258101 - Crash in 1.8a3 on changing form element type to "file"

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Sebastian Redl]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a3) Gecko/20040817
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a3) Gecko/20040817

I discovered this when probing for a possible security hole. When I have an
<input type="text"> and change its type to "file" via JS, the browser crashes
(and interestingly enough, doesn't launch the Feedback Agent).

Reproducible: Always
Steps to Reproduce:
1. Open testcase.
2. Hit the "Hit Me" button.

Actual Results:  
Browser crashes

Expected Results:  
Considering what I tried to do, it should probably throw a security exception.

Comment 1

[Sebastian Redl]

Attachment: Testcase

Comment 2

[Mats Palmgren (inactive)]

There is a circular loop of:

               nsHTMLDocument::FlushPendingNotifications
              nsGenericHTMLElement::GetPrimaryFrameFor
 stack       nsGenericHTMLElement::GetFormControlFrameFor
   ^        nsGenericHTMLElement::GetFormControlFrame
   |       nsHTMLInputElement::GetValue
   |      nsFileControlFrame::CreateAnonymousContent
         nsCSSFrameConstructor::CreateAnonymousFrames
        nsCSSFrameConstructor::CreateAnonymousFrames
       nsCSSFrameConstructor::ConstructHTMLFrame
      nsCSSFrameConstructor::ConstructFrame
     nsCSSFrameConstructor::ContentInserted
    nsCSSFrameConstructor::RecreateFramesForContent
   nsCSSFrameConstructor::RestyleElement
  ProcessRestyle 
 nsCSSFrameConstructor::ProcessPendingRestyles
PresShell::FlushPendingNotifications

until we run out of stack space...

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

This launched Talkback for me on crash, Sebastian.  Perhaps you need to delete
compreg.dat and have it regenerate.

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB743798G

Comment 4

[Sebastian Redl]

(In reply to comment #3)
> This launched Talkback for me on crash, Sebastian.  Perhaps you need to delete
> compreg.dat and have it regenerate.
> 

Still no Talkback after regenerating. I doubt it would be a different trace than
the existing one, though.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Note: patch in bug 257694 fixes this.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed by patch in bug 257694

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using the testcase at
http://bugzilla.mozilla.org/attachment.cgi?id=157946&action=view on Seamonkey
trunk builds of 2004-09-15-12 on Windows XP.

Comment 8

[Bob Clary [:bc] (inactive)]

layout/forms/crashtests/258101-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3