Boris Zbarsky [:bzbarsky] Reporter
	Description • 11 years ago

People keep using -moz-box/-webkit-box and then complaining that they render differently.

But why are we giving them this footgun?  Can we just drop support for -moz-box in untrusted stylesheets?  Or are there too many sites that depend on it?  How close are we to unpreffing flexbox?

	Daniel Holbert [:dholbert]
	Comment 1 • 11 years ago

Flexbox is unpreffed in beta (from bug 841876), and the current plan is to let it stay unpreffed when that goes to release in a few weeks.

> Can we just drop support for -moz-box in untrusted stylesheets?
> Or are there too many sites that depend on it?

I think there might be too many sites...  I suppose we could do analytics to answer that question more definitively ("how many sites use display:-moz-box without following it with display:flex"), if we end up really strongly considering this.

	Boris Zbarsky [:bzbarsky] Reporter
	Comment 2 • 11 years ago

Ah, excellent.  If flexbox is already unpreffed, maybe we should start by adding a warning when -moz-box is used in an untrusted stylesheet?

	Daniel Holbert [:dholbert]
	Comment 3 • 11 years ago

That might be a good idea.

I suspect there are a lot of sites that have both new and old flexbox, for fallback... And as long as we've got users on old Gecko versions (i.e. until ESR17 and B2G 1.0* have negligible userbases), it'd be unwise to encourage web developers to remove that fallback style.

So if we add a warning like this soon, we'd probably want to only warn if the *computed style* ends up having -moz-box, rather than just if we see -moz-box.

* (I believe B2G 1.0 uses pre-gecko-22, which is before flexbox was preffed on by default)

	Boris Zbarsky [:bzbarsky] Reporter
	Comment 4 • 11 years ago

Computed style is hard because we don't know whether it originated in an untrusted sheet by that point....

	Justin Dolske [:Dolske]
	Comment 5 • 11 years ago

Is this likely to impact content we ship in Firefox (eg about:home, videocontrols), or is that covered by "trusted stylesheets"? If so we should probably start migrating such things to flexbox. [I suppose there is a similar concern for add-ons too.]

	Boris Zbarsky [:bzbarsky] Reporter
	Comment 6 • 11 years ago

If the stylesheets are loaded from a chrome:// URI (or maybe chrome://content ?), they should be covered by "trusted stylesheets".

But we should start migrating to flexbox anyway.

	phillip.haydon
	Comment 7 • 10 years ago
advocacy-reviewed

Just drop it completely. Stop being the IE6 of the current browsers.

	David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)
	Comment 8 • 10 years ago

(In reply to Boris Zbarsky [:bz] from comment #4)
> Computed style is hard because we don't know whether it originated in an
> untrusted sheet by that point....

We could probably issue the warning in nsCSSCompressedDataBlock::MapRuleInfoInto to get around that problem.

	David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)
	Comment 9 • 10 years ago

work in progress on the warning:
https://hg.mozilla.org/users/dbaron_mozilla.com/patches/raw-file/728ac3ced47c/unapplied.warn-xul-display-types
but putting it aside for now (see TODO at the top)

	Emilio Cobos Álvarez (:emilio)
	Comment 10 • 6 years ago

This is fixed as of bug 1496961. We don't parse the -moz- display values on content sheets anymore.