312296 2026-04-14 12:00:55 -0700 WebKitTestRunner leaks WKTypeRef out-parameter value from WKBundlePagePostSynchronousMessageForTesting() 2026-04-15 21:39:18 -0700 1 1 1 Unclassified WebKit Tools / Tests WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ddkilzer ddkilzer webkit-bug-importer oldest_to_newest 2200295 0 ddkilzer 2026-04-14 12:00:55 -0700 Several functions in `InjectedBundle.cpp` leak the retained `WKTypeRef` returned via the out-parameter of `WKBundlePagePostSynchronousMessageForTesting()`. The out-parameter returns a +1 retained object (via `toAPILeakingRef()`), but these callers never adopt or release it. Two patterns are affected: 1. `shouldForceRepaint()` and `isPrinting()` pass the raw `WKTypeRef` to `booleanValue()` without ever releasing it, leaking an `API::Boolean` object (visible as `WKNSNumber` in leak reports). 2. `getBackgroundFetchIdentifier()`, `lastAddedBackgroundFetchIdentifier()`, `lastRemovedBackgroundFetchIdentifier()`, `lastUpdatedBackgroundFetchIdentifier()`, and `backgroundFetchState()` return `static_cast<WKStringRef>(result)` into a `WKRetainPtr<WKStringRef>`. The `WKRetainPtr` constructor retains the pointer again without adopting the existing +1, so the original ownership is never balanced. Other callers in the same file (`shouldProcessWorkQueue()`, `isGeolocationClientActive()`, `imageCountInGeneralPasteboard()`, `userMediaPermissionRequestCount()`) already use `adoptWK(result).get()` correctly. 2200303 1 webkit-bug-importer 2026-04-14 12:09:29 -0700 <rdar://problem/174764247> 2200306 2 ddkilzer 2026-04-14 12:12:17 -0700 Pull request: https://github.com/WebKit/WebKit/pull/62757 2200946 3 ews-feeder 2026-04-15 21:39:16 -0700 Committed 311347@main (112967a3c973): <https://commits.webkit.org/311347@main> Reviewed commits have been landed. Closing PR #62757 and removing active labels.