Share one safeSelf() cache between the scriptlets in a frame. (#63)

Context: Each scriptlet has its own copy of safeSelf(). It saves the
functions that it finds when it first runs, and those were often already
the wrappers that earlier scriptlets had installed, not the browser's own
functions. So each hook called all earlier hooks again. With six hooks on
JSON.stringify (as on youtube.com), one JSON.stringify call from the page
became 2^6=64 native calls.

The extension gives each scriptlet its own copy of scriptletGlobals, so
the first scriptlet in a frame (and world) now keeps the cache on
globalThis, and the later scriptlets use it. The property is read-only,
and its key has the uBO version, so other versions do not share it. This
works for all injection paths (registered scripts and executeScript),
without changes in the extension.

refs ghostery/ghostery-extension#3672

Author: philipp-classen

build.ts

@@ -18,6 +18,19 @@ for (const scriptlet of scriptlets) {
   }
 }
 
+// uBO runs all scriptlets of a page in one scope, so they share one safeSelf() cache. Our scriptlets are separate functions, so they share it on globalThis.
+// Else each hook captures the earlier hooks as natives, and calls grow as 2^n. The uBO version is in the key, so other versions do not share it.
+const safeSelf = index.get('safe-self.fn').fn;
+const shareSafeSelf = `try {
+    const key = Symbol.for('safeSelf.${tagName}');
+    safeSelf.safe = globalThis[key];
+    if ( safeSelf.safe === undefined ) {
+        Object.defineProperty(globalThis, key, { value: safeSelf() });
+    }
+} catch {
+}
+`;
+
 console.log(`
 /*******************************************************************************
 
@@ -67,7 +80,7 @@ requiresTrust: ${scriptlet.requiresTrust || false},
 func: function (scriptletGlobals = {}, ...args) {
 ${deps.map((dep) => dep.toString()).join('\n')}
 ${scriptlet.fn.toString()};
-${scriptlet.fn.name}(...args);
+${deps.includes(safeSelf) ? shareSafeSelf : ''}${scriptlet.fn.name}(...args);
 },
 };
 `;

test.js

@@ -1,5 +1,6 @@
 import { test, suite } from "node:test";
 import assert from "node:assert";
+import vm from "node:vm";
 import scriptlets from "./index.js";
 
 test("default export is an object", () => {
@@ -26,3 +27,55 @@ suite("uBO", () => {
     assert.strictEqual(scriptlets["set-constant.js"], scriptlets["set.js"]);
   });
 });
+
+suite("safeSelf() cache", () => {
+  // Each hook clones the argument with safe.JSON_parse(safe.JSON_stringify(obj))
+  const func = scriptlets["trusted-edit-inbound-object.js"].func;
+  const HOOKS = 6;
+  // Same code as the extension makes for each scriptlet; the first argument is scriptletGlobals
+  const hooks = Array.from({ length: HOOKS }, (_, i) =>
+    `(${func})(...${JSON.stringify([{}, "JSON.stringify", "0", `[?.hook${i}]+={"edited${i}":true}`])});`
+  );
+
+  // A fresh realm is the page; counters wrap the native JSON methods before the scriptlets run
+  function createPage() {
+    const page = vm.createContext({ EventTarget: class {}, Request: class {} });
+    vm.runInContext(
+      `
+        const { parse, stringify } = JSON;
+        globalThis.calls = { parse: 0, stringify: 0 };
+        JSON.parse = function (...args) { calls.parse += 1; return parse.apply(JSON, args); };
+        JSON.stringify = function (...args) { calls.stringify += 1; return stringify.apply(JSON, args); };
+      `,
+      page
+    );
+    return page;
+  }
+
+  test("is shared in a realm, so stacked hooks stay linear", () => {
+    const page = createPage();
+    for (const hook of hooks) {
+      vm.runInContext(hook, page);
+    }
+
+    const result = vm.runInContext(
+      "calls.parse = 0; calls.stringify = 0; JSON.stringify({ hook0: true, hook5: true });",
+      page
+    );
+    assert.deepStrictEqual(JSON.parse(result), { hook0: true, hook5: true, edited0: true, edited5: true });
+    // One call from the page plus one clone per hook, not 2^n
+    assert.deepStrictEqual({ ...page.calls }, { parse: HOOKS, stringify: HOOKS + 1 });
+  });
+
+  test("is read-only and not enumerable", () => {
+    const page = createPage();
+    vm.runInContext(hooks.join("\n"), page);
+
+    const keys = vm
+      .runInContext("Object.getOwnPropertySymbols(globalThis)", page)
+      .filter((key) => key.description.startsWith("safeSelf."));
+    assert.strictEqual(keys.length, 1);
+    const { value, ...flags } = Object.getOwnPropertyDescriptor(page, keys[0]);
+    assert.deepStrictEqual(flags, { writable: false, enumerable: false, configurable: false });
+  });
+});