Bug 15806

Summary: ASSERT(element->isRadioButton()) fires destroying form elements
Product: WebKit Reporter: Darin Adler <darin>
Component: FormsAssignee: Darin Adler <darin>
Status: RESOLVED FIXED    
Severity: Normal CC: mitz
Priority: P2 Keywords: InRadar
Version: 523.x (Safari 3)   
Hardware: Mac   
OS: OS X 10.4   
Attachments:
Description Flags
patch with log and test mitz: review+

Darin Adler
Reported 2007-11-02 14:56:38 PDT
Mark Rowe: This is a 100% reproducible assertion failure. I hit this every day or two when casually browsing the Intarwebs. The assertion that is failing is ASSERT(element->isRadioButton());. GDB suggests that the element in question may have already been deleted. Note the value of m_deletionHasBegun.
Attachments
patch with log and test (5.43 KB, patch)
2007-11-02 16:08 PDT, Darin Adler 		mitz: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Darin Adler
Comment 1 2007-11-02 14:56:53 PDT
<rdar://problem/5561626>
Darin Adler
Comment 2 2007-11-02 14:57:00 PDT
The problem here is that by the time ~HTMLGenericFormElement is called, it's too late to call removeFormElement, because HTMLInputElement part of the object has been destroyed, and the name() function no longer will return the right thing.
Darin Adler
Comment 3 2007-11-02 16:08:03 PDT
Created attachment 17003 [details] patch with log and test
mitz
Comment 4 2007-11-02 16:11:39 PDT
*** Bug 14769 has been marked as a duplicate of this bug. ***
mitz
Comment 5 2007-11-02 16:13:37 PDT
Comment on attachment 17003 [details] patch with log and test r=me!
Darin Adler
Comment 6 2007-11-02 16:25:25 PDT
Committed revision 27380.
Note You need to log in before you can comment on or make changes to this bug.