These Weeks in Firefox: Issue 33

Highlights

• Added section context menus to Activity Stream, allowing for more in-page customizations like reordering.

• Heads up:
  • The Symantec CA distrust policy action is underway in Nightly. This policy is being implemented by Chrome in M66, which will release ahead of Firefox 60.
    • You are likely to get certificate errors for some popular websites in Nightly until they change their configuration.
    • Note that filing bugs for particular websites is not useful; we’ve been duping them on Bug 1436062.
    • TLS Canary shows ~300 high-ranking sites broken.
• Some larger UI changes to about:preferences landed last week, combining cookies, site data and cache into a single section. The previously rather buried cookie settings should now be more easily accessible.

Friends of the Firefox team

• Resolved bugs (excluding employees): https://mzl.la/2F5TXXk
  • More than one bug fixed:
    • :prathiksha
    • Arthur Edelstein [:arthuredelstein]
    • Oriol Brufau [:Oriol]
    • Richard Marti (:Paenglab)
    • Tim Nguyen :ntim
  • New contributors (🌟 = First Patch!)
    • 🌟 Apoorv Goel made it so that about:telemetry uses the new Symbol Server
    • 🌟 Connor Masini made it so that WebExtensions can theme arrow panels 🚀
      • Dark Theme Darkening 🌘 update #3 was sent to firefox-dev

Project Updates

Add-ons

• WebExtension changes in Firefox 59:
  • Buncha test fixes, notably chasing down NS_ERROR_FILE_ACCESS_DENIED.
  • Fixed browser and page actions cleared when navigating.
  • Fixed pageAction visibility error (conflict between show_matches and hide_matches).
• WebExtension changes in Firefox 60:
  • Only one homepage can be set by extensions.
  • Clearer messages for when an extension is controlling New Tab and Home pages.
  • The devtools.network.onRequestFinished API has been implemented – this is mostly useful for DevTools extensions.
  • Battling FOUC (“Flash of unstyled content”) by running document_idle after DOMContentLoaded and after layout has had a chance to start.
  • Theming of arrow panels!
  • Popup opened by WebExtensions now get focus.
  • Hidden tabs are restored when the extension that hid them is removed.
• Misc
  • Removed some innerHTML uses, and fixed some bolding broken by sanitization in bug 1432966, in Firefox 59.
  • …and some more innerHTML uses in dynamic install prompt messages, in Firefox 60.
  • Fixed a regression on WebExtension themes in Thunderbird, in Firefox 60.

Activity Stream

• Highlights include “Saved to Pocket” cards with more caching heuristics incoming.
• Reevaluating approach for about:preferences move to incorporate Fluent.

Browser Architecture

• Investigating XULStore alternatives.
• Proposing using Node as part of the Firefox build.
• Migrating <tabbrowser> to a JS class.
• Sync and Storage folks are holding weekly show and tells for their cross-platform syncing code, ping Emily Toop if you’re interested.
• Continued progress on removing XBL bindings and XUL overlays.

Lint

• Working on rolling out more Cc/Ci/Cr/Cu fixes to the rules & spread the coverage of the rules out further.
• Rolling out no-unused-vars for the global scope (as well as the existing local checks) in *.jsm files (meta).
• ESlint bumped to 4.18.1, includes support for “ecmaVersion: 2018”, especially async iteration (for-await-of).

Policy Engine

• Support for Group Policy Objects on Windows landed in bug 1433136.
• “Blocked by policy” errors for about: pages got a facelift in bug 1438243.
• Implement policies for bookmarks (Bug 1428924), blocking Dev Tools (Bug 1429185), blocking private browsing (Bug 1432355), disabling saved passwords and Master Password (Bug 1429148), and homepage locking (Bug 1429186).

Performance

• mconley landed a patch to fix the tab warming short-spinner bug.
  • Will enable tab warming by default on Nightly starting early in next cycle.
• florian made it so that the address bar is now focused before first paint, to avoid flicker.
• Doug Thayer fixed a 1-frame, eye-straining flash that was occurring on macOS when clicking on a link in Activity Stream.
• Gijs has been reducing blocklist sizes, and is working on making accessing the blocklist lazier.
• paolo has been refactoring PanelMultiView to make it less buggy, removes an XBL binding, and in preparation for removing a sync layout flush.

Privacy/Security

• We are currently testing upgrading mixed passive content on Nightly, until March 7th. This will probably break images on some sites. See the dev-platform post for more info.
  • If you notice any breakage please report it by commenting in this bug.
• The tiny “Clear Recent History” link in about:preferences is now a nice regular button.

• We’re no longer showing the (admittedly quite annoying) canvas permission prompt unless the canvas data was accessed from a user interaction.
• We are looking to deprecate navigator.registerProtocolHandler over insecure HTTP in the ~62 timeframe. It’s already disabled on Nightly. Please file bugs in the DOM :: Security component.
• There are new identity UI pieces for showing disabled (“paused”) WebRTC streams (which will be available to sites starting with Firefox 60 to avoid showing another permission prompt when temporarily turning off devices).

Search and Navigation

Address Bar & Search

• It’s now easier to find open tabs in the Address Bar. Remote Tabs got a weight bump, and switch-to-tab matches can now replace identical matches.
• Fixed a problem with delayed key handling in the Address Bar, causing Enter to be ineffective in some cases.
• The top preloaded sites feature in the Address Bar, has been disabled globally, to reduce Nightly users confusion about foreign domains used for testing.
• Enhanced autofill will likely land in 61, to have longer Nightly testing.
• Work in progress to add Search engines discovery to the Address Bar.

Places

• It’s no longer possible to have multiple keywords for the same URL, unless the POST data differs. This may cause minor data loss for duplicate keywords.
• treeview.js is no longer loaded on every window opening.
• Localized titles for bookmark roots are no longer stored in the database, but handled by the frontend code.
• Fixed various regressions in bookmarks features.
• Removed more synchronous Bookmarks APIs: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=656936">getRemoveFolderTransaction</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1432426">moveItem</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1432427">insertSeparator</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1433307">getKeywordForBookmark</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1434607">setKeywordForBookmark</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1432425">removeFolderChildren</a>.

More

• Removed tree autocomplete support from the autocomplete controller.
• A Sanitize on Shutdown forced through autoconfig or policies won’t sanitize anymore at every browser startup.

Sync / Firefox Accounts

• Mark refactored how Sync authenticates with FxA 🔑, removing a lot of technical debt.
• Thom is working on persisting synced bookmark deletions, which should avoid resurrecting deleted bookmarks in certain cases ⛔️, refactored the bookmark validator ✅, and modularized and rewrote the About Sync add-on ✏️.
• Thom and Ed significantly improved new bookmark mirror performance 🏃‍♀️.
• Kit is working on storing more Sync metadata in Places 🗺, which improves how we handle bookmark restores and corrupt database recovery.
• We have a plan to fix the storage thread hang ⛄️ that blocks dogfooding of new bookmarks 📚.

Test Pilot

• Incoming: theme creator experiment shipping soon; tab split experiment exploring a rewrite. Both experiments set to launch in Q2.
• Outgoing: Cliqz, Voice Fill, Snooze Tabs, Min Vid graduating Q1.
• Min Vid SHIELD study launching soon.
• Screenshots:
  • Usage steady at 2.8M MAU, 62M+ shots as of today.
  • Lots of bug fixes exported into the tree recently (bug 1436218); another release landing in 60, pending QA (bug 1440524).
  • ICYMI: rad Screenshots article on Firefox blog last week (bug filed to put that YouTube video on the screenshots homepage 🙂
  • Lo-fi user research happening this week on discoverability & onboarding.
  • Annotations shipping soon: edit, highlight, & draw on uploaded shots
  • Here’s a usage graph, now with all the shot types:

Web Payments

• Team meetings in Vancouver last week.
• On track to finish M1 by the end of the quarter.
  • M1: End-to-end test with valid user data and merchant update/change events, no Firefox validation, generic merchant error string, only already stored cards/addresses.
• Fixed:
  • Shipping address/option pickers
    • The shipping-option-picker doesn’t show the selected option when the popup is closed
    • Dispatch shippingoptionchange when the shipping option is changed
    • Only show shipping (option & address) pickers in the payment request dialog when requestShipping is true
    • Vary the payment request address label according to the shippingType
  • Implement the “processing” screen for when the pay button is clicked
  • Show shipping address errors on the summary screen
  • Cleanup
    • Clean up some duplication in the webpayments mochitest-browser tests for setting up dialogs
    • Moved hard-coded PaymentRequest strings to entities
• In Progress
  • Implement the “success” screen for when the merchant accepts the payment
  • Implement the payerName/payerEmail/payerPhone contact picker
  • Show additional list items (additionalDisplayItems) tied to payment methods in the UI
  • Don’t dispatch shipping*change events if requestShipping is false