Long Tasks API

1. Introduction

As the page is loading and while the user is interacting with the page afterwards, both the application and browser queue various events that are then executed by the browser -- e.g. user agent schedules input events based on user’s activity, the application schedules callbacks for requestAnimationFrame and other callbacks, etc. Once in the queue, the browser dequeues these events one-by-one and executes them.

However, some tasks can take a long time (multiple frames) and if/when that happens, the UI thread may become blocked and block all other tasks as well. To the user, this is commonly visible as a "locked up" page where the browser is unable to respond to user input; this is a major source of bad user experience on the web today:

Delayed "time to Interactive":

while the page is loading, or even completely visually rendered, long tasks often tie up the main thread and prevent the user from interacting with the page. Poorly designed third-party content is frequently the culprit.

High/variable input latency:

critical user-interaction events (e.g. tap, click, scroll, wheel, etc.) are queued behind long tasks which yields janky and unpredictable user experience.

High/variable event handling latency:

like input, processing event callbacks (e.g. onload events, etc.) delay application updates.

Janky animations and scrolling:

some animation and scrolling interactions require coordination between compositor and main threads; if a long task is blocking the main thread it can affect responsiveness of animations and scrolling.

Some applications (and RUM vendors) are already attempting to identify and track cases where "long tasks" happen. For example, one known pattern is to install a ~short periodic timer and inspect the elapsed time between the successive expirations: if the elapsed time is greater than the timer period, then there is high likelihood that one or more long tasks have delayed execution of the event loop. This approach mostly works but has several bad performance implications: by polling to detect long tasks, the application prevents quiescence and long idle blocks (see requestIdleCallback); it’s bad for battery life; there is no way to know what is causing the delay (e.g. first party or third party code).

The RAIL performance model suggests that applications should respond to user input in less than 100ms (for touch move and scrolling, the threshold is 16ms). The goal of this API is to surface notifications about tasks that may prevent the application from hitting these targets. This API surfaces tasks that take 50ms or more. A website without these tasks should respond to user input in under 100ms: it will take less than 50ms to finish the task that is being executed when the user input is received and less than 50ms to execute the task to react to such user input.

1.1. Usage Example

const observer = new PerformanceObserver(function(list) {
    for (const entry of list.getEntries()) {
        // Process long task notifications:
        // report back for analytics and monitoring
        // ...
    }
});
// Register observer for previous and future long task notifications.
observer.observe({type: "longtask", buffered: true});
// Long script execution after this will result in queueing
// and receiving "longtask" entries in the observer.

2. Terminology

Long task refers to any of the following occurrences whose duration exceeds 50ms:

• An event loop task plus the perform a microtask checkpoint that follows immediately afterwards. This captures the duration of an event loop task, including its associated microtasks.

• An update the rendering step within the event loop processing model.

• A pause between the last step and the next first step of the event loop processing model. This captures any work that the user agent performs in its UI thread outside of the event loop.

The browsing context container for a browsing context bc is bc’s active document's node navigable's container.

Note: This term is outdated, and the new terms should be reused when revamping this.

Culprit browsing context container refers to the browsing context container (iframe, object, etc.) that is being implicated, on the whole, for a long task.

Attribution refers to identifying the type of work (such as script, layout etc.) that contributed significantly to the long task, as well as identifying which culprit browsing context container is responsible for that work.

3. Long Task Timing

Long Task timing involves the following new interfaces:

3.1. PerformanceLongTaskTiming interface

[Exposed=Window]
interface PerformanceLongTaskTiming : PerformanceEntry {
    /* Overloading PerformanceEntry */
    readonly attribute DOMHighResTimeStamp startTime;
    readonly attribute DOMHighResTimeStamp duration;
    readonly attribute DOMString name;
    readonly attribute DOMString entryType;

    readonly attribute FrozenArray<TaskAttributionTiming> attribution;
    [Default] object toJSON();
};

The values of the attributes of a PerformanceLongTaskTiming are set in the processing model in § 4.1 Report long tasks. The following provides an informative summary of how they will be set.

The name attribute’s getter will return one of the following strings:

"unknown"

The long task originated from work that the user agent performed outside of the event loop.

"self"

The long task originated from an event loop task within this browsing context.

"same-origin-ancestor"

The long task originated from an event loop task within a same-origin ancestor navigable.

"same-origin-descendant"

The long task originated from an event loop task within a same-origin descendant browsing context.

"same-origin"

The long task originated from an event loop task within a same-origin browsing context that is not an ancestor or descendant.

"cross-origin-ancestor"

The long task originated from an event loop task within a cross-origin ancestor navigable.

"cross-origin-descendant"

The long task originated from an event loop task within a cross-origin descendant browsing context.

"cross-origin-unreachable"

The long task originated from an event loop task within a cross-origin browsing context that is not an ancestor or descendant.

"multiple-contexts"

The long task originated from an event loop task involving multiple browsing contexts.

Note: There are some inconsistencies across these names, such as the "-unreachable" and the "-contexts" suffixes. These names are kept for backward compatibility reasons.

The entryType attribute’s getter step is to return "longtask".

The startTime attribute’s getter step is to return a DOMHighResTimeStamp of when the task started.

The duration attribute’s getter step is to return a DOMHighResTimeStamp equal to the elapsed time between the start and end of task, with a 1 ms granularity.

The attribution attribute’s getter will return a frozen array of TaskAttributionTiming entries.

3.2. TaskAttributionTiming interface

[Exposed=Window]
interface TaskAttributionTiming : PerformanceEntry {
    /* Overloading PerformanceEntry */
    readonly attribute DOMHighResTimeStamp startTime;
    readonly attribute DOMHighResTimeStamp duration;
    readonly attribute DOMString name;
    readonly attribute DOMString entryType;

    readonly attribute DOMString containerType;
    readonly attribute DOMString containerSrc;
    readonly attribute DOMString containerId;
    readonly attribute DOMString containerName;
    [Default] object toJSON();
};

The values of the attributes of a TaskAttributionTiming are set in the processing model in § 4.1 Report long tasks. The following provides an informative summary of how they will be set.

The name attribute’s getter will always return "unknown".

The entryType attribute’s getter will always return "taskattribution".

The startTime attribute’s getter will always return 0.

The duration attribute’s getter will always return 0.

The containerType attribute’s getter will return the type of the culprit browsing context container, such as "iframe", "embed", or "object". If no single culprit browsing context container is found, it will return "window".

The containerName attribute’s getter will return the value of the container’s name content attribute. If no single culprit browsing context container is found, it will return the empty string.

The containerId attribute’s getter will return the value of the container’s id content attribute. If no single culprit browsing context container is found, it will return the empty string.

The containerSrc attribute’s getter will return the value of the container’s src content attribute. If no single culprit browsing context container is found, it will return the empty string.

3.3. Pointing to the culprit

4. Processing model

Note: A user agent implementing the Long Tasks API would need to include "longtask" in supportedEntryTypes for Window contexts, respectively.

This allows developers to detect support for long tasks.

4.1. Report long tasks

5. Security & privacy considerations

Long Tasks API adheres to the same-origin policy by including origin-safe attribution information about the source of the long task. There is a 50ms threshold for long tasks. Durations are only provided in 1 ms granularity. Together this provides adequate protection against cross-origin leaks.

The Long Tasks API provides timing information about the duration and type of tasks executed by the user, as well as attribution such as the browsing context causing the function calls. This could enable an attacker to perform side-channel timing attacks to guess the user’s action, or identify the user. For example, a pattern of long script followed by a long render could be put together to guess user’s interaction with a social widget. Detailed function call attribution would be used to determine the user’s action.

While the API doesn’t introduce any new privacy attacks, it could make existing privacy attacks faster. Mitigations for this are possible and can be implemented as needed:

• Further clamp or add random jitter to the long task duration provided by the API to make attacks harder to exploit.

• Limit the number of origins for which longtasks are exposed by the API, and obfuscate the attribution of any tasks afterwards. For instance, a page with 5 iframes could receive only attribution for tasks from 3 of those iframes, and would receive no attribution (name set to unknown") for tasks from the other 2.

• Allow dropping the culprit/attribution information after a certain threshold. For instance, after 10 longtasks all entries would receive no attribution and their name would be "unknown".

• Add a built-in delay to the timing information exposed to make attacks dependent on longtask volume harder to execute.

5.1. What is Exposed to Observers?

All observers within the top level page (i.e. all iframes in the page and the main frame) will receive notifications about presence of long tasks. We expose the start time of the task, its duration (with 1 ms granularity), and a pointer to the culprit frame. This information can already be observed today, and with higher resolution, using setTimeout. An attacker can do this by clearing everything else on the page and adding the vulnerable cross-origin resource to ensure that delays from the setTimeout are caused by that resource. Observers in other different pages (tabs or windows) should not receive notifications, regardless of the architecture of the user agent.

Cross origin rules for what is exposed:

• Cross-origin observers may see the direction of the culprit e.g if the culprit is a deeply nested iframe, then the host page can see the first cross-origin between itself and the culprit.

• Conversely, if the culprit is the top level page, then a deeply embedded iframe can see that a longtask occurrred in its cross-origin ancestor but does not receive any information about it.

5.2. Attack Scenarios Considered

The following are the timing attacks considered:

1. Traditional timing attacks: using external resource load time to reveal the size of private data. For instance the number of hidden pictures in a gallery, whether username is valid, etc. See an example.

2. Side-channel timing attacks: using time for video parsing, script parsing, App Cache reads or Cache API (service workers) usage to uniquely identify a user, or to create a profile of the user’s age, gender, location, and interests etc. For instance, status updates from a social network can be limited to certain demographic (eg. females of age 20-30) the file size of the permalink page can be used to determine whether the user is in the target demographic.

These scenarios are addressed by the 50ms threshold AND respecting cross-origin boundary i.e. not showing task type or additional attribution to untrusted cross origin observers.