1475286 - Cannot click red button on standaard.be's cookie warning

Status: RESOLVED WORKSFORME

(Core :: Panning and Zooming, defect, P5)

Description

[Andreas Bovens [:abovens]]

Attachment: Screenshot_20180712-164646.jpg

1. Use Focus with GeckoView
2. Go to http://standaard.be
3. Try tapping the red button (cookie warning) at the bottom: "Ja, ik aanvaard de voorwaarden"

Actual result
Button cannot be tapped

Expected result
Button can be tapped

Comment 1

[Chris Peterson [:cpeterson]]

This bug was reported for Android GeckoView, but we can also reproduce on Firefox desktop intermittently. (We tested Windows and Linux.) James thinks this is an APZ bug related to hit testing. The button works as expected in Chrome and Edge.

This is not a regression. I can reproduce back to at least Firefox 57. For whatever reason, I seem to be able to reproduce this bug much more easily in a private browsing window, even with Tracking Protection disabled. I don't know why. Perhaps there is a timing difference when opening a new tab in a new window.

Comment 2

[Kartikaya Gupta (email:[e-mail])]

I can reliably reproduce this in a private window on Linux desktop. If I have tracking protection enabled, then every time I click on the red button, it produces an error in the console about a blocked resource from b.scorecardresearch.com. The cookie warning doesn't disappear regardless of whether TP is on or not.

However, the fact that it's running a script (and blocking a resource load) every time I click suggests that the hit-testing is working just fine, and the button is getting clicked, but the script that's supposed to hide the warning is failing for some other reason. Also, after clicking on the button once, the button has focus, and pressing the spacebar also "clicks" the button and produces the same TP warning in the console. This codepath bypasses the hit-testing code entirely, so I'm pretty sure the problem is not APZ here.

Comment 3

[Kartikaya Gupta (email:[e-mail])]

Furthermore, even in the private browsing window, after clicking on the button, if you reload the page, the cookie warning disappears. So clearly the server side knows that you clicked on the button. I looked at the network requests in the devtools console upon clicking the button and there are a bunch of very plausible requests like to a "usercontract" API endpoint with parameters that look very much like cookie acceptance.

Comment 4

[Kartikaya Gupta (email:[e-mail])]

I don't even know what component is most appropriate for this bug. Somebody needs to de-obfuscate the scripts to figure out what's going on, or get in touch with the content authors.

Comment 5

[Kartikaya Gupta (email:[e-mail])]

Seems to work now.