299188 - [FIX] CSS position:relative on input tag within fieldset tag crashes browser in [@ nsCSSFrameConstructor::GetAbsoluteContainingBlock]

Status: RESOLVED FIXED

(Core :: Layout: Form Controls, defect, P1)

Description

[Alex King]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050629 Camino/0.9a1+
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050629 Camino/0.9a1+

In the Jun. 29th nightly of Camino, loading a page in the WordPress admin
interface causes Camino to crash. I am using the "Tiger" CSS:

http://www.orderedlist.com/articles/wordpress-administration-design-tiger/

I believe the most recent nightly I used before this was the Jun. 27th nightly,
this build did not exhibit this problem.

Reproducible: Always

Steps to Reproduce:
1. Click on bookmark for WP admin interface

Actual Results:  
Camino crashes.

Expected Results:  
Not crash.

Will attach crash log.

Comment 1

[Alex King]

Attachment: Crash log.

Comment 2

[Samuel Sidler (old account; do not CC)]

Is this something you can reproduce? Before I try, I want to make sure it's not
a different bug and that it's reproducible.

Comment 3

[Alex King]

(In reply to comment #2)
> Is this something you can reproduce? Before I try, I want to make sure it's not
> a different bug and that it's reproducible.

I stopped trying after it crashed twice in a row while loading the page -
loading at the same point in the page I think. Both crash logs are in the
attached .log file.

Comment 4

[Samuel Sidler (old account; do not CC)]

This looks like a core bug, but I want to confirm it first and see if I can't
figure out exactly what is going on. Is there a particular page you're going to
that causes the crash?

I'm currently testing on opensourcecms.com, but it doesn't have that specific
theme which you're using.

Also: Does this happen when you're *not* logged into the admin interface? As
in... when you click to load the bookmark, it crashes despite the fact that
you're not logged in?

Comment 5

[Alex King]

I've saved the page and linked CSS and JS as a test case for you:

http://alexking.org/dev/camino_06-29/crash.html

Comment 6

[Samuel Sidler (old account; do not CC)]

Attachment: Confirmation Crash Log

Confirming with this crash log. Will isolate bug later.

Comment 7

[Samuel Sidler (old account; do not CC)]

This is definitely a regression and also a CSS bug (removing CSS fixes it).
Working on a testcase.

Comment 8

[Samuel Sidler (old account; do not CC)]

Attachment: Testcase (Warning: This will crash your browser)

This appears to be caused when the position:relative CSS style is defined on an
<input> tag within <fieldset> tags. The following code, combined with
position:relative CSS will crash your browser.

<div class="wrap">
 <fieldset>
  <input name="mn" value="1" size="2" maxlength="2" type="text">
 </fieldset>
</div>

Comment 9

[Samuel Sidler (old account; do not CC)]

Confirmed on Deer Park 20050629 for Windows.

-> Core

Comment 10

[Samuel Sidler (old account; do not CC)]

Rewriting description, reassigning to nobody, adding QA, and requesting
blocking1.8b3.

Comment 11

[Samuel Sidler (old account; do not CC)]

This bug is not present on the Deer Park build from 20050628. It's a recent
regression (as in, the last 48 hours).

Comment 12

[Benjamin Smedberg]

Possible causes: bug 294717 (most likely, touched fieldsets specifically), bug
293504, bug 295690. Marking blocking+ for speedy triage, depending on
seriousness we might backout the offending patch or push this to b4.

Comment 13

[Mats Palmgren (inactive)]

*** Bug 299227 has been marked as a duplicate of this bug. ***

Comment 14

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

What happens here is that nsCSSFrameConstructor::GetAbsoluteContainingBlock is
called before nsFieldSetFrame::SetInitialChildList which means the area frame
does not exist yet (first child is null).
Make GetFieldSetAreaFrame() return nsnull for this case.

(I still think GetAbsoluteContainingBlock() isn't entirely correct in other
cases but I will file a separate bug on that)

Comment 15

[Benjamin Smedberg]

Comment on attachment 187834 [details] [diff] [review]
Patch rev. 1

a=bsmedberg for checkin on 6/30 only

Comment 16

[Carsten Book [:Tomcat]]

*** Bug 299243 has been marked as a duplicate of this bug. ***

Comment 17

[Mats Palmgren (inactive)]

*** Bug 299289 has been marked as a duplicate of this bug. ***

Comment 18

[Mats Palmgren (inactive)]

Checked in to trunk at 2005-06-30 13:31 PDT

-> FIXED

Comment 19

[Carsten Book [:Tomcat]]

*** Bug 299243 has been marked as a duplicate of this bug. ***