X-Git-Url: https://git.webkit.org/?p=WebKit-https.git;a=blobdiff_plain;f=WebCore%2FChangeLog;h=c333c8c20dc6cee8084198970da6e82c39723b9c;hp=8c02e39b5777d09726d52679d52333a8135696b9;hb=add00eadf2c0a1b9d0b7816939253c26cccdf958;hpb=5a5f696a0ff723dd8adb34df44d806f917922556

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 8c02e39b5777..c333c8c20dc6 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,23 @@
+2007-11-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mitz.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15806
+          <rdar://problem/5561626> ASSERT(element->isRadioButton()) fires destroying form elements
+
+        Test: fast/forms/remove-radio-button-assert.html
+
+        * html/HTMLGenericFormElement.cpp: (WebCore::HTMLGenericFormElement::removeFromForm):
+        Added protected function to be used by derived classes that need to do the same sort
+        of removal from form that's automatically done by the base class in certain circumstances.
+        * html/HTMLGenericFormElement.h: Added removeFromForm.
+
+        * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::~HTMLInputElement):
+        Call removeFromForm here so the element is removed before we destroy the HTMLInputElement
+        part of this object. By the time we get to the base class's destructor it's too late.
+        The problem is specific to radio buttons so we don't have to worry about other classes
+        derived from HTMLGenericFormElement.
+
 2007-11-02  Darin Adler  <darin@apple.com>
 
         Reviewed by Mitz.