RESOLVED FIXED 15806
ASSERT(element->isRadioButton()) fires destroying form elements 
https://bugs.webkit.org/show_bug.cgi?id=15806
Summary ASSERT(element->isRadioButton()) fires destroying form elements
Darin Adler
Reported 2007-11-02 14:56:38 PDT
Mark Rowe: This is a 100% reproducible assertion failure. I hit this every day or two when casually browsing the Intarwebs. The assertion that is failing is ASSERT(element->isRadioButton());. GDB suggests that the element in question may have already been deleted. Note the value of m_deletionHasBegun.
Attachments
patch with log and test (5.43 KB, patch)
2007-11-02 16:08 PDT, Darin Adler 		mitz: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Darin Adler
Comment 1 2007-11-02 14:56:53 PDT
<rdar://problem/5561626>
Darin Adler
Comment 2 2007-11-02 14:57:00 PDT
The problem here is that by the time ~HTMLGenericFormElement is called, it's too late to call removeFormElement, because HTMLInputElement part of the object has been destroyed, and the name() function no longer will return the right thing.
Darin Adler
Comment 3 2007-11-02 16:08:03 PDT
Created attachment 17003 [details] patch with log and test
mitz
Comment 4 2007-11-02 16:11:39 PDT
*** Bug 14769 has been marked as a duplicate of this bug. ***
mitz
Comment 5 2007-11-02 16:13:37 PDT
Comment on attachment 17003 [details] patch with log and test r=me!
Darin Adler
Comment 6 2007-11-02 16:25:25 PDT
Committed revision 27380.
Note You need to log in before you can comment on or make changes to this bug.