205415 - crash when element containing input type file is hidden using display: none

Status: RESOLVED DUPLICATE of bug 203041

(SeaMonkey :: General, defect)

Description

[Tim]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.4b) Gecko/20030501
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.4b) Gecko/20030501

In the exaple link given there is a table displayed for uploading files. The
table is within a div with style set to "display: block". Upon pressing the
"close [x]" button this style is changed to "display: none" resulting in the
table being hidden. About 3 seconds after this the mozilla crashes.

Reproducible: Always

Steps to Reproduce:
1. have an input element set to "type = 'file'".
2. put the input element in a div with style = 'display: block'
3. put div inside a form
4. using javascript activated by an onclick event change the div element's
display setting to none.

Actual Results:  
Within 2-3 seconds mozilla completely crashes. - mac os x
linux it crashes instantly.

Expected Results:  
hide div element, without crashing ;)

Comment 1

[Matthias Versen [:Matti]]

nsCSSFrameConstructor::FindFrameWithContent(nsCSSFrameConstructor * const
0x0012f328, nsIPresContext * 0x07a9ba08, nsIFrameManager * 0x02e23110, nsIFrame
* 0x06e8be34, nsIContent * 0x02e34538, nsIContent * 0x024a5ea8, nsFindFrameHint
* 0x00000000) line 11693 + 13 bytes
nsCSSFrameConstructor::FindPrimaryFrameFor(nsCSSFrameConstructor * const
0x066e2058, nsIPresContext * 0x07a9ba08, nsIFrameManager * 0x02e23110,
nsIContent * 0x024a5ea8, nsIFrame * * 0x02e34538, nsFindFrameHint * 0x00000000)
line 11872
StyleSetImpl::FindPrimaryFrameFor(StyleSetImpl * const 0x0469e3f0,
nsIPresContext * 0x07a9ba08, nsIFrameManager * 0x02e23110, nsIContent *
0x024a5ea8, nsIFrame * * 0x0012f3e8, nsFindFrameHint * 0x00000000) line 1826
FrameManager::GetPrimaryFrameFor(FrameManager * const 0x00000000, nsIContent *
0x024a5ea8, nsIFrame * * 0x0012f3e8) line 683
nsCSSFrameConstructor::FindPrimaryFrameFor(nsCSSFrameConstructor * const
0x066e2058, nsIPresContext * 0x07a9ba08, nsIFrameManager * 0x02e23110,
nsIContent * 0x028500e8, nsIFrame * * 0x024a5ea8, nsFindFrameHint * 0x00000000)
line 11843
StyleSetImpl::FindPrimaryFrameFor(StyleSetImpl * const 0x0469e3f0,
nsIPresContext * 0x07a9ba08, nsIFrameManager * 0x02e23110, nsIContent *
0x028500e8, nsIFrame * * 0x0012f474, nsFindFrameHint * 0x00000000) line 1826
FrameManager::GetPrimaryFrameFor(FrameManager * const 0x024a5ee0, nsIContent *
0x028500e8, nsIFrame * * 0x0012f474) line 683
nsCSSFrameConstructor::FindPrimaryFrameFor(nsCSSFrameConstructor * const
0x066e2058, nsIPresContext * 0x07a9ba08, nsIFrameManager * 0x02e23110,
nsIContent * 0x044f1708, nsIFrame * * 0x028500e8, nsFindFrameHint * 0x00000000)
line 11843
StyleSetImpl::FindPrimaryFrameFor(StyleSetImpl * const 0x0469e3f0,
nsIPresContext * 0x07a9ba08, nsIFrameManager * 0x02e23110, nsIContent *
0x044f1708, nsIFrame * * 0x0012f644, nsFindFrameHint * 0x00000000) line 1826
FrameManager::GetPrimaryFrameFor(FrameManager * const 0x065fa248, nsIContent *
0x044f1708, nsIFrame * * 0x0012f644) line 683
PresShell::GetPrimaryFrameFor(const PresShell * const 0x06ad85a8, nsIContent *
0x044f1708, nsIFrame * * 0x0012f644) line 5712
nsCSSFrameConstructor::ContentStatesChanged(nsCSSFrameConstructor * const
0x066e2058, nsIPresContext * 0x00000000, nsIContent * 0x044f1708, nsIContent *
0x00000000, int 4) line 10406
StyleSetImpl::ContentStatesChanged(StyleSetImpl * const 0x0469e3f0,
nsIPresContext * 0x07a9ba08, nsIContent * 0x044f1708, nsIContent * 0x00000000,
int 4) line 1751
PresShell::ContentStatesChanged(PresShell * const 0x06ad85b0, nsIDocument *
0x02cd3a40, nsIContent * 0x044f1708, nsIContent * 0x00000000, int 4) line 5295
nsDocument::ContentStatesChanged(nsDocument * const 0x02cd3a40, nsIContent *
0x044f1708, nsIContent * 0x00000000, int 4) line 2053 + 19 bytes
nsEventStateManager::SetContentState(nsEventStateManager * const 0x02cd3a40,
nsIContent * 0x00000000, int 4) line 4098
nsEventStateManager::GenerateMouseEnterExit(nsEventStateManager * const
0x0012f328, nsIPresContext * 0x07a9ba08, nsGUIEvent * 0x0012fa40) line 2632
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x06d8ea04,
nsIPresContext * 0x07a9ba08, nsEvent * 0x0012fa40, nsIFrame * 0x0543913c,
nsEventStatus * 0x0012f96c, nsIView * 0x0755b558) line 398
PresShell::HandleEventInternal(PresShell * const 0x0012f328, nsEvent *
0x00000000, nsIView * 0x0755b558, unsigned int 1, nsEventStatus * 0x0012f96c)
line 6379
PresShell::HandleEvent(PresShell * const 0x06ad8600, nsIView * 0x0755b558,
nsGUIEvent * 0x0012fa40, nsEventStatus * 0x0012f96c, int 0, int & 22204296) line
6299 + 19 bytes
nsViewManager::HandleEvent(nsViewManager * const 0x0012f328, nsView *
0x00000000, nsGUIEvent * 0x0012fa40, int 0) line 2292
nsView::HandleEvent(nsView * const 0x0012f328, nsViewManager * 0x05409738,
nsGUIEvent * 0x0012fa40, int 0) line 308
nsViewManager::DispatchEvent(nsViewManager * const 0x05409738, nsGUIEvent *
0x0773cea8, nsEventStatus * 0x0012f9ec) line 2022 + 30 bytes
HandleEvent(nsGUIEvent * 0x0012fa40) line 82
nsWindow::DispatchEvent(nsWindow * const 0x068dee64, nsGUIEvent * 0x0012fa40,
nsEventStatus & nsEventStatus_eIgnore) line 1054 + 3 bytes
nsWindow::DispatchWindowEvent(nsWindow * const 0x0012f328, nsGUIEvent *
0x00000000) line 1075
nsWindow::DispatchMouseEvent(nsWindow * const 0x0012f328, unsigned int 300,
unsigned int 0, nsPoint * 0x00000001) line 5198
ChildWindow::DispatchMouseEvent(ChildWindow * const 0x0012f328, unsigned int
300, unsigned int 0, nsPoint * 0x00000000) line 5452 + 19 bytes
nsWindow::ProcessMessage(nsWindow * const 0x0012f328, unsigned int 512, unsigned
int 0, long 8782189, long * 0x0012fd10) line 3976
nsWindow::WindowProc(HWND__ * 0x002e03b4, unsigned int 0, unsigned int 0, long
109964900) line 1348 + 16 bytes
USER32! 77e2a244()
USER32! 77e045e5()
USER32! 77e0a792()
nsAppShellService::Run(nsAppShellService * const 0x00de6c48) line 479
main1(int 0, char * * 0x00243de8, nsISupports * 0x00000000) line 1268 + 9 bytes
main(int 3, char * * 0x00243de8) line 1647 + 22 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x001334ee,
HINSTANCE__ * 0x00400000) line 1671 + 23 bytes
MOZILLA! WinMainCRTStartup + 308 bytes
KERNEL32! 77e9847c()


*** This bug has been marked as a duplicate of 203041 ***