210895 - input type=file form element causes crash when in complex DOM structure [@ StyleSetImpl::AttributeChanged]

Status: RESOLVED DUPLICATE of bug 203041

(Core :: CSS Parsing and Computation, defect)

Description

[Mike Heins]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2b) Gecko/20021016
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030617

Placing an <input type=file> in a form containing complex <table> and <div>
structures causes a Placing an <input type=file> in a form containing complex
<table> and <div>
structures causes a crash.

The crash started at Mozilla 1.3a, and will not occur in 1.2b or below.

You can reproduce with:

   http://demo.icdevgroup.org/tmp/test6.html

An identical file with the only change being an <input type=text>
instead of <input type=file> does not cause the crash:

   http://demo.icdevgroup.org/tmp/test5.html

This appears to be related to the new CSS positioning and sizing
routines, which I don't like. They appear to try and emulate MSIE's
brain-dead refusal to transmit the size of relative elements to
its parents. Mozilla 1.2 would dynamically resize containing
blocks based on the current status; Mozilla 1.3 does the same
thing MSIE does, which is to transmit a zero size and force you
to manually specify a width and height. Ugh.
crash.

The crash started at Mozilla 1.3a, and will not occur in 1.2b or below.

You can reproduce with:

   http://demo.icdevgroup.org/tmp/test6.html

Reproducible: Always

Steps to Reproduce:
1. Access http://demo.icdevgroup.org/tmp/test6.html
Actual Results:  
Browser crash and core dump.

Expected Results:  
Handled it.

Most important, this was not present in Mozilla 1.2b and below.

Comment 1

[Matthias Versen [:Matti]]

-> Style System (or Layout ?)

confirming with win2k and a 1 day old CVS trunk (optimized with symbols)

Comment 2

[Matthias Versen [:Matti]]

Attachment: Stacktrace

Comment 3

[Andrew Schultz]

regression between linux trunk 2002121908 and 2002122008

dupe of another crasher bug for file input style manipulation with same
regression window

*** This bug has been marked as a duplicate of 203041 ***