32949 - [FIX]Absolutely positioned FORM element crashes app

Status: VERIFIED FIXED

(Core :: Layout: Form Controls, defect, P3)

Description

[Christine Hoffman]

Using the following builds:

Win32: 2000-03-15-06-m15-nb1b 
Mac: 2000-03-17-15-M15-nb1b 
Linux: 2000-03-17-16-m15-nb1b 

Open the attached file. Document consists of an absolutely positioned FORM 
element.

Expected result: FORM should be absolutely positioned 2 inches from the top and 
2 inches from the left.
Actual result: Application crashes. Talkback incident #7296301.

Call Stack:    (Signature = nsBlockReflowState::~nsBlockReflowState 07523b20) 
     
nsBlockReflowState::~nsBlockReflowState
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 701]
0x40000000
nsAbsoluteContainingBlock::ReflowAbsoluteFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp, 
line 408]
nsAbsoluteContainingBlock::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAbsoluteContainingBlock.cpp, 
line 210]
nsAreaFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAreaFrame.cpp, line 290]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
669]
RootFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 334]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
669]
nsScrollPortFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsScrollPortFrame.cpp, line 
481]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
669]
nsGfxScrollFrameInner::ReflowFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 
1366]
nsGfxScrollFrameInner::ReflowScrollArea
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 
1428]
nsGfxScrollFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line 
582]
nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 
669]
ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 531]
nsHTMLReflowCommand::Dispatch
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line 
145]
PresShell::ProcessReflowCommands
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2054]
PresShell::ExitReflowLock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 903]
PresShell::ContentAppended
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2626]
nsDocument::ContentAppended
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 1591]
nsHTMLDocument::ContentAppended
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLDocument.cpp, line 
1127]
HTMLContentSink::NotifyAppend
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp, 
line 3986]
SinkContext::FlushTags
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp, 
line 1923]
HTMLContentSink::CloseBody
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp, 
line 2714]
CNavDTD::CloseBody
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 2676]
CNavDTD::CloseContainer
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 2985]
CNavDTD::CloseContainersTo
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3045]
CNavDTD::CloseContainersTo
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3240]
CNavDTD::DidBuildModel
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 563]
nsParser::DidBuildModel
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 723]
nsParser::ResumeParse
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1220]
nsParser::OnStopRequest
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1645]
0x16007004

Comment 1

[Christine Hoffman]

Attachment: testcase to demonstrate problem

Comment 2

[rods (gone)]

I have the fix

Comment 3

[rods (gone)]

fixed - the blockframe wasn't getting created with the space manager flag.

Comment 4

[rods (gone)]

Closed the wrong bug - reopening

Comment 5

[R.K.Aa.]

sure you didn't reopen the wrong bug?

Comment 6

[rods (gone)]

Yes, I think I did reopen the wrong bug, I think this is fixed.

Comment 7

[Christine Hoffman]

Tested using 4/3 builds across platform. No crashes. Verifying bug fixed.