Closed Bug 645634 Opened 12 years ago Closed 4 years ago

css rule :after with 'content' property crashes firefox when applied on <select> [@ nsViewManager::SetViewVisibility ]


(Core :: CSS Parsing and Computation, defect)

Not set





(Reporter: mathieu.despont, Unassigned)



(Keywords: crash, Whiteboard: [bugday-2011-05-06])

Crash Data

User-Agent:       Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: 4.0

Same bug like:
but on another plateform:

The CSS rule :after with the property 'content' will crash Firefox when applied
on <select> element and user click twice on it.

guilty CSS:

    select:after {
        content: ' appended string';

Reproducible: Always

Steps to Reproduce:
1. open attached HTML page
2. click once on <select> to "open" it (nothing happens, it does not open)
3. click a second time, firefox crash
Actual Results:  
Firefox crashes on second click

Expected Results:  
The <select> should open to display options. And I guess the CSS property
'content' should be ignored (at least this is Chrome's behavior)

And that's the crash report on OSX:
Depends on: 644542
Version: unspecified → Trunk
0 	XUL 	nsViewManager::SetViewVisibility 	view/src/nsView.h:140
1 	XUL 	nsComboboxControlFrame::ShowPopup 	layout/forms/nsComboboxControlFrame.cpp:366
2 	XUL 	nsComboboxControlFrame::ShowList 	layout/forms/nsComboboxControlFrame.cpp:390
3 	XUL 	nsListControlFrame::MouseDown 	layout/forms/nsListControlFrame.cpp:2171
4 	XUL 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:175
5 	XUL 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventListenerManager.h:146
6 	XUL 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:628
7 	XUL 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:7066
8 	XUL 	PresShell::HandlePositionedEvent 	layout/base/nsPresShell.cpp:6900
9 	XUL 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6731
10 	XUL 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1105
11 	XUL 	HandleEvent 	view/src/nsView.cpp:161
12 	XUL 	nsChildView::DispatchEvent 	widget/src/cocoa/
13 	XUL 	nsChildView::DispatchWindowEvent 	widget/src/cocoa/
14 	XUL 	-[ChildView mouseDown:] 	widget/src/cocoa/
15 	AppKit 	AppKit@0x13cf1a 	
16 	AppKit 	AppKit@0x75d82f 	
17 	libSystem.B.dylib 	libSystem.B.dylib@0x5369 	
18 	AppKit 	AppKit@0x737473 	
19 	CoreFoundation 	CoreFoundation@0x2eac 	
20 	AppKit 	AppKit@0x7695cd 	
21 	AppKit 	AppKit@0x7490d5 	
22 	AppKit 	AppKit@0x74ff8f 	
23 	Foundation 	Foundation@0x6b72 	
24 	AppKit 	AppKit@0x7c418f 	
25 	CoreFoundation 	CoreFoundation@0x706f2 	
26 	CoreFoundation 	CoreFoundation@0x70552 	
27 	CoreFoundation 	CoreFoundation@0xf75e 	
28 	Foundation 	Foundation@0x602f 	
29 	libobjc.A.dylib 	libobjc.A.dylib@0x619f 	
30 	XUL 	-[ToolbarWindow sendEvent:] 	widget/src/cocoa/
31 	AppKit 	AppKit@0x72661 	
32 	CoreFoundation 	CoreFoundation@0x242b8 	
33 	AppKit 	AppKit@0x71084 	
34 	AppKit 	AppKit@0x74913f 	
35 	AppKit 	AppKit@0x43695 	
36 	CoreFoundation 	CoreFoundation@0x1015b 	
37 	XUL 	js::ValueToNumberSlow 	js/src/jsnum.h:661
38 		@0x7fff5fbff1df 	
39 	CoreFoundation 	CoreFoundation@0xf872 	
40 	CoreFoundation 	CoreFoundation@0x24444 	
41 	AppKit 	AppKit@0x77d26f 	
42 	AppKit 	AppKit@0x90a9 	
43 	XUL 	nsAppShell::Run 	widget/src/cocoa/
44 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:220
45 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3786
46 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
47 	firefox-bin 	firefox-bin@0x1953
Ever confirmed: true
Whiteboard: [bugday-2011-05-06]
Keywords: crash
Summary: css rule :after with 'content' property crashes firefox when applied on <select> → css rule :after with 'content' property crashes firefox when applied on <select> [@ nsViewManager::SetViewVisibility ]
Crash Signature: [@ nsViewManager::SetViewVisibility ]
I think this is fixed now. Anyone confirm?
Yup, it works fine for me too, on Linux and OSX.
Closed: 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.