auto-injection breaks nested ES module Workers

[sheltondong]

Spector.js auto-injection breaks nested ES module Workers

Summary

With the Spector.js browser extension 0.9.33 enabled, a nested ES module Worker fails to start. Disabling the extension makes the same application and browser succeed.

Spector.js documents that spyWorkers() monkey-patches the global Worker constructor to inject its Worker bundle, and that the auto-injection path may fail for ES module Workers. This report requests a safe fallback rather than a broken Worker startup.

Expected behavior

Instrumentation must preserve the URL and origin semantics of module Workers. If automatic injection is unsupported, Spector.js should use the native Worker constructor unchanged.

Actual behavior

The nested Worker is constructed with a local file: URL and the browser rejects it as cross-origin:

SecurityError: Failed to construct 'Worker': Script at
'file:///path/to/child-worker.js' cannot be accessed from origin
'https://example.test'.

The stack includes a Blob-based wrapper around self.Worker, indicating that Worker construction has been intercepted.

Minimal reproduction

main.js:

const parent = new Worker(new URL("./parent.js", import.meta.url), { type: "module" });
parent.postMessage("start");

parent.js:

self.onmessage = () => {
  const child = new Worker(new URL("./child.js", import.meta.url), { type: "module" });
  child.postMessage("ping");
};

child.js:

self.onmessage = () => self.postMessage("pong");

Steps:

1. Serve these files from an HTTPS origin with a standard bundler that supports new Worker(new URL(..., import.meta.url), { type: "module" }).
2. Enable Spector.js 0.9.33.
3. Load the page and trigger the start message.
4. Observe that nested Worker creation fails with the SecurityError above.
5. Disable Spector.js and repeat: the nested Worker starts successfully.

Requested fix

• Do not intercept module Workers when injection cannot preserve their native URL and origin semantics.
• Fall back to the original Worker constructor instead of generating a Blob wrapper that leads to a file: URL.
• Add an automated regression test for nested module Workers.

Related documentation

• Spector.js Worker auto-injection and its documented ES module Worker limitation
• Spector.js 0.9.33 changelog

[sebavan]

Thanks for the report, I will address it tonight.

[sebavan]

I rolled back the online extension as a mitigation.