<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>270610</bug_id>
          
          <creation_ts>2024-03-06 17:25:06 -0800</creation_ts>
          <short_desc>[IPCTestingAPI] JSGlobalObject may be destroyed when sending IPC messages during page teardown</short_desc>
          <delta_ts>2024-03-07 09:00:30 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Tools / Tests</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Charlie Wolfe">charliew</reporter>
          <assigned_to name="Charlie Wolfe">charliew</assigned_to>
          <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>2019237</commentid>
    <comment_count>0</comment_count>
    <who name="Charlie Wolfe">charliew</who>
    <bug_when>2024-03-06 17:25:06 -0800</bug_when>
    <thetext>Some objects send IPC messages in their destructor. So, when the page is being torn down, it is possible that the JSGlobalObject associated with the JSContextRef we are storing has already been destroyed. To fix this, we should instead hold a weak reference to the global object and early return when it has been destroyed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2019238</commentid>
    <comment_count>1</comment_count>
    <who name="Charlie Wolfe">charliew</who>
    <bug_when>2024-03-06 17:25:54 -0800</bug_when>
    <thetext>rdar://114871193</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2019239</commentid>
    <comment_count>2</comment_count>
    <who name="Charlie Wolfe">charliew</who>
    <bug_when>2024-03-06 17:28:41 -0800</bug_when>
    <thetext>Pull request: https://github.com/WebKit/WebKit/pull/25560</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2019353</commentid>
    <comment_count>3</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2024-03-07 09:00:28 -0800</bug_when>
    <thetext>Committed 275792@main (de54ecba6b59): &lt;https://commits.webkit.org/275792@main&gt;

Reviewed commits have been landed. Closing PR #25560 and removing active labels.</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>