<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>14769</bug_id>
          
          <creation_ts>2007-07-25 23:17:00 -0700</creation_ts>
          <short_desc>Reproducible ASSERTION FAILED: element-&gt;isRadioButton() in WebCore::HTMLFormElement::CheckedRadioButtons::removeButton(WebCore::HTMLGenericFormElement*)</short_desc>
          <delta_ts>2007-11-02 16:11:39 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>DOM</component>
          <version>523.x (Safari 3)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.4</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>DUPLICATE</resolution>
          <dup_id>15806</dup_id>
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>HasReduction</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter>mitz</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>andersca</cc>
    
    <cc>dev+webkit</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>3698</commentid>
    <comment_count>0</comment_count>
    <who name="">mitz</who>
    <bug_when>2007-07-25 23:17:00 -0700</bug_when>
    <thetext>Closing a Bugzilla bug report I got this:
ASSERTION FAILED: element-&gt;isRadioButton()
(/WebKit/WebCore/html/HTMLFormElement.cpp:743 void WebCore::HTMLFormElement::CheckedRadioButtons::removeButton(WebCore::HTMLGenericFormElement*))</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>58688</commentid>
    <comment_count>1</comment_count>
    <who name="Matt Lilek">dev+webkit</who>
    <bug_when>2007-10-16 16:30:34 -0700</bug_when>
    <thetext>I&apos;m hitting this reliably when submitting the quiz on http://today.msnbc.msn.com/id/21310010/.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>58689</commentid>
    <comment_count>2</comment_count>
    <who name="Matt Lilek">dev+webkit</who>
    <bug_when>2007-10-16 16:34:35 -0700</bug_when>
    <thetext>Steps to reproduce:
1. Go to &lt;http://today.msnbc.msn.com/id/21310010/&gt;
2. Select the first radio button for each question
3. Click submit
4. Boom.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>59076</commentid>
    <comment_count>3</comment_count>
      <attachid>16781</attachid>
    <who name="Matt Lilek">dev+webkit</who>
    <bug_when>2007-10-21 21:56:17 -0700</bug_when>
    <thetext>Created attachment 16781
Reduction

Load the file and close the tab/window, will assert in a debug build.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>59077</commentid>
    <comment_count>4</comment_count>
    <who name="Matt Lilek">dev+webkit</who>
    <bug_when>2007-10-21 21:58:10 -0700</bug_when>
    <thetext>(In reply to comment #3)
&gt; Created an attachment (id=16781) [edit]
&gt; Reduction
&gt; 
&gt; Load the file and close the tab/window, will assert in a debug build.
&gt; 

Looks like you have to open it in a new tab/window to tickle it.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>59256</commentid>
    <comment_count>5</comment_count>
      <attachid>16820</attachid>
    <who name="">mitz</who>
    <bug_when>2007-10-23 08:58:01 -0700</bug_when>
    <thetext>Created attachment 16820
Simpler reduction

The button is not a descendant of its form, and after the document is destroyed, the button gets destroyed before the form is destroyed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>60103</commentid>
    <comment_count>6</comment_count>
    <who name="">mitz</who>
    <bug_when>2007-11-02 16:11:39 -0700</bug_when>
    <thetext>The later bug wins because it has a patch :-)

*** This bug has been marked as a duplicate of 15806 ***</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="0"
              isprivate="0"
          >
            <attachid>16781</attachid>
            <date>2007-10-21 21:56:17 -0700</date>
            <delta_ts>2007-10-23 08:58:01 -0700</delta_ts>
            <desc>Reduction</desc>
            <filename>Bug14769.html</filename>
            <type>text/html</type>
            <size>281</size>
            <attacher name="Matt Lilek">dev+webkit</attacher>
            
              <data encoding="base64">PGJvZHkgb25sb2FkPSJkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnYnRuJykuY2hlY2tlZD10cnVl
OyI+Cjx0YWJsZT4KICAgIDx0cj4KICAgICAgICA8dGQ+CiAgICAgICAgICAgIDx0YWJsZT4KICAg
ICAgICAgICAgICAgIDxmb3JtPgogICAgICAgICAgICAgICAgICAgIDxpbnB1dCB0eXBlPSJyYWRp
byIgbmFtZT0iYnRuIiBpZD0iYnRuIj4KICAgICAgICAgICAgICAgIDwvZm9ybT4KICAgICAgICAg
ICAgPC90YWJsZT4KICAgICAgICA8L3RkPgogICAgPC90cj4KPC90YWJsZT4KPC9ib2R5Pgo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>16820</attachid>
            <date>2007-10-23 08:58:01 -0700</date>
            <delta_ts>2007-10-23 08:58:01 -0700</delta_ts>
            <desc>Simpler reduction</desc>
            <filename>14769 reduction.html</filename>
            <type>text/html</type>
            <size>85</size>
            <attacher>mitz</attacher>
            
              <data encoding="base64">PHRhYmxlPgoJPGZvcm0+CgkJPGlucHV0IHR5cGU9InJhZGlvIiBuYW1lPSJidG4iIGlkPSJidG4i
IGNoZWNrZWQ+Cgk8L2Zvcm0+CjwvdGFibGU+Cg==
</data>

          </attachment>
      

    </bug>

</bugzilla>