Repository navigation
fix(chromium): use resource type when deciding if evicted body can be re-fetched - #42201
Merged
Yury Semikhatsky (yury-s) merged 2 commits intoAug 11, 2026
Merged
Conversation
… re-fetched Sec-Fetch-Dest is only sent to potentially trustworthy origins, so the re-fetch gate from microsoft#42124 always returned an empty body on Android where tests reach the server via http://10.0.2.2. Accept requests whose CDP resource type is a static subresource, falling back to the header checks otherwise. Skip the prefetch test on Chromium < 138: Sec-Purpose on <link rel=prefetch> only shipped in Chrome 138 and the Android emulator's Chrome is older. Fixes "should return body for prefetch script" and "should return body for image with evicted body" under android, broken by microsoft#42124.
Yury Semikhatsky (yury-s)
requested review from
Simon Knott (Skn0tt),
Dmitry Gozman (dgozman) and
Pavel Feldman (pavelfeldman)
August 11, 2026 16:43
This comment has been minimized.
This comment has been minimized.
Dmitry Gozman (dgozman)
approved these changes
Aug 11, 2026
| const secFetchDest = rawHeaderValue('sec-fetch-dest'); | ||
| if (!isPrefetch && (!secFetchDest || !kRefetchSafeDestinations.has(secFetchDest))) | ||
| return Buffer.from(''); | ||
| if (!kRefetchSafeResourceTypes.has(request.resourceType())) { |
Collaborator
There was a problem hiding this comment.
Perhaps using just the resourceType() is enough here?
Member
Author
There was a problem hiding this comment.
Dropped the Sec-Fetch-Dest check — every destination in that list maps to a resource type already in the safe set (workers report 'script', audio/video 'media', track 'texttrack'). Kept the Sec-Purpose check: link prefetch reports resource type 'other', so the header is the only signal.
This comment has been minimized.
This comment has been minimized.
…etch Drop the Sec-Fetch-Dest check: every safe destination maps to a resource type already in the safe set. Keep the Sec-Purpose check as link prefetch requests report resource type 'other'.
Contributor
Test results for "tests 1"6 flaky51080 passed, 1208 skipped Merge workflow run. |
Contributor
Test results for "MCP"8089 passed, 1284 skipped Merge workflow run. |
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sec-Fetch-Dest, which Chromium only sends to potentially trustworthy origins; Android tests reach the server via plain-http10.0.2.2, soresponse.body()always returned an empty body there.Sec-Purposeon<link rel=prefetch>only shipped in Chrome 138 and the Android emulator's Chrome is older.