2053935 - [IPC Urlbar] UrlbarEventBufferer isn't armed synchronously over the actor message path, so a fast Enter fires against a stale heuristic

Status: ASSIGNED

(Firefox :: Address Bar, defect)

Description

[Dão Gottwald [:dao]]

On the actor message path (browser.urlbar.ipc.chromeMessagePassing), the QUERY_STARTED notification reaches content-side listeners a round-trip late, delivered through the parent controller proxy. UrlbarEventBufferer (a content-side listener) therefore arms #lastQuery only after a just-typed Enter has already been handled.

UrlbarParentController.startQuery documents the invariant that QUERY_STARTED "must be fired synchronously, as soon as startQuery is invoked". That holds on the direct (in-process) path but not over the wire.

As a result, a fast type+Enter isn't deferred and fires against a stale heuristic result -- navigating e.g. a google.com search URL -- which crashes under the test harness's non-local-connection guard.

The message-path controller proxy that breaks the synchrony landed in Phase 4 (Bug 2052787); this is a pre-existing gap surfaced by the Phase 6 pref-on CI variant (urlbar-ipc). Affected tests on the message path: browser_autocomplete_enter_race (crash), browser_bufferer_onQueryResults, browser_slow_heuristic.

Fix: arm the bufferer synchronously content-side from the input's startQuery without emitting an out-of-order QUERY_STARTED notification, and make the bufferer's teardown handlers query-aware so a late previous-query teardown echo can't clobber the newly-armed query.

Comment 1

[Dão Gottwald [:dao]]

Attachment: Bug 2053935 - [IPC Urlbar] Phase 6: Arm the event bufferer synchronously so a fast Enter is deferred over the message path. r?mbeier!

UrlbarEventBufferer defers a just-typed Enter until results arrive so the key
lands on a stable result instead of a stale heuristic. It armed on the
QUERY_STARTED notification, which UrlbarParentController.startQuery fires
synchronously "as soon as startQuery is invoked". In-process that guarantee
holds; over the actor message path the notification reaches the content-side
bufferer a round-trip later -- after the key event -- so a fast type+Enter isn't
deferred and navigates the stale heuristic, crashing the test harness's
non-local-connection guard on a google.com search URL.

Arm the bufferer from UrlbarChildController.startQuery, the single content-side
entry both inputs route through, via a new queryStarting() call rather than the
QUERY_STARTED listener notification. This touches only the bufferer's own state
-- it emits no out-of-order notification -- so the query lifecycle other
listeners see, and exposure telemetry, are unchanged. The arm runs after the
query is dispatched so the parent's synchronous teardown of the previous query
(in-process) can't clobber the freshly-armed state. The direct path stays
behavior-neutral.

Greens browser_autocomplete_enter_race, browser_bufferer_onQueryResults, and
browser_slow_heuristic on the message path.