1171407 - nsIHTTPChannel.redirectTo() causes Flash plugin subrequests to fail [single process only]

Status: RESOLVED INCOMPLETE

(Core :: Networking: HTTP, defect, P5)

Description

[Giorgio Maone [:ma1]]

Attachment: Scratchpad-based test case, run in browser context

Using nsIHttpChannel.redirectTo(), even with the same URL as the original request, makes subrequests issued by the Flash plugin fail unconditionally with code 2147500037.

This issue is clearly demonstrated by the attached Scratchpad-based test case, to be run in Browser context: just run it, press the [Show me] button in the Flow Player demo above the fold and watch either it fail or a log of the intercepted redirection callback failure in the browser console (ctrl+shift+J).

Notice that in order to see the player actually fail you must answer [Cancel] to the initial prompt, otherwise the same work-around used by NoScript to avoid this issue while implementing the hack described in bug 1170197 will be demonstrated and the movie will be played. 

This seems to happen for any Flash plugin subrequest (contentPolicyType === 12), and is reproducible on YouTube if you force their Flash player instead their HTML 5 one.

Also, this is reproducible in Firefox stable (38.0.5) up to Firefox Dev Edition (Aurora, 40.0a2), but not on current Trunk (that's why I'm *not* requesting e10s tracking).
I'm not sure if anything (accidentally? permanently?) fixed this in trunk, but even if it did, a test may be useful to prevent future regressions (hence blocking bug 1170197).

Reproduced against Shockwave Flash 17.0.0.169 on Windows 8.1.

Comment 1

[Giorgio Maone [:ma1]]

Sorry, I meant to block bug 1124803, actually.

Comment 2

[Honza Bambas (:mayhemer)]

In that case I think Dragana will not be interested in this bug (sorry for eventual spam.)

Comment 3

[perceptron8]

Seems similar to https://bugzilla.mozilla.org/show_bug.cgi?id=1114891

Comment 5

[Benjamin Smedberg]

I suspect that this is related to the redirect handling in the plugin code here: http://hg.mozilla.org/mozilla-central/annotate/7649ffe28b67/dom/plugins/base/nsPluginStreamListenerPeer.cpp#l1335

But it could be somewhere in here as well:
http://hg.mozilla.org/mozilla-central/annotate/7649ffe28b67/dom/plugins/base/nsNPAPIPluginStreamListener.cpp#l885

I suggest setting C++ breakpoints at some of the error handling paths in these methods and see which if any are triggered by the testcases (bug 1166501 has an HSTS testcase that doesn't require any special addons calls).

Comment 6

[perceptron8]

It's very likely that http://hg.mozilla.org/mozilla-central/rev/484242b6953c fixed this bug as well.

Comment 7

[perceptron8]

That's not this commit, it must be something more recent. I reversed it's changes manually, it didn't broke redirection. So, FF 43.0b2 is still buggy (mentioned rev had 43.0a1 milestone).

I don't have FF 44 to test. However, FF 45 works as expected.

Comment 8

[perceptron8]

FF 44.0a2 works as expected.

Comment 9

[perceptron8]

Are you sure it works when e10s is disabled?

Comment 10

[Patrick McManus [:mcmanus]]

closed based on comment 7 and 8.. we wouldn't uplift any fix farther than 45 in any event.

Comment 11

[perceptron8]

Please see https://bugzilla.mozilla.org/show_bug.cgi?id=1114891#c29. I was convinced that everything works as expected, however Loic noticed it depends on e10s.

Once more I can confirm it works... but only of e10s is enabled.
It does not work with e10s. Checked just now.

Comment 12

[perceptron8]

You are welcome to use https://github.com/perceptron8/http-on-modify-request for testing.

Comment 13

[perceptron8]

Forgive me, I made mistake in comment 11. There is: "It does not work with e10s.", should be: "It does not work with e10s disabled.". Sorry for the confusion.

To summarize everything in one sentence: flash plugin + redirection works if and only if e10s is enabled.

Comment 14

[Honza Bambas (:mayhemer)]

So is this (or some other) bug fixed or not?

Comment 15

[Honza Bambas (:mayhemer)]

Is the issue left tracked elsewhere?

Comment 16

[Patrick McManus [:mcmanus]]

I'm meant to reopen the bug too.. must have messed that part up

Comment 17

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 18

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 19

[Jens Stutte [:jstutte]]

Bulk-downgrade of unassigned, >=3 years untouched DOM/Storage bug's priority.

If you have reason to believe this is wrong, please write a comment and ni :jstutte.

Comment 20

[u597032]

Adobe Flash is no longer supported.