Bug 15806 - ASSERT(element->isRadioButton()) fires destroying form elements
Summary: ASSERT(element->isRadioButton()) fires destroying form elements
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Forms (show other bugs)
Version: 523.x (Safari 3)
Hardware: Mac OS X 10.4
: P2 Normal
Assignee: Darin Adler
URL:
Keywords: InRadar
: 14769 (view as bug list)
Depends on:
Blocks:
 
Reported: 2007-11-02 14:56 PDT by Darin Adler
Modified: 2007-11-02 16:25 PDT (History)
1 user (show)

See Also:

Attachments
patch with log and test (5.43 KB, patch)
2007-11-02 16:08 PDT, Darin Adler 		mitz: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Darin Adler 2007-11-02 14:56:38 PDT 
Mark Rowe:
This is a 100% reproducible assertion failure.  I hit this every day or two when casually browsing the Intarwebs.  The assertion that is failing is ASSERT(element->isRadioButton());.  GDB suggests that the element in question may have already been deleted. Note the value of m_deletionHasBegun.
Comment 1 Darin Adler 2007-11-02 14:56:53 PDT 
<rdar://problem/5561626>
Comment 2 Darin Adler 2007-11-02 14:57:00 PDT 
The problem here is that by the time ~HTMLGenericFormElement is called, it's too late to call removeFormElement, because HTMLInputElement part of the object has been destroyed, and the name() function no longer will return the right thing.
Comment 3 Darin Adler 2007-11-02 16:08:03 PDT 
Created attachment 17003 [details]
patch with log and test
Comment 4 mitz 2007-11-02 16:11:39 PDT 
*** Bug 14769 has been marked as a duplicate of this bug. ***
Comment 5 mitz 2007-11-02 16:13:37 PDT 
Comment on attachment 17003 [details]
patch with log and test

r=me!
Comment 6 Darin Adler 2007-11-02 16:25:25 PDT 
Committed revision 27380.