[webkit-reviews] review denied: [Bug 93812] REGRESSION(r125251): It made svg/custom/use-instanceRoot-as-event-target.xhtml assert and flakey : [Attachment 237244] Patch

[bugzilla-daemon at webkit.org]

Darin Adler <darin at apple.com> has denied Guillaume Emont
<guijemont at igalia.com>'s request for review:
Bug 93812: REGRESSION(r125251): It made
svg/custom/use-instanceRoot-as-event-target.xhtml assert and flakey
https://bugs.webkit.org/show_bug.cgi?id=93812

Attachment 237244: Patch
https://bugs.webkit.org/attachment.cgi?id=237244&action=review

------- Additional Comments from Darin Adler <darin at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=237244&action=review


Geoff, what’s your analysis about what’s happening here?

> Source/WebCore/bindings/js/JSEventListener.h:72
> +	   mutable JSC::Strong<JSC::JSObject> m_wrapper;

I don’t think we can just change this from Weak to Strong; doing that would
lead to cycles and every object with an event listener that captured the object
would leak. We should write a test case that checks this does not happen.

> LayoutTests/ChangeLog:9
> +	   There are cases where the wrapper is not referenced from anywhere
any more at
> +	   the time when the event needs to be fired, which prevents that
firing.

We can’t fix this bug without understanding more about those cases.