Servo 0.4.0 Release Notes

Servo 0.4.0 is a major update featuring 558 commits, focusing on expanding web platform compatibility, enhancing security, and optimizing the engine's performance and memory footprint.

Web Platform and DOM API Enhancements

Servo 0.4.0 significantly expands its support for CSS and DOM APIs to improve rendering and interactivity across the web.

CSS and Media Query Support

New features include the implementation of the attr() function (in experimental mode), image(<color>), and updated mathematical expressions in calc() that can be resolved after parse time. The release adds comprehensive media query support for:

  • device-width and device-height (including min- and max- variants)
  • height and aspect-ratio (including min- and max- variants)
  • orientation
  • pointer and any-pointer
  • hover and any-hover

Additionally, font-feature-settings is now supported within @font-face.

New DOM APIs

Several critical DOM APIs have been landed to improve application functionality:

  • Concurrency: Implementation of SharedWorker.
  • Developer Tools: Addition of console.dir().
  • Custom Elements: customElementRegistry on Document and ShadowRoot, including initialize() and the ability to instantiate new CustomElementRegistry().
  • Streaming: textStream() on Request, Response, and Blob.
  • Pointer Events: setPointerCapture(), releasePointerCapture(), and hasPointerCapture() on Element.
  • Touch Events: ontouchstart, ontouchend, ontouchmove, and ontouchcancel on Element.
  • Cryptography: crypto.subtle.digest() for KT128/KT256 and crypto.subtle.getPublicKey() for ML-KEM/ML-DSA.

Real-World Compatibility and Rendering

Layout correctness has improved for several high-traffic sites, specifically through better handling of variable fonts.

  • Lichess.org: Significant improvements in layout correctness.
  • Zulip and Speedtest.net: Enhanced readability due to variable font improvements.
  • Google Photos and Cash Converters: Confirmed as working in version 0.4.0.
  • Google Maps and OpenStreetMap: Render well, though some interactivity issues remain.

Security Updates

Servo 0.4.0 addresses multiple security vulnerabilities through runtime updates and implementation changes.

  • SpiderMonkey Updates: The JS runtime was updated to SpiderMonkey 140.11.0 and 140.12.0, fixing several security bugs including CVE-2026-8388, CVE-2026-8391, CVE-2026-8974, and CVE-2026-8975 (MFSA 2026-48 and MFSA 2026-58).
  • Cryptographic Hardening: RSA operations in SubtleCrypto now use constant-time modular exponentiation. ML-DSA operations now perform the Decompose step in constant time, fixing RUSTSEC-2025-0144.
  • XSS Fix: An HTML injection bug in file:/// directory listings involving file names containing </script> has been resolved.

Performance and Stability Optimizations

Memory and Power Efficiency

  • Memory Footprint: BoxFragment is now 17% smaller (reduced from 288 to 240 bytes on amd64), and ShapeCacheEntry has also been reduced in size.
  • Power Consumption: 2D canvases now use up to 23% less power.
  • Resource Management: Image decoding and image cache filling are now performed asynchronously, reducing the load on script threads.

Engine Stability

  • Fuzzing: Sixteen crash bugs were fixed in June through fuzzing efforts, covering areas such as <iframe>, <slot>, clip-path, and the DOM tree.
  • Memory Leaks: Leaks associated with page reloading and 2D canvases have been resolved.

Technical Architecture and Future Work

Garbage Collection (GC) Safety

Servo is migrating toward a safer integration with SpiderMonkey by utilizing the Rust type system to prevent dynamic borrow failures during GC. The introduction of a NoGC marker value and the safe_borrow_mut() method allows the engine to prove that GC cannot occur during specific operations, which also enables performance optimizations by avoiding unnecessary rooting of JavaScript objects. This has resulted in a >1% overhead reduction in the layout process and HTMLCollection.

Embedding and API Progress

  • C API Wrapper: To solve the lack of a stable Rust ABI, Servo has begun designing a wrapper C API. This will allow Servo to be consumed as a prebuilt shared library via the stable C ABI, with a potential Rust wrapper to be built on top of it for ergonomics.
  • WebGPU: Improvements include the implementation of copyExternalImageToTexture(), createQuerySet(), and resolveQuerySet(), as well as better secure context enforcement.
  • Text Selection: Work has begun on implementing visible and interactive text selection.

User and Developer Experience

Servoshell Updates

  • Android: Now requires Android 13+ and has been modernized to use Compose UI and Kotlin.
  • Desktop: Added drag-and-drop file opening, horizontal tab bar scrolling, and improved fullscreen behavior across multiple monitors.
  • General: localhost:<port> is now automatically treated as http:// in the location bar and command line.

DevTools Improvements

When using Firefox DevTools, Servo now correctly reports uncaught exceptions in the Console tab and allows the inspection of nested arrays and Map objects in the Console and Debugger tabs. The Scopes panel now displays the global scope, the value of this, and (uninitialized) variables.

Sources