This is the fifth edition of the XBL Replacement Newsletter. Since the last update we’ve moved below 200 bindings, so we’ve removed just over one third of the bindings. We’ve also been making progress on in-content bindings and doing some cleanup that’s been enabled by the work so far. The easiest way to follow along with this work is to watch the main meta bug.
Stopping use of XBL in the content process will be a big milestone for the project, and it’ll let us remove a lot of complexity that exists to make these elements secure. We’ve come up with an outline for how to replace in-content bindings that require DOM/JS in the content process: the basic idea is to use a “User Agent” Shadow DOM that’s only accessible to chrome code and to run the JS in a new limited privileged scope. You can see a more detailed proposal on the bug.
In addition to this, we’ve been making progress on removing and simplifying the current in-content bindings:
scrollbar binding, and we instead build up native anonymous content to render them. This unblocks further improvements such as using a single element instead of a full DOM tree for scrollbars.resizer binding and we now use native anonymous content instead.touchControls and suppressChangeEvent were separate bindings for mobile that extended the videocontrols binding. Tim removed them and now we now share a single binding with different styling for mobile.<details> and <summary> tags instead. We still use a XBL binding to mount the content into the page, but there’s a bug on file to stop doing that.NODE_FORCE_XBL_BINDINGS
that would eagerly attach XBL to a cloned node even before it was added
to the DOM. We no longer rely on that feature, so it was removed.touchControls, among other things. We still load minimal-xul.css in all content documents, but there’s a new metabug tracking removal of in-content xul to ratchet this down.nsIDOMXULTreeElement, nsIDOMXULTextBoxElement, and everything but one attribute from nsIDOMXULCheckboxElement.nsXULElement to be subclassed and then using a subclass for menupopup, popup, panel, and tooltip elements.There are 196 more bindings left, compared to 215 from the last update and 300 from the start of the project. Here’s a list of changes:
menubar binding and cleaned up some redundant styling in the meantime.statuspanel binding, by moving the implementation into a plain JS object inside tabbrowser.js.menulist-base binding, by loading the CSS file inside of components.css instead of with XBL <resources>.sorters binding used in about:addons in order to unblock simplification of nsIDOMXULCheckboxElement.container binding from about:preferences, using a normal <richlistitem> instead.offlineapp binding, which was unused.filefield binding by using a normal <textbox> with custom styling.button-repeat binding, which was unused.toolbarbutton-menu-button binding, which was unused.splitter binding, by loading the CSS file inside of components.css instead of with XBL <resources>.scrollbar, suppressChangeEvent, touchControls, and resizer.grippy binding, which was unused.groupbox-base binding by loading the CSS inside of components.css instead of with XBL <resources>.