[browser] Handle anonymous callbacks more gracefully when using `allowUrls`/`denyUrls`

[lobsterkatie]

Package + Version

• @sentry/browser 6.9.0

Description

Originally a question from a customer. TL;DR - Chrome represents anonymous callbacks of methods like Array.forEach in stacktraces in a weird way. Instead of doing this:

<anonymous> at line x, col y in myscript.js
Array.forEach at line w, col z in myscript.js

it does this:

Array.forEach in <anonymous>

using <anonymous> as the script name.

(For the record, though Firefox and Safari each do it differently, each one does include the correct script name in the relevant frames.)

If this happens to be the last frame of the stacktrace, it more or less breaks allowUrls and denyUrls, because then the thing being filtered on is <anonymous>.

Three possible solutions off the top of my head:

1. Have the option to filter on more than just the last frame. This is actually a pretty common ask. Related issue: [feature request] Ability to filter events based on any frame #3799

2. Filter on the last frame that has a real URL rather than just the absolute last frame . Hopefully this would be a relatively small change.

3. (Unlikely to happen, but listing it here for completeness) Fix the stacktrace so that it actually correctly includes the two separate frames rather than the one combo frame. We’d have to do some thinking/investigation to determine if it would always work to pull the script name from the forEach frame the line and col number from the <anonymous> frame.

[lobsterkatie]

We discussed this as a team and are opting for option 2 at the moment, as it seems the simplest fix. It's perhaps also worth filing an issue in the Chrome repo about this.

[amakhrov]

Curious whether it's true for a specific Chrome / OS version only?
In my tests I'm getting next to last stack frame as Array.forEach <anonymous>, while the very last one has the real script file name. E.g

    at src_app_routed-lazy_devtools_devtools_module_ts.js:5289
    at Array.forEach (<anonymous>)
    at SentryPage.triggerSyncError (src_app_routed-lazy_devtools_devtools_module_ts.js:5288)

(user agent: '5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36')

So filtering by the last frame for InboundFilters worked fine. And with the new change (from #3842), it's actually a regression, since real 3rd party errors are not properly filtered out any more. Any thoughts? @onurtemizkan @lobsterkatie