314931 2026-05-15 20:44:07 -0700 WorkerOrWorkletGlobalScope::postTask() should null-check workerOrWorkletThread() to handle cross-thread teardown race 2026-05-22 18:35:14 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 299941 1 ddkilzer ddkilzer webkit-bug-importer oldest_to_newest 2211348 0 ddkilzer 2026-05-15 20:44:07 -0700 `WorkerOrWorkletGlobalScope::postTask()` and `WorkerOrWorkletGlobalScope::postTaskForMode()` unconditionally dereference the result of `workerOrWorkletThread()`. After `300878@main` (Bug 299941) converted the underlying `m_thread` field to `ThreadSafeWeakPtr<WorkerOrWorkletThread>`, that accessor can legitimately return `nullptr`, so these unconditional dereferences are now a nullptr crash. They also must keep a RefPtr<WorkerOrWorkletThread> on the stack when calling out to a non-trivial method for SaferCPP. Crash stack: ``` Thread 0 Crashed: 0 WebCore: WorkerOrWorkletGlobalScope::postTask 1 WebCore: ScriptExecutionContext::postTaskTo 2 WebCore: WorkerGlobalScope::releaseMemoryInWorkers 3 WebCore: releaseCriticalMemory 4 WebCore: releaseMemory 5 WebKit: WebProcess::initializeWebProcess (memory-pressure handler) 6 JavaScriptCore: MemoryPressureHandler::releaseMemory 7 WebKit: WebProcess::releaseMemory 8 WebKit: WebProcess::prepareToSuspend [...] ``` 2211349 1 ddkilzer 2026-05-15 20:44:09 -0700 <rdar://problem/165266466> 2211355 2 ddkilzer 2026-05-15 20:51:41 -0700 Pull request: https://github.com/WebKit/WebKit/pull/65030 2213455 3 ews-feeder 2026-05-22 18:35:12 -0700 Committed 313772@main (52162f9781a0): <https://commits.webkit.org/313772@main> Reviewed commits have been landed. Closing PR #65030 and removing active labels.