Repository navigation
Fix router // paths, ApiError.fromJson, range/search/SlotArray and inViewY - #10
Merged
Merged
Conversation
The history got the uri alone, and a path like //evil.com/x is read as another host, so pushState threw a SecurityError after the click was already prevented and the request was left half open. The history now gets the full url on the current origin. Refs #6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…uble remove range computed its length as end - start / step, so range(0, 10, 2) had holes and range(-5, 5, 2) or range(5, 2) threw. It now collects the values in a plain array. searchScore measured the right distance with searchSpaceLeft, back over the match itself, so an exact match scored like a match inside a longer word. It now uses the unused searchSpaceRight from the last matched character: foo/foo is 1, foo/foobarbaz is 7. Removing a SlotArray slot twice added it to free twice, so two later pushes got the same index and the first value was overwritten. Refs #6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The XHR helpers pass null when the error response was not json, which threw "Cannot use 'in' operator" instead of returning an ApiError. Such values now become OTHER. Refs #6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An element that covers the whole viewport has its top above and its bottom below the viewport, so neither check matched. Refs #6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collecting the values with push was about 3-4x slower than the old preallocated array for 1000+ values. range now preallocates with the correct length, which is as fast as before. A step of 0 or below returns an empty array instead of looping forever. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
noah-meierlabs
force-pushed
the
review-fixes-small
branch
from
October 30, 2026 05:05
478f7df to
9821d7f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A smaller subset of #9. Fixes point 2, the
ApiError.fromJsonpart of 12, points 16–18, and theinViewYpart of 21 from #6. No API surface changes.//paths (chuchi):pushState/replaceStategetlocation.origin + uriinstead of the bare uri. A same-host link likehttps://site.ch//evil.com/xused to throw a SecurityError, because//evil.com/xis read as another host. The URL in the address bar stays the same. crelte has the same bug.ApiError.fromJson(core): returns anOTHERerror fornull, numbers or{}instead of crashing. The XHR helpers passnullwhen the error body isn't JSON.range(utils): fixes the operator-precedence bug in the length.range(0, 10, 2)→[0,2,4,6,8], andrange(-5, 5, 2)/range(5, 2)no longer throw.searchScore(utils): the right distance usessearchSpaceRight, so exact matches rank better:foo/foo= 1,foo/foobarbaz= 7 (before: both 4).SlotArray(utils): removing a slot twice no longer hands out the same index twice.inViewY(legacy): true for an element taller than the viewport that covers it.Testing
build,check-fmt,check,lintandcheck-jsrpass.//evil.example/xlink works. On main it throwsSecurityError: Failed to execute 'pushState'…. Normal links behave as before.fromJson,range,searchScoreandSlotArray.🤖 Generated with Claude Code