HTMLFrameSetElement::defaultEventHandler() assumes its renderer is a RenderFrameSet object when handling mouse events and thus tries to cast its renderer to RenderFrameSet. This causes an assertion failure when a <frameset> specifies an image in its CSS content property since we associate a generic render object (RenderObject) to the HTMLFrameSetElement instead of the specialized RenderFrameSet object. For completeness, support for the CSS content property was added to HTMLFrameSetElement in changeset 15299 <http://trac.webkit.org/changeset/15299> (rdar://problem/4610314).
Created attachment 70007 [details] Patch and test case For some reason running the test case in a release build may not cause a crash directly. But, if you click on the not-found image placeholder then it will crash.
Created attachment 70008 [details] [Test Case] Standalone Standalone test case. Included in the patch.
Created attachment 70009 [details] Patch and test case Updated changelogs in patch to reflect updated bug title.
Committed r69256: <http://trac.webkit.org/changeset/69256>