The assertion added to Document::removePlaybackTargetPickerClient in r183096 is too aggressive, it it not an error for it to be called more than once.
<rdar://problem/20661179>
Created attachment 251431 [details] Proposed patch.
Comment on attachment 251431 [details] Proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=251431&action=review > Source/WebCore/dom/Document.cpp:6553 > + const auto& it = m_clientToIDMap.find(&client); Best type to use here is probably auto rather than const auto&. Same thing below. > Source/WebCore/dom/Document.cpp:6559 > m_clientToIDMap.remove(&client); This should be remove(it), not remove(&client); passing &client results in a second hash table lookup.
Committed r183187 and r183187 - https://trac.webkit.org/r183185, https://trac.webkit.org/r183187
By which I meant r183185 and r183187 of course.
Reopened, test still occasionally crash.
Created attachment 251974 [details] Another patch.
Comment on attachment 251974 [details] Another patch. r=me
Comment on attachment 251974 [details] Another patch. Clearing flags on attachment: 251974 Committed r183578: <http://trac.webkit.org/changeset/183578>
All reviewed patches have been landed. Closing bug.