Bug 88835 – Checking a radio button doesn't uncheck other buttons in the same group in some cases

• Component: Forms
• Status: RESOLVED FIXED

[Ryosuke Niwa]

Created attachment 147002 [details]
Demonstrates the assertion failure

ASSERTION FAILED: m_nameToGroupMap
/Volumes/Data/webkit3/Source/WebCore/dom/CheckedRadioButtons.cpp(199) : void WebCore::CheckedRadioButtons::updateCheckedState(WebCore::HTMLInputElement*)
1   0x102d9175d WebCore::CheckedRadioButtons::updateCheckedState(WebCore::HTMLInputElement*)
2   0x1036df1f7 WebCore::HTMLInputElement::setChecked(bool, WebCore::TextFieldEventBehavior)
3   0x103a1e216 WebCore::setJSHTMLInputElementChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue)
4   0x103a1fe95 bool JSC::lookupPut<WebCore::JSHTMLInputElement>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLInputElement*, bool)
5   0x103a1ff26 void JSC::lookupPut<WebCore::JSHTMLInputElement, WebCore::JSHTMLElement>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLInputElement*, JSC::PutPropertySlot&)
6   0x103a1e31a WebCore::JSHTMLInputElement::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
7   0x101e5bbdd JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
8   0x10206141f llint_slow_path_put_by_id
9   0x10206a6ac llint_op_put_by_id

[Ryosuke Niwa]

Note please place the attached file in fast/forms or other paths that's 2-directories below LayoutTests.

[Kent Tamura]

I identified the problem.
http://trac.webkit.org/changeset/111051 was incomplete.
r111051 changed the behavior so that radio buttons in an orphan form make groups.   However the current code unregisters a radio button from its group whenever a tree including the radio button is detached from a tree.

[Kent Tamura]

Created attachment 147023 [details]
Patch

[Ryosuke Niwa]

Comment on attachment 147023 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=147023&action=review

> Source/WebCore/ChangeLog:5
> +        Fix a bug that checking a radio button in a radio button group in a from
> +        detached from a document tree doesn't uncheck another radio button in
> +        the radio button group.

Why is this different from the bug title? I should go below the reviewed by line.

> Source/WebCore/ChangeLog:14
> +        Register this to CheckedRadioButtons only if new owner is Document.

Did you mean only if the new owner is in the document?
Also, could you explain why doing so fixes the bug?

> Source/WebCore/ChangeLog:16
> +        Unregister this from CheckedRadioButtons only if old owner was Document.

Ditto.

[Kent Tamura]

Created attachment 147033 [details]
Patch 2

Update ChangeLog

[Ryosuke Niwa]

Comment on attachment 147033 [details]
Patch 2

Thanks for the detailed description!

[WebKit Review Bot]

Comment on attachment 147033 [details]
Patch 2

Clearing flags on attachment: 147033

Committed r120118: <http://trac.webkit.org/changeset/120118>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.