Created attachment 147002 [details] Demonstrates the assertion failure ASSERTION FAILED: m_nameToGroupMap /Volumes/Data/webkit3/Source/WebCore/dom/CheckedRadioButtons.cpp(199) : void WebCore::CheckedRadioButtons::updateCheckedState(WebCore::HTMLInputElement*) 1 0x102d9175d WebCore::CheckedRadioButtons::updateCheckedState(WebCore::HTMLInputElement*) 2 0x1036df1f7 WebCore::HTMLInputElement::setChecked(bool, WebCore::TextFieldEventBehavior) 3 0x103a1e216 WebCore::setJSHTMLInputElementChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue) 4 0x103a1fe95 bool JSC::lookupPut<WebCore::JSHTMLInputElement>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLInputElement*, bool) 5 0x103a1ff26 void JSC::lookupPut<WebCore::JSHTMLInputElement, WebCore::JSHTMLElement>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLInputElement*, JSC::PutPropertySlot&) 6 0x103a1e31a WebCore::JSHTMLInputElement::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 7 0x101e5bbdd JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) 8 0x10206141f llint_slow_path_put_by_id 9 0x10206a6ac llint_op_put_by_id
Note please place the attached file in fast/forms or other paths that's 2-directories below LayoutTests.
I identified the problem. http://trac.webkit.org/changeset/111051 was incomplete. r111051 changed the behavior so that radio buttons in an orphan form make groups. However the current code unregisters a radio button from its group whenever a tree including the radio button is detached from a tree.
Created attachment 147023 [details] Patch
Comment on attachment 147023 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=147023&action=review > Source/WebCore/ChangeLog:5 > + Fix a bug that checking a radio button in a radio button group in a from > + detached from a document tree doesn't uncheck another radio button in > + the radio button group. Why is this different from the bug title? I should go below the reviewed by line. > Source/WebCore/ChangeLog:14 > + Register this to CheckedRadioButtons only if new owner is Document. Did you mean only if the new owner is in the document? Also, could you explain why doing so fixes the bug? > Source/WebCore/ChangeLog:16 > + Unregister this from CheckedRadioButtons only if old owner was Document. Ditto.
Created attachment 147033 [details] Patch 2 Update ChangeLog
Comment on attachment 147033 [details] Patch 2 Thanks for the detailed description!
Comment on attachment 147033 [details] Patch 2 Clearing flags on attachment: 147033 Committed r120118: <http://trac.webkit.org/changeset/120118>
All reviewed patches have been landed. Closing bug.