<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>302416</bug_id>
          
          <creation_ts>2025-11-12 13:09:34 -0800</creation_ts>
          <short_desc>Inspector agents should use CheckedRef for InspectorEnvironment references</short_desc>
          <delta_ts>2025-12-09 12:58:20 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          <dependson>302559</dependson>
    
    <dependson>303870</dependson>
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Basuke Suzuki">basuke</reporter>
          <assigned_to name="Basuke Suzuki">basuke</assigned_to>
          <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>2158313</commentid>
    <comment_count>0</comment_count>
    <who name="Basuke Suzuki">basuke</who>
    <bug_when>2025-11-12 13:09:34 -0800</bug_when>
    <thetext>Inspector agents hold references to their InspectorEnvironment through the AgentContext structure. Currently, this uses a raw reference which doesn&apos;t provide any lifetime safety guarantees. If an agent outlives its environment (which should never happen but could be a bug), we&apos;d have undefined behavior.

This change makes InspectorEnvironment inherit from CanMakeCheckedPtr and updates AgentContext to hold a CheckedRef&lt;InspectorEnvironment&gt;. This provides runtime checking that the environment is never destroyed while agents still reference it, making bugs more actionable by causing immediate crashes rather than subtle memory corruption.

The change required:
1. Making InspectorEnvironment support CheckedPtr/CheckedRef
2. JSGlobalObjectInspectorController implementing the AbstractCanMakeCheckedPtr interface
3. Updating AgentContext to use CheckedRef instead of a raw reference
4. Including InspectorEnvironment.h instead of forward declaring it (required for CheckedRef)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2158314</commentid>
    <comment_count>1</comment_count>
    <who name="Basuke Suzuki">basuke</who>
    <bug_when>2025-11-12 13:11:12 -0800</bug_when>
    <thetext>rdar://164582768</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2158315</commentid>
    <comment_count>2</comment_count>
    <who name="Basuke Suzuki">basuke</who>
    <bug_when>2025-11-12 13:13:53 -0800</bug_when>
    <thetext>Pull request: https://github.com/WebKit/WebKit/pull/53828</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2158666</commentid>
    <comment_count>3</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2025-11-13 16:47:28 -0800</bug_when>
    <thetext>Committed 303022@main (3db54ba8bc59): &lt;https://commits.webkit.org/303022@main&gt;

Reviewed commits have been landed. Closing PR #53828 and removing active labels.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2158955</commentid>
    <comment_count>4</comment_count>
    <who name="Marta Darbinyan">darbinyan</who>
    <bug_when>2025-11-14 18:35:57 -0800</bug_when>
    <thetext>Reopened Bugzilla.
REGRESSION(303022@main): [macOS Release wk1] webaudio/audiobuffersource-not-gced-until-ended.html is a flaky crash, tracking revert in https://bugs.webkit.org/show_bug.cgi?id=302559.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2159736</commentid>
    <comment_count>5</comment_count>
    <who name="Basuke Suzuki">basuke</who>
    <bug_when>2025-11-18 17:15:09 -0800</bug_when>
    <thetext>&lt;rdar://problem/165006365&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2159737</commentid>
    <comment_count>6</comment_count>
    <who name="Basuke Suzuki">basuke</who>
    <bug_when>2025-11-18 17:15:23 -0800</bug_when>
    <thetext>Pull request: https://github.com/WebKit/WebKit/pull/54147</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2163734</commentid>
    <comment_count>7</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2025-12-05 14:02:01 -0800</bug_when>
    <thetext>Committed 304015@main (0f0653d9eddc): &lt;https://commits.webkit.org/304015@main&gt;

Reviewed commits have been landed. Closing PR #54147 and removing active labels.</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>