Closed Bug 889428 Opened 12 years ago Closed 11 years ago

Switching tabs from a Nightly/UX tab to a Nightly/UX tab and then changing the URL maintains the Nightly/UX icon.

Categories

(Firefox :: Address Bar, defect)

25 Branch
x86_64
Windows 7
defect
Not set
normal

Tracking

()

RESOLVED FIXED
Firefox 25
Tracking Status
firefox24 --- unaffected
firefox25 - affected

People

(Reporter: suraj_patel_95, Assigned: jaws)

References

Details

(Keywords: csectype-spoof, sec-low, Whiteboard: fixed by bug 893424)

Attachments

(1 file, 4 obsolete files)

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130702 Firefox/24.0 (Nightly/Aurora) Build ID: 20130702004019 Steps to reproduce: 1. Start a new browsing session. 2. Change the tab URL to about:home so that the Nightly/UX indicator is shown in the address bar. 3. Open a new tab and again navigate to about:home so that the Nightly/UX indicator is shown in the address bar. 4. Switch back to the first tab and change the URL to any normal web page. Note that about:home could be any about: page which adds the indicator. Actual results: Nightly/UX page indicator remains. Expected results: It should disappear.
Summary: Switching tabs from a UX tab to a UX tab and then changing the URL maintains the UX icon. → Switching tabs from a Nightly/UX tab to a Nightly/UX tab and then changing the URL maintains the Nightly/UX icon.
I can reproduce this on Windows Nightly, but couldn't on OS X earlier today. Not sure why. Either way, confirming.
Status: UNCONFIRMED → NEW
Depends on: 750106
Ever confirmed: true
Component: Untriaged → Location Bar
Marking for tracking as this can make a website appear as trusted chrome UI.
Blocks: 750106
No longer depends on: 750106
Keywords: csec-spoof
Assignee: nobody → jaws
Status: NEW → ASSIGNED
I think this is a regression from bug 398360 actually, it's just that chromeUI wasn't introduced until bug 590206, and even at that it wasn't obvious when it was wrong until the patches for bug 750106 landed.
Blocks: 398360
And https://bugzilla.mozilla.org/show_bug.cgi?id=398360#c6 mentions that onLocationChange won't be fired for error pages, which are the same as chrome pages as I understand it.
In the case where this is failing, onSecurityChange is being called before onLocationChange, but there is an implicit ordering dependency between these functions since onLocationChange resets this._hostChanged and onSecurityChange checks this value. A simple patch here would be to only set this._hostChanged=false when the page is not a chrome URI, although that seems hacky. I'm currently working on getting a mochitest that reproduces this broken ordering, but when I run this through mochitest the events appear in the order of onLocationChange then onSecurityChange. When I run these STR manually, I see onSecurityChange then onLocationChange.
Attached patch Wallpaper patch (obsolete) — Splinter Review
Attached patch Tests (obsolete) — Splinter Review
Tests that pass without the patch applied, so something here isn't right...
Attached patch Tests (qref'd) (obsolete) — Splinter Review
Attachment #770660 - Attachment is obsolete: true
Attached patch Tests v2 (obsolete) — Splinter Review
This test reproduces the STR that were given in comment #0. It also demonstrates bug 882977.
Attachment #770661 - Attachment is obsolete: true
Attachment #770673 - Flags: review?(gavin.sharp)
Comment on attachment 770659 [details] [diff] [review] Wallpaper patch mach mochitest-browser browser/base/content/test 2:34.98 INFO TEST-START | Shutdown 2:34.98 Browser Chrome Test Summary 2:34.98 Passed: 6147 2:34.98 Failed: 0 2:34.98 Todo: 10 with the accompanied test applied. Without this patch the accompanied test fails.
Attachment #770659 - Flags: review?(gavin.sharp)
(In reply to Suraj Patel from comment #0) Thank you so very much for these detailed steps to reproduce. This was a very well written bug report. Welcome to Bugzilla! :-)
(In reply to Jared Wein [:jaws] from comment #4) > And https://bugzilla.mozilla.org/show_bug.cgi?id=398360#c6 mentions that > onLocationChange won't be fired for error pages, which are the same as > chrome pages as I understand it. I should point out that this assumption is likely wrong, as error documents likely replace the current document but keep the location the same.
We typically do not track security regressions less than sec-high/critical. We would take a low risk uplift if necessary though.
Keywords: sec-low
Attachment #770659 - Flags: review?(dao)
Attached patch Tests v2.1Splinter Review
Noticed some debugging code that should have been removed.
Attachment #770673 - Attachment is obsolete: true
Attachment #770673 - Flags: review?(gavin.sharp)
Attachment #774750 - Flags: review?(gavin.sharp)
Attachment #774750 - Flags: review?(dao)
Comment on attachment 770659 [details] [diff] [review] Wallpaper patch The whole _hostChanged thingy seems broken. I think we should fix that, not wallpaper over it.
Attachment #770659 - Flags: review?(dao) → review-
Depends on: 893424
Attachment #770659 - Flags: review?(gavin.sharp)
Comment on attachment 770659 [details] [diff] [review] Wallpaper patch Made obsolete by the patch in bug 893424.
Attachment #770659 - Attachment is obsolete: true
Comment on attachment 774750 [details] [diff] [review] Tests v2.1 >diff --git a/browser/base/content/test/browser_bug889428.js b/browser/base/content/test/browser_bug889428.js >+function loadURIInSelectedTab(aURL, aCallback) { >+ gNewWin.gBrowser.selectedBrowser.addEventListener("load", function() { >+ gNewWin.gBrowser.selectedBrowser.removeEventListener("load", arguments.callee, true); Use a named function rather than arguments.callee. >+function test() { >+ let oldTab = gBrowser.selectedTab; unused? The whole gNewWin/loadURIInSelectedTab/firstTab setup seems confusing, it seems like you could refactor this so that what's it's actually doing is a bit clearer (use a closure to avoid the need for gNewWin, avoid having helpers that operate on selectedTab and instead use explicit references to the relevant tabs, etc.).
Attachment #774750 - Flags: review?(gavin.sharp)
Attachment #774750 - Flags: review?(dao)
Attachment #774750 - Flags: feedback+
Whiteboard: fixed by bug 893424
Target Milestone: --- → Firefox 25
Any reason this was still open?
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Flags: needinfo?(jaws)
Flags: needinfo?(dao)
Resolution: --- → FIXED
Flags: needinfo?(dao)
It was just open for the test that was here. There hasn't been much progress on the test and I won't be having any time for it in the near future either, so it's fine to close this.
Flags: needinfo?(jaws)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: