Merge branch 'devel' of https://github.com/AngleSharp/AngleSharp.Js into devel

Author: FlorianRappl

CHANGELOG.md

@@ -14,6 +14,7 @@ Released on Friday, July 31 2026.
 - Updated to use AngleSharp v1
 - Updated for Jint v4 (#89, #97) @tomvanenckevort @lahma
 - Updated CreatorCache to be thread-safe (#110) @badnickname
+- Updated DOM prototypes to be built from a member layout shared by the whole process, which resolves a type once instead of once per document and lets the engine cache warm member reads @lahma
 - Added report for uncaught event-loop exceptions through the browsing context
 - Added `JsScriptingOptions` to tune the engine via `WithJs` (#75) @lahma
 - Added support for Web Workers (#78)

src/AngleSharp.Js.Tests/DomTests.cs

@@ -128,5 +128,169 @@ public async Task AssignedPropertyIsReportedConsistently()
             var result = await "(function () { var d = document.createElement('div'); d.custom = 1; return d.hasOwnProperty('custom') + ',' + Object.getOwnPropertyNames(d).join(); })()".EvalScriptAsync();
             Assert.AreEqual("true,custom", result);
         }
+
+        //  Reading an index, testing it for existence and enumerating it are three different
+        //  questions the engine asks, and the node answers each of them from a different
+        //  method. They have to agree.
+        [Test]
+        public async Task IndexedEntryIsReportedAsAnOwnPropertyAndReads()
+        {
+            var result = await "(function () { var c = document.getElementsByTagName('script'); return c.hasOwnProperty(0) + ',' + (0 in c) + ',' + c[0].nodeName; })()".EvalScriptAsync();
+            Assert.AreEqual("true,true,SCRIPT", result);
+        }
+
+        [Test]
+        public async Task IndexBeyondTheEndIsNoOwnPropertyAndReadsUndefined()
+        {
+            var result = await "(function () { var c = document.getElementsByTagName('script'); return c.hasOwnProperty(5) + ',' + (5 in c) + ',' + (typeof c[5]); })()".EvalScriptAsync();
+            Assert.AreEqual("false,false,undefined", result);
+        }
+
+        //  A member of an indexed collection must not be mistaken for an index. "length" is
+        //  the collection's own property rather than an inherited one, which is what the
+        //  array-like projection reports for it - a browser has it on the prototype instead.
+        [Test]
+        public async Task MemberOfAnIndexedCollectionIsNotMistakenForAnIndex()
+        {
+            var result = await "(function () { var c = document.getElementsByTagName('script'); return ('length' in c) + ',' + c.length + ',' + c.propertyIsEnumerable('length'); })()".EvalScriptAsync();
+            Assert.AreEqual("true,1,false", result);
+        }
+
+        //  A DOM collection is array-like, not an array - which is exactly what a browser
+        //  reports for one.
+        [Test]
+        public async Task CollectionIsNotAnArray()
+        {
+            var result = await "Array.isArray(document.getElementsByTagName('script'))".EvalScriptAsync();
+            Assert.AreEqual("False", result);
+        }
+
+        [Test]
+        public async Task CollectionKeepsItsDomIdentity()
+        {
+            var result = await "(function () { var c = document.getElementsByTagName('script'); return Object.prototype.toString.call(c) + ',' + (c instanceof HTMLCollection); })()".EvalScriptAsync();
+            Assert.AreEqual("[object HTMLCollection],true", result);
+        }
+
+        [Test]
+        public async Task CollectionCanBeIterated()
+        {
+            var result = await "(function () { var n = 0; for (var s of document.getElementsByTagName('script')) { n += s.nodeName.length; } return n; })()".EvalScriptAsync();
+            Assert.AreEqual("6", result);
+        }
+
+        [Test]
+        public async Task CollectionCanBeSpread()
+        {
+            var result = await "[...document.getElementsByTagName('script')].length".EvalScriptAsync();
+            Assert.AreEqual("1", result);
+        }
+
+        [Test]
+        public async Task ArrayGenericsRunOverACollection()
+        {
+            var result = await "Array.prototype.map.call(document.getElementsByTagName('script'), function (e) { return e.nodeName; }).join()".EvalScriptAsync();
+            Assert.AreEqual("SCRIPT", result);
+        }
+
+        [Test]
+        public async Task IndicesOfACollectionAreEnumerated()
+        {
+            var result = await "JSON.stringify(Object.keys(document.getElementsByTagName('script')))".EvalScriptAsync();
+            Assert.AreEqual("[\"0\"]", result);
+        }
+
+        //  The platform-object shape: the projection owns its indices, so script cannot delete
+        //  one or define over it.
+        [Test]
+        public async Task IndexOfACollectionCannotBeDeleted()
+        {
+            var result = await "(function () { var c = document.getElementsByTagName('script'); return delete c[0]; })()".EvalScriptAsync();
+            Assert.AreEqual("False", result);
+        }
+
+        [Test]
+        public async Task ExpandoOnACollectionIsStillPossible()
+        {
+            var result = await "(function () { var c = document.getElementsByTagName('script'); c.marker = 'kept'; return c.marker + ',' + c.hasOwnProperty('marker'); })()".EvalScriptAsync();
+            Assert.AreEqual("kept,true", result);
+        }
+
+        //  Existence is answered from the collection's length alone, without producing the
+        //  element - so it has to keep agreeing with what reading it would say.
+        [Test]
+        public async Task ExistenceOfAnIndexAgreesWithReadingIt()
+        {
+            var result = await "(function () { var c = document.getElementsByTagName('script'); var r = []; for (var i = 0; i < 3; i++) { r.push((i in c) + ':' + (c[i] !== undefined)); } return r.join(); })()".EvalScriptAsync();
+            Assert.AreEqual("true:true,false:false,false:false", result);
+        }
+
+        [Test]
+        public async Task NumericIndexerOfNamedNodeMapStillReadsBothWays()
+        {
+            var result = await "(function () { var d = document.createElement('div'); d.setAttribute('title', 't'); var a = d.attributes; return a.length + ',' + a[0].name + ',' + a.title.value; })()".EvalScriptAsync();
+            Assert.AreEqual("1,title,t", result);
+        }
+
+        //  An element whose id happens to be numeric must not surface as an index of the
+        //  collection. The array-like projection owns every array-index key - an index past the
+        //  end is authoritatively absent - so the named entry answers only non-index names,
+        //  which is also how WebIDL resolves the collision. Every answer has to say the same
+        //  thing, the descriptor included.
+        [Test]
+        public async Task NamedEntryWithAnIndexShapedNameIsNotAnIndex()
+        {
+            var result = await "(function () { var f = document.createElement('form'); f.id = '5'; document.documentElement.appendChild(f); var c = document.forms; return (Object.getOwnPropertyDescriptor(c, '5') === undefined) + ',' + ('5' in c) + ',' + (c['5'] === undefined) + ',' + c.hasOwnProperty('5') + ',' + (c[0] === f); })()".EvalScriptAsync();
+            Assert.AreEqual("true,false,true,false,true", result);
+        }
+
+        //  The guard above must not overreach: a named entry whose name is not an array index
+        //  keeps resolving, descriptor and all.
+        [Test]
+        public async Task NamedEntryWithAnOrdinaryNameStillResolves()
+        {
+            var result = await "(function () { var f = document.createElement('form'); f.id = 'login'; document.documentElement.appendChild(f); var c = document.forms; return (c.login === f) + ',' + (Object.getOwnPropertyDescriptor(c, 'login') !== undefined); })()".EvalScriptAsync();
+            Assert.AreEqual("true,true", result);
+        }
+
+        //  A symbol cannot be an index, and it must not be turned into one either - the
+        //  well-known symbols are probed on every kind of object by library code.
+        [Test]
+        public async Task SymbolKeyOnAnIndexedCollectionIsNotTreatedAsAnIndex()
+        {
+            var result = await "(function () { var c = document.getElementsByTagName('script'); return c.hasOwnProperty(Symbol.toStringTag) + ',' + (typeof c[Symbol.toStringTag]); })()".EvalScriptAsync();
+            Assert.AreEqual("false,string", result);
+        }
+
+        //  The node's own property set lives in the DOM, so nothing in the engine changes
+        //  when an entry appears there. A name that was absent has to start resolving on the
+        //  node from the very next read, rather than staying on whatever the prototype said.
+        [Test]
+        public async Task NamedEntryStartsResolvingOnTheNodeAsSoonAsItExists()
+        {
+            var result = await "(function () { var d = document.createElement('div'), a = d.attributes, before = typeof a.title; d.setAttribute('title', 't'); return before + ',' + a.title.value + ',' + a.hasOwnProperty('title'); })()".EvalScriptAsync();
+            Assert.AreEqual("undefined,t,true", result);
+        }
+
+        [Test]
+        public async Task AccessorDefinedOnANodeByScriptIsInvokedOnRead()
+        {
+            var result = await "(function () { var d = document.createElement('div'); Object.defineProperty(d, 'marker', { get: function () { return 'from getter'; } }); return d.marker + ',' + d.hasOwnProperty('marker'); })()".EvalScriptAsync();
+            Assert.AreEqual("from getter,true", result);
+        }
+
+        [Test]
+        public async Task NonEnumerablePropertyOfANodeIsSeenButNotEnumerated()
+        {
+            var result = await "(function () { var d = document.createElement('div'); Object.defineProperty(d, 'hidden2', { value: 1 }); return d.hasOwnProperty('hidden2') + ',' + d.propertyIsEnumerable('hidden2') + ',' + Object.keys(d).length; })()".EvalScriptAsync();
+            Assert.AreEqual("true,false,0", result);
+        }
+
+        [Test]
+        public async Task PropertyAssignedToANodeIsCopiedAndSerialized()
+        {
+            var result = await "(function () { var d = document.createElement('div'); d.custom = 'v'; return JSON.stringify(d) + ',' + JSON.stringify(Object.assign({}, d)); })()".EvalScriptAsync();
+            Assert.AreEqual("{\"custom\":\"v\"},{\"custom\":\"v\"}", result);
+        }
     }
 }

src/AngleSharp.Js.Tests/HostContractVerificationTests.cs

@@ -0,0 +1,115 @@
+namespace AngleSharp.Js.Tests
+{
+    using Jint;
+    using Jint.Native;
+    using Jint.Native.Object;
+    using Jint.Runtime;
+    using Jint.Runtime.Descriptors;
+    using NUnit.Framework;
+    using System;
+    using System.Collections.Generic;
+    using System.Runtime.CompilerServices;
+
+    /// <summary>
+    /// Turns Jint's host-contract verifiers on for this suite, and proves they are on.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The verifiers are the checks that catch a host object answering one of the engine's
+    /// extension points in a way that contradicts another - the exact hazard this binding lives
+    /// with, because its proxies answer four of them: TryGetOwnPropertyValue, ProbeOwnProperty,
+    /// HasIndex, and the semantics derived from not overriding Get. Every one of those is trusted
+    /// by the engine and never re-checked on the hot path, so a wrong answer is silent: a member
+    /// disappears from every enumeration, or a read that should have found an attribute resolves
+    /// on the prototype instead. A verified run is the only thing that turns any of that into a
+    /// failure.
+    /// </para>
+    /// <para>
+    /// They used to be compiled out of Release, so reaching them meant building Jint from source
+    /// in Debug. Since 4.15.3 the shipped package reads an AppContext switch instead, which is
+    /// what makes this a thing every CI run can do against the very package the library ships
+    /// against.
+    /// </para>
+    /// <para>
+    /// The switch is read once, at the type initialization of the gate behind it, so it has to be
+    /// set before the first use of any Jint type - a fixture, a one-time setup or a static
+    /// constructor all run far too late. A module initializer is the only hook early enough by
+    /// construction: the runtime runs it before any code of this assembly does, and Jint is only
+    /// ever reached from this assembly's code.
+    /// </para>
+    /// </remarks>
+    [TestFixture]
+    public class HostContractVerificationTests
+    {
+        internal const String SwitchName = "Jint.EnableHostContractVerification";
+
+        [ModuleInitializer]
+        internal static void EnableBeforeAnyJintTypeIsTouched() => AppContext.SetSwitch(SwitchName, true);
+
+        /// <summary>
+        /// That the switch was set early enough, proven from behaviour rather than from the flag:
+        /// a host whose probe contradicts its own descriptors throws exactly when something is
+        /// verifying, and is quietly believed when nothing is.
+        /// </summary>
+        /// <remarks>
+        /// It is deliberately not asserted through the gate itself, which is internal to Jint. If
+        /// this fails, the whole suite has been running unverified and the proxies' hooks are
+        /// covered by nothing.
+        /// </remarks>
+        [Test]
+        public void TheVerifiersAreRunningForThisSuite()
+        {
+            var engine = new Engine();
+            engine.SetValue("host", new SelfContradictingHost(engine));
+
+            var error = Assert.Throws<InvalidOperationException>(() => engine.Evaluate("Object.keys(host).join(',')"),
+                "The host-contract verifiers must be on, or nothing checks this binding's own hooks.");
+
+            StringAssert.Contains("lied", error.Message);
+        }
+
+        /// <summary>
+        /// Denies through its probe one name its own GetOwnProperty plainly serves. The engine
+        /// trusts the probe and never re-asks, so unverified the key simply vanishes from every
+        /// enumeration with nothing to see.
+        /// </summary>
+        private sealed class SelfContradictingHost : ObjectInstance
+        {
+            public SelfContradictingHost(Engine engine)
+                : base(engine)
+            {
+            }
+
+            public override PropertyDescriptor GetOwnProperty(JsValue property)
+            {
+                var name = property.ToString();
+                return name == "honest" || name == "lied"
+                    ? new PropertyDescriptor(name, true, true, true)
+                    : PropertyDescriptor.Undefined;
+            }
+
+            //  Seen as "protected" from outside the Jint assembly, which is what a host writes.
+            protected override OwnPropertyProbe ProbeOwnProperty(JsValue property) =>
+                property.ToString() == "lied" ? OwnPropertyProbe.Missing : base.ProbeOwnProperty(property);
+
+            public override List<JsValue> GetOwnPropertyKeys(Types types = Types.String | Types.Symbol) =>
+                new List<JsValue> { new JsString("honest"), new JsString("lied") };
+        }
+    }
+}
+
+#if !NET5_0_OR_GREATER
+namespace System.Runtime.CompilerServices
+{
+    using System;
+
+    /// <summary>
+    /// The attribute the compiler recognizes by name rather than by identity, so declaring it
+    /// here is what gives the initializer above a target framework where the BCL carries none.
+    /// </summary>
+    [AttributeUsage(AttributeTargets.Method, Inherited = false)]
+    sealed class ModuleInitializerAttribute : Attribute
+    {
+    }
+}
+#endif

src/AngleSharp.Js.Tests/PropertyAccessSemanticsTests.cs

@@ -0,0 +1,86 @@
+namespace AngleSharp.Js.Tests
+{
+    using AngleSharp.Dom;
+    using AngleSharp.Js.Proxies;
+    using AngleSharp.Scripting;
+    using Jint;
+    using Jint.Native.Object;
+    using NUnit.Framework;
+    using System;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// Pins the property access semantics Jint derives for the proxy types.
+    /// </summary>
+    /// <remarks>
+    /// Every proxy here is ordinary, and the engine works that out by itself: a type gets the
+    /// short read path because it does not override Get, and loses it because it does. Nothing
+    /// declares that anywhere, so adding a Get override - the obvious way to intercept a read -
+    /// would silently move every read against that type onto the long path, with no test failing
+    /// and no behaviour changing. These assertions are the alarm for that.
+    /// </remarks>
+    [TestFixture]
+    public class PropertyAccessSemanticsTests
+    {
+        private static Task AssertOrdinaryAsync(String expression, Type expected) =>
+            AssertOrdinaryAsync(expression, (engine, instance) =>
+                //  Assert what it is as well as how it reads: if the expression stops producing
+                //  the proxy under test the semantics assertion would still pass, and pass for
+                //  the wrong object.
+                Assert.AreEqual(expected, instance.GetType(), expression + " produced an unexpected proxy type."));
+
+        private static async Task AssertOrdinaryAsync(String expression, Action<Engine, ObjectInstance> identify)
+        {
+            var context = BrowsingContext.New(Configuration.Default.WithJs());
+            var document = await context.OpenAsync(m => m.Content(
+                "<!doctype html><html><body><span id='s'>x</span></body></html>")).ConfigureAwait(false);
+            var engine = context.GetService<JsScriptingService>().GetOrCreateJint(document);
+            var value = engine.Evaluate(expression);
+
+            Assert.IsInstanceOf<ObjectInstance>(value, expression + " did not evaluate to an object.");
+
+            var instance = (ObjectInstance)value;
+
+            identify.Invoke(engine, instance);
+
+            Assert.AreEqual(PropertyAccessSemantics.Ordinary, engine.Advanced.GetPropertyAccessSemantics(instance),
+                instance.GetType().Name + " must keep ordinary read semantics; overriding Get forfeits them.");
+
+            context.Dispose();
+        }
+
+        [Test]
+        public Task NodeProxyReadsAsOrdinary() =>
+            AssertOrdinaryAsync("document.createElement('div')", typeof(DomNodeInstance));
+
+        [Test]
+        public Task CollectionProxyReadsAsOrdinary() =>
+            AssertOrdinaryAsync("document.getElementsByTagName('span')", typeof(DomCollectionInstance));
+
+        /// <summary>
+        /// The prototype is identified by its representation rather than by its type, because it
+        /// no longer has one of ours: it is an object over a shared member layout, and that is
+        /// exactly the property carrying the win - a host subclass used as a prototype is refused
+        /// as an inline-cache holder by design, an object in the shared layout is not.
+        /// </summary>
+        /// <remarks>
+        /// The member read is what settles the answer: the representation is installed on first
+        /// touch, and the diagnostic deliberately does not perturb an untouched object into it.
+        /// </remarks>
+        [Test]
+        public Task PrototypeReadsAsOrdinary() =>
+            AssertOrdinaryAsync(
+                "(function () { var d = document.createElement('div'); d.tagName; return Object.getPrototypeOf(d); })()",
+                (engine, instance) =>
+                    Assert.IsTrue(engine.Advanced.HasSharedShape(instance),
+                        "A DOM prototype must be an object over a shared member layout."));
+
+        [Test]
+        public Task ConstructorReadsAsOrdinary() =>
+            AssertOrdinaryAsync("HTMLDivElement", typeof(DomConstructorInstance));
+
+        [Test]
+        public Task ConstructorFunctionReadsAsOrdinary() =>
+            AssertOrdinaryAsync("Image", typeof(DomConstructorFunctionInstance));
+    }
+}