Skip to content

fix(browser-utils): Remove DOM instrumentation click listeners with stable capture flag - #24725

Closed
macuzi wants to merge 2 commits into
developfrom
cursor/dom-click-listener-leak-565e
Closed

macuzi wants to merge 2 commits into
developfrom
cursor/dom-click-listener-leak-565e

Conversation

@macuzi

@macuzi macuzi commented Sep 25, 2026

Copy link
Copy Markdown

instrumentDOM registered its per-target handler with whatever addEventListener options the first caller used, but removed it with the options from whichever removeEventListener drove the refcount to zero. Radix DismissableLayer can decrement the refcount via bubble-phase no-op removals while the handler was added in capture phase, so the real listener was never removed and leaked on every dialog cycle.

Store the capture flag when attaching and always use it when detaching.

Fixes #24702

Open in Web Open in Cursor 

@github-actions

github-actions Bot commented Sep 25, 2026 •

Copy link
Copy Markdown
Contributor

size-limit report 📦

Path Size % Change Change
@sentry/browser 29.26 kB +0.07% +19 B 🔺
@sentry/browser - with treeshaking flags 27.52 kB +0.08% +20 B 🔺
@sentry/browser - with treeshaking flags tracing without tracing 27.42 kB +0.08% +21 B 🔺
@sentry/browser (incl. Tracing) 51.17 kB +0.04% +16 B 🔺
@sentry/browser (incl. Tracing + Span Streaming) 51.19 kB +0.04% +16 B 🔺
@sentry/browser (incl. Tracing, Profiling) 54.19 kB +0.04% +18 B 🔺
@sentry/browser (incl. Tracing, Replay) 90.78 kB +0.03% +23 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 79.88 kB +0.03% +16 B 🔺
@sentry/browser (incl. Tracing, Replay with Canvas) 95.48 kB +0.03% +21 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback) 108.44 kB +0.03% +25 B 🔺
@sentry/browser (incl. Feedback) 46.78 kB +0.04% +18 B 🔺
@sentry/browser (incl. sendFeedback) 34.32 kB +0.06% +20 B 🔺
@sentry/browser (incl. FeedbackAsync) 39.43 kB +0.05% +17 B 🔺
@sentry/browser (incl. Metrics) 30.27 kB +0.07% +19 B 🔺
@sentry/browser (incl. Logs) 30.53 kB +0.07% +20 B 🔺
@sentry/browser (incl. Metrics & Logs) 31.2 kB +0.07% +21 B 🔺
@sentry/react 31.02 kB +0.08% +22 B 🔺
@sentry/react (incl. Tracing) 53.47 kB +0.04% +21 B 🔺
@sentry/vue 36.75 kB +0.04% +13 B 🔺
@sentry/vue (incl. Tracing) 53.72 kB +0.04% +17 B 🔺
@sentry/svelte 29.28 kB +0.07% +19 B 🔺
CDN Bundle 30.96 kB +0.08% +24 B 🔺
CDN Bundle (incl. Tracing) 51.71 kB +0.05% +22 B 🔺
CDN Bundle (incl. Logs, Metrics) 33.22 kB +0.06% +19 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) 53.69 kB +0.06% +30 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics) 73.94 kB +0.03% +19 B 🔺
CDN Bundle (incl. Tracing, Replay) 89.3 kB +0.03% +22 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 91.27 kB +0.03% +21 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) 95.48 kB +0.04% +32 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 97.45 kB +0.04% +34 B 🔺
CDN Bundle - uncompressed 91.47 kB +0.07% +61 B 🔺
CDN Bundle (incl. Tracing) - uncompressed 153.83 kB +0.04% +61 B 🔺
CDN Bundle (incl. Logs, Metrics) - uncompressed 98.03 kB +0.07% +61 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 159.79 kB +0.04% +61 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 227.61 kB +0.03% +61 B 🔺
CDN Bundle (incl. Tracing, Replay) - uncompressed 273.56 kB +0.03% +61 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 279.5 kB +0.03% +61 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 287.26 kB +0.03% +61 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 293.19 kB +0.03% +61 B 🔺
@sentry/nextjs (client) 55.79 kB +0.04% +20 B 🔺
@sentry/sveltekit (client) 51.62 kB +0.06% +26 B 🔺
@sentry/core/server 39.95 kB - -
@sentry/core/browser 13.63 kB - -
@sentry/node 133.9 kB +0.01% +5 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection) 82.43 kB - -
@sentry/node - without tracing 90.46 kB +0.02% +15 B 🔺
@sentry/node - without channel injection 112.41 kB +0.01% +11 B 🔺
@sentry/aws-serverless 98.72 kB +0.01% +4 B 🔺
@sentry/cloudflare (withSentry) - minified 206.49 kB - -
@sentry/cloudflare (withSentry) 513.73 kB - -

View base workflow run

cursoragent and others added 2 commits September 25, 2026 10:12
…table capture flag

Fixes #24702

Co-Authored-By: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: lamberto <macuzi@users.noreply.github.com>
@Lms24

Lms24 commented Sep 25, 2026

Copy link
Copy Markdown
Member

this went into the right direction but needed some further fixes to account for ref count differentiates. I'd like to get this reviewed, so I opened #24727. Thanks though!

@Lms24 Lms24 closed this Sep 25, 2026
Lms24 added a commit that referenced this pull request Sep 30, 2026
…matched removals (#24727)

This PR fixes two (related) problems in our `instrumentDOM` event
listener instrumentation:

TIL about event listener
[capture](https://developer.mozilla.org/en-US/docs/Web/API/EventTarget/addEventListener#usecapture)
modes.

1. We didn't differentiate between `addEventListener(fn, {capture:
true})` and `addEventListener(fn, {capture: false})` calls, causing
leakage of our event listeners when event listeners were removed with
different options.

=> Fixed by checking the `capture` option, registering our own listeners
in the same capture config and keeping the capture option on the meta
object of the event target so that we can then remove it in the correct
capture config

2. More generally fixes an issue with `refCount` where e.g. calling
`removeEventListener` with a callback that was never added via
`addEventListener`: Browsers just ignore this call but our refCount was
decremented anyway.

=> Fixed by replacing the general ref count with two sets of callbacks
(for both capture modes) and only removing our listener if all user-set
listeners were removed

Fixes #24702

supersedes #24725
supersedes #24723
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

instrumentDOM leaks a document click handler when the refcount hits zero on a removal with different capture options (e.g. Radix DismissableLayer)

3 participants