The implementation of webkitTextCombinerReleasePad() was wrong in that it was checking the peer pad of webkittextcombinerpad to check if it belonged a webvttenc element and remove it... But since this is a ghostpad, the peer is upstream, not downstream. When the release pad function is called, upstream is already disconnected, so the branch was never hit. To actually remove the webvttenc element we must check the target pad instead of the peer pad, which corresponds to the element downstream. Also, we need to set the element state to NULL before removing it, which the previous code didn't.
Created attachment 391735 [details] Patch
Comment on attachment 391735 [details] Patch Clearing flags on attachment: 391735 Committed r257468: <https://trac.webkit.org/changeset/257468>
All reviewed patches have been landed. Closing bug.