Files
orca/config/scripts/mobile-web-app-preview-frame-diagnosis.mjs
Jinwoo Hong 963da57cc3 test(config): preview rig readiness polls the main world, never the utility world (Chrome 152 hang) (#21963)
* test(mobile): wait for the preview frame in its main world, and probe the world that hung

Three cases spent their whole 180s on CI's Chrome inside `waitForSelector('#marker')` while
the diagnosis reported, from the same frame, `readyState: complete` and `marker: true`.
Those two readings ask in different worlds. `frame.evaluate` needs only the frame's main
execution context; a selector wait needs Playwright's injected script in Chromium's utility
world, an isolated world created per document by a command whose failure the driver swallows
and whose creation event it drops for a frame the driver considers stale. With `timeout: 0`
a world that never arrives is a wait that never ends.

So readiness is main-world polling now: the frame is resolved again from `page.frames()` on
every attempt and the predicate runs through `frame.evaluate`, still bounded by the case's
own `ctx.signal` and still ending in the diagnosis. The evaluate is abandoned after a second
so a frame that never answers cannot outlive its own replacement.

The diagnosis gains the reading that would have settled this in one run: a bounded
`utilityWorld` probe per frame, printed beside the main-world reading, so the split is
measured rather than inferred again. The competing explanation is ruled out in code --
Playwright closes a detached frame's scope with an error that every wait races, so a stale
Frame rejects rather than hangs.

Not proven red-first. Chrome 152 is the only engine that has shown this and it is not
available here; chromium 147 and WebKit 26.4 both build the utility world and both report
`utilityWorld "resolved"` for the sealed `srcdoc` frame. What is proven locally: 18 of 18 on
both engines, and a deliberately marker-less artifact still ends in the diagnosis, with
exactly one line per case naming the wait that hung.

That last part needed a fix of its own: an abort listener left behind by a wait that had
already resolved printed its stale reading at a later wait's timeout, so every timeout spoke
with more voices than it had hung waits. The listener is dropped on the way out.

In-frame `frame.click` needs the utility world too and is left alone: a main-world click is
not a user gesture, and the gesture is what those cases assert on.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* test(mobile): take the preview's refusal from the browser's report, not from a listener in the frame

The utility-world theory is refuted: CI's Chrome answered `utilityWorld "resolved"` on both frames
and the case failed anyway, with the widened frame reporting the artifact parsed, the CSS
background's `img-src` refusal recorded, no `script-src` refusal, and no script run. Two different
things produce exactly that reading. The policy refused the script and the frame's own listener was
not there to see it, or the sandbox refused it first, which raises no violation at all -- and a
listener inside the frame cannot tell them apart, because in the second case there is nothing for it
to hear.

So the evidence moves to where neither depends on timing: the sealed server now appends `report-uri`
to the policy it serves, carrying the arm's nonce, and the rig records what the browser reports. The
override arm's precondition is a `script-src` report from this arm's frame, waited for under
`ctx.signal` and ending in the diagnosis. Measured on both engines: a widened frame is reported for
`script-src` and a sealed one never is, while both are reported for the image the policy refuses. So
the sealed arm now waits for its own `img-src` report, which turns "no script-src refusal here" from
an unguarded absence into one measured beside a presence.

`report-uri` is additive -- it names where a report goes and changes nothing about what is enforced
-- and the first case now pins that by splitting the served header and asserting the rest is the
shipped Kotlin text exactly.

The in-frame collector stays, for the diagnosis only, and it now carries the readings that would
have answered the ordering question in one run: the init script records when it ran in each frame,
the artifact's script records the same on the document element, and the diagnosis prints both. What
the artifact wrote moved off `window` entirely for the same reason -- a page init script owns the
window of every frame it reaches. Locally the init script precedes the artifact's by one
millisecond, in every arm on both engines; the ordering on Chrome 152 is now a reading rather than a
hypothesis.

A measurement worth keeping beside the code: in a frame with no `allow-scripts` the init script runs
and its array exists, and no violation event is ever delivered to it, while the browser reports the
same refusals to the server. That is why the old `violations` assertions could not have caught this.

Red-first, all three locally: with report recording off, with the report endpoint not appended, and
with `script-src` reports alone dropped, the preconditions time out into the diagnosis and the
served-policy assertion reds too. 18 of 18 on both engines, three runs.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb

* test(mobile): cover the navigation wait's sampling branch, and bind the load wait to the case

Two findings from the bots on the rig, both real.

The navigation wait's five-second sampling branch called `describePreviewFrame` after the import
that supplied it had gone. It fires only when an arm is slow, the name is evaluated before `.catch`
can attach, and `no-undef` is off, so nothing in the file or the lint run had ever executed that
line. Fixed by moving the settle waits into the readiness module, where the call sits beside the
import it needs rather than a file away from it -- the split is what let the reference dangle.

The proof is a case that drives the branch: a navigation the arm will never see, a sampling interval
passed in, and the case's own abort ending it, asserting on the reading it printed rather than on
its own absence of an error. Red-first, with only that branch's callee renamed: 2 failed, 18 passed,
`ReferenceError`. So the case covers the branch and nothing else in the file did.

The load-only arm's `frame.waitForLoadState('load')` was the one wait left that did not observe
`ctx.signal`; after an abort it kept waiting on its own timeout. It is a main-world poll on
`document.readyState` now, re-resolving the frame each attempt like every other wait here, and it
ends in the diagnosis.

20 of 20 on both engines, twice.

Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
2026-09-21 06:16:40 -04:00

142 lines
6.5 KiB
JavaScript

/**
* What the HTML preview's render rig can still read when a frame never becomes ready, and the bound
* it reads at.
*
* Separate from the test file because the file is at its line limit and because these two are one
* thing: a wait that ends only with the case, and the reading it prints when it does. The rig's
* claims stay in the test; this is the instrument that reports why one could not be made.
*/
/**
* A wait bounded by the case's own timeout and by nothing else.
*
* `ctx.signal` aborts when vitest times a case out, so no number in here races the one the case
* declares. On abort the rig prints what the frame reported -- the reading that tells a frame the
* policy refused from one that was merely slow, which is what CI's chromium timeouts could not say.
*
* The reading is sampled while waiting and printed from the last sample, never read at the abort:
* a reading taken after the case has timed out loses its race with vitest's teardown, which is how
* a first attempt at this printed nothing at all. Nothing is rethrown either -- a rejection raised
* after vitest has given up has nobody left to catch it, and an unhandled one fails a run whose
* every test passed.
*/
export async function untilAborted(wait, signal, describe) {
let latest = 'no reading was taken before the case ended'
let sampling = true
const sample = async () => {
// Once at the start and then every five seconds, so a case that ends early still has a reading to
// print. A wait that only ever prints "no reading was taken" tells nobody anything.
while (sampling) {
latest = await describe().catch(
(error) => `the reading itself failed: ${String(error).split('\n')[0]}`
)
await new Promise((resolve) => setTimeout(resolve, 5000))
}
}
void sample()
let report = null
await Promise.race([
wait,
new Promise((resolve) => {
if (!signal) {
return
}
if (signal.aborted) {
// Silent: the case was already over when this wait began, so it has nothing of its own to
// report and the wait that did time out has already printed its reading.
resolve()
return
}
report = () => {
console.error(`[html-preview-render] ${latest}`)
resolve()
}
signal.addEventListener('abort', report, { once: true })
})
]).catch(() => {})
sampling = false
// Dropped on the way out, so the wait that hung is the only one that speaks: a listener left by a
// wait that resolved prints its own stale reading at a later wait's timeout.
if (report) {
signal?.removeEventListener('abort', report)
}
}
/**
* Everything a frame that never became ready can still be asked, which is the whole diagnosis when
* the only oracle is a runner.
*
* Three readings, because each is blind where the others see. The element's own attributes come from
* the embedder and survive a frame that never parsed. `contentDocument` and `contentWindow` answer
* only for a frame granted `allow-same-origin`, and say `refused` for the opaque ones, which is
* itself the answer to "is this arm same-origin". And every Playwright frame is evaluated through
* CDP, which reaches an opaque frame whose own scripts are blocked, so `readyState` separates a
* document that never parsed from one that parsed and did nothing.
*
* The violations are read per frame rather than from the top. `securitypolicyviolation` does not
* cross frames, so the top document's array says nothing about what the frame refused -- and the
* page's init script installs the same collector in every frame, measured on both engines, so each
* frame has its own array to report.
*
* `utilityWorld` is the fourth reading, and it is the one the readings above cannot give. Everything
* else here is an evaluate, which needs only a frame's main context; a selector wait needs the
* injected script in Chromium's isolated world, created per document by a command whose failure the
* driver swallows. Three cases once spent their whole timeout in such a wait while an evaluate in
* the same frame answered, so the probe is bounded and reported rather than left to be inferred
* again. `unavailable` here and a main-world reading beside it is that split, measured.
*/
export async function describePreviewFrame(page, frame, browserVersion) {
const host = await page
.evaluate(() => {
const element = document.querySelector('iframe')
const reach = (read) => {
try {
return read() ?? null
} catch {
return 'refused'
}
}
return {
srcdocChars: element?.getAttribute('srcdoc')?.length ?? null,
sandbox: element?.getAttribute('sandbox') ?? null,
contentReadyState: reach(() => element?.contentDocument?.readyState),
contentHref: reach(() => element?.contentWindow?.location.href),
topViolations: window.__violations ?? null
}
})
.catch((error) => `page refused: ${String(error).split('\n')[0]}`)
const frames = []
for (const one of page.frames()) {
const reading = await one
.evaluate(() => ({
readyState: document.readyState,
bodyChars: document.body?.innerHTML.length ?? null,
marker: document.getElementById('marker') !== null,
ran: document.documentElement.dataset.ran ?? null,
// The order the collector's own reach depends on: when the page's init script ran here and
// when the artifact's script did. A listener installed after the parser reached the inline
// script can only report what came later.
initAt: window.__initAt ?? null,
artifactAt: document.documentElement.dataset.artifactAt ?? null,
violations: window.__violations ?? 'absent'
}))
.catch((error) => `evaluate refused: ${String(error).split('\n')[0]}`)
// Bounded, and the only wait in the diagnosis: a frame whose isolated world never arrives would
// otherwise hold the reading open for as long as the wait it is explaining.
const utilityWorld = await one
.locator('html')
.waitFor({ state: 'attached', timeout: 2000 })
.then(() => 'resolved')
.catch((error) => `unavailable: ${String(error).split('\n')[0]}`)
frames.push(
`${JSON.stringify(one.url())} name ${JSON.stringify(one.name())} utilityWorld ${JSON.stringify(utilityWorld)} ${JSON.stringify(reading)}`
)
}
return [
`browser ${browserVersion ?? 'unknown'}`,
`awaited frame url ${JSON.stringify(frame?.url() ?? null)}`,
`host ${JSON.stringify(host)}`,
`frames [${frames.join(' ;; ')}]`
].join(' | ')
}