Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=34076
        <rdar://problem/7594601> Crash in mangleme in WebCore::Element::getAttribute

        Test: fast/forms/misplaced-img-form-registration.html

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::registerImgElement): Assert that the same image isn't added
        to vector again.
        (WebCore::HTMLFormElement::removeImgElement): Similarly, assert that we're removing something
        that's actually registered.

        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::~HTMLImageElement): If parser fails
        to insert the image element, then there will be no removed from tree notification either,
        need to unregister right away.



git-svn-id: svn://svn.chromium.org/blink/trunk@54242 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/LayoutTests/ChangeLog

+2010-02-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        <rdar://problem/7594601> Crash in mangleme in WebCore::Element::getAttribute
+
+        * fast/forms/misplaced-img-form-registration-expected.txt: Added.
+        * fast/forms/misplaced-img-form-registration.html: Added.
+
 2010-02-02  Adam Roben  <aroben@apple.com>
 
         Stop skipping some tests that were failing due to buggy versions of

third_party/WebKit/LayoutTests/fast/forms/misplaced-img-form-registration-expected.txt

+Test for bug 34488: Crash in mangleme in WebCore::Element::getAttribute.
+
+Pass if no crash or assertion failure.
+
+

third_party/WebKit/LayoutTests/fast/forms/misplaced-img-form-registration.html

+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=34488">bug 34488</a>: Crash in mangleme in WebCore::Element::getAttribute.</p>
+<p>Pass if no crash or assertion failure.</p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<FORM><SELECT><IMG>

third_party/WebKit/WebCore/ChangeLog

+2010-02-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        <rdar://problem/7594601> Crash in mangleme in WebCore::Element::getAttribute
+
+        Test: fast/forms/misplaced-img-form-registration.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::registerImgElement): Assert that the same image isn't added
+        to vector again.
+        (WebCore::HTMLFormElement::removeImgElement): Similarly, assert that we're removing something
+        that's actually registered.
+
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::~HTMLImageElement): If parser fails
+        to insert the image element, then there will be no removed from tree notification either,
+        need to unregister right away.
+
 2010-02-02  Alexander Pavlov  <apavlov@chromium.org>
 
         Reviewed by Pavel Feldman.

third_party/WebKit/WebCore/html/HTMLFormElement.cpp

@@ -524,11 +524,13 @@ bool HTMLFormElement::isURLAttribute(Attribute* attr) const
 
 void HTMLFormElement::registerImgElement(HTMLImageElement* e)
 {
+    ASSERT(imgElements.find(e) == notFound);
     imgElements.append(e);
 }
 
 void HTMLFormElement::removeImgElement(HTMLImageElement* e)
 {
+    ASSERT(imgElements.find(e) != notFound);
     removeFromVector(imgElements, e);
 }
 

third_party/WebKit/WebCore/html/HTMLImageElement.cpp

@@ -54,6 +54,8 @@ HTMLImageElement::HTMLImageElement(const QualifiedName& tagName, Document* doc,
 
 HTMLImageElement::~HTMLImageElement()
 {
+    if (m_form)
+        m_form->removeImgElement(this);
 }
 
 bool HTMLImageElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const