711499 - Video context menu entries have no effect, when any JavaScript nsIContentPolicy is installed

Status: RESOLVED DUPLICATE of bug 708431

(Toolkit :: Video/Audio Controls, defect)

Description

[Daniel Holbert [:dholbert]]

STEPS TO REPRODUCE:
 1. Install Noscript from https://addons.mozilla.org/en-US/firefox/addon/noscript/
   (restart browser, to complete installation)

 2. Click the NoScript icon (near back/forward buttons) and choose the option for
    "Allow scripts globally (dangerous)"

 3. Visit http://www.webmfiles.org/wp-content/uploads/video/big-buck-bunny_trailer.webm

 4. Right-click video, and try to activate any of the context-menu items.
     e.g. Pause, Mute, Full Screen, Save Snapshot, Send Video

ACTUAL RESULTS:
None of the context-menu items have any effect.

**NOTE that we've _enabled scripts_, so this isn't just a "video controls require script" issue.

NoScript has a number of other security features, aside from its script-disabling ability, so presumably this is due to an interaction with one of those.

NOTES FROM ERROR CONSOLE:
At pageload of the webm file, this appears in error console:
> Error: Permission denied for <http://www.webmfiles.org> to get property Object.dynamicControls
> Source File: chrome://global/content/bindings/videocontrols.xml
> Line: 452

And then this appears when I mouseover the video:
>Error: this.Utils is undefined
>Source File: chrome://global/content/bindings/videocontrols.xml
>Line: 1304

From viewing that chrome:// URL locally, those errors point to these two lines:
http://mxr.mozilla.org/mozilla-central/source/toolkit/content/widgets/videocontrols.xml?rev=cdee05798c4a&mark=452-452#451
http://mxr.mozilla.org/mozilla-central/source/toolkit/content/widgets/videocontrols.xml?rev=cdee05798c4a&mark=1311-1311#1308

Mozilla/5.0 (X11; Linux x86_64; rv:11.0a1) Gecko/20111216 Firefox/11.0a1
NoScript 2.2.3

Comment 1

[Daniel Holbert [:dholbert]]

I also get a "this.Utils is undefined" for this line, in a constructor within videocontrols.xml:
http://mxr.mozilla.org/mozilla-central/source/toolkit/content/widgets/videocontrols.xml?rev=cdee05798c4a&mark=307-307#305

Comment 2

[Giorgio Maone [:ma1]]

Regression? WFM on Firefox 8 any platform. 
Broken on Mozilla/5.0 (Windows NT 5.2; WOW64; rv:11.0a1) Gecko/20111213 Firefox/11.0a1

Comment 3

[Daniel Holbert [:dholbert]]

Possibly, I'll try that next.

Workaround for my Nightly build:
 0. (I'm assuming you already did "Allow scripts globally" from comment 0)
 1. Click NoScript icon, pick "Options", and go to "Embeddings" tab
 2. Uncheck "Block every object coming from a site marked as untrusted"
 3. Reload WebM video.

Now the context menu items work (and the video controls show up, which they don't otherwise)

This appears to be a NoScript bug -- note that I haven't marked any sites as untrusted (rather, I'm globally trusting all sites!), so I wouldn't expect options about "site[s] marked as untrusted" to come into play here.

Giorgio, please correct me if I'm missing / overlooking something.

Comment 4

[Daniel Holbert [:dholbert]]

(In reply to Daniel Holbert [:dholbert] from comment #3)
> This appears to be a NoScript bug
or maybe not, given comment 2  (sorry, I'd typed up comment 3 pretty much entirely before seeing comment 2 :)) I suppose this could be a regression in whatever underlying Firefox API the "Block every object" checkbox plugs into.

Comment 5

[Daniel Holbert [:dholbert]]

(In reply to Giorgio Maone from comment #2)
> Regression? WFM on Firefox 8 any platform. 

Confirmed, WFM in Firefox 8, though the video controls have been updated since then, which may have involved shifting them partially from chrome to content or something like that (not sure).

Comment 6

[Daniel Holbert [:dholbert]]

WFM in latest Aurora (which has similar-to-nightly video controls, w/ gray background):
Mozilla/5.0 (X11; Linux x86_64; rv:10.0a2) Gecko/20111216 Firefox/10.0a2

So this has regressed on Trunk since the last Aurora migration.

Comment 7

[Daniel Holbert [:dholbert]]

from mozregression:
  Last good nightly: 2011-11-15
  First bad nightly: 2011-11-16
  Regression range:
  http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2011-11-15&enddate=2011-11-16
which does include 7 video-related csets from Jared (in a fx-team merge)

Comment 8

[Daniel Holbert [:dholbert]]

Regression range on fx-team:
http://hg.mozilla.org/integration/fx-team/pushloghtml?fromchange=7e1f046b173b&tochange=15c2cf2f47f4

Looks like Bug 700854 or Bug 700856, which mainly involved shifting some video styles into external stylesheets.

It still seems strange that this would be fixed by unchecking the "Block every object coming from a site marked as untrusted" option (per comment 3) , when no sites are untrusted (IIRC).  Presumably we're failing because one of the video stylesheets or some other resource is falling afoul of that check (but I'd expect the check shouldn't be happening when sites are trusted?)

So I'm still not sure whether this is a Firefox bug vs. a NoScript bug...

Comment 9

[Daniel Holbert [:dholbert]]

I also get this output on the command-line when I perform STR:
> [NoScript] No category?!true, true, [xpconnect wrapped nsIMIMEService]

Comment 10

[Giorgio Maone [:ma1]]

(In reply to Daniel Holbert [:dholbert] from comment #3)

> Workaround for my Nightly build:
>  0. (I'm assuming you already did "Allow scripts globally" from comment 0)
>  2. Uncheck "Block every object coming from a site marked as untrusted"

This effectively *uninstall* (rather than disabling) NoScript's nsIContentPolicy implementation, hence next logical step has been uninstalling NoScript and installing another less complex content policy such as Adblock Plus without any filterset or GreaseMonkey. In fact, that breaks the context menu as well.
So having any JavaScript-based nsIContentPolicy installed suffices to trigger this bug.

Comment 11

[Jared Wein [:jaws] (please needinfo? me)]

Is this a dupe of bug 708431?

Comment 13

[Daniel Holbert [:dholbert]]

Yup, looks like it.