Drop executionContexts?

[annevk]

We might drop this feature from Firefox as Chrome doesn't implement it and we keep running into issues with it. Latest is https://bugzilla.mozilla.org/show_bug.cgi?id=1548034.

[wanderview]

It seems to me we either need to:

1. Figure out how to make executionContexts work correctly.
2. Or spec what actually happens to things like open blobs, cache_storage Response, etc when their underlying storage is nuked. AFAIK that is completely undefined.

Reloading contexts seems like the best option to actually getting the user to a known sane state.

[annevk]

2 is needed either way right? That seems like a separate problem that also exists.

[asakusuma]

There may be an expectation that executionContexts is required to ensure storage kills a service worker. I would much rather provide the guarantee that storage alone kills any service workers though. Tangentially, there were already some potential issues with spec guarantees around removing service workers: #54

[ericlaw1979]

It appears that Firefox landed their removal: https://bugzilla.mozilla.org/show_bug.cgi?id=1548034#c8

[Offirmo]

Hi team,
a bit late to the party, but in case this executionContexts property is resurrected, my security team came up with a potential issue when we evaluated the Clear-Site-data header: risk of infinite reload loop.

• Supposing Clear-Site-Data=* is set in response to a url with a query param such as &logged-out=true...
• supposing a user logs out, navigating to such a "logged out" url and triggering Clear-Site-Data=*
• supposing the user had an old "logged out" tab for the same origin with the same url...

then tab1 would trigger the reload of tab2, which would attempt to clear executionContexts as well, thus re-loading tab1 and so on, causing an infinite loop of reloading between the 2 tabs

Suggestion: if this interpretation is correct, instead of reloading all the pages of the same origin, maybe we should instead unload other same-origin browsing contexts instead of reloading them.

Hope this helps. Thanks for all this security work!