Fix form association behavior when a form and a control with form= are removed from a document toge…

Source/core/html/FormAssociatedElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 81 matching lines @@
         return;
 
     HTMLElement* element = toHTMLElement(this);
     if (element->fastHasAttribute(formAttr))
         resetFormAttributeTargetObserver();
 }
 
 void FormAssociatedElement::removedFrom(ContainerNode* insertionPoint)
 {
     HTMLElement* element = toHTMLElement(this);
-    if (insertionPoint->inDocument() && element->fastHasAttribute(formAttr))
+    if (insertionPoint->inDocument() && element->fastHasAttribute(formAttr)) {
         setFormAttributeTargetObserver(nullptr);
+        resetFormOwner();
+        ASSERT(!m_form);

[tkent, 2015/06/26 02:01:44]

Some tests hit this.  Investigating...

[tkent, 2015/06/26 03:49:16]

According to the specification, ancestor form can be the owner.  We should not
add this assertion.

[tkent, 2015/06/26 03:51:54]

Removed in Patch Set 2. PTAL.

+        return;
+    }
     // If the form and element are both in the same tree, preserve the connection to the form.
     // Otherwise, null out our form and remove ourselves from the form's list of elements.
     if (m_form && NodeTraversal::highestAncestorOrSelf(*element) != NodeTraversal::highestAncestorOrSelf(*m_form.get()))
         resetFormOwner();
 }
 
 HTMLFormElement* FormAssociatedElement::findAssociatedForm(const HTMLElement* element)
 {
     const AtomicString& formId(element->fastGetAttribute(formAttr));
     // 3. If the element is reassociateable, has a form content attribute, and
@@ skipping 236 matching lines @@
     visitor->trace(m_element);
     IdTargetObserver::trace(visitor);
 }
 
 void FormAttributeTargetObserver::idTargetChanged()
 {
     m_element->formAttributeTargetChanged();
 }
 
 } // namespace blink