There are two problems.
1. If playing the audio element and navigating another page, the audio element is not removed.
2. GC sweeps the audio element at any time, not during playing.
Created attachment 100764 [details]
The audio element's life time should synchronize with document's life time.
V8 has following problem.
1. V8 GC removes an audio element at any time.
The condition causes 2 bugs.
1. LEAK : If playing the audio element and navigating another page,
audio.paused() returns "false".
2. GC sweeps the audio element at any time, not during playing. It makes web
developers confused because they can not play audio after GC.
Created attachment 100784 [details]
I'm worry that it is possible that I use GCController.getJSObjectCount for the leak test.
Most of the tests using GCController.getJSObjectCount were disabled because the buildbot failed the tests.
Comment on attachment 100784 [details]
View in context: https://bugs.webkit.org/attachment.cgi?id=100784&action=review
> + 1. LEAK : If playing the audio element and navigating another page,
> + audio.paused() returns "false".
This sounds like a bad bug if having a playing audio at the time of navigation causes a world leak. However, what if the document goes to back/forward cache, and is restored later? Should we continue playing the audio when that happens?
> + 2. GC sweeps the audio element at any time, not during playing. It makes web
> + developers confused because they can not play audio after GC.
> + Document* doc = node->document();
An audio element always has a non-null document. Only DocumentType nodes may have a null document(), as explained in a comment in Node.h.
While looking at this patch, I noticed some broken code in HTMLMediaElement::mediaPlayerOwningDocument(). ownerDocument() can never return non-null if document() returned null(). This method seems useless, and should be simply removed. It's also virtual, but no subclass ever overrides it.
> + Page* pg = 0;
> + if (doc)
> + pg = doc->page();
> + bool inCurrentPage = doc && pg;
As mentioned above, this doesn't look like a correct check. Also, we try to not have abbreviations like pg or even doc in new code.
I'm not sure what a correct check would be. You can have a look at HTMLMediaElement::isPlaying() and HTMLMediaElement::inActiveDocument(). The latter is confusing - it uses a data member in HTMLMediaElement, but you can always easily figure out if an element is in active document without that. Perhaps it doesn't do what it says, and perhaps it actually does what you need here.
The first thing to do would be to figure out whether audio should continue playing when a page returns from b/f cache.
(In reply to comment #0)
> There are two problems.
> 1. If playing the audio element and navigating another page, the audio element is not removed.
> 2. GC sweeps the audio element at any time, not during playing.
Not collecting an un-paused media element that is not in the Document is correct according to the spec:
Media elements that are potentially playing while not in a Document must not play
any video, but should play any audio component. Media elements must not stop
playing just because all references to them have been removed; only once a media
element is in a state where no further audio could ever be played by that element
may the element be garbage collected. 
I see that the current code is wrong in that it only considers <audio> elements, I wrote bug 64617 for this.