Fix update of validity cache value, so that it reflects the correct state of any FormControlElement.

Source/core/html/HTMLTextAreaElement.cpp

Index: Source/core/html/HTMLTextAreaElement.cpp
diff --git a/Source/core/html/HTMLTextAreaElement.cpp b/Source/core/html/HTMLTextAreaElement.cpp
index 8480199a6472428e6aefb13aeb91361ec073a5cf..7ad42d371fdce9025b9eb4be77def06a100c666c 100644
--- a/Source/core/html/HTMLTextAreaElement.cpp
+++ b/Source/core/html/HTMLTextAreaElement.cpp
@@ -572,4 +572,13 @@ bool HTMLTextAreaElement::supportsAutofocus() const
     return true;
 }
 
+void HTMLTextAreaElement::detach(const AttachContext& context)
+{
+    // Since we do a lazy update from renderer, do it if we have
+    // failed to do a lazy update. Updated value will be needed
+    // while saving the form control state.

[tkent, 2014/09/03 08:04:44]

I don't understand the comment.
Does the code to save form control value use m_value instead of value()?

[spartha, 2014/09/03 08:50:57]

It uses value(). It tries to update m_value in the process. This causes the
assertion for renderer() to fail, as the element is already detached. I guess
this issue got masked by the call to setNeedsValidityCheck in subTreeChanged()
which would call value().

#0 0x7f17d2e2dcfe base::debug::StackTrace::StackTrace()
#1 0x7f17d2e2d830 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f17c3be7340 <unknown>
#3 0x7f17ca368c16 blink::HTMLTextAreaElement::updateValue()
#4 0x7f17ca367a17 blink::HTMLTextAreaElement::value()
#5 0x7f17ca3679af blink::HTMLTextAreaElement::saveFormControlState()
#6 0x7f17ca40bf3c blink::DocumentState::toStateVector()
#7 0x7f17caa125de blink::HistoryItem::documentState()
#8 0x7f17caa12633 blink::HistoryItem::getReferencedFilePaths()
#9 0x7f17c89a4202 blink::WebHistoryItem::getReferencedFilePaths()
#10 0x7f17cda40bf7 content::HistoryEntryToPageState()
#11 0x7f17cdb8837e content::RenderViewImpl::SendUpdateState()
#12 0x7f17cdb882a3 content::RenderViewImpl::UpdateSessionHistory()
#13 0x7f17cdb37ee2 content::RenderFrameImpl::didCommitProvisionalLoad()
#14 0x00000056e380 content::WebFrameTestProxy<>::didCommitProvisionalLoad()
#15 0x00000056f3ed content::WebFrameTestProxy<>::didCommitProvisionalLoad()
#16 0x7f17c89250ec blink::FrameLoaderClientImpl::dispatchDidCommitLoad()
#17 0x7f17caa0ab79 blink::FrameLoader::receivedFirstData()
#18 0x7f17ca9fb5fb blink::DocumentLoader::ensureWriter()
#19 0x7f17ca9f9d55 blink::DocumentLoader::commitData()
#20 0x7f17ca9f9922 blink::DocumentLoader::finishedLoading()
#21 0x7f17ca9fc686 blink::DocumentLoader::maybeLoadEmpty()
#22 0x7f17ca9fc7f9 blink::DocumentLoader::startLoadingMainResource()
#23 0x7f17caa0ddb9 blink::FrameLoader::loadWithNavigationAction()
#24 0x7f17caa0cfa3 blink::FrameLoader::load() 

[tkent, 2014/09/03 09:11:27]

Thanks.  I understand.
We should remove ASSERT(renderer()).  It's bogus now.

[spartha, 2014/09/03 14:47:33]

Done.

+    updateValue();
+    HTMLTextFormControlElement::detach(context);
+}
+
 }