Bug 314931 – WorkerOrWorkletGlobalScope::postTask() should null-check workerOrWorkletThread() to handle cross-thread teardown race

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[David Kilzer (:ddkilzer)]

`WorkerOrWorkletGlobalScope::postTask()` and `WorkerOrWorkletGlobalScope::postTaskForMode()` unconditionally dereference the result of `workerOrWorkletThread()`. After `300878@main` (Bug 299941) converted the underlying `m_thread` field to `ThreadSafeWeakPtr<WorkerOrWorkletThread>`, that accessor can legitimately return `nullptr`, so these unconditional dereferences are now a nullptr crash.

They also must keep a RefPtr<WorkerOrWorkletThread> on the stack when calling out to a non-trivial method for SaferCPP.

Crash stack:

```
Thread 0 Crashed:
0   WebCore:  WorkerOrWorkletGlobalScope::postTask
1   WebCore:  ScriptExecutionContext::postTaskTo
2   WebCore:  WorkerGlobalScope::releaseMemoryInWorkers
3   WebCore:  releaseCriticalMemory
4   WebCore:  releaseMemory
5   WebKit:   WebProcess::initializeWebProcess (memory-pressure handler)
6   JavaScriptCore:  MemoryPressureHandler::releaseMemory
7   WebKit:   WebProcess::releaseMemory
8   WebKit:   WebProcess::prepareToSuspend
[...]
```

[David Kilzer (:ddkilzer)]

<rdar://problem/165266466>

[David Kilzer (:ddkilzer)]

Pull request: https://github.com/WebKit/WebKit/pull/65030

[EWS]

Committed 313772@main (52162f9781a0): <https://commits.webkit.org/313772@main>

Reviewed commits have been landed. Closing PR #65030 and removing active labels.