Bug 312491

Summary: Event's target can get its JS wrapper GC'ed
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: New BugsAssignee: Ryosuke Niwa <rniwa>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Ryosuke Niwa
Reported 2026-04-16 10:49:58 PDT
JSEvent doesn't add the opaque root of the target during marking phase, resulting in its JS wrapper to get collected while Event is still reachable.
Attachments
Ryosuke Niwa
Comment 1 2026-04-16 11:01:05 PDT
Radar WebKit Bug Importer
Comment 2 2026-04-23 10:50:13 PDT
EWS
Comment 3 2026-04-25 06:42:13 PDT
Committed 312017@main (05f145f9a116): <https://commits.webkit.org/312017@main> Reviewed commits have been landed. Closing PR #62908 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.