ref(core): Remove redundant iframe check in supportsNativeFetch#19853
Open
ref(core): Remove redundant iframe check in supportsNativeFetch#19853
supportsNativeFetch#19853Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| } | ||
|
|
||
| if (!_isFetchSupported()) { | ||
| return false; |
There was a problem hiding this comment.
Public API supportsNativeFetch no longer checks native implementation
Medium Severity
supportsNativeFetch is a publicly exported function whose JSDoc says "returns true if window.fetch is natively implemented, false otherwise." It now delegates to _isFetchSupported(), which only checks whether fetch exists (native or polyfilled). This is a semantic breaking change to a public API — external consumers relying on this function to distinguish native from polyfilled fetch will get incorrect results. The function is now functionally identical to the already-deprecated supportsFetch.
Triggered by project rule: PR Review Guidelines for Cursor Bot
Contributor
size-limit report 📦
|
Contributor
node-overhead report 🧳Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
|
Lms24
force-pushed
the
bundle-size/supports-native-fetch
branch
from
e2fd3a8 to
39fcc12
Compare
Lms24
changed the title
Lms24
changed the title
supportsNativeFetch
Contributor
Semver Impact of This PR🟢 Patch (bug fixes) 📋 Changelog PreviewThis is how your changes will appear in the changelog. New Features ✨
Bug Fixes 🐛Deps
Other
Internal Changes 🔧Core
Other
🤖 This preview updates automatically when you update the PR. |
Lms24
changed the base branch from
autoresearch/browser-bundle-size-2026-03-17
to
develop
supportsNativeFetch() created a sandboxed iframe to check if the Fetch API
is natively implemented — identical logic to getNativeImplementation('fetch')
in browser-utils. The iframe approach adds ~30 lines of DOM manipulation code.
The function is only called behind a `skipNativeFetchCheck` guard that is
never set to true in the base CDN bundle, making the iframe code dead weight
that cannot be tree-shaken by terser (it can't prove the parameter is always
falsy across the program).
Simplify to delegate to `_isFetchSupported()` which checks if `window.fetch`
exists. The actual native-vs-polyfill distinction is already handled by
`getNativeImplementation` at the call sites that need it.
Also simplifies the `isNativeFunction` regex from an exact whitespace pattern
to a simpler `/[native code]/` check, which is more permissive across
different JS engine toString() formats.
Saves ~200 bytes gzipped on the base browser bundle.
Co-Authored-By: Claude claude@anthropic.com
Lms24
force-pushed
the
bundle-size/supports-native-fetch
branch
from
39fcc12 to
dff6335
Compare
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| // eslint-disable-next-line @typescript-eslint/ban-types | ||
| export function isNativeFunction(func: Function): boolean { | ||
| return func && /^function\s+\w+\(\)\s+\{\s+\[native code\]\s+\}$/.test(func.toString()); | ||
| return func && /\[native code\]/.test(func.toString()); |
There was a problem hiding this comment.
Bug: The relaxed regex in isNativeFunction can misidentify a wrapped fetch as native, causing getNativeImplementation to return a version that can trigger an infinite loop with ad-blockers.
Severity: HIGH
Suggested Fix
Revert the regex in isNativeFunction to a stricter version that validates the function's structure, not just the presence of the [native code] substring. The previous regex /^function\s+\w+\(\)\s+\{\s+\[native code\]\s+\}$/ or a similarly strict alternative should be used to ensure only truly native functions are identified.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: packages/core/src/utils/supports.ts#L97
Potential issue: The `isNativeFunction` utility was changed to use a permissive regex
that only checks for the substring `[native code]`. This causes wrapped or polyfilled
functions, such as a `fetch` implementation modified by an ad-blocker or framework, to
be incorrectly identified as native. Consequently, `getNativeImplementation('fetch')`
returns this wrapped version instead of a truly native one. If Sentry then uses this
wrapped `fetch` for its own event reporting and an ad-blocker intercepts the request, it
can trigger an infinite loop, freezing the user's application. This bypasses a specific
safety mechanism designed to prevent this exact scenario.
Did we get this right? 👍 / 👎 to inform future reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remove ~30 lines of iframe-based DOM manipulation from
supportsNativeFetch(). Saves ~200 bytes gzipped — the single biggest win in this bundle size effort.Problem
supportsNativeFetch()created a sandboxed iframe to check iffetchis natively implemented. This is identical logic togetNativeImplementation("fetch")inbrowser-utils, creating two separate iframe-based checks in the CDN bundle.The function is only called behind a
skipNativeFetchCheckguard:In the base CDN bundle,
skipNativeFetchCheckis never set totrue, making the iframe code dead weight. Terser cannot tree-shake it because it cannot prove the parameter is always falsy.Solution
Simplify
supportsNativeFetch()to just delegate to_isFetchSupported()(checks ifwindow.fetchexists). The native-vs-polyfill distinction is handled bygetNativeImplementationat call sites that need it.Also simplifies
isNativeFunctionfrom/^function\s+\w+\(\)\s+\{\s+\[native code\]\s+\}$/to/\[native code\]/— more permissive across different JS enginetoString()formats.Part of #19833.
Co-Authored-By: Claude claude@anthropic.com