Closed Bug 2034019 Opened 3 months ago Closed 3 months ago

search.yahoo.com / yahoo.com - The search results are not displayed on the first attempt in Release and ESR versions

Categories

(Web Compatibility :: Site Reports, defect, P1)

Product:
Web Compatibility
Component:
Site Reports
Platform:
Desktop
Windows 11
Type:
defect

Tracking

(Webcompat Priority:P1, Webcompat Score:10)

Status:
VERIFIED FIXED
Project Flags:
Webcompat Priority P1
Webcompat Score 10

People

(Reporter: bfarkas, Unassigned)

References

(
URL
)

Details

(Keywords: regression, webcompat:needs-diagnosis, webcompat:site-report, Whiteboard: [webcompat-source:web-bugs][webcompat:sightline][webcompat:core])

User Story

platform:windows,mac,linux,android
impact:site-broken
configuration:general
affects:all
branch:release
diagnosis-team:networking
user-impact-score:3000

Attachments

(6 files)

search.yahoo.com blank page
203.50 KB, video/mp4
Details
yahoo.com - 'about:blank' page
1.31 MB, video/mp4
Details
test-window-open.html
1.38 KB, text/html
Details
Firefox: blank page on first navigation to search.yahoo.com/search?p=test
17.29 KB, image/png
Details
Chrome: search results displayed correctly for same URL
112.77 KB, image/png
Details
Firefox: search results load correctly on second attempt
138.30 KB, image/png
Details

Environment:
Operating system: Windows 11 / Windows 10
Firefox version: Firefox 140.10.0esr / Firefox Release 150.0 (64-bit) / Firefox Beta 150.0b10 (64-bit)

Preconditions:
Clean profile

Steps to reproduce:

  1. Access: https://www.yahoo.com/
  2. Write any text in the search bar
  3. Click on Search button / Press Enter key
  4. Observe the new tab

Expected Behavior:
The search result is displayed accordingly in the new tab

Actual Behavior:
In the new tab's address bar about:blank is displayed and the search result is not loaded

Notes:

  • If accessing the search page directly: https://search.yahoo.com/search?p=test, only a blank page is displayed on the first attempt
  • The pages can be loaded on second attempt
  • Reproduces regardless of the status of ETP
  • Reproduces in firefox-release, firefox-beta/ ESR
  • Does not reproduce in firefox-nightly and chrome

Created from https://github.com/webcompat/web-bugs/issues/217070

status-firefox151: --- → affected
status-firefox152: --- → unaffected
status-firefox151: affected → ---
Whiteboard: [webcompat-source:web-bugs] → [webcompat-source:web-bugs][webcompat:sightline][webcompat:core]
Severity: -- → S2
User Story: (updated)
Webcompat Priority: --- → P1
Webcompat Score: --- → 10
Keywords: webcompat:needs-diagnosis
Priority: -- → P1
Flags: needinfo?(kberezina)

I can reliably reproduce this in release, but can't seem to find a fixing range with mozregression --find-fix as it's working as expected in builds even from 2 years ago.

Flags: needinfo?(kberezina)

Since the status is marked as unaffected for nightly and as affected for release, is it unaffected or affected for beta?
For more information, please visit BugBot documentation.

status-firefox151: --- → ?
User Story: (updated)
Attached file test-window-open.html —

Looks like yahoo creating a custom wrapper around window.open, but it doesn't seem to be what's causing this behavior as I can reproduce this with just window.open(url, '_blank');. With this testcase it's reproducible it exactly once and after starts working as expected, but following these steps I can reproduce it consistently:

  1. Create a new profile in release (150.0.0) on about:profiles and click on Launch profile in new browser
  2. Open the testcase, enter search term and click search

Expected:
A yahoo page with url https://ca.search.yahoo.com/search?... opens
Actual:
Empty about:blank page

Note: if you click on the search button again, it works as expected. To reproduce the problem again, close the browser and click on Launch profile in new browser on the same profile that was created and follow steps 1 and 2.

Hi Vincent,
Several of DOM engineers tried to reproduce this in our triage meeting and none of us can reproduce this, either in Nightly or in Release. We also tested on Windows, MacOS and Ubuntu.

We know that this isn't relevant with the big about:blank changes landed in Fx 148 as it's also reproducible in ESR. However, this looks very about:blank in general so I'd like to use your investigation help. thank you.

User Story: (updated)
Flags: needinfo?(vhilla)

Can reproduce with Linux Release 150 and Win 11 Release 150.
Couldn't reproduce with Linux Nightly 152 or Win 11 Nightly 152.

Profile with logging: https://share.firefox.dev/4tYmJxM

I think the NS_ERROR_ABORT is interesting, that's also in line with gBrowser.selectedBrowser.browsingContext.currentWindowGlobal.isUncommittedInitialDocument being true.

[Child 63335: Main Thread]: V/DocumentChannel DocumentChannel ctor [this=7ff6d5313160, uri=https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1]
[Child 63335: Main Thread]: V/DocumentChannel DocumentChannelChild ctor [this=7ff6d5313160, uri=https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1]
[Parent 62987: Main Thread]: I/BCWebProgress OnLocationChange({isTopLevel:1, isLoadingDocument:0}, <null>, about:blank, 0) on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: I/BCWebProgress OnSecurityChange({isTopLevel:1, isLoadingDocument:0}, <null>, 4) on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: I/BCWebProgress OnStateChange({isTopLevel:1, isLoadingDocument:0}, {URI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1, originalURI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1}, STATE_START|STATE_IS_REQUEST|STATE_IS_DOCUMENT|STATE_IS_NETWORK|STATE_IS_WINDOW, NS_OK) on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: V/DocumentChannel DocumentChannelParent ctor [this=7eccc4e5cbe0]
[Parent 62987: Main Thread]: V/DocumentChannel DocumentChannelParent Init [this=7eccc4e5cbe0, uri=https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1]
[Parent 62987: Main Thread]: V/DocumentChannel DocumentLoadListener ctor [this=7eccd68e0480]
[Parent 62987: Main Thread]: V/DocumentChannel DocumentLoadListener [7eccd68e0480] OpenDocument [uri=https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1]
[Parent 62987: Main Thread]: V/DocumentChannel ParentProcessDocumentOpenInfo ctor [this=7eccc4567b00]
[Parent 62987: Main Thread]: I/BCWebProgress OnContentBlockingEvent({isTopLevel:1, isLoadingDocument:1}, {URI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1, originalURI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1}, 8000) on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: I/BCWebProgress OnStatusChange({isTopLevel:1, isLoadingDocument:1}, {URI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1, originalURI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1}, NS_NET_STATUS_RESOLVING_HOST, "Looking up ca.search.yahoo.com…") on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: I/BCWebProgress OnStatusChange({isTopLevel:1, isLoadingDocument:1}, {URI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1, originalURI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1}, NS_NET_STATUS_RESOLVED_HOST, "Looked up ca.search.yahoo.com…") on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: I/BCWebProgress OnStatusChange({isTopLevel:1, isLoadingDocument:1}, {URI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1, originalURI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1}, NS_NET_STATUS_CONNECTING_TO, "Connecting to ca.search.yahoo.com…") on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: I/BCWebProgress OnStatusChange({isTopLevel:1, isLoadingDocument:1}, {URI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1, originalURI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1}, NS_NET_STATUS_CONNECTED_TO, "Connected to ca.search.yahoo.com…") on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: I/BCWebProgress OnStatusChange({isTopLevel:1, isLoadingDocument:1}, {URI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1, originalURI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1}, NS_NET_STATUS_TLS_HANDSHAKE_STARTING, "Performing a TLS handshake to ca.search.yahoo.com…") on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: I/BCWebProgress OnStatusChange({isTopLevel:1, isLoadingDocument:1}, {URI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1, originalURI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1}, NS_NET_STATUS_TLS_HANDSHAKE_ENDED, "The TLS handshake finished for ca.search.yahoo.com…") on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: I/BCWebProgress OnStatusChange({isTopLevel:1, isLoadingDocument:1}, {URI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1, originalURI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1}, NS_NET_STATUS_WAITING_FOR, "Waiting for ca.search.yahoo.com…") on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: V/DocumentChannel ParentProcessDocumentOpenInfo OnStartRequest [this=7eccc4567b00]
[Parent 62987: Main Thread]: V/DocumentChannel ParentProcessDocumentOpenInfo OnDocumentStartRequest [this=7eccc4567b00]
[Parent 62987: Main Thread]: V/DocumentChannel DocumentLoadListener OnStartRequest [this=7eccd68e0480]
[Parent 62987: Main Thread]: V/ProcessIsolation Skipping process switch, as DocShell will not display content (status: NS_ERROR_ABORT) https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1
[Parent 62987: Main Thread]: V/DocumentChannel DocumentLoadListener::TriggerRedirectToRealChannel [this=7eccd68e0480] aDestinationBrowsingContext=500000001 aDestinationProcess=-1
[Parent 62987: Main Thread]: V/DocumentChannel DocumentLoadListener RedirectToRealChannel [this=7eccd68e0480] aRedirectFlags=4, aLoadFlags=2d0004
[Child 63335: Main Thread]: V/DocumentChannel DocumentChannelChild RecvRedirectToRealChannel [this=7ff6d5313160, uri=https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1]
[Child 63335: Main Thread]: V/DocumentChannel DocumentChannelChild OnRedirectVerifyCallback [this=7ff6d5313160, aRv=0x00000000 ]
[Child 63335: Main Thread]: V/DocumentChannel DocumentChannelChild dtor [this=7ff6d5313160]
[Parent 62987: Main Thread]: V/DocumentChannel DocumentLoadListener RedirectToRealChannelFinished [this=7eccd68e0480, aRv=0 ]
[Parent 62987: Main Thread]: V/DocumentChannel DocumentChannelParent dtor [this=7eccc4e5cbe0]
[Parent 62987: Main Thread]: V/DocumentChannel DocumentLoadListener FinishReplacementChannelSetup [this=7eccd68e0480, aResult=0]
[Parent 62987: Main Thread]: V/DocumentChannel DocumentLoadListener ResumeSuspendedChannel [this=7eccd68e0480]
[Parent 62987: Main Thread]: V/DocumentChannel ParentProcessDocumentOpenInfo dtor [this=7eccc4567b00]
[Parent 62987: Main Thread]: V/DocumentChannel DocumentLoadListener dtor [this=7eccd68e0480]
[Parent 62987: Main Thread]: I/BCWebProgress OnStateChange({isTopLevel:1, isLoadingDocument:1}, {URI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1, originalURI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1}, STATE_STOP|STATE_IS_DOCUMENT, NS_ERROR_ABORT) on {top:1, id:500000001, url:about:blank}
[Parent 62987: Main Thread]: I/BCWebProgress OnStateChange({isTopLevel:1, isLoadingDocument:1}, {URI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1, originalURI:https://ca.search.yahoo.com/search?p=foo&fr=yfp-t&fr2=p%3Afp%2Cm%3Asb&fp=1}, STATE_STOP|STATE_IS_NETWORK|STATE_IS_WINDOW, NS_ERROR_ABORT) on {top:1, id:500000001, url:about:blank}

It's unique to Yahoo, doesn't happen with Google or example.com. Maybe it's related to a redirect Yahoo does.

If I try a second time, the logs won't contain a DNS lookup or TLS handshake and start to differ more at Skipping process switch, as DocShell will not display content where the working example does perform a process switch. So the NS_ERROR_ABORT seems to point to the issue here, but my log doesn't show where it comes from.

Profile with more logging enabled (ProcessIsolation:5,DocumentChannel:5,nsDocShell:4,BCWebProgress:5,nsHttp:5): https://share.firefox.dev/42p9pGX

Vincent, are you seeing a problem with Nightly 152, too? The current 152-status is unaffected.

No, I can't reproduce it with Nightly 152. But I also can't reproduce it with ./mach mozregression --launch 150, so perhaps the release configuration is relevant.

Yes, it does reproduce with ./mach mozregression --launch 150 --repo mozilla-release. It also reproduces with a mozilla-central release build edit: I was still on the release branch for recording the pernosco trace. It doesn't seem to reproduce on mozilla-central.

Pernosco recording from a local release branch build: https://pernos.co/debug/HlAmcyuF8i4IXkX7eBs0PQ/index.html

  • nsHttpConnection::OnInputStreamReady calls CloseTransaction due to NS_BASE_STREAM_CLOSED
  • That is set in nsHttpConnection::OnWriteSegment when (*countWritten == 0)

I didn't see any relevant logging pointing to DOM canceling the load and from where this comes from, this looks like a networking issue.

:hsinyi, should we move diagnosis-team to necko? I don't know how this is done for webcompat bugs.

Flags: needinfo?(vhilla) → needinfo?(htsai)
Duplicate of this bug: 2030771
See Also: → 2031100

(In reply to Vincent Hilla [:vhilla] from comment #13)

Pernosco recording from a local release branch build: https://pernos.co/debug/HlAmcyuF8i4IXkX7eBs0PQ/index.html

  • nsHttpConnection::OnInputStreamReady calls CloseTransaction due to NS_BASE_STREAM_CLOSED
  • That is set in nsHttpConnection::OnWriteSegment when (*countWritten == 0)

I didn't see any relevant logging pointing to DOM canceling the load and from where this comes from, this looks like a networking issue.

:hsinyi, should we move diagnosis-team to necko? I don't know how this is done for webcompat bugs.

Thanks for the findings so far. I'm moving this to Necko by editing the User Story field.

User Story: (updated)
Flags: needinfo?(htsai)
User Story: (updated)
User Story: (updated)
User Story: (updated)

Automated reproduction using Playwright (headless) confirms the issue:

Test: Direct navigation to https://search.yahoo.com/search?p=test

  • Firefox (Nightly-based): Navigation fails with NS_ERROR_ABORT, page ends up on about:blank (see attachment "Firefox: blank page on first navigation...")
  • Chrome: Page loads correctly showing Yahoo search results (see attachment "Chrome: search results displayed correctly...")
  • Firefox second attempt: Works correctly, search results load (see attachment "Firefox: search results load correctly on second attempt")

Test: Yahoo.com homepage → search → new tab

  • Firefox: Clicking the search button opens a new tab that remains blank (empty URL, no content)
  • (Chrome comparison not needed; the direct URL test already shows the difference)

Additional observations from Firefox:

  • Console warning: "yahoo.com" has been classified as a bounce tracker. If it does not receive user activation within the next 3,600 seconds it will have its state purged.
  • Network log: [GET] https://search.yahoo.com/search?p=test => [FAILED] NS_ERROR_ABORT (two failed requests)

The "bounce tracker" classification is notable — this may interact with the navigation/loading pipeline and could explain why the first attempt fails but subsequent ones succeed (after the domain receives user activation). This is consistent with comment 9's finding that it's unique to Yahoo and doesn't happen with Google or example.com.

This is an automated analysis result. If this result is incorrect please add a needinfo and feel free to correct the error.

Can I point out that this is not happening with my windows seven machines which are no longer getting updates to firefox?
Meaning that while something might be up with what Yahoo is doing, it's not affecting machines which running that particular version.

If this repros on a debug build of the release branch it should be straight-forward to record a pernosco trace of it?

Can reproduce with Firefox 140 release with mozregression --launch 140.0 -a https://www.yahoo.com/. Cannot reproduce with 135.0a1 Nightly.

Somehow my 152 nightly is now stuck and always opens about:blank.

(In reply to Emilio Cobos Álvarez [:emilio] from comment #21)

If this repros on a debug build of the release branch it should be straight-forward to record a pernosco trace of it?

comment 13
https://pernos.co/debug/HlAmcyuF8i4IXkX7eBs0PQ/index.html

See Also: → https://pernos.co/debug/HlAmcyuF8i4IXkX7eBs0PQ/index.html

Doesn't repro on 110 release with comment #6. Will try getting a (broad) bisect.

Does not repro on 130 but does on 140. Continuing...

Edit: Does repro on 135, not on 133

Bisect on release finished, 134.0 is the first affected release build.

Err, in Slack people had different bisect result, now I see 132 and 133 repro but not 131. Also mozregression --launch 150.0 --pref "security.pki.certificate_transparency.mode:1" -a https://bug2034019.bmoattachments.org/attachment.cgi?id=9572948 makes it work.

Keywords: regression
Regressed by: 1355903

Release builds doing autoupgrade is screwing my bisect. Now I cannot repro on 134 but can on 135.

No longer regressed by: 1355903
diff --git a/134-pref.yaml b/135-pref.yaml
index 5c5992d7b32e..7364514f7470 100644
--- a/134-pref.yaml
+++ b/135-pref.yaml
@@ -679,6 +679,11 @@
   value: @IS_NOT_ANDROID@
   mirror: always
 
+- name: apz.keyboard.focus-optimization
+  type: bool
+  value: false
+  mirror: always
+
 - name: apz.max_tap_time
   type: RelaxedAtomicInt32
   value: 300
@@ -704,6 +709,11 @@
   value: false
   mirror: always
 
+- name: apz.mousemove_hittest_optimization.enabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 - name: apz.one_touch_pinch.enabled
   type: RelaxedAtomicBool
   value: @IS_ANDROID@
@@ -783,6 +793,11 @@
   value: true
   mirror: always
 
+- name: apz.popups_without_remote.enabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 # Whether to print the APZC tree for debugging.
 - name: apz.printtree
   type: RelaxedAtomicBool
@@ -1602,7 +1617,7 @@
 
 - name: browser.navigation.requireUserInteraction
   type: bool
-  value: @IS_EARLY_BETA_OR_EARLIER@
+  value: true
   mirror: always
 
 # Indicates if about:newtab shows content (enabled) or just blank.
@@ -2198,6 +2213,7 @@
 # Prefs starting with "datareporting."
 #---------------------------------------------------------------------------
 
+# Do note that the toggle on Fenix and Focus does NOT reflect to this pref.
 - name: datareporting.healthreport.uploadEnabled
   type: RelaxedAtomicBool
   value: false
@@ -2325,12 +2341,6 @@
   value: true
   mirror: always
 
-# Block multiple window.open() per single event.
-- name: dom.block_multiple_popups
-  type: bool
-  value: true
-  mirror: always
-
 # The maximum number of popup that is allowed to be opened. Set to -1 for no
 # limit.
 - name: dom.popup_maximum
@@ -2485,7 +2495,7 @@
 # Enable/disable contenteditable="plaintext-only".
 - name: dom.element.contenteditable.plaintext-only.enabled
   type: bool
-  value: @IS_NIGHTLY_BUILD@
+  value: @IS_EARLY_BETA_OR_EARLIER@
   mirror: always
 
 # Whether Dialog elements emit beforetoggle and toggle events during opening and closing.
@@ -2571,7 +2581,7 @@
 # Whether the scheduler interface will be exposed
 - name: dom.enable_web_task_scheduling
   type: RelaxedAtomicBool
-  value: @IS_NIGHTLY_BUILD@
+  value: false
   mirror: always
 
 # If this is true, it's allowed to fire "cut", "copy" and "paste" events.
@@ -2616,6 +2626,36 @@
   value: @IS_NOT_EARLY_BETA_OR_EARLIER@
   mirror: always
 
+# Whether the result of screenX, screenY, clientX, clientY, offsetX, offsetY,
+# x and y of trusted MouseEvent and subclasses may be fractional values.
+# Enabling this may cause backward compatibility issues.
+# Note that this pref is referred only when
+# `dom.event.pointer.fractional_coordinates.enabled` is `true`.
+- name: dom.event.mouse.fractional_coordinates.trusted.enabled
+  type: bool
+  value: false
+  mirror: always
+
+# Whether the result of screenX, screenY, clientX, clientY, offsetX, offsetY,
+# x and y of untrusted MouseEvent and subclasses may be fractional values.
+# I.e., this allows web apps to use fractional values with their own DOM events
+# which have MouseEvent interface.  However, this might cause backward
+# compatibility issues if web apps initializes untrusted events with quotients.
+# Note that this pref is referred only when
+# `dom.event.pointer.fractional_coordinates.enabled` is `true`.
+- name: dom.event.mouse.fractional_coordinates.untrusted.enabled
+  type: bool
+  value: false
+  mirror: always
+
+# Whether the result of screenX, screenY, clientX, clientY, offsetX, offsetY,
+# x and y of PointerEvent may be fractional values (except `click`, `auxclick`
+# and `contextmenu`)
+- name: dom.event.pointer.fractional_coordinates.enabled
+  type: bool
+  value: true
+  mirror: always
+
 # Whether wheel event target's should be grouped. When enabled, all wheel
 # events that occur in a given wheel transaction have the same event target.
 - name: dom.event.wheel-event-groups.enabled
@@ -2662,7 +2702,7 @@
 # target is removed from the DOM tree.
 - name: dom.events.mouse-pointer-boundary.keep-enter-targets-after-over-target-removed
   type: bool
-  value: @IS_EARLY_BETA_OR_EARLIER@
+  value: true
   mirror: always
 
 # Whether .offset{X,Y} for events targeted at SVG nodes returns bounds relative
@@ -3168,14 +3208,14 @@
 # Is support for key events and focus events on disabled elements enabled?
 - name: dom.forms.always_allow_key_and_focus_events.enabled
   type: bool
-  value: @IS_EARLY_BETA_OR_EARLIER@
+  value: true
   mirror: always
 
 # Whether to disable only the descendants or the parent fieldset element too
 # Note that this still allows it to be selected by `:disable`.
 - name: dom.forms.fieldset_disable_only_descendants.enabled
   type: bool
-  value: @IS_EARLY_BETA_OR_EARLIER@
+  value: true
   mirror: always
 
 # Does mousewheel-scrolling over a focused <input type="number"> or
@@ -5525,7 +5565,11 @@
 # If true, crash when a blocklisted preference is accessed in a subprocess
 - name: fission.enforceBlocklistedPrefsInSubprocesses
   type: RelaxedAtomicBool
-  value: @IS_EARLY_BETA_OR_EARLIER@
+#ifdef DEBUG
+  value: true
+#else
+  value: false
+#endif
   mirror: always
 
 #---------------------------------------------------------------------------
@@ -5706,6 +5750,13 @@
     mirror: always
     rust: true
 
+#ifdef FUZZING_SNAPSHOT
+-   name: fuzzing.snapshot.enabled
+    type: RelaxedAtomicBool
+    value: true
+    mirror: always
+#endif
+
 # This configures a virtual authenticator for WebAuthn. The value encodes the
 # arguments to the WebDriver "Add Virtual Authenticator" extension command.
 # Bits 0, 1, 2, and 3 encode "is_user_verified", "is_user_consenting",
@@ -6027,7 +6078,7 @@
 
 - name: gfx.canvas.accelerated.cache-items
   type: RelaxedAtomicUint32
-  value: 2048
+  value: 8192
   mirror: always
 
 - name: gfx.canvas.accelerated.cache-size
@@ -7026,6 +7077,15 @@
 #endif
   mirror: once
 
+#ifdef NIGHTLY_BUILD
+  # Keep this pref hidden on non-nightly builds to avoid people accidentally
+  # turning it on.
+- name: gfx.webrender.layer-compositor
+  type: bool
+  value: false
+  mirror: once
+#endif
+
 - name: gfx.webrender.scissored-cache-clears.enabled
   type: bool
   value: true
@@ -8284,6 +8344,15 @@
 
 #endif  // NIGHTLY_BUILD
 
+#ifdef JS_HAS_TEMPORAL_API
+  # Experimental support for Temporal in JavaScript.
+- name: javascript.options.experimental.temporal
+  type: bool
+  value: false
+  mirror: always
+  set_spidermonkey_pref: startup
+#endif  // JS_HAS_TEMPORAL_API
+
 #ifdef ENABLE_EXPLICIT_RESOURCE_MANAGEMENT
   # Experimental support for Explicit Resource Management in JavaScript.
 -   name: javascript.options.experimental.explicit_resource_management
@@ -8295,7 +8364,7 @@
 
 -   name: javascript.options.experimental.json_parse_with_source
     type: bool
-    value: false
+    value: true
     mirror: always
     set_spidermonkey_pref: always
 
@@ -8508,7 +8577,7 @@
 # Use wasm_lazy_tiering to enable it for any module.
 -   name: javascript.options.wasm_lazy_tiering_for_gc
     type: bool
-    value: false
+    value: true
     mirror: always
     set_spidermonkey_pref: always
 
@@ -8558,14 +8627,15 @@
   mirror: always
   set_spidermonkey_pref: always
 
-# When selecting a call_ref target for speculative inlining, this is the minimum
+# When selecting call_ref targets for speculative inlining, this is the minimum
 # percentage of the total number of calls from the call site that a candidate
-# must have in order to be elegible for inlining.  Allowable: 10 .. 100 (%).
-# Setting it (eg) 75 means the hottest target must be 75% of all observed calls
-# to be considered for inlining.  Probably unwise to let this be much below 50.
+# set of targets must collectively have in order to be elegible for inlining.
+# Allowable: 10 .. 100 (%).  Setting it (eg) 75 means the targets must collectively
+# be 75% of all observed calls to be considered for inlining.  Probably unwise to
+# let this be much below 40.
 - name: javascript.options.wasm_call_ref_inlining_percent
   type: uint32_t
-  value: 50
+  value: 40
   mirror: always
   set_spidermonkey_pref: always
 
@@ -9116,6 +9186,13 @@
   mirror: always
   rust: true
 
+# Whether the `-moz-user-input` property is exposed to content.
+- name: layout.css.moz-user-input.enabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+  rust: true
+
 # This pref controls whether the `prefers-color-scheme` value of iframes images
 # reacts to the embedder `color-scheme` in content.
 - name: layout.css.iframe-embedder-prefers-color-scheme.content.enabled
@@ -9834,12 +9911,6 @@
   value: false
   mirror: always
 
-# Enables the Reveal Password context-menu entry.
-- name: layout.forms.reveal-password-context-menu.enabled
-  type: bool
-  value: true
-  mirror: always
-
 # If enabled, textareas won't include 'overflow:auto' scrollbars in their
 # block-axis size (usually height).
 - name: layout.forms.textarea-sizing-excludes-auto-scrollbar.enabled
@@ -10651,6 +10722,12 @@
   value: @IS_NOT_XP_MACOSX@
   mirror: always
 
+# How long in milliseconds before timing out to destroy en/decoders gracefully
+- name: media.gmp.coder-shutdown-timeout-ms
+  type: RelaxedAtomicUint32
+  value: 1000
+  mirror: always
+
 #if defined(XP_LINUX) && defined(MOZ_SANDBOX)
   # Whether to allow, on a Linux system that doesn't support the necessary
   # sandboxing features, loading Gecko Media Plugins unsandboxed.  However, EME
@@ -10713,6 +10790,11 @@
 #endif
   mirror: always
 
+- name: media.ffvpx-hw.enabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 # The codecs in the vendored ffmpeg copy are usually prefered to the other
 # codecs. This allows changing this policy for testing purposes.
 - name: media.prefer-non-ffvpx
@@ -12003,6 +12085,22 @@
 #endif
   mirror: always
 
+- name: media.webrtc.codec.video.av1.enabled
+  type: RelaxedAtomicBool
+#if defined(MOZ_AV1)
+  value: @IS_NIGHTLY_BUILD@
+#else
+  value: false
+#endif
+  mirror: always
+
+# If true, then AV1 will be used as the preferred codec for WebRTC video.
+# After the AV1 codec is enabled by default, this pref will be renamed.
+- name: media.webrtc.codec.video.av1.experimental_preferred
+  type: bool
+  value: false
+  mirror: always
+
 - name: media.webrtc.simulcast.vp9.enabled
   type: RelaxedAtomicBool
   value: false
@@ -12410,7 +12508,7 @@
 # cookieBehavior=5.
 - name: network.cookie.cookieBehavior.trackerCookieBlocking
   type: bool
-  value: true
+  value: @IS_NOT_NIGHTLY_BUILD@
   mirror: always
 
 # Whether to support CHIPS(Cookies Having Independent Partitioned State).
@@ -12464,6 +12562,11 @@
   value: false
   mirror: always
 
+- name: network.cookie.sameSite.laxByDefaultWarningsForBeta
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 # lax-by-default 2 minutes tollerance for unsafe methods. The value is in seconds.
 - name: network.cookie.sameSite.laxPlusPOST.timeout
   type: uint32_t
@@ -12565,7 +12668,7 @@
   # in response to a Refresh header.
 - name: network.http.referer.sendFromRefresh
   type: bool
-  value: false
+  value: @IS_NIGHTLY_BUILD@
   mirror: always
 
 # false=real referer, true=spoof referer (use target URI as referer).
@@ -12588,6 +12691,12 @@
   value: 2
   mirror: always
 
+# Include an idempotency-key header for POST requests
+- name: network.http.idempotencyKey.enabled
+  type: RelaxedAtomicBool
+  value: @IS_NIGHTLY_BUILD@
+  mirror: always
+
 # Whether to respect the redirected-tainted origin flag
 # https://fetch.spec.whatwg.org/#concept-request-tainted-origin
 - name: network.http.origin.redirectTainted
@@ -13391,7 +13500,11 @@
 # every page reload.
 - name: network.dns.only_refresh_on_fresh_connection
   type: RelaxedAtomicBool
+#ifdef EARLY_BETA_OR_EARLIER
+  value: false
+#else
   value: true
+#endif
   mirror: always
 
 # When true, DNS resolutions will downgrade DNS
@@ -13402,6 +13515,86 @@
   value: false
   mirror: always
 
+# This preference specifies a list of domains for which DNS lookups will be
+# IPv4 only. Works around broken DNS servers which can't handle IPv6 lookups
+# and/or allows the user to disable IPv6 on a per-domain basis. See bug 68796.
+- name: network.dns.ipv4OnlyDomains
+  type: String
+  value: ""
+  mirror: never
+
+# This is the number of dns cache entries allowed
+- name: network.dnsCacheEntries
+  type: RelaxedAtomicUint32
+  value: 400
+  mirror: always
+
+# In the absence of OS TTLs, the DNS cache TTL value
+- name: network.dnsCacheExpiration
+  type: RelaxedAtomicUint32
+  value: 60
+  mirror: always
+
+# Get TTL; not supported on all platforms; nop on the unsupported ones.
+- name: network.dns.get-ttl
+  type: RelaxedAtomicBool
+  value: true
+  mirror: always
+
+# For testing purposes! Makes the native resolver resolve IPv4 "localhost"
+# instead of the actual given name.
+- name: network.dns.native-is-localhost
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
+# The grace period allows the DNS cache to use expired entries, while kicking off
+# a revalidation in the background.
+- name: network.dnsCacheExpirationGracePeriod
+  type: RelaxedAtomicUint32
+  value: 60
+  mirror: always
+
+# This preference can be used to turn off DNS prefetch.
+- name: network.dns.disablePrefetch
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
+# This preference controls whether .onion hostnames are
+# rejected before being given to DNS. RFC 7686
+- name: network.dns.blockDotOnion
+  type: RelaxedAtomicBool
+  value: true
+  mirror: always
+
+# These domains are treated as localhost equivalent
+- name: network.dns.localDomains
+  type: String
+  value: ""
+  mirror: never
+
+# When non empty all non-localhost DNS queries (including IP addresses)
+# resolve to this value. The value can be a name or an IP address.
+# domains mapped to localhost with localDomains stay localhost.
+- name: network.dns.forceResolve
+  type: String
+  value: ""
+  mirror: never
+
+# Contols whether or not "localhost" should resolve when offline
+- name: network.dns.offline-localhost
+  type: RelaxedAtomicBool
+  value: true
+  mirror: always
+
+# Defines how much longer resolver threads should stay idle before are shut down.
+# A negative value will keep the thread alive forever.
+- name: network.dns.resolver-thread-extra-idle-time-seconds
+  type: RelaxedAtomicInt32
+  value: 60
+  mirror: always
+
 # The proxy type. See nsIProtocolProxyService.idl
 #     PROXYCONFIG_DIRECT   = 0
 #     PROXYCONFIG_MANUAL   = 1
@@ -14194,11 +14387,7 @@
 # Has no effect unless security.tls.enable_kyber is true.
 - name: network.http.http3.enable_kyber
   type: RelaxedAtomicBool
-#ifdef EARLY_BETA_OR_EARLIER
   value: @IS_NOT_ANDROID@
-#else
-  value: false
-#endif
   mirror: always
   rust: true
 
@@ -14329,13 +14518,6 @@
   value: ""
   mirror: never
 
-# This is only used for testing. When true, nsHttpChannel::mPeerAddr will be
-# overridden with the address provided by DNS prefetch.
-- name: network.dns.use_override_as_peer_address
-  type: RelaxedAtomicBool
-  value: false
-  mirror: always
-
 # Whether to add additional record IPs to the cache
 - name: network.trr.add_additional_records
   type: RelaxedAtomicBool
@@ -14453,6 +14635,13 @@
   value: 16
   mirror: always
 
+# When a primary or backup half-open socket fails while another is still
+# connecting, retry with the remaining one
+- name: network.http.retry_with_another_half_open
+  type: RelaxedAtomicBool
+  value: @IS_EARLY_BETA_OR_EARLIER@
+  mirror: always
+
   # If true, HTTP response content-type headers will be parsed using the standards-compliant MimeType parser
 - name: network.standard_content_type_parsing.response_headers
   type: RelaxedAtomicBool
@@ -14546,6 +14735,13 @@
   value: false
   mirror: always
 
+# Used for testing purposes only. When true, it attaches an extra networking
+# layer to simulate different network scenarios.
+- name: network.socket.attach_mock_network_layer
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 #---------------------------------------------------------------------------
 # Prefs starting with "nglayout."
 #---------------------------------------------------------------------------
@@ -14622,6 +14818,13 @@
   value: true
   mirror: always
 
+# Whether default permissions should be imported from remote settings in
+# addition to importing them from browser/app/permissions.
+- name: permissions.manager.remote.enabled
+  type: bool
+  value: @IS_EARLY_BETA_OR_EARLIER@
+  mirror: always
+
 #---------------------------------------------------------------------------
 # Prefs starting with "places."
 #---------------------------------------------------------------------------
@@ -14661,7 +14864,7 @@
 # Whether flooding prevention feature is enabled or not.
 - name: places.history.floodingPrevention.enabled
   type: bool
-  value: @IS_NIGHTLY_BUILD@
+  value: true
   mirror: always
 
 # Maximum elapsed time betwen a user interaction and a visit before starting to
@@ -15053,7 +15256,7 @@
 
 - name: privacy.resistFingerprinting.target_video_res
   type: uint32_t
-  value: 480
+  value: 1080
   mirror: always
 
 # Enable resetting the fingerprinting randomization key daily for normal windwos.
@@ -15897,10 +16100,10 @@
 # 2: Enforce CT.
 - name: security.pki.certificate_transparency.mode
   type: RelaxedAtomicUint32
-#ifdef EARLY_BETA_OR_EARLIER
-  value: 2
-#else
+#if defined(ANDROID) && !defined(EARLY_BETA_OR_EARLIER)
   value: 0
+#else
+  value: 2
 #endif
   mirror: always
 
@@ -15929,7 +16132,11 @@
 # 3: Consult CRLite and enforce "Not Revoked" results, but defer to OCSP for "Revoked".
 - name: security.pki.crlite_mode
   type: RelaxedAtomicUint32
+#ifdef NIGHTLY_BUILD
+  value: 2
+#else
   value: 3
+#endif
   mirror: always
 
 # The CRLite filter channel to which the user is subscribed.
@@ -16211,6 +16418,12 @@
   value: true
   mirror: always
 
+# MLS
+- name: security.mls.enabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 #---------------------------------------------------------------------------
 # Prefs starting with "signon."
 #---------------------------------------------------------------------------
@@ -16655,6 +16868,33 @@
   value: 1000
   mirror: always
 
+# If true, popups are attached to their native parent window (and move with it)
+# and can't overlap the OS chrome. Otherwise they are topmost.
+# NOTE(emilio): Comments below might not be accurate anymore.
+- name: ui.panel.default_level_parent
+  type: RelaxedAtomicBool
+#if defined(XP_WIN) || defined(XP_MACOSX)
+  # See bug 448927, on topmost panel, some IMEs are not usable on Windows.
+  # See bug 404131, topmost <panel> element wins to Dashboard on MacOSX.
+  value: true
+#else
+  # Setting default_level_parent to true makes the default level for popup
+  # windows "top" instead of "parent".  On GTK2 platform, this is implemented
+  # with override-redirect windows which is the normal way to implement
+  # temporary popup windows.  Setting this to false would make the default
+  # level "parent" which is implemented with managed windows. A problem with
+  # using managed windows is that metacity sometimes deactivates the parent
+  # window when the managed popup is shown, see bug 526941.
+  #
+  # TODO(emilio): Re-evaluate this default, the comment above is no longer
+  # true since bug 552982 (where we started looking at mNoAutohide rather than
+  # popup level to make the override-redirect vs. managed window distinction).
+  #
+  # The Android default was copied from GTK in bug 568700.
+  value: false
+#endif
+  mirror: always
+
 # If true, all popups won't hide automatically on blur
 - name: ui.popup.disable_autohide
   type: RelaxedAtomicBool
@@ -17649,6 +17889,16 @@
   value: 2
   mirror: always
 
+# Whether to use XDG portal for native messaging.
+# https://github.com/flatpak/xdg-desktop-portal/issues/655
+#  - 0: never
+#  - 1: always
+#  - 2: auto (true for snap and flatpak or GTK_USE_PORTAL=1, false otherwise)
+- name: widget.use-xdg-desktop-portal.native-messaging
+  type: int32_t
+  value: 0
+  mirror: always
+
 # Whether to try to use XDG portal for settings / look-and-feel information.
 # https://flatpak.github.io/xdg-desktop-portal/#gdbus-org.freedesktop.portal.Settings
 #  - 0: never
@@ -17710,6 +17960,13 @@
   value: true
   mirror: always
 
+# Whether PiP windows have window decorations (borders and shadows).
+# Off for now while we fix bug 1934760 and related issues.
+- name: widget.windows.pip-decorations.enabled
+  type: bool
+  value: false
+  mirror: always
+
 # Whether we use the accent color for highlight as some other UWP apps do.
 #
 # false for now since it can cause some contrast-with-background issues

between 134 and 135.

:keeler, since you are the author of the regressor, bug 1927085, could you take a look?

For more information, please visit BugBot documentation.

Flags: needinfo?(dkeeler)

I think your regression has just identified the last time our TLS Client Hello changed. That's not the regressing bug. Rather, any change to our TLS Client Hello seems to fix the issue. Folks have stated that the following prefs (individually flipped) fix the issue:

security.ssl3.ecdhe_ecdsa_aes_128_sha=false
security.ssl3.ecdhe_ecdsa_aes_256_sha=false
security.pki.certificate_transparency.mode=0
security.tls13.aes_128_gcm_sha256=false

Where as some other TLS related changes do not seem to fix it:

security.tls.client_hello.send_p256_keyshare
security.tls.enable_delegated_credentials
Flags: needinfo?(dkeeler)
No longer regressed by: 1927085

That this is a Yahoo server change is shown by the fact that it only just started happening, but mysteriously was at the same time a regression from 18 months ago. What Dennis is implying is that there could be some new anti-bot detection, and "modern FIrefox handshake" is getting put in a bucket that fails on the server side. The TLS handshake completed and we have a valid session -- they didn't reject us, just never got around to answering. The reload skips the handshake and the site is happy.

See Also: → 1816878
Depends on: 2035801

I can confirm the issue affects all platforms and verified that it's no longer reproducible after setting the “security.ssl3.ecdhe_ecdsa_aes_128_sha” pref to false. Tested using Firefox Release 150.0.1 (Build ID 20260427013024) and ESR 140.10.1 (Build ID 20260427105827) on Windows 11 x64, macOS 26.0.1 and Ubuntu 22.04 x64.

We have landed fixes in nightly/beta and will uplift to release dot release, and also shipped an experiment to mitigate this problem at yahoo's end for any users with experiments enabled. Marking this bug as fixed

Status: NEW → RESOLVED
Closed: 3 months ago
Resolution: --- → FIXED
Duplicate of this bug: 2031100

Verified, the issue no longer reproduces.

Tested with:

  • Browser / Version: Firefox 151.0-candidate build 1
  • Operating System: Windows 10
Status: RESOLVED → VERIFIED
Duplicate of this bug: 2029636
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: