Bug 66805 – MediaElementAudioSourceNode lives longer than necessary

• Component: Media
• Status: NEW

[Chris Rogers]

On Tue, Aug 23, 2011 at 12:49 PM, Chris Evans <[e-mail]> wrote:
Here's my immediate puzzle:

<script>
a = document.createElement("audio");
delete a;
window.gc();
</script>


<script>
a = document.createElement("audio");
c = new webkitAudioContext();
m = c.createMediaElementSource(a);
delete a;
delete c;
delete m;
window.gc();
</script>

Can you help me work out why the first script destroys the HTMLAudioElement but the second does not? (You can put a printf in the constructor and destructor if you like)
Something must be referencing that DOM node but I can't work out what the code is doing to cause that.


.....................


Hi Chris,

Yes, basically the problem ultimately is coming about because an AudioContext is an ActiveDOMObject and lives as long as the document exists (it will be available for garbage collection only after its stop() method is called).  Also, in the nascent MediaElementAudioSourceNode implementation, the context is calling ref() on MediaElementAudioSourceNode even before it's connected.  It should only ref() the node when it's actually connected, then deref() when it's disconnected.

[Abhishek Arya]

tracking security chromium bug - http://code.google.com/p/chromium/issues/detail?id=94186

[Chris Rogers]

This bug is confusing two different problems.  The original security issue was fixed here:
http://trac.webkit.org/changeset/94608

The second issue is not nearly as serious which is that the MediaElementAudioSourceNode *could* be deleted through garbage collection sooner than it actually is (since the context keeps it around longer than necessary).  It's not a leak - just stays around longer than necessary

[Radar WebKit Bug Importer]

<rdar://problem/12147106>