775301 - Figure out policy for plugins-in-chrome-documents

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Plug-ins, defect)

Description

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Currently the click-to-play code effectively makes all (or at least many) plugins in chrome documents use click-to-play.

While discussing if this was the correct policy it was brought up if we should allow plugins in chrome documents at all.

This is a bug to figure out which policy to use and implement that policy.

Comment 1

[Josh Aas]

I don't think we should allow plugins in chrome at all. Not much to gain, terrible for performance, and adds to future support burdens.

Comment 2

[Steven Michaud [:smichaud] (Retired)]

Just to make sure I understand:

Are "chrome documents" documents with "chrome:" URLs?

If so, then allowing plugins in them could also be a security issue, and I'm inclined to agree with Josh.

Comment 3

[HttpWatch]

We use a plugin in the main browser chrome window for our HttpWatch product (see http://www.httpwatch.com ). It allows the user interface to be integrated as a docked panel. 

I believe there are other products on the Windows platform that also use plugins to embed a Windows based UI into Firefox. If you removed the ability to host plugins in Chrome then it would make it more difficult for products like ours to work as well in Firefox as it does in Internet Explorer.

We could avoid using a plugin if there was some sort of XUL element that allowed us to embed our own window (HWND based) into our extensions overlay file.

Comment 4

[Josh Aas]

I'm inclined to say we should deprecate plugins in chrome and perhaps not even allow them to instantiate. It can only really be bad-to-terrible for performance (serious footgun), and I certainly wouldn't want to prioritize any work needed to support it. If people really need to use native code there is always ctypes.

Comment 5

[Josh Aas]

(In reply to Josh Aas (Mozilla Corporation) from comment #4)

And somehow I didn't realize I already wrote basically the same thing months ago in this same bug! Apologies.

Comment 6

[Benjamin Smedberg]

I don't have a strong opinion, but it seems that addon authors are currently using plugins for various binary-interop uses and we have recommended that in the past because it is often easier/safer than ctypes. So I think that we probably should keep support for now. And plugins in chrome docs shouldn't be CTP.

Comment 7

[Benjamin Smedberg]

Resolving old bugs which are likely not relevant any more, since NPAPI plugins are deprecated.