According to eric.carlson:
Every non-DOM object that is an EventTarget needs code (for JSC at lease, I don't know about V8) to make sure that the wrapper isn't collected during event dispatch or while the parent/owner object is reachable. For example, see JSTextTrackListOwner::isReachableFromOpaqueRoots and the tracklist-is-reachable.html test added in https://bugs.webkit.org/show_bug.cgi?id=71123.
*** Bug 72149 has been marked as a duplicate of this bug. ***
Wrote up 73865 for the V8 changes.
Created attachment 117966 [details]
Attachment 117966 [details] did not pass style-queue:
Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/medi..." exit_code: 1
LayoutTests/ChangeLog:8: Need whitespace between colon and description [changelog/filechangedescriptionwhitespace] 
LayoutTests/ChangeLog:10: Need whitespace between colon and description [changelog/filechangedescriptionwhitespace] 
Total errors found: 2 in 19 files
If any of these errors are false positives, please file a bug against check-webkit-style.
Created attachment 117985 [details]
Fix the malformed ChangeLog.
Comment on attachment 117985 [details]
View in context: https://bugs.webkit.org/attachment.cgi?id=117985&action=review
> + return visitor.containsOpaqueRoot(root(textTrackCue->track()->mediaElement()));
Slightly nicer to call "root(textTrackCue->track())", and put root(TextTrack*) inline in a header. That way, if a text track ever changes its mind about what its root is, we only have to update one function.
> + return visitor.containsOpaqueRoot(root(textTrack->mediaElement()));
This would be "root(textTrack)", if you followed my advice above.
> + scheduleAddTrackEvent(track);
Can this be "track.release()"?
> +void TextTrackList::remove(PassRefPtr<TextTrack> prpTrack)
Seems like prpTrack should just be a raw pointer, since we don't take ownership.
Mac rebaseline done in http://trac.webkit.org/changeset/103642.