Bug 14769 - Reproducible ASSERTION FAILED: element->isRadioButton() in WebCore::HTMLFormElement::CheckedRadioButtons::removeButton(WebCore::HTMLGenericFormElement*)
Summary: Reproducible ASSERTION FAILED: element->isRadioButton() in WebCore::HTMLFormE...
Status: RESOLVED DUPLICATE of bug 15806
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 523.x (Safari 3)
Hardware: Mac OS X 10.4
: P2 Normal
Assignee: Nobody
URL:
Keywords: HasReduction
Depends on:
Blocks:
 
Reported: 2007-07-25 23:17 PDT by mitz
Modified: 2007-11-02 16:11 PDT (History)
2 users (show)

See Also:

Attachments
Reduction (281 bytes, text/html)
2007-10-21 21:56 PDT, Matt Lilek 		no flags Details
Simpler reduction (85 bytes, text/html)
2007-10-23 08:58 PDT, mitz 		no flags Details
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description mitz 2007-07-25 23:17:00 PDT 
Closing a Bugzilla bug report I got this:
ASSERTION FAILED: element->isRadioButton()
(/WebKit/WebCore/html/HTMLFormElement.cpp:743 void WebCore::HTMLFormElement::CheckedRadioButtons::removeButton(WebCore::HTMLGenericFormElement*))
Comment 1 Matt Lilek 2007-10-16 16:30:34 PDT 
I'm hitting this reliably when submitting the quiz on http://today.msnbc.msn.com/id/21310010/.
Comment 2 Matt Lilek 2007-10-16 16:34:35 PDT 
Steps to reproduce:
1. Go to <http://today.msnbc.msn.com/id/21310010/>
2. Select the first radio button for each question
3. Click submit
4. Boom.
Comment 3 Matt Lilek 2007-10-21 21:56:17 PDT 
Created attachment 16781 [details]
Reduction

Load the file and close the tab/window, will assert in a debug build.
Comment 4 Matt Lilek 2007-10-21 21:58:10 PDT 
(In reply to comment #3)
> Created an attachment (id=16781) [edit]
> Reduction
> 
> Load the file and close the tab/window, will assert in a debug build.
> 

Looks like you have to open it in a new tab/window to tickle it.
Comment 5 mitz 2007-10-23 08:58:01 PDT 
Created attachment 16820 [details]
Simpler reduction

The button is not a descendant of its form, and after the document is destroyed, the button gets destroyed before the form is destroyed.
Comment 6 mitz 2007-11-02 16:11:39 PDT 
The later bug wins because it has a patch :-)

*** This bug has been marked as a duplicate of 15806 ***