Bug 47314 - ASSERTION FAILURE: Attempt to cast RenderObject to RenderFrameSet when <frameset> has CSS content property
Summary: ASSERTION FAILURE: Attempt to cast RenderObject to RenderFrameSet when <frame...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Frames (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Daniel Bates
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-10-06 16:29 PDT by Daniel Bates
Modified: 2010-10-06 16:53 PDT (History)
3 users (show)

See Also:


Attachments
Patch and test case (5.45 KB, patch)
2010-10-06 16:37 PDT, Daniel Bates
darin: review+
Details | Formatted Diff | Diff
[Test Case] Standalone (1.68 KB, text/html)
2010-10-06 16:38 PDT, Daniel Bates
no flags Details
Patch and test case (5.44 KB, patch)
2010-10-06 16:41 PDT, Daniel Bates
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Bates 2010-10-06 16:29:16 PDT
HTMLFrameSetElement::defaultEventHandler() assumes its renderer is a RenderFrameSet object when handling mouse events and thus tries to cast its renderer to RenderFrameSet. This causes an assertion failure when a <frameset> specifies an image in its CSS content property since we associate a generic render object (RenderObject) to the HTMLFrameSetElement instead of the specialized RenderFrameSet object.

For completeness, support for the CSS content property was added to HTMLFrameSetElement in changeset 15299 <http://trac.webkit.org/changeset/15299> (rdar://problem/4610314).
Comment 1 Daniel Bates 2010-10-06 16:37:21 PDT
Created attachment 70007 [details]
Patch and test case

For some reason running the test case in a release build may not cause a crash directly. But, if you click on the not-found image placeholder then it will crash.
Comment 2 Daniel Bates 2010-10-06 16:38:40 PDT
Created attachment 70008 [details]
[Test Case] Standalone

Standalone test case. Included in the patch.
Comment 3 Daniel Bates 2010-10-06 16:41:19 PDT
Created attachment 70009 [details]
Patch and test case

Updated changelogs in patch to reflect updated bug title.
Comment 4 Daniel Bates 2010-10-06 16:53:23 PDT
Committed r69256: <http://trac.webkit.org/changeset/69256>