Extension unload listeners can fail the bfcache audit but be otherwise undetectable

[brendankenny]

From an issue @rviscomi ran into:

An extension can inject an unload listener into the main frame and the bfcache audit will fail on this reason, but the no-unload-listeners audit will pass, and a user looking in the DevTools Elements panel or running getEventListeners(window) in the console will similarly find no 'unload' listeners. This ends up very challenging to debug.

To repro:

• yarn chrome --port=9222 --enable-extensions
• install the LastPass extension (https://chrome.google.com/webstore/detail/hdokiejnpimakedhajhdlcegeplioahd), ignore the log-in screen
• either
  • visit https://example.com and run Lighthouse in DevTools
  • run node cli/index.js https://example.com --port 9222 --view on the command line

---

This is due to the 'unload' listener being added inside a content script injected on document_start, which runs in an isolated execution context. Unless no-unload-listeners starts running DOMDebugger.getEventListeners on a window reference from the isolated context, those listeners are invisible to the user (similar to how users need to know to pick the other execution context in the DevTools console dropdown for getEventListeners(window) to show the injected script's unload listeners).

Lighthouse could

• cycle through execution contexts for the queries for this kind of audit (probably good in general)
• add a top-level extension warning to the report if there were any content scripts from extensions (possibly similar to #14651)

[connorjclark]

cycle through execution contexts for the queries for this kind of audit (probably good in general)

Target manager can listen to Runtime.executionContextCreated (and keep association with what session/target it came from), and GlobalListeners gatherer can loop through each when collected the listeners for the main target's window.

Eventually bfcache failures reasons will cite source locations, which would have really helped here. (@brendankenny could link to it)

[adamraine]

cycle through execution contexts for the queries for this kind of audit (probably good in general)

This seems like a good path forward. We will go through just the main frame contexts.