STR:

1. Go to www.pinterest.ca (or probably the .com version)
2. Click login, and use "Continue with Google".

In Firefox, we get a pop-up blocker door hanger. In Chrome we get a pop-up window opened.

Edgar, would you mind investigating a bit to see what's up in our code? Thanks !

BTW note that on Nightly until bug 1594540 is fixed you may need to turn on ETP for Pinterest to be able to reproduce this.

This only happens very first time clicking "Continue with Google". And If we click again afterward, we get a pop-up window opened and could login with Google account. For the very first time clicks, I saw the window.open is called in "onmessage" event handler which is not considering as a user-gesture event. I guess log-in with Google account probably depends on some resources which are lazyloaded.

There is an ongoing spec work to define a new model for user-activation, see https://github.com/whatwg/html/pull/3851.
We apply the new model only on the fullscreen API for experiments now. I could try if we could fill above gap by using the new user-activation model.

But pop-up blocker has a different implementation from other user-gesture API. To minimize the risk, maybe we could integrate the new model to popup blocker but also keep the old behavior for now. For example, if there is a popup state on the stack, we use the old popup state. If not, we try to use the new model instead.

This behavior also happens with facebook login, not only with google login and also can be reproduced on ro.pinterest.com.
Reproducible on the latest Nightly 75.0a1 (2020-03-04) , beta74b9 and Release73.0.1 - Windows 10, Mac 10.15

(not actively working on this)