Telemetry says currently only 0.08% of pages use this method: https://telemetry.mozilla.org/new-pipeline/dist.html#!measure=USE_COUNTER2_DEPRECATED_WindowContentUntrusted_PAGE&max_channel_version=beta%252F76 Since this has been disabled in Nightly for more than two years and there has been no relevant regression report so far, it's time to try disabling this on stable Firefox.

It’s not a good time to ship this. Because of the COVID-19 pandemic, any breaking changes are being reviewed on Slack and avoided. 0.08% is not really a small number.

Ah, understood.

Then I'll modify the patch to only introduce the flag without actually disabling it, does this sound good?

Sure, sounds fine.

It's probably also fine to disable it on Nightly. That way we catch potential fallout sooner.

It's probably also fine to disable it on Nightly.

It's already disabled in Nightly via preprecessor. IMO it's cleaner to disable it by a flag, though.

Comment on attachment 9142077 [details]
Bug 1400140 - Put window.content behind dom.window.content.enabled

Revision D71775 was moved to bug 1632116. Setting attachment 9142077 [details] to obsolete.

Here is Intent to unship: Visibility of window.content to untrusted code by bz 3 years ago

How about disabling it in the early beta channel as well if a new flag is introduced this time? @IS_EARLY_BETA_OR_EARLIER@ is often used.

That sounds good, as early beta users know breakages can happen.

dom.window.content.untrusted.enabled = false since FF101 via Bug 1764339, maybe time to remove the pref/code?

• https://searchfox.org/mozilla-central/search?q=content.untrusted&path=&case=false&regexp=false

https://hg.mozilla.org/mozilla-central/rev/3177eee3a850

Is this something we should call out in the Fx117 relnotes?

(In reply to Ryan VanderMeulen [:RyanVM] from comment #17)

Is this something we should call out in the Fx117 relnotes?

Probably not. For untrusted content, window.content is (was) an alias for window.top, it's also been unavailable to web content for about a year, so this change didn't really change the behavior much.

As this isn't needed to be called out in the release notes, I'm removing the dev-doc-needed keyword - feel free to re-apply if anyone thinks necessary