`WebEvent` and subclasses converted to ref-counted heap objects

Component: WebKit input events | 70826d7

WebEvent and its subclasses model every mouse, keyboard, touch, wheel and gesture event WebKit ferries from the platform and UIProcess across IPC into WebProcess for dispatch to the DOM. CheckedPtr / CanMakeCheckedPtr is WebKit's lightweight lifetime-checking pointer: it asserts that a normal operator delete ran before the object is truly destroyed, catching dangling-pointer misuse.

This commit converts WebEvent and every concrete subclass from stack-allocatable, movable value types into always-heap-allocated, ref-counted objects created through static create() factories returning Ref<> / RefPtr<>. Event-specific fields move out into plain WebEventData / WebXEventData structs so the IPC wire format stays byte-identical, and every concrete class gets its own WTF_MAKE_TZONE_ALLOCATED. The hierarchy uses ThreadSafeRefCounted rather than plain RefCounted because EventDispatcher handles wheel and touch events on the IPC background queue before hopping to the main thread.

Significance

WebEvent had opted into CanMakeThreadSafeCheckedPtr with a delete-check exception because it was routinely stack-allocated, so the lifetime assertion could never fire on one of the highest-frequency cross-process data paths in the browser. This closes that gap. The counterweight is scope: dozens of files across every platform's event creation, coalescing and dispatch code, which is itself a large surface for newly introduced lifetime or copy-semantics bugs.

Audit directions

The forward-facing pattern is a class opting into a lifetime-checking mechanism while carving out an exception that makes the check vacuous. Grep for other CanMakeCheckedPtr / CanMakeThreadSafeCheckedPtr users that pair the opt-in with a delete-check exception — each one is advertising protection it does not have, and the code-review tell is the exception macro sitting adjacent to the opt-in on the same class. Separately, the conversion itself changes copy semantics across every platform's event path; the coalescing code, which previously operated on value types it could freely copy and mutate, is the natural place for aliasing bugs to land.

---