Very rarely, the AVCFURLAssetRef associated with a media element can change from its original state. When this happens, we adopt the new AVCFURLAssetRef without incrementing its retain count. Later, when the AVFWrapper is destroyed it calls Release on this item causing a double-release.
Created attachment 237568 [details]
Committed r173216: <http://trac.webkit.org/changeset/173216>