[Webkit-unassigned] [Bug 160434] New: ASSERTION FAILURE: !stayWithin || child->tree().isDescendantOf(stayWithin) in FrameTree::traverseNext()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=160434

            Bug ID: 160434
           Summary: ASSERTION FAILURE: !stayWithin ||
                    child->tree().isDescendantOf(stayWithin) in
                    FrameTree::traverseNext()
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Local Build
          Hardware: iOS
                OS: iOS 9.3
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Media Elements
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: dbates at webkit.org
                CC: eric.carlson at apple.com, jeremyj-wk at apple.com

Using a debug build of WebKit perform the following:

1. Open Simulator.app and simulate an iPad device (say, iPad Air 2).
2. Visit data:text/html,<iframe height='500' width='500' srcdoc='<video src="http://www.quirksmode.org/html5/videos/big_buck_bunny.mp4" controls>'></iframe>
3. Press the reload button.

Then the WebContent process crashes because the ASSERT(!stayWithin || child->tree().isDescendantOf(stayWithin)) fails in FrameTree::traverseNext().

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160802/e2b72c14/attachment.html>