1415740 - PerformanceResourceTiming.workerStart should not be restricted by Timing-Allow-Origin

Status: RESOLVED FIXED

(Core :: DOM: Service Workers, enhancement)

Description

[Ben Kelly [:bkelly, not reviewing]]

When I implemented workerStart in bug 1191943 I accidentally copied code that restricts it to same-origin or Timing-Allow-Origin.  The spec does not say to do this:

https://w3c.github.io/resource-timing/#dom-performanceresourcetiming-workerstart

In particular, this prevents the workerStart from showing up for typical CDN hosted image requests.

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P1 Allow PerformanceResourceTiming.workerStart to be accessed on no-cors resources without Timing-Allow-Origin. r=baku

This fixes the problem.  I can write a WPT test for this.  I verified it makes firefox match chrome behavior manually.

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

Comment on attachment 8926659 [details] [diff] [review]
P1 Allow PerformanceResourceTiming.workerStart to be accessed on no-cors resources without Timing-Allow-Origin. r=baku

Andrea, this removes the same-origin or Timing-Allow-Origin header restriction I accidentally used when first implementing workerStart.  Per the spec here we shouldn't use it:

https://w3c.github.io/resource-timing/#dom-performanceresourcetiming-workerstart

Chrome also matches this behavior.

Comment 3

[Ben Kelly [:bkelly, not reviewing]]

I'll still add a WPT test before landing this.

Comment 4

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P2 Add a WPT test to verify we report workerStart on cross-origin no-cors requests, like <img>. r=baku

Andrea, this patch adds a cross-origin <img> load to the resource-timing.https.html test.  We should see workerStart here, but per the spec responseStart should not be shown.

Without the P1 patch we fail this test due to the missing workerStart.  With the P1 patch we pass this test.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2f496f8ba892
P1 Allow PerformanceResourceTiming.workerStart to be accessed on no-cors resources without Timing-Allow-Origin. r=baku
https://hg.mozilla.org/integration/mozilla-inbound/rev/56b28c7bc989
P2 Add a WPT test to verify we report workerStart on cross-origin no-cors requests, like <img>. r=baku

Comment 6

[Ben Kelly [:bkelly, not reviewing]]

Backed out the WPT in P2 because I forgot to update the manifest:

https://hg.mozilla.org/integration/mozilla-inbound/rev/9c74e8d1e1c3c31fe672058c4d6e09dd07f512ad

Comment 7

[Ben Kelly [:bkelly, not reviewing]]

Attachment: P2 Add a WPT test to verify we report workerStart on cross-origin no-cors requests, like <img>. r=baku

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4762a6f87238
P2 Add a WPT test to verify we report workerStart on cross-origin no-cors requests, like <img>. r=baku

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/2f496f8ba892
https://hg.mozilla.org/mozilla-central/rev/4762a6f87238