WebCore:

[WebKit-https.git] / WebCore / ChangeLog

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 8c02e39b5777d09726d52679d52333a8135696b9..c333c8c20dc6cee8084198970da6e82c39723b9c 100644 (file)
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,23 @@
+2007-11-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mitz.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15806
+          <rdar://problem/5561626> ASSERT(element->isRadioButton()) fires destroying form elements
+
+        Test: fast/forms/remove-radio-button-assert.html
+
+        * html/HTMLGenericFormElement.cpp: (WebCore::HTMLGenericFormElement::removeFromForm):
+        Added protected function to be used by derived classes that need to do the same sort
+        of removal from form that's automatically done by the base class in certain circumstances.
+        * html/HTMLGenericFormElement.h: Added removeFromForm.
+
+        * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::~HTMLInputElement):
+        Call removeFromForm here so the element is removed before we destroy the HTMLInputElement
+        part of this object. By the time we get to the base class's destructor it's too late.
+        The problem is specific to radio buttons so we don't have to worry about other classes
+        derived from HTMLGenericFormElement.
+

 2007-11-02  Darin Adler  <darin@apple.com>
 
         Reviewed by Mitz.
 2007-11-02  Darin Adler  <darin@apple.com>
 
         Reviewed by Mitz.