645634 - css rule :after with 'content' property crashes firefox when applied on <select> [@ nsViewManager::SetViewVisibility ]

Status: RESOLVED WORKSFORME

(Core :: CSS Parsing and Computation, defect)

Description

[Martouf]

User-Agent:       Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: 4.0

Same bug like:
https://bugzilla.mozilla.org/show_bug.cgi?id=644542
but on another plateform:

The CSS rule :after with the property 'content' will crash Firefox when applied
on <select> element and user click twice on it.

guilty CSS:

    select:after {
        content: ' appended string';
    }


Reproducible: Always

Steps to Reproduce:
1. open attached HTML page
2. click once on <select> to "open" it (nothing happens, it does not open)
3. click a second time, firefox crash
Actual Results:  
Firefox crashes on second click

Expected Results:  
The <select> should open to display options. And I guess the CSS property
'content' should be ignored (at least this is Chrome's behavior)

And that's the crash report on OSX:
https://crash-stats.mozilla.com/report/index/bd8b7b27-fea2-4619-a6e1-4f7d52110326

Comment 1

[Thomas Ahlblom]

0 	XUL 	nsViewManager::SetViewVisibility 	view/src/nsView.h:140
1 	XUL 	nsComboboxControlFrame::ShowPopup 	layout/forms/nsComboboxControlFrame.cpp:366
2 	XUL 	nsComboboxControlFrame::ShowList 	layout/forms/nsComboboxControlFrame.cpp:390
3 	XUL 	nsListControlFrame::MouseDown 	layout/forms/nsListControlFrame.cpp:2171
4 	XUL 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:175
5 	XUL 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventListenerManager.h:146
6 	XUL 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:628
7 	XUL 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:7066
8 	XUL 	PresShell::HandlePositionedEvent 	layout/base/nsPresShell.cpp:6900
9 	XUL 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6731
10 	XUL 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1105
11 	XUL 	HandleEvent 	view/src/nsView.cpp:161
12 	XUL 	nsChildView::DispatchEvent 	widget/src/cocoa/nsChildView.mm:1807
13 	XUL 	nsChildView::DispatchWindowEvent 	widget/src/cocoa/nsChildView.mm:1817
14 	XUL 	-[ChildView mouseDown:] 	widget/src/cocoa/nsChildView.mm:3436
15 	AppKit 	AppKit@0x13cf1a 	
16 	AppKit 	AppKit@0x75d82f 	
17 	libSystem.B.dylib 	libSystem.B.dylib@0x5369 	
18 	AppKit 	AppKit@0x737473 	
19 	CoreFoundation 	CoreFoundation@0x2eac 	
20 	AppKit 	AppKit@0x7695cd 	
21 	AppKit 	AppKit@0x7490d5 	
22 	AppKit 	AppKit@0x74ff8f 	
23 	Foundation 	Foundation@0x6b72 	
24 	AppKit 	AppKit@0x7c418f 	
25 	CoreFoundation 	CoreFoundation@0x706f2 	
26 	CoreFoundation 	CoreFoundation@0x70552 	
27 	CoreFoundation 	CoreFoundation@0xf75e 	
28 	Foundation 	Foundation@0x602f 	
29 	libobjc.A.dylib 	libobjc.A.dylib@0x619f 	
30 	XUL 	-[ToolbarWindow sendEvent:] 	widget/src/cocoa/nsCocoaWindow.mm:2356
31 	AppKit 	AppKit@0x72661 	
32 	CoreFoundation 	CoreFoundation@0x242b8 	
33 	AppKit 	AppKit@0x71084 	
34 	AppKit 	AppKit@0x74913f 	
35 	AppKit 	AppKit@0x43695 	
36 	CoreFoundation 	CoreFoundation@0x1015b 	
37 	XUL 	js::ValueToNumberSlow 	js/src/jsnum.h:661
38 		@0x7fff5fbff1df 	
39 	CoreFoundation 	CoreFoundation@0xf872 	
40 	CoreFoundation 	CoreFoundation@0x24444 	
41 	AppKit 	AppKit@0x77d26f 	
42 	AppKit 	AppKit@0x90a9 	
43 	XUL 	nsAppShell::Run 	widget/src/cocoa/nsAppShell.mm:746
44 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:220
45 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3786
46 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
47 	firefox-bin 	firefox-bin@0x1953

Comment 2

[Timothy Nikkel (:tnikkel)]

I think this is fixed now. Anyone confirm?

Comment 3

[Mats Palmgren (:mats)]

Yup, it works fine for me too, on Linux and OSX.