462807 - URL classifier initializes PSM/NSS during startup if homepage is an HTTP page

Status: RESOLVED FIXED

(Toolkit :: Safe Browsing, defect)

Description

[Boris Zbarsky [:bzbarsky]]

See bug 390324 for the code change that introduced this.  I certainly hit my PSM/NSS init breakpoint before a window is ever shown.  This does require that the homepage be something that the URL classifier will care about (so not about:blank), but I suspect that's the common case.

You'll need to apply the patch in bug 462806 to hit this, since without that we init PSM from the jar code.

Comment 1

[Boris Zbarsky [:bzbarsky]]

I should note that even with about:blank, all that happens is that we delay url-classifier load by 2 seconds, then we init NSS.  Maybe that's unavoidable, and maybe we're guaranteed that the window is mapped by then, even on slow hardware...

Comment 2

[Dave Camp (:dcamp)]

So we init PSM for nsCryptoHash, which we need to perform the lookup (the db stores hashed urls).  To fix this well, we'd need to separate out hash initialization from the rest of NSS initialization (see bug 424093).

Comment 3

[Dave Camp (:dcamp)]

(In reply to comment #2)
> To fix this well, we'd need to separate out hash
> initialization from the rest of NSS initialization (see bug 424093).

Err, bug 448579

Comment 4

[Boris Zbarsky [:bzbarsky]]

Wait.  Why do we need to separate things out to fix this?  We could also fix PSM init to work from non-main threads and take out the "force init from main thread" code, no?  Or would we still need to hash before we get the HTTP response?

Comment 5

[Boris Zbarsky [:bzbarsky]]

I should also note that if we're not worried about the user's homepage being a phishing page we could skip url-classifying that one load.  I'm not sure we shouldn't worry about it, though.

Comment 6

[Dave Camp (:dcamp)]

(In reply to comment #4)
> Wait.  Why do we need to separate things out to fix this?  We could also fix
> PSM init to work from non-main threads and take out the "force init from main
> thread" code, no?  Or would we still need to hash before we get the HTTP
> response?

Yeah, we still need to hash before we get the response.  The blacklist doesn't contain urls, it contains hashes.  We need to hash the urls before we can look them up in the db.

Comment 7

[Dave Camp (:dcamp)]

(In reply to comment #5)
> I should also note that if we're not worried about the user's homepage being a
> phishing page we could skip url-classifying that one load.  I'm not sure we
> shouldn't worry about it, though.

Another, much more hacky, workaround would be to keep the hashes of homepage urls around somewhere so that we can skip initializing psm for them..

Comment 8

[Jared Wein [:jaws] (please needinfo? me)]

I'm pretty sure that this bug was fixed by bug 756313. Please reopen if I am wrong.