Merge remote-tracking branch 'origin/main' into maintainer/pr-509-fix

# Conflicts:
#	crates/obscura-js/src/runtime.rs

crates/obscura-dom/src/selector.rs

@@ -580,6 +580,10 @@ impl DomTree {
         // Fast path: a bare "#id" selector resolves through the id index in O(1)
         // instead of scanning every descendant. The index holds the first element
         // in tree order per id, which is exactly what the full scan would return.
+        // In quirks mode `#id` matches ASCII-case-insensitively, but the id
+        // index is keyed on the exact-case id, so skip the fast path and let the
+        // selector engine (below) do the case-insensitive match.
+        if !self.is_quirks() {
             if let Some(id) = simple_id_selector(selector) {
                 match self.get_element_by_id(id) {
                     // querySelector matches strict descendants of root only, so the
@@ -592,13 +596,14 @@ impl DomTree {
                     _ => {}
                 }
             }
+        }
         let selector_list = parse_selector(selector)?;
         let mut caches = selectors::context::SelectorCaches::default();
         let mut context = MatchingContext::new(
             MatchingMode::Normal,
             None,
             &mut caches,
-            QuirksMode::NoQuirks,
+            self.selector_quirks_mode(),
             NeedsSelectorFlags::No,
             MatchingForInvalidation::No,
         );
@@ -619,6 +624,16 @@ impl DomTree {
         Ok(None)
     }
 
+    // Map the document's quirks flag onto the selector crate's QuirksMode. In
+    // quirks mode the crate matches class/id selectors ASCII-case-insensitively.
+    fn selector_quirks_mode(&self) -> QuirksMode {
+        if self.is_quirks() {
+            QuirksMode::Quirks
+        } else {
+            QuirksMode::NoQuirks
+        }
+    }
+
     pub fn query_selector_all_from(&self, root: NodeId, selector: &str) -> Result<Vec<NodeId>, String> {
         let selector_list = parse_selector(selector)?;
         let mut caches = selectors::context::SelectorCaches::default();
@@ -626,7 +641,7 @@ impl DomTree {
             MatchingMode::Normal,
             None,
             &mut caches,
-            QuirksMode::NoQuirks,
+            self.selector_quirks_mode(),
             NeedsSelectorFlags::No,
             MatchingForInvalidation::No,
         );
@@ -729,6 +744,34 @@ mod tests {
         assert!(result.is_none());
     }
 
+    #[test]
+    fn quirks_mode_matches_class_and_id_case_insensitively() {
+        // No doctype => quirks mode; class/id match ASCII case-insensitively.
+        let tree = parse_html(r#"<div class="Foo" id="Bar">x</div>"#);
+        assert!(
+            tree.query_selector(".foo").unwrap().is_some(),
+            ".foo should match class=\"Foo\" in quirks mode"
+        );
+        assert!(
+            tree.query_selector("#bar").unwrap().is_some(),
+            "#bar should match id=\"Bar\" in quirks mode"
+        );
+    }
+
+    #[test]
+    fn standards_mode_matches_class_and_id_case_sensitively() {
+        // With a doctype => no-quirks; class/id remain case-sensitive.
+        let tree = parse_html(r#"<!DOCTYPE html><div class="Foo" id="Bar">x</div>"#);
+        assert!(
+            tree.query_selector(".foo").unwrap().is_none(),
+            ".foo must NOT match class=\"Foo\" in standards mode"
+        );
+        assert!(
+            tree.query_selector("#bar").unwrap().is_none(),
+            "#bar must NOT match id=\"Bar\" in standards mode"
+        );
+    }
+
     #[test]
     fn test_query_selector_complex() {
         let tree = parse_html(

crates/obscura-dom/src/tree.rs

@@ -143,6 +143,9 @@ pub(crate) struct DomTreeInner {
     pub(crate) free_list: Vec<u32>,
     pub(crate) document: NodeId,
     pub(crate) id_index: HashMap<String, NodeId>,
+    // Whether the document was parsed in (full) quirks mode. In quirks mode CSS
+    // class and id selectors match ASCII-case-insensitively.
+    pub(crate) quirks: bool,
 }
 
 impl DomTree {
@@ -162,6 +165,7 @@ impl DomTree {
                 free_list: Vec::new(),
                 document: NodeId(0),
                 id_index: HashMap::new(),
+                quirks: false,
             }),
         }
     }
@@ -170,6 +174,17 @@ impl DomTree {
         self.inner.borrow().document
     }
 
+    /// Record whether the document was parsed in (full) quirks mode.
+    pub fn set_quirks(&self, quirks: bool) {
+        self.inner.borrow_mut().quirks = quirks;
+    }
+
+    /// Whether the document is in (full) quirks mode, in which CSS class and id
+    /// selectors match ASCII-case-insensitively.
+    pub fn is_quirks(&self) -> bool {
+        self.inner.borrow().quirks
+    }
+
     pub(crate) fn borrow_inner(&self) -> std::cell::Ref<'_, DomTreeInner> {
         self.inner.borrow()
     }
@@ -469,13 +484,21 @@ impl DomTree {
             inner.id_index.remove(&id_str);
         }
 
+        // Only free slots that are currently live. Freeing an out-of-range id
+        // would panic on direct indexing, and freeing an already-freed slot
+        // would push it onto the free list a second time — later handing the
+        // same NodeId to two live nodes (aliasing).
         for desc_id in descendants {
+            if matches!(inner.nodes.get(desc_id.index()), Some(Some(_))) {
                 inner.nodes[desc_id.index()] = None;
                 inner.free_list.push(desc_id.0);
             }
+        }
+        if matches!(inner.nodes.get(node_id.index()), Some(Some(_))) {
             inner.nodes[node_id.index()] = None;
             inner.free_list.push(node_id.0);
         }
+    }
 
     pub fn children(&self, node_id: NodeId) -> Vec<NodeId> {
         let inner = self.inner.borrow();
@@ -932,6 +955,30 @@ mod tests {
         assert!(node.is_document());
     }
 
+    #[test]
+    fn remove_out_of_range_id_is_a_noop() {
+        let tree = DomTree::new();
+        // Direct indexing into `nodes` panicked out-of-bounds for an id past the
+        // end of the slot vector; it must be a no-op instead.
+        tree.remove(NodeId::new(9999));
+        assert_eq!(tree.len(), 1);
+    }
+
+    #[test]
+    fn remove_twice_does_not_alias_slots() {
+        let tree = DomTree::new();
+        let doc = tree.document();
+        let a = tree.new_node(NodeData::Text { contents: "a".into() });
+        tree.append_child(doc, a);
+        tree.remove(a);
+        // Removing the already-freed node again must not push its slot onto the
+        // free list a second time, or two later allocations alias one slot.
+        tree.remove(a);
+        let x = tree.new_node(NodeData::Text { contents: "x".into() });
+        let y = tree.new_node(NodeData::Text { contents: "y".into() });
+        assert_ne!(x, y, "double-free aliased two live nodes onto the same slot");
+    }
+
     #[test]
     fn test_append_child() {
         let tree = DomTree::new();

crates/obscura-dom/src/tree_sink.rs

@@ -218,7 +218,10 @@ impl TreeSink for DomTree {
         x == y
     }
 
-    fn set_quirks_mode(&self, _mode: QuirksMode) {
+    fn set_quirks_mode(&self, mode: QuirksMode) {
+        // Only full quirks mode makes CSS class/id selectors case-insensitive;
+        // limited-quirks behaves like no-quirks for selector matching.
+        self.set_quirks(mode == QuirksMode::Quirks);
     }
 
     fn is_mathml_annotation_xml_integration_point(&self, target: &NodeId) -> bool {

crates/obscura-js/js/bootstrap.js

@@ -4180,13 +4180,13 @@ if (typeof Response === 'undefined') {
 }
 
 if (!Element.prototype.replaceWith) {
+  // _convertNodes turns any non-node argument (numbers, booleans, null, …) into
+  // a Text node via String(n), matching the spec and append()/prepend(); the
+  // old `typeof n === 'string'` check corrupted insert_before for other types.
   Element.prototype.replaceWith = function(...nodes) {
     const parent = this.parentNode;
     if (!parent) return;
-    for (const n of nodes) {
-      if (typeof n === 'string') parent.insertBefore(document.createTextNode(n), this);
-      else parent.insertBefore(n, this);
-    }
+    for (const n of _convertNodes(nodes)) parent.insertBefore(n, this);
     parent.removeChild(this);
   };
   _markNative(Element.prototype.replaceWith);
@@ -4195,10 +4195,7 @@ if (!Element.prototype.before) {
   Element.prototype.before = function(...nodes) {
     const parent = this.parentNode;
     if (!parent) return;
-    for (const n of nodes) {
-      if (typeof n === 'string') parent.insertBefore(document.createTextNode(n), this);
-      else parent.insertBefore(n, this);
-    }
+    for (const n of _convertNodes(nodes)) parent.insertBefore(n, this);
   };
   _markNative(Element.prototype.before);
 }
@@ -4207,10 +4204,7 @@ if (!Element.prototype.after) {
     const parent = this.parentNode;
     if (!parent) return;
     const ref = this.nextSibling;
-    for (const n of nodes) {
-      if (typeof n === 'string') parent.insertBefore(document.createTextNode(n), ref);
-      else parent.insertBefore(n, ref);
-    }
+    for (const n of _convertNodes(nodes)) parent.insertBefore(n, ref);
   };
   _markNative(Element.prototype.after);
 }
@@ -5710,7 +5704,10 @@ globalThis.atob = globalThis.atob || ((s) => { const c="ABCDEFGHIJKLMNOPQRSTUVWX
   const stack = [{state: null, url: undefined}]; // initial entry; url=undefined means "use document URL"
   let idx = 0;
   const resolveOrFallback = (url) => {
-    if (url === null || url === undefined) return undefined;
+    // A missing url (pushState/replaceState called with < 3 args) keeps the
+    // current document URL per the HTML spec — capture it so the entry does not
+    // reset location back to the original document URL.
+    if (url === null || url === undefined) return __currentUrl();
     try { return new URL(String(url), __currentUrl()).href; } catch (e) { return String(url); }
   };
   const applyVirtual = () => {

crates/obscura-js/src/runtime.rs

@@ -1344,6 +1344,48 @@ mod tests {
         );
     }
 
+    #[test]
+    fn childnode_helpers_coerce_non_string_primitives_to_text() {
+        let mut rt = setup_runtime(r#"<html><body><div id="p"><span id="t">x</span></div></body></html>"#);
+        let before = rt
+            .evaluate("(function(){var t=document.getElementById('t'); t.before(5); return t.previousSibling ? t.previousSibling.textContent : 'NULL';})()")
+            .unwrap();
+        assert_eq!(before, serde_json::json!("5"));
+        let after = rt
+            .evaluate("(function(){var t=document.getElementById('t'); t.after(true); return t.nextSibling ? t.nextSibling.textContent : 'NULL';})()")
+            .unwrap();
+        assert_eq!(after, serde_json::json!("true"));
+        let replaced = rt
+            .evaluate("(function(){var t=document.getElementById('t'); t.replaceWith(42); return document.getElementById('p').textContent;})()")
+            .unwrap();
+        assert!(
+            replaced.as_str().unwrap().contains("42"),
+            "replaceWith(42) should leave text '42': {replaced}"
+        );
+    }
+
+    #[test]
+    fn replace_state_without_url_preserves_current_location() {
+        let mut rt = setup_runtime("<html><body></body></html>");
+        let path = rt
+            .evaluate(
+                "(function(){history.pushState({}, '', '/dashboard'); history.replaceState({scroll:1}); return location.pathname;})()",
+            )
+            .unwrap();
+        assert_eq!(path, serde_json::json!("/dashboard"));
+    }
+
+    #[test]
+    fn push_state_without_url_preserves_current_location() {
+        let mut rt = setup_runtime("<html><body></body></html>");
+        let path = rt
+            .evaluate(
+                "(function(){history.pushState({}, '', '/a'); history.pushState({b:1}); return location.pathname;})()",
+            )
+            .unwrap();
+        assert_eq!(path, serde_json::json!("/a"));
+    }
+
     #[test]
     fn test_document_title() {
         let mut rt = setup_runtime("<html><head><title>Test</title></head><body></body></html>");