Improve MediaStreamTrack's hasPendingActivity predicate.

third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  * Copyright (C) 2011 Ericsson AB. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 194 matching lines @@
     m_isIteratingRegisteredMediaStreams = false;
 }
 
 void MediaStreamTrack::stop()
 {
     m_stopped = true;
 }
 
 bool MediaStreamTrack::hasPendingActivity() const
 {
-    return !m_stopped && hasEventListeners();
+    // If 'ended' listeners exist and the object hasn't yet reached
+    // that state, keep the object alive.
+    //
+    // An otherwise unreachable MediaStreamTrack object in an non-ended
+    // state will otherwise indirectly be transitioned to the 'ended' state
+    // while finalizing m_component. Which dispatches an 'ended' event,
+    // referring to this object as the target. If this object is then GCed
+    // at the same time, v8 objects will retain (wrapper) references to
+    // this dead MediaStreamTrack object. Bad.
+    //
+    // Hence insisting on keeping this object alive until the 'ended'
+    // state has been reached & handled.
+    return !ended() && hasEventListeners(EventTypeNames::ended);
 }
 
 PassOwnPtr<AudioSourceProvider> MediaStreamTrack::createWebAudioSource()
 {
     return MediaStreamCenter::instance().createWebAudioSourceFromMediaStreamTrack(component());
 }
 
 void MediaStreamTrack::registerMediaStream(MediaStream* mediaStream)
 {
     RELEASE_ASSERT(!m_isIteratingRegisteredMediaStreams);
@@ skipping 21 matching lines @@
 
 DEFINE_TRACE(MediaStreamTrack)
 {
     visitor->trace(m_registeredMediaStreams);
     visitor->trace(m_component);
     RefCountedGarbageCollectedEventTargetWithInlineData<MediaStreamTrack>::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink