Skip to content

refactor(window): use native cross-origin binding tables - #1614

Closed
ldm0 wants to merge 3 commits into
mainfrom
refactor/native-cross-origin-bindings-20261016
Closed

ldm0 wants to merge 3 commits into
mainfrom
refactor/native-cross-origin-bindings-20261016

Conversation

@ldm0

@ldm0 ldm0 commented Oct 16, 2026 •

Copy link
Copy Markdown
Member

Continued in #1594 on the original panic-fix39192 branch. That PR contains the same three commits and validated final tree; this duplicate PR is closed to keep review in one place.

Cross-origin Window access builds JavaScript surfaces and calls captured WeakMap intrinsics. Watchdog termination can fail those calls and panic. On personalshop.ch, Adform's ancestor search also loops because top is a caller-local projection while following parent reaches the actual top WindowProxy.

This change fixes the ancestor identity bug and dispatches cross-origin access-check handlers through generated native member tables. It replaces the earlier WeakMap termination fix by removing that cache entirely.

The three commits separate the behavior fix, reusable binding infrastructure, and Window/Location migration:

  1. Preserve the actual top WindowProxy throughout the ancestor chain. A three-origin nested-frame search that exceeded a 10-step bound before now reaches top after 2 steps, matching Chromium.
  2. Add WebApiCrossOrigin declarations. Cache stateless FunctionTemplates per isolate and let V8 provide each accessing Context's function instances. Callbacks resolve their actual receiver without capturing a target or observer.
  3. Dispatch Window and Location through native member tables, removing the WeakMap cache and per-child intermediate access surfaces. Keep per-Window Location wrapper identity and resolve indexed/named children from the current frame tree.

The migration also applies cross-origin descriptor/fallback rules: configurable, non-enumerable descriptors; undefined symbol fallbacks; SecurityError for unsupported descriptors; named child windows precede fallbacks and may shadow names such as document. Tests cover removal, navigation, borrowed receivers, function realms/identity, termination, and garbage collection.

The design follows Blink's native cross-origin member support and the HTML WindowProxy rules. The controlled Chromium comparison also checked receiver errors, mutation restrictions, Location identity, and named collisions.

Validation (24 Cargo build jobs, each commit checked separately):

  • cargo fmt --all
  • cargo clippy --workspace --all-targets --all-features -- -D warnings
  • cargo nextest run --no-fail-fast: 20,221 passed, 18 skipped at the final commit.
  • cargo build -p moli and the three-origin differential fixture.
  • Three independent 40-second personalshop.ch runs loaded trackpoint-async.js and recorded no panic or watchdog termination. The previous profile spent approximately 8 seconds in Adform's ancestor loop before termination. The page still remained interactive at the end of these observations; this does not claim complete third-party resource loading.

@github-actions

github-actions Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

Spider Bench A/B

✅ All benchmark browser service runs completed; results are informational.

Public HEAD: 184 / 240 rows; 38 / 48 sites produced rows; 10 unexpected empty sites.

✅ Deterministic fixture contract is clean.

Common ancestor 07368cea9a72 → HEAD 817e17d84a9c; benchmark order: base-first; workflow: success.

Public 48-site run · informational

Metric Base HEAD Δ
Run status success success —
Extracted rows / contract 184 / 240 184 / 240 0 (0.00%)
Contract fill 76.67% 76.67% 0.00 pp (0.00%)
Sites with rows 38 / 48 38 / 48 0 (0.00%)
Sites meeting row contract 36 / 48 36 / 48 0 (0.00%)
Unexpected empty sites 10 10 0 (0.00%)
Partial-row sites 2 2 0 (0.00%)
Site outcomes extracted: 36; HTTP error + rows: 2; empty: 7; HTTP error + empty: 1; snapshot error + empty: 2 extracted: 37; HTTP error + rows: 1; empty: 7; HTTP error + empty: 1; snapshot error + empty: 2 —
Observed duration 51.06 s 46.92 s -4.13 s (-8.10%)
Estimated CPU 47.61 s 50.75 s +3.14 s (+6.60%)
Peak PSS 247.90 MiB 277.02 MiB +29.12 MiB (+11.75%)
Peak RSS 251.59 MiB 280.56 MiB +28.97 MiB (+11.52%)
Peak threads 27 27 0 (0.00%)
Mismatched sites 0 0 0
Timeout with items 0 0 0
Category rows Base HEAD Δ
news 35 / 40 35 / 40 0
stocks 20 / 40 20 / 40 0
tech 35 / 40 35 / 40 0
sports 27 / 40 27 / 40 0
games 37 / 40 37 / 40 0
life 30 / 40 30 / 40 0

Public-site content, timing, and memory are noisy. This single A/B run reports evidence only; site outcome counts explain missing rows without treating them as a deterministic regression.

CPU and memory timelines

These are bounded 40-point views of the same complete process-tree samples used by the HTML report. CPU uses 100% per occupied logical core; memory lines are RSS first and PSS second when complete PSS samples are available.

Base

xychart-beta
    title "Base CPU"
    x-axis "Elapsed seconds" [1.536, 2.537, 3.037, 4.54, 5.542, 7.044, 8.546, 10.048, 11.551, 13.053, 14.055, 15.557, 17.059, 17.56, 18.561, 20.063, 21.565, 22.566, 24.068, 25.57, 27.073, 28.576, 29.077, 30.079, 31.08, 32.581, 34.084, 35.586, 37.088, 38.588, 39.59, 41.092, 42.592, 44.095, 45.596, 47.097, 48.097, 49.599]
    y-axis "CPU percent" 0 --> 500
    line [25.98, 131.98, 123.91, 103.92, 203.42, 157.83, 123.76, 167.66, 117.77, 51.91, 117.81, 41.95, 7.98, 0, 87.95, 125.91, 11.97, 0, 143.78, 81.91, 113.83, 99.87, 109.76, 101.83, 110.02, 121.88, 137.73, 49.98, 81.94, 109.85, 13.97, 101.95, 77.98, 3.99, 13.98, 114, 173.95, 145.85]
Loading
xychart-beta
    title "Base memory: RSS then PSS"
    x-axis "Elapsed seconds" [0.035, 1.536, 2.537, 3.037, 4.54, 5.542, 7.044, 8.546, 10.048, 11.551, 13.053, 14.055, 15.557, 17.059, 17.56, 18.561, 20.063, 21.565, 22.566, 24.068, 25.57, 27.073, 28.576, 29.077, 30.079, 31.08, 32.581, 34.084, 35.586, 37.088, 38.588, 39.59, 41.092, 42.592, 44.095, 45.596, 47.097, 48.097, 49.599, 51.056]
    y-axis "Memory MiB" 0 --> 500
    line [12.3, 82.26, 126.5, 135.68, 125.57, 150.61, 182.34, 156.58, 185.28, 166.21, 179.87, 191.36, 164.93, 150.81, 150.65, 176.66, 162.17, 147.49, 145.42, 162.23, 148.73, 164.01, 199.65, 251.59, 204.39, 188.83, 148.7, 179.75, 152.38, 154.05, 156.41, 149.76, 173.61, 163.72, 169.62, 158.03, 200.04, 170.55, 192.49, 0]
    line [9, 78.62, 122.82, 132, 122.05, 146.91, 178.64, 152.88, 181.48, 160.89, 176.2, 187.98, 161.16, 147.07, 146.91, 172.93, 158.43, 143.75, 141.68, 158.94, 145.01, 160.3, 196.17, 247.9, 200.66, 185.08, 144.85, 175.89, 148.64, 150.41, 152.82, 146.02, 168.61, 159.98, 165.88, 154.29, 198.48, 166.82, 189.05, 0]
Loading

HEAD

xychart-beta
    title "HEAD CPU"
    x-axis "Elapsed seconds" [1.035, 1.536, 2.538, 4.04, 5.04, 6.542, 8.043, 9.044, 10.546, 12.048, 13.049, 14.552, 15.553, 17.055, 18.557, 19.559, 21.061, 22.062, 23.564, 24.565, 25.065, 26.067, 27.568, 28.568, 30.07, 31.572, 32.573, 34.075, 35.577, 36.578, 38.08, 39.081, 40.583, 42.085, 43.086, 43.586, 44.588, 45.589]
    y-axis "CPU percent" 0 --> 500
    line [4, 43.88, 133.74, 144.04, 148.03, 159.82, 129.89, 139.86, 153.79, 83.95, 139.81, 87.81, 71.94, 87.89, 0, 53.95, 53.94, 139.91, 137.79, 115.94, 125.82, 151.96, 142.02, 123.86, 135.69, 161.78, 99.86, 129.9, 87.79, 123.83, 85.9, 73.89, 15.98, 109.87, 109.84, 201.69, 99.89, 135.82]
Loading
xychart-beta
    title "HEAD memory: RSS then PSS"
    x-axis "Elapsed seconds" [0.036, 1.035, 1.536, 2.538, 4.04, 5.04, 6.542, 8.043, 9.044, 10.546, 12.048, 13.049, 14.552, 15.553, 17.055, 18.557, 19.559, 21.061, 22.062, 23.564, 24.565, 25.065, 26.067, 27.568, 28.568, 30.07, 31.572, 32.573, 34.075, 35.577, 36.578, 38.08, 39.081, 40.583, 42.085, 43.086, 43.586, 44.588, 45.589, 46.921]
    y-axis "Memory MiB" 0 --> 500
    line [12.39, 62.42, 93.48, 127.42, 131.07, 165.89, 180.07, 170.34, 191.24, 182.33, 171.89, 176.63, 172.18, 163.25, 164.3, 151.16, 158.72, 147.93, 161.2, 187.22, 280.56, 197.48, 204.72, 221.39, 157.75, 196.68, 171.82, 158.68, 160.16, 156.58, 230.69, 171.66, 190.13, 164.82, 182.73, 185.97, 171.29, 156.56, 198.86, 0]
    line [9.02, 58.7, 89.8, 123.68, 127.4, 160.96, 176.38, 166.19, 187.51, 178.65, 168.14, 173.03, 168.43, 159.5, 160.88, 147.41, 154.97, 144.18, 157.56, 183.49, 277.02, 193.73, 200.97, 217.92, 154, 192.9, 168.06, 154.9, 156.46, 152.83, 227.24, 167.91, 186.38, 161.07, 178.95, 182.33, 167.97, 152.85, 195.12, 0]
Loading

Deterministic fixture · required contract

The fixture exercises 15 routes: 8 are expected to emit rows and 7 intentionally exercise empty, loading, or timeout behavior.

Metric Base HEAD Δ
Run status success success —
Extracted rows / contract 40 / 40 40 / 40 0 (0.00%)
Contract fill 100.00% 100.00% 0.00 pp (0.00%)
Sites with rows 8 / 15 8 / 15 0 (0.00%)
Sites meeting row contract 15 / 15 15 / 15 0 (0.00%)
Unexpected empty sites 0 0 0
Partial-row sites 0 0 0
Site outcomes extracted: 7; HTTP error + rows: 1; empty: 3; timeout + empty: 4 extracted: 7; HTTP error + rows: 1; empty: 3; timeout + empty: 4 —
Observed duration 19.86 s 19.87 s +0.01 s (+0.03%)
Estimated CPU 0.42 s 0.48 s +0.06 s (+13.71%)
Peak PSS 67.08 MiB 66.89 MiB -0.20 MiB (-0.29%)
Peak RSS 70.68 MiB 70.43 MiB -0.25 MiB (-0.35%)
Peak threads 18 18 0 (0.00%)
Mismatched sites 0 0 0
Timeout with items 0 0 0

Full HTML, JSON, CSV, logs, and page snapshots: workflow run and full spider-bench-results artifact.

The public-web A/B is informational. The exact HEAD fixture contract runs as a separate required CI check; timing and public-site content deltas remain non-blocking.

Cross-origin child realms used caller-local top projections while following
parent reached the actual top WindowProxy. Ancestor searches could then loop
on the real top's self-parent until the watchdog terminated execution.

Use the stable top WindowProxy throughout the ancestor chain and message
endpoint resolution. Add a bounded nested-frame regression for the Adform
ancestor search observed on personalshop.ch.
@github-actions

github-actions Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

CI Regression Report

Source CI run · source state at render: in_progress · artifacts: 6/6

Check Status Signal
Release regression ✅ HEAD/base failures 0/0; raw binary +0.004406%
Frontend differential ✅ 1,020/1,020 cases matched; 0 issues
Agent episodes ✅ 8/8 Moli episodes passed; 0 failures
Runtime/CDP contracts ✅ 26 contract cases; 0 failures
CDP smoke ✅ 52/52 groups passed; 621 scenarios
WebMainBench ✅ 545/545 completed; 0 unexpected failures
Release regression — ✅ HEAD/base failures 0/0; raw binary +0.004406%

Package and image size

Metric Base HEAD Delta Delta %
Raw binary 153.07 MiB 153.07 MiB +6.91 KiB +0.004406%
Stripped binary 106.38 MiB 106.38 MiB 0 B 0.00%
gzip binary 52.71 MiB 52.71 MiB +1.37 KiB +0.002531%
Rootfs 159.97 MiB 159.98 MiB +10.00 KiB +0.006105%
gzip rootfs 61.75 MiB 61.75 MiB +3.86 KiB +0.006099%

Startup latency and PSS

Case Base p50 HEAD p50 Delta Base PSS HEAD PSS Delta
Serve ready 27.07 ms 27.19 ms +0.13 ms 3.69 MiB 4.80 MiB +1.11 MiB
CDP first page 49.92 ms 49.86 ms −0.06 ms 4.43 MiB 4.16 MiB −277.50 KiB
CDP warm page 10.89 ms 11.06 ms +0.17 ms 50.46 MiB 50.76 MiB +313.50 KiB
CLI about:blank 14.99 ms 14.82 ms −0.18 ms 3.08 MiB 3.36 MiB +291.50 KiB
CLI local JS 18.92 ms 19.22 ms +0.30 ms 4.05 MiB 4.47 MiB +428.00 KiB

Concurrency matrix

Concurrency Base p50 HEAD p50 Delta Base PSS HEAD PSS Delta HEAD failures Unstable B/H
1 17.83 ms 18.08 ms +0.25 ms 863.00 KiB 798.00 KiB −65.00 KiB 0 0/0
5 20.08 ms 21.14 ms +1.06 ms 19.09 MiB 29.10 MiB +10.02 MiB 0 0/0
10 20.91 ms 19.39 ms −1.52 ms 23.59 MiB 28.00 MiB +4.41 MiB 0 0/0
25 21.01 ms 19.65 ms −1.35 ms 28.45 MiB 13.77 MiB −14.68 MiB 0 0/0
100 20.47 ms 20.32 ms −0.15 ms 28.38 MiB 28.47 MiB +92.50 KiB 0 0/0
Frontend differential — ✅ 1,020/1,020 cases matched; 0 issues
Match DOM mismatch Diagnostic mismatch Moli error Reference error Infrastructure error Mismatched frames Duration
1,020 0 0 0 0 0 0 6m 32.49s
Agent episodes · Moli vs Chromium — ✅ 8/8 Moli episodes passed; 0 failures
Fast contract Episodes Passed Assertions Ready p50 Episode p50
Moli 8 8 47/47 3.58 ms 26.59 ms
Chromium 8 8 47/47 247.04 ms 92.27 ms
Operation p50 Chromium Moli Delta Delta %
navigate 43.27 ms 9.03 ms −34.24 ms −79.13%
observe 1.45 ms 0.99 ms −0.46 ms −31.59%
fill 2.59 ms 3.42 ms +0.83 ms +32.20%
click 4.96 ms 4.21 ms −0.75 ms −15.11%
Idle-resource episode Peak RSS Peak PSS Average CPU Peak CPU Peak processes Sampler
Moli 66.59 MiB 63.85 MiB 0.72% 9.99% 1 ✅
Chromium 1292.38 MiB 334.90 MiB 2.35% 94.04% 13 ⚠️ PSS partial
Runtime and CDP session contracts — ✅ 26 contract cases; 0 failures
Suite Cases Failures Median case p50 Median case p95 Median peak PSS p50
Synthetic fetch 13 0 18.25 ms 18.89 ms 709.00 KiB
Long-lived CDP session 13 0 18.64 ms 19.29 ms —
CDP smoke — ✅ 52/52 groups passed; 621 scenarios

Workers: 4 · cumulative group time: 192.90 s · failed groups: 0

Slowest group Scenarios Duration Status
scrollbar-visibility 22 28.08 s ✅
target-lifecycle 24 16.55 s ✅
dom-input 27 12.74 s ✅
chromium-cdp 56 11.16 s ✅
multi-page 45 11.13 s ✅
WebMainBench · 545 pages — ✅ 545/545 completed; 0 unexpected failures
Completed Successful Expected DNS failure Unexpected failures Panics Crashes Timeouts Empty output
545/545 544 1 0 0 0 0 0

Frozen HTML · Linux · --wait done · 45 seconds per page · no retries. Content quality is evaluated separately.

Diagnostics: webmainbench-results — every page's Markdown, stderr, and exit status. Source run and artifacts

All artifact fields are parsed by the trusted default-branch renderer; missing or invalid inputs remain visible as unavailable.

ldm0 added 2 commits October 16, 2026 23:05
Generate stateless method and accessor tables with receiver checks and native
value callbacks. Cache FunctionTemplates per isolate and use V8's per-context
function instances, without retaining target Windows or observer realms.

Cover function identity, realm prototypes, descriptors, receiver validation,
exception and termination propagation, and context collection.
Replace WeakMap-backed Window surfaces with native access-check dispatch.
Keep per-Window Location identity and resolve dynamic children from the
current frame tree. Reuse the ordinary Window accessor value helpers.

Apply cross-origin descriptor and fallback rules, preserve borrowed receiver
behavior, and cover navigation, named collisions, removal, and realm teardown.
@github-actions

github-actions Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

Sequential Navigation Soak A/B

✅ HEAD completed the 200-navigation resilience and memory observation.

One browser process, one target, and one CDP session navigate CSDN → SegmentFault → Huaban → example.com repeatedly. This run issued 200 Page.navigate commands per binary.

Common ancestor 07368cea9a → HEAD 817e17d84a; benchmark order: base-first; workflow: success.

Session resilience

Metric Base HEAD
Attempted / planned 200 / 200 200 / 200
Direct observable pass 194 / 200 192 / 200
Failures / recovered 6 / 6 8 / 8
Recovery failures 0 0
Lifecycle order violations 0 0
Network order violations 0 0
Wall time 794.5 s 721.8 s

A public-page failure is reported separately from an unrecoverable session. The soak requires all navigation attempts, zero failed recovery, zero lifecycle/network ordering violations, and complete resource evidence.

Process-tree memory

Metric Base HEAD Δ
Boundary samples 200 200 0
Boundary RSS samples 200 200 0
Boundary PSS samples 200 200 0
Periodic peak RSS 231.5 MiB 251.9 MiB +20.4 MiB
Periodic peak PSS 227.5 MiB 249.8 MiB +22.3 MiB
RSS · first 10 avg 171.9 MiB 170.8 MiB -1.1 MiB
RSS · last 10 avg 181.9 MiB 181.6 MiB -0.3 MiB
RSS · last − first window +10.1 MiB +10.8 MiB +0.8 MiB
RSS · warm slope / 100 nav +3.4 MiB +4.4 MiB +1.0 MiB
PSS · first 10 avg 168.2 MiB 167.9 MiB -0.3 MiB
PSS · last 10 avg 179.0 MiB 179.9 MiB +0.9 MiB
PSS · last − first window +10.8 MiB +12.0 MiB +1.2 MiB
PSS · warm slope / 100 nav +3.9 MiB +5.1 MiB +1.2 MiB
Peak file descriptors 61 59 -2
Peak threads 31 29 -2

HEAD memory by 50-navigation quarter

HEAD range Avg RSS Final RSS Peak RSS Avg PSS Final PSS Peak FD
1–50 172.9 MiB 159.5 MiB 236.7 MiB 170.0 MiB 156.6 MiB 53
51–100 173.4 MiB 172.1 MiB 218.8 MiB 171.5 MiB 170.4 MiB 54
101–150 179.8 MiB 171.2 MiB 221.1 MiB 178.0 MiB 169.4 MiB 55
151–200 178.8 MiB 171.6 MiB 218.7 MiB 177.2 MiB 169.9 MiB 53

Raw reports and per-navigation boundary samples: workflow run and full sequential-navigation-soak-results artifact.

Public-site timing and memory are observational. Use the A/B deltas and trend shape as evidence, not as a deterministic performance threshold.

@ldm0
ldm0 force-pushed the refactor/native-cross-origin-bindings-20261016 branch from 806e853 to 817e17d Compare October 16, 2026 15:13
@ldm0 ldm0 closed this Oct 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant