte,
-        length: *mut FT_ULong,
-    ) -> FT_Error;
-}
-
+#[derive(Clone)]
 enum FreeTypeFaceTableProviderData {
     Web(FontData),
-    Local(Mmap, u32),
+    Local(Arc<Mmap>, u32),
 }
 
 impl FreeTypeFaceTableProviderData {
     fn font_ref(&self) -> Result<FontRef<'_>, ReadError> {
         match self {
-            Self::Web(ipc_shared_memory) => FontRef::new(&ipc_shared_memory.0),
+            Self::Web(ipc_shared_memory) => FontRef::new(ipc_shared_memory.as_ref()),
             Self::Local(mmap, index) => FontRef::from_index(mmap, *index),
         }
     }

components/fonts/platform/freetype/freetype_face.rs

@@ -0,0 +1,254 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+use std::ffi::{CStr, c_long};
+use std::ptr;
+
+use app_units::Au;
+use freetype_sys::{
+    FT_Done_Face, FT_Done_MM_Var, FT_F26Dot6, FT_FACE_FLAG_COLOR, FT_FACE_FLAG_FIXED_SIZES,
+    FT_FACE_FLAG_SCALABLE, FT_Face, FT_FaceRec, FT_Fixed, FT_Get_MM_Var, FT_HAS_MULTIPLE_MASTERS,
+    FT_Int32, FT_LOAD_COLOR, FT_LOAD_DEFAULT, FT_Long, FT_MM_Var, FT_New_Face, FT_New_Memory_Face,
+    FT_Pos, FT_Select_Size, FT_Set_Char_Size, FT_Set_Var_Design_Coordinates, FT_UInt,
+    FTErrorMethods,
+};
+use webrender_api::FontVariation;
+
+use crate::platform::freetype::library_handle::FreeTypeLibraryHandle;
+
+// This constant is not present in the freetype
+// bindings due to bindgen not handling the way
+// the macro is defined.
+const FT_LOAD_TARGET_LIGHT: FT_UInt = 1 << 16;
+
+/// A safe wrapper around [FT_Face].
+#[derive(Debug)]
+pub(crate) struct FreeTypeFace {
+    /// ## Safety Invariant
+    /// The pointer must have been returned from [FT_New_Face] or [FT_New_Memory_Face]
+    /// and must not be freed before `FreetypeFace::drop` is called.
+    face: ptr::NonNull<FT_FaceRec>,
+}
+
+impl FreeTypeFace {
+    pub(crate) fn new_from_memory(
+        library: &FreeTypeLibraryHandle,
+        data: &[u8],
+    ) -> Result<Self, &'static str> {
+        let mut face = ptr::null_mut();
+        let result = unsafe {
+            FT_New_Memory_Face(
+                library.freetype_library,
+                data.as_ptr(),
+                data.len() as FT_Long,
+                0,
+                &mut face,
+            )
+        };
+
+        if 0 != result {
+            return Err("Could not create FreeType face");
+        }
+        let Some(face) = ptr::NonNull::new(face) else {
+            return Err("Could not create FreeType face");
+        };
+
+        Ok(Self { face })
+    }
+
+    pub(crate) fn new_from_file(
+        library: &FreeTypeLibraryHandle,
+        filename: &CStr,
+        index: u32,
+    ) -> Result<Self, &'static str> {
+        let mut face = ptr::null_mut();
+        let result = unsafe {
+            FT_New_Face(
+                library.freetype_library,
+                filename.as_ptr(),
+                index as FT_Long,
+                &mut face,
+            )
+        };
+
+        if 0 != result {
+            return Err("Could not create FreeType face");
+        }
+        let Some(face) = ptr::NonNull::new(face) else {
+            return Err("Could not create FreeType face");
+        };
+
+        Ok(Self { face })
+    }
+
+    pub(crate) fn as_ref(&self) -> &FT_FaceRec {
+        unsafe { self.face.as_ref() }
+    }
+
+    pub(crate) fn as_ptr(&self) -> FT_Face {
+        self.face.as_ptr()
+    }
+
+    /// Return true iff the font face flags contain [FT_FACE_FLAG_SCALABLE].
+    pub(crate) fn scalable(&self) -> bool {
+        self.as_ref().face_flags & FT_FACE_FLAG_SCALABLE as c_long != 0
+    }
+
+    /// Return true iff the font face flags contain [FT_FACE_FLAG_COLOR].
+    pub(crate) fn color(&self) -> bool {
+        self.as_ref().face_flags & FT_FACE_FLAG_COLOR as c_long != 0
+    }
+
+    /// Scale the font to the given size if it is scalable, or select the closest
+    /// available size if it is not, preferring larger sizes over smaller ones.
+    ///
+    /// Returns the selected size on success and a error message on failure
+    pub(crate) fn set_size(&self, requested_size: Au) -> Result<Au, &'static str> {
+        if self.scalable() {
+            let size_in_fixed_point = (requested_size.to_f64_px() * 64.0 + 0.5) as FT_F26Dot6;
+            let result =
+                unsafe { FT_Set_Char_Size(self.face.as_ptr(), size_in_fixed_point, 0, 72, 72) };
+            if 0 != result {
+                return Err("FT_Set_Char_Size failed");
+            }
+            return Ok(requested_size);
+        }
+
+        let requested_size = (requested_size.to_f64_px() * 64.0) as FT_Pos;
+        let get_size_at_index = |index| unsafe {
+            (
+                (*self.as_ref().available_sizes.offset(index as isize)).x_ppem,
+                (*self.as_ref().available_sizes.offset(index as isize)).y_ppem,
+            )
+        };
+
+        let mut best_index = 0;
+        let mut best_size = get_size_at_index(0);
+        let mut best_dist = best_size.1 - requested_size;
+        for strike_index in 1..self.as_ref().num_fixed_sizes {
+            let new_scale = get_size_at_index(strike_index);
+            let new_distance = new_scale.1 - requested_size;
+
+            // Distance is positive if strike is larger than desired size,
+            // or negative if smaller. If previously a found smaller strike,
+            // then prefer a larger strike. Otherwise, minimize distance.
+            if (best_dist < 0 && new_distance >= best_dist) || new_distance.abs() <= best_dist {
+                best_dist = new_distance;
+                best_size = new_scale;
+                best_index = strike_index;
+            }
+        }
+
+        if 0 == unsafe { FT_Select_Size(self.face.as_ptr(), best_index) } {
+            Ok(Au::from_f64_px(best_size.1 as f64 / 64.0))
+        } else {
+            Err("FT_Select_Size failed")
+        }
+    }
+
+    /// Select a reasonable set of glyph loading flags for the font.
+    pub(crate) fn glyph_load_flags(&self) -> FT_Int32 {
+        let mut load_flags = FT_LOAD_DEFAULT;
+
+        // Default to slight hinting, which is what most
+        // Linux distros use by default, and is a better
+        // default than no hinting.
+        // TODO(gw): Make this configurable.
+        load_flags |= FT_LOAD_TARGET_LIGHT as i32;
+
+        let face_flags = self.as_ref().face_flags;
+        if (face_flags & (FT_FACE_FLAG_FIXED_SIZES as FT_Long)) != 0 {
+            // We only set FT_LOAD_COLOR if there are bitmap strikes; COLR (color-layer) fonts
+            // will be handled internally in Servo. In that case WebRender will just be asked to
+            // paint individual layers.
+            load_flags |= FT_LOAD_COLOR;
+        }
+
+        load_flags as FT_Int32
+    }
+
+    /// Applies to provided variations to the font face.
+    ///
+    /// Returns the normalized font variations, which are clamped
+    /// to fit within the range of their respective axis. Variation
+    /// values for nonexistent axes are not included.
+    pub(crate) fn set_variations_for_font(
+        &self,
+        variations: &[FontVariation],
+        library: &FreeTypeLibraryHandle,
+    ) -> Result<Vec<FontVariation>, &'static str> {
+        if !FT_HAS_MULTIPLE_MASTERS(self.as_ptr()) ||
+            variations.is_empty() ||
+            !servo_config::pref!(layout_variable_fonts_enabled)
+        {
+            // Nothing to do
+            return Ok(vec![]);
+        }
+
+        // Query variation axis of font
+        let mut mm_var: *mut FT_MM_Var = ptr::null_mut();
+        let result = unsafe { FT_Get_MM_Var(self.as_ptr(), &mut mm_var as *mut _) };
+        if !result.succeeded() {
+            return Err("Failed to query font variations");
+        }
+
+        // Prepare values for each axis. These are either the provided values (if any) or the default
+        // ones for the axis.
+        let num_axis = unsafe { (*mm_var).num_axis } as usize;
+        let mut normalized_axis_values = Vec::with_capacity(variations.len());
+        let mut coords = vec![0; num_axis];
+        for (index, coord) in coords.iter_mut().enumerate() {
+            let axis_data = unsafe { &*(*mm_var).axis.add(index) };
+            let Some(variation) = variations
+                .iter()
+                .find(|variation| variation.tag == axis_data.tag as u32)
+            else {
+                *coord = axis_data.def;
+                continue;
+            };
+
+            // Freetype uses a 16.16 fixed point format for variation values
+            let shift_factor = 16.0_f32.exp2();
+            let min_value = axis_data.minimum as f32 / shift_factor;
+            let max_value = axis_data.maximum as f32 / shift_factor;
+            normalized_axis_values.push(FontVariation {
+                tag: variation.tag,
+                value: variation.value.min(max_value).max(min_value),
+            });
+
+            *coord = (variation.value * shift_factor) as FT_Fixed;
+        }
+
+        // Free the MM_Var structure
+        unsafe {
+            FT_Done_MM_Var(library.freetype_library, mm_var);
+        }
+
+        // Set the values for each variation axis
+        let result = unsafe {
+            FT_Set_Var_Design_Coordinates(self.as_ptr(), coords.len() as u32, coords.as_ptr())
+        };
+        if !result.succeeded() {
+            return Err("Could not set variations for font face");
+        }
+
+        Ok(normalized_axis_values)
+    }
+}
+
+/// FT_Face can be used in multiple threads, but from only one thread at a time.
+/// See <https://freetype.org/freetype2/docs/reference/ft2-face_creation.html#ft_face>.
+unsafe impl Send for FreeTypeFace {}
+
+impl Drop for FreeTypeFace {
+    fn drop(&mut self) {
+        // The FreeType documentation says that both `FT_New_Face` and `FT_Done_Face`
+        // should be protected by a mutex.
+        // See https://freetype.org/freetype2/docs/reference/ft2-library_setup.html.
+        let _guard = FreeTypeLibraryHandle::get().lock();
+        if unsafe { FT_Done_Face(self.face.as_ptr()) } != 0 {
+            panic!("FT_Done_Face failed");
+        }
+    }
+}

components/fonts/platform/freetype/library_handle.rs

@@ -11,12 +11,12 @@ use freetype_sys::{
     FT_Add_Default_Modules, FT_Done_Library, FT_Library, FT_Memory, FT_MemoryRec, FT_New_Library,
 };
 use malloc_size_of::{MallocSizeOf, MallocSizeOfOps};
-use parking_lot::Mutex;
+use parking_lot::ReentrantMutex;
 use servo_allocator::libc_compat::{free, malloc, realloc};
 use servo_allocator::usable_size;
 
 static FREETYPE_MEMORY_USAGE: AtomicUsize = AtomicUsize::new(0);
-static FREETYPE_LIBRARY_HANDLE: OnceLock<Mutex<FreeTypeLibraryHandle>> = OnceLock::new();
+static FREETYPE_LIBRARY_HANDLE: OnceLock<ReentrantMutex<FreeTypeLibraryHandle>> = OnceLock::new();
 
 extern "C" fn ft_alloc(_: FT_Memory, req_size: c_long) -> *mut c_void {
     unsafe {
@@ -90,7 +90,7 @@ impl FreeTypeLibraryHandle {
     /// > also, as long as a mutex lock is used around FT_New_Face and FT_Done_Face.
     ///
     /// See <https://freetype.org/freetype2/docs/reference/ft2-library_setup.html>.
-    pub(crate) fn get() -> &'static Mutex<FreeTypeLibraryHandle> {
+    pub(crate) fn get() -> &'static ReentrantMutex<FreeTypeLibraryHandle> {
         FREETYPE_LIBRARY_HANDLE.get_or_init(|| {
             let freetype_memory = Box::into_raw(Box::new(FT_MemoryRec {
                 user: ptr::null_mut(),
@@ -105,7 +105,7 @@ impl FreeTypeLibraryHandle {
                     panic!("Unable to initialize FreeType library");
                 }
                 FT_Add_Default_Modules(freetype_library);
-                Mutex::new(FreeTypeLibraryHandle {
+                ReentrantMutex::new(FreeTypeLibraryHandle {
                     freetype_library,
                     freetype_memory,
                 })

components/fonts/platform/freetype/mod.rs

@@ -13,7 +13,10 @@ use serde::{Deserialize, Serialize};
 use style::Atom;
 use webrender_api::NativeFontHandle;
 
+use crate::{FontData, FontDataAndIndex};
+
 pub mod font;
+mod freetype_face;
 
 #[cfg(all(target_os = "linux", not(target_env = "ohos"), not(ohos_mock)))]
 pub mod font_list;
@@ -56,9 +59,14 @@ impl LocalFontIdentifier {
         }
     }
 
-    pub(crate) fn read_data_from_file(&self) -> Option<Vec<u8>> {
+    pub(crate) fn font_data_and_index(&self) -> Option<FontDataAndIndex> {
         let file = File::open(Path::new(&*self.path)).ok()?;
         let mmap = unsafe { Mmap::map(&file).ok()? };
-        Some(mmap[..].to_vec())
+        let data = FontData::from_bytes(&mmap);
+
+        Some(FontDataAndIndex {
+            data,
+            index: self.variation_index as u32,
+        })
     }
 }

components/fonts/platform/macos/core_text_font_cache.rs

@@ -7,16 +7,17 @@ use std::sync::{Arc, OnceLock};
 
 use app_units::Au;
 use core_foundation::base::TCFType;
-use core_foundation::string::CFString;
+use core_foundation::data::CFData;
+use core_foundation::number::CFNumber;
+use core_foundation::string::{CFString, CFStringRef};
 use core_foundation::url::{CFURL, kCFURLPOSIXPathStyle};
-use core_graphics::data_provider::CGDataProvider;
 use core_graphics::display::CFDictionary;
-use core_graphics::font::CGFont;
-use core_text::font::CTFont;
-use core_text::font_descriptor::kCTFontURLAttribute;
+use core_text::font_descriptor::{kCTFontURLAttribute, kCTFontVariationAttribute};
 use parking_lot::RwLock;
+use webrender_api::FontVariation;
 
 use crate::FontData;
+use crate::platform::font::PlatformFont;
 use crate::system_font_service::FontIdentifier;
 
 /// A cache of `CTFont` to avoid having to create `CTFont` instances over and over. It is
@@ -29,28 +30,62 @@ static CACHE: CoreTextFontCache = CoreTextFontCache(OnceLock::new());
 
 /// A [`HashMap`] of cached [`CTFont`] for a single [`FontIdentifier`]. There is one [`CTFont`]
 /// for each cached font size.
-type CachedCTFont = HashMap<Au, CTFont>;
+type CachedCTFont = HashMap<CoreTextFontCacheKey, PlatformFont>;
+
+#[derive(Eq, Hash, PartialEq)]
+struct CoreTextFontCacheKey {
+    size: Au,
+    variations: Vec<FontVariation>,
+}
 
 impl CoreTextFontCache {
     pub(crate) fn core_text_font(
         font_identifier: FontIdentifier,
         data: Option<&FontData>,
         pt_size: f64,
-    ) -> Option<CTFont> {
+        variations: &[FontVariation],
+    ) -> Option<PlatformFont> {
         //// If you pass a zero font size to one of the Core Text APIs, it'll replace it with
         //// 12.0. We don't want that! (Issue #10492.)
         let clamped_pt_size = pt_size.max(0.01);
         let au_size = Au::from_f64_px(clamped_pt_size);
 
+        let key = CoreTextFontCacheKey {
+            size: au_size,
+            variations: variations.to_owned(),
+        };
+
         let cache = CACHE.0.get_or_init(Default::default);
         {
             let cache = cache.read();
-            if let Some(core_text_font) = cache
+            if let Some(platform_font) = cache
                 .get(&font_identifier)
-                .and_then(|identifier_cache| identifier_cache.get(&au_size))
+                .and_then(|identifier_cache| identifier_cache.get(&key))
             {
+                return Some(platform_font.clone());
+            }
+        }
+
+        if !key.variations.is_empty() {
+            let core_text_font_no_variations =
+                Self::core_text_font(font_identifier.clone(), data, clamped_pt_size, &[])?;
+            let mut cache = cache.write();
+            let entry = cache.entry(font_identifier.clone()).or_default();
+
+            // It could be that between the time of the cache miss above and now, after the write lock
+            // on the cache has been acquired, the cache was populated with the data that we need. Thus
+            // check again and return the CTFont if it is is already cached.
+            if let Some(core_text_font) = entry.get(&key) {
                 return Some(core_text_font.clone());
             }
+
+            let platform_font = Self::add_variations_to_font(
+                core_text_font_no_variations,
+                &key.variations,
+                clamped_pt_size,
+            );
+            entry.insert(key, platform_font.clone());
+            return Some(platform_font);
         }
 
         let mut cache = cache.write();
@@ -59,11 +94,22 @@ impl CoreTextFontCache {
         // It could be that between the time of the cache miss above and now, after the write lock
         // on the cache has been acquired, the cache was populated with the data that we need. Thus
         // check again and return the CTFont if it is is already cached.
-        if let Some(core_text_font) = identifier_cache.get(&au_size) {
-            return Some(core_text_font.clone());
+        if let Some(platform_font) = identifier_cache.get(&key) {
+            return Some(platform_font.clone());
         }
 
-        let core_text_font = match font_identifier {
+        let platform_font =
+            Self::create_font_without_variations(font_identifier, data, clamped_pt_size)?;
+        identifier_cache.insert(key, platform_font.clone());
+        Some(platform_font)
+    }
+
+    pub(crate) fn create_font_without_variations(
+        font_identifier: FontIdentifier,
+        data: Option<&FontData>,
+        clamped_pt_size: f64,
+    ) -> Option<PlatformFont> {
+        let descriptor = match font_identifier {
             FontIdentifier::Local(local_font_identifier) => {
                 // Other platforms can instantiate a platform font by loading the data
                 // from a file and passing an index in the case the file is a TTC bundle.
@@ -71,7 +117,7 @@ impl CoreTextFontCache {
                 // macOS is to create the font using a descriptor with both the PostScript
                 // name and path.
                 let cf_name = CFString::new(&local_font_identifier.postscript_name);
-                let mut descriptor = core_text::font_descriptor::new_from_postscript_name(&cf_name);
+                let descriptor = core_text::font_descriptor::new_from_postscript_name(&cf_name);
 
                 let cf_path = CFString::new(&local_font_identifier.path);
                 let url_attribute = unsafe { CFString::wrap_under_get_rule(kCTFontURLAttribute) };
@@ -79,25 +125,128 @@ impl CoreTextFontCache {
                     url_attribute,
                     CFURL::from_file_system_path(cf_path, kCFURLPOSIXPathStyle, false),
                 )]);
-                if let Ok(descriptor_with_path) =
-                    descriptor.create_copy_with_attributes(attributes.to_untyped())
-                {
-                    descriptor = descriptor_with_path;
-                }
 
-                core_text::font::new_from_descriptor(&descriptor, clamped_pt_size)
+                descriptor.create_copy_with_attributes(attributes.to_untyped())
             },
             FontIdentifier::Web(_) => {
                 let data = data
                     .expect("Should always have FontData for web fonts")
                     .clone();
-                let provider = CGDataProvider::from_buffer(Arc::new(data));
-                let cgfont = CGFont::from_data_provider(provider).ok()?;
-                core_text::font::new_from_CGFont(&cgfont, clamped_pt_size)
+                let cf_data = CFData::from_arc(Arc::new(data));
+                core_text::font_manager::create_font_descriptor_with_data(cf_data)
             },
         };
 
-        identifier_cache.insert(au_size, core_text_font.clone());
-        Some(core_text_font)
+        Some(PlatformFont::new_with_ctfont(
+            core_text::font::new_from_descriptor(&descriptor.ok()?, clamped_pt_size),
+        ))
+    }
+
+    fn add_variations_to_font(
+        platform_font: PlatformFont,
+        specified_variations: &[FontVariation],
+        pt_size: f64,
+    ) -> PlatformFont {
+        if specified_variations.is_empty() {
+            return platform_font;
+        }
+        let Some(variations) = Self::get_variation_axis_information(&platform_font) else {
+            return platform_font;
+        };
+
+        let mut modified_variations = false;
+        let variations: Vec<_> = variations
+            .iter()
+            .map(|variation| {
+                let value = specified_variations
+                    .iter()
+                    .find_map(|specified_variation| {
+                        if variation.tag == specified_variation.tag as i64 {
+                            Some(specified_variation.value as f64)
+                        } else {
+                            None
+                        }
+                    })
+                    .unwrap_or(variation.default_value)
+                    .clamp(variation.min_value, variation.max_value);
+                if value != variation.default_value {
+                    modified_variations = true;
+                }
+                FontVariation {
+                    tag: variation.tag as u32,
+                    value: value as f32,
+                }
+            })
+            .collect();
+
+        if !modified_variations {
+            return platform_font;
+        }
+
+        let cftype_variations: Vec<_> = variations
+            .iter()
+            .map(|variation| {
+                (
+                    CFNumber::from(variation.tag as i64),
+                    CFNumber::from(variation.value as f64),
+                )
+            })
+            .collect();
+        let values_dict = CFDictionary::from_CFType_pairs(&cftype_variations);
+
+        let variation_attribute =
+            unsafe { CFString::wrap_under_get_rule(kCTFontVariationAttribute) };
+        let attrs_dict = CFDictionary::from_CFType_pairs(&[(variation_attribute, values_dict)]);
+        let ct_var_font_desc = platform_font
+            .ctfont
+            .copy_descriptor()
+            .create_copy_with_attributes(attrs_dict.to_untyped())
+            .unwrap();
+
+        let ctfont = core_text::font::new_from_descriptor(&ct_var_font_desc, pt_size);
+        PlatformFont::new_with_ctfont_and_variations(ctfont, variations)
+    }
+
+    fn get_variation_axis_information(
+        platform_font: &PlatformFont,
+    ) -> Option<Vec<VariationAxisInformation>> {
+        Some(
+            platform_font
+                .ctfont
+                .get_variation_axes()?
+                .iter()
+                .filter_map(|axes| {
+                    let tag = unsafe { axes.find(kCTFontVariationAxisIdentifierKey) }
+                        .and_then(|tag| tag.downcast::<CFNumber>())?;
+                    let max_value = unsafe { axes.find(kCTFontVariationAxisMaximumValueKey) }
+                        .and_then(|tag| tag.downcast::<CFNumber>())?;
+                    let min_value = unsafe { axes.find(kCTFontVariationAxisMinimumValueKey) }
+                        .and_then(|tag| tag.downcast::<CFNumber>())?;
+                    let default_value = unsafe { axes.find(kCTFontVariationAxisDefaultValueKey) }
+                        .and_then(|tag| tag.downcast::<CFNumber>())?;
+                    Some(VariationAxisInformation {
+                        tag: tag.to_i64()?,
+                        max_value: max_value.to_f64()?,
+                        min_value: min_value.to_f64()?,
+                        default_value: default_value.to_f64()?,
+                    })
+                })
+                .collect(),
+        )
     }
 }
+
+#[derive(Clone, Default, Debug)]
+struct VariationAxisInformation {
+    tag: i64,
+    max_value: f64,
+    min_value: f64,
+    default_value: f64,
+}
+
+unsafe extern "C" {
+    static kCTFontVariationAxisDefaultValueKey: CFStringRef;
+    static kCTFontVariationAxisIdentifierKey: CFStringRef;
+    static kCTFontVariationAxisMaximumValueKey: CFStringRef;
+    static kCTFontVariationAxisMinimumValueKey: CFStringRef;
+}

components/fonts/platform/macos/font.rs

@@ -19,7 +19,7 @@ use core_text::font_descriptor::{
 use euclid::default::{Point2D, Rect, Size2D};
 use log::debug;
 use style::values::computed::font::{FontStretch, FontStyle, FontWeight};
-use webrender_api::FontInstanceFlags;
+use webrender_api::{FontInstanceFlags, FontVariation};
 
 use super::core_text_font_cache::CoreTextFontCache;
 use super::font_list::LocalFontIdentifier;
@@ -31,6 +31,7 @@ use crate::{
 
 const KERN_PAIR_LEN: usize = 6;
 
+#[derive(Clone)]
 pub struct FontTable {
     data: CFData,
 }
@@ -52,9 +53,10 @@ impl FontTableMethods for FontTable {
     }
 }
 
-#[derive(Debug)]
+#[derive(Clone, Debug)]
 pub struct PlatformFont {
-    ctfont: CTFont,
+    pub(crate) ctfont: CTFont,
+    variations: Vec<FontVariation>,
     h_kern_subtable: Option<CachedKernTable>,
 }
 
@@ -70,10 +72,52 @@ unsafe impl Sync for PlatformFont {}
 unsafe impl Send for PlatformFont {}
 
 impl PlatformFont {
+    pub(crate) fn new_with_ctfont(ctfont: CTFont) -> Self {
+        Self::new_with_ctfont_and_variations(ctfont, vec![])
+    }
+
+    pub(crate) fn new_with_ctfont_and_variations(
+        ctfont: CTFont,
+        variations: Vec<FontVariation>,
+    ) -> PlatformFont {
+        Self {
+            ctfont,
+            variations,
+            h_kern_subtable: None,
+        }
+    }
+
+    fn new(
+        font_identifier: FontIdentifier,
+        data: Option<&FontData>,
+        requested_size: Option<Au>,
+        variations: &[FontVariation],
+    ) -> Result<PlatformFont, &'static str> {
+        let size = match requested_size {
+            Some(s) => s.to_f64_px(),
+            None => 0.0,
+        };
+        let Some(mut platform_font) =
+            CoreTextFontCache::core_text_font(font_identifier, data, size, variations)
+        else {
+            return Err("Could not generate CTFont for FontTemplateData");
+        };
+
+        platform_font.load_h_kern_subtable();
+        Ok(platform_font)
+    }
+
     /// Cache all the data needed for basic horizontal kerning. This is used only as a fallback or
     /// fast path (when the GPOS table is missing or unnecessary) so it needn't handle every case.
-    fn find_h_kern_subtable(&self) -> Option<CachedKernTable> {
-        let font_table = self.table_for_tag(KERN)?;
+    fn load_h_kern_subtable(&mut self) {
+        if self.h_kern_subtable.is_some() {
+            return;
+        }
+
+        let Some(font_table) = self.table_for_tag(KERN) else {
+            return;
+        };
+
         let mut result = CachedKernTable {
             font_table,
             pair_data_range: 0..0,
@@ -89,7 +133,7 @@ impl PlatformFont {
             let table = result.font_table.buffer();
             let version = BigEndian::read_u16(table);
             if version != 0 {
-                return None;
+                return;
             }
             let num_subtables = BigEndian::read_u16(&table[2..]);
             let mut start = 4;
@@ -102,7 +146,7 @@ impl PlatformFont {
                     // Found a matching subtable.
                     if !result.pair_data_range.is_empty() {
                         debug!("Found multiple horizontal kern tables. Disable fast path.");
-                        return None;
+                        return;
                     }
                     // Read the subtable header.
                     let subtable_start = start + SUBTABLE_HEADER_LEN;
@@ -112,7 +156,7 @@ impl PlatformFont {
                     result.pair_data_range = pair_data_start..end;
                     if result.pair_data_range.len() != n_pairs * KERN_PAIR_LEN {
                         debug!("Bad data in kern header. Disable fast path.");
-                        return None;
+                        return;
                     }
 
                     let pt_per_font_unit =
@@ -122,14 +166,14 @@ impl PlatformFont {
                 start = end;
             }
         }
+
         if !result.pair_data_range.is_empty() {
-            Some(result)
-        } else {
-            None
+            self.h_kern_subtable = Some(result);
         }
     }
 }
 
+#[derive(Clone)]
 struct CachedKernTable {
     font_table: FontTable,
     pair_data_range: Range<usize>,
@@ -164,44 +208,27 @@ impl fmt::Debug for CachedKernTable {
     }
 }
 
-impl PlatformFont {
-    fn new(
-        font_identifier: FontIdentifier,
-        data: Option<&FontData>,
-        requested_size: Option<Au>,
-    ) -> Result<PlatformFont, &'static str> {
-        let size = match requested_size {
-            Some(s) => s.to_f64_px(),
-            None => 0.0,
-        };
-        let Some(core_text_font) = CoreTextFontCache::core_text_font(font_identifier, data, size)
-        else {
-            return Err("Could not generate CTFont for FontTemplateData");
-        };
-
-        let mut handle = PlatformFont {
-            ctfont: core_text_font.clone_with_font_size(size),
-            h_kern_subtable: None,
-        };
-        handle.h_kern_subtable = handle.find_h_kern_subtable();
-        Ok(handle)
-    }
-}
-
 impl PlatformFontMethods for PlatformFont {
     fn new_from_data(
         font_identifier: FontIdentifier,
         data: &FontData,
         requested_size: Option<Au>,
+        variations: &[FontVariation],
     ) -> Result<PlatformFont, &'static str> {
-        Self::new(font_identifier, Some(data), requested_size)
+        Self::new(font_identifier, Some(data), requested_size, variations)
     }
 
     fn new_from_local_font_identifier(
         font_identifier: LocalFontIdentifier,
         requested_size: Option<Au>,
+        variations: &[FontVariation],
     ) -> Result<PlatformFont, &'static str> {
-        Self::new(FontIdentifier::Local(font_identifier), None, requested_size)
+        Self::new(
+            FontIdentifier::Local(font_identifier),
+            None,
+            requested_size,
+            variations,
+        )
     }
 
     fn descriptor(&self) -> FontTemplateDescriptor {
@@ -345,6 +372,10 @@ impl PlatformFontMethods for PlatformFont {
             Size2D::new(rect.size.width as f32, rect.size.height as f32),
         )
     }
+
+    fn variations(&self) -> &[FontVariation] {
+        &self.variations
+    }
 }
 
 pub(super) trait CoreTextFontTraitsMapping {

components/fonts/platform/macos/font_list.rs

@@ -6,9 +6,11 @@ use std::fs::File;
 use std::path::Path;
 
 use base::text::{UnicodeBlock, UnicodeBlockMethod, unicode_plane};
-use log::debug;
+use log::{debug, warn};
 use malloc_size_of_derive::MallocSizeOf;
 use memmap2::Mmap;
+use read_fonts::types::NameId;
+use read_fonts::{FileRef, TableProvider as _};
 use serde::{Deserialize, Serialize};
 use style::Atom;
 use style::values::computed::font::GenericFontFamily;
@@ -18,8 +20,8 @@ use webrender_api::NativeFontHandle;
 use crate::platform::add_noto_fallback_families;
 use crate::platform::font::CoreTextFontTraitsMapping;
 use crate::{
-    EmojiPresentationPreference, FallbackFontSelectionOptions, FontIdentifier, FontTemplate,
-    FontTemplateDescriptor, LowercaseFontFamilyName,
+    EmojiPresentationPreference, FallbackFontSelectionOptions, FontData, FontDataAndIndex,
+    FontIdentifier, FontTemplate, FontTemplateDescriptor, LowercaseFontFamilyName,
 };
 
 /// An identifier for a local font on a MacOS system. These values comes from the CoreText
@@ -43,16 +45,61 @@ impl LocalFontIdentifier {
         0
     }
 
-    pub(crate) fn read_data_from_file(&self) -> Option<Vec<u8>> {
-        // TODO: This is incorrect, if the font file is a TTC (collection) with more than
-        // one font. In that case we either need to reconstruct the pertinent tables into
-        // a bundle of font data (expensive) or make sure that the value returned by
-        // `index()` above is correct. The latter is potentially tricky as macOS might not
-        // do an accurate mapping between the PostScript name that it gives us and what is
-        // listed in the font.
+    pub(crate) fn font_data_and_index(&self) -> Option<FontDataAndIndex> {
         let file = File::open(Path::new(&*self.path)).ok()?;
         let mmap = unsafe { Mmap::map(&file).ok()? };
-        Some(mmap[..].to_vec())
+
+        // Determine index
+        let file_ref = FileRef::new(mmap.as_ref()).ok()?;
+        let index = ttc_index_from_postscript_name(file_ref, &self.postscript_name);
+
+        Some(FontDataAndIndex {
+            data: FontData::from_bytes(&mmap),
+            index,
+        })
+    }
+}
+
+/// CoreText font enumeration gives us a Postscript name rather than an index.
+/// This functions maps from a Postscript name to an index.
+///
+/// This mapping works for single-font files and for simple TTC files, but may not work in all cases.
+/// We are not 100% sure which cases (if any) will not work. But we suspect that variable fonts may cause
+/// issues due to the Postscript names corresponding to instances not being straightforward, and the possibility
+/// that CoreText may return a non-standard in that scenerio.
+fn ttc_index_from_postscript_name(font_file: FileRef<'_>, postscript_name: &str) -> u32 {
+    match font_file {
+        // File only contains one font: simply return 0
+        FileRef::Font(_) => 0,
+        // File is a collection: iterate through each font in the collection and check
+        // whether the name matches
+        FileRef::Collection(collection) => {
+            for i in 0..collection.len() {
+                let font = collection.get(i).unwrap();
+                let name_table = font.name().unwrap();
+                if name_table
+                    .name_record()
+                    .iter()
+                    .filter(|record| record.name_id() == NameId::POSTSCRIPT_NAME)
+                    .any(|record| {
+                        record
+                            .string(name_table.string_data())
+                            .unwrap()
+                            .chars()
+                            .eq(postscript_name.chars())
+                    })
+                {
+                    return i;
+                }
+            }
+
+            // If we fail to find a font, just use the first font in the file.
+            warn!(
+                "Font with postscript_name {} not found in collection",
+                postscript_name
+            );
+            0
+        },
     }
 }
 

components/fonts/platform/windows/font.rs

@@ -6,27 +6,28 @@
 // information for an approach that we'll likely need to take when the
 // renderer moves to a sandboxed process.
 
+use std::cell::RefCell;
+use std::ffi::c_void;
 use std::fmt;
-use std::io::Cursor;
 use std::ops::Deref;
 use std::sync::Arc;
 
 use app_units::Au;
-use dwrote::{FontCollection, FontFace, FontFile};
+use dwrote::{
+    DWRITE_FONT_AXIS_VALUE, DWRITE_FONT_SIMULATIONS_NONE, FontCollection, FontFace, FontFile,
+};
 use euclid::default::{Point2D, Rect, Size2D};
-use log::{debug, warn};
+use log::debug;
+use read_fonts::TableProvider;
+use skrifa::Tag;
 use style::Zero;
-use style::computed_values::font_stretch::T as StyleFontStretch;
-use style::computed_values::font_weight::T as StyleFontWeight;
-use style::values::computed::font::FontStyle as StyleFontStyle;
-use truetype::tables::WindowsMetrics;
-use truetype::value::Read;
-use webrender_api::FontInstanceFlags;
+use webrender_api::{FontInstanceFlags, FontVariation};
+use winapi::shared::minwindef::{BOOL, FALSE};
 
 use super::font_list::LocalFontIdentifier;
 use crate::{
     FontData, FontIdentifier, FontMetrics, FontTableMethods, FontTableTag, FontTemplateDescriptor,
-    FractionalPixel, GlyphId, PlatformFontMethods, ot_tag,
+    FractionalPixel, GlyphId, PlatformFontMethods,
 };
 
 // 1em = 12pt = 16px, assuming 72 points per inch and 96 px per inch
@@ -67,6 +68,7 @@ pub struct PlatformFont {
     em_size: f32,
     du_to_px: f32,
     scaled_du_to_px: f32,
+    variations: Vec<FontVariation>,
 }
 
 // Based on information from the Skia codebase, it seems that DirectWrite APIs from
@@ -92,7 +94,11 @@ impl<T> Deref for Nondebug<T> {
 }
 
 impl PlatformFont {
-    fn new(font_face: FontFace, pt_size: Option<Au>) -> Result<Self, &'static str> {
+    fn new(
+        font_face: FontFace,
+        pt_size: Option<Au>,
+        variations: Vec<FontVariation>,
+    ) -> Result<Self, &'static str> {
         let pt_size = pt_size.unwrap_or(au_from_pt(12.));
         let du_per_em = font_face.metrics().metrics0().designUnitsPerEm as f32;
 
@@ -107,8 +113,51 @@ impl PlatformFont {
             em_size,
             du_to_px: design_units_to_pixels,
             scaled_du_to_px: scaled_design_units_to_pixels,
+            variations,
         })
     }
+
+    fn new_with_variations(
+        font_face: FontFace,
+        pt_size: Option<Au>,
+        variations: &[FontVariation],
+    ) -> Result<Self, &'static str> {
+        if variations.is_empty() {
+            return Self::new(font_face, pt_size, vec![]);
+        }
+
+        // On FreeType and CoreText platforms, the platform layer is able to read the minimum, maxmimum,
+        // and default values of each axis. This doesn't seem possible here and it seems that Gecko
+        // also just sets the value of the axis based on the values from the style as well.
+        //
+        // dwrote (and presumably the Windows APIs) accept a reversed version of the table
+        // tag bytes, which means that `u32::swap_bytes` must be called here in order to
+        // use a byte order compatible with the rest of Servo.
+        let variations: Vec<_> = variations
+            .into_iter()
+            .map(|variation| DWRITE_FONT_AXIS_VALUE {
+                axisTag: variation.tag.swap_bytes(),
+                value: variation.value,
+            })
+            .collect();
+
+        let Some(font_face) =
+            font_face.create_font_face_with_variations(DWRITE_FONT_SIMULATIONS_NONE, &variations)
+        else {
+            return Err("Could not adapt FontFace to given variations");
+        };
+
+        let variations = font_face.variations().unwrap_or_default();
+        let variations = variations
+            .iter()
+            .map(|dwrote_variation| FontVariation {
+                tag: dwrote_variation.axisTag.swap_bytes(),
+                value: dwrote_variation.value,
+            })
+            .collect();
+
+        Self::new(font_face, pt_size, variations)
+    }
 }
 
 impl PlatformFontMethods for PlatformFont {
@@ -116,20 +165,19 @@ impl PlatformFontMethods for PlatformFont {
         _font_identifier: FontIdentifier,
         data: &FontData,
         pt_size: Option<Au>,
+        variations: &[FontVariation],
     ) -> Result<Self, &'static str> {
         let font_face = FontFile::new_from_buffer(Arc::new(data.clone()))
             .ok_or("Could not create FontFile")?
-            .create_face(
-                0, /* face_index */
-                dwrote::DWRITE_FONT_SIMULATIONS_NONE,
-            )
+            .create_face(0 /* face_index */, DWRITE_FONT_SIMULATIONS_NONE)
             .map_err(|_| "Could not create FontFace")?;
-        Self::new(font_face, pt_size)
+        Self::new_with_variations(font_face, pt_size, variations)
     }
 
     fn new_from_local_font_identifier(
         font_identifier: LocalFontIdentifier,
         pt_size: Option<Au>,
+        variations: &[FontVariation],
     ) -> Result<PlatformFont, &'static str> {
         let font_face = FontCollection::system()
             .font_from_descriptor(&font_identifier.font_descriptor)
@@ -137,100 +185,48 @@ impl PlatformFontMethods for PlatformFont {
             .flatten()
             .ok_or("Could not create Font from descriptor")?
             .create_font_face();
-        Self::new(font_face, pt_size)
+        Self::new_with_variations(font_face, pt_size, variations)
     }
 
     fn descriptor(&self) -> FontTemplateDescriptor {
-        // We need the font (DWriteFont) in order to be able to query things like
-        // the family name, face name, weight, etc.  On Windows 10, the
-        // DWriteFontFace3 interface provides this on the FontFace, but that's only
-        // available on Win10+.
-        //
-        // Instead, we do the parsing work using the truetype crate for raw fonts.
-        // We're just extracting basic info, so this is sufficient for now.
-        //
-        // The `dwrote` APIs take SFNT table tags in a reversed byte order, which
-        // is why `u32::swap_bytes()` is called here.
-        let windows_metrics_bytes = self
-            .face
-            .get_font_table(u32::swap_bytes(ot_tag!('O', 'S', '/', '2')));
-        if windows_metrics_bytes.is_none() {
-            warn!("Could not find OS/2 table in font.");
-            return FontTemplateDescriptor::default();
-        }
-
-        let mut cursor = Cursor::new(windows_metrics_bytes.as_ref().unwrap());
-        let Ok(table) = WindowsMetrics::read(&mut cursor) else {
-            warn!("Could not read OS/2 table in font.");
-            return FontTemplateDescriptor::default();
-        };
-
-        let (weight_val, width_val, italic_bool) = match table {
-            WindowsMetrics::Version0(ref m) => {
-                (m.weight_class, m.width_class, m.selection_flags.0 & 1 == 1)
-            },
-            WindowsMetrics::Version1(ref m) => {
-                (m.weight_class, m.width_class, m.selection_flags.0 & 1 == 1)
-            },
-            WindowsMetrics::Version2(ref m) |
-            WindowsMetrics::Version3(ref m) |
-            WindowsMetrics::Version4(ref m) => {
-                (m.weight_class, m.width_class, m.selection_flags.0 & 1 == 1)
-            },
-            WindowsMetrics::Version5(ref m) => {
-                (m.weight_class, m.width_class, m.selection_flags.0 & 1 == 1)
-            },
-        };
-
-        let weight = StyleFontWeight::from_float(weight_val as f32);
-        let stretch = match width_val.clamp(1, 9) {
-            1 => StyleFontStretch::ULTRA_CONDENSED,
-            2 => StyleFontStretch::EXTRA_CONDENSED,
-            3 => StyleFontStretch::CONDENSED,
-            4 => StyleFontStretch::SEMI_CONDENSED,
-            5 => StyleFontStretch::NORMAL,
-            6 => StyleFontStretch::SEMI_EXPANDED,
-            7 => StyleFontStretch::EXPANDED,
-            8 => StyleFontStretch::EXTRA_EXPANDED,
-            9 => StyleFontStretch::ULTRA_CONDENSED,
-            _ => {
-                warn!("Unknown stretch size.");
-                StyleFontStretch::NORMAL
-            },
-        };
-
-        let style = if italic_bool {
-            StyleFontStyle::ITALIC
-        } else {
-            StyleFontStyle::NORMAL
-        };
-
-        FontTemplateDescriptor::new(weight, stretch, style)
+        DirectWriteTableProvider::new(self)
+            .os2()
+            .as_ref()
+            .map(Self::descriptor_from_os2_table)
+            .unwrap_or_default()
     }
 
     fn glyph_index(&self, codepoint: char) -> Option<GlyphId> {
-        let glyph = self.face.get_glyph_indices(&[codepoint as u32])[0];
-        if glyph == 0 {
+        let Ok(glyphs) = self.face.glyph_indices(&[codepoint as u32]) else {
+            return None;
+        };
+        let Some(glyph) = glyphs.first() else {
+            return None;
+        };
+        if *glyph == 0 {
             return None;
         }
-        Some(glyph as GlyphId)
+        Some(*glyph as GlyphId)
     }
 
     fn glyph_h_advance(&self, glyph: GlyphId) -> Option<FractionalPixel> {
         if glyph == 0 {
             return None;
         }
-
-        let gm = self.face.get_design_glyph_metrics(&[glyph as u16], false)[0];
-        let f = (gm.advanceWidth as f32 * self.scaled_du_to_px) as FractionalPixel;
-
-        Some(f)
+        let Ok(metrics) = self.face.design_glyph_metrics(&[glyph as u16], false) else {
+            return None;
+        };
+        let Some(glyph_metric) = metrics.first() else {
+            return None;
+        };
+        Some((glyph_metric.advanceWidth as f32 * self.scaled_du_to_px) as FractionalPixel)
     }
 
     fn glyph_h_kerning(&self, first_glyph: GlyphId, second_glyph: GlyphId) -> FractionalPixel {
         let adjustment = self
             .face
-            .get_glyph_pair_kerning_adjustment(first_glyph as u16, second_glyph as u16);
+            .glyph_pair_kerning_adjustment(first_glyph as u16, second_glyph as u16)
+            .unwrap_or_default();
 
         (adjustment as f32 * self.scaled_du_to_px) as FractionalPixel
     }
@@ -291,7 +287,9 @@ impl PlatformFontMethods for PlatformFont {
         // tag bytes, which means that `u32::swap_bytes` must be called here in order to
         // use a byte order compatible with the rest of Servo.
         self.face
-            .get_font_table(u32::swap_bytes(tag))
+            .font_table(u32::swap_bytes(tag))
+            .ok()
+            .flatten()
             .map(|bytes| FontTable { data: bytes })
     }
 
@@ -300,10 +298,12 @@ impl PlatformFontMethods for PlatformFont {
     }
 
     fn typographic_bounds(&self, glyph_id: GlyphId) -> Rect<f32> {
-        let metrics = self
-            .face
-            .get_design_glyph_metrics(&[glyph_id as u16], false);
-        let metrics = &metrics[0];
+        let Ok(metrics) = self.face.design_glyph_metrics(&[glyph_id as u16], false) else {
+            return Rect::zero();
+        };
+        let Some(metrics) = metrics.first() else {
+            return Rect::zero();
+        };
         let advance_width = metrics.advanceWidth as f32;
         let advance_height = metrics.advanceHeight as f32;
         let left_side_bearing = metrics.leftSideBearing as f32;
@@ -320,4 +320,76 @@ impl PlatformFontMethods for PlatformFont {
             Size2D::new(width, height),
         )
     }
+
+    fn variations(&self) -> &[FontVariation] {
+        &self.variations
+    }
+}
+
+/// A wrapper struct around [`PlatformFont`] which is responsible for
+/// implementing [`TableProvider`] and cleaning up any font table contexts from
+/// DirectWrite when the struct is dropped.
+struct DirectWriteTableProvider<'platform_font> {
+    platform_font: &'platform_font PlatformFont,
+    contexts: RefCell<Vec<*mut c_void>>,
+}
+
+impl<'platform_font> DirectWriteTableProvider<'platform_font> {
+    fn new(platform_font: &'platform_font PlatformFont) -> Self {
+        Self {
+            platform_font,
+            contexts: Default::default(),
+        }
+    }
+}
+
+impl Drop for DirectWriteTableProvider<'_> {
+    fn drop(&mut self) {
+        let direct_write_face = unsafe { self.platform_font.face.as_ptr() };
+        assert!(!direct_write_face.is_null());
+
+        let direct_write_face = unsafe { &*direct_write_face };
+        for context in self.contexts.borrow_mut().drain(..) {
+            unsafe { direct_write_face.ReleaseFontTable(context) };
+        }
+    }
+}
+
+impl<'platform_font> TableProvider<'platform_font> for DirectWriteTableProvider<'platform_font> {
+    fn data_for_tag(&self, tag: Tag) -> Option<read_fonts::FontData<'platform_font>> {
+        let direct_write_face = unsafe { self.platform_font.face.as_ptr() };
+        if direct_write_face.is_null() {
+            return None;
+        }
+
+        let direct_write_face = unsafe { &*direct_write_face };
+        let direct_write_tag = u32::from_be_bytes(tag.to_be_bytes()).swap_bytes();
+        let mut table_data_ptr: *const u8 = std::ptr::null_mut();
+        let mut table_size: u32 = 0;
+        let mut table_context: *mut c_void = std::ptr::null_mut();
+        let mut exists: BOOL = FALSE;
+
+        let hr = unsafe {
+            direct_write_face.TryGetFontTable(
+                direct_write_tag,
+                &mut table_data_ptr as *mut *const _ as *mut *const c_void,
+                &mut table_size,
+                &mut table_context,
+                &mut exists,
+            )
+        };
+
+        if hr != 0 || exists == 0 {
+            return None;
+        }
+
+        self.contexts.borrow_mut().push(table_context);
+
+        if table_data_ptr.is_null() || table_size == 0 {
+            return None;
+        }
+
+        let bytes = unsafe { std::slice::from_raw_parts(table_data_ptr, table_size as usize) };
+        Some(read_fonts::FontData::new(bytes))
+    }
 }

components/fonts/platform/windows/font_list.rs

@@ -15,8 +15,8 @@ use style::values::specified::font::FontStretchKeyword;
 use webrender_api::NativeFontHandle;
 
 use crate::{
-    EmojiPresentationPreference, FallbackFontSelectionOptions, FontIdentifier, FontTemplate,
-    FontTemplateDescriptor, LowercaseFontFamilyName,
+    EmojiPresentationPreference, FallbackFontSelectionOptions, FontData, FontDataAndIndex,
+    FontIdentifier, FontTemplate, FontTemplateDescriptor, LowercaseFontFamilyName,
 };
 
 pub fn for_each_available_family<F>(mut callback: F)
@@ -56,10 +56,12 @@ impl LocalFontIdentifier {
             .expect("Could not create Font from FontDescriptor")
             .create_font_face();
         let path = face
-            .get_files()
-            .first()
+            .files()
+            .ok()
+            .and_then(|files| files.first().cloned())
             .expect("Could not get FontFace files")
-            .get_font_file_path()
+            .font_file_path()
+            .ok()
             .expect("Could not get FontFace files path");
         NativeFontHandle {
             path,
@@ -67,14 +69,19 @@ impl LocalFontIdentifier {
         }
     }
 
-    pub(crate) fn read_data_from_file(&self) -> Option<Vec<u8>> {
+    pub(crate) fn font_data_and_index(&self) -> Option<FontDataAndIndex> {
         let font = FontCollection::system()
             .font_from_descriptor(&self.font_descriptor)
             .ok()??;
         let face = font.create_font_face();
-        let files = face.get_files();
+        let index = face.get_index();
+        let files = face.files().ok()?;
         assert!(!files.is_empty());
-        Some(files[0].get_font_file_bytes())
+
+        let data = files[0].font_file_bytes().ok()?;
+        let data = FontData::from_bytes(&data);
+
+        Some(FontDataAndIndex { data, index })
     }
 }
 

components/fonts/shaper.rs

@@ -1,762 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
-
-#![allow(unsafe_code)]
-
-use std::os::raw::{c_char, c_int, c_uint, c_void};
-use std::sync::LazyLock;
-use std::{char, cmp, ptr};
-
-use app_units::Au;
-use base::text::is_bidi_control;
-use euclid::default::Point2D;
-// Eventually we would like the shaper to be pluggable, as many operating systems have their own
-// shapers. For now, however, HarfBuzz is a hard dependency.
-use harfbuzz_sys::{
-    HB_DIRECTION_LTR, HB_DIRECTION_RTL, HB_MEMORY_MODE_READONLY, HB_OT_LAYOUT_BASELINE_TAG_HANGING,
-    HB_OT_LAYOUT_BASELINE_TAG_IDEO_EMBOX_BOTTOM_OR_LEFT, HB_OT_LAYOUT_BASELINE_TAG_ROMAN,
-    hb_blob_create, hb_blob_t, hb_bool_t, hb_buffer_add_utf8, hb_buffer_create, hb_buffer_destroy,
-    hb_buffer_get_glyph_infos, hb_buffer_get_glyph_positions, hb_buffer_get_length,
-    hb_buffer_set_direction, hb_buffer_set_script, hb_buffer_t, hb_codepoint_t,
-    hb_face_create_for_tables, hb_face_destroy, hb_face_t, hb_feature_t, hb_font_create,
-    hb_font_destroy, hb_font_funcs_create, hb_font_funcs_set_glyph_h_advance_func,
-    hb_font_funcs_set_nominal_glyph_func, hb_font_funcs_t, hb_font_set_funcs, hb_font_set_ppem,
-    hb_font_set_scale, hb_font_t, hb_glyph_info_t, hb_glyph_position_t, hb_ot_layout_get_baseline,
-    hb_position_t, hb_shape, hb_tag_t,
-};
-use log::debug;
-use num_traits::Zero;
-
-use crate::platform::font::FontTable;
-use crate::{
-    BASE, ByteIndex, Font, FontBaseline, FontTableMethods, FontTableTag, GlyphData, GlyphId,
-    GlyphStore, KERN, ShapingFlags, ShapingOptions, fixed_to_float, float_to_fixed, ot_tag,
-};
-
-const NO_GLYPH: i32 = -1;
-const LIGA: u32 = ot_tag!('l', 'i', 'g', 'a');
-const HB_OT_TAG_DEFAULT_SCRIPT: u32 = ot_tag!('D', 'F', 'L', 'T');
-const HB_OT_TAG_DEFAULT_LANGUAGE: u32 = ot_tag!('d', 'f', 'l', 't');
-
-pub struct ShapedGlyphData {
-    count: usize,
-    glyph_infos: *mut hb_glyph_info_t,
-    pos_infos: *mut hb_glyph_position_t,
-}
-
-pub struct ShapedGlyphEntry {
-    codepoint: GlyphId,
-    advance: Au,
-    offset: Option<Point2D<Au>>,
-}
-
-impl ShapedGlyphData {
-    /// Create a new [`ShapedGlyphData`] from the given HarfBuzz buffer.
-    ///
-    /// # Safety
-    ///
-    /// Passing an invalid buffer pointer to this function results in undefined behavior.
-    pub unsafe fn new(buffer: *mut hb_buffer_t) -> ShapedGlyphData {
-        let mut glyph_count = 0;
-        let glyph_infos = unsafe { hb_buffer_get_glyph_infos(buffer, &mut glyph_count) };
-        assert!(!glyph_infos.is_null());
-        let mut pos_count = 0;
-        let pos_infos = unsafe { hb_buffer_get_glyph_positions(buffer, &mut pos_count) };
-        assert!(!pos_infos.is_null());
-        assert_eq!(glyph_count, pos_count);
-
-        ShapedGlyphData {
-            count: glyph_count as usize,
-            glyph_infos,
-            pos_infos,
-        }
-    }
-
-    #[inline(always)]
-    fn byte_offset_of_glyph(&self, i: usize) -> u32 {
-        assert!(i < self.count);
-
-        unsafe {
-            let glyph_info_i = self.glyph_infos.add(i);
-            (*glyph_info_i).cluster
-        }
-    }
-
-    pub fn len(&self) -> usize {
-        self.count
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.count == 0
-    }
-
-    /// Returns shaped glyph data for one glyph, and updates the y-position of the pen.
-    pub fn entry_for_glyph(&self, i: usize, y_pos: &mut Au) -> ShapedGlyphEntry {
-        assert!(i < self.count);
-
-        unsafe {
-            let glyph_info_i = self.glyph_infos.add(i);
-            let pos_info_i = self.pos_infos.add(i);
-            let x_offset = Shaper::fixed_to_float((*pos_info_i).x_offset);
-            let y_offset = Shaper::fixed_to_float((*pos_info_i).y_offset);
-            let x_advance = Shaper::fixed_to_float((*pos_info_i).x_advance);
-            let y_advance = Shaper::fixed_to_float((*pos_info_i).y_advance);
-
-            let x_offset = Au::from_f64_px(x_offset);
-            let y_offset = Au::from_f64_px(y_offset);
-            let x_advance = Au::from_f64_px(x_advance);
-            let y_advance = Au::from_f64_px(y_advance);
-
-            let offset = if x_offset.is_zero() && y_offset.is_zero() && y_advance.is_zero() {
-                None
-            } else {
-                // adjust the pen..
-                if y_advance > Au::zero() {
-                    *y_pos -= y_advance;
-                }
-
-                Some(Point2D::new(x_offset, *y_pos - y_offset))
-            };
-
-            ShapedGlyphEntry {
-                codepoint: (*glyph_info_i).codepoint as GlyphId,
-                advance: x_advance,
-                offset,
-            }
-        }
-    }
-}
-
-#[derive(Debug)]
-pub struct Shaper {
-    hb_face: *mut hb_face_t,
-    hb_font: *mut hb_font_t,
-    font: *const Font,
-}
-
-// The HarfBuzz API is thread safe as well as our `Font`, so we can make the data
-// structures here as thread-safe as well. This doesn't seem to be documented,
-// but was expressed as one of the original goals of the HarfBuzz API.
-unsafe impl Sync for Shaper {}
-unsafe impl Send for Shaper {}
-
-impl Drop for Shaper {
-    fn drop(&mut self) {
-        unsafe {
-            assert!(!self.hb_face.is_null());
-            hb_face_destroy(self.hb_face);
-
-            assert!(!self.hb_font.is_null());
-            hb_font_destroy(self.hb_font);
-        }
-    }
-}
-
-impl Shaper {
-    #[allow(clippy::not_unsafe_ptr_arg_deref)] // Has an unsafe block inside
-    pub fn new(font: *const Font) -> Shaper {
-        unsafe {
-            let hb_face: *mut hb_face_t = hb_face_create_for_tables(
-                Some(font_table_func),
-                font as *const c_void as *mut c_void,
-                None,
-            );
-            let hb_font: *mut hb_font_t = hb_font_create(hb_face);
-
-            // Set points-per-em. if zero, performs no hinting in that direction.
-            let pt_size = (*font).descriptor.pt_size.to_f64_px();
-            hb_font_set_ppem(hb_font, pt_size as c_uint, pt_size as c_uint);
-
-            // Set scaling. Note that this takes 16.16 fixed point.
-            hb_font_set_scale(
-                hb_font,
-                Shaper::float_to_fixed(pt_size) as c_int,
-                Shaper::float_to_fixed(pt_size) as c_int,
-            );
-
-            // configure static function callbacks.
-            hb_font_set_funcs(
-                hb_font,
-                HB_FONT_FUNCS.0,
-                font as *mut Font as *mut c_void,
-                None,
-            );
-
-            Shaper {
-                hb_face,
-                hb_font,
-                font,
-            }
-        }
-    }
-
-    fn float_to_fixed(f: f64) -> i32 {
-        float_to_fixed(16, f)
-    }
-
-    fn fixed_to_float(i: hb_position_t) -> f64 {
-        fixed_to_float(16, i)
-    }
-}
-
-pub fn unicode_to_hb_script(script: unicode_script::Script) -> harfbuzz_sys::hb_script_t {
-    use harfbuzz_sys::*;
-    use unicode_script::Script::*;
-    match script {
-        Adlam => HB_SCRIPT_ADLAM,
-        Ahom => HB_SCRIPT_AHOM,
-        Anatolian_Hieroglyphs => HB_SCRIPT_ANATOLIAN_HIEROGLYPHS,
-        Arabic => HB_SCRIPT_ARABIC,
-        Armenian => HB_SCRIPT_ARMENIAN,
-        Avestan => HB_SCRIPT_AVESTAN,
-        Balinese => HB_SCRIPT_BALINESE,
-        Bamum => HB_SCRIPT_BAMUM,
-        Bassa_Vah => HB_SCRIPT_BASSA_VAH,
-        Batak => HB_SCRIPT_BATAK,
-        Bengali => HB_SCRIPT_BENGALI,
-        Bhaiksuki => HB_SCRIPT_BHAIKSUKI,
-        Bopomofo => HB_SCRIPT_BOPOMOFO,
-        Brahmi => HB_SCRIPT_BRAHMI,
-        Braille => HB_SCRIPT_BRAILLE,
-        Buginese => HB_SCRIPT_BUGINESE,
-        Buhid => HB_SCRIPT_BUHID,
-        Canadian_Aboriginal => HB_SCRIPT_CANADIAN_SYLLABICS,
-        Carian => HB_SCRIPT_CARIAN,
-        Caucasian_Albanian => HB_SCRIPT_CAUCASIAN_ALBANIAN,
-        Chakma => HB_SCRIPT_CHAKMA,
-        Cham => HB_SCRIPT_CHAM,
-        Cherokee => HB_SCRIPT_CHEROKEE,
-        Chorasmian => HB_SCRIPT_CHORASMIAN,
-        Common => HB_SCRIPT_COMMON,
-        Coptic => HB_SCRIPT_COPTIC,
-        Cuneiform => HB_SCRIPT_CUNEIFORM,
-        Cypriot => HB_SCRIPT_CYPRIOT,
-        Cyrillic => HB_SCRIPT_CYRILLIC,
-        Deseret => HB_SCRIPT_DESERET,
-        Devanagari => HB_SCRIPT_DEVANAGARI,
-        Dives_Akuru => HB_SCRIPT_DIVES_AKURU,
-        Dogra => HB_SCRIPT_DOGRA,
-        Duployan => HB_SCRIPT_DUPLOYAN,
-        Egyptian_Hieroglyphs => HB_SCRIPT_EGYPTIAN_HIEROGLYPHS,
-        Elbasan => HB_SCRIPT_ELBASAN,
-        Elymaic => HB_SCRIPT_ELYMAIC,
-        Ethiopic => HB_SCRIPT_ETHIOPIC,
-        Georgian => HB_SCRIPT_GEORGIAN,
-        Glagolitic => HB_SCRIPT_GLAGOLITIC,
-        Gothic => HB_SCRIPT_GOTHIC,
-        Grantha => HB_SCRIPT_GRANTHA,
-        Greek => HB_SCRIPT_GREEK,
-        Gujarati => HB_SCRIPT_GUJARATI,
-        Gunjala_Gondi => HB_SCRIPT_GUNJALA_GONDI,
-        Gurmukhi => HB_SCRIPT_GURMUKHI,
-        Han => HB_SCRIPT_HAN,
-        Hangul => HB_SCRIPT_HANGUL,
-        Hanifi_Rohingya => HB_SCRIPT_HANIFI_ROHINGYA,
-        Hanunoo => HB_SCRIPT_HANUNOO,
-        Hatran => HB_SCRIPT_HATRAN,
-        Hebrew => HB_SCRIPT_HEBREW,
-        Hiragana => HB_SCRIPT_HIRAGANA,
-        Imperial_Aramaic => HB_SCRIPT_IMPERIAL_ARAMAIC,
-        Inherited => HB_SCRIPT_INHERITED,
-        Inscriptional_Pahlavi => HB_SCRIPT_INSCRIPTIONAL_PAHLAVI,
-        Inscriptional_Parthian => HB_SCRIPT_INSCRIPTIONAL_PARTHIAN,
-        Javanese => HB_SCRIPT_JAVANESE,
-        Kaithi => HB_SCRIPT_KAITHI,
-        Kannada => HB_SCRIPT_KANNADA,
-        Katakana => HB_SCRIPT_KATAKANA,
-        Kayah_Li => HB_SCRIPT_KAYAH_LI,
-        Kharoshthi => HB_SCRIPT_KHAROSHTHI,
-        Khitan_Small_Script => HB_SCRIPT_KHITAN_SMALL_SCRIPT,
-        Khmer => HB_SCRIPT_KHMER,
-        Khojki => HB_SCRIPT_KHOJKI,
-        Khudawadi => HB_SCRIPT_KHUDAWADI,
-        Lao => HB_SCRIPT_LAO,
-        Latin => HB_SCRIPT_LATIN,
-        Lepcha => HB_SCRIPT_LEPCHA,
-        Limbu => HB_SCRIPT_LIMBU,
-        Linear_A => HB_SCRIPT_LINEAR_A,
-        Linear_B => HB_SCRIPT_LINEAR_B,
-        Lisu => HB_SCRIPT_LISU,
-        Lycian => HB_SCRIPT_LYCIAN,
-        Lydian => HB_SCRIPT_LYDIAN,
-        Mahajani => HB_SCRIPT_MAHAJANI,
-        Makasar => HB_SCRIPT_MAKASAR,
-        Malayalam => HB_SCRIPT_MALAYALAM,
-        Mandaic => HB_SCRIPT_MANDAIC,
-        Manichaean => HB_SCRIPT_MANICHAEAN,
-        Marchen => HB_SCRIPT_MARCHEN,
-        Masaram_Gondi => HB_SCRIPT_MASARAM_GONDI,
-        Medefaidrin => HB_SCRIPT_MEDEFAIDRIN,
-        Meetei_Mayek => HB_SCRIPT_MEETEI_MAYEK,
-        Mende_Kikakui => HB_SCRIPT_MENDE_KIKAKUI,
-        Meroitic_Cursive => HB_SCRIPT_MEROITIC_CURSIVE,
-        Meroitic_Hieroglyphs => HB_SCRIPT_MEROITIC_HIEROGLYPHS,
-        Miao => HB_SCRIPT_MIAO,
-        Modi => HB_SCRIPT_MODI,
-        Mongolian => HB_SCRIPT_MONGOLIAN,
-        Mro => HB_SCRIPT_MRO,
-        Multani => HB_SCRIPT_MULTANI,
-        Myanmar => HB_SCRIPT_MYANMAR,
-        Nabataean => HB_SCRIPT_NABATAEAN,
-        Nandinagari => HB_SCRIPT_NANDINAGARI,
-        New_Tai_Lue => HB_SCRIPT_NEW_TAI_LUE,
-        Newa => HB_SCRIPT_NEWA,
-        Nko => HB_SCRIPT_NKO,
-        Nushu => HB_SCRIPT_NUSHU,
-        Nyiakeng_Puachue_Hmong => HB_SCRIPT_NYIAKENG_PUACHUE_HMONG,
-        Ogham => HB_SCRIPT_OGHAM,
-        Ol_Chiki => HB_SCRIPT_OL_CHIKI,
-        Old_Hungarian => HB_SCRIPT_OLD_HUNGARIAN,
-        Old_Italic => HB_SCRIPT_OLD_ITALIC,
-        Old_North_Arabian => HB_SCRIPT_OLD_NORTH_ARABIAN,
-        Old_Permic => HB_SCRIPT_OLD_PERMIC,
-        Old_Persian => HB_SCRIPT_OLD_PERSIAN,
-        Old_Sogdian => HB_SCRIPT_OLD_SOGDIAN,
-        Old_South_Arabian => HB_SCRIPT_OLD_SOUTH_ARABIAN,
-        Old_Turkic => HB_SCRIPT_OLD_TURKIC,
-        Oriya => HB_SCRIPT_ORIYA,
-        Osage => HB_SCRIPT_OSAGE,
-        Osmanya => HB_SCRIPT_OSMANYA,
-        Pahawh_Hmong => HB_SCRIPT_PAHAWH_HMONG,
-        Palmyrene => HB_SCRIPT_PALMYRENE,
-        Pau_Cin_Hau => HB_SCRIPT_PAU_CIN_HAU,
-        Phags_Pa => HB_SCRIPT_PHAGS_PA,
-        Phoenician => HB_SCRIPT_PHOENICIAN,
-        Psalter_Pahlavi => HB_SCRIPT_PSALTER_PAHLAVI,
-        Rejang => HB_SCRIPT_REJANG,
-        Runic => HB_SCRIPT_RUNIC,
-        Samaritan => HB_SCRIPT_SAMARITAN,
-        Saurashtra => HB_SCRIPT_SAURASHTRA,
-        Sharada => HB_SCRIPT_SHARADA,
-        Shavian => HB_SCRIPT_SHAVIAN,
-        Siddham => HB_SCRIPT_SIDDHAM,
-        SignWriting => HB_SCRIPT_SIGNWRITING,
-        Sinhala => HB_SCRIPT_SINHALA,
-        Sogdian => HB_SCRIPT_SOGDIAN,
-        Sora_Sompeng => HB_SCRIPT_SORA_SOMPENG,
-        Soyombo => HB_SCRIPT_SOYOMBO,
-        Sundanese => HB_SCRIPT_SUNDANESE,
-        Syloti_Nagri => HB_SCRIPT_SYLOTI_NAGRI,
-        Syriac => HB_SCRIPT_SYRIAC,
-        Tagalog => HB_SCRIPT_TAGALOG,
-        Tagbanwa => HB_SCRIPT_TAGBANWA,
-        Tai_Le => HB_SCRIPT_TAI_LE,
-        Tai_Tham => HB_SCRIPT_TAI_THAM,
-        Tai_Viet => HB_SCRIPT_TAI_VIET,
-        Takri => HB_SCRIPT_TAKRI,
-        Tamil => HB_SCRIPT_TAMIL,
-        Tangut => HB_SCRIPT_TANGUT,
-        Telugu => HB_SCRIPT_TELUGU,
-        Thaana => HB_SCRIPT_THAANA,
-        Thai => HB_SCRIPT_THAI,
-        Tibetan => HB_SCRIPT_TIBETAN,
-        Tifinagh => HB_SCRIPT_TIFINAGH,
-        Tirhuta => HB_SCRIPT_TIRHUTA,
-        Ugaritic => HB_SCRIPT_UGARITIC,
-        Unknown => HB_SCRIPT_UNKNOWN,
-        Vai => HB_SCRIPT_VAI,
-        Warang_Citi => HB_SCRIPT_WARANG_CITI,
-        Wancho => HB_SCRIPT_WANCHO,
-        Yezidi => HB_SCRIPT_YEZIDI,
-        Yi => HB_SCRIPT_YI,
-        Zanabazar_Square => HB_SCRIPT_ZANABAZAR_SQUARE,
-        _ => HB_SCRIPT_UNKNOWN,
-    }
-}
-
-impl Shaper {
-    /// Calculate the layout metrics associated with the given text when painted in a specific
-    /// font.
-    pub(crate) fn shape_text(&self, text: &str, options: &ShapingOptions, glyphs: &mut GlyphStore) {
-        unsafe {
-            let hb_buffer: *mut hb_buffer_t = hb_buffer_create();
-            hb_buffer_set_direction(
-                hb_buffer,
-                if options.flags.contains(ShapingFlags::RTL_FLAG) {
-                    HB_DIRECTION_RTL
-                } else {
-                    HB_DIRECTION_LTR
-                },
-            );
-
-            hb_buffer_set_script(hb_buffer, unicode_to_hb_script(options.script));
-
-            hb_buffer_add_utf8(
-                hb_buffer,
-                text.as_ptr() as *const c_char,
-                text.len() as c_int,
-                0,
-                text.len() as c_int,
-            );
-
-            let mut features = Vec::new();
-            if options
-                .flags
-                .contains(ShapingFlags::IGNORE_LIGATURES_SHAPING_FLAG)
-            {
-                features.push(hb_feature_t {
-                    tag: LIGA,
-                    value: 0,
-                    start: 0,
-                    end: hb_buffer_get_length(hb_buffer),
-                })
-            }
-            if options
-                .flags
-                .contains(ShapingFlags::DISABLE_KERNING_SHAPING_FLAG)
-            {
-                features.push(hb_feature_t {
-                    tag: KERN,
-                    value: 0,
-                    start: 0,
-                    end: hb_buffer_get_length(hb_buffer),
-                })
-            }
-
-            hb_shape(
-                self.hb_font,
-                hb_buffer,
-                features.as_mut_ptr(),
-                features.len() as u32,
-            );
-            self.save_glyph_results(text, options, glyphs, hb_buffer);
-            hb_buffer_destroy(hb_buffer);
-        }
-    }
-
-    fn save_glyph_results(
-        &self,
-        text: &str,
-        options: &ShapingOptions,
-        glyphs: &mut GlyphStore,
-        buffer: *mut hb_buffer_t,
-    ) {
-        let glyph_data = unsafe { ShapedGlyphData::new(buffer) };
-        let glyph_count = glyph_data.len();
-        let byte_max = text.len();
-
-        debug!(
-            "Shaped text[byte count={}], got back {} glyph info records.",
-            byte_max, glyph_count
-        );
-
-        // make map of what chars have glyphs
-        let mut byte_to_glyph = vec![NO_GLYPH; byte_max];
-
-        debug!("(glyph idx) -> (text byte offset)");
-        for i in 0..glyph_data.len() {
-            let loc = glyph_data.byte_offset_of_glyph(i) as usize;
-            if loc < byte_max {
-                byte_to_glyph[loc] = i as i32;
-            } else {
-                debug!(
-                    "ERROR: tried to set out of range byte_to_glyph: idx={}, glyph idx={}",
-                    loc, i
-                );
-            }
-            debug!("{} -> {}", i, loc);
-        }
-
-        debug!("text: {:?}", text);
-        debug!("(char idx): char->(glyph index):");
-        for (i, ch) in text.char_indices() {
-            debug!("{}: {:?} --> {}", i, ch, byte_to_glyph[i]);
-        }
-
-        let mut glyph_span = 0..0;
-        let mut byte_range = 0..0;
-
-        let mut y_pos = Au::zero();
-
-        // main loop over each glyph. each iteration usually processes 1 glyph and 1+ chars.
-        // in cases with complex glyph-character associations, 2+ glyphs and 1+ chars can be
-        // processed.
-        while glyph_span.start < glyph_count {
-            debug!("Processing glyph at idx={}", glyph_span.start);
-            glyph_span.end = glyph_span.start;
-            byte_range.end = glyph_data.byte_offset_of_glyph(glyph_span.start) as usize;
-
-            while byte_range.end < byte_max {
-                byte_range.end += 1;
-                // Extend the byte range to include any following byte without its own glyph.
-                while byte_range.end < byte_max && byte_to_glyph[byte_range.end] == NO_GLYPH {
-                    byte_range.end += 1;
-                }
-
-                // Extend the glyph range to include all glyphs covered by bytes processed so far.
-                let mut max_glyph_idx = glyph_span.end;
-                for glyph_idx in &byte_to_glyph[byte_range.clone()] {
-                    if *glyph_idx != NO_GLYPH {
-                        max_glyph_idx = cmp::max(*glyph_idx as usize + 1, max_glyph_idx);
-                    }
-                }
-                if max_glyph_idx > glyph_span.end {
-                    glyph_span.end = max_glyph_idx;
-                    debug!("Extended glyph span to {:?}", glyph_span);
-                }
-
-                // if there's just one glyph, then we don't need further checks.
-                if glyph_span.len() == 1 {
-                    break;
-                }
-
-                // if no glyphs were found yet, extend the char byte range more.
-                if glyph_span.is_empty() {
-                    continue;
-                }
-
-                // If byte_range now includes all the byte offsets found in glyph_span, then we
-                // have found a contiguous "cluster" and can stop extending it.
-                let mut all_glyphs_are_within_cluster: bool = true;
-                for j in glyph_span.clone() {
-                    let loc = glyph_data.byte_offset_of_glyph(j) as usize;
-                    if !(byte_range.start <= loc && loc < byte_range.end) {
-                        all_glyphs_are_within_cluster = false;
-                        break;
-                    }
-                }
-                if all_glyphs_are_within_cluster {
-                    break;
-                }
-
-                // Otherwise, the bytes we have seen so far correspond to a non-contiguous set of
-                // glyphs.  Keep extending byte_range until we fill in all the holes in the glyph
-                // span or reach the end of the text.
-            }
-
-            assert!(!byte_range.is_empty());
-            assert!(!glyph_span.is_empty());
-
-            // Now byte_range is the ligature clump formed by the glyphs in glyph_span.
-            // We will save these glyphs to the glyph store at the index of the first byte.
-            let byte_idx = ByteIndex(byte_range.start as isize);
-
-            if glyph_span.len() == 1 {
-                // Fast path: 1-to-1 mapping of byte offset to single glyph.
-                //
-                // TODO(Issue #214): cluster ranges need to be computed before
-                // shaping, and then consulted here.
-                // for now, just pretend that every character is a cluster start.
-                // (i.e., pretend there are no combining character sequences).
-                // 1-to-1 mapping of character to glyph also treated as ligature start.
-                //
-                // NB: When we acquire the ability to handle ligatures that cross word boundaries,
-                // we'll need to do something special to handle `word-spacing` properly.
-                let character = text[byte_range.clone()].chars().next().unwrap();
-                if is_bidi_control(character) {
-                    // Don't add any glyphs for bidi control chars
-                } else {
-                    let (glyph_id, advance, offset) = if character == '\t' {
-                        // Treat tabs in pre-formatted text as a fixed number of spaces. The glyph id does
-                        // not matter here as Servo doesn't render any glyphs for whitespace.
-                        //
-                        // TODO: Proper tab stops. This should happen in layout and be based on the
-                        // size of the space character of the inline formatting context.
-                        let font = unsafe { &(*self.font) };
-                        (
-                            font.glyph_index(' ').unwrap_or(0) as hb_codepoint_t,
-                            font.metrics.space_advance * 8,
-                            Default::default(),
-                        )
-                    } else {
-                        let shape = glyph_data.entry_for_glyph(glyph_span.start, &mut y_pos);
-                        let advance =
-                            self.advance_for_shaped_glyph(shape.advance, character, options);
-                        (shape.codepoint, advance, shape.offset)
-                    };
-
-                    let data = GlyphData::new(glyph_id, advance, offset, true, true);
-                    glyphs.add_glyph_for_byte_index(byte_idx, character, &data);
-                }
-            } else {
-                // collect all glyphs to be assigned to the first character.
-                let mut datas = vec![];
-
-                for glyph_i in glyph_span.clone() {
-                    let shape = glyph_data.entry_for_glyph(glyph_i, &mut y_pos);
-                    datas.push(GlyphData::new(
-                        shape.codepoint,
-                        shape.advance,
-                        shape.offset,
-                        true, // treat as cluster start
-                        glyph_i > glyph_span.start,
-                    ));
-                    // all but first are ligature continuations
-                }
-                // now add the detailed glyph entry.
-                glyphs.add_glyphs_for_byte_index(byte_idx, &datas);
-            }
-
-            glyph_span.start = glyph_span.end;
-            byte_range.start = byte_range.end;
-        }
-
-        // this must be called after adding all glyph data; it sorts the
-        // lookup table for finding detailed glyphs by associated char index.
-        glyphs.finalize_changes();
-    }
-
-    fn advance_for_shaped_glyph(
-        &self,
-        mut advance: Au,
-        character: char,
-        options: &ShapingOptions,
-    ) -> Au {
-        if let Some(letter_spacing) = options.letter_spacing {
-            advance += letter_spacing;
-        };
-
-        // CSS 2.1 § 16.4 states that "word spacing affects each space (U+0020) and non-breaking
-        // space (U+00A0) left in the text after the white space processing rules have been
-        // applied. The effect of the property on other word-separator characters is undefined."
-        // We elect to only space the two required code points.
-        if character == ' ' || character == '\u{a0}' {
-            // https://drafts.csswg.org/css-text-3/#word-spacing-property
-            advance += options.word_spacing;
-        }
-
-        advance
-    }
-
-    pub fn baseline(&self) -> Option<FontBaseline> {
-        unsafe { (*self.font).table_for_tag(BASE)? };
-
-        let mut hanging_baseline = 0;
-        let mut alphabetic_baseline = 0;
-        let mut ideographic_baseline = 0;
-
-        unsafe {
-            hb_ot_layout_get_baseline(
-                self.hb_font,
-                HB_OT_LAYOUT_BASELINE_TAG_ROMAN,
-                HB_DIRECTION_LTR,
-                HB_OT_TAG_DEFAULT_SCRIPT,
-                HB_OT_TAG_DEFAULT_LANGUAGE,
-                &mut alphabetic_baseline as *mut _,
-            );
-
-            hb_ot_layout_get_baseline(
-                self.hb_font,
-                HB_OT_LAYOUT_BASELINE_TAG_HANGING,
-                HB_DIRECTION_LTR,
-                HB_OT_TAG_DEFAULT_SCRIPT,
-                HB_OT_TAG_DEFAULT_LANGUAGE,
-                &mut hanging_baseline as *mut _,
-            );
-
-            hb_ot_layout_get_baseline(
-                self.hb_font,
-                HB_OT_LAYOUT_BASELINE_TAG_IDEO_EMBOX_BOTTOM_OR_LEFT,
-                HB_DIRECTION_LTR,
-                HB_OT_TAG_DEFAULT_SCRIPT,
-                HB_OT_TAG_DEFAULT_LANGUAGE,
-                &mut ideographic_baseline as *mut _,
-            );
-        }
-
-        Some(FontBaseline {
-            ideographic_baseline: Shaper::fixed_to_float(ideographic_baseline) as f32,
-            alphabetic_baseline: Shaper::fixed_to_float(alphabetic_baseline) as f32,
-            hanging_baseline: Shaper::fixed_to_float(hanging_baseline) as f32,
-        })
-    }
-}
-
-/// Callbacks from Harfbuzz when font map and glyph advance lookup needed.
-struct FontFuncs(*mut hb_font_funcs_t);
-
-unsafe impl Sync for FontFuncs {}
-unsafe impl Send for FontFuncs {}
-
-static HB_FONT_FUNCS: LazyLock<FontFuncs> = LazyLock::new(|| unsafe {
-    let hb_funcs = hb_font_funcs_create();
-    hb_font_funcs_set_nominal_glyph_func(hb_funcs, Some(glyph_func), ptr::null_mut(), None);
-    hb_font_funcs_set_glyph_h_advance_func(
-        hb_funcs,
-        Some(glyph_h_advance_func),
-        ptr::null_mut(),
-        None,
-    );
-
-    FontFuncs(hb_funcs)
-});
-
-extern "C" fn glyph_func(
-    _: *mut hb_font_t,
-    font_data: *mut c_void,
-    unicode: hb_codepoint_t,
-    glyph: *mut hb_codepoint_t,
-    _: *mut c_void,
-) -> hb_bool_t {
-    let font: *const Font = font_data as *const Font;
-    assert!(!font.is_null());
-
-    unsafe {
-        match (*font).glyph_index(char::from_u32(unicode).unwrap()) {
-            Some(g) => {
-                *glyph = g as hb_codepoint_t;
-                true as hb_bool_t
-            },
-            None => false as hb_bool_t,
-        }
-    }
-}
-
-extern "C" fn glyph_h_advance_func(
-    _: *mut hb_font_t,
-    font_data: *mut c_void,
-    glyph: hb_codepoint_t,
-    _: *mut c_void,
-) -> hb_position_t {
-    let font: *mut Font = font_data as *mut Font;
-    assert!(!font.is_null());
-
-    unsafe {
-        let advance = (*font).glyph_h_advance(glyph as GlyphId);
-        Shaper::float_to_fixed(advance)
-    }
-}
-
-// Callback to get a font table out of a font.
-extern "C" fn font_table_func(
-    _: *mut hb_face_t,
-    tag: hb_tag_t,
-    user_data: *mut c_void,
-) -> *mut hb_blob_t {
-    unsafe {
-        // NB: These asserts have security implications.
-        let font = user_data as *const Font;
-        assert!(!font.is_null());
-
-        // TODO(Issue #197): reuse font table data, which will change the unsound trickery here.
-        match (*font).table_for_tag(tag as FontTableTag) {
-            None => ptr::null_mut(),
-            Some(font_table) => {
-                // `Box::into_raw` intentionally leaks the FontTable so we don't destroy the buffer
-                // while HarfBuzz is using it.  When HarfBuzz is done with the buffer, it will pass
-                // this raw pointer back to `destroy_blob_func` which will deallocate the Box.
-                let font_table_ptr = Box::into_raw(Box::new(font_table));
-
-                let buf = (*font_table_ptr).buffer();
-                // HarfBuzz calls `destroy_blob_func` when the buffer is no longer needed.
-                let blob = hb_blob_create(
-                    buf.as_ptr() as *const c_char,
-                    buf.len() as c_uint,
-                    HB_MEMORY_MODE_READONLY,
-                    font_table_ptr as *mut c_void,
-                    Some(destroy_blob_func),
-                );
-
-                assert!(!blob.is_null());
-                blob
-            },
-        }
-    }
-}
-
-extern "C" fn destroy_blob_func(font_table_ptr: *mut c_void) {
-    unsafe {
-        drop(Box::from_raw(font_table_ptr as *mut FontTable));
-    }
-}

components/fonts/shapers/harfbuzz.rs

@@ -0,0 +1,423 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#![allow(unsafe_code)]
+
+use std::os::raw::{c_char, c_int, c_uint, c_void};
+use std::sync::LazyLock;
+use std::{char, ptr};
+
+use app_units::Au;
+use euclid::default::Point2D;
+// Eventually we would like the shaper to be pluggable, as many operating systems have their own
+// shapers. For now, however, HarfBuzz is a hard dependency.
+use harfbuzz_sys::{
+    HB_DIRECTION_LTR, HB_DIRECTION_RTL, HB_MEMORY_MODE_READONLY, HB_OT_LAYOUT_BASELINE_TAG_HANGING,
+    HB_OT_LAYOUT_BASELINE_TAG_IDEO_EMBOX_BOTTOM_OR_LEFT, HB_OT_LAYOUT_BASELINE_TAG_ROMAN,
+    hb_blob_create, hb_blob_t, hb_bool_t, hb_buffer_add_utf8, hb_buffer_create, hb_buffer_destroy,
+    hb_buffer_get_glyph_infos, hb_buffer_get_glyph_positions, hb_buffer_get_length,
+    hb_buffer_set_direction, hb_buffer_set_script, hb_buffer_t, hb_codepoint_t,
+    hb_face_create_for_tables, hb_face_destroy, hb_face_t, hb_feature_t, hb_font_create,
+    hb_font_destroy, hb_font_funcs_create, hb_font_funcs_set_glyph_h_advance_func,
+    hb_font_funcs_set_nominal_glyph_func, hb_font_funcs_t, hb_font_set_funcs, hb_font_set_ppem,
+    hb_font_set_scale, hb_font_set_variations, hb_font_t, hb_glyph_info_t, hb_glyph_position_t,
+    hb_ot_layout_get_baseline, hb_position_t, hb_script_from_iso15924_tag, hb_shape, hb_tag_t,
+    hb_variation_t,
+};
+use num_traits::Zero;
+
+use super::{HarfBuzzShapedGlyphData, ShapedGlyphEntry, unicode_script_to_iso15924_tag};
+use crate::platform::font::FontTable;
+use crate::{
+    BASE, Font, FontBaseline, FontTableMethods, FontTableTag, GlyphId, GlyphStore, KERN, LIGA,
+    OpenTypeTableTag, ShapingFlags, ShapingOptions, fixed_to_float, float_to_fixed, ot_tag,
+};
+
+const HB_OT_TAG_DEFAULT_SCRIPT: OpenTypeTableTag = ot_tag!('D', 'F', 'L', 'T');
+const HB_OT_TAG_DEFAULT_LANGUAGE: OpenTypeTableTag = ot_tag!('d', 'f', 'l', 't');
+
+pub struct ShapedGlyphData {
+    count: usize,
+    buffer: *mut hb_buffer_t,
+    glyph_infos: *mut hb_glyph_info_t,
+    pos_infos: *mut hb_glyph_position_t,
+}
+
+impl ShapedGlyphData {
+    /// Create a new [`ShapedGlyphData`] from the given HarfBuzz buffer.
+    ///
+    /// # Safety
+    ///
+    /// - Passing an invalid buffer pointer to this function results in undefined behavior.
+    /// - This function takes ownership of the buffer and the ShapedGlyphData destroys the buffer when dropped
+    ///   so the pointer must an owned pointer and must not be used after being passed to this function
+    unsafe fn new(buffer: *mut hb_buffer_t) -> ShapedGlyphData {
+        let mut glyph_count = 0;
+        let glyph_infos = unsafe { hb_buffer_get_glyph_infos(buffer, &mut glyph_count) };
+        assert!(!glyph_infos.is_null());
+        let mut pos_count = 0;
+        let pos_infos = unsafe { hb_buffer_get_glyph_positions(buffer, &mut pos_count) };
+        assert!(!pos_infos.is_null());
+        assert_eq!(glyph_count, pos_count);
+
+        ShapedGlyphData {
+            count: glyph_count as usize,
+            buffer,
+            glyph_infos,
+            pos_infos,
+        }
+    }
+}
+
+impl Drop for ShapedGlyphData {
+    fn drop(&mut self) {
+        unsafe { hb_buffer_destroy(self.buffer) }
+    }
+}
+
+impl HarfBuzzShapedGlyphData for ShapedGlyphData {
+    #[inline]
+    fn len(&self) -> usize {
+        self.count
+    }
+
+    #[inline(always)]
+    fn byte_offset_of_glyph(&self, i: usize) -> u32 {
+        assert!(i < self.count);
+
+        unsafe {
+            let glyph_info_i = self.glyph_infos.add(i);
+            (*glyph_info_i).cluster
+        }
+    }
+
+    /// Returns shaped glyph data for one glyph, and updates the y-position of the pen.
+    fn entry_for_glyph(&self, i: usize, y_pos: &mut Au) -> ShapedGlyphEntry {
+        assert!(i < self.count);
+
+        unsafe {
+            let glyph_info_i = self.glyph_infos.add(i);
+            let pos_info_i = self.pos_infos.add(i);
+            let x_offset = Shaper::fixed_to_float((*pos_info_i).x_offset);
+            let y_offset = Shaper::fixed_to_float((*pos_info_i).y_offset);
+            let x_advance = Shaper::fixed_to_float((*pos_info_i).x_advance);
+            let y_advance = Shaper::fixed_to_float((*pos_info_i).y_advance);
+
+            let x_offset = Au::from_f64_px(x_offset);
+            let y_offset = Au::from_f64_px(y_offset);
+            let x_advance = Au::from_f64_px(x_advance);
+            let y_advance = Au::from_f64_px(y_advance);
+
+            let offset = if x_offset.is_zero() && y_offset.is_zero() && y_advance.is_zero() {
+                None
+            } else {
+                // adjust the pen..
+                if y_advance > Au::zero() {
+                    *y_pos -= y_advance;
+                }
+
+                Some(Point2D::new(x_offset, *y_pos - y_offset))
+            };
+
+            ShapedGlyphEntry {
+                codepoint: (*glyph_info_i).codepoint as GlyphId,
+                advance: x_advance,
+                offset,
+            }
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct Shaper {
+    hb_face: *mut hb_face_t,
+    hb_font: *mut hb_font_t,
+    font: *const Font,
+}
+
+// The HarfBuzz API is thread safe as well as our `Font`, so we can make the data
+// structures here as thread-safe as well. This doesn't seem to be documented,
+// but was expressed as one of the original goals of the HarfBuzz API.
+unsafe impl Sync for Shaper {}
+unsafe impl Send for Shaper {}
+
+impl Drop for Shaper {
+    fn drop(&mut self) {
+        unsafe {
+            assert!(!self.hb_face.is_null());
+            hb_face_destroy(self.hb_face);
+
+            assert!(!self.hb_font.is_null());
+            hb_font_destroy(self.hb_font);
+        }
+    }
+}
+
+impl Shaper {
+    pub fn new(font: &Font) -> Shaper {
+        unsafe {
+            let hb_face: *mut hb_face_t = hb_face_create_for_tables(
+                Some(font_table_func),
+                font as *const Font as *mut c_void,
+                None,
+            );
+            let hb_font: *mut hb_font_t = hb_font_create(hb_face);
+
+            // Set points-per-em. if zero, performs no hinting in that direction.
+            let pt_size = font.descriptor.pt_size.to_f64_px();
+            hb_font_set_ppem(hb_font, pt_size as c_uint, pt_size as c_uint);
+
+            // Set scaling. Note that this takes 16.16 fixed point.
+            hb_font_set_scale(
+                hb_font,
+                Shaper::float_to_fixed(pt_size) as c_int,
+                Shaper::float_to_fixed(pt_size) as c_int,
+            );
+
+            // configure static function callbacks.
+            hb_font_set_funcs(
+                hb_font,
+                HB_FONT_FUNCS.0,
+                font as *const Font as *mut c_void,
+                None,
+            );
+
+            if servo_config::pref!(layout_variable_fonts_enabled) {
+                let variations = &font.variations();
+                if !variations.is_empty() {
+                    let variations: Vec<_> = variations
+                        .iter()
+                        .map(|variation| hb_variation_t {
+                            tag: variation.tag,
+
+                            value: variation.value,
+                        })
+                        .collect();
+
+                    hb_font_set_variations(hb_font, variations.as_ptr(), variations.len() as u32);
+                }
+            }
+
+            Shaper {
+                hb_face,
+                hb_font,
+                font,
+            }
+        }
+    }
+
+    /// Calculate the layout metrics associated with the given text with the [`Shaper`]s font.
+    fn shaped_glyph_data(&self, text: &str, options: &ShapingOptions) -> ShapedGlyphData {
+        unsafe {
+            let hb_buffer: *mut hb_buffer_t = hb_buffer_create();
+            hb_buffer_set_direction(
+                hb_buffer,
+                if options.flags.contains(ShapingFlags::RTL_FLAG) {
+                    HB_DIRECTION_RTL
+                } else {
+                    HB_DIRECTION_LTR
+                },
+            );
+
+            let script =
+                hb_script_from_iso15924_tag(unicode_script_to_iso15924_tag(options.script));
+            hb_buffer_set_script(hb_buffer, script);
+
+            hb_buffer_add_utf8(
+                hb_buffer,
+                text.as_ptr() as *const c_char,
+                text.len() as c_int,
+                0,
+                text.len() as c_int,
+            );
+
+            let mut features = Vec::new();
+            if options
+                .flags
+                .contains(ShapingFlags::IGNORE_LIGATURES_SHAPING_FLAG)
+            {
+                features.push(hb_feature_t {
+                    tag: LIGA,
+                    value: 0,
+                    start: 0,
+                    end: hb_buffer_get_length(hb_buffer),
+                })
+            }
+            if options
+                .flags
+                .contains(ShapingFlags::DISABLE_KERNING_SHAPING_FLAG)
+            {
+                features.push(hb_feature_t {
+                    tag: KERN,
+                    value: 0,
+                    start: 0,
+                    end: hb_buffer_get_length(hb_buffer),
+                })
+            }
+
+            hb_shape(
+                self.hb_font,
+                hb_buffer,
+                features.as_mut_ptr(),
+                features.len() as u32,
+            );
+
+            ShapedGlyphData::new(hb_buffer)
+        }
+    }
+
+    fn font(&self) -> &Font {
+        unsafe { &(*self.font) }
+    }
+
+    pub fn shape_text(&self, text: &str, options: &ShapingOptions, glyphs: &mut GlyphStore) {
+        let glyph_data = self.shaped_glyph_data(text, options);
+        let font = self.font();
+        super::shape_text_harfbuzz(&glyph_data, font, text, options, glyphs);
+    }
+
+    pub fn baseline(&self) -> Option<FontBaseline> {
+        unsafe { (*self.font).table_for_tag(BASE)? };
+
+        let mut hanging_baseline = 0;
+        let mut alphabetic_baseline = 0;
+        let mut ideographic_baseline = 0;
+
+        unsafe {
+            hb_ot_layout_get_baseline(
+                self.hb_font,
+                HB_OT_LAYOUT_BASELINE_TAG_ROMAN,
+                HB_DIRECTION_LTR,
+                HB_OT_TAG_DEFAULT_SCRIPT,
+                HB_OT_TAG_DEFAULT_LANGUAGE,
+                &mut alphabetic_baseline as *mut _,
+            );
+
+            hb_ot_layout_get_baseline(
+                self.hb_font,
+                HB_OT_LAYOUT_BASELINE_TAG_HANGING,
+                HB_DIRECTION_LTR,
+                HB_OT_TAG_DEFAULT_SCRIPT,
+                HB_OT_TAG_DEFAULT_LANGUAGE,
+                &mut hanging_baseline as *mut _,
+            );
+
+            hb_ot_layout_get_baseline(
+                self.hb_font,
+                HB_OT_LAYOUT_BASELINE_TAG_IDEO_EMBOX_BOTTOM_OR_LEFT,
+                HB_DIRECTION_LTR,
+                HB_OT_TAG_DEFAULT_SCRIPT,
+                HB_OT_TAG_DEFAULT_LANGUAGE,
+                &mut ideographic_baseline as *mut _,
+            );
+        }
+
+        Some(FontBaseline {
+            ideographic_baseline: Shaper::fixed_to_float(ideographic_baseline) as f32,
+            alphabetic_baseline: Shaper::fixed_to_float(alphabetic_baseline) as f32,
+            hanging_baseline: Shaper::fixed_to_float(hanging_baseline) as f32,
+        })
+    }
+
+    fn float_to_fixed(f: f64) -> i32 {
+        float_to_fixed(16, f)
+    }
+
+    fn fixed_to_float(i: hb_position_t) -> f64 {
+        fixed_to_float(16, i)
+    }
+}
+
+/// Callbacks from Harfbuzz when font map and glyph advance lookup needed.
+struct FontFuncs(*mut hb_font_funcs_t);
+
+unsafe impl Sync for FontFuncs {}
+unsafe impl Send for FontFuncs {}
+
+static HB_FONT_FUNCS: LazyLock<FontFuncs> = LazyLock::new(|| unsafe {
+    let hb_funcs = hb_font_funcs_create();
+    hb_font_funcs_set_nominal_glyph_func(hb_funcs, Some(glyph_func), ptr::null_mut(), None);
+    hb_font_funcs_set_glyph_h_advance_func(
+        hb_funcs,
+        Some(glyph_h_advance_func),
+        ptr::null_mut(),
+        None,
+    );
+
+    FontFuncs(hb_funcs)
+});
+
+extern "C" fn glyph_func(
+    _: *mut hb_font_t,
+    font_data: *mut c_void,
+    unicode: hb_codepoint_t,
+    glyph: *mut hb_codepoint_t,
+    _: *mut c_void,
+) -> hb_bool_t {
+    let font: *const Font = font_data as *const Font;
+    assert!(!font.is_null());
+
+    match unsafe { (*font).glyph_index(char::from_u32(unicode).unwrap()) } {
+        Some(g) => {
+            unsafe { *glyph = g as hb_codepoint_t };
+            true as hb_bool_t
+        },
+        None => false as hb_bool_t,
+    }
+}
+
+extern "C" fn glyph_h_advance_func(
+    _: *mut hb_font_t,
+    font_data: *mut c_void,
+    glyph: hb_codepoint_t,
+    _: *mut c_void,
+) -> hb_position_t {
+    let font: *mut Font = font_data as *mut Font;
+    assert!(!font.is_null());
+
+    let advance = unsafe { (*font).glyph_h_advance(glyph as GlyphId) };
+    Shaper::float_to_fixed(advance)
+}
+
+/// Callback to get a font table out of a font.
+extern "C" fn font_table_func(
+    _: *mut hb_face_t,
+    tag: hb_tag_t,
+    user_data: *mut c_void,
+) -> *mut hb_blob_t {
+    // NB: These asserts have security implications.
+    let font = user_data as *const Font;
+    assert!(!font.is_null());
+
+    // TODO(Issue #197): reuse font table data, which will change the unsound trickery here.
+    let Some(font_table) = (unsafe { (*font).table_for_tag(tag as FontTableTag) }) else {
+        return ptr::null_mut();
+    };
+
+    // `Box::into_raw` intentionally leaks the FontTable so we don't destroy the buffer
+    // while HarfBuzz is using it.  When HarfBuzz is done with the buffer, it will pass
+    // this raw pointer back to `destroy_blob_func` which will deallocate the Box.
+    let font_table_ptr = Box::into_raw(Box::new(font_table));
+
+    let buf = unsafe { (*font_table_ptr).buffer() };
+    // HarfBuzz calls `destroy_blob_func` when the buffer is no longer needed.
+    let blob = unsafe {
+        hb_blob_create(
+            buf.as_ptr() as *const c_char,
+            buf.len() as c_uint,
+            HB_MEMORY_MODE_READONLY,
+            font_table_ptr as *mut c_void,
+            Some(destroy_blob_func),
+        )
+    };
+
+    assert!(!blob.is_null());
+    blob
+}
+
+extern "C" fn destroy_blob_func(font_table_ptr: *mut c_void) {
+    unsafe {
+        drop(Box::from_raw(font_table_ptr as *mut FontTable));
+    }
+}

components/fonts/shapers/harfrust.rs

@@ -0,0 +1,252 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+use app_units::Au;
+use euclid::default::Point2D;
+use harfrust::{
+    Feature, FontRef as HarfRustFontRef, GlyphBuffer, Script, ShaperData, ShaperInstance, Tag,
+    UnicodeBuffer, Variation,
+};
+use num_traits::Zero as _;
+use read_fonts::TableProvider;
+use read_fonts::types::BigEndian;
+use smallvec::SmallVec;
+
+use super::{HarfBuzzShapedGlyphData, ShapedGlyphEntry, unicode_script_to_iso15924_tag};
+use crate::{Font, FontBaseline, FontData, GlyphStore, ShapingFlags, ShapingOptions};
+
+/// Convert a `webrender_api::FontVariation` to a `harfrust::Variation`
+fn wr_variation_to_hr_varation(wr_variation: webrender_api::FontVariation) -> harfrust::Variation {
+    Variation {
+        tag: Tag::from_u32(wr_variation.tag),
+        value: wr_variation.value,
+    }
+}
+
+pub struct ShapedGlyphData {
+    data: GlyphBuffer,
+    scale: f64,
+}
+
+impl HarfBuzzShapedGlyphData for ShapedGlyphData {
+    fn len(&self) -> usize {
+        self.data.len()
+    }
+
+    fn byte_offset_of_glyph(&self, i: usize) -> u32 {
+        self.data.glyph_infos()[i].cluster
+    }
+
+    fn entry_for_glyph(&self, i: usize, y_pos: &mut app_units::Au) -> super::ShapedGlyphEntry {
+        let glyph_info_i = self.data.glyph_infos()[i];
+        let pos_info_i = self.data.glyph_positions()[i];
+        let x_offset = Au::from_f64_px(pos_info_i.x_offset as f64 * self.scale);
+        let y_offset = Au::from_f64_px(pos_info_i.y_offset as f64 * self.scale);
+        let x_advance = Au::from_f64_px(pos_info_i.x_advance as f64 * self.scale);
+        let y_advance = Au::from_f64_px(pos_info_i.y_advance as f64 * self.scale);
+
+        let offset = if x_offset.is_zero() && y_offset.is_zero() && y_advance.is_zero() {
+            None
+        } else {
+            // adjust the pen..
+            if y_advance > Au::zero() {
+                *y_pos -= y_advance;
+            }
+
+            Some(Point2D::new(x_offset, *y_pos - y_offset))
+        };
+
+        ShapedGlyphEntry {
+            codepoint: glyph_info_i.glyph_id,
+            advance: x_advance,
+            offset,
+        }
+    }
+}
+
+pub struct Shaper {
+    font: *const Font,
+    /// The raw byte data of the font
+    font_data: FontData,
+    /// The index of a font in it's collection (.ttc)
+    /// If the font file is not a collection then this is 0
+    font_index: u32,
+    // Used for scaling HarfRust's output
+    scale: f64,
+    ppem: f64,
+
+    /// Pre-computed data for shaping a font
+    shaper_data: ShaperData,
+
+    /// Pre-computed data for shaping a variable font with a particular set of variations.
+    /// If there are no variations then we don't create a ShaperInstance.
+    shaper_instance: Option<ShaperInstance>,
+}
+
+// `Font` and `FontData` are both threadsafe, so we can make the data structures here as thread-safe as well.
+#[allow(unsafe_code)]
+unsafe impl Sync for Shaper {}
+#[allow(unsafe_code)]
+unsafe impl Send for Shaper {}
+
+impl Shaper {
+    pub(crate) fn new(font: &Font) -> Self {
+        let raw_font = font
+            .font_data_and_index()
+            .expect("Error creating shaper for font");
+        let font_data = raw_font.data.clone();
+        let font_index = raw_font.index;
+
+        // Set points-per-em. if zero, performs no hinting in that direction
+        let ppem = font.descriptor.pt_size.to_f64_px();
+        let font_ref = read_fonts::FontRef::from_index(font_data.as_ref(), font_index).unwrap();
+        let units_per_em = font_ref.head().unwrap().units_per_em();
+        let scale = ppem / (units_per_em as f64);
+
+        // Create cached shaping data for the font
+        let hr_font = HarfRustFontRef::from_index(font_data.as_ref(), font_index).unwrap();
+        let shaper_data = ShaperData::new(&hr_font);
+
+        // If variable fonts are enabled and the font has variations, create a ShaperInstance to set on the shaper.
+        let variations = font.variations();
+        let shaper_instance =
+            if servo_config::pref!(layout_variable_fonts_enabled) && !variations.is_empty() {
+                let variations_iter = variations.iter().copied().map(wr_variation_to_hr_varation);
+                Some(ShaperInstance::from_variations(&hr_font, variations_iter))
+            } else {
+                None
+            };
+
+        Self {
+            font: font as *const Font,
+            font_data,
+            font_index,
+            scale,
+            ppem,
+            shaper_data,
+            shaper_instance,
+        }
+    }
+}
+
+impl Shaper {
+    fn shaped_glyph_data(&self, text: &str, options: &crate::ShapingOptions) -> ShapedGlyphData {
+        let mut buffer = UnicodeBuffer::new();
+
+        // Set direction
+        buffer.set_direction(if options.flags.contains(ShapingFlags::RTL_FLAG) {
+            harfrust::Direction::RightToLeft
+        } else {
+            harfrust::Direction::LeftToRight
+        });
+
+        // Set script
+        let script_tag = Tag::from_u32(unicode_script_to_iso15924_tag(options.script));
+        let script = Script::from_iso15924_tag(script_tag).unwrap();
+        buffer.set_script(script);
+
+        // Push text
+        buffer.push_str(text);
+
+        // Features
+        let mut features = SmallVec::<[Feature; 2]>::new();
+        if options
+            .flags
+            .contains(ShapingFlags::IGNORE_LIGATURES_SHAPING_FLAG)
+        {
+            features.push(Feature::new(Tag::new(b"liga"), 0, ..));
+        }
+        if options
+            .flags
+            .contains(ShapingFlags::DISABLE_KERNING_SHAPING_FLAG)
+        {
+            features.push(Feature::new(Tag::new(b"kern"), 0, ..));
+        }
+
+        let hr_font =
+            HarfRustFontRef::from_index(self.font_data.as_ref(), self.font_index).unwrap();
+        let shaper = self
+            .shaper_data
+            .shaper(&hr_font)
+            .instance(self.shaper_instance.as_ref())
+            .build();
+
+        let glyph_buffer = shaper.shape(buffer, &features);
+
+        ShapedGlyphData {
+            data: glyph_buffer,
+            scale: self.scale,
+        }
+    }
+
+    #[allow(unsafe_code)]
+    fn font(&self) -> &Font {
+        // SAFETY: the font actually owns this shaper so it cannot have been dropped
+        unsafe { &(*self.font) }
+    }
+
+    pub fn shape_text(&self, text: &str, options: &ShapingOptions, glyphs: &mut GlyphStore) {
+        let glyph_data = self.shaped_glyph_data(text, options);
+        let font = self.font();
+        super::shape_text_harfbuzz(&glyph_data, font, text, options, glyphs);
+    }
+
+    pub fn baseline(&self) -> Option<crate::FontBaseline> {
+        let font_ref =
+            read_fonts::FontRef::from_index(self.font_data.as_ref(), self.font_index).unwrap();
+
+        // Load the horizontal axis of the BASE table
+        let base_table = font_ref.base().ok()?;
+        let horiz_axis = base_table.horiz_axis()?.ok()?;
+
+        // Get the index of each baseline tag in the tag list
+        let tag_list = horiz_axis.base_tag_list()?.ok()?;
+        let baseline_tags = tag_list.baseline_tags();
+        let romn_tag_idx = baseline_tags
+            .binary_search(&BigEndian::from(Tag::new(b"romn")))
+            .ok();
+        let hang_tag_idx = baseline_tags
+            .binary_search(&BigEndian::from(Tag::new(b"hang")))
+            .ok();
+        let ideo_tag_idx = baseline_tags
+            .binary_search(&BigEndian::from(Tag::new(b"ideo")))
+            .ok();
+
+        // Bail early if none of the baseline tags exist in the tag list
+        if romn_tag_idx.is_none() && hang_tag_idx.is_none() && ideo_tag_idx.is_none() {
+            return None;
+        }
+
+        // Find the DFLT (default) script record
+        let script_list = horiz_axis.base_script_list().ok()?;
+        let script_records = script_list.base_script_records();
+        let default_script_record_idx = script_records
+            .binary_search_by_key(&Tag::from_be_bytes(*b"DFLT"), |record| {
+                record.base_script_tag()
+            })
+            .ok()?;
+        let default_script_record = &script_records[default_script_record_idx];
+
+        // Lookup the baseline coordinates DFLT script record
+        let base_script = default_script_record
+            .base_script(script_list.offset_data())
+            .ok()?;
+        let base_script_values = base_script.base_values()?.ok()?;
+        let base_coords = base_script_values.base_coords();
+
+        // Search for the baseline corresponding to a given baseline index
+        let get_coord = |idx: usize| -> Option<f32> {
+            base_coords
+                .get(idx)
+                .ok()
+                .map(|coord| coord.coordinate() as f32 * self.scale as f32)
+        };
+
+        Some(FontBaseline {
+            ideographic_baseline: ideo_tag_idx.and_then(get_coord).unwrap_or(0.0),
+            alphabetic_baseline: romn_tag_idx.and_then(get_coord).unwrap_or(0.0),
+            hanging_baseline: hang_tag_idx.and_then(get_coord).unwrap_or(0.0),
+        })
+    }
+}

components/fonts/shapers/mod.rs

@@ -0,0 +1,227 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+use std::cmp;
+
+use app_units::Au;
+use base::text::is_bidi_control;
+use euclid::default::Point2D;
+use fonts_traits::ByteIndex;
+use log::debug;
+use num_traits::Zero as _;
+
+use crate::{Font, GlyphData, GlyphId, GlyphStore, ShapingOptions, advance_for_shaped_glyph};
+
+#[cfg(feature = "harfbuzz")]
+mod harfbuzz;
+#[cfg(feature = "harfbuzz")]
+pub use harfbuzz::Shaper;
+
+#[cfg(feature = "harfrust")]
+mod harfrust;
+#[cfg(all(feature = "harfrust", not(feature = "harfbuzz")))]
+pub use harfrust::Shaper;
+
+const NO_GLYPH: i32 = -1;
+
+/// Utility function to convert a `unicode_script::Script` enum into the corresponding `c_uint` tag that
+/// harfbuzz uses to represent unicode scipts.
+fn unicode_script_to_iso15924_tag(script: unicode_script::Script) -> u32 {
+    let bytes: [u8; 4] = match script {
+        unicode_script::Script::Unknown => *b"Zzzz",
+        _ => {
+            let short_name = script.short_name();
+            short_name.as_bytes().try_into().unwrap()
+        },
+    };
+
+    u32::from_be_bytes(bytes)
+}
+
+struct ShapedGlyphEntry {
+    codepoint: GlyphId,
+    advance: Au,
+    offset: Option<Point2D<Au>>,
+}
+
+/// Holds the results of shaping. Abstracts over HarfBuzz and HarfRust which return data in very similar
+/// form but with different types
+trait HarfBuzzShapedGlyphData {
+    /// The number of shaped glyphs
+    fn len(&self) -> usize;
+    /// The byte offset of the shaped glyph in the souce text
+    fn byte_offset_of_glyph(&self, i: usize) -> u32;
+    /// Returns shaped glyph data for one glyph, and updates the y-position of the pen.
+    fn entry_for_glyph(&self, i: usize, y_pos: &mut Au) -> ShapedGlyphEntry;
+}
+
+/// Shape text using an `impl HarfBuzzShaper`
+fn shape_text_harfbuzz<ShapedGlyphData: HarfBuzzShapedGlyphData>(
+    glyph_data: &ShapedGlyphData,
+    font: &Font,
+    text: &str,
+    options: &ShapingOptions,
+    glyphs: &mut GlyphStore,
+) {
+    let glyph_count = glyph_data.len();
+    let byte_max = text.len();
+
+    debug!(
+        "Shaped text[byte count={}], got back {} glyph info records.",
+        byte_max, glyph_count
+    );
+
+    // make map of what chars have glyphs
+    let mut byte_to_glyph = vec![NO_GLYPH; byte_max];
+
+    debug!("(glyph idx) -> (text byte offset)");
+    for i in 0..glyph_data.len() {
+        let loc = glyph_data.byte_offset_of_glyph(i) as usize;
+        if loc < byte_max {
+            byte_to_glyph[loc] = i as i32;
+        } else {
+            debug!(
+                "ERROR: tried to set out of range byte_to_glyph: idx={}, glyph idx={}",
+                loc, i
+            );
+        }
+        debug!("{} -> {}", i, loc);
+    }
+
+    debug!("text: {:?}", text);
+    debug!("(char idx): char->(glyph index):");
+    for (i, ch) in text.char_indices() {
+        debug!("{}: {:?} --> {}", i, ch, byte_to_glyph[i]);
+    }
+
+    let mut glyph_span = 0..0;
+    let mut byte_range = 0..0;
+
+    let mut y_pos = Au::zero();
+
+    // main loop over each glyph. each iteration usually processes 1 glyph and 1+ chars.
+    // in cases with complex glyph-character associations, 2+ glyphs and 1+ chars can be
+    // processed.
+    while glyph_span.start < glyph_count {
+        debug!("Processing glyph at idx={}", glyph_span.start);
+        glyph_span.end = glyph_span.start;
+        byte_range.end = glyph_data.byte_offset_of_glyph(glyph_span.start) as usize;
+
+        while byte_range.end < byte_max {
+            byte_range.end += 1;
+            // Extend the byte range to include any following byte without its own glyph.
+            while byte_range.end < byte_max && byte_to_glyph[byte_range.end] == NO_GLYPH {
+                byte_range.end += 1;
+            }
+
+            // Extend the glyph range to include all glyphs covered by bytes processed so far.
+            let mut max_glyph_idx = glyph_span.end;
+            for glyph_idx in &byte_to_glyph[byte_range.clone()] {
+                if *glyph_idx != NO_GLYPH {
+                    max_glyph_idx = cmp::max(*glyph_idx as usize + 1, max_glyph_idx);
+                }
+            }
+            if max_glyph_idx > glyph_span.end {
+                glyph_span.end = max_glyph_idx;
+                debug!("Extended glyph span to {:?}", glyph_span);
+            }
+
+            // if there's just one glyph, then we don't need further checks.
+            if glyph_span.len() == 1 {
+                break;
+            }
+
+            // if no glyphs were found yet, extend the char byte range more.
+            if glyph_span.is_empty() {
+                continue;
+            }
+
+            // If byte_range now includes all the byte offsets found in glyph_span, then we
+            // have found a contiguous "cluster" and can stop extending it.
+            let mut all_glyphs_are_within_cluster: bool = true;
+            for j in glyph_span.clone() {
+                let loc = glyph_data.byte_offset_of_glyph(j) as usize;
+                if !(byte_range.start <= loc && loc < byte_range.end) {
+                    all_glyphs_are_within_cluster = false;
+                    break;
+                }
+            }
+            if all_glyphs_are_within_cluster {
+                break;
+            }
+
+            // Otherwise, the bytes we have seen so far correspond to a non-contiguous set of
+            // glyphs.  Keep extending byte_range until we fill in all the holes in the glyph
+            // span or reach the end of the text.
+        }
+
+        assert!(!byte_range.is_empty());
+        assert!(!glyph_span.is_empty());
+
+        // Now byte_range is the ligature clump formed by the glyphs in glyph_span.
+        // We will save these glyphs to the glyph store at the index of the first byte.
+        let byte_idx = ByteIndex(byte_range.start as isize);
+
+        if glyph_span.len() == 1 {
+            // Fast path: 1-to-1 mapping of byte offset to single glyph.
+            //
+            // TODO(Issue #214): cluster ranges need to be computed before
+            // shaping, and then consulted here.
+            // for now, just pretend that every character is a cluster start.
+            // (i.e., pretend there are no combining character sequences).
+            // 1-to-1 mapping of character to glyph also treated as ligature start.
+            //
+            // NB: When we acquire the ability to handle ligatures that cross word boundaries,
+            // we'll need to do something special to handle `word-spacing` properly.
+            let character = text[byte_range.clone()].chars().next().unwrap();
+            if is_bidi_control(character) {
+                // Don't add any glyphs for bidi control chars
+            } else {
+                let (glyph_id, advance, offset) = if character == '\t' {
+                    // Treat tabs in pre-formatted text as a fixed number of spaces. The glyph id does
+                    // not matter here as Servo doesn't render any glyphs for whitespace.
+                    //
+                    // TODO: Proper tab stops. This should happen in layout and be based on the
+                    // size of the space character of the inline formatting context.
+                    (
+                        font.glyph_index(' ').unwrap_or(0),
+                        font.metrics.space_advance * 8,
+                        Default::default(),
+                    )
+                } else {
+                    let shape = glyph_data.entry_for_glyph(glyph_span.start, &mut y_pos);
+                    let advance = advance_for_shaped_glyph(shape.advance, character, options);
+                    (shape.codepoint, advance, shape.offset)
+                };
+
+                let data = GlyphData::new(glyph_id, advance, offset, true, true);
+                glyphs.add_glyph_for_byte_index(byte_idx, character, &data);
+            }
+        } else {
+            // collect all glyphs to be assigned to the first character.
+            let mut datas = vec![];
+
+            for glyph_i in glyph_span.clone() {
+                let shape = glyph_data.entry_for_glyph(glyph_i, &mut y_pos);
+                datas.push(GlyphData::new(
+                    shape.codepoint,
+                    shape.advance,
+                    shape.offset,
+                    true, // treat as cluster start
+                    glyph_i > glyph_span.start,
+                ));
+                // all but first are ligature continuations
+            }
+            // now add the detailed glyph entry.
+            glyphs.add_glyphs_for_byte_index(byte_idx, &datas);
+        }
+
+        glyph_span.start = glyph_span.end;
+        byte_range.start = byte_range.end;
+    }
+
+    // this must be called after adding all glyph data; it sorts the
+    // lookup table for finding detailed glyphs by associated char index.
+    glyphs.finalize_changes();
+}

components/fonts/system_font_service.rs

@@ -28,7 +28,7 @@ use style::values::computed::font::{
 };
 use style::values::computed::{FontStretch, FontWeight};
 use style::values::specified::FontStretch as SpecifiedFontStretch;
-use webrender_api::{FontInstanceFlags, FontInstanceKey, FontKey};
+use webrender_api::{FontInstanceFlags, FontInstanceKey, FontKey, FontVariation};
 
 use crate::font::FontDescriptor;
 use crate::font_store::FontStore;
@@ -65,6 +65,7 @@ pub enum SystemFontServiceMessage {
         FontIdentifier,
         Au,
         FontInstanceFlags,
+        Vec<FontVariation>,
         IpcSender<FontInstanceKey>,
     ),
     GetFontKey(IpcSender<FontKey>),
@@ -94,7 +95,7 @@ pub struct SystemFontService {
     local_families: FontStore,
     compositor_api: CrossProcessCompositorApi,
     webrender_fonts: HashMap<FontIdentifier, FontKey>,
-    font_instances: HashMap<(FontKey, Au), FontInstanceKey>,
+    font_instances: HashMap<(FontKey, Au, Vec<FontVariation>), FontInstanceKey>,
     generic_fonts: ResolvedGenericFontFamilies,
 
     /// This is an optimization that allows the [`SystemFontService`] to send font data to
@@ -176,8 +177,15 @@ impl SystemFontService {
                     let _ =
                         result_sender.send(self.get_font_templates(font_descriptor, font_family));
                 },
-                SystemFontServiceMessage::GetFontInstance(identifier, pt_size, flags, result) => {
-                    let _ = result.send(self.get_font_instance(identifier, pt_size, flags));
+                SystemFontServiceMessage::GetFontInstance(
+                    identifier,
+                    pt_size,
+                    flags,
+                    variations,
+                    result,
+                ) => {
+                    let _ =
+                        result.send(self.get_font_instance(identifier, pt_size, flags, variations));
                 },
                 SystemFontServiceMessage::GetFontKey(result_sender) => {
                     self.fetch_new_keys();
@@ -281,6 +289,7 @@ impl SystemFontService {
         identifier: FontIdentifier,
         pt_size: Au,
         flags: FontInstanceFlags,
+        variations: Vec<FontVariation>,
     ) -> FontInstanceKey {
         self.fetch_new_keys();
 
@@ -301,7 +310,7 @@ impl SystemFontService {
 
         *self
             .font_instances
-            .entry((font_key, pt_size))
+            .entry((font_key, pt_size, variations.clone()))
             .or_insert_with(|| {
                 let font_instance_key = self.free_font_instance_keys.pop().unwrap();
                 compositor_api.add_font_instance(
@@ -309,6 +318,7 @@ impl SystemFontService {
                     font_key,
                     pt_size.to_f32_px(),
                     flags,
+                    variations,
                 );
                 font_instance_key
             })
@@ -363,7 +373,7 @@ struct FontTemplateCacheKey {
 
 /// The public interface to the [`SystemFontService`], used by per-Document
 /// `FontContext` instances.
-#[derive(Debug)]
+#[derive(Debug, MallocSizeOf)]
 pub struct SystemFontServiceProxy {
     sender: Mutex<IpcSender<SystemFontServiceMessage>>,
     templates: RwLock<HashMap<FontTemplateCacheKey, Vec<FontTemplateRef>>>,
@@ -473,6 +483,7 @@ impl SystemFontServiceProxy {
         identifier: FontIdentifier,
         size: Au,
         flags: FontInstanceFlags,
+        variations: Vec<FontVariation>,
     ) -> FontInstanceKey {
         let (response_chan, response_port) = ipc::channel().expect("failed to create IPC channel");
         self.sender
@@ -481,6 +492,7 @@ impl SystemFontServiceProxy {
                 identifier,
                 size,
                 flags,
+                variations,
                 response_chan,
             ))
             .expect("failed to send message to system font service");

components/fonts/tests/font.rs

@@ -27,7 +27,7 @@ fn make_font(path: PathBuf) -> Font {
     let data = FontData::from_bytes(&bytes);
 
     let identifier = FontIdentifier::Web(ServoUrl::from_file_path(path).unwrap());
-    let platform_font = PlatformFont::new_from_data(identifier.clone(), &data, None).unwrap();
+    let platform_font = PlatformFont::new_from_data(identifier.clone(), &data, None, &[]).unwrap();
 
     let template = FontTemplate {
         identifier,
@@ -40,6 +40,7 @@ fn make_font(path: PathBuf) -> Font {
         style: FontStyle::normal(),
         variant: FontVariantCaps::Normal,
         pt_size: Au::from_px(24),
+        variation_settings: vec![],
     };
     Font::new(FontTemplateRef::new(template), descriptor, Some(data), None).unwrap()
 }

components/fonts/tests/font_context.rs

@@ -9,8 +9,8 @@ mod font_context {
     use std::collections::HashMap;
     use std::ffi::OsStr;
     use std::path::PathBuf;
-    use std::sync::Arc;
     use std::sync::atomic::{AtomicI32, Ordering};
+    use std::sync::{Arc, Once};
     use std::thread;
 
     use app_units::Au;
@@ -23,7 +23,7 @@ mod font_context {
         SystemFontServiceProxySender, fallback_font_families,
     };
     use ipc_channel::ipc::{self, IpcReceiver};
-    use net_traits::ResourceThreads;
+    use net_traits::{ResourceThreads, start_fetch_thread};
     use parking_lot::Mutex;
     use servo_arc::Arc as ServoArc;
     use style::ArcSlice;
@@ -36,6 +36,8 @@ mod font_context {
     use stylo_atoms::Atom;
     use webrender_api::{FontInstanceKey, FontKey, IdNamespace};
 
+    static INIT: Once = Once::new();
+
     struct TestContext {
         context: FontContext,
         system_font_service: Arc<MockSystemFontService>,
@@ -53,6 +55,9 @@ mod font_context {
             let mock_compositor_api = CrossProcessCompositorApi::dummy();
 
             let proxy_clone = Arc::new(system_font_service_proxy.to_sender().to_proxy());
+            INIT.call_once(|| {
+                start_fetch_thread();
+            });
             Self {
                 context: FontContext::new(proxy_clone, mock_compositor_api, mock_resource_threads),
                 system_font_service,
@@ -128,7 +133,7 @@ mod font_context {
                         );
                     },
                     SystemFontServiceMessage::GetFontInstanceKey(result_sender) |
-                    SystemFontServiceMessage::GetFontInstance(_, _, _, result_sender) => {
+                    SystemFontServiceMessage::GetFontInstance(_, _, _, _, result_sender) => {
                         let _ = result_sender.send(FontInstanceKey(IdNamespace(0), 0));
                     },
                     SystemFontServiceMessage::GetFontKey(result_sender) => {
@@ -182,9 +187,12 @@ mod font_context {
                 path: path.to_str().expect("Could not load test font").into(),
                 variation_index: 0,
             };
-            let handle =
-                PlatformFont::new_from_local_font_identifier(local_font_identifier.clone(), None)
-                    .expect("Could not load test font");
+            let handle = PlatformFont::new_from_local_font_identifier(
+                local_font_identifier.clone(),
+                None,
+                &[],
+            )
+            .expect("Could not load test font");
 
             family.add_template(FontTemplate::new(
                 FontIdentifier::Local(local_font_identifier),
@@ -347,6 +355,7 @@ mod font_context {
             style: FontStyle::normal(),
             variant: FontVariantCaps::Normal,
             pt_size: Au(10),
+            variation_settings: vec![],
         };
 
         let family = SingleFontFamily::FamilyName(FamilyName {

components/fonts/tests/font_template.rs

@@ -36,7 +36,7 @@ fn test_font_template_descriptor() {
             .unwrap();
         let data = FontData::from_bytes(&bytes);
 
-        let handle = PlatformFont::new_from_data(identifier, &data, None).unwrap();
+        let handle = PlatformFont::new_from_data(identifier, &data, None, &[]).unwrap();
         handle.descriptor()
     }
 

components/geometry/Cargo.toml

@@ -16,4 +16,5 @@ app_units = { workspace = true }
 euclid = { workspace = true }
 malloc_size_of = { workspace = true }
 malloc_size_of_derive = { workspace = true }
+webrender = { workspace = true }
 webrender_api = { workspace = true }

components/geometry/lib.rs

@@ -8,9 +8,10 @@ use app_units::{Au, MAX_AU, MIN_AU};
 use euclid::default::{Point2D as UntypedPoint2D, Rect as UntypedRect, Size2D as UntypedSize2D};
 use euclid::{Box2D, Length, Point2D, Scale, SideOffsets2D, Size2D, Vector2D};
 use malloc_size_of_derive::MallocSizeOf;
+use webrender::FastTransform;
 use webrender_api::units::{
-    DeviceIntRect, DeviceIntSize, DevicePixel, FramebufferPixel, LayoutPoint, LayoutRect,
-    LayoutSize,
+    DeviceIntRect, DeviceIntSize, DevicePixel, FramebufferPixel, LayoutPixel, LayoutPoint,
+    LayoutRect, LayoutSize,
 };
 
 // Units for use with euclid::length and euclid::scale_factor.
@@ -46,6 +47,8 @@ pub type DeviceIndependentPoint = Point2D<f32, DeviceIndependentPixel>;
 pub type DeviceIndependentVector2D = Vector2D<f32, DeviceIndependentPixel>;
 pub type DeviceIndependentSize = Size2D<f32, DeviceIndependentPixel>;
 
+pub type FastLayoutTransform = FastTransform<LayoutPixel, LayoutPixel>;
+
 // An Au is an "App Unit" and represents 1/60th of a CSS pixel.  It was
 // originally proposed in 2002 as a standard unit of measure in Gecko.
 // See https://bugzilla.mozilla.org/show_bug.cgi?id=177805 for more info.

components/hyper_serde/lib.rs

@@ -431,6 +431,10 @@ impl Serialize for Ser<'_, HeaderMap> {
             {
                 let mut serializer = serializer.serialize_seq(Some(self.0.len()))?;
                 for v in self.0 {
+                    #[allow(
+                        clippy::collapsible_if,
+                        reason = "let chains are not available in 1.85"
+                    )]
                     if self.1 {
                         if let Ok(v) = str::from_utf8(v) {
                             serializer.serialize_element(v)?;

components/layout/Cargo.toml

@@ -22,12 +22,12 @@ atomic_refcell = { workspace = true }
 base = { workspace = true }
 bitflags = { workspace = true }
 compositing_traits = { workspace = true }
-constellation_traits = { workspace = true }
+cssparser = { workspace = true }
 data-url = { workspace = true }
 embedder_traits = { workspace = true }
 euclid = { workspace = true }
 fnv = { workspace = true }
-fonts = { path = "../fonts" }
+fonts = { path = "../fonts", default-features = false }
 fonts_traits = { workspace = true }
 fxhash = { workspace = true }
 html5ever = { workspace = true }
@@ -35,6 +35,7 @@ icu_locid = { workspace = true }
 icu_segmenter = { workspace = true }
 ipc-channel = { workspace = true }
 itertools = { workspace = true }
+kurbo = { workspace = true }
 layout_api = { workspace = true }
 log = { workspace = true }
 malloc_size_of = { workspace = true }

components/layout/construct_modern.rs

@@ -69,10 +69,10 @@ impl<'dom> ModernContainerJob<'dom> {
                     BlockContainer::InlineFormattingContext(inline_formatting_context),
                 );
                 let info: &NodeAndStyleInfo = anonymous_info;
-                let formatting_context = IndependentFormattingContext {
-                    base: LayoutBoxBase::new(info.into(), info.style.clone()),
-                    contents: IndependentFormattingContextContents::Flow(block_formatting_context),
-                };
+                let formatting_context = IndependentFormattingContext::new(
+                    LayoutBoxBase::new(info.into(), info.style.clone()),
+                    IndependentFormattingContextContents::Flow(block_formatting_context),
+                );
 
                 Some(ModernItem {
                     kind: ModernItemKind::InFlow(formatting_context),
@@ -228,7 +228,7 @@ impl<'a, 'dom> ModernContainerBuilder<'a, 'dom> {
 
         let anonymous_info = LazyLock::new(|| {
             self.info
-                .pseudo(self.context, PseudoElement::ServoAnonymousBox)
+                .with_pseudo_element(self.context, PseudoElement::ServoAnonymousBox)
                 .expect("Should always be able to construct info for anonymous boxes.")
         });
 

components/layout/context.rs

@@ -4,10 +4,12 @@
 
 use std::sync::Arc;
 
+use embedder_traits::UntrustedNodeAddress;
 use euclid::Size2D;
 use fnv::FnvHashMap;
 use fonts::FontContext;
 use fxhash::FxHashMap;
+use layout_api::wrapper_traits::ThreadSafeLayoutNode;
 use layout_api::{
     IFrameSizes, ImageAnimationState, PendingImage, PendingImageState, PendingRasterizationImage,
 };
@@ -17,6 +19,7 @@ use net_traits::image_cache::{
 };
 use parking_lot::{Mutex, RwLock};
 use pixels::RasterImage;
+use script::layout_dom::ServoThreadSafeLayoutNode;
 use servo_url::{ImmutableOrigin, ServoUrl};
 use style::context::SharedStyleContext;
 use style::dom::OpaqueNode;
@@ -56,13 +59,11 @@ pub enum ResolvedImage<'a> {
 pub enum ResolveImageError {
     LoadError,
     ImagePending,
-    ImageRequested,
     OnlyMetadata,
     InvalidUrl,
     MissingNode,
     ImageMissingFromImageSet,
-    FailedToResolveImageFromImageSet,
-    NotImplementedYet(&'static str),
+    NotImplementedYet,
     None,
 }
 
@@ -86,6 +87,13 @@ pub(crate) struct ImageResolver {
     /// size determined by layout. This will be shared with the script thread.
     pub pending_rasterization_images: Mutex<Vec<PendingRasterizationImage>>,
 
+    /// A list of `SVGSVGElement`s encountered during layout that are not
+    /// serialized yet. This is needed to support inline SVGs as they are treated
+    /// as replaced elements and the layout is responsible for triggering the
+    /// network load for the corresponding serialzed data: urls (similar to
+    /// background images).
+    pub pending_svg_elements_for_serialization: Mutex<Vec<UntrustedNodeAddress>>,
+
     /// A shared reference to script's map of DOM nodes with animated images. This is used
     /// to manage image animations in script and inform the script about newly animating
     /// nodes.
@@ -105,6 +113,11 @@ impl Drop for ImageResolver {
         if !std::thread::panicking() {
             assert!(self.pending_images.lock().is_empty());
             assert!(self.pending_rasterization_images.lock().is_empty());
+            assert!(
+                self.pending_svg_elements_for_serialization
+                    .lock()
+                    .is_empty()
+            );
         }
     }
 }
@@ -174,7 +187,7 @@ impl ImageResolver {
         }
     }
 
-    fn get_cached_image_for_url(
+    pub(crate) fn get_cached_image_for_url(
         &self,
         node: OpaqueNode,
         url: ServoUrl,
@@ -234,6 +247,15 @@ impl ImageResolver {
         result
     }
 
+    pub(crate) fn queue_svg_element_for_serialization(
+        &self,
+        element: ServoThreadSafeLayoutNode<'_>,
+    ) {
+        self.pending_svg_elements_for_serialization
+            .lock()
+            .push(element.opaque().into())
+    }
+
     pub(crate) fn resolve_image<'a>(
         &self,
         node: Option<OpaqueNode>,
@@ -242,10 +264,8 @@ impl ImageResolver {
         match image {
             // TODO: Add support for PaintWorklet and CrossFade rendering.
             Image::None => Result::Err(ResolveImageError::None),
-            Image::CrossFade(_) => Result::Err(ResolveImageError::NotImplementedYet("CrossFade")),
-            Image::PaintWorklet(_) => {
-                Result::Err(ResolveImageError::NotImplementedYet("PaintWorklet"))
-            },
+            Image::CrossFade(_) => Result::Err(ResolveImageError::NotImplementedYet),
+            Image::PaintWorklet(_) => Result::Err(ResolveImageError::NotImplementedYet),
             Image::Gradient(gradient) => Ok(ResolvedImage::Gradient(gradient)),
             Image::Url(image_url) => {
                 // FIXME: images won’t always have in intrinsic width or

components/layout/display_list/background.rs

@@ -65,7 +65,11 @@ impl<'a> BackgroundPainter<'a> {
         if &BackgroundAttachment::Fixed ==
             get_cyclic(&background.background_attachment.0, layer_index)
         {
-            return builder.compositor_info.viewport_size.into();
+            return builder
+                .compositor_info
+                .viewport_details
+                .layout_size()
+                .into();
         }
 
         match get_cyclic(&background.background_clip.0, layer_index) {
@@ -149,7 +153,11 @@ impl<'a> BackgroundPainter<'a> {
                 Origin::PaddingBox => *fragment_builder.padding_rect(),
                 Origin::BorderBox => fragment_builder.border_rect,
             },
-            BackgroundAttachment::Fixed => builder.compositor_info.viewport_size.into(),
+            BackgroundAttachment::Fixed => builder
+                .compositor_info
+                .viewport_details
+                .layout_size()
+                .into(),
         }
     }
 }

components/layout/display_list/clip.rs

@@ -4,6 +4,7 @@
 
 use app_units::Au;
 use base::id::ScrollTreeNodeId;
+use malloc_size_of_derive::MallocSizeOf;
 use style::values::computed::basic_shape::{BasicShape, ClipPath};
 use style::values::computed::length_percentage::NonNegativeLengthPercentage;
 use style::values::computed::position::Position;
@@ -16,7 +17,7 @@ use super::{BuilderForBoxFragment, compute_margin_box_radius, normalize_radii};
 
 /// An identifier for a clip used during StackingContextTree construction. This is a simple index in
 /// a [`ClipStore`]s vector of clips.
-#[derive(Clone, Copy, Debug, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, Hash, MallocSizeOf, PartialEq)]
 pub(crate) struct ClipId(pub usize);
 
 impl ClipId {
@@ -27,7 +28,7 @@ impl ClipId {
 /// All the information needed to create a clip on a WebRender display list. These are created at
 /// two times: during `StackingContextTree` creation and during WebRender display list construction.
 /// Only the former are stored in a [`ClipStore`].
-#[derive(Clone)]
+#[derive(Clone, MallocSizeOf)]
 pub(crate) struct Clip {
     pub id: ClipId,
     pub radii: BorderRadius,
@@ -39,10 +40,14 @@ pub(crate) struct Clip {
 /// A simple vector of [`Clip`] that is built during `StackingContextTree` construction.
 /// These are later turned into WebRender clips and clip chains during WebRender display
 /// list construction.
-#[derive(Clone, Default)]
+#[derive(Clone, Default, MallocSizeOf)]
 pub(crate) struct StackingContextTreeClipStore(pub Vec<Clip>);
 
 impl StackingContextTreeClipStore {
+    pub(super) fn get(&self, clip_id: ClipId) -> &Clip {
+        &self.0[clip_id.0]
+    }
+
     pub(crate) fn add(
         &mut self,
         radii: webrender_api::BorderRadius,

components/layout/display_list/hit_test.rs

@@ -0,0 +1,415 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+use std::collections::HashMap;
+
+use app_units::Au;
+use base::id::ScrollTreeNodeId;
+use embedder_traits::Cursor;
+use euclid::{Box2D, Vector2D};
+use kurbo::{Ellipse, Shape};
+use layout_api::{ElementsFromPointFlags, ElementsFromPointResult};
+use servo_geometry::FastLayoutTransform;
+use style::computed_values::backface_visibility::T as BackfaceVisibility;
+use style::computed_values::pointer_events::T as PointerEvents;
+use style::computed_values::visibility::T as Visibility;
+use style::properties::ComputedValues;
+use style::values::computed::ui::CursorKind;
+use webrender_api::BorderRadius;
+use webrender_api::units::{LayoutPoint, LayoutRect, LayoutSize, RectExt};
+
+use crate::display_list::clip::{Clip, ClipId};
+use crate::display_list::stacking_context::StackingContextSection;
+use crate::display_list::{
+    StackingContext, StackingContextContent, StackingContextTree, ToWebRender,
+};
+use crate::fragment_tree::{Fragment, FragmentFlags};
+use crate::geom::PhysicalRect;
+
+pub(crate) struct HitTest<'a> {
+    /// The flags which describe how to perform this [`HitTest`].
+    flags: ElementsFromPointFlags,
+    /// The point to test for this hit test, relative to the page.
+    point_to_test: LayoutPoint,
+    /// A cached version of [`Self::point_to_test`] projected to a spatial node, to avoid
+    /// doing a lot of matrix math over and over.
+    projected_point_to_test: Option<(ScrollTreeNodeId, LayoutPoint, FastLayoutTransform)>,
+    /// The stacking context tree against which to perform the hit test.
+    stacking_context_tree: &'a StackingContextTree,
+    /// The resulting [`HitTestResultItems`] for this hit test.
+    results: Vec<ElementsFromPointResult>,
+    /// A cache of hit test results for shared clip nodes.
+    clip_hit_test_results: HashMap<ClipId, bool>,
+}
+
+impl<'a> HitTest<'a> {
+    pub(crate) fn run(
+        stacking_context_tree: &'a StackingContextTree,
+        point_to_test: LayoutPoint,
+        flags: ElementsFromPointFlags,
+    ) -> Vec<ElementsFromPointResult> {
+        let mut hit_test = Self {
+            flags,
+            point_to_test,
+            projected_point_to_test: None,
+            stacking_context_tree,
+            results: Vec::new(),
+            clip_hit_test_results: HashMap::new(),
+        };
+        stacking_context_tree
+            .root_stacking_context
+            .hit_test(&mut hit_test);
+        hit_test.results
+    }
+
+    /// Perform a hit test against a the clip node for the given [`ClipId`], returning
+    /// true if it is not clipped out or false if is clipped out.
+    fn hit_test_clip_id(&mut self, clip_id: ClipId) -> bool {
+        if clip_id == ClipId::INVALID {
+            return true;
+        }
+
+        if let Some(result) = self.clip_hit_test_results.get(&clip_id) {
+            return *result;
+        }
+
+        let clip = self.stacking_context_tree.clip_store.get(clip_id);
+        let result = self
+            .location_in_spatial_node(clip.parent_scroll_node_id)
+            .is_some_and(|(point, _)| {
+                clip.contains(point) && self.hit_test_clip_id(clip.parent_clip_id)
+            });
+        self.clip_hit_test_results.insert(clip_id, result);
+        result
+    }
+
+    /// Get the hit test location in the coordinate system of the given spatial node,
+    /// returning `None` if the transformation is uninvertible or the point cannot be
+    /// projected into the spatial node.
+    fn location_in_spatial_node(
+        &mut self,
+        scroll_tree_node_id: ScrollTreeNodeId,
+    ) -> Option<(LayoutPoint, FastLayoutTransform)> {
+        match self.projected_point_to_test {
+            Some((cached_scroll_tree_node_id, projected_point, transform))
+                if cached_scroll_tree_node_id == scroll_tree_node_id =>
+            {
+                return Some((projected_point, transform));
+            },
+            _ => {},
+        }
+
+        let transform = self
+            .stacking_context_tree
+            .compositor_info
+            .scroll_tree
+            .cumulative_root_to_node_transform(&scroll_tree_node_id)?;
+
+        let projected_point = transform.project_point2d(self.point_to_test)?;
+
+        self.projected_point_to_test = Some((scroll_tree_node_id, projected_point, transform));
+        Some((projected_point, transform))
+    }
+}
+
+impl Clip {
+    fn contains(&self, point: LayoutPoint) -> bool {
+        rounded_rect_contains_point(self.rect, &self.radii, point)
+    }
+}
+
+impl StackingContext {
+    /// Perform a hit test against a [`StackingContext`]. Note that this is the reverse
+    /// of the stacking context walk algorithm in `stacking_context.rs`. Any changes made
+    /// here should be reflected in the forward version in that file.
+    fn hit_test(&self, hit_test: &mut HitTest) -> bool {
+        let mut contents = self.contents.iter().rev().peekable();
+
+        // Step 10: Outlines
+        while contents
+            .peek()
+            .is_some_and(|child| child.section() == StackingContextSection::Outline)
+        {
+            // The hit test will not hit the outline.
+            let _ = contents.next().unwrap();
+        }
+
+        // Steps 8 and 9: Stacking contexts with non-negative ‘z-index’, and
+        // positioned stacking containers (where ‘z-index’ is auto)
+        let mut real_stacking_contexts_and_positioned_stacking_containers = self
+            .real_stacking_contexts_and_positioned_stacking_containers
+            .iter()
+            .rev()
+            .peekable();
+        while real_stacking_contexts_and_positioned_stacking_containers
+            .peek()
+            .is_some_and(|child| child.z_index() >= 0)
+        {
+            let child = real_stacking_contexts_and_positioned_stacking_containers
+                .next()
+                .unwrap();
+            if child.hit_test(hit_test) {
+                return true;
+            }
+        }
+
+        // Steps 7 and 8: Fragments and inline stacking containers
+        while contents
+            .peek()
+            .is_some_and(|child| child.section() == StackingContextSection::Foreground)
+        {
+            let child = contents.next().unwrap();
+            if self.hit_test_content(child, hit_test) {
+                return true;
+            }
+        }
+
+        // Step 6: Float stacking containers
+        for child in self.float_stacking_containers.iter().rev() {
+            if child.hit_test(hit_test) {
+                return true;
+            }
+        }
+
+        // Step 5: Block backgrounds and borders
+        while contents.peek().is_some_and(|child| {
+            child.section() == StackingContextSection::DescendantBackgroundsAndBorders
+        }) {
+            let child = contents.next().unwrap();
+            if self.hit_test_content(child, hit_test) {
+                return true;
+            }
+        }
+
+        // Step 4: Stacking contexts with negative ‘z-index’
+        for child in real_stacking_contexts_and_positioned_stacking_containers {
+            if child.hit_test(hit_test) {
+                return true;
+            }
+        }
+
+        // Steps 2 and 3: Borders and background for the root
+        while contents.peek().is_some_and(|child| {
+            child.section() == StackingContextSection::OwnBackgroundsAndBorders
+        }) {
+            let child = contents.next().unwrap();
+            if self.hit_test_content(child, hit_test) {
+                return true;
+            }
+        }
+        false
+    }
+
+    pub(crate) fn hit_test_content(
+        &self,
+        content: &StackingContextContent,
+        hit_test: &mut HitTest<'_>,
+    ) -> bool {
+        match content {
+            StackingContextContent::Fragment {
+                scroll_node_id,
+                clip_id,
+                containing_block,
+                fragment,
+                ..
+            } => {
+                hit_test.hit_test_clip_id(*clip_id) &&
+                    fragment.hit_test(hit_test, *scroll_node_id, containing_block)
+            },
+            StackingContextContent::AtomicInlineStackingContainer { index } => {
+                self.atomic_inline_stacking_containers[*index].hit_test(hit_test)
+            },
+        }
+    }
+}
+
+impl Fragment {
+    pub(crate) fn hit_test(
+        &self,
+        hit_test: &mut HitTest,
+        spatial_node_id: ScrollTreeNodeId,
+        containing_block: &PhysicalRect<Au>,
+    ) -> bool {
+        let Some(tag) = self.tag() else {
+            return false;
+        };
+
+        let mut hit_test_fragment_inner =
+            |style: &ComputedValues,
+             fragment_rect: PhysicalRect<Au>,
+             border_radius: BorderRadius,
+             fragment_flags: FragmentFlags,
+             auto_cursor: Cursor| {
+                let is_root_element = fragment_flags.contains(FragmentFlags::IS_ROOT_ELEMENT);
+
+                if !is_root_element {
+                    if style.get_inherited_ui().pointer_events == PointerEvents::None {
+                        return false;
+                    }
+                    if style.get_inherited_box().visibility != Visibility::Visible {
+                        return false;
+                    }
+                }
+
+                let (point_in_spatial_node, transform) =
+                    match hit_test.location_in_spatial_node(spatial_node_id) {
+                        Some(point) => point,
+                        None => return false,
+                    };
+
+                if !is_root_element &&
+                    style.get_box().backface_visibility == BackfaceVisibility::Hidden &&
+                    transform.is_backface_visible()
+                {
+                    return false;
+                }
+
+                let fragment_rect = fragment_rect.translate(containing_block.origin.to_vector());
+                if is_root_element {
+                    let viewport_size = hit_test
+                        .stacking_context_tree
+                        .compositor_info
+                        .viewport_details
+                        .size;
+                    let viewport_rect = LayoutRect::from_origin_and_size(
+                        Default::default(),
+                        viewport_size.cast_unit(),
+                    );
+                    if !viewport_rect.contains(hit_test.point_to_test) {
+                        return false;
+                    }
+                } else if !rounded_rect_contains_point(
+                    fragment_rect.to_webrender(),
+                    &border_radius,
+                    point_in_spatial_node,
+                ) {
+                    return false;
+                }
+
+                let point_in_target = point_in_spatial_node.cast_unit() -
+                    Vector2D::new(
+                        fragment_rect.origin.x.to_f32_px(),
+                        fragment_rect.origin.y.to_f32_px(),
+                    );
+
+                hit_test.results.push(ElementsFromPointResult {
+                    node: tag.node,
+                    point_in_target,
+                    cursor: cursor(style.get_inherited_ui().cursor.keyword, auto_cursor),
+                });
+                !hit_test.flags.contains(ElementsFromPointFlags::FindAll)
+            };
+
+        match self {
+            Fragment::Box(box_fragment) | Fragment::Float(box_fragment) => {
+                let box_fragment = box_fragment.borrow();
+                hit_test_fragment_inner(
+                    &box_fragment.style,
+                    box_fragment.border_rect(),
+                    box_fragment.border_radius(),
+                    box_fragment.base.flags,
+                    Cursor::Default,
+                )
+            },
+            Fragment::Text(text) => {
+                let text = &*text.borrow();
+                hit_test_fragment_inner(
+                    &text.inline_styles.style.borrow(),
+                    text.rect,
+                    BorderRadius::zero(),
+                    FragmentFlags::empty(),
+                    Cursor::Text,
+                )
+            },
+            _ => false,
+        }
+    }
+}
+
+fn rounded_rect_contains_point(
+    rect: LayoutRect,
+    border_radius: &BorderRadius,
+    point: LayoutPoint,
+) -> bool {
+    if !rect.contains(point) {
+        return false;
+    }
+
+    if border_radius.is_zero() {
+        return true;
+    }
+
+    let check_corner = |corner: LayoutPoint, radius: &LayoutSize, is_right, is_bottom| {
+        let mut origin = corner;
+        if is_right {
+            origin.x -= radius.width;
+        }
+        if is_bottom {
+            origin.y -= radius.height;
+        }
+        if !Box2D::from_origin_and_size(origin, *radius).contains(point) {
+            return true;
+        }
+        let center = (
+            if is_right {
+                corner.x - radius.width
+            } else {
+                corner.x + radius.width
+            },
+            if is_bottom {
+                corner.y - radius.height
+            } else {
+                corner.y + radius.height
+            },
+        );
+        let radius = (radius.width as f64, radius.height as f64);
+        Ellipse::new(center, radius, 0.0).contains((point.x, point.y).into())
+    };
+
+    check_corner(rect.top_left(), &border_radius.top_left, false, false) &&
+        check_corner(rect.top_right(), &border_radius.top_right, true, false) &&
+        check_corner(rect.bottom_right(), &border_radius.bottom_right, true, true) &&
+        check_corner(rect.bottom_left(), &border_radius.bottom_left, false, true)
+}
+
+fn cursor(kind: CursorKind, auto_cursor: Cursor) -> Cursor {
+    match kind {
+        CursorKind::Auto => auto_cursor,
+        CursorKind::None => Cursor::None,
+        CursorKind::Default => Cursor::Default,
+        CursorKind::Pointer => Cursor::Pointer,
+        CursorKind::ContextMenu => Cursor::ContextMenu,
+        CursorKind::Help => Cursor::Help,
+        CursorKind::Progress => Cursor::Progress,
+        CursorKind::Wait => Cursor::Wait,
+        CursorKind::Cell => Cursor::Cell,
+        CursorKind::Crosshair => Cursor::Crosshair,
+        CursorKind::Text => Cursor::Text,
+        CursorKind::VerticalText => Cursor::VerticalText,
+        CursorKind::Alias => Cursor::Alias,
+        CursorKind::Copy => Cursor::Copy,
+        CursorKind::Move => Cursor::Move,
+        CursorKind::NoDrop => Cursor::NoDrop,
+        CursorKind::NotAllowed => Cursor::NotAllowed,
+        CursorKind::Grab => Cursor::Grab,
+        CursorKind::Grabbing => Cursor::Grabbing,
+        CursorKind::EResize => Cursor::EResize,
+        CursorKind::NResize => Cursor::NResize,
+        CursorKind::NeResize => Cursor::NeResize,
+        CursorKind::NwResize => Cursor::NwResize,
+        CursorKind::SResize => Cursor::SResize,
+        CursorKind::SeResize => Cursor::SeResize,
+        CursorKind::SwResize => Cursor::SwResize,
+        CursorKind::WResize => Cursor::WResize,
+        CursorKind::EwResize => Cursor::EwResize,
+        CursorKind::NsResize => Cursor::NsResize,
+        CursorKind::NeswResize => Cursor::NeswResize,
+        CursorKind::NwseResize => Cursor::NwseResize,
+        CursorKind::ColResize => Cursor::ColResize,
+        CursorKind::RowResize => Cursor::RowResize,
+        CursorKind::AllScroll => Cursor::AllScroll,
+        CursorKind::ZoomIn => Cursor::ZoomIn,
+        CursorKind::ZoomOut => Cursor::ZoomOut,
+    }
+}

components/layout/display_list/mod.rs

@@ -6,15 +6,12 @@ use std::cell::{OnceCell, RefCell};
 use std::sync::Arc;
 
 use app_units::{AU_PER_PX, Au};
-use base::WebRenderEpochToU16;
 use base::id::ScrollTreeNodeId;
 use clip::{Clip, ClipId};
 use compositing_traits::display_list::{CompositorDisplayListInfo, SpatialTreeNodeInfo};
-use embedder_traits::Cursor;
 use euclid::{Point2D, Scale, SideOffsets2D, Size2D, UnknownUnit, Vector2D};
 use fonts::GlyphStore;
 use gradient::WebRenderGradient;
-use layout_api::ReflowRequest;
 use net_traits::image_cache::Image as CachedImage;
 use range::Range as ServoRange;
 use servo_arc::Arc as ServoArc;
@@ -37,19 +34,18 @@ use style::values::computed::{
 use style::values::generics::NonNegative;
 use style::values::generics::rect::Rect;
 use style::values::specified::text::TextDecorationLine;
-use style::values::specified::ui::CursorKind;
 use style_traits::{CSSPixel as StyloCSSPixel, DevicePixel as StyloDevicePixel};
 use webrender_api::units::{DeviceIntSize, DevicePixel, LayoutPixel, LayoutRect, LayoutSize};
 use webrender_api::{
-    self as wr, BorderDetails, BoxShadowClipMode, BuiltDisplayList, ClipChainId, ClipMode,
-    CommonItemProperties, ComplexClipRegion, ImageRendering, NinePatchBorder,
-    NinePatchBorderSource, PropertyBinding, SpatialId, SpatialTreeItemKey, units,
+    self as wr, BorderDetails, BorderRadius, BoxShadowClipMode, BuiltDisplayList, ClipChainId,
+    ClipMode, CommonItemProperties, ComplexClipRegion, NinePatchBorder, NinePatchBorderSource,
+    PrimitiveFlags, PropertyBinding, SpatialId, SpatialTreeItemKey, units,
 };
 use wr::units::LayoutVector2D;
 
 use crate::cell::ArcRefCell;
 use crate::context::{ImageResolver, ResolvedImage};
-pub use crate::display_list::conversions::ToWebRender;
+pub(crate) use crate::display_list::conversions::ToWebRender;
 use crate::display_list::stacking_context::StackingContextSection;
 use crate::fragment_tree::{
     BackgroundMode, BoxFragment, Fragment, FragmentFlags, FragmentTree, SpecificLayoutInfo, Tag,
@@ -65,14 +61,13 @@ mod background;
 mod clip;
 mod conversions;
 mod gradient;
+mod hit_test;
 mod stacking_context;
 
 use background::BackgroundPainter;
-pub use stacking_context::*;
+pub(crate) use hit_test::HitTest;
+pub(crate) use stacking_context::*;
 
-// webrender's `ItemTag` is private.
-type ItemTag = (u64, u16);
-type HitInfo = Option<ItemTag>;
 const INSERTION_POINT_LOGICAL_WIDTH: Au = Au(AU_PER_PX);
 
 pub(crate) struct DisplayListBuilder<'a> {
@@ -149,7 +144,11 @@ struct HighlightTraversalState {
 impl InspectorHighlight {
     fn for_node(node: OpaqueNode) -> Self {
         Self {
-            tag: Tag::new(node),
+            tag: Tag {
+                node,
+                // TODO: Support highlighting pseudo-elements.
+                pseudo_element_chain: Default::default(),
+            },
             state: None,
         }
     }
@@ -157,19 +156,18 @@ impl InspectorHighlight {
 
 impl DisplayListBuilder<'_> {
     pub(crate) fn build(
-        reflow_request: &ReflowRequest,
         stacking_context_tree: &mut StackingContextTree,
         fragment_tree: &FragmentTree,
         image_resolver: Arc<ImageResolver>,
         device_pixel_ratio: Scale<f32, StyloCSSPixel, StyloDevicePixel>,
+        highlighted_dom_node: Option<OpaqueNode>,
         debug: &DebugOptions,
     ) -> BuiltDisplayList {
         // Build the rest of the display list which inclues all of the WebRender primitives.
         let compositor_info = &mut stacking_context_tree.compositor_info;
-        compositor_info.hit_test_info.clear();
-
+        let pipeline_id = compositor_info.pipeline_id;
         let mut webrender_display_list_builder =
-            webrender_api::DisplayListBuilder::new(compositor_info.pipeline_id);
+            webrender_api::DisplayListBuilder::new(pipeline_id);
         webrender_display_list_builder.begin();
 
         // `dump_serialized_display_list` doesn't actually print anything. It sets up
@@ -189,9 +187,7 @@ impl DisplayListBuilder<'_> {
             current_clip_id: ClipId::INVALID,
             webrender_display_list_builder: &mut webrender_display_list_builder,
             compositor_info,
-            inspector_highlight: reflow_request
-                .highlighted_dom_node
-                .map(InspectorHighlight::for_node),
+            inspector_highlight: highlighted_dom_node.map(InspectorHighlight::for_node),
             paint_body_background: true,
             clip_map: Default::default(),
             image_resolver,
@@ -204,6 +200,8 @@ impl DisplayListBuilder<'_> {
             builder.add_clip_to_display_list(clip);
         }
 
+        builder.push_hit_tests_for_scrollable_areas(&stacking_context_tree.hit_test_items);
+
         // Paint the canvas’ background (if any) before/under everything else
         stacking_context_tree
             .root_stacking_context
@@ -275,7 +273,7 @@ impl DisplayListBuilder<'_> {
                         info.origin,
                         *parent_spatial_node_id,
                         info.transform_style,
-                        PropertyBinding::Value(info.transform),
+                        PropertyBinding::Value(*info.transform.to_transform()),
                         info.kind,
                         spatial_tree_item_key,
                     );
@@ -313,6 +311,39 @@ impl DisplayListBuilder<'_> {
         self.compositor_info.scroll_tree = scroll_tree;
     }
 
+    fn push_hit_tests_for_scrollable_areas(
+        &mut self,
+        scroll_frame_hit_test_items: &[ScrollFrameHitTestItem],
+    ) {
+        // Add a single hit test that covers the entire viewport, so that WebRender knows
+        // which pipeline it hits when doing hit testing.
+        let pipeline_id = self.compositor_info.pipeline_id;
+        let viewport_size = self.compositor_info.viewport_details.size;
+        let viewport_rect = LayoutRect::from_size(viewport_size.cast_unit());
+        self.wr().push_hit_test(
+            viewport_rect,
+            ClipChainId::INVALID,
+            SpatialId::root_reference_frame(pipeline_id),
+            PrimitiveFlags::default(),
+            (0, 0), /* tag */
+        );
+
+        for item in scroll_frame_hit_test_items {
+            let spatial_id = self
+                .compositor_info
+                .scroll_tree
+                .webrender_id(&item.scroll_node_id);
+            let clip_chain_id = self.clip_chain_id(item.clip_id);
+            self.wr().push_hit_test(
+                item.rect,
+                clip_chain_id,
+                spatial_id,
+                PrimitiveFlags::default(),
+                (item.external_scroll_id.0, 0), /* tag */
+            );
+        }
+    }
+
     /// Add the given [`Clip`] to the WebRender display list and create a mapping from
     /// its [`ClipId`] to a WebRender [`ClipChainId`]. This happens:
     ///  - When WebRender display list construction starts: All clips created during the
@@ -394,27 +425,6 @@ impl DisplayListBuilder<'_> {
         }
     }
 
-    fn hit_info(
-        &mut self,
-        style: &ComputedValues,
-        tag: Option<Tag>,
-        auto_cursor: Cursor,
-    ) -> HitInfo {
-        use style::computed_values::pointer_events::T as PointerEvents;
-
-        let inherited_ui = style.get_inherited_ui();
-        if inherited_ui.pointer_events == PointerEvents::None {
-            return None;
-        }
-
-        let hit_test_index = self.compositor_info.add_hit_test_info(
-            tag?.node.0 as u64,
-            Some(cursor(inherited_ui.cursor.keyword, auto_cursor)),
-            self.current_scroll_node_id,
-        );
-        Some((hit_test_index as u64, self.compositor_info.epoch.as_u16()))
-    }
-
     /// Draw highlights around the node that is currently hovered in the devtools.
     fn paint_dom_inspector_highlight(&mut self) {
         let Some(highlight) = self
@@ -573,7 +583,6 @@ impl Fragment {
         builder: &mut DisplayListBuilder,
         containing_block: &PhysicalRect<Au>,
         section: StackingContextSection,
-        is_hit_test_for_scrollable_overflow: bool,
         is_collapsed_table_borders: bool,
         text_decorations: &Arc<Vec<FragmentTextDecoration>>,
     ) {
@@ -597,7 +606,6 @@ impl Fragment {
                     Visibility::Visible => BuilderForBoxFragment::new(
                         box_fragment,
                         containing_block,
-                        is_hit_test_for_scrollable_overflow,
                         is_collapsed_table_borders,
                     )
                     .build(builder, section),
@@ -605,20 +613,7 @@ impl Fragment {
                     Visibility::Collapse => (),
                 }
             },
-            Fragment::AbsoluteOrFixedPositioned(_) => {},
-            Fragment::Positioning(positioning_fragment) => {
-                let positioning_fragment = positioning_fragment.borrow();
-                let rect = positioning_fragment
-                    .rect
-                    .translate(containing_block.origin.to_vector());
-                self.maybe_push_hit_test_for_style_and_tag(
-                    builder,
-                    &positioning_fragment.style,
-                    positioning_fragment.base.tag,
-                    rect,
-                    Cursor::Default,
-                );
-            },
+            Fragment::AbsoluteOrFixedPositioned(_) | Fragment::Positioning(_) => {},
             Fragment::Image(image) => {
                 let image = image.borrow();
                 match image.style.get_inherited_box().visibility {
@@ -700,31 +695,6 @@ impl Fragment {
         }
     }
 
-    fn maybe_push_hit_test_for_style_and_tag(
-        &self,
-        builder: &mut DisplayListBuilder,
-        style: &ComputedValues,
-        tag: Option<Tag>,
-        rect: PhysicalRect<Au>,
-        cursor: Cursor,
-    ) {
-        let hit_info = builder.hit_info(style, tag, cursor);
-        let hit_info = match hit_info {
-            Some(hit_info) => hit_info,
-            None => return,
-        };
-
-        let clip_chain_id = builder.clip_chain_id(builder.current_clip_id);
-        let spatial_id = builder.spatial_id(builder.current_scroll_node_id);
-        builder.wr().push_hit_test(
-            rect.to_webrender(),
-            clip_chain_id,
-            spatial_id,
-            style.get_webrender_primitive_flags(),
-            hit_info,
-        );
-    }
-
     fn build_display_list_for_text_fragment(
         &self,
         fragment: &TextFragment,
@@ -754,14 +724,6 @@ impl Fragment {
         }
 
         let parent_style = fragment.inline_styles.style.borrow();
-        self.maybe_push_hit_test_for_style_and_tag(
-            builder,
-            &parent_style,
-            fragment.base.tag,
-            rect,
-            Cursor::Text,
-        );
-
         let color = parent_style.clone_color();
         let font_metrics = &fragment.font_metrics;
         let dppx = builder.device_pixel_ratio.get();
@@ -975,7 +937,6 @@ struct BuilderForBoxFragment<'a> {
     border_edge_clip_chain_id: RefCell<Option<ClipChainId>>,
     padding_edge_clip_chain_id: RefCell<Option<ClipChainId>>,
     content_edge_clip_chain_id: RefCell<Option<ClipChainId>>,
-    is_hit_test_for_scrollable_overflow: bool,
     is_collapsed_table_borders: bool,
 }
 
@@ -983,48 +944,22 @@ impl<'a> BuilderForBoxFragment<'a> {
     fn new(
         fragment: &'a BoxFragment,
         containing_block: &'a PhysicalRect<Au>,
-        is_hit_test_for_scrollable_overflow: bool,
         is_collapsed_table_borders: bool,
     ) -> Self {
         let border_rect = fragment
             .border_rect()
             .translate(containing_block.origin.to_vector());
-
-        let webrender_border_rect = border_rect.to_webrender();
-        let border_radius = {
-            let resolve = |radius: &LengthPercentage, box_size: Au| {
-                radius.to_used_value(box_size).to_f32_px()
-            };
-            let corner = |corner: &style::values::computed::BorderCornerRadius| {
-                Size2D::new(
-                    resolve(&corner.0.width.0, border_rect.size.width),
-                    resolve(&corner.0.height.0, border_rect.size.height),
-                )
-            };
-            let b = fragment.style.get_border();
-            let mut radius = wr::BorderRadius {
-                top_left: corner(&b.border_top_left_radius),
-                top_right: corner(&b.border_top_right_radius),
-                bottom_right: corner(&b.border_bottom_right_radius),
-                bottom_left: corner(&b.border_bottom_left_radius),
-            };
-
-            normalize_radii(&webrender_border_rect, &mut radius);
-            radius
-        };
-
         Self {
             fragment,
             containing_block,
-            border_rect: webrender_border_rect,
-            border_radius,
+            border_rect: border_rect.to_webrender(),
+            border_radius: fragment.border_radius(),
             margin_rect: OnceCell::new(),
             padding_rect: OnceCell::new(),
             content_rect: OnceCell::new(),
             border_edge_clip_chain_id: RefCell::new(None),
             padding_edge_clip_chain_id: RefCell::new(None),
             content_edge_clip_chain_id: RefCell::new(None),
-            is_hit_test_for_scrollable_overflow,
             is_collapsed_table_borders,
         }
     }
@@ -1107,11 +1042,6 @@ impl<'a> BuilderForBoxFragment<'a> {
     }
 
     fn build(&mut self, builder: &mut DisplayListBuilder, section: StackingContextSection) {
-        if self.is_hit_test_for_scrollable_overflow {
-            self.build_hit_test(builder, self.fragment.scrollable_overflow().to_webrender());
-            return;
-        }
-
         if self.is_collapsed_table_borders {
             self.build_collapsed_table_borders(builder);
             return;
@@ -1122,7 +1052,6 @@ impl<'a> BuilderForBoxFragment<'a> {
             return;
         }
 
-        self.build_hit_test(builder, self.border_rect);
         if self
             .fragment
             .base
@@ -1137,30 +1066,6 @@ impl<'a> BuilderForBoxFragment<'a> {
         self.build_border(builder);
     }
 
-    fn build_hit_test(&self, builder: &mut DisplayListBuilder, rect: LayoutRect) {
-        let hit_info = builder.hit_info(
-            &self.fragment.style,
-            self.fragment.base.tag,
-            Cursor::Default,
-        );
-        let hit_info = match hit_info {
-            Some(hit_info) => hit_info,
-            None => return,
-        };
-
-        let mut common = builder.common_properties(rect, &self.fragment.style);
-        if let Some(clip_chain_id) = self.border_edge_clip(builder, false) {
-            common.clip_chain_id = clip_chain_id;
-        }
-        builder.wr().push_hit_test(
-            common.clip_rect,
-            common.clip_chain_id,
-            common.spatial_id,
-            common.flags,
-            hit_info,
-        );
-    }
-
     fn build_background_for_painter(
         &mut self,
         builder: &mut DisplayListBuilder,
@@ -1362,7 +1267,7 @@ impl<'a> BuilderForBoxFragment<'a> {
 
     fn build_collapsed_table_borders(&mut self, builder: &mut DisplayListBuilder) {
         let Some(SpecificLayoutInfo::TableGridWithCollapsedBorders(table_info)) =
-            &self.fragment.specific_layout_info
+            self.fragment.specific_layout_info()
         else {
             return;
         };
@@ -1501,7 +1406,8 @@ impl<'a> BuilderForBoxFragment<'a> {
 
                 width = size.width;
                 height = size.height;
-                NinePatchBorderSource::Image(key, ImageRendering::Auto)
+                let image_rendering = self.fragment.style.clone_image_rendering().to_webrender();
+                NinePatchBorderSource::Image(key, image_rendering)
             },
             Ok(ResolvedImage::Gradient(gradient)) => {
                 match gradient::build(&self.fragment.style, gradient, border_image_size, builder) {
@@ -1552,13 +1458,19 @@ impl<'a> BuilderForBoxFragment<'a> {
         if width == 0.0 {
             return;
         }
-        let offset = outline
-            .outline_offset
-            .px()
-            .max(-self.border_rect.width() / 2.0)
-            .max(-self.border_rect.height() / 2.0) +
-            width;
-        let outline_rect = self.border_rect.inflate(offset, offset);
+        // <https://drafts.csswg.org/css-ui-3/#outline-offset>
+        // > Negative values must cause the outline to shrink into the border box. Both
+        // > the height and the width of outside of the shape drawn by the outline should
+        // > not become smaller than twice the computed value of the outline-width
+        // > property, to make sure that an outline can be rendered even with large
+        // > negative values. User agents should apply this constraint independently in
+        // > each dimension. If the outline is drawn as multiple disconnected shapes, this
+        // > constraint applies to each shape separately.
+        let offset = outline.outline_offset.px() + width;
+        let outline_rect = self.border_rect.inflate(
+            offset.max(-self.border_rect.width() / 2.0 + width),
+            offset.max(-self.border_rect.height() / 2.0 + width),
+        );
         let common = builder.common_properties(outline_rect, &self.fragment.style);
         let widths = SideOffsets2D::new_all_same(width);
         let border_style = match outline.outline_style {
@@ -1678,47 +1590,6 @@ fn glyphs_advance_by_index(
     point
 }
 
-fn cursor(kind: CursorKind, auto_cursor: Cursor) -> Cursor {
-    match kind {
-        CursorKind::Auto => auto_cursor,
-        CursorKind::None => Cursor::None,
-        CursorKind::Default => Cursor::Default,
-        CursorKind::Pointer => Cursor::Pointer,
-        CursorKind::ContextMenu => Cursor::ContextMenu,
-        CursorKind::Help => Cursor::Help,
-        CursorKind::Progress => Cursor::Progress,
-        CursorKind::Wait => Cursor::Wait,
-        CursorKind::Cell => Cursor::Cell,
-        CursorKind::Crosshair => Cursor::Crosshair,
-        CursorKind::Text => Cursor::Text,
-        CursorKind::VerticalText => Cursor::VerticalText,
-        CursorKind::Alias => Cursor::Alias,
-        CursorKind::Copy => Cursor::Copy,
-        CursorKind::Move => Cursor::Move,
-        CursorKind::NoDrop => Cursor::NoDrop,
-        CursorKind::NotAllowed => Cursor::NotAllowed,
-        CursorKind::Grab => Cursor::Grab,
-        CursorKind::Grabbing => Cursor::Grabbing,
-        CursorKind::EResize => Cursor::EResize,
-        CursorKind::NResize => Cursor::NResize,
-        CursorKind::NeResize => Cursor::NeResize,
-        CursorKind::NwResize => Cursor::NwResize,
-        CursorKind::SResize => Cursor::SResize,
-        CursorKind::SeResize => Cursor::SeResize,
-        CursorKind::SwResize => Cursor::SwResize,
-        CursorKind::WResize => Cursor::WResize,
-        CursorKind::EwResize => Cursor::EwResize,
-        CursorKind::NsResize => Cursor::NsResize,
-        CursorKind::NeswResize => Cursor::NeswResize,
-        CursorKind::NwseResize => Cursor::NwseResize,
-        CursorKind::ColResize => Cursor::ColResize,
-        CursorKind::RowResize => Cursor::RowResize,
-        CursorKind::AllScroll => Cursor::AllScroll,
-        CursorKind::ZoomIn => Cursor::ZoomIn,
-        CursorKind::ZoomOut => Cursor::ZoomOut,
-    }
-}
-
 /// Radii for the padding edge or content edge
 fn inner_radii(mut radii: wr::BorderRadius, insets: units::LayoutSideOffsets) -> wr::BorderRadius {
     assert!(insets.left >= 0.0, "left inset must not be negative");
@@ -1914,3 +1785,36 @@ pub(super) fn compute_margin_box_radius(
         ),
     }
 }
+
+impl BoxFragment {
+    fn border_radius(&self) -> BorderRadius {
+        let border = self.style.get_border();
+        if border.border_top_left_radius.0.is_zero() &&
+            border.border_top_right_radius.0.is_zero() &&
+            border.border_bottom_right_radius.0.is_zero() &&
+            border.border_bottom_left_radius.0.is_zero()
+        {
+            return BorderRadius::zero();
+        }
+
+        let border_rect = self.border_rect();
+        let resolve =
+            |radius: &LengthPercentage, box_size: Au| radius.to_used_value(box_size).to_f32_px();
+        let corner = |corner: &style::values::computed::BorderCornerRadius| {
+            Size2D::new(
+                resolve(&corner.0.width.0, border_rect.size.width),
+                resolve(&corner.0.height.0, border_rect.size.height),
+            )
+        };
+
+        let mut radius = wr::BorderRadius {
+            top_left: corner(&border.border_top_left_radius),
+            top_right: corner(&border.border_top_right_radius),
+            bottom_right: corner(&border.border_bottom_right_radius),
+            bottom_left: corner(&border.border_bottom_left_radius),
+        };
+
+        normalize_radii(&border_rect.to_webrender(), &mut radius);
+        radius
+    }
+}

components/layout/display_list/stacking_context.rs

@@ -3,7 +3,7 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
 use core::f32;
-use std::cell::RefCell;
+use std::cell::{Cell, RefCell};
 use std::mem;
 use std::sync::Arc;
 
@@ -14,9 +14,11 @@ use compositing_traits::display_list::{
     AxesScrollSensitivity, CompositorDisplayListInfo, ReferenceFrameNodeInfo, ScrollableNodeInfo,
     SpatialTreeNodeInfo, StickyNodeInfo,
 };
+use embedder_traits::ViewportDetails;
 use euclid::SideOffsets2D;
 use euclid::default::{Point2D, Rect, Size2D};
 use log::warn;
+use malloc_size_of_derive::MallocSizeOf;
 use servo_config::opts::DebugOptions;
 use style::Zero;
 use style::color::AbsoluteColor;
@@ -32,7 +34,7 @@ use style::values::generics::box_::Perspective;
 use style::values::generics::transform::{self, GenericRotate, GenericScale, GenericTranslate};
 use style::values::specified::box_::DisplayOutside;
 use webrender_api::units::{LayoutPoint, LayoutRect, LayoutTransform, LayoutVector2D};
-use webrender_api::{self as wr, BorderRadius};
+use webrender_api::{self as wr, BorderRadius, ExternalScrollId};
 use wr::StickyOffsetBounds;
 use wr::units::{LayoutPixel, LayoutSize};
 
@@ -91,7 +93,7 @@ impl ContainingBlock {
 
 pub(crate) type ContainingBlockInfo<'a> = ContainingBlockManager<'a, ContainingBlock>;
 
-#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
+#[derive(Clone, Copy, Debug, Eq, Ord, MallocSizeOf, PartialEq, PartialOrd)]
 pub(crate) enum StackingContextSection {
     OwnBackgroundsAndBorders,
     DescendantBackgroundsAndBorders,
@@ -99,6 +101,24 @@ pub(crate) enum StackingContextSection {
     Outline,
 }
 
+#[derive(MallocSizeOf)]
+pub(crate) struct ScrollFrameHitTestItem {
+    /// The [`ScrollTreeNodeId`] of the spatial node that contains this hit test item.
+    pub scroll_node_id: ScrollTreeNodeId,
+
+    /// The [`ClipId`] of the clip that clips this [`ScrollFrameHitTestItems`].
+    pub clip_id: ClipId,
+
+    /// The rectangle of the scroll frame in the coordinate space of [`Self::scroll_node_id`].
+    pub rect: LayoutRect,
+
+    /// The WebRender [`ExternalScrollId`] of the scrolling spatial node that
+    /// this [`ScrollFrameHitTestItem`] identifies. Note that this is a *different*
+    /// spatial node than the one identified by [`Self::scroll_node_id`] (the parent).
+    pub external_scroll_id: ExternalScrollId,
+}
+
+#[derive(MallocSizeOf)]
 pub(crate) struct StackingContextTree {
     /// The root stacking context of this [`StackingContextTree`].
     pub root_stacking_context: StackingContext,
@@ -113,6 +133,10 @@ pub(crate) struct StackingContextTree {
     /// for things like `overflow`. More clips may be created later during WebRender
     /// display list construction, but they are never added here.
     pub clip_store: StackingContextTreeClipStore,
+
+    /// A vector of hit test items, one per scroll frame. These are used for allowing
+    /// renderer-side scrolling in the Servo renderer.
+    pub hit_test_items: Vec<ScrollFrameHitTestItem>,
 }
 
 impl StackingContextTree {
@@ -120,7 +144,7 @@ impl StackingContextTree {
     /// pipeline id.
     pub fn new(
         fragment_tree: &FragmentTree,
-        viewport_size: LayoutSize,
+        viewport_details: ViewportDetails,
         pipeline_id: wr::PipelineId,
         first_reflow: bool,
         debug: &DebugOptions,
@@ -131,8 +155,9 @@ impl StackingContextTree {
             scrollable_overflow.size.height.to_f32_px(),
         ));
 
+        let viewport_size = viewport_details.layout_size();
         let compositor_info = CompositorDisplayListInfo::new(
-            viewport_size,
+            viewport_details,
             scrollable_overflow,
             pipeline_id,
             // This epoch is set when the WebRender display list is built. For now use a dummy value.
@@ -145,7 +170,7 @@ impl StackingContextTree {
         let cb_for_non_fixed_descendants = ContainingBlock::new(
             fragment_tree.initial_containing_block,
             root_scroll_node_id,
-            Some(compositor_info.viewport_size),
+            Some(viewport_size),
             ClipId::INVALID,
         );
         let cb_for_fixed_descendants = ContainingBlock::new(
@@ -172,6 +197,7 @@ impl StackingContextTree {
             root_stacking_context: StackingContext::create_root(root_scroll_node_id, debug),
             compositor_info,
             clip_store: Default::default(),
+            hit_test_items: Vec::new(),
         };
 
         let mut root_stacking_context = StackingContext::create_root(root_scroll_node_id, debug);
@@ -199,6 +225,7 @@ impl StackingContextTree {
     fn push_reference_frame(
         &mut self,
         origin: LayoutPoint,
+        frame_origin_for_query: LayoutPoint,
         parent_scroll_node_id: &ScrollTreeNodeId,
         transform_style: wr::TransformStyle,
         transform: LayoutTransform,
@@ -208,8 +235,9 @@ impl StackingContextTree {
             Some(parent_scroll_node_id),
             SpatialTreeNodeInfo::ReferenceFrame(ReferenceFrameNodeInfo {
                 origin,
+                frame_origin_for_query,
                 transform_style,
-                transform,
+                transform: transform.into(),
                 kind,
             }),
         )
@@ -231,6 +259,7 @@ impl StackingContextTree {
                 clip_rect,
                 scroll_sensitivity,
                 offset: LayoutVector2D::zero(),
+                offset_changed: Cell::new(false),
             }),
         )
     }
@@ -256,7 +285,7 @@ impl StackingContextTree {
 }
 
 /// The text decorations for a Fragment, collecting during [`StackingContextTree`] construction.
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, MallocSizeOf)]
 pub(crate) struct FragmentTextDecoration {
     pub line: TextDecorationLine,
     pub color: AbsoluteColor,
@@ -267,6 +296,7 @@ pub(crate) struct FragmentTextDecoration {
 ///
 /// This is generally part of a fragment, like its borders or foreground, but it
 /// can also be a stacking container that needs to be painted in fragment order.
+#[derive(MallocSizeOf)]
 pub(crate) enum StackingContextContent {
     /// A fragment that does not generate a stacking context or stacking container.
     Fragment {
@@ -276,8 +306,8 @@ pub(crate) enum StackingContextContent {
         section: StackingContextSection,
         containing_block: PhysicalRect<Au>,
         fragment: Fragment,
-        is_hit_test_for_scrollable_overflow: bool,
         is_collapsed_table_borders: bool,
+        #[conditional_malloc_size_of]
         text_decorations: Arc<Vec<FragmentTextDecoration>>,
     },
 
@@ -288,7 +318,7 @@ pub(crate) enum StackingContextContent {
 }
 
 impl StackingContextContent {
-    fn section(&self) -> StackingContextSection {
+    pub(crate) fn section(&self) -> StackingContextSection {
         match self {
             Self::Fragment { section, .. } => *section,
             Self::AtomicInlineStackingContainer { .. } => StackingContextSection::Foreground,
@@ -308,7 +338,6 @@ impl StackingContextContent {
                 section,
                 containing_block,
                 fragment,
-                is_hit_test_for_scrollable_overflow,
                 is_collapsed_table_borders,
                 text_decorations,
             } => {
@@ -319,7 +348,6 @@ impl StackingContextContent {
                     builder,
                     containing_block,
                     *section,
-                    *is_hit_test_for_scrollable_overflow,
                     *is_collapsed_table_borders,
                     text_decorations,
                 );
@@ -331,7 +359,7 @@ impl StackingContextContent {
     }
 }
 
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, MallocSizeOf, PartialEq)]
 pub(crate) enum StackingContextType {
     RealStackingContext,
     PositionedStackingContainer,
@@ -344,6 +372,7 @@ pub(crate) enum StackingContextType {
 ///
 /// We use the term “real stacking context” in situations that call for a
 /// stacking context but not a stacking container.
+#[derive(MallocSizeOf)]
 pub struct StackingContext {
     /// The spatial id of this fragment. This is used to properly handle
     /// things like preserve-3d.
@@ -360,7 +389,7 @@ pub struct StackingContext {
     context_type: StackingContextType,
 
     /// The contents that need to be painted in fragment order.
-    contents: Vec<StackingContextContent>,
+    pub(super) contents: Vec<StackingContextContent>,
 
     /// Stacking contexts that need to be stolen by the parent stacking context
     /// if this is a stacking container, that is, real stacking contexts and
@@ -371,13 +400,13 @@ pub struct StackingContext {
     /// >     if it created a new stacking context, but omitting any positioned
     /// >     descendants or descendants that actually create a stacking context
     /// >     (letting the parent stacking context paint them, instead).
-    real_stacking_contexts_and_positioned_stacking_containers: Vec<StackingContext>,
+    pub(super) real_stacking_contexts_and_positioned_stacking_containers: Vec<StackingContext>,
 
     /// Float stacking containers.
     /// Separate from real_stacking_contexts_or_positioned_stacking_containers
     /// because they should never be stolen by the parent stacking context.
     /// <https://drafts.csswg.org/css-position-4/#paint-a-stacking-container>
-    float_stacking_containers: Vec<StackingContext>,
+    pub(super) float_stacking_containers: Vec<StackingContext>,
 
     /// Atomic inline stacking containers.
     /// Separate from real_stacking_contexts_or_positioned_stacking_containers
@@ -386,26 +415,25 @@ pub struct StackingContext {
     /// can index into this vec to paint them in fragment order.
     /// <https://drafts.csswg.org/css-position-4/#paint-a-stacking-container>
     /// <https://drafts.csswg.org/css-position-4/#paint-a-box-in-a-line-box>
-    atomic_inline_stacking_containers: Vec<StackingContext>,
+    pub(super) atomic_inline_stacking_containers: Vec<StackingContext>,
 
     /// Information gathered about the painting order, for [Self::debug_print].
     debug_print_items: Option<RefCell<Vec<DebugPrintItem>>>,
 }
 
 /// Refers to one of the child contents or stacking contexts of a [StackingContext].
-#[derive(Clone, Copy)]
+#[derive(Clone, Copy, MallocSizeOf)]
 pub struct DebugPrintItem {
     field: DebugPrintField,
     index: usize,
 }
 
 /// Refers to one of the vecs of a [StackingContext].
-#[derive(Clone, Copy)]
+#[derive(Clone, Copy, MallocSizeOf)]
 pub enum DebugPrintField {
     Contents,
     RealStackingContextsAndPositionedStackingContainers,
     FloatStackingContainers,
-    AtomicInlineStackingContainers,
 }
 
 impl StackingContext {
@@ -468,7 +496,7 @@ impl StackingContext {
         .push(stacking_context)
     }
 
-    fn z_index(&self) -> i32 {
+    pub(crate) fn z_index(&self) -> i32 {
         self.initializing_fragment.as_ref().map_or(0, |fragment| {
             let fragment = fragment.borrow();
             fragment.style.effective_z_index(fragment.base.flags)
@@ -576,7 +604,7 @@ impl StackingContext {
     pub(crate) fn build_canvas_background_display_list(
         &self,
         builder: &mut DisplayListBuilder,
-        fragment_tree: &crate::FragmentTree,
+        fragment_tree: &crate::fragment_tree::FragmentTree,
     ) {
         let Some(root_fragment) = fragment_tree.root_fragments.iter().find(|fragment| {
             fragment
@@ -636,7 +664,6 @@ impl StackingContext {
         let mut fragment_builder = BuilderForBoxFragment::new(
             &root_fragment,
             &fragment_tree.initial_containing_block,
-            false, /* is_hit_test_for_scrollable_overflow */
             false, /* is_collapsed_table_borders */
         );
         let painter = super::background::BackgroundPainter {
@@ -647,6 +674,9 @@ impl StackingContext {
         fragment_builder.build_background_image(builder, &painter);
     }
 
+    /// Build a display list from a a [`StackingContext`]. Note that this is the forward
+    /// version of the reversed stacking context walk algorithm in `hit_test.rs`. Any
+    /// changes made here should be reflected in the reverse version in that file.
     pub(crate) fn build_display_list(&self, builder: &mut DisplayListBuilder) {
         let pushed_context = self.push_webrender_stacking_context_if_necessary(builder);
 
@@ -791,9 +821,6 @@ impl StackingContext {
                 DebugPrintField::FloatStackingContainers => {
                     self.float_stacking_containers[*index].debug_print_with_tree(tree);
                 },
-                DebugPrintField::AtomicInlineStackingContainers => {
-                    // do nothing; we print these in DebugPrintField::Contents
-                },
             }
         }
         match self.context_type {
@@ -884,7 +911,6 @@ impl Fragment {
                         clip_id: containing_block.clip_id,
                         containing_block: containing_block.rect,
                         fragment: fragment_clone,
-                        is_hit_test_for_scrollable_overflow: false,
                         is_collapsed_table_borders: false,
                         text_decorations: text_decorations.clone(),
                     });
@@ -910,7 +936,8 @@ struct OverflowFrameData {
 
 impl BoxFragment {
     fn get_stacking_context_type(&self) -> Option<StackingContextType> {
-        if self.style.establishes_stacking_context(self.base.flags) {
+        let flags = self.base.flags;
+        if self.style.establishes_stacking_context(flags) {
             return Some(StackingContextType::RealStackingContext);
         }
 
@@ -923,7 +950,10 @@ impl BoxFragment {
             return Some(StackingContextType::FloatStackingContainer);
         }
 
-        if self.is_atomic_inline_level() {
+        // Flex and grid items are painted like inline blocks.
+        // <https://drafts.csswg.org/css-flexbox-1/#painting>
+        // <https://drafts.csswg.org/css-grid/#z-order>
+        if self.is_atomic_inline_level() || flags.contains(FragmentFlags::IS_FLEX_OR_GRID_ITEM) {
             return Some(StackingContextType::AtomicInlineStackingContainer);
         }
 
@@ -992,8 +1022,11 @@ impl BoxFragment {
             return;
         }
 
+        let frame_origin_for_query = self.cumulative_border_box_rect().origin.to_webrender();
+
         let new_spatial_id = stacking_context_tree.push_reference_frame(
             reference_frame_data.origin.to_webrender(),
+            frame_origin_for_query,
             &containing_block.scroll_node_id,
             self.style.get_box().transform_style.to_webrender(),
             reference_frame_data.transform,
@@ -1081,7 +1114,6 @@ impl BoxFragment {
                 BuilderForBoxFragment::new(
                     self,
                     &containing_block.rect,
-                    false, /* is_hit_test_for_scrollable_overflow */
                     false, /* is_collapsed_table_borders */
                 ),
             )
@@ -1165,7 +1197,6 @@ impl BoxFragment {
             BuilderForBoxFragment::new(
                 self,
                 &containing_block.rect,
-                false, /* is_hit_test_for_scrollable_overflow*/
                 false, /* is_collapsed_table_borders */
             ),
         ) {
@@ -1198,7 +1229,6 @@ impl BoxFragment {
                     section,
                     containing_block: containing_block.rect,
                     fragment: fragment.clone(),
-                    is_hit_test_for_scrollable_overflow: false,
                     is_collapsed_table_borders: false,
                     text_decorations: text_decorations.clone(),
                 });
@@ -1210,6 +1240,11 @@ impl BoxFragment {
             add_fragment(StackingContextSection::Outline);
         }
 
+        // Spatial tree node that will affect the transform of the fragment. Note that the next frame,
+        // scroll frame, does not affect the transform of the fragment but affect the transform of it
+        // children.
+        *self.spatial_tree_node.borrow_mut() = Some(new_scroll_node_id);
+
         // We want to build the scroll frame after the background and border, because
         // they shouldn't scroll with the rest of the box content.
         if let Some(overflow_frame_data) = self.build_overflow_frame_if_necessary(
@@ -1222,21 +1257,6 @@ impl BoxFragment {
             if let Some(scroll_frame_data) = overflow_frame_data.scroll_frame_data {
                 new_scroll_node_id = scroll_frame_data.scroll_tree_node_id;
                 new_scroll_frame_size = Some(scroll_frame_data.scroll_frame_rect.size());
-
-                stacking_context
-                    .contents
-                    .push(StackingContextContent::Fragment {
-                        scroll_node_id: new_scroll_node_id,
-                        reference_frame_scroll_node_id:
-                            reference_frame_scroll_node_id_for_fragments,
-                        clip_id: new_clip_id,
-                        section,
-                        containing_block: containing_block.rect,
-                        fragment: fragment.clone(),
-                        is_hit_test_for_scrollable_overflow: true,
-                        is_collapsed_table_borders: false,
-                        text_decorations: text_decorations.clone(),
-                    });
             }
         }
 
@@ -1321,7 +1341,7 @@ impl BoxFragment {
         }
 
         if matches!(&fragment, Fragment::Box(box_fragment) if matches!(
-            box_fragment.borrow().specific_layout_info,
+            box_fragment.borrow().specific_layout_info(),
             Some(SpecificLayoutInfo::TableGridWithCollapsedBorders(_))
         )) {
             stacking_context
@@ -1333,7 +1353,6 @@ impl BoxFragment {
                     section,
                     containing_block: containing_block.rect,
                     fragment: fragment.clone(),
-                    is_hit_test_for_scrollable_overflow: false,
                     is_collapsed_table_borders: true,
                     text_decorations: text_decorations.clone(),
                 });
@@ -1405,7 +1424,7 @@ impl BoxFragment {
             // https://drafts.csswg.org/css-overflow-3/#corner-clipping
             let radii;
             if overflow.x == ComputedOverflow::Clip && overflow.y == ComputedOverflow::Clip {
-                let builder = BuilderForBoxFragment::new(self, containing_block_rect, false, false);
+                let builder = BuilderForBoxFragment::new(self, containing_block_rect, false);
                 radii = offset_radii(builder.border_radius, clip_margin);
             } else if overflow.x != ComputedOverflow::Clip {
                 overflow_clip_rect.min.x = f32::MIN;
@@ -1430,39 +1449,20 @@ impl BoxFragment {
             });
         }
 
-        // scrollable overflow path
-        // From https://drafts.csswg.org/css-overflow/#propdef-overflow:
-        // > UAs must apply the overflow-* values set on the root element to the viewport when the
-        // > root element’s display value is not none. However, when the root element is an [HTML]
-        // > html element (including XML syntax for HTML) whose overflow value is visible (in both
-        // > axes), and that element has as a child a body element whose display value is also not
-        // > none, user agents must instead apply the overflow-* values of the first such child
-        // > element to the viewport. The element from which the value is propagated must then have a
-        // > used overflow value of visible.
-        //
-        // TODO: This should only happen when the `display` value is actually propagated.
-        if self
-            .base
-            .flags
-            .contains(FragmentFlags::IS_BODY_ELEMENT_OF_HTML_ELEMENT_ROOT)
-        {
-            return None;
-        }
-
         let scroll_frame_rect = self
             .padding_rect()
             .translate(containing_block_rect.origin.to_vector())
             .to_webrender();
 
         let clip_id = stacking_context_tree.clip_store.add(
-            BuilderForBoxFragment::new(self, containing_block_rect, false, false).border_radius,
+            BuilderForBoxFragment::new(self, containing_block_rect, false).border_radius,
             scroll_frame_rect,
             *parent_scroll_node_id,
             parent_clip_id,
         );
 
         let tag = self.base.tag?;
-        let external_id = wr::ExternalScrollId(
+        let external_scroll_id = wr::ExternalScrollId(
             tag.to_display_list_fragment_id(),
             stacking_context_tree.compositor_info.pipeline_id,
         );
@@ -1474,12 +1474,21 @@ impl BoxFragment {
 
         let scroll_tree_node_id = stacking_context_tree.define_scroll_frame(
             parent_scroll_node_id,
-            external_id,
+            external_scroll_id,
             self.scrollable_overflow().to_webrender(),
             scroll_frame_rect,
             sensitivity,
         );
 
+        stacking_context_tree
+            .hit_test_items
+            .push(ScrollFrameHitTestItem {
+                scroll_node_id: *parent_scroll_node_id,
+                clip_id,
+                rect: scroll_frame_rect,
+                external_scroll_id,
+            });
+
         Some(OverflowFrameData {
             clip_id,
             scroll_frame_data: Some(ScrollFrameData {
@@ -1504,7 +1513,10 @@ impl BoxFragment {
             Some(size) => size,
             None => {
                 // This is a direct descendant of a reference frame.
-                &stacking_context_tree.compositor_info.viewport_size
+                &stacking_context_tree
+                    .compositor_info
+                    .viewport_details
+                    .layout_size()
             },
         };
 

components/layout/dom.rs

@@ -2,21 +2,19 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
-use std::any::Any;
 use std::marker::PhantomData;
 
 use atomic_refcell::{AtomicRef, AtomicRefCell, AtomicRefMut};
 use base::id::{BrowsingContextId, PipelineId};
 use html5ever::{local_name, ns};
-use layout_api::wrapper_traits::{
-    LayoutDataTrait, LayoutNode, ThreadSafeLayoutElement, ThreadSafeLayoutNode,
-};
+use layout_api::wrapper_traits::{LayoutDataTrait, ThreadSafeLayoutElement, ThreadSafeLayoutNode};
 use layout_api::{
-    GenericLayoutDataTrait, LayoutDamage, LayoutElementType, LayoutNodeType as ScriptLayoutNodeType,
+    GenericLayoutDataTrait, LayoutDamage, LayoutElementType,
+    LayoutNodeType as ScriptLayoutNodeType, SVGElementData,
 };
 use malloc_size_of_derive::MallocSizeOf;
 use net_traits::image_cache::Image;
-use script::layout_dom::ServoLayoutNode;
+use script::layout_dom::ServoThreadSafeLayoutNode;
 use servo_arc::Arc as ServoArc;
 use smallvec::SmallVec;
 use style::context::SharedStyleContext;
@@ -29,6 +27,7 @@ use crate::flow::BlockLevelBox;
 use crate::flow::inline::{InlineItem, SharedInlineStyles};
 use crate::fragment_tree::Fragment;
 use crate::geom::PhysicalSize;
+use crate::layout_box_base::LayoutBoxBase;
 use crate::replaced::CanvasInfo;
 use crate::table::TableLevelBox;
 use crate::taffy::TaffyItemBox;
@@ -36,7 +35,7 @@ use crate::taffy::TaffyItemBox;
 #[derive(MallocSizeOf)]
 pub struct PseudoLayoutData {
     pseudo: PseudoElement,
-    box_slot: ArcRefCell<Option<LayoutBox>>,
+    data: ArcRefCell<InnerDOMLayoutData>,
 }
 
 /// The data that is stored in each DOM node that is used by layout.
@@ -47,22 +46,65 @@ pub struct InnerDOMLayoutData {
 }
 
 impl InnerDOMLayoutData {
-    pub(crate) fn for_pseudo(
+    fn pseudo_layout_data(
         &self,
-        pseudo_element: Option<PseudoElement>,
-    ) -> Option<AtomicRef<Option<LayoutBox>>> {
-        let Some(pseudo_element) = pseudo_element else {
-            return Some(self.self_box.borrow());
-        };
-
+        pseudo_element: PseudoElement,
+    ) -> Option<ArcRefCell<InnerDOMLayoutData>> {
         for pseudo_layout_data in self.pseudo_boxes.iter() {
             if pseudo_element == pseudo_layout_data.pseudo {
-                return Some(pseudo_layout_data.box_slot.borrow());
+                return Some(pseudo_layout_data.data.clone());
             }
         }
-
         None
     }
+
+    fn create_pseudo_layout_data(
+        &mut self,
+        pseudo_element: PseudoElement,
+    ) -> ArcRefCell<InnerDOMLayoutData> {
+        let data: ArcRefCell<InnerDOMLayoutData> = Default::default();
+        self.pseudo_boxes.push(PseudoLayoutData {
+            pseudo: pseudo_element,
+            data: data.clone(),
+        });
+        data
+    }
+
+    fn fragments(&self) -> Vec<Fragment> {
+        self.self_box
+            .borrow()
+            .as_ref()
+            .map(|layout_box| layout_box.with_base_flat(LayoutBoxBase::fragments))
+            .unwrap_or_default()
+    }
+
+    fn repair_style(&self, node: &ServoThreadSafeLayoutNode, context: &SharedStyleContext) {
+        if let Some(layout_object) = &*self.self_box.borrow() {
+            layout_object.repair_style(context, node, &node.style(context));
+        }
+
+        for pseudo_layout_data in self.pseudo_boxes.iter() {
+            let Some(node_with_pseudo) = node.with_pseudo(pseudo_layout_data.pseudo) else {
+                continue;
+            };
+            pseudo_layout_data
+                .data
+                .borrow()
+                .repair_style(&node_with_pseudo, context);
+        }
+    }
+
+    fn clear_fragment_layout_cache(&self) {
+        if let Some(data) = self.self_box.borrow().as_ref() {
+            data.clear_fragment_layout_cache();
+        }
+        for pseudo_layout_data in self.pseudo_boxes.iter() {
+            pseudo_layout_data
+                .data
+                .borrow()
+                .clear_fragment_layout_cache();
+        }
+    }
 }
 
 /// A box that is stored in one of the `DOMLayoutData` slots.
@@ -98,30 +140,51 @@ impl LayoutBox {
         }
     }
 
-    pub(crate) fn fragments(&self) -> Vec<Fragment> {
+    pub(crate) fn with_base_flat<T>(&self, callback: impl Fn(&LayoutBoxBase) -> Vec<T>) -> Vec<T> {
         match self {
             LayoutBox::DisplayContents(..) => vec![],
-            LayoutBox::BlockLevel(block_level_box) => block_level_box.borrow().fragments(),
+            LayoutBox::BlockLevel(block_level_box) => block_level_box.borrow().with_base(callback),
             LayoutBox::InlineLevel(inline_items) => inline_items
                 .iter()
-                .flat_map(|inline_item| inline_item.borrow().fragments())
+                .flat_map(|inline_item| inline_item.borrow().with_base(&callback))
                 .collect(),
-            LayoutBox::FlexLevel(flex_level_box) => flex_level_box.borrow().fragments(),
-            LayoutBox::TaffyItemBox(taffy_item_box) => taffy_item_box.borrow().fragments(),
-            LayoutBox::TableLevelBox(table_box) => table_box.fragments(),
+            LayoutBox::FlexLevel(flex_level_box) => flex_level_box.borrow().with_base(callback),
+            LayoutBox::TaffyItemBox(taffy_item_box) => taffy_item_box.borrow().with_base(callback),
+            LayoutBox::TableLevelBox(table_box) => table_box.with_base(callback),
+        }
+    }
+
+    pub(crate) fn with_base_mut(&mut self, callback: impl Fn(&mut LayoutBoxBase)) {
+        match self {
+            LayoutBox::DisplayContents(..) => {},
+            LayoutBox::BlockLevel(block_level_box) => {
+                block_level_box.borrow_mut().with_base_mut(callback);
+            },
+            LayoutBox::InlineLevel(inline_items) => {
+                for inline_item in inline_items {
+                    inline_item.borrow_mut().with_base_mut(&callback);
+                }
+            },
+            LayoutBox::FlexLevel(flex_level_box) => {
+                flex_level_box.borrow_mut().with_base_mut(callback)
+            },
+            LayoutBox::TableLevelBox(table_level_box) => table_level_box.with_base_mut(callback),
+            LayoutBox::TaffyItemBox(taffy_item_box) => {
+                taffy_item_box.borrow_mut().with_base_mut(callback)
+            },
         }
     }
 
     fn repair_style(
         &self,
         context: &SharedStyleContext,
-        node: &ServoLayoutNode,
+        node: &ServoThreadSafeLayoutNode,
         new_style: &ServoArc<ComputedValues>,
     ) {
         match self {
             LayoutBox::DisplayContents(inline_shared_styles) => {
                 *inline_shared_styles.style.borrow_mut() = new_style.clone();
-                *inline_shared_styles.selected.borrow_mut() = node.to_threadsafe().selected_style();
+                *inline_shared_styles.selected.borrow_mut() = node.selected_style();
             },
             LayoutBox::BlockLevel(block_level_box) => {
                 block_level_box
@@ -171,7 +234,7 @@ pub struct DOMLayoutData(AtomicRefCell<InnerDOMLayoutData>);
 // The implementation of this trait allows the data to be stored in the DOM.
 impl LayoutDataTrait for DOMLayoutData {}
 impl GenericLayoutDataTrait for DOMLayoutData {
-    fn as_any(&self) -> &dyn Any {
+    fn as_any(&self) -> &dyn std::any::Any {
         self
     }
 }
@@ -193,14 +256,6 @@ impl From<ArcRefCell<Option<LayoutBox>>> for BoxSlot<'_> {
 
 /// A mutable reference to a `LayoutBox` stored in a DOM element.
 impl BoxSlot<'_> {
-    pub(crate) fn dummy() -> Self {
-        let slot = None;
-        Self {
-            slot,
-            marker: PhantomData,
-        }
-    }
-
     pub(crate) fn set(mut self, box_: LayoutBox) {
         if let Some(slot) = &mut self.slot {
             *slot.borrow_mut() = Some(box_);
@@ -232,13 +287,12 @@ pub(crate) trait NodeExt<'dom> {
     fn as_canvas(&self) -> Option<(CanvasInfo, PhysicalSize<f64>)>;
     fn as_iframe(&self) -> Option<(PipelineId, BrowsingContextId)>;
     fn as_video(&self) -> Option<(Option<webrender_api::ImageKey>, Option<PhysicalSize<f64>>)>;
+    fn as_svg(&self) -> Option<SVGElementData>;
     fn as_typeless_object_with_data_attribute(&self) -> Option<String>;
-    fn style(&self, context: &SharedStyleContext) -> ServoArc<ComputedValues>;
 
-    fn layout_data_mut(&self) -> AtomicRefMut<'dom, InnerDOMLayoutData>;
-    fn layout_data(&self) -> Option<AtomicRef<'dom, InnerDOMLayoutData>>;
-    fn element_box_slot(&self) -> BoxSlot<'dom>;
-    fn pseudo_element_box_slot(&self, pseudo_element: PseudoElement) -> BoxSlot<'dom>;
+    fn ensure_inner_layout_data(&self) -> AtomicRefMut<'dom, InnerDOMLayoutData>;
+    fn inner_layout_data(&self) -> Option<AtomicRef<'dom, InnerDOMLayoutData>>;
+    fn box_slot(&self) -> BoxSlot<'dom>;
 
     /// Remove boxes for the element itself, and all of its pseudo-element boxes.
     fn unset_all_boxes(&self);
@@ -253,10 +307,9 @@ pub(crate) trait NodeExt<'dom> {
     fn take_restyle_damage(&self) -> LayoutDamage;
 }
 
-impl<'dom> NodeExt<'dom> for ServoLayoutNode<'dom> {
+impl<'dom> NodeExt<'dom> for ServoThreadSafeLayoutNode<'dom> {
     fn as_image(&self) -> Option<(Option<Image>, PhysicalSize<f64>)> {
-        let node = self.to_threadsafe();
-        let (resource, metadata) = node.image_data()?;
+        let (resource, metadata) = self.image_data()?;
         let (width, height) = resource
             .as_ref()
             .map(|image| {
@@ -266,16 +319,19 @@ impl<'dom> NodeExt<'dom> for ServoLayoutNode<'dom> {
             .or_else(|| metadata.map(|metadata| (metadata.width, metadata.height)))
             .unwrap_or((0, 0));
         let (mut width, mut height) = (width as f64, height as f64);
-        if let Some(density) = node.image_density().filter(|density| *density != 1.) {
+        if let Some(density) = self.image_density().filter(|density| *density != 1.) {
             width /= density;
             height /= density;
         }
         Some((resource, PhysicalSize::new(width, height)))
     }
 
+    fn as_svg(&self) -> Option<SVGElementData> {
+        self.svg_data()
+    }
+
     fn as_video(&self) -> Option<(Option<webrender_api::ImageKey>, Option<PhysicalSize<f64>>)> {
-        let node = self.to_threadsafe();
-        let data = node.media_data()?;
+        let data = self.media_data()?;
         let natural_size = if let Some(frame) = data.current_frame {
             Some(PhysicalSize::new(frame.width.into(), frame.height.into()))
         } else {
@@ -289,8 +345,7 @@ impl<'dom> NodeExt<'dom> for ServoLayoutNode<'dom> {
     }
 
     fn as_canvas(&self) -> Option<(CanvasInfo, PhysicalSize<f64>)> {
-        let node = self.to_threadsafe();
-        let canvas_data = node.canvas_data()?;
+        let canvas_data = self.canvas_data()?;
         let source = canvas_data.source;
         Some((
             CanvasInfo { source },
@@ -299,8 +354,7 @@ impl<'dom> NodeExt<'dom> for ServoLayoutNode<'dom> {
     }
 
     fn as_iframe(&self) -> Option<(PipelineId, BrowsingContextId)> {
-        let node = self.to_threadsafe();
-        match (node.iframe_pipeline_id(), node.iframe_browsing_context_id()) {
+        match (self.iframe_pipeline_id(), self.iframe_browsing_context_id()) {
             (Some(pipeline_id), Some(browsing_context_id)) => {
                 Some((pipeline_id, browsing_context_id))
             },
@@ -309,8 +363,10 @@ impl<'dom> NodeExt<'dom> for ServoLayoutNode<'dom> {
     }
 
     fn as_typeless_object_with_data_attribute(&self) -> Option<String> {
-        if LayoutNode::type_id(self) !=
-            ScriptLayoutNodeType::Element(LayoutElementType::HTMLObjectElement)
+        if self.type_id() !=
+            Some(ScriptLayoutNodeType::Element(
+                LayoutElementType::HTMLObjectElement,
+            ))
         {
             return None;
         }
@@ -318,7 +374,7 @@ impl<'dom> NodeExt<'dom> for ServoLayoutNode<'dom> {
         // TODO: This is the what the legacy layout system did, but really if Servo
         // supports any `<object>` that's an image, it should support those with URLs
         // and `type` attributes with image mime types.
-        let element = self.to_threadsafe().as_element()?;
+        let element = self.as_element()?;
         if element.get_attr(&ns!(), &local_name!("type")).is_some() {
             return None;
         }
@@ -327,15 +383,11 @@ impl<'dom> NodeExt<'dom> for ServoLayoutNode<'dom> {
             .map(|string| string.to_owned())
     }
 
-    fn style(&self, context: &SharedStyleContext) -> ServoArc<ComputedValues> {
-        self.to_threadsafe().style(context)
-    }
-
-    fn layout_data_mut(&self) -> AtomicRefMut<'dom, InnerDOMLayoutData> {
-        if LayoutNode::layout_data(self).is_none() {
+    fn ensure_inner_layout_data(&self) -> AtomicRefMut<'dom, InnerDOMLayoutData> {
+        if self.layout_data().is_none() {
             self.initialize_layout_data::<DOMLayoutData>();
         }
-        LayoutNode::layout_data(self)
+        self.layout_data()
             .unwrap()
             .as_any()
             .downcast_ref::<DOMLayoutData>()
@@ -344,8 +396,8 @@ impl<'dom> NodeExt<'dom> for ServoLayoutNode<'dom> {
             .borrow_mut()
     }
 
-    fn layout_data(&self) -> Option<AtomicRef<'dom, InnerDOMLayoutData>> {
-        LayoutNode::layout_data(self).map(|data| {
+    fn inner_layout_data(&self) -> Option<AtomicRef<'dom, InnerDOMLayoutData>> {
+        self.layout_data().map(|data| {
             data.as_any()
                 .downcast_ref::<DOMLayoutData>()
                 .unwrap()
@@ -354,22 +406,38 @@ impl<'dom> NodeExt<'dom> for ServoLayoutNode<'dom> {
         })
     }
 
-    fn element_box_slot(&self) -> BoxSlot<'dom> {
-        self.layout_data_mut().self_box.clone().into()
-    }
+    fn box_slot(&self) -> BoxSlot<'dom> {
+        let pseudo_element_chain = self.pseudo_element_chain();
+        let Some(primary) = pseudo_element_chain.primary else {
+            return self.ensure_inner_layout_data().self_box.clone().into();
+        };
 
-    fn pseudo_element_box_slot(&self, pseudo_element: PseudoElement) -> BoxSlot<'dom> {
-        let mut layout_data = self.layout_data_mut();
-        let box_slot = ArcRefCell::new(None);
-        layout_data.pseudo_boxes.push(PseudoLayoutData {
-            pseudo: pseudo_element,
-            box_slot: box_slot.clone(),
-        });
-        box_slot.into()
+        let Some(secondary) = pseudo_element_chain.secondary else {
+            let primary_layout_data = self
+                .ensure_inner_layout_data()
+                .create_pseudo_layout_data(primary);
+            return primary_layout_data.borrow().self_box.clone().into();
+        };
+
+        // It's *very* important that this not borrow the element's main
+        // `InnerLayoutData`. Primary pseudo-elements are processed at the same recursion
+        // level as the main data, so the `BoxSlot` is created sequentially with other
+        // primary pseudo-elements and the element itself. The secondary pseudo-element is
+        // one level deep, so could be happening in parallel with the primary
+        // pseudo-elements or main element layout.
+        let primary_layout_data = self
+            .inner_layout_data()
+            .expect("Should already have element InnerLayoutData here.")
+            .pseudo_layout_data(primary)
+            .expect("Should already have primary pseudo-element InnerLayoutData here");
+        let secondary_layout_data = primary_layout_data
+            .borrow_mut()
+            .create_pseudo_layout_data(secondary);
+        secondary_layout_data.borrow().self_box.clone().into()
     }
 
     fn unset_all_boxes(&self) {
-        let mut layout_data = self.layout_data_mut();
+        let mut layout_data = self.ensure_inner_layout_data();
         *layout_data.self_box.borrow_mut() = None;
         layout_data.pseudo_boxes.clear();
 
@@ -378,48 +446,31 @@ impl<'dom> NodeExt<'dom> for ServoLayoutNode<'dom> {
     }
 
     fn unset_all_pseudo_boxes(&self) {
-        self.layout_data_mut().pseudo_boxes.clear();
+        self.ensure_inner_layout_data().pseudo_boxes.clear();
     }
 
     fn clear_fragment_layout_cache(&self) {
-        let data = self.layout_data_mut();
-        if let Some(data) = data.self_box.borrow_mut().as_ref() {
-            data.clear_fragment_layout_cache();
-        }
-
-        for pseudo_layout_data in data.pseudo_boxes.iter() {
-            if let Some(layout_box) = pseudo_layout_data.box_slot.borrow().as_ref() {
-                layout_box.clear_fragment_layout_cache();
-            }
+        if let Some(inner_layout_data) = self.inner_layout_data() {
+            inner_layout_data.clear_fragment_layout_cache();
         }
     }
 
     fn fragments_for_pseudo(&self, pseudo_element: Option<PseudoElement>) -> Vec<Fragment> {
-        let Some(layout_data) = NodeExt::layout_data(self) else {
+        let Some(layout_data) = self.inner_layout_data() else {
             return vec![];
         };
-        let Some(layout_data) = layout_data.for_pseudo(pseudo_element) else {
-            return vec![];
-        };
-        layout_data
-            .as_ref()
-            .map(LayoutBox::fragments)
-            .unwrap_or_default()
+        match pseudo_element {
+            Some(pseudo_element) => layout_data
+                .pseudo_layout_data(pseudo_element)
+                .map(|pseudo_layout_data| pseudo_layout_data.borrow().fragments())
+                .unwrap_or_default(),
+            None => layout_data.fragments(),
+        }
     }
 
     fn repair_style(&self, context: &SharedStyleContext) {
-        let data = self.layout_data_mut();
-        if let Some(layout_object) = &*data.self_box.borrow() {
-            let style = self.to_threadsafe().style(context);
-            layout_object.repair_style(context, self, &style);
-        }
-
-        for pseudo_layout_data in data.pseudo_boxes.iter() {
-            if let Some(layout_box) = pseudo_layout_data.box_slot.borrow().as_ref() {
-                if let Some(node) = self.to_threadsafe().with_pseudo(pseudo_layout_data.pseudo) {
-                    layout_box.repair_style(context, self, &node.style(context));
-                }
-            }
+        if let Some(layout_data) = self.inner_layout_data() {
+            layout_data.repair_style(self, context);
         }
     }
 

components/layout/dom_traversal.rs

@@ -3,17 +3,18 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
 use std::borrow::Cow;
-use std::iter::FusedIterator;
 
 use fonts::ByteIndex;
-use html5ever::{LocalName, local_name};
-use layout_api::wrapper_traits::{LayoutNode, ThreadSafeLayoutElement, ThreadSafeLayoutNode};
+use html5ever::LocalName;
+use layout_api::wrapper_traits::{
+    PseudoElementChain, ThreadSafeLayoutElement, ThreadSafeLayoutNode,
+};
 use layout_api::{LayoutDamage, LayoutElementType, LayoutNodeType};
 use range::Range;
-use script::layout_dom::ServoLayoutNode;
+use script::layout_dom::ServoThreadSafeLayoutNode;
 use selectors::Element as SelectorsElement;
 use servo_arc::Arc as ServoArc;
-use style::dom::{NodeInfo, TElement, TNode, TShadowRoot};
+use style::dom::NodeInfo;
 use style::properties::ComputedValues;
 use style::selector_parser::PseudoElement;
 use style::values::generics::counters::{Content, ContentItem};
@@ -22,7 +23,6 @@ use style::values::specified::Quotes;
 use crate::context::LayoutContext;
 use crate::dom::{BoxSlot, LayoutBox, NodeExt};
 use crate::flow::inline::SharedInlineStyles;
-use crate::fragment_tree::{BaseFragmentInfo, FragmentFlags, Tag};
 use crate::quotes::quotes_for_lang;
 use crate::replaced::ReplacedContents;
 use crate::style_ext::{Display, DisplayGeneratingBox, DisplayInside, DisplayOutside};
@@ -31,113 +31,44 @@ use crate::style_ext::{Display, DisplayGeneratingBox, DisplayInside, DisplayOuts
 /// avoid having to repeat the same arguments in argument lists.
 #[derive(Clone)]
 pub(crate) struct NodeAndStyleInfo<'dom> {
-    pub node: ServoLayoutNode<'dom>,
-    pub pseudo_element_type: Option<PseudoElement>,
+    pub node: ServoThreadSafeLayoutNode<'dom>,
     pub style: ServoArc<ComputedValues>,
     pub damage: LayoutDamage,
 }
 
 impl<'dom> NodeAndStyleInfo<'dom> {
     pub(crate) fn new(
-        node: ServoLayoutNode<'dom>,
+        node: ServoThreadSafeLayoutNode<'dom>,
         style: ServoArc<ComputedValues>,
         damage: LayoutDamage,
     ) -> Self {
         Self {
             node,
-            pseudo_element_type: None,
             style,
             damage,
         }
     }
 
-    pub(crate) fn is_single_line_text_input(&self) -> bool {
-        self.node.type_id() == LayoutNodeType::Element(LayoutElementType::HTMLInputElement)
+    pub(crate) fn pseudo_element_chain(&self) -> PseudoElementChain {
+        self.node.pseudo_element_chain()
     }
 
-    pub(crate) fn pseudo(
+    pub(crate) fn with_pseudo_element(
         &self,
         context: &LayoutContext,
         pseudo_element_type: PseudoElement,
     ) -> Option<Self> {
-        let style = self
-            .node
-            .to_threadsafe()
-            .as_element()?
-            .with_pseudo(pseudo_element_type)?
-            .style(&context.style_context);
+        let element = self.node.as_element()?.with_pseudo(pseudo_element_type)?;
+        let style = element.style(&context.style_context);
         Some(NodeAndStyleInfo {
-            node: self.node,
-            pseudo_element_type: Some(pseudo_element_type),
+            node: element.as_node(),
             style,
             damage: self.damage,
         })
     }
 
-    pub(crate) fn get_selected_style(&self) -> ServoArc<ComputedValues> {
-        self.node.to_threadsafe().selected_style()
-    }
-
     pub(crate) fn get_selection_range(&self) -> Option<Range<ByteIndex>> {
-        self.node.to_threadsafe().selection()
-    }
-}
-
-impl<'dom> From<&NodeAndStyleInfo<'dom>> for BaseFragmentInfo {
-    fn from(info: &NodeAndStyleInfo<'dom>) -> Self {
-        let node = info.node;
-        let pseudo = info.pseudo_element_type;
-        let threadsafe_node = node.to_threadsafe();
-        let mut flags = FragmentFlags::empty();
-
-        // Anonymous boxes should not have a tag, because they should not take part in hit testing.
-        //
-        // TODO(mrobinson): It seems that anonymous boxes should take part in hit testing in some
-        // cases, but currently this means that the order of hit test results isn't as expected for
-        // some WPT tests. This needs more investigation.
-        if matches!(
-            pseudo,
-            Some(PseudoElement::ServoAnonymousBox) |
-                Some(PseudoElement::ServoAnonymousTable) |
-                Some(PseudoElement::ServoAnonymousTableCell) |
-                Some(PseudoElement::ServoAnonymousTableRow)
-        ) {
-            return Self::anonymous();
-        }
-
-        if let Some(element) = threadsafe_node.as_html_element() {
-            if element.is_body_element_of_html_element_root() {
-                flags.insert(FragmentFlags::IS_BODY_ELEMENT_OF_HTML_ELEMENT_ROOT);
-            }
-
-            match element.get_local_name() {
-                &local_name!("br") => {
-                    flags.insert(FragmentFlags::IS_BR_ELEMENT);
-                },
-                &local_name!("table") | &local_name!("th") | &local_name!("td") => {
-                    flags.insert(FragmentFlags::IS_TABLE_TH_OR_TD_ELEMENT);
-                },
-                _ => {},
-            }
-
-            if matches!(
-                element.type_id(),
-                Some(LayoutNodeType::Element(
-                    LayoutElementType::HTMLInputElement | LayoutElementType::HTMLTextAreaElement
-                ))
-            ) {
-                flags.insert(FragmentFlags::IS_TEXT_CONTROL);
-            }
-
-            if ThreadSafeLayoutElement::is_root(&element) {
-                flags.insert(FragmentFlags::IS_ROOT_ELEMENT);
-            }
-        };
-
-        Self {
-            tag: Some(Tag::new_pseudo(threadsafe_node.opaque(), pseudo)),
-            flags,
-        }
+        self.node.selection()
     }
 }
 
@@ -194,29 +125,26 @@ fn traverse_children_of<'dom>(
 ) {
     traverse_eager_pseudo_element(PseudoElement::Before, parent_element_info, context, handler);
 
+    // TODO(stevennovaryo): In the past we are rendering text input as a normal element,
+    //                      and the processing of text is happening here. Remove this
+    //                      special case after the implementation of UA Shadow DOM for
+    //                      all affected input elements.
     if parent_element_info.node.is_text_input() {
-        let node_text_content = parent_element_info.node.to_threadsafe().node_text_content();
+        let node_text_content = parent_element_info.node.node_text_content();
         if node_text_content.is_empty() {
-            // The addition of zero-width space here forces the text input to have an inline formatting
-            // context that might otherwise be trimmed if there's no text. This is important to ensure
-            // that the input element is at least as tall as the line gap of the caret:
-            // <https://drafts.csswg.org/css-ui/#element-with-default-preferred-size>.
-            //
-            // This is also used to ensure that the caret will still be rendered when the input is empty.
-            // TODO: Is there a less hacky way to do this?
             handler.handle_text(parent_element_info, "\u{200B}".into());
         } else {
             handler.handle_text(parent_element_info, node_text_content);
         }
     } else {
-        for child in iter_child_nodes(parent_element_info.node) {
+        for child in parent_element_info.node.children() {
             if child.is_text_node() {
                 let info = NodeAndStyleInfo::new(
                     child,
                     child.style(&context.style_context),
                     child.take_restyle_damage(),
                 );
-                handler.handle_text(&info, child.to_threadsafe().node_text_content());
+                handler.handle_text(&info, child.node_text_content());
             } else if child.is_element() {
                 traverse_element(child, context, handler);
             }
@@ -227,7 +155,7 @@ fn traverse_children_of<'dom>(
 }
 
 fn traverse_element<'dom>(
-    element: ServoLayoutNode<'dom>,
+    element: ServoThreadSafeLayoutNode<'dom>,
     context: &LayoutContext,
     handler: &mut impl TraversalHandler<'dom>,
 ) {
@@ -248,7 +176,7 @@ fn traverse_element<'dom>(
             } else {
                 let shared_inline_styles: SharedInlineStyles = (&info).into();
                 element
-                    .element_box_slot()
+                    .box_slot()
                     .set(LayoutBox::DisplayContents(shared_inline_styles.clone()));
 
                 handler.enter_display_contents(shared_inline_styles);
@@ -261,16 +189,16 @@ fn traverse_element<'dom>(
                 Contents::Replaced(replaced)
             } else if matches!(
                 element.type_id(),
-                LayoutNodeType::Element(
+                Some(LayoutNodeType::Element(
                     LayoutElementType::HTMLInputElement | LayoutElementType::HTMLTextAreaElement
-                )
+                ))
             ) {
                 NonReplacedContents::OfTextControl.into()
             } else {
                 NonReplacedContents::OfElement.into()
             };
             let display = display.used_value_for_contents(&contents);
-            let box_slot = element.element_box_slot();
+            let box_slot = element.box_slot();
             handler.handle_element(&info, display, contents, box_slot);
         },
     }
@@ -286,7 +214,8 @@ fn traverse_eager_pseudo_element<'dom>(
 
     // If this node doesn't have this eager pseudo-element, exit early. This depends on
     // the style applied to the element.
-    let Some(pseudo_element_info) = node_info.pseudo(context, pseudo_element_type) else {
+    let Some(pseudo_element_info) = node_info.with_pseudo_element(context, pseudo_element_type)
+    else {
         return;
     };
     if pseudo_element_info.style.ineffective_content_property() {
@@ -297,9 +226,7 @@ fn traverse_eager_pseudo_element<'dom>(
         Display::None => {},
         Display::Contents => {
             let items = generate_pseudo_element_content(&pseudo_element_info, context);
-            let box_slot = pseudo_element_info
-                .node
-                .pseudo_element_box_slot(pseudo_element_type);
+            let box_slot = pseudo_element_info.node.box_slot();
             let shared_inline_styles: SharedInlineStyles = (&pseudo_element_info).into();
             box_slot.set(LayoutBox::DisplayContents(shared_inline_styles.clone()));
 
@@ -309,9 +236,7 @@ fn traverse_eager_pseudo_element<'dom>(
         },
         Display::GeneratingBox(display) => {
             let items = generate_pseudo_element_content(&pseudo_element_info, context);
-            let box_slot = pseudo_element_info
-                .node
-                .pseudo_element_box_slot(pseudo_element_type);
+            let box_slot = pseudo_element_info.node.box_slot();
             let contents = NonReplacedContents::OfPseudoElement(items).into();
             handler.handle_element(&pseudo_element_info, display, contents, box_slot);
         },
@@ -330,7 +255,7 @@ fn traverse_pseudo_element_contents<'dom>(
             PseudoElementContentItem::Text(text) => handler.handle_text(info, text.into()),
             PseudoElementContentItem::Replaced(contents) => {
                 let anonymous_info = anonymous_info.get_or_insert_with(|| {
-                    info.pseudo(context, PseudoElement::ServoAnonymousBox)
+                    info.with_pseudo_element(context, PseudoElement::ServoAnonymousBox)
                         .unwrap_or_else(|| info.clone())
                 });
                 let display_inline = DisplayGeneratingBox::OutsideInside {
@@ -348,8 +273,7 @@ fn traverse_pseudo_element_contents<'dom>(
                     anonymous_info,
                     display_inline,
                     Contents::Replaced(contents),
-                    info.node
-                        .pseudo_element_box_slot(PseudoElement::ServoAnonymousBox),
+                    anonymous_info.node.box_slot(),
                 )
             },
         }
@@ -414,7 +338,6 @@ fn generate_pseudo_element_content(
                     ContentItem::Attr(attr) => {
                         let element = pseudo_element_info
                             .node
-                            .to_threadsafe()
                             .as_element()
                             .expect("Expected an element");
 
@@ -485,44 +408,3 @@ fn generate_pseudo_element_content(
         Content::Normal | Content::None => unreachable!(),
     }
 }
-
-pub enum ChildNodeIterator<'dom> {
-    /// Iterating over the children of a node
-    Node(Option<ServoLayoutNode<'dom>>),
-    /// Iterating over the assigned nodes of a `HTMLSlotElement`
-    Slottables(<Vec<ServoLayoutNode<'dom>> as IntoIterator>::IntoIter),
-}
-
-pub(crate) fn iter_child_nodes(parent: ServoLayoutNode<'_>) -> ChildNodeIterator<'_> {
-    if let Some(element) = parent.as_element() {
-        if let Some(shadow) = element.shadow_root() {
-            return iter_child_nodes(shadow.as_node());
-        };
-
-        let slotted_nodes = element.slotted_nodes();
-        if !slotted_nodes.is_empty() {
-            #[allow(clippy::unnecessary_to_owned)] // Clippy is wrong.
-            return ChildNodeIterator::Slottables(slotted_nodes.to_owned().into_iter());
-        }
-    }
-
-    let first = parent.first_child();
-    ChildNodeIterator::Node(first)
-}
-
-impl<'dom> Iterator for ChildNodeIterator<'dom> {
-    type Item = ServoLayoutNode<'dom>;
-
-    fn next(&mut self) -> Option<Self::Item> {
-        match self {
-            Self::Node(node) => {
-                let old = *node;
-                *node = old?.next_sibling();
-                old
-            },
-            Self::Slottables(slots) => slots.next(),
-        }
-    }
-}
-
-impl FusedIterator for ChildNodeIterator<'_> {}

components/layout/flexbox/layout.rs

@@ -31,19 +31,17 @@ use crate::formatting_contexts::Baselines;
 use crate::fragment_tree::{
     BoxFragment, CollapsedBlockMargins, Fragment, FragmentFlags, SpecificLayoutInfo,
 };
-use crate::geom::{AuOrAuto, LazySize, LogicalRect, LogicalSides, LogicalVec2, Size, Sizes};
+use crate::geom::{AuOrAuto, LogicalRect, LogicalSides, LogicalVec2};
 use crate::layout_box_base::CacheableLayoutResult;
 use crate::positioned::{
     AbsolutelyPositionedBox, PositioningContext, PositioningContextLength, relative_adjustement,
 };
 use crate::sizing::{
     ComputeInlineContentSizes, ContentSizes, InlineContentSizesResult, IntrinsicSizingMode,
+    LazySize, Size, SizeConstraint, Sizes,
 };
 use crate::style_ext::{AspectRatio, Clamp, ComputedValuesExt, ContentBoxSizesAndPBM, LayoutStyle};
-use crate::{
-    ConstraintSpace, ContainingBlock, ContainingBlockSize, IndefiniteContainingBlock,
-    SizeConstraint,
-};
+use crate::{ConstraintSpace, ContainingBlock, ContainingBlockSize, IndefiniteContainingBlock};
 
 /// Layout parameters and intermediate results about a flex container,
 /// grouped to avoid passing around many parameters
@@ -58,9 +56,7 @@ struct FlexContext<'a> {
 struct FlexItem<'a> {
     box_: &'a FlexItemBox,
 
-    /// The preferred, min and max inner cross sizes. If the flex container is single-line
-    /// and [`Self::cross_size_stretches_to_line`] is true, then the preferred cross size
-    /// is set to [`Size::Stretch`].
+    /// The preferred, min and max inner cross sizes.
     content_cross_sizes: Sizes,
 
     padding: FlexRelativeSides<Au>,
@@ -99,17 +95,10 @@ struct FlexItem<'a> {
     /// <https://drafts.csswg.org/css-sizing-4/#preferred-aspect-ratio>
     preferred_aspect_ratio: Option<AspectRatio>,
 
-    /// Whether the preferred cross size of the item stretches to fill the flex line.
-    /// This happens when the size computes to `auto`, the used value of `align-self`
-    /// is `stretch`, and neither of the cross-axis margins are `auto`.
-    /// <https://drafts.csswg.org/css-flexbox-1/#stretched>
-    ///
-    /// Note the following sizes are not sufficient:
-    ///  - A size that only behaves as `auto` (like a cyclic percentage).
-    ///    The computed value needs to be `auto` too.
-    ///  - A `stretch` size. It stretches to the containing block, not to the line
-    ///    (under discussion in <https://github.com/w3c/csswg-drafts/issues/11784>).
-    cross_size_stretches_to_line: bool,
+    /// The automatic size in the cross axis.
+    /// <https://drafts.csswg.org/css-sizing-3/#automatic-size>
+    automatic_cross_size: Size<Au>,
+    automatic_cross_size_for_intrinsic_sizing: Size<Au>,
 }
 
 /// Child of a FlexContainer. Can either be absolutely positioned, or not. If not,
@@ -128,51 +117,20 @@ struct FlexItemLayoutResult {
     // Either the first or the last baseline, depending on ‘align-self’.
     baseline_relative_to_margin_box: Option<Au>,
 
-    // The content size of this layout. For replaced elements this is known before layout,
-    // but for non-replaced it's only known after layout.
-    content_size: LogicalVec2<Au>,
+    // The content size of this layout in the block axis. This is known before layout
+    // for replaced elements, but for non-replaced it's only known after layout.
+    content_block_size: Au,
 
-    // The containing block inline size used to generate this layout.
-    containing_block_inline_size: Au,
-
-    // The containing block block size used to generate this layout.
-    containing_block_block_size: SizeConstraint,
+    // The containing block size used to generate this layout.
+    containing_block_size: ContainingBlockSize,
 
     // Whether or not this layout depended on block constraints.
     depends_on_block_constraints: bool,
 
-    // Whether or not this layout had a child that dependeded on block constraints.
-    has_child_which_depends_on_block_constraints: bool,
-
     // The specific layout info that this flex item had.
     specific_layout_info: Option<SpecificLayoutInfo>,
 }
 
-impl FlexItemLayoutResult {
-    fn compatible_with_containing_block_size(&self, containing_block: &ContainingBlock) -> bool {
-        if containing_block.size.inline == self.containing_block_inline_size &&
-            (containing_block.size.block == self.containing_block_block_size ||
-                (!self.depends_on_block_constraints &&
-                    !self.has_child_which_depends_on_block_constraints))
-        {
-            return true;
-        }
-
-        #[cfg(feature = "tracing")]
-        tracing::warn!(
-            name: "NonReplaced stretch cache miss",
-            cached_inline = ?self.containing_block_inline_size,
-            cached_block = ?self.containing_block_block_size,
-            required_inline = ?containing_block.size.inline,
-            required_block = ?containing_block.size.block,
-            depends_on_block_constraints = self.depends_on_block_constraints,
-            has_child_which_depends_on_block_constraints = self.has_child_which_depends_on_block_constraints,
-        );
-
-        false
-    }
-}
-
 /// A data structure to hold all of the information about a flex item that has been placed
 /// into a flex line. This happens once the item is laid out and its line has been determined.
 struct FlexLineItem<'a> {
@@ -627,7 +585,6 @@ impl FlexContainer {
         layout_context: &LayoutContext,
         positioning_context: &mut PositioningContext,
         containing_block: &ContainingBlock,
-        depends_on_block_constraints: bool,
         lazy_block_size: &LazySize,
     ) -> CacheableLayoutResult {
         let mut flex_context = FlexContext {
@@ -953,6 +910,20 @@ impl FlexContainer {
                 .or(all_baselines.last),
         };
 
+        // TODO: `depends_on_block_constraints` could be false in some corner cases
+        // in order to improve performance.
+        // - In a single-line column container where all items have the grow and shrink
+        //   factors set to zero and the flex basis doesn't depend on block constraints,
+        //   and `justify-content` is `start` or equivalent.
+        //   This is unlikely because the flex shrink factor defaults to 1.
+        // - In a single-line row container where all items have `align-self: start` or
+        //   equivalent, and the cross size doesn't depend on block constraints.
+        //   This is unlikely because `align-self` stretches by default.
+        // - In a multi-line row container where `align-content` is `start` or equivalent,
+        //   and no item cross size depends on block constraints.
+        //   This is unlikely because `align-content` defaults to `stretch`.
+        let depends_on_block_constraints = true;
+
         CacheableLayoutResult {
             fragments,
             content_block_size,
@@ -1030,7 +1001,7 @@ impl FlexContainer {
     }
 
     #[inline]
-    pub(crate) fn layout_style(&self) -> LayoutStyle {
+    pub(crate) fn layout_style(&self) -> LayoutStyle<'_> {
         LayoutStyle::Default(&self.style)
     }
 }
@@ -1179,7 +1150,11 @@ fn do_initial_flex_line_layout<'items>(
     // We didn't reach the end of the last line, so add all remaining items there.
     lines.push((items, line_size_so_far));
 
-    lines.par_drain(..).map(construct_line).collect()
+    if flex_context.layout_context.use_rayon {
+        lines.par_drain(..).map(construct_line).collect()
+    } else {
+        lines.drain(..).map(construct_line).collect()
+    }
 }
 
 /// The result of splitting the flex items into lines using their intrinsic sizes and doing an
@@ -1216,19 +1191,13 @@ impl InitialFlexLineLayout<'_> {
             items
                 .par_iter()
                 .zip(&item_used_main_sizes)
-                .map(|(item, used_main_size)| {
-                    item.layout(*used_main_size, flex_context, None, None)
-                        .unwrap()
-                })
+                .map(|(item, used_main_size)| item.layout(*used_main_size, flex_context, None))
                 .collect()
         } else {
             items
                 .iter()
                 .zip(&item_used_main_sizes)
-                .map(|(item, used_main_size)| {
-                    item.layout(*used_main_size, flex_context, None, None)
-                        .unwrap()
-                })
+                .map(|(item, used_main_size)| item.layout(*used_main_size, flex_context, None))
                 .collect()
         };
 
@@ -1558,42 +1527,63 @@ impl InitialFlexLineLayout<'_> {
         let mut item_used_cross_sizes = Vec::with_capacity(item_count);
         let mut item_margins = Vec::with_capacity(item_count);
         for item in self.items.iter_mut() {
-            let used_cross_size = if item.item.cross_size_stretches_to_line {
-                let (axis, content_size) = match flex_context.config.flex_axis {
-                    FlexAxis::Row => (Direction::Block, item.layout_result.content_size.block),
-                    FlexAxis::Column => (Direction::Inline, item.layout_result.content_size.inline),
-                };
-                item.item.content_cross_sizes.resolve(
-                    axis,
-                    Size::Stretch,
-                    Au::zero,
-                    Some(final_line_cross_size - item.item.pbm_auto_is_zero.cross),
-                    || content_size.into(),
-                    // Tables have a special sizing in the block axis in that handles collapsed rows,
-                    // but it would prevent stretching. So we only recognize tables in the inline axis.
-                    // The interaction of collapsed table tracks and the flexbox algorithms is unclear,
-                    // see https://github.com/w3c/csswg-drafts/issues/11408.
-                    item.item.box_.independent_formatting_context.is_table() &&
-                        axis == Direction::Inline,
-                )
-            } else {
-                item.layout_result.hypothetical_cross_size
+            let cross_axis = match flex_context.config.flex_axis {
+                FlexAxis::Row => Direction::Block,
+                FlexAxis::Column => Direction::Inline,
             };
+            let layout = &mut item.layout_result;
+            let get_content_size = || match cross_axis {
+                Direction::Block => layout.content_block_size.into(),
+                Direction::Inline => item
+                    .item
+                    .inline_content_sizes(flex_context, item.used_main_size),
+            };
+            let used_cross_size = item.item.content_cross_sizes.resolve(
+                cross_axis,
+                item.item.automatic_cross_size,
+                Au::zero,
+                Some(Au::zero().max(final_line_cross_size - item.item.pbm_auto_is_zero.cross)),
+                get_content_size,
+                // Tables have a special sizing in the block axis in that handles collapsed rows,
+                // but it would prevent stretching. So we only recognize tables in the inline axis.
+                // The interaction of collapsed table tracks and the flexbox algorithms is unclear,
+                // see https://github.com/w3c/csswg-drafts/issues/11408.
+                item.item.box_.independent_formatting_context.is_table() &&
+                    cross_axis == Direction::Inline,
+            );
             item_used_cross_sizes.push(used_cross_size);
 
             // “If the flex item has `align-self: stretch`, redo layout for its contents,
             // treating this used size as its definite cross size so that percentage-sized
             // children can be resolved.”
-            if item.item.cross_size_stretches_to_line {
-                let new_layout = item.item.layout(
-                    item.used_main_size,
-                    flex_context,
-                    Some(used_cross_size),
-                    Some(&mut item.layout_result),
+            // However, as resolved in https://github.com/w3c/csswg-drafts/issues/11784,
+            // we do that when the cross size is `stretch`. We also need to do it if the
+            // inline size changes, which may happen with a `fit-content` cross size.
+            let needs_new_layout = match cross_axis {
+                Direction::Block => {
+                    (match item.item.content_cross_sizes.preferred {
+                        Size::Initial => item.item.automatic_cross_size == Size::Stretch,
+                        Size::Stretch => true,
+                        _ => false,
+                    }) && SizeConstraint::Definite(used_cross_size) !=
+                        layout.containing_block_size.block &&
+                        layout.depends_on_block_constraints
+                },
+                Direction::Inline => used_cross_size != layout.containing_block_size.inline,
+            };
+            if needs_new_layout {
+                #[cfg(feature = "tracing")]
+                tracing::warn!(
+                    name: "Flex item stretch cache miss",
+                    cached_inline = ?layout.containing_block_size.inline,
+                    cached_block = ?layout.containing_block_size.block,
+                    required_cross_size = ?used_cross_size,
+                    cross_axis = ?cross_axis,
+                    depends_on_block_constraints = layout.depends_on_block_constraints,
                 );
-                if let Some(layout) = new_layout {
-                    item.layout_result = layout;
-                }
+                *layout =
+                    item.item
+                        .layout(item.used_main_size, flex_context, Some(used_cross_size));
             }
 
             let baseline = item.get_or_synthesize_baseline_with_cross_size(used_cross_size);
@@ -1736,7 +1726,6 @@ impl FlexItem<'_> {
         fields(
             self_address = self as *const _ as usize,
             box_address = self.box_ as *const _ as usize,
-            for_stretch = non_stretch_layout_result.is_some()
         )
     )]
     #[allow(clippy::too_many_arguments)]
@@ -1745,8 +1734,7 @@ impl FlexItem<'_> {
         used_main_size: Au,
         flex_context: &FlexContext,
         used_cross_size_override: Option<Au>,
-        non_stretch_layout_result: Option<&mut FlexItemLayoutResult>,
-    ) -> Option<FlexItemLayoutResult> {
+    ) -> FlexItemLayoutResult {
         let containing_block = flex_context.containing_block;
         let independent_formatting_context = &self.box_.independent_formatting_context;
         let is_table = independent_formatting_context.is_table();
@@ -1764,9 +1752,6 @@ impl FlexItem<'_> {
             let cross_size = match used_cross_size_override {
                 Some(s) => SizeConstraint::Definite(s),
                 None => {
-                    // This means that an auto size with stretch alignment will behave different than
-                    // a stretch size. That's not what the spec says, but matches other browsers.
-                    // To be discussed in https://github.com/w3c/csswg-drafts/issues/11784.
                     let stretch_size = containing_block
                         .size
                         .block
@@ -1797,22 +1782,12 @@ impl FlexItem<'_> {
             let cross_size = used_cross_size_override.unwrap_or_else(|| {
                 let stretch_size =
                     Au::zero().max(containing_block.size.inline - self.pbm_auto_is_zero.cross);
-                let get_content_size = || {
-                    let constraint_space = ConstraintSpace::new(
-                        SizeConstraint::Definite(used_main_size),
-                        item_writing_mode,
-                        self.preferred_aspect_ratio,
-                    );
-                    independent_formatting_context
-                        .inline_content_sizes(flex_context.layout_context, &constraint_space)
-                        .sizes
-                };
                 self.content_cross_sizes.resolve(
                     Direction::Inline,
                     Size::FitContent,
                     Au::zero,
                     Some(stretch_size),
-                    get_content_size,
+                    || self.inline_content_sizes(flex_context, used_main_size),
                     is_table,
                 )
             });
@@ -1841,20 +1816,11 @@ impl FlexItem<'_> {
             style: item_style,
         };
 
-        if non_stretch_layout_result.is_some_and(|old_result| {
-            old_result.compatible_with_containing_block_size(&item_as_containing_block)
-        }) {
-            return None;
-        }
-
         let lazy_block_size = if !cross_axis_is_item_block_axis {
             used_main_size.into()
         } else if let Some(cross_size) = used_cross_size_override {
             cross_size.into()
         } else {
-            // This means that an auto size with stretch alignment will behave different than
-            // a stretch size. That's not what the spec says, but matches other browsers.
-            // To be discussed in https://github.com/w3c/csswg-drafts/issues/11784.
             let stretch_size = containing_block
                 .size
                 .block
@@ -1876,9 +1842,6 @@ impl FlexItem<'_> {
             &item_as_containing_block,
             containing_block,
             self.preferred_aspect_ratio,
-            flex_axis == FlexAxis::Column ||
-                self.cross_size_stretches_to_line ||
-                self.depends_on_block_constraints,
             &lazy_block_size,
         );
         let CacheableLayoutResult {
@@ -1890,14 +1853,6 @@ impl FlexItem<'_> {
             ..
         } = layout;
 
-        let has_child_which_depends_on_block_constraints = fragments.iter().any(|fragment| {
-            fragment.base().is_some_and(|base| {
-                base.flags.contains(
-                    FragmentFlags::SIZE_DEPENDS_ON_BLOCK_CONSTRAINTS_AND_CAN_BE_CHILD_OF_FLEX_ITEM,
-                )
-            })
-        });
-
         let hypothetical_cross_size = if cross_axis_is_item_block_axis {
             lazy_block_size.resolve(|| content_block_size)
         } else {
@@ -1929,21 +1884,16 @@ impl FlexItem<'_> {
             _ => None,
         };
 
-        Some(FlexItemLayoutResult {
+        FlexItemLayoutResult {
             hypothetical_cross_size,
             fragments,
             positioning_context,
             baseline_relative_to_margin_box,
-            content_size: LogicalVec2 {
-                inline: item_as_containing_block.size.inline,
-                block: content_block_size,
-            },
-            containing_block_inline_size: item_as_containing_block.size.inline,
-            containing_block_block_size: item_as_containing_block.size.block,
+            content_block_size,
+            containing_block_size: item_as_containing_block.size,
             depends_on_block_constraints,
-            has_child_which_depends_on_block_constraints,
             specific_layout_info,
-        })
+        }
     }
 
     fn synthesized_baseline_relative_to_margin_box(&self, content_size: Au) -> Au {
@@ -2077,6 +2027,15 @@ impl FlexItem<'_> {
             };
         outer_cross_start + margin.cross_start + self.border.cross_start + self.padding.cross_start
     }
+
+    #[inline]
+    fn inline_content_sizes(&self, flex_context: &FlexContext, block_size: Au) -> ContentSizes {
+        self.box_.inline_content_sizes(
+            flex_context,
+            SizeConstraint::Definite(block_size),
+            self.preferred_aspect_ratio,
+        )
+    }
 }
 
 impl FlexItemBox {
@@ -2087,7 +2046,7 @@ impl FlexItemBox {
         content_box_sizes_and_pbm: &ContentBoxSizesAndPBM,
         config: &FlexContainerConfig,
         flex_context_getter: &impl Fn() -> &'a FlexContext<'a>,
-    ) -> FlexItem {
+    ) -> FlexItem<'_> {
         let flex_axis = config.flex_axis;
         let style = self.style();
         let cross_axis_is_item_block_axis = cross_axis_is_item_block_axis(
@@ -2121,28 +2080,31 @@ impl FlexItemBox {
             main: padding_border.main,
             cross: padding_border.cross,
         } + margin_auto_is_zero.sum_by_axis();
-        let (content_main_sizes, mut content_cross_sizes, cross_size_computes_to_auto) =
-            match flex_axis {
-                FlexAxis::Row => (
-                    &content_box_sizes.inline,
-                    content_box_sizes.block.clone(),
-                    preferred_size_computes_to_auto.block,
-                ),
-                FlexAxis::Column => (
-                    &content_box_sizes.block,
-                    content_box_sizes.inline.clone(),
-                    preferred_size_computes_to_auto.inline,
-                ),
-            };
-        let cross_size_stretches_to_line = cross_size_computes_to_auto &&
-            item_with_auto_cross_size_stretches_to_line_size(align_self, &margin);
-        if cross_size_stretches_to_line && config.container_is_single_line {
-            // <https://drafts.csswg.org/css-flexbox-1/#definite-sizes>
-            // > If a single-line flex container has a definite cross size, the automatic preferred
-            // > outer cross size of any stretched flex items is the flex container’s inner cross size.
-            // Therefore, set it to `stretch`, which has the desired behavior.
-            content_cross_sizes.preferred = Size::Stretch;
-        }
+        let (content_main_sizes, content_cross_sizes, cross_size_computes_to_auto) = match flex_axis
+        {
+            FlexAxis::Row => (
+                &content_box_sizes.inline,
+                &content_box_sizes.block,
+                preferred_size_computes_to_auto.block,
+            ),
+            FlexAxis::Column => (
+                &content_box_sizes.block,
+                &content_box_sizes.inline,
+                preferred_size_computes_to_auto.inline,
+            ),
+        };
+        let automatic_cross_size = if cross_size_computes_to_auto &&
+            item_with_auto_cross_size_stretches_to_line_size(align_self, &margin)
+        {
+            Size::Stretch
+        } else {
+            Size::FitContent
+        };
+        let automatic_cross_size_for_intrinsic_sizing = if config.container_is_single_line {
+            automatic_cross_size
+        } else {
+            Size::FitContent
+        };
         let containing_block_size = flex_axis.vec2_to_flex_relative(containing_block.size);
         let stretch_size = FlexRelativeVec2 {
             main: containing_block_size
@@ -2163,7 +2125,7 @@ impl FlexItemBox {
         let (preferred_cross_size, min_cross_size, max_cross_size) =
             if let Some(cross_content_size) = tentative_cross_content_size {
                 let (preferred, min, max) = content_cross_sizes.resolve_each(
-                    Size::FitContent,
+                    automatic_cross_size_for_intrinsic_sizing,
                     Au::zero,
                     stretch_size.cross,
                     || cross_content_size,
@@ -2172,7 +2134,7 @@ impl FlexItemBox {
                 (Some(preferred), min, max)
             } else {
                 content_cross_sizes.resolve_each_extrinsic(
-                    Size::FitContent,
+                    automatic_cross_size_for_intrinsic_sizing,
                     Au::zero(),
                     stretch_size.cross,
                 )
@@ -2237,7 +2199,7 @@ impl FlexItemBox {
                     &pbm_auto_is_zero,
                     content_box_sizes,
                     preferred_aspect_ratio,
-                    content_cross_sizes.preferred == Size::Stretch,
+                    automatic_cross_size_for_intrinsic_sizing,
                     IntrinsicSizingMode::Size,
                 )
                 .into()
@@ -2306,7 +2268,7 @@ impl FlexItemBox {
 
         FlexItem {
             box_: self,
-            content_cross_sizes,
+            content_cross_sizes: content_cross_sizes.clone(),
             padding,
             border,
             margin: config.sides_to_flex_relative(pbm.margin),
@@ -2320,7 +2282,8 @@ impl FlexItemBox {
             align_self,
             depends_on_block_constraints: *depends_on_block_constraints,
             preferred_aspect_ratio,
-            cross_size_stretches_to_line,
+            automatic_cross_size,
+            automatic_cross_size_for_intrinsic_sizing,
         }
     }
 
@@ -2339,12 +2302,12 @@ impl FlexItemBox {
         // TODO: when laying out a column container with an indefinite main size,
         // we compute the base sizes of the items twice. We should consider caching.
         let FlexItem {
-            content_cross_sizes,
             flex_base_size,
             content_min_main_size,
             content_max_main_size,
             pbm_auto_is_zero,
             preferred_aspect_ratio,
+            automatic_cross_size_for_intrinsic_sizing,
             ..
         } = self.to_flex_item(
             layout_context,
@@ -2371,7 +2334,7 @@ impl FlexItemBox {
                         layout_context,
                         containing_block,
                         &auto_minimum,
-                        content_cross_sizes.preferred == Size::Stretch,
+                        automatic_cross_size_for_intrinsic_sizing == Size::Stretch,
                     );
                 (sizes, depends_on_block_constraints)
             },
@@ -2381,7 +2344,7 @@ impl FlexItemBox {
                     &pbm_auto_is_zero,
                     &content_box_sizes_and_pbm.content_box_sizes,
                     preferred_aspect_ratio,
-                    content_cross_sizes.preferred == Size::Stretch,
+                    automatic_cross_size_for_intrinsic_sizing,
                     IntrinsicSizingMode::Contribution,
                 );
                 (size.into(), true)
@@ -2538,7 +2501,7 @@ impl FlexItemBox {
         pbm_auto_is_zero: &FlexRelativeVec2<Au>,
         content_box_sizes: &LogicalVec2<Sizes>,
         preferred_aspect_ratio: Option<AspectRatio>,
-        cross_size_stretches_to_container_size: bool,
+        automatic_inline_size: Size<Au>,
         intrinsic_sizing_mode: IntrinsicSizingMode,
     ) -> Au {
         let content_block_size = || {
@@ -2553,26 +2516,18 @@ impl FlexItemBox {
             // TODO: This is wrong if the item writing mode is different from the flex
             // container's writing mode.
             let inline_size = {
-                let initial_behavior = if cross_size_stretches_to_container_size {
-                    Size::Stretch
-                } else {
-                    Size::FitContent
-                };
                 let stretch_size =
                     flex_context.containing_block.size.inline - pbm_auto_is_zero.cross;
                 let get_content_size = || {
-                    let constraint_space = ConstraintSpace::new(
+                    self.inline_content_sizes(
+                        flex_context,
                         tentative_block_size,
-                        style.writing_mode,
                         preferred_aspect_ratio,
-                    );
-                    self.independent_formatting_context
-                        .inline_content_sizes(flex_context.layout_context, &constraint_space)
-                        .sizes
+                    )
                 };
                 content_box_sizes.inline.resolve(
                     Direction::Inline,
-                    initial_behavior,
+                    automatic_inline_size,
                     Au::zero,
                     Some(stretch_size),
                     get_content_size,
@@ -2593,7 +2548,6 @@ impl FlexItemBox {
                     &item_as_containing_block,
                     flex_context.containing_block,
                     preferred_aspect_ratio,
-                    false, /* depends_on_block_constraints */
                     &LazySize::intrinsic(),
                 )
                 .content_block_size
@@ -2625,4 +2579,18 @@ impl FlexItemBox {
             IntrinsicSizingMode::Size => content_block_size(),
         }
     }
+
+    fn inline_content_sizes(
+        &self,
+        flex_context: &FlexContext,
+        block_size: SizeConstraint,
+        preferred_aspect_ratio: Option<AspectRatio>,
+    ) -> ContentSizes {
+        let writing_mode = self.independent_formatting_context.style().writing_mode;
+        let constraint_space =
+            ConstraintSpace::new(block_size, writing_mode, preferred_aspect_ratio);
+        self.independent_formatting_context
+            .inline_content_sizes(flex_context.layout_context, &constraint_space)
+            .sizes
+    }
 }

components/layout/flexbox/mod.rs

@@ -4,7 +4,7 @@
 
 use geom::{FlexAxis, MainStartCrossStart};
 use malloc_size_of_derive::MallocSizeOf;
-use script::layout_dom::ServoLayoutNode;
+use script::layout_dom::ServoThreadSafeLayoutNode;
 use servo_arc::Arc as ServoArc;
 use style::context::SharedStyleContext;
 use style::logical_geometry::WritingMode;
@@ -22,7 +22,8 @@ use crate::context::LayoutContext;
 use crate::dom::LayoutBox;
 use crate::dom_traversal::{NodeAndStyleInfo, NonReplacedContents};
 use crate::formatting_contexts::IndependentFormattingContext;
-use crate::fragment_tree::{BaseFragmentInfo, Fragment};
+use crate::fragment_tree::BaseFragmentInfo;
+use crate::layout_box_base::LayoutBoxBase;
 use crate::positioned::AbsolutelyPositionedBox;
 
 mod geom;
@@ -151,6 +152,7 @@ impl FlexContainer {
     }
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Debug, MallocSizeOf)]
 pub(crate) enum FlexLevelBox {
     FlexItem(FlexItemBox),
@@ -161,7 +163,7 @@ impl FlexLevelBox {
     pub(crate) fn repair_style(
         &mut self,
         context: &SharedStyleContext,
-        node: &ServoLayoutNode,
+        node: &ServoThreadSafeLayoutNode,
         new_style: &ServoArc<ComputedValues>,
     ) {
         match self {
@@ -189,14 +191,24 @@ impl FlexLevelBox {
         }
     }
 
-    pub(crate) fn fragments(&self) -> Vec<Fragment> {
+    pub(crate) fn with_base<T>(&self, callback: impl Fn(&LayoutBoxBase) -> T) -> T {
         match self {
-            FlexLevelBox::FlexItem(flex_item_box) => flex_item_box
-                .independent_formatting_context
-                .base
-                .fragments(),
+            FlexLevelBox::FlexItem(flex_item_box) => {
+                callback(&flex_item_box.independent_formatting_context.base)
+            },
             FlexLevelBox::OutOfFlowAbsolutelyPositionedBox(positioned_box) => {
-                positioned_box.borrow().context.base.fragments()
+                callback(&positioned_box.borrow().context.base)
+            },
+        }
+    }
+
+    pub(crate) fn with_base_mut<T>(&mut self, callback: impl Fn(&mut LayoutBoxBase) -> T) -> T {
+        match self {
+            FlexLevelBox::FlexItem(flex_item_box) => {
+                callback(&mut flex_item_box.independent_formatting_context.base)
+            },
+            FlexLevelBox::OutOfFlowAbsolutelyPositionedBox(positioned_box) => {
+                callback(&mut positioned_box.borrow_mut().context.base)
             },
         }
     }

components/layout/flow/construct.rs

@@ -171,11 +171,10 @@ impl BlockContainer {
             if let Some((marker_info, marker_contents)) = crate::lists::make_marker(context, info) {
                 match marker_info.style.clone_list_style_position() {
                     ListStylePosition::Inside => {
-                        builder.handle_list_item_marker_inside(&marker_info, info, marker_contents)
+                        builder.handle_list_item_marker_inside(&marker_info, marker_contents)
                     },
                     ListStylePosition::Outside => builder.handle_list_item_marker_outside(
                         &marker_info,
-                        info,
                         marker_contents,
                         info.style.clone(),
                     ),
@@ -228,7 +227,7 @@ impl<'dom, 'style> BlockContainerBuilder<'dom, 'style> {
         self.inline_formatting_context_builder.take()?.finish(
             self.context,
             !self.have_already_seen_first_line_for_text_indent,
-            self.info.is_single_line_text_input(),
+            self.info.node.is_single_line_text_input(),
             self.info.style.to_bidi_level(),
         )
     }
@@ -299,9 +298,7 @@ impl<'dom, 'style> BlockContainerBuilder<'dom, 'style> {
                 self.push_block_level_job_for_inline_formatting_context(inline_formatting_context);
             }
 
-            let box_slot = table_info
-                .node
-                .pseudo_element_box_slot(PseudoElement::ServoAnonymousTable);
+            let box_slot = table_info.node.box_slot();
             self.block_level_boxes.push(BlockLevelJob {
                 info: table_info,
                 box_slot,
@@ -408,19 +405,9 @@ impl<'dom> BlockContainerBuilder<'dom, '_> {
     fn handle_list_item_marker_inside(
         &mut self,
         marker_info: &NodeAndStyleInfo<'dom>,
-        container_info: &NodeAndStyleInfo<'dom>,
         contents: Vec<crate::dom_traversal::PseudoElementContentItem>,
     ) {
-        // TODO: We do not currently support saving box slots for ::marker pseudo-elements
-        // that are part nested in ::before and ::after pseudo elements. For now, just
-        // forget about them once they are built.
-        let box_slot = match container_info.pseudo_element_type {
-            Some(_) => BoxSlot::dummy(),
-            None => marker_info
-                .node
-                .pseudo_element_box_slot(PseudoElement::Marker),
-        };
-
+        let box_slot = marker_info.node.box_slot();
         self.handle_inline_level_element(
             marker_info,
             DisplayInside::Flow {
@@ -434,20 +421,10 @@ impl<'dom> BlockContainerBuilder<'dom, '_> {
     fn handle_list_item_marker_outside(
         &mut self,
         marker_info: &NodeAndStyleInfo<'dom>,
-        container_info: &NodeAndStyleInfo<'dom>,
         contents: Vec<crate::dom_traversal::PseudoElementContentItem>,
         list_item_style: Arc<ComputedValues>,
     ) {
-        // TODO: We do not currently support saving box slots for ::marker pseudo-elements
-        // that are part nested in ::before and ::after pseudo elements. For now, just
-        // forget about them once they are built.
-        let box_slot = match container_info.pseudo_element_type {
-            Some(_) => BoxSlot::dummy(),
-            None => marker_info
-                .node
-                .pseudo_element_box_slot(PseudoElement::Marker),
-        };
-
+        let box_slot = marker_info.node.box_slot();
         self.block_level_boxes.push(BlockLevelJob {
             info: marker_info.clone(),
             box_slot,
@@ -466,6 +443,7 @@ impl<'dom> BlockContainerBuilder<'dom, '_> {
         contents: Contents,
         box_slot: BoxSlot<'dom>,
     ) {
+        let old_layout_box = box_slot.take_layout_box_if_undamaged(info.damage);
         let (is_list_item, non_replaced_contents) = match (display_inside, contents) {
             (
                 DisplayInside::Flow { is_list_item },
@@ -485,7 +463,7 @@ impl<'dom> BlockContainerBuilder<'dom, '_> {
                         propagated_data,
                     ))
                 };
-                let old_layout_box = box_slot.take_layout_box_if_undamaged(info.damage);
+
                 let atomic = self
                     .ensure_inline_formatting_context_builder()
                     .push_atomic(construction_callback, old_layout_box);
@@ -497,7 +475,11 @@ impl<'dom> BlockContainerBuilder<'dom, '_> {
         // Otherwise, this is just a normal inline box. Whatever happened before, all we need to do
         // before recurring is to remember this ongoing inline level box.
         self.ensure_inline_formatting_context_builder()
-            .start_inline_box(InlineBox::new(info), None);
+            .start_inline_box(
+                || ArcRefCell::new(InlineBox::new(info)),
+                None,
+                old_layout_box,
+            );
 
         if is_list_item {
             if let Some((marker_info, marker_contents)) =
@@ -506,7 +488,7 @@ impl<'dom> BlockContainerBuilder<'dom, '_> {
                 // Ignore `list-style-position` here:
                 // “If the list item is an inline box: this value is equivalent to `inside`.”
                 // https://drafts.csswg.org/css-lists/#list-style-position-outside
-                self.handle_list_item_marker_inside(&marker_info, info, marker_contents)
+                self.handle_list_item_marker_inside(&marker_info, marker_contents)
             }
         }
 
@@ -677,21 +659,18 @@ impl<'dom> BlockContainerBuilder<'dom, '_> {
         inline_formatting_context: InlineFormattingContext,
     ) {
         let layout_context = self.context;
-        let info = self
+        let anonymous_info = self
             .anonymous_box_info
             .get_or_insert_with(|| {
                 self.info
-                    .pseudo(layout_context, PseudoElement::ServoAnonymousBox)
+                    .with_pseudo_element(layout_context, PseudoElement::ServoAnonymousBox)
                     .expect("Should never fail to create anonymous box")
             })
             .clone();
 
-        let box_slot = self
-            .info
-            .node
-            .pseudo_element_box_slot(PseudoElement::ServoAnonymousBox);
+        let box_slot = anonymous_info.node.box_slot();
         self.block_level_boxes.push(BlockLevelJob {
-            info,
+            info: anonymous_info,
             box_slot,
             kind: BlockLevelCreator::SameFormattingContextBlock(
                 IntermediateBlockContainer::InlineFormattingContext(