1626573 - Opening blob links in new tabs doesn't work (doesn't show their content)

Status: VERIFIED FIXED

(Core :: DOM: File, defect, P1)

Description

[:Gijs (he/him)]

STR:

1. open https://developer.mozilla.org/en-US/docs/Web/API/Blob#Result
   2a. right click the "open the array URL" and click "open link in new tab"

OR

2b. middle-click (or accel-click) the link

Expected:
content is visible

Actual:
no content shows up

Comment 1

[Anne (:annevk)]

I thought this was related to rel=noopener, but it seems like a bigger problem.

Comment 2

[Itiel]

The error logged on the browser console is Security Error: Content at https://mdn.mozillademos.org/en-US/docs/Web/API/Blob$samples/Creating_a_URL_representing_the_contents_of_a_typed_array?revision=1610517 may not load data from blob:https://mdn.mozillademos.org/a911c84b-144b-4442-bdeb-302e29b3808c.

I can reproduce the same issue from Chrome btw.

Comment 3

[Alice0775 White]

Regression window:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=398b5e6b2dab72d5be60bc81b0fda2d2c27bfb25&tochange=b9740bd7bf8f1a0656c09a88fe6d7ee00586ee60

Comment 4

[:Gijs (he/him)]

Thanks, Alice!

Comment 5

[Andrea Marchesini [:baku]]

Currently, we broadcast URLs based on what the content process is loading and it has loaded in the past.
The entrypoint for this broadcasting is ContentParent::AboutToLoadHttpFtpDocumentForChild.

When we load a blobURL, as the first-party context, in a process that has not loaded the corresponding origin yet, we fail because, at the creation of the nsIChannel, we try to retrieve the blobURL's principal, synchronously here:
https://searchfox.org/mozilla-central/rev/4ccefc3181f9d237ef4ca8bd17b4e7c101ddf7b5/caps/ContentPrincipal.cpp#301-306
... and of course, ContentParent::AboutToLoadHttpFtpDocumentForChild() has not been called yet.

The interesting part of the stack is this:
https://searchfox.org/mozilla-central/rev/4ccefc3181f9d237ef4ca8bd17b4e7c101ddf7b5/dom/security/nsContentSecurityManager.cpp#1085
https://searchfox.org/mozilla-central/rev/4ccefc3181f9d237ef4ca8bd17b4e7c101ddf7b5/netwerk/ipc/DocumentChannelChild.cpp#47
https://searchfox.org/mozilla-central/rev/4ccefc3181f9d237ef4ca8bd17b4e7c101ddf7b5/docshell/base/BrowsingContext.cpp#1077

The "real" fix is to complete bug 1619943. But that is an important refactoring of the code and it will take a while to be completed.

As a temporary solution, we can implement a specific workaround to send the specific blobURL to the content process before calling ::SendLoadURI here:
https://searchfox.org/mozilla-central/rev/4ccefc3181f9d237ef4ca8bd17b4e7c101ddf7b5/docshell/base/BrowsingContext.cpp#1082

Comment 6

[Anne (:annevk)]

One thing to double check is that the workaround also works for <a href=blob:... target=_blank rel=noopener>.

Comment 7

[Subhamoy [:ssengupta][he/him]]

Attachment: Bug 1626573 - P1 - BrowsingContext transmits BlobURL before loading an URI if URI is a BlobURL r=baku

Comment 8

[Subhamoy [:ssengupta][he/him]]

Attachment: Bug 1626573 - P2 - Browser Mochitests added to test if opening blob URL in a new tab by right clicking works r=baku

Depends on D69717

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/00443a958bbc
P1 - BrowsingContext transmits BlobURL before loading an URI if URI is a BlobURL r=baku
https://hg.mozilla.org/integration/autoland/rev/0d461e174640
P2 - Browser Mochitests added to test if opening blob URL in a new tab by right clicking works r=baku

Comment 10

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a0d6988a22b1
Backed out 2 changesets for causing lint failures CLOSED TREE

Comment 11

[Andrei Ciure[:aciure]]

push with failure: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=0d461e1746403eb791ee5d3069dd5ea81a301eb0&selectedJob=296951737&searchStr=Linting%2Copt%2CJavaScript%2Cchecks%2Csource-test-mozlint-eslint%2Cjs%28ES%29

log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=296951737&repo=autoland&lineNumber=331
[task 2020-04-09T12:28:50.973Z] 12:28:50.972 eslint (97) | Finished in 103.33 seconds
[task 2020-04-09T12:29:36.653Z] 12:29:36.653 eslint (98) | Finished in 149.01 seconds
[task 2020-04-09T12:33:49.136Z] 12:33:49.136 eslint (99) | Finished in 401.49 seconds
[task 2020-04-09T12:40:49.893Z] 12:40:49.893 eslint (100) | Finished in 822.24 seconds
[task 2020-04-09T12:40:49.898Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js:21:50 | Replace gBrowser.selectedBrowser,·{·selector·}, with ⏎····gBrowser.selectedBrowser,⏎····{·selector·},⏎··· (prettier/prettier)
[task 2020-04-09T12:40:49.898Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js:22:1 | Insert ·· (prettier/prettier)
[task 2020-04-09T12:40:49.898Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js:23:3 | Replace } with ··}⏎·· (prettier/prettier)
[task 2020-04-09T12:40:49.898Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js:28:55 | Replace contextMenu,·"popupshown" with ⏎····contextMenu,⏎····"popupshown"⏎·· (prettier/prettier)
[task 2020-04-09T12:40:49.898Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js:30:50 | Replace '#'·+·selector,·{·type:·"contextmenu",·button:·2·},·gBrowser.selectedBrowser with ⏎····"#"·+·selector,⏎····{·type:·"contextmenu",·button:·2·},⏎····gBrowser.selectedBrowser⏎·· (prettier/prettier)
[task 2020-04-09T12:40:49.899Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js:33:56 | Replace contextMenu,·"popuphidden" with ⏎····contextMenu,⏎····"popuphidden"⏎·· (prettier/prettier)
[task 2020-04-09T12:40:49.899Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js:50:53 | Replace gBrowser.selectedBrowser,·null,·async·function· with ⏎····gBrowser.selectedBrowser,⏎····null,⏎····async·function (prettier/prettier)
[task 2020-04-09T12:40:49.899Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js:51:1 | Insert ·· (prettier/prettier)
[task 2020-04-09T12:40:49.899Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js:52:1 | Replace ··} with ····}⏎·· (prettier/prettier)
[task 2020-04-09T12:40:49.899Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js:60:73 | Replace 'blob-url-link' with ⏎····"blob-url-link"⏎·· (prettier/prettier)
[task 2020-04-09T12:40:49.899Z] TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js:65:73 | Replace 'blob-url-referrer-link' with ⏎····"blob-url-referrer-link"⏎·· (prettier/prettier)
[taskcluster 2020-04-09 12:40:50.972Z] === Task Finished ===
[taskcluster 2020-04-09 12:40:51.285Z] Unsuccessful task run with exit code: 1 completed in 1151.784 seconds

Comment 12

[Cosmin Sabou [:CosminS]]

That patch has also turned bug 1424433 into permafail: https://treeherder.mozilla.org/#/jobs?repo=autoland&group_state=expanded&searchStr=os%2Cx%2C10.14%2Cshippable%2Copt%2Cmochitests%2Ctest-macosx1014-64-shippable%2Fopt-mochitest-browser-chrome-e10s-2%2Cm%28bc2%29&fromchange=f85190eebb8e6b3df7a8be42e9a855fbf41180bf&tochange=a0d6988a22b18f4fb5739452b3a8e6ad9af092eb&selectedJob=296972075

Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=296972075&repo=autoland

Comment 13

[guest271314]

Attachment: FirefoxBlobURLPastingNavigationBroken.html

Able to reproduce at Firefox 75 and Nightly 77. See attached HTML file and plnkr to demonstrate https://plnkr.co/edit/snGG7WcXOmImN6cl?preview.

window.open(<BlobURL>) does open the BlobURL, otherwise the error message

Hmm. That address doesn’t look right. Please check that the URL is correct and try again.

is displayed at the tab.

This is particularly problematic when attemting to capture the output of a a bug, frozen tab or browser or crash using getDisplayMedia() as the user might only get one chance to capture the visual output of a frozen tab of browser before a complete crash, which happened to occur yesterday when experienced a crash using AudioWorklet with Disable Cache checked at Network tab at Developer Tools.

Comment 14

[guest271314]

Attachment: Screenshot_2020-04-12_18-35-45.png

See attached image displaying window.open() displaying contents of Blob though error message when pasting the URL to address bar and pressing Enter.

Comment 15

[Subhamoy [:ssengupta][he/him]]

(In reply to Cosmin Sabou [:CosminS] from comment #12)

That patch has also turned bug 1424433 into permafail: https://treeherder.mozilla.org/#/jobs?repo=autoland&group_state=expanded&searchStr=os%2Cx%2C10.14%2Cshippable%2Copt%2Cmochitests%2Ctest-macosx1014-64-shippable%2Fopt-mochitest-browser-chrome-e10s-2%2Cm%28bc2%29&fromchange=f85190eebb8e6b3df7a8be42e9a855fbf41180bf&tochange=a0d6988a22b18f4fb5739452b3a8e6ad9af092eb&selectedJob=296972075

Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=296972075&repo=autoland

Made some modifications. Re-running the test to see the current status.

Comment 16

[Emilio Cobos Álvarez (:emilio)]

FYI, depending on which order does this land with respect to https://phabricator.services.mozilla.com/D70937, you may need to remove the skipTests bits in there.

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cd9de3c507ff
P1 - BrowsingContext transmits BlobURL before loading an URI if URI is a BlobURL r=baku
https://hg.mozilla.org/integration/autoland/rev/d2ee826f13fa
P2 - Browser Mochitests added to test if opening blob URL in a new tab by right clicking works r=baku

Comment 18

[Stefan Hindli [:stefan_hindli]]

Backed out 2 changesets (Bug 1626573) for perma bc failures in browser/base/content/test/contextMenu/browser_contextmenu_loadblobinnewtab.js CLOSED TREE

https://treeherder.mozilla.org/#/jobs?repo=autoland&selectedJob=297728101&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&revision=beea44acc63af6585d07ac02d0e44ed1ceb26ce2

https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=d2ee826f13fa28c54665b57e7c30b99f267f0b37&selectedJob=297730080

https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=297730080&repo=autoland&lineNumber=2843

Comment 19

[Subhamoy [:ssengupta][he/him]]

Updated the patches.

Comment 20

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8cfd349a3921
P1 - BrowsingContext transmits BlobURL before loading an URI if URI is a BlobURL r=baku
https://hg.mozilla.org/integration/autoland/rev/47168f57dad2
P2 - Browser Mochitests added to test if opening blob URL in a new tab by right clicking works r=baku

Comment 21

[Subhamoy [:ssengupta][he/him]]

Attachment: Bug 1626573 - P3 - Browser mochitests revised to prevent intermittent failure r=baku,gijs

BrowserTestUtils.browserLoaded() does not always wait for loading to complete when used without includeSubFrames=false and wantLoad=url.

Comment 22

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/8cfd349a3921
https://hg.mozilla.org/mozilla-central/rev/47168f57dad2

Comment 23

[Marcela (Please NI request to Brindusa Tot)]

I can confirm this issue is fixed, I verified using Nightly 77.0a1 on Windows 10 x64. Version 78.0a1 is not affected. Changed flags accordingly.