fix double free

This commit involves a number of changes to finalizers, all aimed towards
better consistency and reliability.

A big part of this has to do with v8::Inspector's ability to move objects
across IsolatedWorlds. There has been a few previous efforts on this, the most
significant being https://github.com/lightpanda-io/browser/pull/1901. To recap,
a Zig instance can map to 0-N v8::Objects. Where N is the total number of
IsolatedWorlds. Generally, IsolatedWorlds between origins are...isolated...but
the v8::Inspector isn't bound by this. So a Zig instance cannot be tied to a
Context/Identity/IsolatedWorld...it has to live until all references, possibly
from different IsolatedWorlds, are released (or the page is reset).

Finalizers could previously be managed via reference counting or explicitly
toggling the instance as weak/strong. Now, only reference counting is supported.
weak/strong can essentially be seen as an acquireRef (rc += 1) and
releaseRef (rc -= 1). Explicit setting did make some things easier, like not
having to worry so much about double-releasing (e.g. XHR abort being called
multiple times), but it was only used in a few places AND it simply doesn't work
with objects shared between IsolatedWorlds. It is never a boolean now, as 3
different IsolatedWorlds can each hold a reference.

Temps and Globals are tracked on the Session. Previously, they were tracked on
the Identity, but that makes no sense. If a Zig instance can outlive an Identity,
then any of its Temp references can too. This hasn't been a problem because we've
only seen MutationObserver and IntersectionObserver be used cross-origin,
but the right CDP script can make this crash with a use-after-free (e.g.
`MessageEvent.data` is released when the Identity is done, but `MessageEvent` is
still referenced by a different IsolateWorld).

Rather than deinit with a `comptime shutdown: bool`, there is now an explicit
`releaseRef` and `deinit`.

Bridge registration has been streamlined. Previously, types had to register
their finalizer AND acquireRef/releaseRef/deinit had to be declared on the entire
prototype chain, even if these methods just delegated to their proto. Finalizers
are now automatically enabled if a type has a `acquireRef` function. If a type
has an `acquireRef`, then it must have a `releaseRef` and a `deinit`. So if
there's custom cleanup to do in `deinit`, then you also have to define
`acquireRef` and `releaseRef` which will just delegate to the _proto.

Furthermore these finalizer methods can be defined anywhere on the chain.

Previously:

```zig
const KeywboardEvent = struct {
  _proto: *Event,
  ...

  pub fn deinit(self: *KeyboardEvent, session: *Session) void {
    self._proto.deinit(session);
  }

  pub fn releaseRef(self: *KeyboardEvent, session: *Session) void {
    self._proto.releaseRef(session);
  }
}
```

```zig
const KeyboardEvent = struct {
  _proto: *Event,
  ...
  // no deinit, releaseRef, acquireref
}
```

Since the `KeyboardEvent` doesn't participate in finalization directly, it
doesn't have to define anything. The bridge will detect the most specific place
they are defined and call them there.

.github/workflows/nightly.yml

@@ -7,7 +7,7 @@ env:
   AWS_REGION: ${{ vars.NIGHTLY_BUILD_AWS_REGION }}
 
   RELEASE: ${{ github.ref_type == 'tag' && github.ref_name || 'nightly' }}
-  VERSION_FLAG: ${{ github.ref_type == 'tag' && format('-Dversion={0}', github.ref_name) || '-Dversion=nightly' }}
+  VERSION_FLAG: ${{ github.ref_type == 'tag' && format('-Dversion_string={0}', github.ref_name) || format('-Dpre_version={0}', 'nightly') }}
 
 on:
   push:

README.md

@@ -170,7 +170,6 @@ You may still encounter errors or crashes. Please open an issue with specifics i
 
 Here are the key features we have implemented:
 
-- [ ] CORS [#2015](https://github.com/lightpanda-io/browser/issues/2015)
 - [x] HTTP loader ([Libcurl](https://curl.se/libcurl/))
 - [x] HTML parser ([html5ever](https://github.com/servo/html5ever))
 - [x] DOM tree

build.zig

@@ -719,45 +719,39 @@ fn buildCurl(
     return lib;
 }
 
-/// Resolves the semantic version of the build.
-///
-/// The base version is read from `build.zig.zon`. This can be overridden
-/// using the `-Dversion` command-line flag:
-/// - If the flag contains a full semantic version (e.g., `1.2.3`), it replaces
-///   the base version entirely.
-/// - If the flag contains a simple string (e.g., `nightly`), it replaces only
-///   the pre-release tag of the base version (e.g., `1.0.0-dev` -> `1.0.0-nightly`).
-///
-/// For versions that have a pre-release tag and no explicit build metadata,
-/// this function automatically enriches the version with the git commit count
-/// and short hash (e.g., `1.0.0-dev.5243+dbe45229`).
+/// Returns `MAJOR.MINOR.PATCH-dev` when `git describe` fails.
 fn resolveVersion(b: *std.Build) std.SemanticVersion {
-    const opt_version = b.option([]const u8, "version", "Override the version of this build");
+    const version_string = b.option([]const u8, "version_string", "Override the version of this build");
+    if (version_string) |semver_string| {
+        return std.SemanticVersion.parse(semver_string) catch |err| {
+            std.debug.panic("Expected -Dversion-string={s} to be a semantic version: {}", .{ semver_string, err });
+        };
+    }
 
-    const version = if (opt_version) |v|
-        std.SemanticVersion.parse(v) catch blk: {
-            var fallback = lightpanda_version;
-            fallback.pre = v;
-            break :blk fallback;
+    const pre_version = b.option([]const u8, "pre_version", "Override the pre version of this build");
+    const pre = blk: {
+        if (pre_version) |pre| {
+            break :blk pre;
         }
-    else
-        lightpanda_version;
 
-    // Only enrich versions that have a pre-release field and no explicit build metadata.
-    if (version.pre == null or version.build != null) return version;
+        break :blk lightpanda_version.pre;
+    };
+
+    // If it's a stable release (no pre or build metadata in build.zig.zon), use it as is
+    if (pre == null and lightpanda_version.build == null) return lightpanda_version;
 
     // For dev/nightly versions, calculate the commit count and hash
-    const git_hash_raw = runGit(b, &.{ "rev-parse", "--short", "HEAD" }) catch return version;
+    const git_hash_raw = runGit(b, &.{ "rev-parse", "--short", "HEAD" }) catch return lightpanda_version;
     const commit_hash = std.mem.trim(u8, git_hash_raw, " \n\r");
 
-    const git_count_raw = runGit(b, &.{ "rev-list", "--count", "HEAD" }) catch return version;
+    const git_count_raw = runGit(b, &.{ "rev-list", "--count", "HEAD" }) catch return lightpanda_version;
     const commit_count = std.mem.trim(u8, git_count_raw, " \n\r");
 
     return .{
-        .major = version.major,
-        .minor = version.minor,
-        .patch = version.patch,
-        .pre = b.fmt("{s}.{s}", .{ version.pre.?, commit_count }),
+        .major = lightpanda_version.major,
+        .minor = lightpanda_version.minor,
+        .patch = lightpanda_version.patch,
+        .pre = b.fmt("{s}.{s}", .{ pre.?, commit_count }),
         .build = commit_hash,
     };
 }

src/Config.zig

@@ -24,7 +24,6 @@ const log = @import("log.zig");
 const dump = @import("browser/dump.zig");
 
 const WebBotAuthConfig = @import("network/WebBotAuth.zig").Config;
-const mcp = @import("mcp.zig");
 
 pub const RunMode = enum {
     help,
@@ -189,13 +188,6 @@ pub fn webBotAuth(self: *const Config) ?WebBotAuthConfig {
     };
 }
 
-pub fn mcpVersion(self: *const Config) []const u8 {
-    return switch (self.mode) {
-        .mcp => |opts| @tagName(opts.version),
-        else => @tagName(mcp.Version.default),
-    };
-}
-
 pub fn maxConnections(self: *const Config) u16 {
     return switch (self.mode) {
         .serve => |opts| opts.cdp_max_connections,
@@ -230,7 +222,6 @@ pub const Serve = struct {
 
 pub const Mcp = struct {
     common: Common = .{},
-    version: mcp.Version = .default,
 };
 
 pub const DumpFormat = enum {
@@ -462,13 +453,6 @@ pub fn printUsageAndExit(self: *const Config, success: bool) void {
         \\Starts an MCP (Model Context Protocol) server over stdio
         \\Example: {s} mcp
         \\
-        \\Options:
-        \\--version
-        \\                Override the reported MCP version.
-        \\                Valid: 2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25.
-        \\                Can also be set via LIGHTPANDA_MCP_VERSION env var.
-        \\                Defaults to "2024-11-05".
-        \\
     ++ common_options ++
         \\
         \\version command
@@ -656,25 +640,10 @@ fn parseMcpArgs(
     allocator: Allocator,
     args: *std.process.ArgIterator,
 ) !Mcp {
-    var result: Mcp = .{};
-    var env_ver: ?[]const u8 = null;
-    var arg_ver: ?[]const u8 = null;
-
-    if (std.posix.getenv("LIGHTPANDA_MCP_VERSION")) |ver| {
-        env_ver = ver;
-    }
+    var mcp: Mcp = .{};
 
     while (args.next()) |opt| {
-        if (std.mem.eql(u8, "--version", opt)) {
-            const str = args.next() orelse {
-                log.fatal(.mcp, "missing argument value", .{ .arg = opt });
-                return error.InvalidArgument;
-            };
-            arg_ver = str;
-            continue;
-        }
-
-        if (try parseCommonArg(allocator, opt, args, &result.common)) {
+        if (try parseCommonArg(allocator, opt, args, &mcp.common)) {
             continue;
         }
 
@@ -682,15 +651,7 @@ fn parseMcpArgs(
         return error.UnkownOption;
     }
 
-    const final_ver = arg_ver orelse env_ver;
-    if (final_ver) |ver| {
-        result.version = std.meta.stringToEnum(mcp.Version, ver) orelse {
-            log.fatal(.mcp, "invalid protocol version", .{ .value = ver });
-            return error.InvalidArgument;
-        };
-    }
-
-    return result;
+    return mcp;
 }
 
 fn parseFetchArgs(

src/browser/EventManager.zig

@@ -205,7 +205,7 @@ pub fn dispatch(self: *EventManager, target: *EventTarget, event: *Event) Dispat
 
 pub fn dispatchOpts(self: *EventManager, target: *EventTarget, event: *Event, comptime opts: DispatchOpts) DispatchError!void {
     event.acquireRef();
-    defer event.deinit(false, self.page._session);
+    defer _ = event.releaseRef(self.page._session);
 
     if (comptime IS_DEBUG) {
         log.debug(.event, "eventManager.dispatch", .{ .type = event._type_string.str(), .bubbles = event._bubbles });
@@ -240,7 +240,7 @@ pub fn dispatchDirect(self: *EventManager, target: *EventTarget, event: *Event,
     defer window._current_event = prev_event;
 
     event.acquireRef();
-    defer event.deinit(false, page._session);
+    defer _ = event.releaseRef(page._session);
 
     if (comptime IS_DEBUG) {
         log.debug(.event, "dispatchDirect", .{ .type = event._type_string, .context = opts.context });

src/browser/Factory.zig

@@ -239,7 +239,7 @@ fn eventInit(arena: Allocator, typ: String, value: anytype) !Event {
     const time_stamp = (raw_timestamp / 2) * 2;
 
     return .{
-        ._rc = 0,
+        ._rc = .{},
         ._arena = arena,
         ._type = unionInit(Event.Type, value),
         ._type_string = typ,
@@ -255,6 +255,7 @@ pub fn blob(_: *const Factory, arena: Allocator, child: anytype) !*@TypeOf(child
 
     const blob_ptr = chain.get(0);
     blob_ptr.* = .{
+        ._rc = .{},
         ._arena = arena,
         ._type = unionInit(Blob.Type, chain.get(1)),
         ._slice = "",
@@ -271,7 +272,7 @@ pub fn abstractRange(_: *const Factory, arena: Allocator, child: anytype, page:
     const doc = page.document.asNode();
     const abstract_range = chain.get(0);
     abstract_range.* = AbstractRange{
-        ._rc = 0,
+        ._rc = .{},
         ._arena = arena,
         ._page_id = page.id,
         ._type = unionInit(AbstractRange.Type, chain.get(1)),

src/browser/Page.zig

@@ -381,9 +381,12 @@ pub fn getTitle(self: *Page) !?[]const u8 {
     return null;
 }
 
-// Add common headers for a request:
+// Add comon headers for a request:
+// * cookies
 // * referer
-pub fn headersForRequest(self: *Page, headers: *HttpClient.Headers) !void {
+pub fn headersForRequest(self: *Page, temp: Allocator, url: [:0]const u8, headers: *HttpClient.Headers) !void {
+    try self.requestCookie(.{}).headersForRequest(temp, url, headers);
+
     // Build the referer
     const referer = blk: {
         if (self.referer_header == null) {
@@ -538,6 +541,8 @@ pub fn navigate(self: *Page, request_url: [:0]const u8, opts: NavigateOpts) !voi
     if (opts.header) |hdr| {
         try headers.add(hdr);
     }
+    try self.requestCookie(.{ .is_navigation = true }).headersForRequest(self.arena, self.url, &headers);
+
     // We dispatch page_navigate event before sending the request.
     // It ensures the event page_navigated is not dispatched before this one.
     session.notification.dispatch(.page_navigate, &.{
@@ -564,7 +569,6 @@ pub fn navigate(self: *Page, request_url: [:0]const u8, opts: NavigateOpts) !voi
         .headers = headers,
         .body = opts.body,
         .cookie_jar = &session.cookie_jar,
-        .cookie_origin = self.url,
         .resource_type = .document,
         .notification = self._session.notification,
         .header_callback = pageHeaderDoneCallback,
@@ -1028,7 +1032,6 @@ fn pageDoneCallback(ctx: *anyopaque) !void {
             });
 
             parser.parse(html);
-            self._parse_state = .complete;
             self.documentIsComplete();
         },
         else => unreachable,
@@ -3392,7 +3395,7 @@ pub fn handleClick(self: *Page, target: *Node) !void {
 pub fn triggerKeyboard(self: *Page, keyboard_event: *KeyboardEvent) !void {
     const event = keyboard_event.asEvent();
     const element = self.window._document._active_element orelse {
-        keyboard_event.deinit(false, self._session);
+        _ = event.releaseRef(self._session);
         return;
     };
 
@@ -3488,7 +3491,7 @@ pub fn submitForm(self: *Page, submitter_: ?*Element, form_: ?*Element.Html.Form
 
         // so submit_event is still valid when we check _prevent_default
         submit_event.acquireRef();
-        defer submit_event.deinit(false, self._session);
+        defer _ = submit_event.releaseRef(self._session);
 
         try self._event_manager.dispatch(form_element.asEventTarget(), submit_event);
         // If the submit event was prevented, don't submit the form
@@ -3547,6 +3550,19 @@ pub fn insertText(self: *Page, v: []const u8) !void {
     }
 }
 
+const RequestCookieOpts = struct {
+    is_http: bool = true,
+    is_navigation: bool = false,
+};
+pub fn requestCookie(self: *const Page, opts: RequestCookieOpts) HttpClient.RequestCookie {
+    return .{
+        .jar = &self._session.cookie_jar,
+        .origin = self.url,
+        .is_http = opts.is_http,
+        .is_navigation = opts.is_navigation,
+    };
+}
+
 fn asUint(comptime string: anytype) std.meta.Int(
     .unsigned,
     @bitSizeOf(@TypeOf(string.*)) - 8, // (- 8) to exclude sentinel 0

src/browser/ScriptManager.zig

@@ -136,9 +136,9 @@ fn clearList(list: *std.DoublyLinkedList) void {
     }
 }
 
-fn getHeaders(self: *ScriptManager) !net_http.Headers {
+fn getHeaders(self: *ScriptManager, arena: Allocator, url: [:0]const u8) !net_http.Headers {
     var headers = try self.client.newHeaders();
-    try self.page.headersForRequest(&headers);
+    try self.page.headersForRequest(arena, url, &headers);
     return headers;
 }
 
@@ -278,10 +278,9 @@ pub fn addFromElement(self: *ScriptManager, comptime from_parser: bool, script_e
             .ctx = script,
             .method = .GET,
             .frame_id = page._frame_id,
-            .headers = try self.getHeaders(),
+            .headers = try self.getHeaders(arena, url),
             .blocking = is_blocking,
             .cookie_jar = &page._session.cookie_jar,
-            .cookie_origin = page.url,
             .resource_type = .script,
             .notification = page._session.notification,
             .start_callback = if (log.enabled(.http, .debug)) Script.startCallback else null,
@@ -404,9 +403,8 @@ pub fn preloadImport(self: *ScriptManager, url: [:0]const u8, referrer: []const
         .ctx = script,
         .method = .GET,
         .frame_id = page._frame_id,
-        .headers = try self.getHeaders(),
+        .headers = try self.getHeaders(arena, url),
         .cookie_jar = &page._session.cookie_jar,
-        .cookie_origin = page.url,
         .resource_type = .script,
         .notification = page._session.notification,
         .start_callback = if (log.enabled(.http, .debug)) Script.startCallback else null,
@@ -508,11 +506,10 @@ pub fn getAsyncImport(self: *ScriptManager, url: [:0]const u8, cb: ImportAsync.C
         .url = url,
         .method = .GET,
         .frame_id = page._frame_id,
-        .headers = try self.getHeaders(),
+        .headers = try self.getHeaders(arena, url),
         .ctx = script,
         .resource_type = .script,
         .cookie_jar = &page._session.cookie_jar,
-        .cookie_origin = page.url,
         .notification = page._session.notification,
         .start_callback = if (log.enabled(.http, .debug)) Script.startCallback else null,
         .header_callback = Script.headerCallback,
@@ -655,6 +652,7 @@ pub const Script = struct {
     debug_transfer_aborted: bool = false,
     debug_transfer_bytes_received: usize = 0,
     debug_transfer_notified_fail: bool = false,
+    debug_transfer_redirecting: bool = false,
     debug_transfer_intercept_state: u8 = 0,
     debug_transfer_auth_challenge: bool = false,
     debug_transfer_easy_id: usize = 0,
@@ -730,6 +728,7 @@ pub const Script = struct {
                 .a3 = self.debug_transfer_aborted,
                 .a4 = self.debug_transfer_bytes_received,
                 .a5 = self.debug_transfer_notified_fail,
+                .a6 = self.debug_transfer_redirecting,
                 .a7 = self.debug_transfer_intercept_state,
                 .a8 = self.debug_transfer_auth_challenge,
                 .a9 = self.debug_transfer_easy_id,
@@ -738,9 +737,10 @@ pub const Script = struct {
                 .b3 = transfer.aborted,
                 .b4 = transfer.bytes_received,
                 .b5 = transfer._notified_fail,
+                .b6 = transfer._redirecting,
                 .b7 = @intFromEnum(transfer._intercept_state),
                 .b8 = transfer._auth_challenge != null,
-                .b9 = if (transfer._conn) |c| @intFromPtr(c._easy) else 0,
+                .b9 = if (transfer._conn) |c| @intFromPtr(c.easy) else 0,
             });
             self.header_callback_called = true;
             self.debug_transfer_id = transfer.id;
@@ -748,9 +748,10 @@ pub const Script = struct {
             self.debug_transfer_aborted = transfer.aborted;
             self.debug_transfer_bytes_received = transfer.bytes_received;
             self.debug_transfer_notified_fail = transfer._notified_fail;
+            self.debug_transfer_redirecting = transfer._redirecting;
             self.debug_transfer_intercept_state = @intFromEnum(transfer._intercept_state);
             self.debug_transfer_auth_challenge = transfer._auth_challenge != null;
-            self.debug_transfer_easy_id = if (transfer._conn) |c| @intFromPtr(c._easy) else 0;
+            self.debug_transfer_easy_id = if (transfer._conn) |c| @intFromPtr(c.easy) else 0;
         }
 
         lp.assert(self.source.remote.capacity == 0, "ScriptManager.Header buffer", .{ .capacity = self.source.remote.capacity });

src/browser/Session.zig

@@ -71,6 +71,18 @@ origins: std.StringHashMapUnmanaged(*js.Origin) = .empty,
 // ensuring object identity works across same-origin frames.
 identity: js.Identity = .{},
 
+// Shared finalizer callbacks across all Identities. Keyed by Zig instance ptr.
+// This ensures objects are only freed when ALL v8 wrappers are gone.
+finalizer_callbacks: std.AutoHashMapUnmanaged(usize, *FinalizerCallback) = .empty,
+
+// Tracked global v8 objects that need to be released on cleanup.
+// Lives at Session level so objects can outlive individual Identities.
+globals: std.ArrayList(v8.Global) = .empty,
+
+// Temporary v8 globals that can be released early. Key is global.data_ptr.
+// Lives at Session level so objects holding Temps can outlive individual Identities.
+temps: std.AutoHashMapUnmanaged(usize, v8.Global) = .empty,
+
 // Shared resources for all pages in this session.
 // These live for the duration of the page tree (root + frames).
 arena_pool: *ArenaPool,
@@ -224,6 +236,30 @@ pub fn releaseOrigin(self: *Session, origin: *js.Origin) void {
 /// Reset page_arena and factory for a clean slate.
 /// Called when root page is removed.
 fn resetPageResources(self: *Session) void {
+    // Force cleanup all remaining finalized objects
+    {
+        var it = self.finalizer_callbacks.valueIterator();
+        while (it.next()) |fc| {
+            fc.*.deinit(self);
+        }
+        self.finalizer_callbacks = .empty;
+    }
+
+    {
+        for (self.globals.items) |*global| {
+            v8.v8__Global__Reset(global);
+        }
+        self.globals = .empty;
+    }
+
+    {
+        var it = self.temps.valueIterator();
+        while (it.next()) |global| {
+            v8.v8__Global__Reset(global);
+        }
+        self.temps = .empty;
+    }
+
     self.identity.deinit();
     self.identity = .{};
 
@@ -457,35 +493,25 @@ pub fn nextPageId(self: *Session) u32 {
     return id;
 }
 
-// A type that has a finalizer can have its finalizer called one of two ways.
-// The first is from V8 via the WeakCallback we give to weakRef. But that isn't
-// guaranteed to fire, so we track this in finalizer_callbacks and call them on
-// page reset.
+// Every finalizable instance of Zig gets 1 FinalizerCallback registered in the
+// session. This is to ensure that, if v8 doesn't finalize the value, we can
+// release on page reset.
 pub const FinalizerCallback = struct {
     arena: Allocator,
     session: *Session,
-    ptr: *anyopaque,
-    global: v8.Global,
-    identity: *js.Identity,
-    zig_finalizer: *const fn (ptr: *anyopaque, session: *Session) void,
+    resolved_ptr_id: usize,
+    finalizer_ptr_id: usize,
+    _deinit: *const fn (ptr_id: usize, session: *Session) void,
 
-    pub fn deinit(self: *FinalizerCallback) void {
-        self.zig_finalizer(self.ptr, self.session);
-        self.session.releaseArena(self.arena);
-    }
-
-    /// Release this item from the identity tracking maps (called after finalizer runs from V8)
-    pub fn releaseIdentity(self: *FinalizerCallback) void {
-        const session = self.session;
-        const id = @intFromPtr(self.ptr);
-
-        if (self.identity.identity_map.fetchRemove(id)) |kv| {
-            var global = kv.value;
-            v8.v8__Global__Reset(&global);
-        }
-
-        _ = self.identity.finalizer_callbacks.remove(id);
+    // For every FinalizerCallback we'll have 1+ FinalizerCallback.Identity: one
+    // for every identity that gets the instance. In most cases, that'l be 1.
+    pub const Identity = struct {
+        identity: *js.Identity,
+        fc: *Session.FinalizerCallback,
+    };
 
+    fn deinit(self: *FinalizerCallback, session: *Session) void {
+        self._deinit(self.finalizer_ptr_id, session);
         session.releaseArena(self.arena);
     }
 };

src/browser/js/Context.zig

@@ -21,6 +21,7 @@ const lp = @import("lightpanda");
 const log = @import("../../log.zig");
 
 const js = @import("js.zig");
+const bridge = @import("bridge.zig");
 const Env = @import("Env.zig");
 const Origin = @import("Origin.zig");
 const Scheduler = @import("Scheduler.zig");
@@ -213,48 +214,11 @@ pub fn setOrigin(self: *Context, key: ?[]const u8) !void {
 }
 
 pub fn trackGlobal(self: *Context, global: v8.Global) !void {
-    return self.identity.globals.append(self.identity_arena, global);
+    return self.session.globals.append(self.session.page_arena, global);
 }
 
 pub fn trackTemp(self: *Context, global: v8.Global) !void {
-    return self.identity.temps.put(self.identity_arena, global.data_ptr, global);
-}
-
-pub fn weakRef(self: *Context, obj: anytype) void {
-    const resolved = js.Local.resolveValue(obj);
-    const fc = self.identity.finalizer_callbacks.get(@intFromPtr(resolved.ptr)) orelse {
-        if (comptime IS_DEBUG) {
-            // should not be possible
-            std.debug.assert(false);
-        }
-        return;
-    };
-    v8.v8__Global__SetWeakFinalizer(&fc.global, fc, resolved.finalizer_from_v8, v8.kParameter);
-}
-
-pub fn safeWeakRef(self: *Context, obj: anytype) void {
-    const resolved = js.Local.resolveValue(obj);
-    const fc = self.identity.finalizer_callbacks.get(@intFromPtr(resolved.ptr)) orelse {
-        if (comptime IS_DEBUG) {
-            // should not be possible
-            std.debug.assert(false);
-        }
-        return;
-    };
-    v8.v8__Global__ClearWeak(&fc.global);
-    v8.v8__Global__SetWeakFinalizer(&fc.global, fc, resolved.finalizer_from_v8, v8.kParameter);
-}
-
-pub fn strongRef(self: *Context, obj: anytype) void {
-    const resolved = js.Local.resolveValue(obj);
-    const fc = self.identity.finalizer_callbacks.get(@intFromPtr(resolved.ptr)) orelse {
-        if (comptime IS_DEBUG) {
-            // should not be possible
-            std.debug.assert(false);
-        }
-        return;
-    };
-    v8.v8__Global__ClearWeak(&fc.global);
+    return self.session.temps.put(self.session.page_arena, global.data_ptr, global);
 }
 
 pub const IdentityResult = struct {
@@ -270,35 +234,6 @@ pub fn addIdentity(self: *Context, ptr: usize) !IdentityResult {
     };
 }
 
-pub fn releaseTemp(self: *Context, global: v8.Global) void {
-    if (self.identity.temps.fetchRemove(global.data_ptr)) |kv| {
-        var g = kv.value;
-        v8.v8__Global__Reset(&g);
-    }
-}
-
-pub fn createFinalizerCallback(
-    self: *Context,
-    global: v8.Global,
-    ptr: *anyopaque,
-    zig_finalizer: *const fn (ptr: *anyopaque, session: *Session) void,
-) !*Session.FinalizerCallback {
-    const session = self.session;
-    const arena = try session.getArena(.{ .debug = "FinalizerCallback" });
-    errdefer session.releaseArena(arena);
-    const fc = try arena.create(Session.FinalizerCallback);
-    fc.* = .{
-        .arena = arena,
-        .session = session,
-        .ptr = ptr,
-        .global = global,
-        .zig_finalizer = zig_finalizer,
-        // Store identity pointer for cleanup when V8 GCs the object
-        .identity = self.identity,
-    };
-    return fc;
-}
-
 // Any operation on the context have to be made from a local.
 pub fn localScope(self: *Context, ls: *js.Local.Scope) void {
     const isolate = self.isolate;

src/browser/js/Function.zig

@@ -213,7 +213,7 @@ fn _persist(self: *const Function, comptime is_global: bool) !(if (is_global) Gl
         return .{ .handle = global, .temps = {} };
     }
     try ctx.trackTemp(global);
-    return .{ .handle = global, .temps = &ctx.identity.temps };
+    return .{ .handle = global, .temps = &ctx.session.temps };
 }
 
 pub fn tempWithThis(self: *const Function, value: anytype) !Temp {

src/browser/js/Identity.zig

@@ -38,38 +38,9 @@ const Identity = @This();
 // Maps Zig instance pointers to their v8::Global(Object) wrappers.
 identity_map: std.AutoHashMapUnmanaged(usize, v8.Global) = .empty,
 
-// Tracked global v8 objects that need to be released on cleanup.
-globals: std.ArrayList(v8.Global) = .empty,
-
-// Temporary v8 globals that can be released early. Key is global.data_ptr.
-temps: std.AutoHashMapUnmanaged(usize, v8.Global) = .empty,
-
-// Finalizer callbacks for weak references. Key is @intFromPtr of the Zig instance.
-finalizer_callbacks: std.AutoHashMapUnmanaged(usize, *Session.FinalizerCallback) = .empty,
-
 pub fn deinit(self: *Identity) void {
-    {
-        var it = self.finalizer_callbacks.valueIterator();
-        while (it.next()) |finalizer| {
-            finalizer.*.deinit();
-        }
-    }
-
-    {
-        var it = self.identity_map.valueIterator();
-        while (it.next()) |global| {
-            v8.v8__Global__Reset(global);
-        }
-    }
-
-    for (self.globals.items) |*global| {
+    var it = self.identity_map.valueIterator();
+    while (it.next()) |global| {
         v8.v8__Global__Reset(global);
     }
-
-    {
-        var it = self.temps.valueIterator();
-        while (it.next()) |global| {
-            v8.v8__Global__Reset(global);
-        }
-    }
 }

src/browser/js/Local.zig

@@ -17,10 +17,11 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
-const Session = @import("../Session.zig");
 const log = @import("../../log.zig");
 const string = @import("../../string.zig");
 
+const Session = @import("../Session.zig");
+
 const js = @import("js.zig");
 const bridge = @import("bridge.zig");
 const Caller = @import("Caller.zig");
@@ -213,7 +214,8 @@ pub fn mapZigInstanceToJs(self: *const Local, js_obj_handle: ?*const v8.Object,
         .pointer => |ptr| {
             const resolved = resolveValue(value);
 
-            const gop = try ctx.addIdentity(@intFromPtr(resolved.ptr));
+            const resolved_ptr_id = @intFromPtr(resolved.ptr);
+            const gop = try ctx.addIdentity(resolved_ptr_id);
             if (gop.found_existing) {
                 // we've seen this instance before, return the same object
                 return (js.Object.Global{ .handle = gop.value_ptr.* }).local(self);
@@ -262,31 +264,27 @@ pub fn mapZigInstanceToJs(self: *const Local, js_obj_handle: ?*const v8.Object,
             // dont' use js_obj.persist(), because we don't want to track this in
             // context.global_objects, we want to track it in context.identity_map.
             v8.v8__Global__New(isolate.handle, js_obj.handle, gop.value_ptr);
-            if (@hasDecl(JsApi.Meta, "finalizer")) {
-                // It would be great if resolved knew the resolved type, but I
-                // can't figure out how to make that work, since it depends on
-                // the [runtime] `value`.
-                // We need the resolved finalizer, which we have in resolved.
-                //
-                // The above if statement would be more clear as:
-                //    if (resolved.finalizer_from_v8) |finalizer| {
-                // But that's a runtime check.
-                // Instead, we check if the base has finalizer. The assumption
-                // here is that if a resolve type has a finalizer, then the base
-                // should have a finalizer too.
-                const fc = try ctx.createFinalizerCallback(gop.value_ptr.*, resolved.ptr, resolved.finalizer_from_zig.?);
-                {
-                    errdefer fc.deinit();
-                    try ctx.identity.finalizer_callbacks.put(ctx.identity_arena, @intFromPtr(resolved.ptr), fc);
-                }
+            if (resolved.finalizer) |finalizer| {
+                const finalizer_ptr_id = finalizer.ptr_id;
+                finalizer.acquireRef(finalizer_ptr_id);
 
-                conditionallyReference(value);
-                if (@hasDecl(JsApi.Meta, "weak")) {
-                    if (comptime IS_DEBUG) {
-                        std.debug.assert(JsApi.Meta.weak == true);
-                    }
-                    v8.v8__Global__SetWeakFinalizer(gop.value_ptr, fc, resolved.finalizer_from_v8, v8.kParameter);
+                const session = ctx.session;
+                const finalizer_gop = try session.finalizer_callbacks.getOrPut(session.page_arena, finalizer_ptr_id);
+                if (finalizer_gop.found_existing == false) {
+                    // This is the first context (and very likely only one) to
+                    // see this Zig instance. We need to create the FinalizerCallback
+                    // so that we can cleanup on page reset if v8 doesn't finalize.
+                    errdefer _ = session.finalizer_callbacks.remove(finalizer_ptr_id);
+                    finalizer_gop.value_ptr.* = try self.createFinalizerCallback(resolved_ptr_id, finalizer_ptr_id, finalizer.deinit);
                 }
+                const fc = finalizer_gop.value_ptr.*;
+                const identity_finalizer = try fc.arena.create(Session.FinalizerCallback.Identity);
+                identity_finalizer.* = .{
+                    .fc = fc,
+                    .identity = ctx.identity,
+                };
+
+                v8.v8__Global__SetWeakFinalizer(gop.value_ptr, identity_finalizer, finalizer.release, v8.kParameter);
             }
             return js_obj;
         },
@@ -1121,12 +1119,19 @@ fn jsUnsignedIntToZig(comptime T: type, max: comptime_int, maybe: u32) !T {
 // This function recursively walks the _type union field (if there is one) to
 // get the most specific class_id possible.
 const Resolved = struct {
-    weak: bool,
     ptr: *anyopaque,
     class_id: u16,
     prototype_chain: []const @import("TaggedOpaque.zig").PrototypeChainEntry,
-    finalizer_from_v8: ?*const fn (handle: ?*const v8.WeakCallbackInfo) callconv(.c) void = null,
-    finalizer_from_zig: ?*const fn (ptr: *anyopaque, session: *Session) void = null,
+    finalizer: ?Finalizer,
+
+    const Finalizer = struct {
+        // Resolved.ptr is the most specific value in a chain (e.g. IFrame, not EventTarget, Node,  ...)
+        // Finalizer.ptr_id is the most specific value in a chain that defines an acquireRef
+        ptr_id: usize,
+        deinit: *const fn (ptr_id: usize, session: *Session) void,
+        acquireRef: *const fn (ptr_id: usize) void,
+        release: *const fn (handle: ?*const v8.WeakCallbackInfo) callconv(.c) void,
+    };
 };
 pub fn resolveValue(value: anytype) Resolved {
     const T = bridge.Struct(@TypeOf(value));
@@ -1153,27 +1158,85 @@ pub fn resolveValue(value: anytype) Resolved {
     unreachable;
 }
 
-fn resolveT(comptime T: type, value: *anyopaque) Resolved {
+fn resolveT(comptime T: type, value: *T) Resolved {
     const Meta = T.JsApi.Meta;
     return .{
         .ptr = value,
         .class_id = Meta.class_id,
         .prototype_chain = &Meta.prototype_chain,
-        .weak = if (@hasDecl(Meta, "weak")) Meta.weak else false,
-        .finalizer_from_v8 = if (@hasDecl(Meta, "finalizer")) Meta.finalizer.from_v8 else null,
-        .finalizer_from_zig = if (@hasDecl(Meta, "finalizer")) Meta.finalizer.from_zig else null,
+        .finalizer = blk: {
+            const FT = (comptime findFinalizerType(T)) orelse break :blk null;
+            const getFinalizerPtr = comptime finalizerPtrGetter(T, FT);
+            const finalizer_ptr = getFinalizerPtr(value);
+
+            const Wrap = struct {
+                fn deinit(ptr_id: usize, session: *Session) void {
+                    FT.deinit(@ptrFromInt(ptr_id), session);
+                }
+
+                fn acquireRef(ptr_id: usize) void {
+                    FT.acquireRef(@ptrFromInt(ptr_id));
+                }
+
+                fn release(handle: ?*const v8.WeakCallbackInfo) callconv(.c) void {
+                    const ptr = v8.v8__WeakCallbackInfo__GetParameter(handle.?).?;
+                    const identity_finalizer: *Session.FinalizerCallback.Identity = @ptrCast(@alignCast(ptr));
+
+                    const fc = identity_finalizer.fc;
+                    if (identity_finalizer.identity.identity_map.fetchRemove(fc.resolved_ptr_id)) |kv| {
+                        var global = kv.value;
+                        v8.v8__Global__Reset(&global);
+                    }
+
+                    FT.releaseRef(@ptrFromInt(fc.finalizer_ptr_id), fc.session);
+                }
+            };
+            break :blk .{
+                .ptr_id = @intFromPtr(finalizer_ptr),
+                .deinit = Wrap.deinit,
+                .acquireRef = Wrap.acquireRef,
+                .release = Wrap.release,
+            };
+        },
     };
 }
 
-fn conditionallyReference(value: anytype) void {
-    const T = bridge.Struct(@TypeOf(value));
-    if (@hasDecl(T, "acquireRef")) {
-        value.acquireRef();
-        return;
+// Start at the "resolved" type (the most specific) and work our way up the
+// prototype chain looking for the type that defines acquireRef
+fn findFinalizerType(comptime T: type) ?type {
+    const S = bridge.Struct(T);
+    if (@hasDecl(S, "acquireRef")) {
+        return S;
     }
-    if (@hasField(T, "_proto")) {
-        conditionallyReference(value._proto);
+    if (@hasField(S, "_proto")) {
+        const ProtoPtr = std.meta.fieldInfo(S, ._proto).type;
+        const ProtoChild = @typeInfo(ProtoPtr).pointer.child;
+        return findFinalizerType(ProtoChild);
     }
+    return null;
+}
+
+// Generate a function that follows the _proto pointer chain to get to the finalizer type
+fn finalizerPtrGetter(comptime T: type, comptime FT: type) *const fn (*T) *FT {
+    const S = bridge.Struct(T);
+    if (S == FT) {
+        return struct {
+            fn get(v: *T) *FT {
+                return v;
+            }
+        }.get;
+    }
+    if (@hasField(S, "_proto")) {
+        const ProtoPtr = std.meta.fieldInfo(S, ._proto).type;
+        const ProtoChild = @typeInfo(ProtoPtr).pointer.child;
+        const childGetter = comptime finalizerPtrGetter(ProtoChild, FT);
+        return struct {
+            fn get(v: *T) *FT {
+                return childGetter(v._proto);
+            }
+        }.get;
+    }
+    @compileError("Cannot find path from " ++ @typeName(T) ++ " to " ++ @typeName(FT));
 }
 
 pub fn stackTrace(self: *const Local) !?[]const u8 {
@@ -1381,6 +1444,34 @@ pub fn debugContextId(self: *const Local) i32 {
     return v8.v8__Context__DebugContextId(self.handle);
 }
 
+fn createFinalizerCallback(
+    self: *const Local,
+
+    // Key in identity map
+    // The most specific value (KeyboardEvent, not Event)
+    resolved_ptr_id: usize,
+
+    // The most specific value where finalizers are defined
+    // What actually gets acquired / released / deinit
+    finalizer_ptr_id: usize,
+    deinit: *const fn (ptr_id: usize, session: *Session) void,
+) !*Session.FinalizerCallback {
+    const session = self.ctx.session;
+
+    const arena = try session.getArena(.{ .debug = "FinalizerCallback" });
+    errdefer session.releaseArena(arena);
+
+    const fc = try arena.create(Session.FinalizerCallback);
+    fc.* = .{
+        .arena = arena,
+        .session = session,
+        ._deinit = deinit,
+        .resolved_ptr_id = resolved_ptr_id,
+        .finalizer_ptr_id = finalizer_ptr_id,
+    };
+    return fc;
+}
+
 // Encapsulates a Local and a HandleScope. When we're going from V8->Zig
 // we easily get both a Local and a HandleScope via Caller.init.
 // But when we're going from Zig -> V8, things are more complicated.

src/browser/js/Promise.zig

@@ -67,7 +67,7 @@ fn _persist(self: *const Promise, comptime is_global: bool) !(if (is_global) Glo
         return .{ .handle = global, .temps = {} };
     }
     try ctx.trackTemp(global);
-    return .{ .handle = global, .temps = &ctx.identity.temps };
+    return .{ .handle = global, .temps = &ctx.session.temps };
 }
 
 pub const Temp = G(.temp);

src/browser/js/Value.zig

@@ -303,7 +303,7 @@ fn _persist(self: *const Value, comptime is_global: bool) !(if (is_global) Globa
         return .{ .handle = global, .temps = {} };
     }
     try ctx.trackTemp(global);
-    return .{ .handle = global, .temps = &ctx.identity.temps };
+    return .{ .handle = global, .temps = &ctx.session.temps };
 }
 
 pub fn toZig(self: Value, comptime T: type) !T {

src/browser/js/bridge.zig

@@ -101,36 +101,21 @@ pub fn Builder(comptime T: type) type {
             }
             return entries;
         }
-
-        pub fn finalizer(comptime func: *const fn (self: *T, shutdown: bool, session: *Session) void) Finalizer {
-            return .{
-                .from_zig = struct {
-                    fn wrap(ptr: *anyopaque, session: *Session) void {
-                        func(@ptrCast(@alignCast(ptr)), true, session);
-                    }
-                }.wrap,
-
-                .from_v8 = struct {
-                    fn wrap(handle: ?*const v8.WeakCallbackInfo) callconv(.c) void {
-                        const ptr = v8.v8__WeakCallbackInfo__GetParameter(handle.?).?;
-                        const fc: *Session.FinalizerCallback = @ptrCast(@alignCast(ptr));
-
-                        const value_ptr = fc.ptr;
-                        if (fc.identity.finalizer_callbacks.contains(@intFromPtr(value_ptr))) {
-                            func(@ptrCast(@alignCast(value_ptr)), false, fc.session);
-                            fc.releaseIdentity();
-                        } else {
-                            // A bit weird, but v8 _requires_ that we release it
-                            // If we don't. We'll 100% crash.
-                            v8.v8__Global__Reset(&fc.global);
-                        }
-                    }
-                }.wrap,
-            };
-        }
     };
 }
 
+fn releaseRef(comptime T: type, ptr_id: usize, session: *Session) void {
+    if (@hasDecl(T, "releaseRef")) {
+        T.releaseRef(@ptrFromInt(ptr_id), session);
+        return;
+    }
+    if (@hasField(T, "_proto")) {
+        releaseRef(Struct(std.meta.fieldInfo(T, ._proto).type), ptr_id, session);
+        return;
+    }
+    @compileError(@typeName(T) ++ " marked with finalizer without an acquireRef in its prototype chain");
+}
+
 pub const Constructor = struct {
     func: *const fn (?*const v8.FunctionCallbackInfo) callconv(.c) void,
 
@@ -411,17 +396,6 @@ pub const Property = struct {
     }
 };
 
-const Finalizer = struct {
-    // The finalizer wrapper when called from Zig. This is only called on
-    // Origin.deinit
-    from_zig: *const fn (ctx: *anyopaque, session: *Session) void,
-
-    // The finalizer wrapper when called from V8. This may never be called
-    // (hence why we fallback to calling in Origin.deinit). If it is called,
-    // it is only ever called after we SetWeak on the Global.
-    from_v8: *const fn (?*const v8.WeakCallbackInfo) callconv(.c) void,
-};
-
 pub fn unknownWindowPropertyCallback(c_name: ?*const v8.Name, handle: ?*const v8.PropertyCallbackInfo) callconv(.c) u8 {
     const v8_isolate = v8.v8__PropertyCallbackInfo__GetIsolate(handle).?;
     var caller: Caller = undefined;

src/browser/webapi/AbstractRange.zig

@@ -17,6 +17,8 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
+
 const js = @import("../js/js.zig");
 
 const Session = @import("../Session.zig");
@@ -31,7 +33,7 @@ const AbstractRange = @This();
 
 pub const _prototype_root = true;
 
-_rc: u8,
+_rc: lp.RC(u8) = .{},
 _type: Type,
 _page_id: u32,
 _arena: Allocator,
@@ -44,24 +46,18 @@ _start_container: *Node,
 _range_link: std.DoublyLinkedList.Node = .{},
 
 pub fn acquireRef(self: *AbstractRange) void {
-    self._rc += 1;
+    self._rc.acquire();
 }
 
-pub fn deinit(self: *AbstractRange, shutdown: bool, session: *Session) void {
-    _ = shutdown;
-    const rc = self._rc;
-    if (comptime IS_DEBUG) {
-        std.debug.assert(rc != 0);
+pub fn deinit(self: *AbstractRange, session: *Session) void {
+    if (session.findPageById(self._page_id)) |page| {
+        page._live_ranges.remove(&self._range_link);
     }
+    session.releaseArena(self._arena);
+}
 
-    if (rc == 1) {
-        if (session.findPageById(self._page_id)) |page| {
-            page._live_ranges.remove(&self._range_link);
-        }
-        session.releaseArena(self._arena);
-        return;
-    }
-    self._rc = rc - 1;
+pub fn releaseRef(self: *AbstractRange, session: *Session) void {
+    self._rc.release(self, session);
 }
 
 pub const Type = union(enum) {
@@ -338,8 +334,6 @@ pub const JsApi = struct {
         pub const name = "AbstractRange";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(AbstractRange.deinit);
     };
 
     pub const startContainer = bridge.accessor(AbstractRange.getStartContainer, null, .{});

src/browser/webapi/Blob.zig

@@ -17,7 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
-const Writer = std.Io.Writer;
+const lp = @import("lightpanda");
 
 const js = @import("../js/js.zig");
 const Page = @import("../Page.zig");
@@ -25,6 +25,7 @@ const Session = @import("../Session.zig");
 
 const Mime = @import("../Mime.zig");
 
+const Writer = std.Io.Writer;
 const Allocator = std.mem.Allocator;
 
 /// https://w3c.github.io/FileAPI/#blob-section
@@ -34,6 +35,7 @@ const Blob = @This();
 pub const _prototype_root = true;
 
 _type: Type,
+_rc: lp.RC(u32),
 
 _arena: Allocator,
 
@@ -120,6 +122,7 @@ pub fn initWithMimeValidation(
 
     const self = try arena.create(Blob);
     self.* = .{
+        ._rc = .{},
         ._arena = arena,
         ._type = .generic,
         ._slice = data,
@@ -128,11 +131,18 @@ pub fn initWithMimeValidation(
     return self;
 }
 
-pub fn deinit(self: *Blob, shutdown: bool, session: *Session) void {
-    _ = shutdown;
+pub fn deinit(self: *Blob, session: *Session) void {
     session.releaseArena(self._arena);
 }
 
+pub fn releaseRef(self: *Blob, session: *Session) void {
+    self._rc.release(self, session);
+}
+
+pub fn acquireRef(self: *Blob) void {
+    self._rc.acquire();
+}
+
 const largest_vector = @max(std.simd.suggestVectorLength(u8) orelse 1, 8);
 /// Array of possible vector sizes for the current arch in decrementing order.
 /// We may move this to some file for SIMD helpers in the future.
@@ -325,8 +335,6 @@ pub const JsApi = struct {
         pub const name = "Blob";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(Blob.deinit);
     };
 
     pub const constructor = bridge.constructor(Blob.init, .{});

src/browser/webapi/Document.zig

@@ -61,7 +61,7 @@ _fonts: ?*FontFaceSet = null,
 _write_insertion_point: ?*Node = null,
 _script_created_parser: ?Parser.Streaming = null,
 _adopted_style_sheets: ?js.Object.Global = null,
-_selection: Selection = .init,
+_selection: Selection = .{ ._rc = .init(1) },
 
 // https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#throw-on-dynamic-markup-insertion-counter
 // Incremented during custom element reactions when parsing. When > 0,

src/browser/webapi/Event.zig

@@ -17,6 +17,8 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
+
 const js = @import("../js/js.zig");
 
 const Page = @import("../Page.zig");
@@ -55,7 +57,7 @@ _is_trusted: bool = false,
 // - 0: no reference, always a transient state going to either 1 or about to be deinit'd
 // - 1: either zig or v8 have a reference
 // - 2: both zig and v8 have a reference
-_rc: u8 = 0,
+_rc: lp.RC(u8) = .{},
 
 pub const EventPhase = enum(u8) {
     none = 0,
@@ -139,25 +141,16 @@ pub fn initEvent(
 }
 
 pub fn acquireRef(self: *Event) void {
-    self._rc += 1;
+    self._rc.acquire();
 }
 
-pub fn deinit(self: *Event, shutdown: bool, session: *Session) void {
-    if (shutdown) {
-        session.releaseArena(self._arena);
-        return;
-    }
+/// Force cleanup on Session shutdown.
+pub fn deinit(self: *Event, session: *Session) void {
+    session.releaseArena(self._arena);
+}
 
-    const rc = self._rc;
-    if (comptime IS_DEBUG) {
-        std.debug.assert(rc != 0);
-    }
-
-    if (rc == 1) {
-        session.releaseArena(self._arena);
-    } else {
-        self._rc = rc - 1;
-    }
+pub fn releaseRef(self: *Event, session: *Session) void {
+    self._rc.release(self, session);
 }
 
 pub fn as(self: *Event, comptime T: type) *T {
@@ -440,8 +433,6 @@ pub const JsApi = struct {
 
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(Event.deinit);
         pub const enumerable = false;
     };
 

src/browser/webapi/EventTarget.zig

@@ -60,7 +60,7 @@ pub fn dispatchEvent(self: *EventTarget, event: *Event, page: *Page) !bool {
     event._is_trusted = false;
 
     event.acquireRef();
-    defer event.deinit(false, page._session);
+    defer _ = event.releaseRef(page._session);
     try page._event_manager.dispatch(self, event);
     return !event._cancelable or !event._prevent_default;
 }

src/browser/webapi/File.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 
 const js = @import("../js/js.zig");
 const Page = @import("../Page.zig");
@@ -26,7 +27,6 @@ const Blob = @import("Blob.zig");
 
 const File = @This();
 
-/// `File` inherits `Blob`.
 _proto: *Blob,
 
 // TODO: Implement File API.
@@ -36,10 +36,6 @@ pub fn init(page: *Page) !*File {
     return page._factory.blob(arena, File{ ._proto = undefined });
 }
 
-pub fn deinit(self: *File, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub const JsApi = struct {
     pub const bridge = js.Bridge(File);
 
@@ -47,8 +43,6 @@ pub const JsApi = struct {
         pub const name = "File";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(File.deinit);
     };
 
     pub const constructor = bridge.constructor(File.init, .{});

src/browser/webapi/FileReader.zig

@@ -17,6 +17,8 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
+
 const js = @import("../js/js.zig");
 
 const Page = @import("../Page.zig");
@@ -31,6 +33,7 @@ const Allocator = std.mem.Allocator;
 /// https://developer.mozilla.org/en-US/docs/Web/API/FileReader
 const FileReader = @This();
 
+_rc: lp.RC(u8) = .{},
 _page: *Page,
 _proto: *EventTarget,
 _arena: Allocator,
@@ -70,7 +73,7 @@ pub fn init(page: *Page) !*FileReader {
     });
 }
 
-pub fn deinit(self: *FileReader, _: bool, session: *Session) void {
+pub fn deinit(self: *FileReader, session: *Session) void {
     if (self._on_abort) |func| func.release();
     if (self._on_error) |func| func.release();
     if (self._on_load) |func| func.release();
@@ -81,6 +84,14 @@ pub fn deinit(self: *FileReader, _: bool, session: *Session) void {
     session.releaseArena(self._arena);
 }
 
+pub fn releaseRef(self: *FileReader, session: *Session) void {
+    self._rc.release(self, session);
+}
+
+pub fn acquireRef(self: *FileReader) void {
+    self._rc.acquire();
+}
+
 fn asEventTarget(self: *FileReader) *EventTarget {
     return self._proto;
 }
@@ -309,8 +320,6 @@ pub const JsApi = struct {
         pub const name = "FileReader";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(FileReader.deinit);
     };
 
     pub const constructor = bridge.constructor(FileReader.init, .{});

src/browser/webapi/IntersectionObserver.zig

@@ -16,6 +16,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 const std = @import("std");
+const lp = @import("lightpanda");
+
 const js = @import("../js/js.zig");
 const log = @import("../../log.zig");
 
@@ -39,6 +41,7 @@ pub fn registerTypes() []const type {
 
 const IntersectionObserver = @This();
 
+_rc: lp.RC(u8) = .{},
 _arena: Allocator,
 _callback: js.Function.Temp,
 _observing: std.ArrayList(*Element) = .{},
@@ -108,15 +111,22 @@ pub fn init(callback: js.Function.Temp, options: ?ObserverInit, page: *Page) !*I
     return self;
 }
 
-pub fn deinit(self: *IntersectionObserver, shutdown: bool, session: *Session) void {
+pub fn deinit(self: *IntersectionObserver, session: *Session) void {
     self._callback.release();
-    if ((comptime IS_DEBUG) and !shutdown) {
-        std.debug.assert(self._observing.items.len == 0);
+    for (self._pending_entries.items) |entry| {
+        entry.deinitIfUnused(session);
     }
-
     session.releaseArena(self._arena);
 }
 
+pub fn releaseRef(self: *IntersectionObserver, session: *Session) void {
+    self._rc.release(self, session);
+}
+
+pub fn acquireRef(self: *IntersectionObserver) void {
+    self._rc.acquire();
+}
+
 pub fn observe(self: *IntersectionObserver, target: *Element, page: *Page) !void {
     // Check if already observing this target
     for (self._observing.items) |elem| {
@@ -127,7 +137,7 @@ pub fn observe(self: *IntersectionObserver, target: *Element, page: *Page) !void
 
     // Register with page if this is our first observation
     if (self._observing.items.len == 0) {
-        page.js.strongRef(self);
+        self._rc._refs += 1;
         try page.registerIntersectionObserver(self);
     }
 
@@ -144,17 +154,19 @@ pub fn observe(self: *IntersectionObserver, target: *Element, page: *Page) !void
 }
 
 pub fn unobserve(self: *IntersectionObserver, target: *Element, page: *Page) void {
+    const original_length = self._observing.items.len;
     for (self._observing.items, 0..) |elem, i| {
         if (elem == target) {
             _ = self._observing.swapRemove(i);
             _ = self._previous_states.remove(target);
 
-            // Remove any pending entries for this target
+            // Remove any pending entries for this target.
+            // Entries will be cleaned up by V8 GC via the finalizer.
             var j: usize = 0;
             while (j < self._pending_entries.items.len) {
                 if (self._pending_entries.items[j]._target == target) {
                     const entry = self._pending_entries.swapRemove(j);
-                    entry.deinit(false, page._session);
+                    entry.deinitIfUnused(page._session);
                 } else {
                     j += 1;
                 }
@@ -163,21 +175,26 @@ pub fn unobserve(self: *IntersectionObserver, target: *Element, page: *Page) voi
         }
     }
 
-    if (self._observing.items.len == 0) {
-        page.js.safeWeakRef(self);
+    if (original_length > 0 and self._observing.items.len == 0) {
+        self._rc._refs -= 1;
     }
 }
 
 pub fn disconnect(self: *IntersectionObserver, page: *Page) void {
-    page.unregisterIntersectionObserver(self);
-    self._observing.clearRetainingCapacity();
-    self._previous_states.clearRetainingCapacity();
-
     for (self._pending_entries.items) |entry| {
-        entry.deinit(false, page._session);
+        entry.deinitIfUnused(page._session);
     }
     self._pending_entries.clearRetainingCapacity();
-    page.js.safeWeakRef(self);
+    self._previous_states.clearRetainingCapacity();
+
+    const observing_count = self._observing.items.len;
+    self._observing.clearRetainingCapacity();
+
+    if (observing_count > 0) {
+        _ = self.releaseRef(page._session);
+    }
+
+    page.unregisterIntersectionObserver(self);
 }
 
 pub fn takeRecords(self: *IntersectionObserver, page: *Page) ![]*IntersectionObserverEntry {
@@ -268,7 +285,6 @@ fn checkIntersection(self: *IntersectionObserver, target: *Element, page: *Page)
             ._bounding_client_rect = try page._factory.create(data.bounding_client_rect),
             ._intersection_ratio = data.intersection_ratio,
         };
-
         try self._pending_entries.append(self._arena, entry);
     }
 
@@ -310,6 +326,7 @@ pub fn deliverEntries(self: *IntersectionObserver, page: *Page) !void {
 }
 
 pub const IntersectionObserverEntry = struct {
+    _rc: lp.RC(u8) = .{},
     _arena: Allocator,
     _time: f64,
     _target: *Element,
@@ -319,10 +336,25 @@ pub const IntersectionObserverEntry = struct {
     _intersection_ratio: f64,
     _is_intersecting: bool,
 
-    pub fn deinit(self: *IntersectionObserverEntry, _: bool, session: *Session) void {
+    pub fn deinit(self: *IntersectionObserverEntry, session: *Session) void {
         session.releaseArena(self._arena);
     }
 
+    fn deinitIfUnused(self: *IntersectionObserverEntry, session: *Session) void {
+        if (self._rc._refs == 0) {
+            // hasn't been handed to JS yet.
+            self.deinit(session);
+        }
+    }
+
+    pub fn releaseRef(self: *IntersectionObserverEntry, session: *Session) void {
+        self._rc.release(self, session);
+    }
+
+    pub fn acquireRef(self: *IntersectionObserverEntry) void {
+        self._rc.acquire();
+    }
+
     pub fn getTarget(self: *const IntersectionObserverEntry) *Element {
         return self._target;
     }
@@ -358,8 +390,6 @@ pub const IntersectionObserverEntry = struct {
             pub const name = "IntersectionObserverEntry";
             pub const prototype_chain = bridge.prototypeChain();
             pub var class_id: bridge.ClassId = undefined;
-            pub const weak = true;
-            pub const finalizer = bridge.finalizer(IntersectionObserverEntry.deinit);
         };
 
         pub const target = bridge.accessor(IntersectionObserverEntry.getTarget, null, .{});
@@ -379,8 +409,6 @@ pub const JsApi = struct {
         pub const name = "IntersectionObserver";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(IntersectionObserver.deinit);
     };
 
     pub const constructor = bridge.constructor(init, .{});

src/browser/webapi/MutationObserver.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 const String = @import("../../string.zig").String;
 
 const js = @import("../js/js.zig");
@@ -39,6 +40,7 @@ pub fn registerTypes() []const type {
 
 const MutationObserver = @This();
 
+_rc: lp.RC(u8) = .{},
 _arena: Allocator,
 _callback: js.Function.Temp,
 _observing: std.ArrayList(Observing) = .{},
@@ -85,15 +87,20 @@ pub fn init(callback: js.Function.Temp, page: *Page) !*MutationObserver {
     return self;
 }
 
-pub fn deinit(self: *MutationObserver, shutdown: bool, session: *Session) void {
+/// Force cleanup on Session shutdown.
+pub fn deinit(self: *MutationObserver, session: *Session) void {
     self._callback.release();
-    if ((comptime IS_DEBUG) and !shutdown) {
-        std.debug.assert(self._observing.items.len == 0);
-    }
-
     session.releaseArena(self._arena);
 }
 
+pub fn releaseRef(self: *MutationObserver, session: *Session) void {
+    self._rc.release(self, session);
+}
+
+pub fn acquireRef(self: *MutationObserver) void {
+    self._rc.acquire();
+}
+
 pub fn observe(self: *MutationObserver, target: *Node, options: ObserveOptions, page: *Page) !void {
     const arena = self._arena;
 
@@ -158,7 +165,7 @@ pub fn observe(self: *MutationObserver, target: *Node, options: ObserveOptions,
 
     // Register with page if this is our first observation
     if (self._observing.items.len == 0) {
-        page.js.strongRef(self);
+        self._rc._refs += 1;
         try page.registerMutationObserver(self);
     }
 
@@ -169,13 +176,17 @@ pub fn observe(self: *MutationObserver, target: *Node, options: ObserveOptions,
 }
 
 pub fn disconnect(self: *MutationObserver, page: *Page) void {
-    page.unregisterMutationObserver(self);
-    self._observing.clearRetainingCapacity();
     for (self._pending_records.items) |record| {
-        record.deinit(false, page._session);
+        _ = record.releaseRef(page._session);
     }
     self._pending_records.clearRetainingCapacity();
-    page.js.safeWeakRef(self);
+    const observing_count = self._observing.items.len;
+    self._observing.clearRetainingCapacity();
+
+    if (observing_count > 0) {
+        _ = self.releaseRef(page._session);
+    }
+    page.unregisterMutationObserver(self);
 }
 
 pub fn takeRecords(self: *MutationObserver, page: *Page) ![]*MutationRecord {
@@ -348,6 +359,7 @@ pub fn deliverRecords(self: *MutationObserver, page: *Page) !void {
 }
 
 pub const MutationRecord = struct {
+    _rc: lp.RC(u8) = .{},
     _type: Type,
     _target: *Node,
     _arena: Allocator,
@@ -364,10 +376,18 @@ pub const MutationRecord = struct {
         characterData,
     };
 
-    pub fn deinit(self: *MutationRecord, _: bool, session: *Session) void {
+    pub fn deinit(self: *MutationRecord, session: *Session) void {
         session.releaseArena(self._arena);
     }
 
+    pub fn releaseRef(self: *MutationRecord, session: *Session) void {
+        self._rc.release(self, session);
+    }
+
+    pub fn acquireRef(self: *MutationRecord) void {
+        self._rc.acquire();
+    }
+
     pub fn getType(self: *const MutationRecord) []const u8 {
         return switch (self._type) {
             .attributes => "attributes",
@@ -418,8 +438,6 @@ pub const MutationRecord = struct {
             pub const name = "MutationRecord";
             pub const prototype_chain = bridge.prototypeChain();
             pub var class_id: bridge.ClassId = undefined;
-            pub const weak = true;
-            pub const finalizer = bridge.finalizer(MutationRecord.deinit);
         };
 
         pub const @"type" = bridge.accessor(MutationRecord.getType, null, .{});
@@ -441,8 +459,6 @@ pub const JsApi = struct {
         pub const name = "MutationObserver";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(MutationObserver.deinit);
     };
 
     pub const constructor = bridge.constructor(MutationObserver.init, .{});

src/browser/webapi/Permissions.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 const js = @import("../js/js.zig");
 const Page = @import("../Page.zig");
 const Session = @import("../Session.zig");
@@ -50,14 +51,23 @@ pub fn query(_: *const Permissions, qd: QueryDescriptor, page: *Page) !js.Promis
 }
 
 const PermissionStatus = struct {
+    _rc: lp.RC(u8) = .{},
     _arena: Allocator,
     _name: []const u8,
     _state: []const u8,
 
-    pub fn deinit(self: *PermissionStatus, _: bool, session: *Session) void {
+    pub fn deinit(self: *PermissionStatus, session: *Session) void {
         session.releaseArena(self._arena);
     }
 
+    pub fn releaseRef(self: *PermissionStatus, session: *Session) void {
+        self._rc.release(self, session);
+    }
+
+    pub fn acquireRef(self: *PermissionStatus) void {
+        self._rc.acquire();
+    }
+
     fn getName(self: *const PermissionStatus) []const u8 {
         return self._name;
     }
@@ -72,8 +82,6 @@ const PermissionStatus = struct {
             pub const name = "PermissionStatus";
             pub const prototype_chain = bridge.prototypeChain();
             pub var class_id: bridge.ClassId = undefined;
-            pub const weak = true;
-            pub const finalizer = bridge.finalizer(PermissionStatus.deinit);
         };
         pub const name = bridge.accessor(getName, null, .{});
         pub const state = bridge.accessor(getState, null, .{});

src/browser/webapi/Range.zig

@@ -38,10 +38,6 @@ pub fn init(page: *Page) !*Range {
     return page._factory.abstractRange(arena, Range{ ._proto = undefined }, page);
 }
 
-pub fn deinit(self: *Range, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asAbstractRange(self: *Range) *AbstractRange {
     return self._proto;
 }
@@ -697,8 +693,6 @@ pub const JsApi = struct {
         pub const name = "Range";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(Range.deinit);
     };
 
     // Constants for compareBoundaryPoints

src/browser/webapi/Selection.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 
 const js = @import("../js/js.zig");
 const Page = @import("../Page.zig");
@@ -32,18 +33,27 @@ const Selection = @This();
 
 pub const SelectionDirection = enum { backward, forward, none };
 
+_rc: lp.RC(u8) = .{},
 _range: ?*Range = null,
 _direction: SelectionDirection = .none,
 
 pub const init: Selection = .{};
 
-pub fn deinit(self: *Selection, shutdown: bool, session: *Session) void {
+pub fn deinit(self: *Selection, session: *Session) void {
     if (self._range) |r| {
-        r.deinit(shutdown, session);
+        r.asAbstractRange().releaseRef(session);
         self._range = null;
     }
 }
 
+pub fn releaseRef(self: *Selection, session: *Session) void {
+    self._rc.release(self, session);
+}
+
+pub fn acquireRef(self: *Selection) void {
+    self._rc.acquire();
+}
+
 fn dispatchSelectionChangeEvent(page: *Page) !void {
     const event = try Event.init("selectionchange", .{}, page);
     try page._event_manager.dispatch(page.document.asEventTarget(), event);
@@ -693,7 +703,7 @@ pub fn toString(self: *const Selection, page: *Page) ![]const u8 {
 
 fn setRange(self: *Selection, new_range: ?*Range, page: *Page) void {
     if (self._range) |existing| {
-        existing.deinit(false, page._session);
+        _ = existing.asAbstractRange().releaseRef(page._session);
     }
     if (new_range) |nr| {
         nr.asAbstractRange().acquireRef();
@@ -708,7 +718,6 @@ pub const JsApi = struct {
         pub const name = "Selection";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const finalizer = bridge.finalizer(Selection.deinit);
     };
 
     pub const anchorNode = bridge.accessor(Selection.getAnchorNode, null, .{});

src/browser/webapi/URL.zig

@@ -256,8 +256,7 @@ pub fn createObjectURL(blob: *Blob, page: *Page) ![]const u8 {
         .{ page.origin orelse "null", uuid_buf },
     );
     try page._blob_urls.put(page.arena, blob_url, blob);
-    // prevent GC from cleaning up the blob while it's in the registry
-    page.js.strongRef(blob);
+    blob.acquireRef();
     return blob_url;
 }
 
@@ -267,9 +266,8 @@ pub fn revokeObjectURL(url: []const u8, page: *Page) void {
         return;
     }
 
-    // Remove from registry and release strong ref (no-op if not found)
     if (page._blob_urls.fetchRemove(url)) |entry| {
-        page.js.weakRef(entry.value);
+        entry.value.releaseRef(page._session);
     }
 }
 

src/browser/webapi/animation/Animation.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 const log = @import("../../../log.zig");
 const js = @import("../../js/js.zig");
 const Page = @import("../../Page.zig");
@@ -33,6 +34,7 @@ const PlayState = enum {
     finished,
 };
 
+_rc: lp.RC(u32) = .{},
 _page: *Page,
 _arena: Allocator,
 
@@ -62,10 +64,18 @@ pub fn init(page: *Page) !*Animation {
     return self;
 }
 
-pub fn deinit(self: *Animation, _: bool, session: *Session) void {
+pub fn deinit(self: *Animation, session: *Session) void {
     session.releaseArena(self._arena);
 }
 
+pub fn releaseRef(self: *Animation, session: *Session) void {
+    self._rc.release(self, session);
+}
+
+pub fn acquireRef(self: *Animation) void {
+    self._rc.acquire();
+}
+
 pub fn play(self: *Animation, page: *Page) !void {
     if (self._playState == .running) {
         return;
@@ -75,7 +85,7 @@ pub fn play(self: *Animation, page: *Page) !void {
     self._playState = .running;
 
     // Schedule the transition from .running => .finished in 10ms.
-    page.js.strongRef(self);
+    self.acquireRef();
     try page.js.scheduler.add(
         self,
         Animation.update,
@@ -201,7 +211,7 @@ fn update(ctx: *anyopaque) !?u32 {
     }
 
     // No future change scheduled, set the object weak for garbage collection.
-    self._page.js.weakRef(self);
+    self.releaseRef(self._page._session);
     return null;
 }
 
@@ -220,8 +230,6 @@ pub const JsApi = struct {
         pub const name = "Animation";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(Animation.deinit);
     };
 
     pub const play = bridge.function(Animation.play, .{});

src/browser/webapi/collections/NodeList.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 
 const log = @import("../../../log.zig");
 const js = @import("../../js/js.zig");
@@ -37,15 +38,9 @@ _data: union(enum) {
     radio_node_list: *RadioNodeList,
     name: NodeLive(.name),
 },
-_rc: usize = 0,
-
-pub fn deinit(self: *NodeList, _: bool, session: *Session) void {
-    const rc = self._rc;
-    if (rc > 1) {
-        self._rc = rc - 1;
-        return;
-    }
+_rc: lp.RC(u32) = .{},
 
+pub fn deinit(self: *NodeList, session: *Session) void {
     switch (self._data) {
         .selector_list => |list| list.deinit(session),
         .child_nodes => |cn| cn.deinit(session),
@@ -53,8 +48,12 @@ pub fn deinit(self: *NodeList, _: bool, session: *Session) void {
     }
 }
 
+pub fn releaseRef(self: *NodeList, session: *Session) void {
+    self._rc.release(self, session);
+}
+
 pub fn acquireRef(self: *NodeList) void {
-    self._rc += 1;
+    self._rc.acquire();
 }
 
 pub fn length(self: *NodeList, page: *Page) !u32 {
@@ -119,8 +118,12 @@ const Iterator = struct {
 
     const Entry = struct { u32, *Node };
 
-    pub fn deinit(self: *Iterator, shutdown: bool, session: *Session) void {
-        self.list.deinit(shutdown, session);
+    pub fn deinit(self: *Iterator, session: *Session) void {
+        self.list.deinit(session);
+    }
+
+    pub fn releaseRef(self: *Iterator, session: *Session) void {
+        self.list.releaseRef(session);
     }
 
     pub fn acquireRef(self: *Iterator) void {
@@ -143,8 +146,6 @@ pub const JsApi = struct {
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
         pub const enumerable = false;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(NodeList.deinit);
     };
 
     pub const length = bridge.accessor(NodeList.length, null, .{});

src/browser/webapi/collections/iterator.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");
 const Page = @import("../../Page.zig");
 const Session = @import("../../Session.zig");
@@ -40,9 +41,15 @@ pub fn Entry(comptime Inner: type, comptime field: ?[]const u8) type {
             return page._factory.create(Self{ .inner = inner });
         }
 
-        pub fn deinit(self: *Self, shutdown: bool, session: *Session) void {
-            if (@hasDecl(Inner, "deinit")) {
-                self.inner.deinit(shutdown, session);
+        pub fn deinit(self: *Self, session: *Session) void {
+            _ = self;
+            _ = session;
+        }
+
+        pub fn releaseRef(self: *Self, session: *Session) void {
+            // Release the reference to the inner type that we acquired
+            if (@hasDecl(Inner, "releaseRef")) {
+                self.inner.releaseRef(session);
             }
         }
 
@@ -73,8 +80,6 @@ pub fn Entry(comptime Inner: type, comptime field: ?[]const u8) type {
             pub const Meta = struct {
                 pub const prototype_chain = bridge.prototypeChain();
                 pub var class_id: bridge.ClassId = undefined;
-                pub const weak = true;
-                pub const finalizer = bridge.finalizer(Self.deinit);
             };
 
             pub const next = bridge.function(Self.next, .{ .null_as_undefined = true });

src/browser/webapi/css/FontFace.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");
 const Page = @import("../../Page.zig");
 const Session = @import("../../Session.zig");
@@ -25,6 +26,7 @@ const Allocator = std.mem.Allocator;
 
 const FontFace = @This();
 
+_rc: lp.RC(u8) = .{},
 _arena: Allocator,
 _family: []const u8,
 
@@ -42,10 +44,18 @@ pub fn init(family: []const u8, source: []const u8, page: *Page) !*FontFace {
     return self;
 }
 
-pub fn deinit(self: *FontFace, _: bool, session: *Session) void {
+pub fn deinit(self: *FontFace, session: *Session) void {
     session.releaseArena(self._arena);
 }
 
+pub fn releaseRef(self: *FontFace, session: *Session) void {
+    self._rc.release(self, session);
+}
+
+pub fn acquireRef(self: *FontFace) void {
+    self._rc.acquire();
+}
+
 pub fn getFamily(self: *const FontFace) []const u8 {
     return self._family;
 }
@@ -67,8 +77,6 @@ pub const JsApi = struct {
         pub const name = "FontFace";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(FontFace.deinit);
     };
 
     pub const constructor = bridge.constructor(FontFace.init, .{});

src/browser/webapi/css/FontFaceSet.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");
 const Page = @import("../../Page.zig");
 const Session = @import("../../Session.zig");
@@ -28,6 +29,7 @@ const Allocator = std.mem.Allocator;
 
 const FontFaceSet = @This();
 
+_rc: lp.RC(u8) = .{},
 _proto: *EventTarget,
 _arena: Allocator,
 
@@ -41,10 +43,18 @@ pub fn init(page: *Page) !*FontFaceSet {
     });
 }
 
-pub fn deinit(self: *FontFaceSet, _: bool, session: *Session) void {
+pub fn deinit(self: *FontFaceSet, session: *Session) void {
     session.releaseArena(self._arena);
 }
 
+pub fn releaseRef(self: *FontFaceSet, session: *Session) void {
+    self._rc.release(self, session);
+}
+
+pub fn acquireRef(self: *FontFaceSet) void {
+    self._rc.acquire();
+}
+
 pub fn asEventTarget(self: *FontFaceSet) *EventTarget {
     return self._proto;
 }
@@ -95,8 +105,6 @@ pub const JsApi = struct {
         pub const name = "FontFaceSet";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(FontFaceSet.deinit);
     };
 
     pub const size = bridge.property(0, .{ .template = false, .readonly = true });

src/browser/webapi/encoding/TextDecoder.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");
 
 const Page = @import("../../Page.zig");
@@ -25,6 +26,7 @@ const Allocator = std.mem.Allocator;
 
 const TextDecoder = @This();
 
+_rc: lp.RC(u8) = .{},
 _fatal: bool,
 _arena: Allocator,
 _ignore_bom: bool,
@@ -60,10 +62,18 @@ pub fn init(label_: ?[]const u8, opts_: ?InitOpts, page: *Page) !*TextDecoder {
     return self;
 }
 
-pub fn deinit(self: *TextDecoder, _: bool, session: *Session) void {
+pub fn deinit(self: *TextDecoder, session: *Session) void {
     session.releaseArena(self._arena);
 }
 
+pub fn releaseRef(self: *TextDecoder, session: *Session) void {
+    self._rc.release(self, session);
+}
+
+pub fn acquireRef(self: *TextDecoder) void {
+    self._rc.acquire();
+}
+
 pub fn getIgnoreBOM(self: *const TextDecoder) bool {
     return self._ignore_bom;
 }
@@ -109,8 +119,6 @@ pub const JsApi = struct {
         pub const name = "TextDecoder";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(TextDecoder.deinit);
     };
 
     pub const constructor = bridge.constructor(TextDecoder.init, .{});

src/browser/webapi/event/CompositionEvent.zig

@@ -53,10 +53,6 @@ pub fn init(typ: []const u8, opts_: ?Options, page: *Page) !*CompositionEvent {
     return event;
 }
 
-pub fn deinit(self: *CompositionEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *CompositionEvent) *Event {
     return self._proto;
 }
@@ -72,8 +68,6 @@ pub const JsApi = struct {
         pub const name = "CompositionEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(CompositionEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(CompositionEvent.init, .{});

src/browser/webapi/event/CustomEvent.zig

@@ -73,11 +73,19 @@ pub fn initCustomEvent(
     self._detail = detail_;
 }
 
-pub fn deinit(self: *CustomEvent, shutdown: bool, session: *Session) void {
+pub fn deinit(self: *CustomEvent, session: *Session) void {
     if (self._detail) |d| {
         d.release();
     }
-    self._proto.deinit(shutdown, session);
+    self._proto.deinit(session);
+}
+
+pub fn acquireRef(self: *CustomEvent) void {
+    self._proto.acquireRef();
+}
+
+pub fn releaseRef(self: *CustomEvent, session: *Session) void {
+    self._proto._rc.release(self, session);
 }
 
 pub fn asEvent(self: *CustomEvent) *Event {
@@ -95,8 +103,6 @@ pub const JsApi = struct {
         pub const name = "CustomEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(CustomEvent.deinit);
         pub const enumerable = false;
     };
 

src/browser/webapi/event/ErrorEvent.zig

@@ -80,11 +80,19 @@ fn initWithTrusted(arena: Allocator, typ: String, opts_: ?Options, trusted: bool
     return event;
 }
 
-pub fn deinit(self: *ErrorEvent, shutdown: bool, session: *Session) void {
+pub fn deinit(self: *ErrorEvent, session: *Session) void {
     if (self._error) |e| {
         e.release();
     }
-    self._proto.deinit(shutdown, session);
+    self._proto.deinit(session);
+}
+
+pub fn acquireRef(self: *ErrorEvent) void {
+    self._proto.acquireRef();
+}
+
+pub fn releaseRef(self: *ErrorEvent, session: *Session) void {
+    self._proto._rc.release(self, session);
 }
 
 pub fn asEvent(self: *ErrorEvent) *Event {

src/browser/webapi/event/FocusEvent.zig

@@ -70,10 +70,6 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
     return event;
 }
 
-pub fn deinit(self: *FocusEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *FocusEvent) *Event {
     return self._proto.asEvent();
 }
@@ -89,8 +85,6 @@ pub const JsApi = struct {
         pub const name = "FocusEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(FocusEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(FocusEvent.init, .{});

src/browser/webapi/event/FormDataEvent.zig

@@ -66,10 +66,6 @@ fn initWithTrusted(arena: Allocator, typ: String, maybe_options: ?Options, trust
     return event;
 }
 
-pub fn deinit(self: *FormDataEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *FormDataEvent) *Event {
     return self._proto;
 }
@@ -85,8 +81,6 @@ pub const JsApi = struct {
         pub const name = "FormDataEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(FormDataEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(FormDataEvent.init, .{});

src/browser/webapi/event/InputEvent.zig

@@ -83,10 +83,6 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
     return event;
 }
 
-pub fn deinit(self: *InputEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *InputEvent) *Event {
     return self._proto.asEvent();
 }
@@ -110,8 +106,6 @@ pub const JsApi = struct {
         pub const name = "InputEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(InputEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(InputEvent.init, .{});

src/browser/webapi/event/KeyboardEvent.zig

@@ -229,10 +229,6 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
     return event;
 }
 
-pub fn deinit(self: *KeyboardEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *KeyboardEvent) *Event {
     return self._proto.asEvent();
 }
@@ -296,8 +292,6 @@ pub const JsApi = struct {
         pub const name = "KeyboardEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(KeyboardEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(KeyboardEvent.init, .{});

src/browser/webapi/event/MessageEvent.zig

@@ -73,11 +73,19 @@ fn initWithTrusted(arena: Allocator, typ: String, opts_: ?Options, trusted: bool
     return event;
 }
 
-pub fn deinit(self: *MessageEvent, shutdown: bool, session: *Session) void {
+pub fn deinit(self: *MessageEvent, session: *Session) void {
     if (self._data) |d| {
         d.release();
     }
-    self._proto.deinit(shutdown, session);
+    self._proto.deinit(session);
+}
+
+pub fn acquireRef(self: *MessageEvent) void {
+    self._proto.acquireRef();
+}
+
+pub fn releaseRef(self: *MessageEvent, session: *Session) void {
+    self._proto._rc.release(self, session);
 }
 
 pub fn asEvent(self: *MessageEvent) *Event {
@@ -103,8 +111,6 @@ pub const JsApi = struct {
         pub const name = "MessageEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(MessageEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(MessageEvent.init, .{});

src/browser/webapi/event/MouseEvent.zig

@@ -121,10 +121,6 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
     return event;
 }
 
-pub fn deinit(self: *MouseEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *MouseEvent) *Event {
     return self._proto.asEvent();
 }
@@ -203,8 +199,6 @@ pub const JsApi = struct {
         pub const name = "MouseEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(MouseEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(MouseEvent.init, .{});

src/browser/webapi/event/NavigationCurrentEntryChangeEvent.zig

@@ -83,10 +83,6 @@ fn initWithTrusted(
     return event;
 }
 
-pub fn deinit(self: *NavigationCurrentEntryChangeEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *NavigationCurrentEntryChangeEvent) *Event {
     return self._proto;
 }
@@ -106,8 +102,6 @@ pub const JsApi = struct {
         pub const name = "NavigationCurrentEntryChangeEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(NavigationCurrentEntryChangeEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(NavigationCurrentEntryChangeEvent.init, .{});

src/browser/webapi/event/PageTransitionEvent.zig

@@ -66,10 +66,6 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
     return event;
 }
 
-pub fn deinit(self: *PageTransitionEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *PageTransitionEvent) *Event {
     return self._proto;
 }
@@ -85,8 +81,6 @@ pub const JsApi = struct {
         pub const name = "PageTransitionEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(PageTransitionEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(PageTransitionEvent.init, .{});

src/browser/webapi/event/PointerEvent.zig

@@ -128,10 +128,6 @@ pub fn init(typ: []const u8, _opts: ?Options, page: *Page) !*PointerEvent {
     return event;
 }
 
-pub fn deinit(self: *PointerEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *PointerEvent) *Event {
     return self._proto.asEvent();
 }
@@ -191,8 +187,6 @@ pub const JsApi = struct {
         pub const name = "PointerEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(PointerEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(PointerEvent.init, .{});

src/browser/webapi/event/PopStateEvent.zig

@@ -67,10 +67,6 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
     return event;
 }
 
-pub fn deinit(self: *PopStateEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *PopStateEvent) *Event {
     return self._proto;
 }
@@ -92,8 +88,6 @@ pub const JsApi = struct {
         pub const name = "PopStateEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(PopStateEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(PopStateEvent.init, .{});

src/browser/webapi/event/ProgressEvent.zig

@@ -68,10 +68,6 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
     return event;
 }
 
-pub fn deinit(self: *ProgressEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *ProgressEvent) *Event {
     return self._proto;
 }
@@ -96,8 +92,6 @@ pub const JsApi = struct {
         pub const name = "ProgressEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(ProgressEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(ProgressEvent.init, .{});

src/browser/webapi/event/PromiseRejectionEvent.zig

@@ -56,14 +56,22 @@ pub fn init(typ: []const u8, opts_: ?Options, page: *Page) !*PromiseRejectionEve
     return event;
 }
 
-pub fn deinit(self: *PromiseRejectionEvent, shutdown: bool, session: *Session) void {
+pub fn deinit(self: *PromiseRejectionEvent, session: *Session) void {
     if (self._reason) |r| {
         r.release();
     }
     if (self._promise) |p| {
         p.release();
     }
-    self._proto.deinit(shutdown, session);
+    self._proto.deinit(session);
+}
+
+pub fn acquireRef(self: *PromiseRejectionEvent) void {
+    self._proto.acquireRef();
+}
+
+pub fn releaseRef(self: *PromiseRejectionEvent, session: *Session) void {
+    self._proto._rc.release(self, session);
 }
 
 pub fn asEvent(self: *PromiseRejectionEvent) *Event {
@@ -85,8 +93,6 @@ pub const JsApi = struct {
         pub const name = "PromiseRejectionEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(PromiseRejectionEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(PromiseRejectionEvent.init, .{});

src/browser/webapi/event/SubmitEvent.zig

@@ -67,10 +67,6 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
     return event;
 }
 
-pub fn deinit(self: *SubmitEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *SubmitEvent) *Event {
     return self._proto;
 }
@@ -86,8 +82,6 @@ pub const JsApi = struct {
         pub const name = "SubmitEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(SubmitEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(SubmitEvent.init, .{});

src/browser/webapi/event/TextEvent.zig

@@ -59,10 +59,6 @@ pub fn init(typ: []const u8, _opts: ?Options, page: *Page) !*TextEvent {
     return event;
 }
 
-pub fn deinit(self: *TextEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *TextEvent) *Event {
     return self._proto.asEvent();
 }
@@ -101,8 +97,6 @@ pub const JsApi = struct {
         pub const name = "TextEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(TextEvent.deinit);
     };
 
     // No constructor - TextEvent is created via document.createEvent('TextEvent')

src/browser/webapi/event/UIEvent.zig

@@ -71,10 +71,6 @@ pub fn init(typ: []const u8, _opts: ?Options, page: *Page) !*UIEvent {
     return event;
 }
 
-pub fn deinit(self: *UIEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn as(self: *UIEvent, comptime T: type) *T {
     return self.is(T).?;
 }
@@ -122,8 +118,6 @@ pub const JsApi = struct {
         pub const name = "UIEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(UIEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(UIEvent.init, .{});

src/browser/webapi/event/WheelEvent.zig

@@ -87,10 +87,6 @@ pub fn init(typ: []const u8, _opts: ?Options, page: *Page) !*WheelEvent {
     return event;
 }
 
-pub fn deinit(self: *WheelEvent, shutdown: bool, session: *Session) void {
-    self._proto.deinit(shutdown, session);
-}
-
 pub fn asEvent(self: *WheelEvent) *Event {
     return self._proto.asEvent();
 }
@@ -118,8 +114,6 @@ pub const JsApi = struct {
         pub const name = "WheelEvent";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(WheelEvent.deinit);
     };
 
     pub const constructor = bridge.constructor(WheelEvent.init, .{});

src/browser/webapi/net/Fetch.zig

@@ -62,7 +62,7 @@ pub fn init(input: Input, options: ?InitOpts, page: *Page) !js.Promise {
     }
 
     const response = try Response.init(null, .{ .status = 0 }, page);
-    errdefer response.deinit(true, page._session);
+    errdefer response.deinit(page._session);
 
     const fetch = try response._arena.create(Fetch);
     fetch.* = .{
@@ -80,7 +80,7 @@ pub fn init(input: Input, options: ?InitOpts, page: *Page) !js.Promise {
     if (request._headers) |h| {
         try h.populateHttpHeader(page.call_arena, &headers);
     }
-    try page.headersForRequest(&headers);
+    try page.headersForRequest(page.arena, request._url, &headers);
 
     if (comptime IS_DEBUG) {
         log.debug(.http, "fetch", .{ .url = request._url });
@@ -95,7 +95,6 @@ pub fn init(input: Input, options: ?InitOpts, page: *Page) !js.Promise {
         .headers = headers,
         .resource_type = .fetch,
         .cookie_jar = &page._session.cookie_jar,
-        .cookie_origin = page.url,
         .notification = page._session.notification,
         .start_callback = httpStartCallback,
         .header_callback = httpHeaderDoneCallback,
@@ -226,7 +225,7 @@ fn httpDoneCallback(ctx: *anyopaque) !void {
     return ls.toLocal(self._resolver).resolve("fetch done", js_val);
 }
 
-fn httpErrorCallback(ctx: *anyopaque, err: anyerror) void {
+fn httpErrorCallback(ctx: *anyopaque, _: anyerror) void {
     const self: *Fetch = @ptrCast(@alignCast(ctx));
 
     var response = self._response;
@@ -235,7 +234,7 @@ fn httpErrorCallback(ctx: *anyopaque, err: anyerror) void {
     // clear this. (defer since `self is in the response's arena).
 
     defer if (self._owns_response) {
-        response.deinit(err == error.Abort, self._page._session);
+        response.deinit(self._page._session);
         self._owns_response = false;
     };
 
@@ -257,7 +256,7 @@ fn httpShutdownCallback(ctx: *anyopaque) void {
     if (self._owns_response) {
         var response = self._response;
         response._transfer = null;
-        response.deinit(true, self._page._session);
+        response.deinit(self._page._session);
         // Do not access `self` after this point: the Fetch struct was
         // allocated from response._arena which has been released.
     }

src/browser/webapi/net/Response.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");
 const HttpClient = @import("../../HttpClient.zig");
 
@@ -38,6 +39,7 @@ pub const Type = enum {
     opaqueredirect,
 };
 
+_rc: lp.RC(u8) = .{},
 _status: u16,
 _arena: Allocator,
 _headers: *Headers,
@@ -78,18 +80,22 @@ pub fn init(body_: ?[]const u8, opts_: ?InitOpts, page: *Page) !*Response {
     return self;
 }
 
-pub fn deinit(self: *Response, shutdown: bool, session: *Session) void {
+pub fn deinit(self: *Response, session: *Session) void {
     if (self._transfer) |transfer| {
-        if (shutdown) {
-            transfer.terminate();
-        } else {
-            transfer.abort(error.Abort);
-        }
+        transfer.abort(error.Abort);
         self._transfer = null;
     }
     session.releaseArena(self._arena);
 }
 
+pub fn releaseRef(self: *Response, session: *Session) void {
+    self._rc.release(self, session);
+}
+
+pub fn acquireRef(self: *Response) void {
+    self._rc.acquire();
+}
+
 pub fn getStatus(self: *const Response) u16 {
     return self._status;
 }
@@ -197,8 +203,6 @@ pub const JsApi = struct {
         pub const name = "Response";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(Response.deinit);
     };
 
     pub const constructor = bridge.constructor(Response.init, .{});

src/browser/webapi/net/XMLHttpRequest.zig

@@ -17,6 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 const std = @import("std");
+const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");
 
 const log = @import("../../../log.zig");
@@ -38,6 +39,7 @@ const Allocator = std.mem.Allocator;
 const IS_DEBUG = @import("builtin").mode == .Debug;
 
 const XMLHttpRequest = @This();
+_rc: lp.RC(u8) = .{},
 _page: *Page,
 _proto: *XMLHttpRequestEventTarget,
 _arena: Allocator,
@@ -87,21 +89,18 @@ const ResponseType = enum {
 pub fn init(page: *Page) !*XMLHttpRequest {
     const arena = try page.getArena(.{ .debug = "XMLHttpRequest" });
     errdefer page.releaseArena(arena);
-    return page._factory.xhrEventTarget(arena, XMLHttpRequest{
+    const xhr = try page._factory.xhrEventTarget(arena, XMLHttpRequest{
         ._page = page,
         ._arena = arena,
         ._proto = undefined,
         ._request_headers = try Headers.init(null, page),
     });
+    return xhr;
 }
 
-pub fn deinit(self: *XMLHttpRequest, shutdown: bool, session: *Session) void {
+pub fn deinit(self: *XMLHttpRequest, session: *Session) void {
     if (self._transfer) |transfer| {
-        if (shutdown) {
-            transfer.terminate();
-        } else {
-            transfer.abort(error.Abort);
-        }
+        transfer.abort(error.Abort);
         self._transfer = null;
     }
 
@@ -137,6 +136,14 @@ pub fn deinit(self: *XMLHttpRequest, shutdown: bool, session: *Session) void {
     session.releaseArena(self._arena);
 }
 
+pub fn releaseRef(self: *XMLHttpRequest, session: *Session) void {
+    self._rc.release(self, session);
+}
+
+pub fn acquireRef(self: *XMLHttpRequest) void {
+    self._rc.acquire();
+}
+
 fn asEventTarget(self: *XMLHttpRequest) *EventTarget {
     return self._proto._proto;
 }
@@ -224,7 +231,7 @@ pub fn send(self: *XMLHttpRequest, body_: ?[]const u8) !void {
 
     try self._request_headers.populateHttpHeader(page.call_arena, &headers);
     if (cookie_support) {
-        try page.headersForRequest(&headers);
+        try page.headersForRequest(self._arena, self._url, &headers);
     }
 
     try http_client.request(.{
@@ -235,7 +242,6 @@ pub fn send(self: *XMLHttpRequest, body_: ?[]const u8) !void {
         .frame_id = page._frame_id,
         .body = self._request_body,
         .cookie_jar = if (cookie_support) &page._session.cookie_jar else null,
-        .cookie_origin = page.url,
         .resource_type = .xhr,
         .notification = page._session.notification,
         .start_callback = httpStartCallback,
@@ -245,8 +251,6 @@ pub fn send(self: *XMLHttpRequest, body_: ?[]const u8) !void {
         .error_callback = httpErrorCallback,
         .shutdown_callback = httpShutdownCallback,
     });
-
-    page.js.strongRef(self);
 }
 
 fn handleBlobUrl(self: *XMLHttpRequest, page: *Page) !void {
@@ -388,6 +392,7 @@ fn httpStartCallback(transfer: *HttpClient.Transfer) !void {
         log.debug(.http, "request start", .{ .method = self._method, .url = self._url, .source = "xhr" });
     }
     self._transfer = transfer;
+    self.acquireRef();
 }
 
 fn httpHeaderCallback(transfer: *HttpClient.Transfer, header: net_http.Header) !void {
@@ -486,15 +491,17 @@ fn httpDoneCallback(ctx: *anyopaque) !void {
         .loaded = loaded,
     }, page);
 
-    page.js.weakRef(self);
+    self.releaseRef(page._session);
 }
 
 fn httpErrorCallback(ctx: *anyopaque, err: anyerror) void {
     const self: *XMLHttpRequest = @ptrCast(@alignCast(ctx));
     // http client will close it after an error, it isn't safe to keep around
-    self._transfer = null;
     self.handleError(err);
-    self._page.js.weakRef(self);
+    if (self._transfer != null) {
+        self._transfer = null;
+        self.releaseRef(self._page._session);
+    }
 }
 
 fn httpShutdownCallback(ctx: *anyopaque) void {
@@ -505,10 +512,10 @@ fn httpShutdownCallback(ctx: *anyopaque) void {
 pub fn abort(self: *XMLHttpRequest) void {
     self.handleError(error.Abort);
     if (self._transfer) |transfer| {
-        transfer.abort(error.Abort);
         self._transfer = null;
+        transfer.abort(error.Abort);
+        self.releaseRef(self._page._session);
     }
-    self._page.js.weakRef(self);
 }
 
 fn handleError(self: *XMLHttpRequest, err: anyerror) void {
@@ -582,8 +589,6 @@ pub const JsApi = struct {
         pub const name = "XMLHttpRequest";
         pub const prototype_chain = bridge.prototypeChain();
         pub var class_id: bridge.ClassId = undefined;
-        pub const weak = true;
-        pub const finalizer = bridge.finalizer(XMLHttpRequest.deinit);
     };
 
     pub const constructor = bridge.constructor(XMLHttpRequest.init, .{});

src/cdp/CDP.zig

@@ -468,8 +468,8 @@ pub fn BrowserContext(comptime CDP_T: type) type {
             if (self.http_proxy_changed) {
                 // has to be called after browser.closeSession, since it won't
                 // work if there are active connections.
-                browser.http_client.changeProxy(null) catch |err| {
-                    log.warn(.http, "changeProxy", .{ .err = err });
+                browser.http_client.restoreOriginalProxy() catch |err| {
+                    log.warn(.http, "restoreOriginalProxy", .{ .err = err });
                 };
             }
             self.intercept_state.deinit();

src/cdp/domains/network.zig

@@ -351,10 +351,6 @@ pub const TransferAsRequestWriter = struct {
                 try jws.objectField(hdr.name);
                 try jws.write(hdr.value);
             }
-            if (try transfer.getCookieString()) |cookies| {
-                try jws.objectField("Cookie");
-                try jws.write(cookies[0 .. cookies.len - 1]);
-            }
             try jws.endObject();
         }
         try jws.endObject();

src/lightpanda.zig

@@ -209,6 +209,37 @@ noinline fn assertionFailure(comptime ctx: []const u8, args: anytype) noreturn {
     @import("crash_handler.zig").crash(ctx, args, @returnAddress());
 }
 
+// Reference counting helper
+pub fn RC(comptime T: type) type {
+    return struct {
+        _refs: T = 0,
+
+        pub fn init(refs: T) @This() {
+            return .{ ._refs = refs };
+        }
+
+        pub fn acquire(self: *@This()) void {
+            self._refs += 1;
+        }
+
+        pub fn release(self: *@This(), value: anytype, session: *Session) void {
+            if (comptime IS_DEBUG) {
+                std.debug.assert(self._refs > 0);
+            }
+
+            const refs = self._refs - 1;
+            self._refs = refs;
+            if (refs > 0) {
+                return;
+            }
+            value.deinit(session);
+            if (session.finalizer_callbacks.fetchRemove(@intFromPtr(value))) |kv| {
+                session.releaseArena(kv.value.arena);
+            }
+        }
+    };
+}
+
 test {
     std.testing.refAllDecls(@This());
 }

src/mcp.zig

@@ -1,7 +1,6 @@
 const std = @import("std");
 
 pub const protocol = @import("mcp/protocol.zig");
-pub const Version = protocol.Version;
 pub const router = @import("mcp/router.zig");
 pub const Server = @import("mcp/Server.zig");
 

src/mcp/Server.zig

@@ -114,7 +114,7 @@ test "MCP.Server - Integration: synchronous smoke test" {
 
     try router.processRequests(server, &in_reader);
 
-    try testing.expectJson(.{ .jsonrpc = "2.0", .id = 1, .result = .{ .protocolVersion = "2024-11-05" } }, out_alloc.writer.buffered());
+    try testing.expectJson(.{ .jsonrpc = "2.0", .id = 1 }, out_alloc.writer.buffered());
 }
 
 test "MCP.Server - Integration: ping request returns an empty result" {

src/mcp/protocol.zig

@@ -1,14 +1,5 @@
 const std = @import("std");
 
-pub const Version = enum {
-    @"2024-11-05",
-    @"2025-03-26",
-    @"2025-06-18",
-    @"2025-11-25",
-
-    pub const default: Version = .@"2024-11-05";
-};
-
 pub const Request = struct {
     jsonrpc: []const u8 = "2.0",
     id: ?std.json.Value = null,

src/mcp/router.zig

@@ -81,8 +81,8 @@ pub fn handleMessage(server: *Server, arena: std.mem.Allocator, msg: []const u8)
 
 fn handleInitialize(server: *Server, req: protocol.Request) !void {
     const id = req.id orelse return;
-    const result: protocol.InitializeResult = .{
-        .protocolVersion = server.app.config.mcpVersion(),
+    const result = protocol.InitializeResult{
+        .protocolVersion = "2025-11-25",
         .capabilities = .{
             .resources = .{},
             .tools = .{},
@@ -121,7 +121,7 @@ test "MCP.router - handleMessage - synchronous unit tests" {
         \\{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test-client","version":"1.0.0"}}}
     );
     try testing.expectJson(
-        \\{ "jsonrpc": "2.0", "id": 1, "result": { "protocolVersion": "2024-11-05", "capabilities": { "tools": {} } } }
+        \\{ "jsonrpc": "2.0", "id": 1, "result": { "capabilities": { "tools": {} } } }
     , out_alloc.writer.buffered());
     out_alloc.writer.end = 0;
 

src/network/Runtime.zig

@@ -461,7 +461,7 @@ fn drainQueue(self: *Runtime) void {
             self.releaseConnection(conn);
             continue;
         };
-        libcurl.curl_multi_add_handle(multi, conn._easy) catch |err| {
+        libcurl.curl_multi_add_handle(multi, conn.easy) catch |err| {
             lp.log.err(.app, "curl multi add", .{ .err = err });
             self.releaseConnection(conn);
         };
@@ -565,7 +565,7 @@ pub fn getConnection(self: *Runtime) ?*net_http.Connection {
 }
 
 pub fn releaseConnection(self: *Runtime, conn: *net_http.Connection) void {
-    conn.reset(self.config, self.ca_blob) catch |err| {
+    conn.reset() catch |err| {
         lp.assert(false, "couldn't reset curl easy", .{ .err = err });
     };
 

src/network/http.zig

@@ -54,13 +54,14 @@ pub const Header = struct {
 
 pub const Headers = struct {
     headers: ?*libcurl.CurlSList,
+    cookies: ?[*c]const u8,
 
     pub fn init(user_agent: [:0]const u8) !Headers {
         const header_list = libcurl.curl_slist_append(null, user_agent);
         if (header_list == null) {
             return error.OutOfMemory;
         }
-        return .{ .headers = header_list };
+        return .{ .headers = header_list, .cookies = null };
     }
 
     pub fn deinit(self: *const Headers) void {
@@ -91,14 +92,20 @@ pub const Headers = struct {
     pub fn iterator(self: *Headers) Iterator {
         return .{
             .header = self.headers,
+            .cookies = self.cookies,
         };
     }
 
     const Iterator = struct {
         header: [*c]libcurl.CurlSList,
+        cookies: ?[*c]const u8,
 
         pub fn next(self: *Iterator) ?Header {
-            const h = self.header orelse return null;
+            const h = self.header orelse {
+                const cookies = self.cookies orelse return null;
+                self.cookies = null;
+                return .{ .name = "Cookie", .value = std.mem.span(@as([*:0]const u8, cookies)) };
+            };
 
             self.header = h.*.next;
             return parseHeader(std.mem.span(@as([*:0]const u8, @ptrCast(h.*.data))));
@@ -125,7 +132,7 @@ pub const HeaderIterator = union(enum) {
         prev: ?*libcurl.CurlHeader = null,
 
         pub fn next(self: *CurlHeaderIterator) ?Header {
-            const h = libcurl.curl_easy_nextheader(self.conn._easy, .header, -1, self.prev) orelse return null;
+            const h = libcurl.curl_easy_nextheader(self.conn.easy, .header, -1, self.prev) orelse return null;
             self.prev = h;
 
             const header = h.*;
@@ -157,24 +164,33 @@ const HeaderValue = struct {
 };
 
 pub const AuthChallenge = struct {
-    const Source = enum { server, proxy };
-    const Scheme = enum { basic, digest };
-
     status: u16,
-    source: ?Source,
-    scheme: ?Scheme,
+    source: ?enum { server, proxy },
+    scheme: ?enum { basic, digest },
     realm: ?[]const u8,
 
-    pub fn parse(status: u16, source: Source, value: []const u8) !AuthChallenge {
+    pub fn parse(status: u16, header: []const u8) !AuthChallenge {
         var ac: AuthChallenge = .{
             .status = status,
-            .source = source,
+            .source = null,
             .realm = null,
             .scheme = null,
         };
 
-        const pos = std.mem.indexOfPos(u8, std.mem.trim(u8, value, std.ascii.whitespace[0..]), 0, " ") orelse value.len;
-        const _scheme = value[0..pos];
+        const sep = std.mem.indexOfPos(u8, header, 0, ": ") orelse return error.InvalidHeader;
+        const hname = header[0..sep];
+        const hvalue = header[sep + 2 ..];
+
+        if (std.ascii.eqlIgnoreCase("WWW-Authenticate", hname)) {
+            ac.source = .server;
+        } else if (std.ascii.eqlIgnoreCase("Proxy-Authenticate", hname)) {
+            ac.source = .proxy;
+        } else {
+            return error.InvalidAuthChallenge;
+        }
+
+        const pos = std.mem.indexOfPos(u8, std.mem.trim(u8, hvalue, std.ascii.whitespace[0..]), 0, " ") orelse hvalue.len;
+        const _scheme = hvalue[0..pos];
         if (std.ascii.eqlIgnoreCase(_scheme, "basic")) {
             ac.scheme = .basic;
         } else if (std.ascii.eqlIgnoreCase(_scheme, "digest")) {
@@ -210,28 +226,77 @@ pub const ResponseHead = struct {
 };
 
 pub const Connection = struct {
-    _easy: *libcurl.Curl,
+    easy: *libcurl.Curl,
     node: std.DoublyLinkedList.Node = .{},
 
     pub fn init(
-        ca_blob: ?libcurl.CurlBlob,
+        ca_blob_: ?libcurl.CurlBlob,
         config: *const Config,
     ) !Connection {
         const easy = libcurl.curl_easy_init() orelse return error.FailedToInitializeEasy;
+        errdefer libcurl.curl_easy_cleanup(easy);
 
-        const self = Connection{ ._easy = easy };
-        errdefer self.deinit();
+        // timeouts
+        try libcurl.curl_easy_setopt(easy, .timeout_ms, config.httpTimeout());
+        try libcurl.curl_easy_setopt(easy, .connect_timeout_ms, config.httpConnectTimeout());
 
-        try self.reset(config, ca_blob);
-        return self;
+        // redirect behavior
+        try libcurl.curl_easy_setopt(easy, .max_redirs, config.httpMaxRedirects());
+        try libcurl.curl_easy_setopt(easy, .follow_location, 2);
+        try libcurl.curl_easy_setopt(easy, .redir_protocols_str, "HTTP,HTTPS"); // remove FTP and FTPS from the default
+
+        // proxy
+        const http_proxy = config.httpProxy();
+        if (http_proxy) |proxy| {
+            try libcurl.curl_easy_setopt(easy, .proxy, proxy.ptr);
+        }
+
+        // tls
+        if (ca_blob_) |ca_blob| {
+            try libcurl.curl_easy_setopt(easy, .ca_info_blob, ca_blob);
+            if (http_proxy != null) {
+                try libcurl.curl_easy_setopt(easy, .proxy_ca_info_blob, ca_blob);
+            }
+        } else {
+            assert(config.tlsVerifyHost() == false, "Http.init tls_verify_host", .{});
+
+            try libcurl.curl_easy_setopt(easy, .ssl_verify_host, false);
+            try libcurl.curl_easy_setopt(easy, .ssl_verify_peer, false);
+
+            if (http_proxy != null) {
+                try libcurl.curl_easy_setopt(easy, .proxy_ssl_verify_host, false);
+                try libcurl.curl_easy_setopt(easy, .proxy_ssl_verify_peer, false);
+            }
+        }
+
+        // compression, don't remove this. CloudFront will send gzip content
+        // even if we don't support it, and then it won't be decompressed.
+        // empty string means: use whatever's available
+        try libcurl.curl_easy_setopt(easy, .accept_encoding, "");
+
+        // debug
+        if (comptime ENABLE_DEBUG) {
+            try libcurl.curl_easy_setopt(easy, .verbose, true);
+
+            // Sometimes the default debug output hides some useful data. You can
+            // uncomment the following line (BUT KEEP THE LIVE ABOVE AS-IS), to
+            // get more control over the data (specifically, the `CURLINFO_TEXT`
+            // can include useful data).
+
+            // try libcurl.curl_easy_setopt(easy, .debug_function, debugCallback);
+        }
+
+        return .{
+            .easy = easy,
+        };
     }
 
     pub fn deinit(self: *const Connection) void {
-        libcurl.curl_easy_cleanup(self._easy);
+        libcurl.curl_easy_cleanup(self.easy);
     }
 
     pub fn setURL(self: *const Connection, url: [:0]const u8) !void {
-        try libcurl.curl_easy_setopt(self._easy, .url, url.ptr);
+        try libcurl.curl_easy_setopt(self.easy, .url, url.ptr);
     }
 
     // a libcurl request has 2 methods. The first is the method that
@@ -254,7 +319,7 @@ pub const Connection = struct {
     // can infer that based on the presence of the body, but we also reset it
     // to be safe);
     pub fn setMethod(self: *const Connection, method: Method) !void {
-        const easy = self._easy;
+        const easy = self.easy;
         const m: [:0]const u8 = switch (method) {
             .GET => "GET",
             .POST => "POST",
@@ -269,97 +334,56 @@ pub const Connection = struct {
     }
 
     pub fn setBody(self: *const Connection, body: []const u8) !void {
-        const easy = self._easy;
+        const easy = self.easy;
         try libcurl.curl_easy_setopt(easy, .post, true);
         try libcurl.curl_easy_setopt(easy, .post_field_size, body.len);
         try libcurl.curl_easy_setopt(easy, .copy_post_fields, body.ptr);
     }
 
     pub fn setGetMode(self: *const Connection) !void {
-        try libcurl.curl_easy_setopt(self._easy, .http_get, true);
+        try libcurl.curl_easy_setopt(self.easy, .http_get, true);
     }
 
     pub fn setHeaders(self: *const Connection, headers: *Headers) !void {
-        try libcurl.curl_easy_setopt(self._easy, .http_header, headers.headers);
+        try libcurl.curl_easy_setopt(self.easy, .http_header, headers.headers);
     }
 
     pub fn setCookies(self: *const Connection, cookies: [*c]const u8) !void {
-        try libcurl.curl_easy_setopt(self._easy, .cookie, cookies);
+        try libcurl.curl_easy_setopt(self.easy, .cookie, cookies);
     }
 
     pub fn setPrivate(self: *const Connection, ptr: *anyopaque) !void {
-        try libcurl.curl_easy_setopt(self._easy, .private, ptr);
+        try libcurl.curl_easy_setopt(self.easy, .private, ptr);
     }
 
     pub fn setProxyCredentials(self: *const Connection, creds: [:0]const u8) !void {
-        try libcurl.curl_easy_setopt(self._easy, .proxy_user_pwd, creds.ptr);
+        try libcurl.curl_easy_setopt(self.easy, .proxy_user_pwd, creds.ptr);
     }
 
     pub fn setCredentials(self: *const Connection, creds: [:0]const u8) !void {
-        try libcurl.curl_easy_setopt(self._easy, .user_pwd, creds.ptr);
+        try libcurl.curl_easy_setopt(self.easy, .user_pwd, creds.ptr);
     }
 
     pub fn setCallbacks(
-        self: *Connection,
+        self: *const Connection,
+        comptime header_cb: libcurl.CurlHeaderFunction,
         comptime data_cb: libcurl.CurlWriteFunction,
     ) !void {
-        try libcurl.curl_easy_setopt(self._easy, .write_data, self);
-        try libcurl.curl_easy_setopt(self._easy, .write_function, data_cb);
+        try libcurl.curl_easy_setopt(self.easy, .header_data, self.easy);
+        try libcurl.curl_easy_setopt(self.easy, .header_function, header_cb);
+        try libcurl.curl_easy_setopt(self.easy, .write_data, self.easy);
+        try libcurl.curl_easy_setopt(self.easy, .write_function, data_cb);
     }
 
-    pub fn reset(
-        self: *const Connection,
-        config: *const Config,
-        ca_blob: ?libcurl.CurlBlob,
-    ) !void {
-        libcurl.curl_easy_reset(self._easy);
+    pub fn reset(self: *const Connection) !void {
+        try libcurl.curl_easy_setopt(self.easy, .proxy, null);
+        try libcurl.curl_easy_setopt(self.easy, .http_header, null);
 
-        // timeouts
-        try libcurl.curl_easy_setopt(self._easy, .timeout_ms, config.httpTimeout());
-        try libcurl.curl_easy_setopt(self._easy, .connect_timeout_ms, config.httpConnectTimeout());
+        try libcurl.curl_easy_setopt(self.easy, .header_data, null);
+        try libcurl.curl_easy_setopt(self.easy, .header_function, null);
 
-        // compression, don't remove this. CloudFront will send gzip content
-        // even if we don't support it, and then it won't be decompressed.
-        // empty string means: use whatever's available
-        try libcurl.curl_easy_setopt(self._easy, .accept_encoding, "");
-
-        // proxy
-        const http_proxy = config.httpProxy();
-        if (http_proxy) |proxy| {
-            try libcurl.curl_easy_setopt(self._easy, .proxy, proxy.ptr);
-        } else {
-            try libcurl.curl_easy_setopt(self._easy, .proxy, null);
-        }
-
-        // tls
-        if (ca_blob) |ca| {
-            try libcurl.curl_easy_setopt(self._easy, .ca_info_blob, ca);
-            if (http_proxy != null) {
-                try libcurl.curl_easy_setopt(self._easy, .proxy_ca_info_blob, ca);
-            }
-        } else {
-            assert(config.tlsVerifyHost() == false, "Http.init tls_verify_host", .{});
-
-            try libcurl.curl_easy_setopt(self._easy, .ssl_verify_host, false);
-            try libcurl.curl_easy_setopt(self._easy, .ssl_verify_peer, false);
-
-            if (http_proxy != null) {
-                try libcurl.curl_easy_setopt(self._easy, .proxy_ssl_verify_host, false);
-                try libcurl.curl_easy_setopt(self._easy, .proxy_ssl_verify_peer, false);
-            }
-        }
-
-        // debug
-        if (comptime ENABLE_DEBUG) {
-            try libcurl.curl_easy_setopt(self._easy, .verbose, true);
-
-            // Sometimes the default debug output hides some useful data. You can
-            // uncomment the following line (BUT KEEP THE LIVE ABOVE AS-IS), to
-            // get more control over the data (specifically, the `CURLINFO_TEXT`
-            // can include useful data).
-
-            // try libcurl.curl_easy_setopt(easy, .debug_function, debugCallback);
-        }
+        try libcurl.curl_easy_setopt(self.easy, .write_data, null);
+        try libcurl.curl_easy_setopt(self.easy, .write_function, discardBody);
     }
 
     fn discardBody(_: [*]const u8, count: usize, len: usize, _: ?*anyopaque) usize {
@@ -367,31 +391,27 @@ pub const Connection = struct {
     }
 
     pub fn setProxy(self: *const Connection, proxy: ?[:0]const u8) !void {
-        try libcurl.curl_easy_setopt(self._easy, .proxy, if (proxy) |p| p.ptr else null);
-    }
-
-    pub fn setFollowLocation(self: *const Connection, follow: bool) !void {
-        try libcurl.curl_easy_setopt(self._easy, .follow_location, @as(c_long, if (follow) 2 else 0));
+        try libcurl.curl_easy_setopt(self.easy, .proxy, if (proxy) |p| p.ptr else null);
     }
 
     pub fn setTlsVerify(self: *const Connection, verify: bool, use_proxy: bool) !void {
-        try libcurl.curl_easy_setopt(self._easy, .ssl_verify_host, verify);
-        try libcurl.curl_easy_setopt(self._easy, .ssl_verify_peer, verify);
+        try libcurl.curl_easy_setopt(self.easy, .ssl_verify_host, verify);
+        try libcurl.curl_easy_setopt(self.easy, .ssl_verify_peer, verify);
         if (use_proxy) {
-            try libcurl.curl_easy_setopt(self._easy, .proxy_ssl_verify_host, verify);
-            try libcurl.curl_easy_setopt(self._easy, .proxy_ssl_verify_peer, verify);
+            try libcurl.curl_easy_setopt(self.easy, .proxy_ssl_verify_host, verify);
+            try libcurl.curl_easy_setopt(self.easy, .proxy_ssl_verify_peer, verify);
         }
     }
 
     pub fn getEffectiveUrl(self: *const Connection) ![*c]const u8 {
         var url: [*c]u8 = undefined;
-        try libcurl.curl_easy_getinfo(self._easy, .effective_url, &url);
+        try libcurl.curl_easy_getinfo(self.easy, .effective_url, &url);
         return url;
     }
 
     pub fn getResponseCode(self: *const Connection) !u16 {
         var status: c_long = undefined;
-        try libcurl.curl_easy_getinfo(self._easy, .response_code, &status);
+        try libcurl.curl_easy_getinfo(self.easy, .response_code, &status);
         if (status < 0 or status > std.math.maxInt(u16)) {
             return 0;
         }
@@ -400,13 +420,13 @@ pub const Connection = struct {
 
     pub fn getRedirectCount(self: *const Connection) !u32 {
         var count: c_long = undefined;
-        try libcurl.curl_easy_getinfo(self._easy, .redirect_count, &count);
+        try libcurl.curl_easy_getinfo(self.easy, .redirect_count, &count);
         return @intCast(count);
     }
 
     pub fn getResponseHeader(self: *const Connection, name: [:0]const u8, index: usize) ?HeaderValue {
         var hdr: ?*libcurl.CurlHeader = null;
-        libcurl.curl_easy_header(self._easy, name, index, .header, -1, &hdr) catch |err| {
+        libcurl.curl_easy_header(self.easy, name, index, .header, -1, &hdr) catch |err| {
             // ErrorHeader includes OutOfMemory — rare but real errors from curl internals.
             // Logged and returned as null since callers don't expect errors.
             log.err(.http, "get response header", .{
@@ -424,7 +444,7 @@ pub const Connection = struct {
 
     pub fn getPrivate(self: *const Connection) !*anyopaque {
         var private: *anyopaque = undefined;
-        try libcurl.curl_easy_getinfo(self._easy, .private, &private);
+        try libcurl.curl_easy_getinfo(self.easy, .private, &private);
         return private;
     }
 
@@ -441,7 +461,12 @@ pub const Connection = struct {
         try self.secretHeaders(&header_list, http_headers);
         try self.setHeaders(&header_list);
 
-        try libcurl.curl_easy_perform(self._easy);
+        // Add cookies.
+        if (header_list.cookies) |cookies| {
+            try self.setCookies(cookies);
+        }
+
+        try libcurl.curl_easy_perform(self.easy);
         return self.getResponseCode();
     }
 };
@@ -463,11 +488,11 @@ pub const Handles = struct {
     }
 
     pub fn add(self: *Handles, conn: *const Connection) !void {
-        try libcurl.curl_multi_add_handle(self.multi, conn._easy);
+        try libcurl.curl_multi_add_handle(self.multi, conn.easy);
     }
 
     pub fn remove(self: *Handles, conn: *const Connection) !void {
-        try libcurl.curl_multi_remove_handle(self.multi, conn._easy);
+        try libcurl.curl_multi_remove_handle(self.multi, conn.easy);
     }
 
     pub fn perform(self: *Handles) !c_int {
@@ -490,7 +515,7 @@ pub const Handles = struct {
         const msg = libcurl.curl_multi_info_read(self.multi, &messages_count) orelse return null;
         return switch (msg.data) {
             .done => |err| .{
-                .conn = .{ ._easy = msg.easy_handle },
+                .conn = .{ .easy = msg.easy_handle },
                 .err = err,
             },
             else => unreachable,

src/sys/libcurl.zig

@@ -516,10 +516,6 @@ pub fn curl_easy_cleanup(easy: *Curl) void {
     c.curl_easy_cleanup(easy);
 }
 
-pub fn curl_easy_reset(easy: *Curl) void {
-    c.curl_easy_reset(easy);
-}
-
 pub fn curl_easy_perform(easy: *Curl) Error!void {
     try errorCheck(c.curl_easy_perform(easy));
 }