Exception reporting muting is not interoperable

[domenic]

What is the issue with the HTML Standard?

Previously: #958, #2440, #3149.

In some cases, exceptions that have something to do with cross-origin scripts are "muted", i.e. the error events get rewritten to have not much information.

Before #10404, the spec tried to pass around an appropriate script to every instance of exception reporting. There were only a few cases where the correct script was unambiguously passed; many others used "the relevant script" or "the appropriate script". The spec then consulted the script's muted errors flag.

In #10404, we gave up on this, and use the new verbiage

Let script be a script found in an implementation-defined way, or null. This should usually be the running script (most notably during run a classic script).

NOTE: Implementations have not yet settled on interoperable behavior for which script is used to determine whether errors are muted in less common cases.

This issue is about settling that problem.

---

Some suggestions (e.g. in #2440 or #5051) are to drop almost all muting, with the exception of the exceptions that occur during initial script parsing. Given what a mess we have here, I'm more open to this than I was in 2017. But, I doubt we will end up going that direction, since loosening security in a poorly-understood area is not going to be high priority for anyone. And I expect most work on this issue will be done as a side project, so people will not have the bandwidth to push such things through. So the rest of this issue assumes we're sticking with the goal of generally muting exceptions "coming from" cross-origin scripts, whatever that means.

---

There are two axes of difficulty here:

1. What does it mean for the error to "come from" cross-origin scripts. Discussed a bit at Clarify "report an exception" #958 (comment). E.g., if the exception object is constructed in a cross-origin script but thrown in a same-origin script, does it get muted? If a cross-origin script calls a same-origin script, is it muted? What about situations like same -> cross -> same, or cross -> same -> cross?

2. When do we consider whether to mute at all? Create a 'report an exception' algorithm per #958 #10404 (review) discusses this, by breaking down the possible exception reporting sites into categories from "run a script" (OK, obviously we can figure out whether that script is cross-origin) all the way to "there's definitely no script", e.g. declarative shadow DOM. In between there are a lot of different cases where maybe you can trace the result to a script, and maybe you cannot.

The first step to solving this issue is to write an exhaustive matrix of tests, ideally web platform tests, covering these cases.

#958 (comment) and the following comments also have some specific test cases and discussions that should be looked at during any effort here.