[Webkit-unassigned] [Bug 160434] ASSERTION FAILURE: !stayWithin || child->tree().isDescendantOf(stayWithin) in FrameTree::traverseNext()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=160434

--- Comment #2 from Daniel Bates <dbates at webkit.org> ---
(In reply to comment #0)
> Using a debug build of WebKit perform the following:
> 
> 1. Open Simulator.app and simulate an iPad device (say, iPad Air 2).
> 2. Visit data:text/html,<iframe height='500' width='500' srcdoc='<video
> src="http://www.quirksmode.org/html5/videos/big_buck_bunny.mp4"
> controls>'></iframe>

2.5. Tap the picture-in-picture button on the video.

> 3. Press the reload button.
> 
> Then the WebContent process crashes because the ASSERT(!stayWithin ||
> child->tree().isDescendantOf(stayWithin)) fails in FrameTree::traverseNext().

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160802/87309922/attachment.html>