remove Shumway (JS-based Flash VM)

In #18546 (moved), Mike said: Shumway (the flash previewer/player) can bypass proxy settings. If it is compiled in, we should rip it out/disable it at build time, so nobody enables it.

added TorBrowserTeam201604 component::applications/tor browser ff45-esr owner::mcs priority::medium resolution::fixed severity::normal status::closed tbb-6.0a5 type::defect labels

After ESR45, the Shumway files were removed from the Mozilla tree. See https://bugzilla.mozilla.org/show_bug.cgi?id=1250046

Kathy and I still need to verify that it is not included in ESR45-based browsers.

It looks like Shumway will be included in our nightly builds, which is not good (search for shumway inside browser/installer/package-manifest.in).

Kathy and I think the best solution is to backport the three patches that are mentioned here: https://bugzilla.mozilla.org/show_bug.cgi?id=1250046#c8

Arthur, is this something you can do?

It looks like the patches apply fairly cleanly with the exception of the third patch. The problem there is that toolkit/components/telemetry/histogram-whitelists.json does not exist in the ESR45 tree; I think that part of the patch can just be skipped.

Trac:
Cc: brade, gk to brade, gk, arthuredelstein

Replying to mcs:

It looks like Shumway will be included in our nightly builds, which is not good (search for shumway inside browser/installer/package-manifest.in).

Kathy and I think the best solution is to backport the three patches that are mentioned here: https://bugzilla.mozilla.org/show_bug.cgi?id=1250046#c8

Arthur, is this something you can do?

Thanks for finding these patches -- I have cherry-picked/backported all three to https://github.com/arthuredelstein/tor-browser/commits/15197+11 Hash: 1c110015f724eb69b9d0597aab20c2e43de44479

It seems you got the nsBrowserGlue.js part wrong. And is there a reason to have

-browser/fuel/**

?

Trac:
Status: new to needs_revision

Replying to gk:

It seems you got the nsBrowserGlue.js part wrong. And is there a reason to have {{{ -browser/fuel/** }}} ?

Thanks for catching those. I applied a fixup: ​https://github.com/arthuredelstein/tor-browser/commits/15197+11 Hash: c734da3fde70f8818a94a5e3b93d34f0602d2cec

#ifdef NIGHTLY_BUILD
    // Registering Shumway bootstrap script the child processes.
    Services.ppmm.loadProcessScript("chrome://shumway/content/bootstrap-content.js", true);
    // Initializing Shumway (shall be run after child script registration).
    ShumwayUtils.init();
#endif

Was still there. I removed that one before rebasing to 45.0.2esr (the result is visible in tor-browser-45.0.2esr-6.x-1 which is currently still pushed).

Trac:
Resolution: N/A to fixed
Status: needs_revision to closed

closed

moved to tpo/applications/tor-browser#18802 (closed)