Bug 363696 - "Crash [@ nsHTMLReflowState::ComputeContainingBlockRectangle] with file upload control in xul" [p=kinetik@flim.org (Matthew Gregan) r=bzbarsky sr=roc a=blocking1.9+]

layout/forms/nsFileControlFrame.cpp

@@ -380,50 +380,9 @@ NS_IMETHODIMP nsFileControlFrame::Reflow(nsPresContext*          aPresContext,
     }
   }
 
-  // The Areaframe takes care of all our reflow 
-  // except for when style is used to change its size.
-  // XXXbz do we care?  This setup just needs to die....  Leaving it
-  // in for now just because I don't want to regress things, but....
-  nsresult rv = nsAreaFrame::Reflow(aPresContext, aDesiredSize, aReflowState,
-                                    aStatus);
-  if (NS_SUCCEEDED(rv) && mTextFrame != nsnull) {
-    nsIFrame* child = GetFirstChild(nsnull);
-    if (child == mTextFrame) {
-      child = child->GetNextSibling();
-    }
-    if (child) {
-      nsRect buttonRect = child->GetRect();
-      nsRect txtRect = mTextFrame->GetRect();
-
-      // check to see if we must reflow just the area frame again 
-      // in order for the text field to be the correct height
-      // reflowing just the textfield (for some reason) 
-      // messes up the button's rect
-      if (txtRect.width + buttonRect.width != aDesiredSize.width ||
-          txtRect.height != aDesiredSize.height) {
-        nsHTMLReflowMetrics txtKidSize;
-        nsSize txtAvailSize(aReflowState.availableWidth, aDesiredSize.height);
-        nsHTMLReflowState   txtKidReflowState(aPresContext,
-                                              *aReflowState.parentReflowState,
-                                              this, txtAvailSize);
-        txtKidReflowState.SetComputedHeight(aDesiredSize.height);
-        rv = nsAreaFrame::WillReflow(aPresContext);
-        NS_ASSERTION(NS_SUCCEEDED(rv), "Should have succeeded");
-        rv = nsAreaFrame::Reflow(aPresContext, txtKidSize, txtKidReflowState, aStatus);
-        NS_ASSERTION(NS_SUCCEEDED(rv), "Should have succeeded");
-        rv = nsAreaFrame::DidReflow(aPresContext, &txtKidReflowState, aStatus);
-        NS_ASSERTION(NS_SUCCEEDED(rv), "Should have succeeded");
-
-        // And now manually resize the frame...
-        txtRect        = mTextFrame->GetRect();
-        txtRect.y      = aReflowState.mComputedBorderPadding.top;
-        txtRect.height = aDesiredSize.height;
-        mTextFrame->SetRect(txtRect);
-      }
-    }
-  }
-  NS_FRAME_SET_TRUNCATION(aStatus, aReflowState, aDesiredSize);
-  return rv;
+  // The Areaframe takes care of all our reflow
+  return nsAreaFrame::Reflow(aPresContext, aDesiredSize, aReflowState,
+                             aStatus);
 }
 
 /*
@@ -582,8 +541,11 @@ nsFileControlFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
     return rv;
 
   tempList.BorderBackground()->DeleteAll();
-  tempList.MoveTo(aLists);
-  
+
+  rv = OverflowClip(aBuilder, tempList, aLists,
+                    nsRect(aBuilder->ToReferenceFrame(this), GetSize()));
+  NS_ENSURE_SUCCESS(rv, rv);
+
   // Disabled file controls don't pass mouse events to their children, so we
   // put an invisible item in the display list above the children
   // just to catch events

layout/style/forms.css

@@ -361,7 +361,6 @@ input[type="file"] > input[type="text"] {
   background-color: inherit;
   color: inherit;
   font-size: inherit;
-  height: inherit;
   letter-spacing: inherit;
 }