LibWeb: Ensure EventHandler visits its mouse selection target

We hold a raw pointer to the mouse selection target, which is a mixin-
style class inherited only by JS::Cell classes. By not visiting this
object, we sometime had a dangling reference to it after it had been
garbage collected.
This commit is contained in:
Timothy Flynn 2025-02-26 20:40:10 -05:00 committed by Sam Atkins
commit d5be18617e
Notes: github-actions[bot] 2025-02-27 09:54:17 +00:00
7 changed files with 56 additions and 2 deletions

View file

@ -0,0 +1,37 @@
<!DOCTYPE html>
<iframe id="iframe"></iframe>
<script src="../include.js"></script>
<script>
const runTest = () => {
return new Promise(resolve => {
let iframe = document.getElementById("iframe");
iframe.onload = () => {
internals.movePointerTo(20, 40);
internals.mouseDown(20, 40);
internals.movePointerTo(60, 40);
iframe.onload = () => {
setTimeout(() => {
internals.movePointerTo(20, 40);
resolve();
});
};
iframe.src = "data:text/html,<p contenteditable>Text 2</p>";
};
iframe.src = "data:text/html,<p contenteditable>Text 1</p>";
});
};
asyncTest(async done => {
for (let i = 0; i < 10; ++i) {
await runTest();
internals.gc();
}
println("PASS (didn't crash)");
done();
});
</script>