638269 - UI can be DoS'd by content scrolling itself

Status: RESOLVED WONTFIX

(Firefox for Android Graveyard :: Panning/Zooming, defect)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

When content calls window.scrollTo/scrollBy, the UI is updated to position the <browser> content at those scroll positions.  This is OK except when the URL or tab bar is visible; content scrolling itself will move that UI out of view.  This means that if content scrolls faster than the user can pan over and close the tab or navigate to another page, then the user is completely locked out of the UI.  I found this out by accident when working on bug 630743.

My worry is that some page that's autoscrolling itself for non-malicious reasons, like say viewing slides or something, can unintentionally DoS the UI.

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Would block for this if the fix is easy.  If it's not, I'm fine categorizing this as "polish" or something.

Comment 2

[Vivien Nicolas (:vingtetun) (:21) - (NOT reading bugmails, needinfo? please)]

The user can still use the menu button or the back button to escape right?

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Yeah, the HW back button would work on android devices.  I didn't even think of that because I don't use it.

Comment 4

[Brad Lassey [:blassey] (use needinfo?)]

this missed 5, throwing it back in the nom queue so we can talk about it in the next triage meeitng

Comment 5

[Mark Finkle (:mfinkle) (use needinfo?)]

Ben - What's the current status on this situation?

Comment 6

[Benjamin Stover (:stechz)]

No idea? You just assigned it to me. Is this just theoretical or is there an actual example somewhere?

I don't personally think this is high priority at all.

Comment 7

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Attachment: Test

I'm not sure what was unclear about the earlier comments ...

STR
 (1) Long-tap on test, choose "Open in new tab"
 (2) Focus new tab

The page doesn't allow the URL or side bars to be shown.  Pressing the android "Back" button ought to return to the android home screen, and re-opening fennec out to return to the DoS tab.  AFAIK the only way to get the UI back is to force-kill fennec.

I don't have a phone handy to test all this, sorry.  If there's something in the "android menu" UI that allows closing or focusing another tab, we should be in better shape.