Bug 380899

Description Tim Buschtoens 2012-05-29 09:58:01 EDT

To reproduce:
Open controls demo in IE8
Switch to tab "text"
Switch to tab "button"
Error appears.

This specific way to crash the client has been introduced with Fix for bug 380878, though the actual bug has been there before, it just wasn't triggered. 

The setup to produce the error is very specific:
- A widget must have an inner element, for example by *temporarily* setting a complex or rounded border.
- However, the widget may *not* use GraphicsMixin for border layouting (anymore), so no rounded border or gradient. 
- The widget must have border that is either solid (that work only after the fix for 380878, but is easier to reproduce because it can be bigger than 2px), or complex. 
- The widget must be resized so the inner width is less than zero. That already leads to the inner element to have a negative size (which shouldnt happen), but apparently IE is okay with that, at least in quirksmode.
- Hiding and showing the widget again *may* now cause the crash in Widget.js#_ieFixLayoutOnAppear. For some reason IE accepts negative width only if its set as a number, not as a string.

I dont know which widget specifically causes the crash, but is assume its one of the CTabItems.

The fix should be to prevent setting the negative width for the inner element (use 0 instead).