Bug 47314

Summary: ASSERTION FAILURE: Attempt to cast RenderObject to RenderFrameSet when <frameset> has CSS content property
Product: WebKit Reporter: Daniel Bates <dbates>
Component: FramesAssignee: Daniel Bates <dbates>
Status: RESOLVED FIXED    
Severity: Normal CC: bdakin, darin, mjs
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
Patch and test case
darin: review+
[Test Case] Standalone
none
Patch and test case darin: review+

Daniel Bates
Reported 2010-10-06 16:29:16 PDT
HTMLFrameSetElement::defaultEventHandler() assumes its renderer is a RenderFrameSet object when handling mouse events and thus tries to cast its renderer to RenderFrameSet. This causes an assertion failure when a <frameset> specifies an image in its CSS content property since we associate a generic render object (RenderObject) to the HTMLFrameSetElement instead of the specialized RenderFrameSet object. For completeness, support for the CSS content property was added to HTMLFrameSetElement in changeset 15299 <http://trac.webkit.org/changeset/15299> (rdar://problem/4610314).
Attachments
Patch and test case (5.45 KB, patch)
2010-10-06 16:37 PDT, Daniel Bates 		darin: review+
DetailsFormatted DiffDiff
[Test Case] Standalone (1.68 KB, text/html)
2010-10-06 16:38 PDT, Daniel Bates 		no flags
Details
Patch and test case (5.44 KB, patch)
2010-10-06 16:41 PDT, Daniel Bates 		darin: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Daniel Bates
Comment 1 2010-10-06 16:37:21 PDT
Created attachment 70007 [details] Patch and test case For some reason running the test case in a release build may not cause a crash directly. But, if you click on the not-found image placeholder then it will crash.
Daniel Bates
Comment 2 2010-10-06 16:38:40 PDT
Created attachment 70008 [details] [Test Case] Standalone Standalone test case. Included in the patch.
Daniel Bates
Comment 3 2010-10-06 16:41:19 PDT
Created attachment 70009 [details] Patch and test case Updated changelogs in patch to reflect updated bug title.
Daniel Bates
Comment 4 2010-10-06 16:53:23 PDT
Committed r69256: <http://trac.webkit.org/changeset/69256>
Note You need to log in before you can comment on or make changes to this bug.