If a thread dies right as it falls out of parkConditionally, then unparkOne() and friends might die because they will dereference a deallocated ThreadData.
The solution is to ref-count ThreadData's. When unparkOne() and friends want to hold onto a ThreadData past the queue lock, they can +1 the ref count.
Created attachment 288674 [details]
Comment on attachment 288674 [details]
Landed in https://trac.webkit.org/changeset/205859