13 files changed, 349 insertions, 155 deletions

diff --git a/components/script/animations.rs b/components/script/animations.rs
index 693c3ae978f..6119de7c1dd 100644
--- a/components/script/animations.rs
+++ b/components/script/animations.rs
@@ -76,6 +76,10 @@ impl Animations {
         self.pending_events.borrow_mut().clear();
     }
 
+    pub(crate) fn animations_present(&self) -> bool {
+        self.has_running_animations.get() || !self.pending_events.borrow().is_empty()
+    }
+
     // Mark all animations dirty, if they haven't been marked dirty since the
     // specified `current_timeline_value`. Returns true if animations were marked
     // dirty or false otherwise.
diff --git a/components/script/dom/document.rs b/components/script/dom/document.rs
index 78cb2c33075..6056f1f1e5a 100644
--- a/components/script/dom/document.rs
+++ b/components/script/dom/document.rs
@@ -5051,6 +5051,35 @@ impl Document {
         self.image_animation_manager.borrow_mut()
     }
 
+    pub(crate) fn update_animating_images(&self) {
+        let mut image_animation_manager = self.image_animation_manager.borrow_mut();
+        if !image_animation_manager.image_animations_present() {
+            return;
+        }
+        image_animation_manager
+            .update_active_frames(&self.window, self.current_animation_timeline_value());
+
+        if !self.animations().animations_present() {
+            let next_scheduled_time =
+                image_animation_manager.next_schedule_time(self.current_animation_timeline_value());
+            // TODO: Once we have refresh signal from the compositor,
+            // we should get rid of timer for animated image update.
+            if let Some(next_scheduled_time) = next_scheduled_time {
+                self.schedule_image_animation_update(next_scheduled_time);
+            }
+        }
+    }
+
+    fn schedule_image_animation_update(&self, next_scheduled_time: f64) {
+        let callback = ImageAnimationUpdateCallback {
+            document: Trusted::new(self),
+        };
+        self.global().schedule_callback(
+            OneshotTimerCallback::ImageAnimationUpdate(callback),
+            Duration::from_secs_f64(next_scheduled_time),
+        );
+    }
+
     /// <https://html.spec.whatwg.org/multipage/#shared-declarative-refresh-steps>
     pub(crate) fn shared_declarative_refresh_steps(&self, content: &[u8]) {
         // 1. If document's will declaratively refresh is true, then return.
@@ -6747,6 +6776,21 @@ impl FakeRequestAnimationFrameCallback {
     }
 }
 
+/// This is a temporary workaround to update animated images,
+/// we should get rid of this after we have refresh driver #3406
+#[derive(JSTraceable, MallocSizeOf)]
+pub(crate) struct ImageAnimationUpdateCallback {
+    /// The document.
+    #[ignore_malloc_size_of = "non-owning"]
+    document: Trusted<Document>,
+}
+
+impl ImageAnimationUpdateCallback {
+    pub(crate) fn invoke(self, can_gc: CanGc) {
+        with_script_thread(|script_thread| script_thread.update_the_rendering(true, can_gc))
+    }
+}
+
 #[derive(JSTraceable, MallocSizeOf)]
 pub(crate) enum AnimationFrameCallback {
     DevtoolsFramerateTick {
diff --git a/components/script/dom/headers.rs b/components/script/dom/headers.rs
index 0e8dcf92ccd..f195992faa5 100644
--- a/components/script/dom/headers.rs
+++ b/components/script/dom/headers.rs
@@ -13,6 +13,7 @@ use net_traits::fetch::headers::{
     is_forbidden_method,
 };
 use net_traits::request::is_cors_safelisted_request_header;
+use net_traits::trim_http_whitespace;
 
 use crate::dom::bindings::cell::DomRefCell;
 use crate::dom::bindings::codegen::Bindings::HeadersBinding::{HeadersInit, HeadersMethods};
@@ -33,7 +34,7 @@ pub(crate) struct Headers {
     header_list: DomRefCell<HyperHeaders>,
 }
 
-// https://fetch.spec.whatwg.org/#concept-headers-guard
+/// <https://fetch.spec.whatwg.org/#concept-headers-guard>
 #[derive(Clone, Copy, Debug, JSTraceable, MallocSizeOf, PartialEq)]
 pub(crate) enum Guard {
     Immutable,
@@ -66,7 +67,7 @@ impl Headers {
 }
 
 impl HeadersMethods<crate::DomTypeHolder> for Headers {
-    // https://fetch.spec.whatwg.org/#dom-headers
+    /// <https://fetch.spec.whatwg.org/#dom-headers>
     fn Constructor(
         global: &GlobalScope,
         proto: Option<HandleObject>,
@@ -78,47 +79,41 @@ impl HeadersMethods<crate::DomTypeHolder> for Headers {
         Ok(dom_headers_new)
     }
 
-    // https://fetch.spec.whatwg.org/#concept-headers-append
+    /// <https://fetch.spec.whatwg.org/#concept-headers-append>
     fn Append(&self, name: ByteString, value: ByteString) -> ErrorResult {
-        // Step 1
-        let value = normalize_value(value);
+        // 1. Normalize value.
+        let value = trim_http_whitespace(&value);
 
-        // Step 2
-        // https://fetch.spec.whatwg.org/#headers-validate
-        let (mut valid_name, valid_value) = validate_name_and_value(name, value)?;
+        // 2. If validating (name, value) for headers returns false, then return.
+        let Some((mut valid_name, valid_value)) =
+            self.validate_name_and_value(name, ByteString::new(value.into()))?
+        else {
+            return Ok(());
+        };
 
         valid_name = valid_name.to_lowercase();
 
-        if self.guard.get() == Guard::Immutable {
-            return Err(Error::Type("Guard is immutable".to_string()));
-        }
-        if self.guard.get() == Guard::Request &&
-            is_forbidden_request_header(&valid_name, &valid_value)
-        {
-            return Ok(());
-        }
-        if self.guard.get() == Guard::Response && is_forbidden_response_header(&valid_name) {
-            return Ok(());
-        }
-
-        // Step 3
+        // 3. If headers’s guard is "request-no-cors":
         if self.guard.get() == Guard::RequestNoCors {
+            // 3.1. Let temporaryValue be the result of getting name from headers’s header list.
             let tmp_value = if let Some(mut value) =
                 get_value_from_header_list(&valid_name, &self.header_list.borrow())
             {
+                // 3.3. Otherwise, set temporaryValue to temporaryValue, followed by 0x2C 0x20, followed by value.
                 value.extend(b", ");
-                value.extend(valid_value.clone());
+                value.extend(valid_value.to_vec());
                 value
             } else {
-                valid_value.clone()
+                // 3.2. If temporaryValue is null, then set temporaryValue to value.
+                valid_value.to_vec()
             };
-
+            // 3.4. If (name, temporaryValue) is not a no-CORS-safelisted request-header, then return.
             if !is_cors_safelisted_request_header(&valid_name, &tmp_value) {
                 return Ok(());
             }
         }
 
-        // Step 4
+        // 4. Append (name, value) to headers’s header list.
         match HeaderValue::from_bytes(&valid_value) {
             Ok(value) => {
                 self.header_list
@@ -134,7 +129,7 @@ impl HeadersMethods<crate::DomTypeHolder> for Headers {
             },
         };
 
-        // Step 5
+        // 5. If headers’s guard is "request-no-cors", then remove privileged no-CORS request-headers from headers.
         if self.guard.get() == Guard::RequestNoCors {
             self.remove_privileged_no_cors_request_headers();
         }
@@ -142,50 +137,53 @@ impl HeadersMethods<crate::DomTypeHolder> for Headers {
         Ok(())
     }
 
-    // https://fetch.spec.whatwg.org/#dom-headers-delete
+    /// <https://fetch.spec.whatwg.org/#dom-headers-delete>
     fn Delete(&self, name: ByteString) -> ErrorResult {
-        // Step 1
-        let (mut valid_name, valid_value) = validate_name_and_value(name, ByteString::new(vec![]))?;
+        // Step 1 If validating (name, ``) for this returns false, then return.
+        let name_and_value = self.validate_name_and_value(name, ByteString::new(vec![]))?;
+        let Some((mut valid_name, _valid_value)) = name_and_value else {
+            return Ok(());
+        };
 
         valid_name = valid_name.to_lowercase();
 
-        // Step 2
-        if self.guard.get() == Guard::Immutable {
-            return Err(Error::Type("Guard is immutable".to_string()));
-        }
-        // Step 3
-        if self.guard.get() == Guard::Request &&
-            is_forbidden_request_header(&valid_name, &valid_value)
-        {
-            return Ok(());
-        }
-        // Step 4
+        // Step 2 If this’s guard is "request-no-cors", name is not a no-CORS-safelisted request-header name,
+        // and name is not a privileged no-CORS request-header name, then return.
         if self.guard.get() == Guard::RequestNoCors &&
             !is_cors_safelisted_request_header(&valid_name, &b"invalid".to_vec())
         {
             return Ok(());
         }
-        // Step 5
-        if self.guard.get() == Guard::Response && is_forbidden_response_header(&valid_name) {
-            return Ok(());
+
+        // 3. If this’s header list does not contain name, then return.
+        // 4. Delete name from this’s header list.
+        self.header_list.borrow_mut().remove(valid_name);
+
+        // 5. If this’s guard is "request-no-cors", then remove privileged no-CORS request-headers from this.
+        if self.guard.get() == Guard::RequestNoCors {
+            self.remove_privileged_no_cors_request_headers();
         }
-        // Step 6
-        self.header_list.borrow_mut().remove(&valid_name);
+
         Ok(())
     }
 
-    // https://fetch.spec.whatwg.org/#dom-headers-get
+    /// <https://fetch.spec.whatwg.org/#dom-headers-get>
     fn Get(&self, name: ByteString) -> Fallible<Option<ByteString>> {
-        // Step 1
+        // 1. If name is not a header name, then throw a TypeError.
         let valid_name = validate_name(name)?;
+
+        // 2. Return the result of getting name from this’s header list.
         Ok(
             get_value_from_header_list(&valid_name, &self.header_list.borrow())
                 .map(ByteString::new),
         )
     }
 
-    // https://fetch.spec.whatwg.org/#dom-headers-getsetcookie
+    /// <https://fetch.spec.whatwg.org/#dom-headers-getsetcookie>
     fn GetSetCookie(&self) -> Vec<ByteString> {
+        // 1. If this’s header list does not contain `Set-Cookie`, then return « ».
+        // 2. Return the values of all headers in this’s header list whose name is a
+        // byte-case-insensitive match for `Set-Cookie`, in order.
         self.header_list
             .borrow()
             .get_all("set-cookie")
@@ -194,42 +192,36 @@ impl HeadersMethods<crate::DomTypeHolder> for Headers {
             .collect()
     }
 
-    // https://fetch.spec.whatwg.org/#dom-headers-has
+    /// <https://fetch.spec.whatwg.org/#dom-headers-has>
     fn Has(&self, name: ByteString) -> Fallible<bool> {
-        // Step 1
+        // 1. If name is not a header name, then throw a TypeError.
         let valid_name = validate_name(name)?;
-        // Step 2
+        // 2. Return true if this’s header list contains name; otherwise false.
         Ok(self.header_list.borrow_mut().get(&valid_name).is_some())
     }
 
-    // https://fetch.spec.whatwg.org/#dom-headers-set
+    /// <https://fetch.spec.whatwg.org/#dom-headers-set>
     fn Set(&self, name: ByteString, value: ByteString) -> Fallible<()> {
-        // Step 1
-        let value = normalize_value(value);
-        // Step 2
-        let (mut valid_name, valid_value) = validate_name_and_value(name, value)?;
-        valid_name = valid_name.to_lowercase();
-        // Step 3
-        if self.guard.get() == Guard::Immutable {
-            return Err(Error::Type("Guard is immutable".to_string()));
-        }
-        // Step 4
-        if self.guard.get() == Guard::Request &&
-            is_forbidden_request_header(&valid_name, &valid_value)
-        {
+        // 1. Normalize value
+        let value = trim_http_whitespace(&value);
+
+        // 2. If validating (name, value) for this returns false, then return.
+        let Some((mut valid_name, valid_value)) =
+            self.validate_name_and_value(name, ByteString::new(value.into()))?
+        else {
             return Ok(());
-        }
-        // Step 5
+        };
+        valid_name = valid_name.to_lowercase();
+
+        // 3. If this’s guard is "request-no-cors" and (name, value) is not a
+        // no-CORS-safelisted request-header, then return.
         if self.guard.get() == Guard::RequestNoCors &&
-            !is_cors_safelisted_request_header(&valid_name, &valid_value)
+            !is_cors_safelisted_request_header(&valid_name, &valid_value.to_vec())
         {
             return Ok(());
         }
-        // Step 6
-        if self.guard.get() == Guard::Response && is_forbidden_response_header(&valid_name) {
-            return Ok(());
-        }
-        // Step 7
+
+        // 4. Set (name, value) in this’s header list.
         // https://fetch.spec.whatwg.org/#concept-header-list-set
         match HeaderValue::from_bytes(&valid_value) {
             Ok(value) => {
@@ -245,6 +237,12 @@ impl HeadersMethods<crate::DomTypeHolder> for Headers {
                 );
             },
         };
+
+        // 5. If this’s guard is "request-no-cors", then remove privileged no-CORS request-headers from this.
+        if self.guard.get() == Guard::RequestNoCors {
+            self.remove_privileged_no_cors_request_headers();
+        }
+
         Ok(())
     }
 }
@@ -260,7 +258,7 @@ impl Headers {
         Ok(())
     }
 
-    // https://fetch.spec.whatwg.org/#concept-headers-fill
+    /// <https://fetch.spec.whatwg.org/#concept-headers-fill>
     pub(crate) fn fill(&self, filler: Option<HeadersInit>) -> ErrorResult {
         match filler {
             Some(HeadersInit::ByteStringSequenceSequence(v)) => {
@@ -316,12 +314,12 @@ impl Headers {
         self.header_list.borrow_mut().clone()
     }
 
-    // https://fetch.spec.whatwg.org/#concept-header-extract-mime-type
+    /// <https://fetch.spec.whatwg.org/#concept-header-extract-mime-type>
     pub(crate) fn extract_mime_type(&self) -> Vec<u8> {
         extract_mime_type(&self.header_list.borrow()).unwrap_or_default()
     }
 
-    // https://fetch.spec.whatwg.org/#concept-header-list-sort-and-combine
+    /// <https://fetch.spec.whatwg.org/#concept-header-list-sort-and-combine>
     pub(crate) fn sort_and_combine(&self) -> Vec<(String, Vec<u8>)> {
         let borrowed_header_list = self.header_list.borrow();
         let mut header_vec = vec![];
@@ -341,11 +339,38 @@ impl Headers {
         header_vec
     }
 
-    // https://fetch.spec.whatwg.org/#ref-for-privileged-no-cors-request-header-name
+    /// <https://fetch.spec.whatwg.org/#ref-for-privileged-no-cors-request-header-name>
     pub(crate) fn remove_privileged_no_cors_request_headers(&self) {
-        // https://fetch.spec.whatwg.org/#privileged-no-cors-request-header-name
+        // <https://fetch.spec.whatwg.org/#privileged-no-cors-request-header-name>
         self.header_list.borrow_mut().remove("range");
     }
+
+    /// <https://fetch.spec.whatwg.org/#headers-validate>
+    pub(crate) fn validate_name_and_value(
+        &self,
+        name: ByteString,
+        value: ByteString,
+    ) -> Fallible<Option<(String, ByteString)>> {
+        // 1. If name is not a header name or value is not a header value, then throw a TypeError.
+        let valid_name = validate_name(name)?;
+        if !is_legal_header_value(&value) {
+            return Err(Error::Type("Header value is not valid".to_string()));
+        }
+        // 2. If headers’s guard is "immutable", then throw a TypeError.
+        if self.guard.get() == Guard::Immutable {
+            return Err(Error::Type("Guard is immutable".to_string()));
+        }
+        // 3. If headers’s guard is "request" and (name, value) is a forbidden request-header, then return false.
+        if self.guard.get() == Guard::Request && is_forbidden_request_header(&valid_name, &value) {
+            return Ok(None);
+        }
+        // 4. If headers’s guard is "response" and name is a forbidden response-header name, then return false.
+        if self.guard.get() == Guard::Response && is_forbidden_response_header(&valid_name) {
+            return Ok(None);
+        }
+
+        Ok(Some((valid_name, value)))
+    }
 }
 
 impl Iterable for Headers {
@@ -391,6 +416,7 @@ pub(crate) fn is_forbidden_request_header(name: &str, value: &[u8]) -> bool {
         "keep-alive",
         "origin",
         "referer",
+        "set-cookie",
         "te",
         "trailer",
         "transfer-encoding",
@@ -448,26 +474,11 @@ pub(crate) fn is_forbidden_request_header(name: &str, value: &[u8]) -> bool {
     false
 }
 
-// https://fetch.spec.whatwg.org/#forbidden-response-header-name
+/// <https://fetch.spec.whatwg.org/#forbidden-response-header-name>
 fn is_forbidden_response_header(name: &str) -> bool {
-    matches!(name, "set-cookie" | "set-cookie2")
-}
-
-// There is some unresolved confusion over the definition of a name and a value.
-//
-// As of December 2019, WHATWG has no formal grammar production for value;
-// https://fetch.spec.whatg.org/#concept-header-value just says not to have
-// newlines, nulls, or leading/trailing whitespace. It even allows
-// octets that aren't a valid UTF-8 encoding, and WPT tests reflect this.
-// The HeaderValue class does not fully reflect this, so headers
-// containing bytes with values 1..31 or 127 can't be created, failing
-// WPT tests but probably not affecting anything important on the real Internet.
-fn validate_name_and_value(name: ByteString, value: ByteString) -> Fallible<(String, Vec<u8>)> {
-    let valid_name = validate_name(name)?;
-    if !is_legal_header_value(&value) {
-        return Err(Error::Type("Header value is not valid".to_string()));
-    }
-    Ok((valid_name, value.into()))
+    // A forbidden response-header name is a header name that is a byte-case-insensitive match for one of
+    let name = name.to_ascii_lowercase();
+    matches!(name.as_str(), "set-cookie" | "set-cookie2")
 }
 
 fn validate_name(name: ByteString) -> Fallible<String> {
@@ -480,47 +491,20 @@ fn validate_name(name: ByteString) -> Fallible<String> {
     }
 }
 
-// Removes trailing and leading HTTP whitespace bytes.
-// https://fetch.spec.whatwg.org/#concept-header-value-normalize
-pub fn normalize_value(value: ByteString) -> ByteString {
-    match (
-        index_of_first_non_whitespace(&value),
-        index_of_last_non_whitespace(&value),
-    ) {
-        (Some(begin), Some(end)) => ByteString::new(value[begin..end + 1].to_owned()),
-        _ => ByteString::new(vec![]),
-    }
-}
-
-fn is_http_whitespace(byte: u8) -> bool {
-    byte == b'\t' || byte == b'\n' || byte == b'\r' || byte == b' '
-}
-
-fn index_of_first_non_whitespace(value: &ByteString) -> Option<usize> {
-    for (index, &byte) in value.iter().enumerate() {
-        if !is_http_whitespace(byte) {
-            return Some(index);
-        }
-    }
-    None
-}
-
-fn index_of_last_non_whitespace(value: &ByteString) -> Option<usize> {
-    for (index, &byte) in value.iter().enumerate().rev() {
-        if !is_http_whitespace(byte) {
-            return Some(index);
-        }
-    }
-    None
-}
-
-// http://tools.ietf.org/html/rfc7230#section-3.2
+/// <http://tools.ietf.org/html/rfc7230#section-3.2>
 fn is_field_name(name: &ByteString) -> bool {
     is_token(name)
 }
 
-// https://fetch.spec.whatg.org/#concept-header-value
-fn is_legal_header_value(value: &ByteString) -> bool {
+// As of December 2019, WHATWG has no formal grammar production for value;
+// https://fetch.spec.whatg.org/#concept-header-value just says not to have
+// newlines, nulls, or leading/trailing whitespace. It even allows
+// octets that aren't a valid UTF-8 encoding, and WPT tests reflect this.
+// The HeaderValue class does not fully reflect this, so headers
+// containing bytes with values 1..31 or 127 can't be created, failing
+// WPT tests but probably not affecting anything important on the real Internet.
+/// <https://fetch.spec.whatg.org/#concept-header-value>
+fn is_legal_header_value(value: &[u8]) -> bool {
     let value_len = value.len();
     if value_len == 0 {
         return true;
@@ -533,7 +517,7 @@ fn is_legal_header_value(value: &ByteString) -> bool {
         b' ' | b'\t' => return false,
         _ => {},
     };
-    for &ch in &value[..] {
+    for &ch in value {
         match ch {
             b'\0' | b'\n' | b'\r' => return false,
             _ => {},
@@ -555,12 +539,12 @@ fn is_legal_header_value(value: &ByteString) -> bool {
     // }
 }
 
-// https://tools.ietf.org/html/rfc5234#appendix-B.1
+/// <https://tools.ietf.org/html/rfc5234#appendix-B.1>
 pub(crate) fn is_vchar(x: u8) -> bool {
     matches!(x, 0x21..=0x7E)
 }
 
-// http://tools.ietf.org/html/rfc7230#section-3.2.6
+/// <http://tools.ietf.org/html/rfc7230#section-3.2.6>
 pub(crate) fn is_obs_text(x: u8) -> bool {
     matches!(x, 0x80..=0xFF)
 }
diff --git a/components/script/dom/htmlcanvaselement.rs b/components/script/dom/htmlcanvaselement.rs
index 27da9f2b537..499e91c127b 100644
--- a/components/script/dom/htmlcanvaselement.rs
+++ b/components/script/dom/htmlcanvaselement.rs
@@ -27,6 +27,7 @@ use servo_media::streams::registry::MediaStreamId;
 use snapshot::Snapshot;
 use style::attr::AttrValue;
 
+use super::node::NodeDamage;
 pub(crate) use crate::canvas_context::*;
 use crate::conversions::Convert;
 use crate::dom::attr::Attr;
@@ -687,8 +688,11 @@ impl VirtualMethods for HTMLCanvasElement {
             .unwrap()
             .attribute_mutated(attr, mutation, can_gc);
         match attr.local_name() {
-            &local_name!("width") | &local_name!("height") => self.recreate_contexts_after_resize(),
-            _ => (),
+            &local_name!("width") | &local_name!("height") => {
+                self.recreate_contexts_after_resize();
+                self.upcast::<Node>().dirty(NodeDamage::OtherNodeDamage);
+            },
+            _ => {},
         };
     }
 
diff --git a/components/script/dom/htmlinputelement.rs b/components/script/dom/htmlinputelement.rs
index 3c78ba67772..c6a3e2227f5 100644
--- a/components/script/dom/htmlinputelement.rs
+++ b/components/script/dom/htmlinputelement.rs
@@ -520,6 +520,7 @@ impl HTMLInputElement {
         let mut value = textinput.single_line_content().clone();
         self.sanitize_value(&mut value);
         textinput.set_content(value);
+        self.upcast::<Node>().dirty(NodeDamage::OtherNodeDamage);
     }
 
     fn does_minmaxlength_apply(&self) -> bool {
@@ -2668,6 +2669,7 @@ impl VirtualMethods for HTMLInputElement {
                         let mut value = textinput.single_line_content().clone();
                         self.sanitize_value(&mut value);
                         textinput.set_content(value);
+                        self.upcast::<Node>().dirty(NodeDamage::OtherNodeDamage);
 
                         // Steps 7-9
                         if !previously_selectable && self.selection_api_applies() {
@@ -2695,6 +2697,8 @@ impl VirtualMethods for HTMLInputElement {
                 self.sanitize_value(&mut value);
                 self.textinput.borrow_mut().set_content(value);
                 self.update_placeholder_shown_state();
+
+                self.upcast::<Node>().dirty(NodeDamage::OtherNodeDamage);
             },
             local_name!("name") if self.input_type() == InputType::Radio => {
                 self.radio_group_updated(
diff --git a/components/script/dom/htmlmediaelement.rs b/components/script/dom/htmlmediaelement.rs
index 391da272ef3..d1791620592 100644
--- a/components/script/dom/htmlmediaelement.rs
+++ b/components/script/dom/htmlmediaelement.rs
@@ -1369,7 +1369,6 @@ impl HTMLMediaElement {
             .lock()
             .unwrap()
             .render_poster_frame(image);
-        self.upcast::<Node>().dirty(NodeDamage::OtherNodeDamage);
 
         if pref!(media_testing_enabled) {
             self.owner_global()
@@ -1618,7 +1617,6 @@ impl HTMLMediaElement {
                 // TODO: 6. Abort the overall resource selection algorithm.
             },
             PlayerEvent::VideoFrameUpdated => {
-                self.upcast::<Node>().dirty(NodeDamage::OtherNodeDamage);
                 // Check if the frame was resized
                 if let Some(frame) = self.video_renderer.lock().unwrap().current_frame {
                     self.handle_resize(Some(frame.width as u32), Some(frame.height as u32));
@@ -2017,12 +2015,12 @@ impl HTMLMediaElement {
     pub(crate) fn clear_current_frame_data(&self) {
         self.handle_resize(None, None);
         self.video_renderer.lock().unwrap().current_frame = None;
-        self.upcast::<Node>().dirty(NodeDamage::OtherNodeDamage);
     }
 
     fn handle_resize(&self, width: Option<u32>, height: Option<u32>) {
         if let Some(video_elem) = self.downcast::<HTMLVideoElement>() {
             video_elem.resize(width, height);
+            self.upcast::<Node>().dirty(NodeDamage::OtherNodeDamage);
         }
     }
 
diff --git a/components/script/dom/htmltablecellelement.rs b/components/script/dom/htmltablecellelement.rs
index 8b553923230..78f00132580 100644
--- a/components/script/dom/htmltablecellelement.rs
+++ b/components/script/dom/htmltablecellelement.rs
@@ -9,6 +9,9 @@ use style::attr::{AttrValue, LengthOrPercentageOrAuto};
 use style::color::AbsoluteColor;
 use style::context::QuirksMode;
 
+use super::attr::Attr;
+use super::element::AttributeMutation;
+use super::node::NodeDamage;
 use crate::dom::bindings::codegen::Bindings::HTMLTableCellElementBinding::HTMLTableCellElementMethods;
 use crate::dom::bindings::codegen::Bindings::NodeBinding::NodeMethods;
 use crate::dom::bindings::inheritance::Castable;
@@ -174,6 +177,19 @@ impl VirtualMethods for HTMLTableCellElement {
         Some(self.upcast::<HTMLElement>() as &dyn VirtualMethods)
     }
 
+    fn attribute_mutated(&self, attr: &Attr, mutation: AttributeMutation, can_gc: CanGc) {
+        if let Some(super_type) = self.super_type() {
+            super_type.attribute_mutated(attr, mutation, can_gc);
+        }
+
+        if matches!(*attr.local_name(), local_name!("colspan")) {
+            self.upcast::<Node>().dirty(NodeDamage::OtherNodeDamage);
+        }
+        if matches!(*attr.local_name(), local_name!("rowspan")) {
+            self.upcast::<Node>().dirty(NodeDamage::OtherNodeDamage);
+        }
+    }
+
     fn parse_plain_attribute(&self, local_name: &LocalName, value: DOMString) -> AttrValue {
         match *local_name {
             local_name!("colspan") => {
diff --git a/components/script/dom/htmltablecolelement.rs b/components/script/dom/htmltablecolelement.rs
index 9e8eecf1147..70355f274fc 100644
--- a/components/script/dom/htmltablecolelement.rs
+++ b/components/script/dom/htmltablecolelement.rs
@@ -7,8 +7,10 @@ use html5ever::{LocalName, Prefix, local_name, ns};
 use js::rust::HandleObject;
 use style::attr::{AttrValue, LengthOrPercentageOrAuto};
 
+use super::attr::Attr;
 use super::bindings::root::LayoutDom;
-use super::element::Element;
+use super::element::{AttributeMutation, Element};
+use super::node::NodeDamage;
 use crate::dom::bindings::codegen::Bindings::HTMLTableColElementBinding::HTMLTableColElementMethods;
 use crate::dom::bindings::inheritance::Castable;
 use crate::dom::bindings::root::DomRoot;
@@ -93,6 +95,16 @@ impl VirtualMethods for HTMLTableColElement {
         Some(self.upcast::<HTMLElement>() as &dyn VirtualMethods)
     }
 
+    fn attribute_mutated(&self, attr: &Attr, mutation: AttributeMutation, can_gc: CanGc) {
+        if let Some(super_type) = self.super_type() {
+            super_type.attribute_mutated(attr, mutation, can_gc);
+        }
+
+        if matches!(*attr.local_name(), local_name!("span")) {
+            self.upcast::<Node>().dirty(NodeDamage::OtherNodeDamage);
+        }
+    }
+
     fn parse_plain_attribute(&self, local_name: &LocalName, value: DOMString) -> AttrValue {
         match *local_name {
             local_name!("span") => {
diff --git a/components/script/dom/webgpu/gpu.rs b/components/script/dom/webgpu/gpu.rs
index 20380e07bfb..b2534cda9a8 100644
--- a/components/script/dom/webgpu/gpu.rs
+++ b/components/script/dom/webgpu/gpu.rs
@@ -86,8 +86,12 @@ impl GPUMethods<crate::DomTypeHolder> for GPU {
 
     /// <https://gpuweb.github.io/gpuweb/#dom-gpu-getpreferredcanvasformat>
     fn GetPreferredCanvasFormat(&self) -> GPUTextureFormat {
-        // TODO: real implementation
-        GPUTextureFormat::Rgba8unorm
+        // From https://github.com/mozilla-firefox/firefox/blob/24d49101ce17b78c3ba1217d00297fe2891be6b3/dom/webgpu/Instance.h#L68
+        if cfg!(target_os = "android") {
+            GPUTextureFormat::Rgba8unorm
+        } else {
+            GPUTextureFormat::Bgra8unorm
+        }
     }
 
     /// <https://www.w3.org/TR/webgpu/#dom-gpu-wgsllanguagefeatures>
diff --git a/components/script/image_animation.rs b/components/script/image_animation.rs
index 89e4c93b828..9592f86fedb 100644
--- a/components/script/image_animation.rs
+++ b/components/script/image_animation.rs
@@ -2,20 +2,37 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
-use fxhash::FxHashMap;
+use compositing_traits::{ImageUpdate, SerializableImageData};
+use embedder_traits::UntrustedNodeAddress;
+use fxhash::{FxHashMap, FxHashSet};
+use ipc_channel::ipc::IpcSharedMemory;
+use libc::c_void;
+use script_bindings::root::Dom;
 use script_layout_interface::ImageAnimationState;
 use style::dom::OpaqueNode;
+use webrender_api::units::DeviceIntSize;
+use webrender_api::{ImageDescriptor, ImageDescriptorFlags, ImageFormat};
+
+use crate::dom::bindings::cell::DomRefCell;
+use crate::dom::bindings::trace::NoTrace;
+use crate::dom::node::{Node, from_untrusted_node_address};
+use crate::dom::window::Window;
 
 #[derive(Clone, Debug, Default, JSTraceable, MallocSizeOf)]
+#[cfg_attr(crown, crown::unrooted_must_root_lint::must_root)]
 pub struct ImageAnimationManager {
     #[no_trace]
     pub node_to_image_map: FxHashMap<OpaqueNode, ImageAnimationState>,
+
+    /// A list of nodes with in-progress image animations.
+    rooted_nodes: DomRefCell<FxHashMap<NoTrace<OpaqueNode>, Dom<Node>>>,
 }
 
 impl ImageAnimationManager {
     pub fn new() -> Self {
         ImageAnimationManager {
             node_to_image_map: Default::default(),
+            rooted_nodes: DomRefCell::new(FxHashMap::default()),
         }
     }
 
@@ -25,5 +42,81 @@ impl ImageAnimationManager {
 
     pub fn restore_image_animate_set(&mut self, map: FxHashMap<OpaqueNode, ImageAnimationState>) {
         let _ = std::mem::replace(&mut self.node_to_image_map, map);
+        self.root_newly_animating_dom_nodes();
+        self.unroot_unused_nodes();
+    }
+
+    pub fn next_schedule_time(&self, now: f64) -> Option<f64> {
+        self.node_to_image_map
+            .values()
+            .map(|state| state.time_to_next_frame(now))
+            .min_by(|a, b| a.partial_cmp(b).unwrap_or(std::cmp::Ordering::Equal))
+    }
+
+    pub fn image_animations_present(&self) -> bool {
+        !self.node_to_image_map.is_empty()
+    }
+
+    pub fn update_active_frames(&mut self, window: &Window, now: f64) {
+        let rooted_nodes = self.rooted_nodes.borrow();
+        let updates: Vec<ImageUpdate> = self
+            .node_to_image_map
+            .iter_mut()
+            .filter_map(|(node, state)| {
+                if state.update_frame_for_animation_timeline_value(now) {
+                    let image = &state.image;
+                    let frame = image
+                        .frames()
+                        .nth(state.active_frame)
+                        .expect("active_frame should within range of frames");
+
+                    if let Some(node) = rooted_nodes.get(&NoTrace(*node)) {
+                        node.dirty(crate::dom::node::NodeDamage::OtherNodeDamage);
+                    }
+                    Some(ImageUpdate::UpdateImage(
+                        image.id.unwrap(),
+                        ImageDescriptor {
+                            format: ImageFormat::BGRA8,
+                            size: DeviceIntSize::new(image.width as i32, image.height as i32),
+                            stride: None,
+                            offset: 0,
+                            flags: ImageDescriptorFlags::ALLOW_MIPMAPS,
+                        },
+                        SerializableImageData::Raw(IpcSharedMemory::from_bytes(frame.bytes)),
+                    ))
+                } else {
+                    None
+                }
+            })
+            .collect();
+        window.compositor_api().update_images(updates);
+    }
+
+    // Unroot any nodes that we have rooted but no longer have animating images.
+    fn unroot_unused_nodes(&self) {
+        let nodes: FxHashSet<&OpaqueNode> = self.node_to_image_map.keys().collect();
+        self.rooted_nodes
+            .borrow_mut()
+            .retain(|node, _| nodes.contains(&node.0));
+    }
+
+    /// Ensure that all nodes with Image animations are rooted. This should be called
+    /// immediately after a restyle, to ensure that these addresses are still valid.
+    #[allow(unsafe_code)]
+    fn root_newly_animating_dom_nodes(&self) {
+        let mut rooted_nodes = self.rooted_nodes.borrow_mut();
+        for opaque_node in self.node_to_image_map.keys() {
+            let opaque_node = *opaque_node;
+            if rooted_nodes.contains_key(&NoTrace(opaque_node)) {
+                continue;
+            }
+            let address = UntrustedNodeAddress(opaque_node.0 as *const c_void);
+            unsafe {
+                rooted_nodes.insert(
+                    NoTrace(opaque_node),
+                    Dom::from_ref(&*from_untrusted_node_address(address)),
+                )
+            };
+        }
     }
 }
diff --git a/components/script/script_thread.rs b/components/script/script_thread.rs
index 4815e6feae1..e0309298f3d 100644
--- a/components/script/script_thread.rs
+++ b/components/script/script_thread.rs
@@ -1081,6 +1081,10 @@ impl ScriptThread {
         for event in document.take_pending_input_events().into_iter() {
             document.update_active_keyboard_modifiers(event.active_keyboard_modifiers);
 
+            // We do this now, because the event is consumed below, but the order doesn't really
+            // matter as the event will be handled before any new ScriptThread messages are processed.
+            self.notify_webdriver_input_event_completed(pipeline_id, &event.event);
+
             match event.event {
                 InputEvent::MouseButton(mouse_button_event) => {
                     document.handle_mouse_button_event(
@@ -1144,6 +1148,19 @@ impl ScriptThread {
         ScriptThread::set_user_interacting(false);
     }
 
+    fn notify_webdriver_input_event_completed(&self, pipeline_id: PipelineId, event: &InputEvent) {
+        let Some(id) = event.webdriver_message_id() else {
+            return;
+        };
+
+        if let Err(error) = self.senders.pipeline_to_constellation_sender.send((
+            pipeline_id,
+            ScriptToConstellationMessage::WebDriverInputComplete(id),
+        )) {
+            warn!("ScriptThread failed to send WebDriverInputComplete {id:?}: {error:?}",);
+        }
+    }
+
     /// <https://html.spec.whatwg.org/multipage/#update-the-rendering>
     ///
     /// Attempt to update the rendering and then do a microtask checkpoint if rendering was actually
@@ -1272,6 +1289,10 @@ impl ScriptThread {
 
             // TODO: Mark paint timing from https://w3c.github.io/paint-timing.
 
+            // Update the rendering of those does not require a reflow.
+            // e.g. animated images.
+            document.update_animating_images();
+
             #[cfg(feature = "webgpu")]
             document.update_rendering_of_webgpu_canvases();
 
@@ -3420,7 +3441,7 @@ impl ScriptThread {
         // the pointer, when the user presses down and releases the primary pointer button"
 
         // Servo-specific: Trigger if within 10px of the down point
-        if let InputEvent::MouseButton(mouse_button_event) = event.event {
+        if let InputEvent::MouseButton(mouse_button_event) = &event.event {
             if let MouseButton::Left = mouse_button_event.button {
                 match mouse_button_event.action {
                     MouseButtonAction::Up => {
@@ -3429,16 +3450,23 @@ impl ScriptThread {
                         let pixel_dist =
                             (pixel_dist.x * pixel_dist.x + pixel_dist.y * pixel_dist.y).sqrt();
                         if pixel_dist < 10.0 * document.window().device_pixel_ratio().get() {
-                            document.note_pending_input_event(event.clone());
+                            // Pass webdriver_id to the newly generated click event
+                            document.note_pending_input_event(ConstellationInputEvent {
+                                hit_test_result: event.hit_test_result.clone(),
+                                pressed_mouse_buttons: event.pressed_mouse_buttons,
+                                active_keyboard_modifiers: event.active_keyboard_modifiers,
+                                event: event.event.clone().with_webdriver_message_id(None),
+                            });
                             document.note_pending_input_event(ConstellationInputEvent {
                                 hit_test_result: event.hit_test_result,
                                 pressed_mouse_buttons: event.pressed_mouse_buttons,
                                 active_keyboard_modifiers: event.active_keyboard_modifiers,
-                                event: InputEvent::MouseButton(MouseButtonEvent {
-                                    action: MouseButtonAction::Click,
-                                    button: mouse_button_event.button,
-                                    point: mouse_button_event.point,
-                                }),
+                                event: InputEvent::MouseButton(MouseButtonEvent::new(
+                                    MouseButtonAction::Click,
+                                    mouse_button_event.button,
+                                    mouse_button_event.point,
+                                ))
+                                .with_webdriver_message_id(event.event.webdriver_message_id()),
                             });
                             return;
                         }
diff --git a/components/script/test.rs b/components/script/test.rs
index c5933696efc..35e05621125 100644
--- a/components/script/test.rs
+++ b/components/script/test.rs
@@ -7,7 +7,6 @@
 pub use crate::dom::bindings::refcounted::TrustedPromise;
 //pub use crate::dom::bindings::root::Dom;
 pub use crate::dom::bindings::str::{ByteString, DOMString};
-pub use crate::dom::headers::normalize_value;
 //pub use crate::dom::node::Node;
 
 pub mod area {
diff --git a/components/script/timers.rs b/components/script/timers.rs
index 45574c5d717..0dc1397fbdd 100644
--- a/components/script/timers.rs
+++ b/components/script/timers.rs
@@ -24,7 +24,9 @@ use crate::dom::bindings::refcounted::Trusted;
 use crate::dom::bindings::reflector::{DomGlobal, DomObject};
 use crate::dom::bindings::root::Dom;
 use crate::dom::bindings::str::DOMString;
-use crate::dom::document::{FakeRequestAnimationFrameCallback, RefreshRedirectDue};
+use crate::dom::document::{
+    FakeRequestAnimationFrameCallback, ImageAnimationUpdateCallback, RefreshRedirectDue,
+};
 use crate::dom::eventsource::EventSourceTimeoutCallback;
 use crate::dom::globalscope::GlobalScope;
 #[cfg(feature = "testbinding")]
@@ -83,6 +85,7 @@ pub(crate) enum OneshotTimerCallback {
     TestBindingCallback(TestBindingCallback),
     FakeRequestAnimationFrame(FakeRequestAnimationFrameCallback),
     RefreshRedirectDue(RefreshRedirectDue),
+    ImageAnimationUpdate(ImageAnimationUpdateCallback),
 }
 
 impl OneshotTimerCallback {
@@ -95,6 +98,7 @@ impl OneshotTimerCallback {
             OneshotTimerCallback::TestBindingCallback(callback) => callback.invoke(),
             OneshotTimerCallback::FakeRequestAnimationFrame(callback) => callback.invoke(can_gc),
             OneshotTimerCallback::RefreshRedirectDue(callback) => callback.invoke(can_gc),
+            OneshotTimerCallback::ImageAnimationUpdate(callback) => callback.invoke(can_gc),
         }
     }
 }