[Webkit-unassigned] [Bug 14769] Reproducible ASSERTION FAILED: element->isRadioButton() in WebCore::HTMLFormElement::CheckedRadioButtons::removeButton(WebCore::HTMLGenericFormElement*)

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=14769


mitz at webkit.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #16781|0                           |1
        is obsolete|                            |




------- Comment #5 from mitz at webkit.org  2007-10-23 08:58 PDT -------
Created an attachment (id=16820)
 --> (http://bugs.webkit.org/attachment.cgi?id=16820&action=view)
Simpler reduction

The button is not a descendant of its form, and after the document is
destroyed, the button gets destroyed before the form is destroyed.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.