1778430 - HLS (http live streaming) sniffing for ORB (opaque response blocking)

Status: NEW

(Core :: Audio/Video, task)

Description

[Hsin-Yi Tsai (she/her) [:hsinyi]]

HLS manifest is fetched across origins .

As discussed in whatwg/html#6468 we need to make adjustments to handle HTTP Live Streaming correctly.

File this bug to start discussion and investigation of what is required.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Assuming I haven't missed something, HLS goes through fetch()/XHR on desktop (both FF and Chrome) since there isn't native support for it, and that means cors should be implied. But before ORB is enabled on Android, we need to do something.

Comment 2

[Chris Peterson [:cpeterson]]

Hsin-Yi says this fix is needed for Android Fission.

Comment 3

[Hsin-Yi Tsai (she/her) [:hsinyi]]

(In reply to Chris Peterson [:cpeterson] from comment #2)

Hsin-Yi says this fix is needed for Android Fission.

To be clearer, this blocks Android Fission if we plan to use the same the same remoteTypePrefix as on desktop. If so, Spectre mitigation will be disabled automatically once Android Fission is enabled, regardless of ORB ( we don't check for ORB there currently). This would lead to unintended consequences, as ORB is a hard blocker preventing the removal of spectre mitigations. However, even though we will be using another remote type, it still makes sense to fix this issue as soon as possible after Android Fission, so we can disable spectre mitigations where it makes sense, thereby reducing maintenance complexity and gaining performance.

Comment 4

[Chris Peterson [:cpeterson]]

This bug depends on whether we remove Gecko's native HLS support on Android, bug 1896931. That decision is blocked waiting on cbsnew.com HLS bug 1913403...

Comment 5

[Hsin-Yi Tsai (she/her) [:hsinyi]]

(In reply to Hsin-Yi Tsai (she/her) away [:hsinyi] from comment #3)

(In reply to Chris Peterson [:cpeterson] from comment #2)

Hsin-Yi says this fix is needed for Android Fission.

To be clearer, this blocks Android Fission if we plan to use the same the same remoteTypePrefix as on desktop. If so, Spectre mitigation will be disabled automatically once Android Fission is enabled, regardless of ORB ( we don't check for ORB there currently). This would lead to unintended consequences, as ORB is a hard blocker preventing the removal of spectre mitigations.

Leaving a comment here for clear reference: bug 1894265 ensures spectre mitigation remain enabled when ORB is not enabled on Android. So this bug is no longer a blocker for Android Fission.

However, even though we will be using another remote type, it still makes sense to fix this issue as soon as possible after Android Fission, so we can disable spectre mitigations where it makes sense, thereby reducing maintenance complexity and gaining performance.

This part is still true and important.