[Bug]: No detection of canvas mutations in same-origin iframes (+ no drawImage inlining)

Preflight Checklist

• I have searched the issue tracker for a bug report that matches the one I want to file, without success.

What package is this bug report for?

rrweb

Version

2.0.1

Expected Behavior

Hello

I am not certainly sure because for me its quite big project and its hard to read the code but during my tests i stumbled upon bug with canvas. Rrweb handle same-origin iframes only partially and do not listen for canvas mutations. It use MutationObserver which listen only for DOM changes.

Actual Behavior

No canvas updates

Steps to Reproduce

1. Create a page with a same-origin <iframe> that draws on a canvas (e.g. an animation or drag-and-drop canvas captcha puzzle)
2. Record with record({ recordCanvas: true, ... }) in the parent frame
3. Replay — the initial canvas state appears correctly, but all subsequent canvas mutations are missing

Testcase Gist URL

No response

Additional Information

No response

There is also issue with canvas images inlining i think. When something is rendered on canvas using drawImage with remote image url and this url have something like one time token in for example query string then its not possible to properly replay this canvas. The images should be somehow inlined. That's what Claude 4.8 Opus generated for me and it works correctly:

rrweb@2.0.1.patch

[eoghanmurray]

Happy for you to promote the patch to a PR so we can easily take a look and comment