WebAudio: AudioContext::uninitialize() can caused AudioContext deletion before deleting marked nodes.
If the AudioContext's destination nodes hold the only references existing to the AudioContext, then calling m_destinationNode.clear() will cause the context's refCount to drop to 0, and the context will be deleted before exiting uninitialize(). This will potentially skip a lot of clean up and will cause an assertion in ~AudioContext().
Created attachment 115867 [details] Patch
Comment on attachment 115867 [details] Patch Is it possible to create a layout test for this?
(In reply to comment #3) > (From update of attachment 115867 [details]) > Is it possible to create a layout test for this? Probably not.
Comment on attachment 115867 [details] Patch Clearing flags on attachment: 115867 Committed r101265: <http://trac.webkit.org/changeset/101265>
All reviewed patches have been landed. Closing bug.