300956 - Area used by Flash plugin repaints incorrectly during fastback

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
1. Load http://www.mozilla.org/.
2. In the same tab, load http://www.homestarrunner.com/sbemail.html.
3. Press Back.

Result: About 30% of the time, there's a white box and a black box covering
portions of http://www.mozilla.org/ in the same place as the Flash things on the
strong bad page.

Turning off fastback (setting browser.sessionhistory.max_viewers to 0) makes
this problem go away, so this bug might be due to fastback.

This bug might have security implications.  It at least allows an attacker to
cover part of a target site with a white box or a black box.  If the boxes can
contain more interesting graphics than a single solid color, or if the boxes can
be small and plentiful, this bug allows introducing new text onto the target
site, such as "bankofamerica.com has moved to bank.evil.com".

I am using:
* Mac OS X 10.4.2 (latest)
* Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b4)
Gecko/20050715 Firefox/1.0+ (today's nightly build on Mac)
* Flash player 7,0,24,0 (latest).

Comment 1

[Simon Fraser [no longer active]]

Related to bug 277067.

Comment 2

[Brian Ryner (not reading)]

Sounds like a serious fastback blocker for Mac.

Comment 3

[Simon Fraser [no longer active]]

We need to ensure that we make a "SetWindow" call on the plugin (with the clipo
rect set to empty) before displaying the new page. This is similar to the issue
that bug 277067 is about.

Do we really need the security flag on this bug?

Comment 4

[Brian Ryner (not reading)]

Neither Simon or myself have been able to reproduce this... can you provide any
more details that might help?

Comment 5

[Jesse Ruderman]

WFM in Aug 3 builds and later.

july 15  bug
july 26  bug
aug  1   bug
aug  2   bug
aug  3   no bug
aug  4   no bug
aug  6   no bug

I'm curious whether other people see this bug in older builds (on Mac), and what
change fixed it.

Comment 6

[Mike Shaver (:shaver emeritus)]

Marking WFM, feel free to investigate the fix details further though.