thirdPartyErrorFilterIntegration misidentifies first-party web workers and wasm as third-party

[medmunds]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/browser

SDK Version

10.32.1

Framework Version

@sentry/vite-plugin 4.6.1, @sentry/wasm 10.32.1

Link to Sentry event

https://medmunds.sentry.io/issues/7165204471/events/417ba7d770ad47b998e9455a9915f024/

Reproduction Example/SDK Setup

import * as Sentry from "@sentry/browser";
import { wasmIntegration } from "@sentry/wasm";
Sentry.init({
  dsn: import.meta.env.VITE_SENTRY_DSN,
  sendDefaultPii: false,
  integrations: [
    Sentry.browserTracingIntegration(), 
    wasmIntegration(), // optional, to see the wasm issue
    Sentry.thirdPartyErrorFilterIntegration({
        filterKeys: [import.meta.env.VITE_SENTRY_FILTER_APPLICATION_ID],
        behaviour: "apply-tag-if-contains-third-party-frames",
      }),
  ],
});

// then in the module that creates workers...
const sentryWebWorkerIntegration = Sentry.webWorkerIntegration({ worker: [] });
Sentry.addIntegration(sentryWebWorkerIntegration);

// and when a worker is created...
const worker = new Worker(new URL("./worker.ts", import.meta.url), {...});
sentryWebWorkerIntegration.addWorker(worker);

// and in worker.ts...
import * as Sentry from "@sentry/browser";
Sentry.registerWebWorker({ self });

(I'd be happy to extract a minimal reproducible project if this is a bug that's likely to be fixed. You can see the actual code I'm running here: Sentry.init (includes a project-specific workaround for this issue), webWorkerIntegration, addWorker, registerWebWorker.)

Steps to Reproduce

1. Create a project that uses Sentry.thirdPartyErrorFilterIntegration (with vite and @sentry/vite-plugin to add the applicationKey), web workers with Sentry.webWorkerIntegration, and (optionally) web assembly with @sentry/wasm wasmIntegration (loaded through vite's static asset management).
2. Throw an error in the web worker (or in the wasm code)
3. Examine the recorded event

Expected Result

Since all of the code involved is first-party, the event should not be tagged third_party_code.

Actual Result

The event incorrectly includes tag third_party_code: true.

Here's an example stack. Debugging thirdPartyErrorFilterIntegration in Chrome, it identified the frames for both worker.ts and slide-BhXf1bBR.wasm as third-party:

RuntimeError: Aborted(Assertion failed: !"We shouldn't get here", at: /puzzles/unfinished/slide.c,711,generate_board). Build with -sASSERTIONS for more info.
    at abort (../src/assets/puzzles/emcc-runtime.js:1:2243)
    at ___assert_fail (../src/assets/puzzles/emcc-runtime.js:1:6101)
  0x24cac      null (/assets/slide-BhXf1bBR.wasm)
  0x15224      null (/assets/slide-BhXf1bBR.wasm)
  0x17a2b      null (/assets/slide-BhXf1bBR.wasm)
  0x0dcba      null (/assets/slide-BhXf1bBR.wasm)
    at createJsInvoker (../src/assets/puzzles/emcc-runtime.js:1:32024)
    at WorkerPuzzle.newGame (../src/puzzle/worker.ts:135:19)
    at callback (../node_modules/comlink/dist/esm/comlink.mjs:103:48)

Additional Context

For web worker code:

• sentryVitePlugin doesn't seem to add Sentry's metadata to worker modules
• even if it did, that metadata would end up in _sentryModuleMetadata in the worker thread global, not the main thread global, so thirdPartyFilterIntegration in the main thread wouldn't find it (related: webWorkerIntegration: breadcrumbs/tags/context set in worker thread get lost #18704)

For wasm code, I suspect there isn't really any way for sentryVitePlugin to inject Sentry's metadata the way it does for JS. Perhaps there could be some way for the app to tell thirdPartyErrorFilterIntegration about additional first-party code at runtime? (A new registerFirstPartyModule(url: URL | string) API?)

(I'm using vite 7.3.0.)

Priority

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it.}

[linear]

JS-1411

[chargome]

Hey @medmunds thanks for reaching out! I don't think the vite plugin will correctly tag your worker code, could you try this in your vite config:

const sentryPlugin = sentryVitePlugin({
  // ...
});

export default defineConfig({
  // Vite plugin for main bundle
  plugins: [sentryPlugin],
  worker: {
    // Vite plugin for worker bundle
    plugins: () => [...sentryPlugin],
  },
});

[andreiborza]

I think that alone is not enough, we need to also forward this data to the main thread. We can definitely improve this for workers.

Now for WASM, it might be more difficult. We'll need to investigate more there.

[medmunds]

@chargome you're absolutely right, I had forgotten vite uses separate plugins for worker bundling. Your suggestion gets the _sentryModuleMetadata into the worker bundle. (Sorry, and thanks! I've updated the original description.) However, the worker metadata is still not available to the thirdPartyErrorFilterIntegration running in the main thread.

@andreiborza glad to hear the worker part is something you can improve.

If you can find a general bundle-time solution for wasm, of course that'd be great. I looked into it a little before opening this issue, and it seemed like thirdPartyErrorFilterIntegration needs to know the exact stackframe.filename for the wasm—which I'm not sure can be known until the code is running in the browser.

I believe a browser-side registerFirstPartyModule() API could be a viable approach: I would call it with the resolved url for the wasm I'm about to instantiate.

While looking for a workaround, Gemini 3 and I came up with this. It actually worked for the worker url. It almost worked for the wasm url, but at the time addMetadataToStackFrames() runs in thirdPartyErrorFilterIntegration, the frame.filename for the wasm frames also included line and column numbers and function names so didn't match. (Since the wasm frame.filename seems to get cleaned up before the event is submitted to Sentry, maybe I just needed to experiment with the ordering of wasmIntegration vs thirdPartyErrorFilterIntegration?)

/**
 * Registers a URL as first-party code for Sentry.thirdPartyErrorFilterIntegration.
 * Useful for (e.g.,) wasm assets that can appear in a stack trace but where Sentry's
 * bundler integration cannot add metadata, or web workers that register their Sentry
 * metadata in a different thread.
 *
 * url must be exactly the filename that appears in the stack trace.
 */
export function registerSentryFirstPartyModule(url: string) {
  const applicationKey = import.meta.env.VITE_SENTRY_FILTER_APPLICATION_ID;
  if (applicationKey) {
    GLOBAL_OBJ._sentryModuleMetadata = GLOBAL_OBJ._sentryModuleMetadata || {};

    // pseudoStack is meant to match chromeRegexNoFnName from Sentry's stack-parsers.ts:
    //   "at http://localhost:5000//script.js:1:1"
    // https://github.com/getsentry/sentry-javascript/blob/develop/packages/browser/src/stack-parsers.ts
    // https://github.com/getsentry/sentry-javascript/blob/develop/packages/core/src/utils/stacktrace.ts
    const pseudoStack = `at ${url}:1:1`;

    GLOBAL_OBJ._sentryModuleMetadata[pseudoStack] = {
      [`${BUNDLER_PLUGIN_APP_KEY_PREFIX}${applicationKey}`]: true,
    };
  }
}