Port messages with Blob objects are being filtered out in Firefox 116; Blob object is unreachable within GM.xmlHttpRequest with responseType: "blob"

[SebastianSimon]

Since Firefox Nightly 116, GM.xmlHttpRequest({ responseType: "blob",…}) never calls the onload handler. Other handlers like onprogress are always correctly called. If I change responseType to one of the other available types, onload is correctly called. If I use Firefox Beta 115, onload is correctly called for responseType: "blob". No errors are shown in any console.

When debugging the extension, the function xhrEventHandler in src/bg/on-user-script-xhr.js is actually being called with all relevant events, including the call where event.type === "load". It turns out, if you set a breakpoint before port.postMessage({ 'src': src, 'type': event.type, 'responseState': responseState });, then execute responseState.response = null; in the console, then the onload handler is being executed. The issue appears to be that port messages that contain blobs are being ignored or somehow filtered out, likely due to security reasons. This also affects the final readystatechange event.

The question now is: can GreaseMonkey do something about this—perhaps provide a workaround—, or is this exclusively a Firefox issue?

Steps to reproduce

1. Install a fresh copy of Firefox Nightly 116.0a1
2. Install GreaseMonkey 4.11
3. Add the test userscript below
4. Navigate to https://example.com
5. Open the console
6. Click the “More information...” link on the example site

Test userscript

// ==UserScript==
// @name        Test: XHR Blob on link click
// @include     https://example.com/
// @run-at      document-start
// @grant       GM.xmlHttpRequest
// ==/UserScript==

(() => { "use strict";
  ((main) => (document.readyState === "loading"
    ? addEventListener("DOMContentLoaded", main)
    : main()))(() => {
      document.querySelector("a:link").addEventListener("click", (event) => {
        event.preventDefault();
        console.log("clicked");
        GM.xmlHttpRequest({
          method: "GET",
          url: event.target.href,
          responseType: "blob",
          onprogress(...args){
            console.log("progressed"); // This is always logged.
          },
          onload(...args){
            console.log("loaded"); // This is always logged in Firefox <= 115, but never in Firefox Nightly 116.
          }
        });
      });
    });
})();

Actual result

"clicked" and "progressed" are always logged. "loaded" is never logged.

Desired result

"loaded" is correctly logged.

[SebastianSimon]

Workaround

For now, I use this in my scripts:

GM.xmlHttpRequest({
  method: "GET",
  url,
  responseType: "arraybuffer", // Instead of `"blob"`.
  onload({ response }){
    console.log(URL.createObjectURL(new Blob([ response ], { type: "application/octet-stream" }))); // Instead of `URL.createObjectURL(response)`
  }
});

[arantius]

Following the STR in Firefox 119.0 I see clicked, progressed, loaded in the console.