313389 2026-04-26 22:58:25 -0700 WorkerMessagingProxy objects leak after calling worker.terminate() from JavaScript 2026-04-28 19:52:16 -0700 1 1 1 Unclassified WebKit DOM WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 22723 1 ddkilzer ddkilzer webkit-bug-importer oldest_to_newest 2204759 0 ddkilzer 2026-04-26 22:58:25 -0700 `WorkerMessagingProxy` objects leak after calling `worker.terminate()` from JavaScript. The proxy ref-counting has a two-phase cleanup: `terminateWorkerGlobalScope()` shuts down the worker thread (phase 1), then `workerObjectDestroyed()` releases the initial ref when the `Worker` DOM object is destroyed (phase 2). The bug is that phase 1 clears `m_scriptExecutionContextIdentifier`, which phase 2 needs to post its cleanup task. Specifically, `workerGlobalScopeDestroyedInternal()` runs with `m_mayBeDestroyed == false` (set only by `workerObjectDestroyed()`), so it skips `deref()` and sets `m_scriptExecutionContextIdentifier = std::nullopt`. When `Worker::~Worker()` later calls `workerObjectDestroyed()`, the nullopt identifier causes an early return, and `deref()` is never called. A secondary retain cycle exists when messages are queued in `m_queuedEarlyTasks` before the worker thread is created. The queued task lambdas capture `Ref { *this }`, creating a cycle through the proxy's own member vector that prevents destruction even if `deref()` were called. Observed as ROOT LEAK (957 instances of `WorkerMessagingProxy`) and ROOT CYCLE (88 retain cycles with `WorkerMessagingProxy` and `CallableWrapper`) across 20 of 103 WebContent process memgraphs from a full `run-webkit-tests --leaks --debug` run. Tests that exercise the bug include: - workers/worker-terminate-crash.html - workers/bomb.html - workers/worker-set-delete-terminate-crash.html 2204760 1 webkit-bug-importer 2026-04-26 22:58:33 -0700 <rdar://problem/175652847> 2204775 2 ddkilzer 2026-04-26 23:34:03 -0700 Pull request: https://github.com/WebKit/WebKit/pull/63665 2205628 3 ews-feeder 2026-04-28 19:52:14 -0700 Committed 312256@main (80cc99fb32cb): <https://commits.webkit.org/312256@main> Reviewed commits have been landed. Closing PR #63665 and removing active labels.