The request created in NavigatorMediaStream::webkitGetUserMedia() is freed too early. I wonder if we should make it a unique_ptr.
Eric and Thiago, have you seen this issue as well? The life cycle of the request is not very clear to me.
Turns out this can be fixed by storing the requests correctly as RefPtrs (not raw pointers) in the UserMediaRequestManager (implemented in bug 123158). Thanks Eric for the help and advice :)