#1251: Other Spec Review: JS Self-Profiling Markers (ProfilerSample.marker)

Visit on Github

Opened Jul 29, 2026

Specification

https://github.com/WICG/js-self-profiling/blob/main/markers.md, https://github.com/WICG/js-self-profiling/pull/89

Explainer

https://github.com/WICG/js-self-profiling/blob/main/markers.md

Links

The specification

Where and by whom is the work is being done?

  • GitHub repo: https://github.com/WICG/js-self-profiling
  • Primary contacts:
    • Monica Chintala (@monica-ch), Microsoft, Origin Trial lead
    • Andrew Comminos (@acomminos), Meta, base JS Self-Profiling API editor
  • Organization/project driving the specification: Microsoft (Microsoft Edge)
  • This work is being funded by: Microsoft
  • Primary standards group developing this feature: W3C Web Performance Community Group / WICG
  • Group intended to standardize this work: W3C Web Performance Working Group
  • Incubation and standards groups that have discussed the design:

Feedback so far

  • Multi-stakeholder feedback:
    • Chromium comments: Positive — driving the implementation and Origin Trial. ChromeStatus: https://chromestatus.com/feature/5201297767792640
    • Mozilla comments: No signal yet. The base JS Self-Profiling API is not implemented in Gecko; no standards position has been requested for the markers extension.
    • WebKit comments: No signal yet. The base JS Self-Profiling API is not implemented in WebKit; no standards position has been requested for the markers extension.
    • Developer/implementer feedback: Interest from RUM/self-profiling consumers — Excel Online (Microsoft) and Datadog — who plan to evaluate the feature via the Chromium Origin Trial.
  • Major unresolved issues with or opposition to this specification: None known. The one open design point is the cross-origin-isolation gating of the sensitive markers (script/gc/paint), under active security discussion in https://github.com/WICG/js-self-profiling/issues/61. No opposition has been raised.
  • Status/issue trackers for implementations:

You should also know that...

  1. This is an incremental extension of an already-reviewed, shipped API. The base JS Self-Profiling API went through TAG review in #366 and ships in Chromium. This proposal adds exactly one optional field — marker on ProfilerSample — labeling the user-agent activity at each sample (script / gc / style / layout / paint / other). No new entry point, no new way to start profiling, no change to the existing Document-Policy: js-profiling gate.

  2. The only new consideration is timing, and it's addressed by design.

    • The full marker set is exposed only in cross-origin-isolated documents (COOP+COEP) via [CrossOriginIsolated] on the IDL member — the same isolation boundary already used for cross-origin-sensitive timing. In such a process a document can already observe process-wide signals (Spectre threat model, performance.measureMemory(), WeakRef), so gc/paint/script add no new leverage.
    • In non-isolated documents only style and layout are exposed. That timing is already same-origin observable today via forced synchronous reflow (Element.getBoundingClientRect() forces layout; getComputedStyle() forces style/layout). The markers provide the same class of information, sampled rather than forced — strictly less capability than pages already have. This mirrors the exposure model of Long Animation Frames (LoAF).
    • Markers attributable to a specific document are attached only when that document is same-origin with the profiler.

  3. Timing / ask. We plan a Chromium Origin Trial to gather field data from partners (Excel Online, Datadog). Feedback before or early in the trial would be most valuable; we're happy to iterate on the marker vocabulary and gating as part of standardization.

<!-- Content below this is maintained by @w3c-tag-bot -->

Track conversations at https://tag-github-bot.w3.org/gh/w3ctag/design-reviews/1251

Discussions

Comment by @bkardell Aug 12, 2026 (See Github)

@monica-ch can you say more about the plan for a Chromium Origin Trial? Is there already an issue/intent? Any reason there is no standards position filed on the other vendors?

Comment by @monica-ch Aug 13, 2026 (See Github)

Thanks @bkardell! Updates on all three points:

Origin Trial plan & intent. The Intent to Experiment is approved on blink-dev, and the Chromium Origin Trial is approved to run M153 → M161. Tracking links:

The trial gathers field data from partner developers (Excel Online, Datadog) on the marker vocabulary and the cross-origin-isolation gating before we finalize the design.

On standards positions for Mozilla and WebKit. Good prompt — here's the accurate state:

  • There is a Mozilla standards-position request on the base JS Self-Profiling API (mozilla/standards-positions#477), filed alongside the original TAG review (#366). It's still open and unresolved. There is no separate WebKit position issue, and neither engine has implemented the base API.

  • This markers proposal is a one-field extension (marker on ProfilerSample) on top of that base API. Given the parent position is still unresolved and the API is Chromium-only today, filing a fresh position on the extension right now would likely just fork the same unresolved base-API security discussion rather than move it forward.

  • The one genuinely new design point, isolation-based gating of the sensitive markers (script/gc/paint) is still under active discussion (WICG/js-self-profiling#61) and is exactly what the Origin Trial is meant to validate. My inclination is to file the markers-specific WebKit/Mozilla positions once that gating stabilizes after the OT, so their review is against final semantics. Does that sequencing work for TAG, or would you prefer we file now and consolidate with the existing base-API discussion?

We'd welcome TAG feedback before or early in the trial — the marker set and gating are still open for iteration as part of standardization.

Comment by @marcoscaceres Aug 18, 2026 (See Github)

Def worth while filing a WebKit standards position. With my WebKit hat on 🤠, at first glance, my colleagues and I have some privacy concerns/questions.