Source Map is downloaded during performance audit

[developit]

Provide the steps to reproduce

1. Run LH on https://preactjs.com

What is the current behavior?

During the lighthouse Performance audit, Source Map files are downloaded:

lighthouse-sourcemap-download.mov

What is the expected behavior?

No downloads are triggered during Lighthouse execution.

Environment Information

• Affected Channels: Extension (did not test others)
• Lighthouse version: 7.0.0
• Chrome version: 89.0.4389.40 (Official Build) beta (x86_64)
• Node.js version: 12.9
• Operating System: MacOS

Related issues

https://support.google.com/webmasters/thread/86647663?hl=en

[paulirish]

Since we're a diagnostic tool, I think it's totally fair for Lighthouse to attempt these downloads. We do it to provide better detail and actionability in the opportunities.

Similarly, chrome devtools makes the same network requests if JS sourcemaps are enabled (the default).

I see the webmasters support thread.... but it's unclear how this is a problem for site owners... perhaps it's unexpected to see them in request logs?

[patrickhulce]

I think think the issue in the video that's valid is that it prompts Chrome's download UI. DevTools doesn't trigger Chrome's download UI. Probably to do with our weird iframe fetcher?

[brendankenny]

ah, yeah, I didn't spot that in the video either :) In theory the request should be cancelled and never download:

lighthouse/lighthouse-core/gather/fetcher.js

Lines 135 to 136 in aaf1365

	// Fail the request (from the page's perspective) so that the iframe never loads.
	await this.driver.sendCommand('Fetch.failRequest', {requestId, errorReason: 'Aborted'});

Can't repro in CLI but I can in DevTools (Chrome 90, Lighthouse 7.0.1).

[brendankenny]

Since we last discussed protocol support for fetching resources, the protocol method has landed (Network.loadNetworkResource), though I believe it still blocks the CORS case. Its options object does optimistically mention it "may be extended later to better support CORS, CORB and streaming", though.

[paulirish]

Since we last discussed protocol support for fetching resources, the protocol method has landed (Network.loadNetworkResource), though I believe it still blocks the CORS case. Its options object does optimistically mention it "may be extended later to better support CORS, CORB and streaming", though.

i looked into this stuff a bit and filed a new issue: Improve generalized/sourcemap fetcher #12070

[paulirish]

I was looking as to why one would use octet-stream as the mimetype for sourcemaps... Looks like some bozo confirmed it was fine 8 years ago. 😳

But yes unfortunately that mimetype + how lighthouse fetches == a download. We can change this in Lighthouse but, @developit, in the meantime.. serving sourcemaps as application/json would be the workaround.

[adamraine]

Should we close this in favor of #12070? The current fetcher is also incompatible with some CSPs.

Considering there are two issues breaking the current fetcher, we should probably seek a different implementation that uses Network.loadNetworkResource.

[paulirish]

Should we close this in favor of #12070?

good call. sg