1130770 - Flash content is black on twitch.tv with plugin sandbox enabled

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect)

Description

[Trevor Rowbotham [:rowbot]]

When attempting to view streams on www.twitch.tv with plugin sandboxing enabled, a black box is drawn where the flash content should be shown.  Audio, however, plays and you can interact with the flash player.  This is on Win7 with the latest 64bit nightly.

STR:
1) Set the pref dom.ipc.plugins.sandbox-level.flash to 1
2) Restart the browser
2) Visit www.twitch.tv and watch a stream

Setting dom.ipc.plugins.sandbox-level.flash to 0 fixes the problem and the flash player correctly draws the content.

Comment 1

[Bob Owen (:bobowen)]

Hi Trevor,

I'm struggling to reproduce this problem.
Flash seems to work fine for me on Win7 with 64bit Nightly.

Is it only twitch.tv that is giving you issues?

Comment 2

[Trevor Rowbotham [:rowbot]]

Hi Bob,

I did a little more testing and this is appears to be an e10s exclusive bug.  Works fine if e10s is disabled and dom.ipc.plugins.sandbox-level.flash is set to 1.  Did you have e10s enabled when trying to reproduce? (Sorry, I should have tested with e10s disabled before posting the bug report).  I have also added my graphics information below if that is helpful.

Adapter Description	NVIDIA GeForce GTX 660
Adapter Drivers	nvd3dumx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um
Adapter RAM	2048
Device ID	0x11c0
Direct2D Enabled	true
DirectWrite Enabled	true (6.2.9200.16492)
Driver Date	1-9-2015
Driver Version	9.18.13.4725
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 11 (OMTC)
Subsys ID	30693842
Vendor ID	0x10de
WebGL Renderer	Google Inc. -- ANGLE (NVIDIA GeForce GTX 660 Direct3D11 vs_5_0 ps_5_0)
windowLayerManagerRemote	true
AzureCanvasBackend	direct2d 1.1
AzureContentBackend	direct2d 1.1
AzureFallbackCanvasBackend	cairo
AzureSkiaAccelerated	0

Comment 3

[Bob Owen (:bobowen)]

(In reply to Trevor Rowbotham from comment #2)
> Hi Bob,
> 
> I did a little more testing and this is appears to be an e10s exclusive bug.
> Works fine if e10s is disabled and dom.ipc.plugins.sandbox-level.flash is
> set to 1.  Did you have e10s enabled when trying to reproduce? (Sorry, I
> should have tested with e10s disabled before posting the bug report).

I've tried this with and without e10s and it seems fine.

Grasping at straws a bit, but what version of flash are you using?

Comment 4

[Trevor Rowbotham [:rowbot]]

I am using the latest version of flash, version 16.0.0.305.

I just tested some other sites, and twitch.tv is not the only site that is having this issue, but not all the sites I tested have this problem.  I also found that flash will draw properly if the flashplayer enters fullscreen mode on twitch.tv.

Comment 5

[Bob Owen (:bobowen)]

(In reply to Trevor Rowbotham from comment #4)
> I am using the latest version of flash, version 16.0.0.305.
> 
> I just tested some other sites, and twitch.tv is not the only site that is
> having this issue, but not all the sites I tested have this problem.  I also
> found that flash will draw properly if the flashplayer enters fullscreen
> mode on twitch.tv.

OK, thanks for testing various options.
I'll wait and see if anyone else can reproduce or has ideas.

Comment 6

[Trevor Rowbotham [:rowbot]]

A user in a reddit thread[1] reported having to set dom.ipc.plugins.sandbox-level.flash to 0 as well due to issues with Flash, so at least I know I'm not the only one with this issue.  I also saw another post which seems to describe this problem over on the mozillazine forums[2].

I tried to to repo this in a couple different Windows VMs.  Win Vista, 8.1, and 10 VMs all appear to work just fine for me.  The Win7 VM I tried had the same issues as my computer, black where flash content should be, but audio works.

I've also tried disabling OMTC, forcing D3D11 WARP, forcing D3D9 layers, and disabling hardware acceleration, but none of these solved the problem either.

Bug 1098043 and Bug 1128079 appear similar to this, but I cannot force flash to paint when switching tabs or hovering over it with the mouse like it is described in those bugs.

[1] http://www.reddit.com/r/firefox/comments/2vg4yk/unable_to_see_flash_videos_for_the_last_few_weeks/
[2] http://forums.mozillazine.org/viewtopic.php?f=23&t=2911625

Comment 7

[Trevor Rowbotham [:rowbot]]

Ok, so I finally figured out what is causing this.  It has to do with the Windows User Account Control (UAC) setting.  The UAC Setting has 4 possible values on Windows 7:

1) Always notify me
2) (Default) Notify me only when programs try to make changes to my computer
3) Notify me only when programs try to make changes to my computer (do not dim my desktop)
4) Never notify me

I had mine set to #4, Never notify me, because the prompts annoy me.  After having a hunch, I tried setting this back to the default, which is #2, then Flash content began working again.  As far as I know, it is common practice among power users to disable these prompts by selecting option #4.

Since :bobowen appears to be on PTO, ni? :bsmedberg to see if you able to reproduce this by setting your UAC to option #4, Never notify me?

Comment 8

[Benjamin Smedberg]

I'm going to forward the STR to Marcia to see if she can reproduce.

Comment 9

[juan becerra [:juanb]]

I have been trying to reproduce the problem using the steps in comment #0 and the information in comment #7 and I haven't been able to reproduce the problem. I have a feeling this could be hardware related. I don't have a Win7 machine at hand with an nVidia graphics card at the moment.

Comment 10

[Trevor Rowbotham [:rowbot]]

Hi Juan,

Could you try again with the following steps?  I have updated the STR from comment 0 and comment 7 into a new set and added a new step that was missing from comment 7, which requires you to restart the computer for changes to UAC to take effect.

STR:
1) Use Windows Vista or Windows 7
2) Open nightly and set the pref dom.ipc.plugins.sandbox-level.flash to 1
3) Set UAC to Never Notify, which is the lowest setting (Or turn off UAC if on Vista)
4) Restart computer so that UAC setting changes take effect
5) Try loading a stream on twitch.tv

I can reproduce reliably with these steps on Windows Vista and Windows 7.  I cannot reproduce this on Windows 8.1 or Windows 10 using these steps.

Comment 11

[juan becerra [:juanb]]

Following the steps in comment #10 (you need to restart for the UAC changes to take effect) I am able to reproduce the problem on a machine running Windows 7. I'm still not able to reproduce this on Win8.1, consistent with what Trevor found.

If you disable e10s the video plays fine.

Comment 12

[Bob Owen (:bobowen)]

(In reply to Trevor Rowbotham from comment #7)
> Ok, so I finally figured out what is causing this.  It has to do with the
> Windows User Account Control (UAC) setting.  The UAC Setting has 4 possible
> values on Windows 7:
> 
> 1) Always notify me
> 2) (Default) Notify me only when programs try to make changes to my computer
> 3) Notify me only when programs try to make changes to my computer (do not
> dim my desktop)
> 4) Never notify me
> 
> I had mine set to #4, Never notify me, because the prompts annoy me.  After
> having a hunch, I tried setting this back to the default, which is #2, then
> Flash content began working again.  As far as I know, it is common practice
> among power users to disable these prompts by selecting option #4.

Hi Trevor, thanks for continuing to narrow this problem down.

It seems like something is either detecting UAC settings (not sure if that is possible) and then trying to do something the sandbox is blocking.
Or maybe the UAC block and sandbox block present themselves differently and the code doesn't handle it.

Setting a needinfo so I remember to get back to this and see if I can work out what's going on.

By the way, I know that people on development machines sometimes turn off UAC prompts, because of annoyance or other reasons.
However, I'm not sure it is a good idea to have it turned off permanently on a machine that you are using for general web browsing and other purposes.
I know the prompts can be annoying, but they do provide an extra layer of security.

Comment 13

[Bob Owen (:bobowen)]

This is all a bit academic at the moment (as this is now turned off) but ...
I'm pretty certain that this is to do with having a different integrity level for the Broker process and the child process.

With UAC turned off the broker process runs at high integrity (assuming you are an Administrator I think), and the delayed integrity level for the NPAPI process when sandboxed is medium.
This causes a problem with the way the processes communicate.

There also seems to be an issue when the initial integrity level and the delayed integrity level is different.

Another bug I'm working on should help with these problem, but the policy might need tweaking a little as well.

Comment 14

[Trevor Rowbotham [:rowbot]]

It looks like this is now fixed.  Tested using flash versions 16.0.0.305 and 18.0.0.160 on a Windows 7 VM with UAC turned off.  I tested with different sandbox levels for dom.ipc.plugins.sandbox-level.flash and everything works with the values 1-3.

Comment 15

[Bob Owen (:bobowen)]

(In reply to Trevor Rowbotham from comment #14)
> It looks like this is now fixed.  Tested using flash versions 16.0.0.305 and
> 18.0.0.160 on a Windows 7 VM with UAC turned off.  I tested with different
> sandbox levels for dom.ipc.plugins.sandbox-level.flash and everything works
> with the values 1-3.

Thanks for following up and testing this.
I suspect that it was the different integrity levels within the process that were causing the problem here.
Other fixes meant that we don't need that anymore and also they seem to allow us to run at low integrity.