Bug 10541 – REGRESSION: The text on a button sometimes shows up as the text of another button on the same page

• Status: RESOLVED
• Resolution: FIXED
• Component: Forms

Look at the text on the buttons of the attached screenshot to understand what I mean. This is the third time I encounter this, the first two times I only noticed that a button contained the wrong text (text from some other button on the same page), but this last also that the text had swapped between two buttons.

The first time I noticed it was on zeldman.com, the others here on bugzilla. It happens very seldom, but it feels kind of strange to hit "Find" to commit a change to a bug.

I have never seen this in released Safari, so I believe it's a regression.

Created attachment 10203 [details]
Example of the bug in action

Got this a couple of times today following some back/forward cache navigation including non-HTML documents. Looks like a problem with restoring form state in these cases. Vaguely reminiscent of bug 8753.

[Rachael Worthington (cheers)]

I see this occasionally when logging into omni's phpbb forums (forums.omnigroup.com), although I haven't figured out exactly what the trick is to get it to happen. the post-logged in screen has a button that says "if you're not redirected click here" and the button sometimes reads "submit" instead of "proceed".

[John Sullivan]

This is in radar as 4751164.

I have a fairly reproducible case here:
https://svn.macosforge.org/projects/webkit/wiki/WebKit%20Team?action=history
After you click the "View changes" button and navigate back, that button's title changes to Search and the radio buttons change state.

I think the problem is that Document's m_formElementsWithState is a hash set, and as such its iterator is undeterministic. This makes the order in the result of Document::formElementsState() arbitrary for same-named, same-typed controls, so it doesn't necessarily match registration order.

Radio buttons are especially susceptible since typically there are multiple radio buttons with the same name. They have unique values, but value isn't part of the saved state for radio buttons!

[Maciej Stachowiak]

Created attachment 12820 [details]
the fix, made new ListHashSet class and used it

[Maciej Stachowiak]

Comment on attachment 12820 [details]
the fix, made new ListHashSet class and used it

Mark reviewed this, with bonus review help from Lars for the natty template bits.