al_9x wrote:So Fx2.0.0.20 needed this change that introduced these bugs, meaning that NS 1.9.5 with Fx2 has a problem and is not blocking something? Can you expand, what is the issue?
The situation is a bit complex.
Every supported version of Gecko (i.e. >= 1.8.1) blocks stuff fine from a strict active content blocking point of view: requests to be blocked are guaranteed to die before the data is processed by the content viewer (either the browser document viewer or a plugin), and that's all (i.e. in some circumstances, e.g. when we need to perform content sniffing, hitting the network is OK - the active content won't run anyway because we download and process the headers only, not the request body).
Then enters ABE.
ABE's blocking is very tricky in regard of timing: it must happen after DNS resolution (because we check stuff like internet->local requests and now we check also subnetworks), but it must happen
before the request is sent, which is a much stricter requirement.
There's nothing built-in in the browser supporting this kind of timing, therefore ABE uses lots of neat tricks to accomplish this task.
Now, Gecko 1.9 and above supports aborting a request during the nsHttpChannel::asyncOpen() call, either in a http-on-modify-headers observer or in a web progress listener (NoScript is both), and guarantees a request aborted at that time won't hit the network. This is good for ABE, even though
not perfect because at the time asyncOpen() is called DNS records are not necessarily cached. However ABE does some very acrobatic magic to cope with this situation, and it incredibly works.
Unluckily, while testing ABE on Seamonkey 1.1.17 I suddenly realized that the no network assumption for requests aborted in nsHttpChannel:asyncOpen() on Gecko 1.9 is not valid for older Gecko versions. The reason is
this difference.
So, to recap, a blocking method used in a very few cases (when content sniffing is needed) in NoScript "classic", is good enough for NoScript classic's requirements (it hits the network but doesn't download more than the HTTP headers and anyway prevents content processing), but can't suffice for ABE's requirements on Gecko 1.8.1.
Therefore I decided to "harden" late aborting as much as possible on Gecko 1.8.1 so that ABE can be supported (even if with performance penalties unrelated with this issue)
and NoScript's "classic" behavior is more efficient (less networking) and predictable.
But believe me, I'd prefer to drop Gecko 1.8.1 entirely, and I will almost surely do it as soon as Seamonkey 1.x dies.
):
.)