diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 0174c3b..2d2e227 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,23 @@
+2020-03-28  Simon Fraser  <simon.fraser@apple.com>
+
+        ScrollLatchingState should use WeakPtr<Element>
+        https://bugs.webkit.org/show_bug.cgi?id=209714
+
+        Reviewed by Darin Adler.
+
+        ScrollLatchingState shouldn't affect element lifetimes. Change it to use WeakPtr instead
+        of RefPtr<>.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::defaultWheelEventHandler):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::platformPrepareForWheelEvents):
+        * page/scrolling/ScrollLatchingState.cpp:
+        (WebCore::ScrollLatchingState::setWheelEventElement):
+        (WebCore::ScrollLatchingState::setPreviousWheelScrolledElement):
+        (WebCore::ScrollLatchingState::setScrollableContainer):
+        * page/scrolling/ScrollLatchingState.h:
+
 2020-03-30  Megan Gardner  <megan_gardner@apple.com>
 
         Update to new Data Detectors SPI
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 4ef67d2..6048f82 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -2917,16 +2917,15 @@
         filteredPlatformDelta.setHeight(platformWheelEvent->deltaY());
     }
 
+    RefPtr<Element> stopElement;
 #if ENABLE(WHEEL_EVENT_LATCHING)
     ScrollLatchingState* latchedState = m_frame.page() ? m_frame.page()->latchingState() : nullptr;
-    RefPtr<Element> stopElement = latchedState ? latchedState->previousWheelScrolledElement() : nullptr;
+    stopElement = latchedState ? latchedState->previousWheelScrolledElement() : nullptr;
 
     if (m_frame.page() && m_frame.page()->wheelEventDeltaFilter()->isFilteringDeltas()) {
         filteredPlatformDelta = m_frame.page()->wheelEventDeltaFilter()->filteredDelta();
         filteredVelocity = m_frame.page()->wheelEventDeltaFilter()->filteredVelocity();
     }
-#else
-    RefPtr<Element> stopElement;
 #endif
 
     if (handleWheelEventInAppropriateEnclosingBox(startNode, wheelEvent, stopElement, filteredPlatformDelta, filteredVelocity))
@@ -2934,7 +2933,7 @@
 
 #if ENABLE(WHEEL_EVENT_LATCHING)
     if (latchedState && !latchedState->wheelEventElement())
-        latchedState->setPreviousWheelScrolledElement(WTFMove(stopElement));
+        latchedState->setPreviousWheelScrolledElement(stopElement.get());
 #endif
 }
 
diff --git a/Source/WebCore/page/mac/EventHandlerMac.mm b/Source/WebCore/page/mac/EventHandlerMac.mm
index 9ec9105..c171c63 100644
--- a/Source/WebCore/page/mac/EventHandlerMac.mm
+++ b/Source/WebCore/page/mac/EventHandlerMac.mm
@@ -984,7 +984,7 @@
                 latchingState.setStartedGestureAtScrollLimit(false);
                 latchingState.setWheelEventElement(wheelEventTarget.get());
                 latchingState.setFrame(&m_frame);
-                latchingState.setScrollableContainer(scrollableContainer.copyRef());
+                latchingState.setScrollableContainer(scrollableContainer.get());
                 latchingState.setWidgetIsLatched(result.isOverWidget());
                 page->pushNewLatchingState(WTFMove(latchingState));
 
diff --git a/Source/WebCore/page/scrolling/ScrollLatchingState.cpp b/Source/WebCore/page/scrolling/ScrollLatchingState.cpp
index 0c1a245..1c8cb56 100644
--- a/Source/WebCore/page/scrolling/ScrollLatchingState.cpp
+++ b/Source/WebCore/page/scrolling/ScrollLatchingState.cpp
@@ -44,9 +44,9 @@
     m_previousWheelScrolledElement = nullptr;
 }
 
-void ScrollLatchingState::setWheelEventElement(RefPtr<Element>&& element)
+void ScrollLatchingState::setWheelEventElement(Element* element)
 {
-    m_wheelEventElement = WTFMove(element);
+    m_wheelEventElement = makeWeakPtr(element);
 }
 
 void ScrollLatchingState::setWidgetIsLatched(bool isOverWidget)
@@ -54,14 +54,14 @@
     m_widgetIsLatched = isOverWidget;
 }
 
-void ScrollLatchingState::setPreviousWheelScrolledElement(RefPtr<Element>&& element)
+void ScrollLatchingState::setPreviousWheelScrolledElement(Element* element)
 {
-    m_previousWheelScrolledElement = WTFMove(element);
+    m_previousWheelScrolledElement = makeWeakPtr(element);
 }
 
-void ScrollLatchingState::setScrollableContainer(RefPtr<ContainerNode>&& container)
+void ScrollLatchingState::setScrollableContainer(ContainerNode* container)
 {
-    m_scrollableContainer = WTFMove(container);
+    m_scrollableContainer = makeWeakPtr(container);
 }
 
 TextStream& operator<<(TextStream& ts, const ScrollLatchingState& state)
diff --git a/Source/WebCore/page/scrolling/ScrollLatchingState.h b/Source/WebCore/page/scrolling/ScrollLatchingState.h
index f69c84e..f94c3cb 100644
--- a/Source/WebCore/page/scrolling/ScrollLatchingState.h
+++ b/Source/WebCore/page/scrolling/ScrollLatchingState.h
@@ -25,7 +25,7 @@
 
 #pragma once
 
-#include <wtf/RefPtr.h>
+#include <wtf/WeakPtr.h>
 
 namespace WTF {
 class TextStream;
@@ -45,7 +45,8 @@
     void clear();
 
     Element* wheelEventElement() const { return m_wheelEventElement.get(); }
-    void setWheelEventElement(RefPtr<Element>&&);
+    void setWheelEventElement(Element*);
+
     Frame* frame() const { return m_frame; }
     void setFrame(Frame* frame) { m_frame = frame; }
 
@@ -53,17 +54,18 @@
     void setWidgetIsLatched(bool isOverWidget);
 
     Element* previousWheelScrolledElement() const { return m_previousWheelScrolledElement.get(); }
-    void setPreviousWheelScrolledElement(RefPtr<Element>&&);
+    void setPreviousWheelScrolledElement(Element*);
     
     ContainerNode* scrollableContainer() const { return m_scrollableContainer.get(); }
-    void setScrollableContainer(RefPtr<ContainerNode>&&);
+    void setScrollableContainer(ContainerNode*);
+
     bool startedGestureAtScrollLimit() const { return m_startedGestureAtScrollLimit; }
     void setStartedGestureAtScrollLimit(bool startedAtLimit) { m_startedGestureAtScrollLimit = startedAtLimit; }
 
 private:
-    RefPtr<Element> m_wheelEventElement;
-    RefPtr<Element> m_previousWheelScrolledElement;
-    RefPtr<ContainerNode> m_scrollableContainer;
+    WeakPtr<Element> m_wheelEventElement;
+    WeakPtr<Element> m_previousWheelScrolledElement;
+    WeakPtr<ContainerNode> m_scrollableContainer;
 
     Frame* m_frame { nullptr };