775476 - Make synchronous XHR on the main thread unavailable to Marketplace apps

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[Henri Sivonen (:hsivonen)]

We've already prevented the use of synchronous XHR together with new features on the main thread in order to curb the problems that arise from synchronous XHR (UI unresponsiveness and nested event loops tickling Gecko bugs). The only reason synchronous and XHR is still supported with old XHR features is that legacy content on the Web uses it.

The Mozilla Marketplace doesn't offer random legacy Web pages for installation, so there's an opportunity to withdraw the availability of some of the worst Web features from apps installed through the Marketplace, so that bad app with bad practices don't get into the Marketplace in the first place. If we want apps to have some quality attributes such as UI responsiveness, chances are that technically preventing access to responsiveness-hostile legacy APIs will be more effective than technically granting access and then trying to catch usage as part of review.

Considering the above, I suggest making synchronous XHR from the main thread unavailable when the caller is an application installed through the Marketplace.