XBL Replacement Newsletter 5

May 2018

This is the fifth edition of the XBL Replacement Newsletter. Since the last update we've moved below 200 bindings, so we've removed just over one third of the bindings. We've also been making progress on in-content bindings and doing some cleanup that's been enabled by the work so far. The easiest way to follow along with this work is to watch the main meta bug.

In Content XBL

Stopping use of XBL in the content process will be a big milestone for the project, and it'll let us remove a lot of complexity that exists to make these elements secure. We've come up with an outline for how to replace in-content bindings that require DOM/JS in the content process: the basic idea is to use a "User Agent" Shadow DOM that's only accessible to chrome code and to run the JS in a new limited privileged scope. You can see a more detailed proposal on the bug.

In addition to this, we've been making progress on removing and simplifying the current in-content bindings:

  • We no longer use XBL for scrollbars! Tim removed the scrollbar binding, and we instead build up native anonymous content to render them. This unblocks further improvements such as using a single element instead of a full DOM tree for scrollbars.
  • The "resizer" is the little grippy icon that shows up on the corner of textareas to let you resize them. Tim removed the resizer binding and we now use native anonymous content instead.
  • touchControls and suppressChangeEvent were separate bindings for mobile that extended the videocontrols binding. Tim removed them and now we now share a single binding with different styling for mobile.
  • XML pretty printing used to require JS to expand and collapse tags. Ian Moody changed this by rendering the tree with HTML <details> and <summary> tags instead. We still use a XBL binding to mount the content into the page, but there's a bug on file to stop doing that.

Cleanup

  • There was a feature called NODE_FORCE_XBL_BINDINGS that would eagerly attach XBL to a cloned node even before it was added to the DOM. We no longer rely on that feature, so it was removed.
  • We no longer load xul.css in content documents. This used to get loaded when we rendered touchControls, among other things. We still load minimal-xul.css in all content documents, but there's a new metabug tracking removal of in-content xul to ratchet this down.
  • We've been removing nsIDOMXUL* stuff, which also aligns with :bz's work to remove nsIDOM* stuff. We removed nsIDOMXULTreeElement, nsIDOMXULTextBoxElement, and everything but one attribute from nsIDOMXULCheckboxElement.
  • Neil simplified the XBL implementation of popups by allowing nsXULElement to be subclassed and then using a subclass for menupopup, popup, panel, and tooltip elements.
  • There have been some nice cleanups to the gBrowser object since migrating away from XBL. Dão did a bunch of refactoring, which can be seen in bugs inside the ‘Blocks' field of the JS migration bug. We also saw a tabpaint perf win when deleting the tabbrowser binding.

Binding Removals

There are 196 more bindings left, compared to 215 from the last update and 300 from the start of the project. Here's a list of changes: