<html>
<head>
<title>WebKit Bug 47314</title>
<script>
function runTest()
{
    if (window.testRunner)
        testRunner.dumpAsText();

    var frameset = document.getElementById("frameset");
    var mouseClick = document.createEvent("MouseEvent");
    mouseClick.initEvent("click", true, true);
    frameset.dispatchEvent(mouseClick);

    if (!window.testRunner) {
        // For some reason, when running this test by hand in release builds you must manually
        // click on the not-found image placeholder to cause a crash. Hence, we don't replace
        // the <frameset> and print a PASS message.
        return;
    }

    // As per the definition of the body element in section 3.1.4 the HTML 5 spec.
    // <http://www.w3.org/TR/html5/dom.html#the-body-element>, a document can either
    // have a <frameset> or a <body>, but not both, and a frameset does not provide
    // a means to print a PASS message. Therefore, we replace <frameset> with <body>.
    var htmlElement = document.getElementsByTagName("html")[0];
    htmlElement.replaceChild(document.createElement("body"), frameset);
    document.body.appendChild(document.createTextNode("PASS, mouse event to <frameset> did not cause crash."));
}

window.onload = runTest;
</script>
</head>
<!-- This tests that we don't crash when clicking on a <frameset> that specifies the CSS content property. -->
<!-- This test PASSED if you see the word "PASS" on the page. Otherwise, it FAILED. -->
<!-- Note: If you are running this test by hand in a release build then try clicking on the not-found image placeholder to cause a crash. -->
<frameset id="frameset" style="content:url(click-to-crash.jpg)"></frameset>
</html>