[Webkit-unassigned] [Bug 190235] New: IntersectionObserver doesn't keep target's JS wrapper alive

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=190235

            Bug ID: 190235
           Summary: IntersectionObserver doesn't keep target's JS wrapper
                    alive
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: rniwa at webkit.org
                CC: bfulgham at webkit.org, simon.fraser at apple.com,
                    zalan at apple.com

When an element is enqueued as an IntersectionObserverEntry and subsequently removed from the document,
there is no way for JSC GC to know the JS wrapper of the element needs to be kept alive.

As such, the JS wrapper of an element can be erroneously collected.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20181003/f357e02f/attachment.html>