Wrapper-tracing does not trace on-stack objects, so if the on-stack objects are not referenced from any other object, they will be (unintentionally) collected.

Here is an example pseudo code.

  class CallbackFunction : GarbageCollected<CallbackFunction> {
    // TraceWrapperV8Reference is a weak v8::Persistent.
    TraceWrapperV8Reference<v8::Function> v8_function_;
  };

  class DOMObject : GarbageCollected<DOMObject> {
    using id_type_d = int;
    HeapHashMap<id_type_t,
                TraceWrapperMember<CallbackFunction>> callback_function_set_;
  };

  DOMObject::InvokeCallback(id_type_t id) {
    // |Take| removes the callback function from the set, and returns it.
    auto callback = callback_function_set_.Take(id);

    // At this moment, |callback| is NOT a member of |callback_function_set_|.
    // Hence, |callback| is not a target of wrapper-tracing.  No one prevents
    // |callback->v8_function_| from being collected by V8 GC.

    callback.Invoke(args...);  // |v8_function_| might be already gone...  crash!
  }

Actual cases (crashes) are found at: Issue 792604

As of today, this issue is expected to be fixed with the coming unified GC and we don't have a plan to support wrapper-tracing for on-stack objects so far.  This issue was filed mostly just for a record.