The search-textbox (used for quick search) no longer shows its textbox-search-clear icon.

https://hg.mozilla.org/mozilla-central/rev/64cf5966f871 changes the icon src from "chrome://global/skin/icons/searchfield-cancel.svg" to "resource://gre-resources/searchfield-cancel.svg". The toolbox rules tab recognises the resource (if you hover over the list-style-image url), but it isn't shown in the actual image. I think it may be the content security policy needs updating.

(In reply to Henry Wilkes [:henry] from comment #0)

The search-textbox (used for quick search) no longer shows its textbox-search-clear icon.

https://hg.mozilla.org/mozilla-central/rev/64cf5966f871 changes the icon src from "chrome://global/skin/icons/searchfield-cancel.svg" to "resource://gre-resources/searchfield-cancel.svg". The toolbox rules tab recognises the resource (if you hover over the list-style-image url), but it isn't shown in the actual image. I think it may be the content security policy needs updating.

The resource://gre-resources/ dir in jar.mn is used by the UA sheet, also for other stuff. I wonder if we should teach the Gecko CSP implementation that such resources are always allowed irrespective of the "letter" of the CSP provided by the site; I think we already do this for some other URLs/protocols. Christoph, would doing that make sense?

Double checked, and in the console I see "Security Error: Content at chrome://global/skin/search-textbox.css may not load or link to resource://gre-resources/searchfield-cancel.svg."

The clear icon is also not showing in Nightly. The image exists and can be found but is not being loaded.

To reproduce:

1. Go to Settings and type anything in the search box. The clear icon will not show.

To get the icon to show:

1. Right click on the search box and inspect.
2. Find the textbox-search-clear element by searching in the inspector for textbox-search-clear Make sure the correct textbox-search-clear element is selected
3. Then go to the CSS rules for textbox-search-clear and uncheck the list-style-image rule, then check it again and the clear icon should show in the search box now. Sometimes I have to uncheck and check the rule more than once and click on url(resource://gre-resources/searchfield-cancel.svg) and it will show the clear icon in the search box.

(In reply to Niklas Baumgardner from comment #3)

3. Then go to the CSS rules for textbox-search-clear and uncheck the list-style-image rule, then check it again and the clear icon should show in the search box now. Sometimes I have to uncheck and check the rule more than once and click on url(resource://gre-resources/searchfield-cancel.svg) and it will show the clear icon in the search box.

I think this is probably because rules added in the toolbox circumvent the security policy for loaded stylesheets. You should see the "Security Error: Content at chrome://global/skin/search-textbox.css may not load or link to resource://gre-resources/searchfield-cancel.svg." console error on load.

Niklas said his patch in bug 1534799 appears to fix this by switching to an html:img.

Can you verify if this is now fixed on daily TB builds per comment #5 and that bug being fixed?

(In reply to :Gijs (he/him) from comment #1)

The resource://gre-resources/ dir in jar.mn is used by the UA sheet, also for other stuff. I wonder if we should teach the Gecko CSP implementation that such resources are always allowed irrespective of the "letter" of the CSP provided by the site; I think we already do this for some other URLs/protocols. Christoph, would doing that make sense?

Generally speaking yes, we have done that e.g. for resource://pdf.js/ and I think we could have added another carveout within CSP. In the meantime it seems that Bug 1534799 has fixed the issue reported here, so I guess no need for any action after all.