Bug 313389 – WorkerMessagingProxy objects leak after calling worker.terminate() from JavaScript

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[David Kilzer (:ddkilzer)]

`WorkerMessagingProxy` objects leak after calling `worker.terminate()` from JavaScript.

The proxy ref-counting has a two-phase cleanup: `terminateWorkerGlobalScope()` shuts down the worker thread (phase 1), then `workerObjectDestroyed()` releases the initial ref when the `Worker` DOM object is destroyed (phase 2). The bug is that phase 1 clears `m_scriptExecutionContextIdentifier`, which phase 2 needs to post its cleanup task. Specifically, `workerGlobalScopeDestroyedInternal()` runs with `m_mayBeDestroyed == false` (set only by `workerObjectDestroyed()`), so it skips `deref()` and sets `m_scriptExecutionContextIdentifier = std::nullopt`. When `Worker::~Worker()` later calls `workerObjectDestroyed()`, the nullopt identifier causes an early return, and `deref()` is never called.

A secondary retain cycle exists when messages are queued in `m_queuedEarlyTasks` before the worker thread is created. The queued task lambdas capture `Ref { *this }`, creating a cycle through the proxy's own member vector that prevents destruction even if `deref()` were called.

Observed as ROOT LEAK (957 instances of `WorkerMessagingProxy`) and ROOT CYCLE (88 retain cycles with `WorkerMessagingProxy` and `CallableWrapper`) across 20 of 103 WebContent process memgraphs from a full `run-webkit-tests --leaks --debug` run.

Tests that exercise the bug include:
- workers/worker-terminate-crash.html
- workers/bomb.html
- workers/worker-set-delete-terminate-crash.html

[Radar WebKit Bug Importer]

<rdar://problem/175652847>

[David Kilzer (:ddkilzer)]

Pull request: https://github.com/WebKit/WebKit/pull/63665

[EWS]

Committed 312256@main (80cc99fb32cb): <https://commits.webkit.org/312256@main>

Reviewed commits have been landed. Closing PR #63665 and removing active labels.