313950 2026-05-03 20:48:36 -0700 [Cocoa] Crash in WeakPtr<PlatformSpeechSynthesizer>::get() under -[WebSpeechSynthesisWrapper availableVoicesDidChange] 2026-05-04 07:30:47 -0700 1 1 1 Unclassified WebKit Accessibility WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar, Regression P2 Normal --- 1 ddkilzer ddkilzer andresg_22 webkit-bug-importer oldest_to_newest 2207076 0 ddkilzer 2026-05-03 20:48:36 -0700 AVFoundation's `VoiceDatabaseClient.startCacheInvalidation()` now posts `AVSpeechSynthesisAvailableVoicesDidChangeNotification` from a background Swift concurrency cooperative thread rather than the main thread. `-[WebSpeechSynthesisWrapper availableVoicesDidChange]` dereferences its `WeakPtr<PlatformSpeechSynthesizer>` directly in the notification handler, tripping the `WeakPtr` threading assertion (`ASSERT_WITH_SECURITY_IMPLICATION(canSafelyBeUsed())`) and crashing the UI process. Stack trace: ``` Thread 18 Crashed:: Dispatch queue: com.apple.root.default-qos.cooperative: 0 JavaScriptCore: WTFCrashWithSecurityImplication 1 WebCore: WTF::WeakPtr<WebCore::PlatformSpeechSynthesizer>::get() const 2 WebCore: -[WebSpeechSynthesisWrapper availableVoicesDidChange] 3 CoreFoundation: __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ 4 CoreFoundation: ___CFXRegistrationPost_block_invoke 5 CoreFoundation: _CFXRegistrationPost 6 CoreFoundation: _CFXNotificationPost 7 Foundation: -[NSNotificationCenter postNotificationName:object:userInfo:] 8 TextToSpeech: closure #1 in VoiceDatabaseClient.startCacheInvalidation() 9 libswift_Concurrency.dylib: completeTaskWithClosure(swift::AsyncContext*, swift::SwiftError*) ``` The regression is an AVFoundation behavior change, not a WebKit commit regression. 2207077 1 ddkilzer 2026-05-03 20:48:38 -0700 <rdar://problem/173555693> 2207079 2 ddkilzer 2026-05-03 20:53:03 -0700 Pull request: https://github.com/WebKit/WebKit/pull/64144 2207185 3 ews-feeder 2026-05-04 07:30:45 -0700 Committed 312522@main (28838f616b1d): <https://commits.webkit.org/312522@main> Reviewed commits have been landed. Closing PR #64144 and removing active labels.