commit 13b304e55680cd25041ae1efec49280af3c72bc0
author Yoshi Cheng-Hao Huang <allstars.chh@gmail.com> Mon Jun 12 10:24:32 2023
committer moz-wptsync-bot <wptsync@mozilla.com> Mon Jun 12 22:18:44 2023
tree 926a39331f5c13e1507bab510967b2a1d75a7354
parent 7c5bebb89c041d4be30168a88e60deda08ed4bb2

Update the WPT test for error handling behavior when worker loading a cross-origin script.

According to the spec, when a worker is trying to load a cross-origin
script, an onerror handler should be called. The detailed calling
sequence from the spec will be explained in the following paragraph. For the
legacy specification, it will be explained in the bottom.

So we look into current specification first:
(The numbers indicate the calling sequence)
= Explain the current behavior when a worker is trying to load a cross-origin script =

== 1. [run a worker](https://html.spec.whatwg.org/#run-a-worker)

14) [Fetch a classic worker script](https://html.spec.whatwg.org/#fetch-a-classic-worker-script) given url, outside settings, destination, inside settings, and with onComplete and performFetch as defined below
(Note: we use "fetch a classic worker script" as an example here)

== 2. [fetch a classic worker script](https://html.spec.whatwg.org/#fetch-a-classic-worker-script)

given a url, a fetch client settings object, a destination, a script settings object, an onComplete algorithm, and an optional perform the fetch hook performFetch

1) Let request be a new request whose ...  mode is "same-origin", ...

2) If performFetch was given, run performFetch with request, true, and with processResponseConsumeBody as defined below.

Note: Run the performFetch provided in (1),

== 3. performFetch defined in Step 14 of [run a worker](https://html.spec.whatwg.org/#run-a-worker)

...
3) [Fetch](https://fetch.spec.whatwg.org/#concept-fetch) request with processResponseConsumeBody set to the following steps given response response and null, failure, or a byte sequence bodyBytes:

== 4. [fetch](https://fetch.spec.whatwg.org/#concept-fetch)

given a request request, ..., an optional algorithm processResponseConsumeBody

7) Let fetchParams be a new fetch params whose request is request, ...,  process response consume body is processResponseConsumeBody
...
17) Run [main fetch](https://fetch.spec.whatwg.org/#concept-main-fetch) given fetchParams.

== 5. [main fetch](https://fetch.spec.whatwg.org/#concept-main-fetch)

given a fetch params fetchParams

12) If response is null, then set response to the result of running the steps corresponding to the first matching statement:

    - request’s current URL’s origin is same origin with request’s origin, and request’s response tainting is "basic":

    Note: Normal SOP script will execute this part, however in this case we are loading a script which is not the same-origin.
    So we will fallback to next statement.

    - request’s mode is "same-origin":
      - Return a network error.

== 6. processResponseConsumeBody defined in Step 2 of (2) [fetch a classic worker script](https://html.spec.whatwg.org/#fetch-a-classic-worker-script)

2) If either of the following conditions are met:
   - bodyBytes is null or failure; or
   - response's status is not an ok status,
     - then run onComplete given null, and abort these steps.

Note: Run onComplete provided in (1)

== 7. onComplete defined in Step 14 of (1) [run a worker](https://html.spec.whatwg.org/#run-a-worker)

1) If script is null or if script's error to rethrow is non-null, then:
   1) Queue a global task on the DOM manipulation task source given worker's relevant global object to fire an event named error at worker.

   2) Run the environment discarding steps for inside settings.

   3) Abort these steps.

---

So when a worker loads a cross-origin script, the worker.onerror(e) should be
called, where e is a Event whose name is "error".

= Explain the legacy behavior when a worker is trying to load a cross-origin script

In the older HTML spec before 2015. Nov,
The specification was actually defined how to handle cross-origin scripts for workers,
see http://web.archive.org/web/20151106154945/https://html.spec.whatwg.org/#dom-worker, step 5:

> If the scheme component of worker URL is not "data", and the origin of worker URL
> is not the same as the origin specified by the incumbent settings object, then
> throw a SecurityError exception and abort these steps.

However, the statement was removed in https://github.com/whatwg/html/commit/24242406daa40cfe5d97cdfbac463c29e63433fd
because the SOP check should be done in Fetch API.
But WPT doesn't get updated since then, so it caused different error
handling behavior between browsers since then.

Differential Revision: https://phabricator.services.mozilla.com/D179544

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1833891
gecko-commit: 73259a567a07812b46b8cefa04c2066f94d6724e
gecko-reviewers: dom-worker-reviewers, smaug, zcorpan