Cherry-pick 4cae7c8. rdar://117727810

    Crash under WebCore::createMainThreadConnection(WebCore::WorkerGlobalScope&)
    https://bugs.webkit.org/show_bug.cgi?id=264222
    rdar://117727810

    Reviewed by Darin Adler.

    We're crashing when calling `createCacheStorageConnection()` on the WorkerLoaderProxy which
    we got from the WorkerThread. I believe the WorkerLoaderProxy reference returned by the
    WorkerThread is stale, which is possible since it keeps C++ references to its proxies.

    To address the issue, I updated WorkerThread to keep raw pointers to its proxies instead of
    C++ references. I am also adding a clearProxies() function to clear those raw pointers once
    the proxies get destroyed. Finally, I added null checks are proxy use sites now that we null
    them out.

    In the future, we should convert this raw pointers into CheckedPtrs.

    * Source/WebCore/Modules/badge/WorkerBadgeProxy.h:
    * Source/WebCore/Modules/cache/WorkerCacheStorageConnection.cpp:
    (WebCore::createMainThreadConnection):
    * Source/WebCore/Modules/permissions/Permissions.cpp:
    (WebCore::Permissions::query):
    * Source/WebCore/Modules/storage/WorkerStorageConnection.cpp:
    (WebCore::WorkerStorageConnection::getPersisted):
    (WebCore::WorkerStorageConnection::getEstimate):
    (WebCore::WorkerStorageConnection::fileSystemGetDirectory):
    * Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp:
    (WebCore::AudioWorkletGlobalScope::registerProcessor):
    * Source/WebCore/Modules/webaudio/AudioWorkletMessagingProxy.cpp:
    (WebCore::AudioWorkletMessagingProxy::~AudioWorkletMessagingProxy):
    * Source/WebCore/Modules/webaudio/AudioWorkletThread.cpp:
    (WebCore::AudioWorkletThread::clearProxies):
    (WebCore::AudioWorkletThread::workerLoaderProxy):
    (WebCore::AudioWorkletThread::messagingProxy):
    * Source/WebCore/Modules/webaudio/AudioWorkletThread.h:
    (WebCore::AudioWorkletThread::messagingProxy): Deleted.
    * Source/WebCore/Modules/websockets/WebSocket.cpp:
    (WebCore::WebSocket::connect):
    * Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
    (WebCore::WorkerThreadableWebSocketChannel::Bridge::Bridge):
    (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize):
    * Source/WebCore/dom/BroadcastChannel.cpp:
    (WebCore::BroadcastChannel::MainThreadBridge::ensureOnMainThread):
    * Source/WebCore/dom/ScriptExecutionContext.cpp:
    (WebCore::ScriptExecutionContext::postTaskToResponsibleDocument):
    * Source/WebCore/loader/WorkerThreadableLoader.cpp:
    (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
    * Source/WebCore/loader/cache/MemoryCache.cpp:
    (WebCore::MemoryCache::removeRequestFromSessionCaches):
    * Source/WebCore/page/WorkerNavigator.cpp:
    (WebCore::WorkerNavigator::setAppBadge):
    * Source/WebCore/workers/WorkerDebuggerProxy.h:
    * Source/WebCore/workers/WorkerGlobalScope.cpp:
    (WebCore::WorkerGlobalScope::~WorkerGlobalScope):
    (WebCore::WorkerGlobalScope::createRTCDataChannelRemoteHandlerConnection):
    (WebCore::WorkerGlobalScope::close):
    (WebCore::WorkerGlobalScope::logExceptionToConsole):
    (WebCore::WorkerGlobalScope::wrapCryptoKey):
    (WebCore::WorkerGlobalScope::unwrapCryptoKey):
    (WebCore::WorkerGlobalScope::reportErrorToWorkerObject):
    * Source/WebCore/workers/WorkerLoaderProxy.h:
    * Source/WebCore/workers/WorkerMessagingProxy.cpp:
    (WebCore::WorkerMessagingProxy::WorkerMessagingProxy):
    (WebCore::WorkerMessagingProxy::~WorkerMessagingProxy):
    (WebCore::WorkerMessagingProxy::workerGlobalScopeDestroyedInternal):
    * Source/WebCore/workers/WorkerNotificationClient.cpp:
    (WebCore::WorkerNotificationClient::postToMainThread):
    * Source/WebCore/workers/WorkerOrWorkletThread.h:
    * Source/WebCore/workers/WorkerReportingProxy.h:
    * Source/WebCore/workers/WorkerThread.cpp:
    (WebCore::WorkerThread::workerBadgeProxy const):
    (WebCore::WorkerThread::workerDebuggerProxy const):
    (WebCore::WorkerThread::workerLoaderProxy):
    (WebCore::WorkerThread::workerReportingProxy const):
    (WebCore::WorkerThread::clearProxies):
    * Source/WebCore/workers/WorkerThread.h:
    (WebCore::WorkerThread::workerBadgeProxy const): Deleted.
    (WebCore::WorkerThread::workerReportingProxy const): Deleted.
    * Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.cpp:
    (WebCore::ServiceWorkerThreadProxy::~ServiceWorkerThreadProxy):
    * Source/WebCore/workers/shared/context/SharedWorkerThreadProxy.cpp:
    (WebCore::SharedWorkerThreadProxy::~SharedWorkerThreadProxy):

    Canonical link: https://commits.webkit.org/267815.537@safari-7617-branch

Identifier: 267815.520@safari-7617.1.16.10-branch

Source/WebCore/Modules/cache/WorkerCacheStorageConnection.cpp

@@ -70,8 +70,9 @@ static Ref<CacheStorageConnection> createMainThreadConnection(WorkerGlobalScope&
 {
     RefPtr<CacheStorageConnection> mainThreadConnection;
     callOnMainThreadAndWait([workerThread = Ref { scope.thread() }, &mainThreadConnection]() mutable {
-        if (!workerThread->runLoop().terminated())
-            mainThreadConnection = workerThread->workerLoaderProxy().createCacheStorageConnection();
+        auto* workerLoaderProxy = workerThread->workerLoaderProxy();
+        if (!workerThread->runLoop().terminated() && workerLoaderProxy)
+            mainThreadConnection = workerLoaderProxy->createCacheStorageConnection();
         if (!mainThreadConnection) {
             RELEASE_LOG_INFO(ServiceWorker, "Creating stopped WorkerCacheStorageConnection");
             mainThreadConnection = StoppedCacheStorageConnection::create();

Source/WebCore/Modules/permissions/Permissions.cpp

@@ -198,7 +198,8 @@ void Permissions::query(JSC::Strong<JSC::JSObject> permissionDescriptorValue, DO
         });
     };
 
-    workerGlobalScope.thread().workerLoaderProxy().postTaskToLoader(WTFMove(completionHandler));
+    if (auto* workerLoaderProxy = workerGlobalScope.thread().workerLoaderProxy())
+        workerLoaderProxy->postTaskToLoader(WTFMove(completionHandler));
 }
 
 } // namespace WebCore

Source/WebCore/Modules/storage/WorkerStorageConnection.cpp

@@ -64,10 +64,14 @@ void WorkerStorageConnection::getPersisted(ClientOrigin&& origin, StorageConnect
 {
     ASSERT(m_scope);
 
+    auto* workerLoaderProxy = m_scope->thread().workerLoaderProxy();
+    if (!workerLoaderProxy)
+        return completionHandler(false);
+
     auto callbackIdentifier = ++m_lastCallbackIdentifier;
     m_getPersistedCallbacks.add(callbackIdentifier, WTFMove(completionHandler));
 
-    m_scope->thread().workerLoaderProxy().postTaskToLoader([callbackIdentifier, contextIdentifier = m_scope->identifier(), origin = WTFMove(origin).isolatedCopy()](auto& context) mutable {
+    workerLoaderProxy->postTaskToLoader([callbackIdentifier, contextIdentifier = m_scope->identifier(), origin = WTFMove(origin).isolatedCopy()](auto& context) mutable {
         ASSERT(isMainThread());
 
         auto& document = downcast<Document>(context);
@@ -94,10 +98,14 @@ void WorkerStorageConnection::getEstimate(ClientOrigin&& origin, StorageConnecti
 {
     ASSERT(m_scope);
 
+    auto* workerLoaderProxy = m_scope->thread().workerLoaderProxy();
+    if (!workerLoaderProxy)
+        return completionHandler(Exception { InvalidStateError });
+
     auto callbackIdentifier = ++m_lastCallbackIdentifier;
     m_getEstimateCallbacks.add(callbackIdentifier, WTFMove(completionHandler));
 
-    m_scope->thread().workerLoaderProxy().postTaskToLoader([callbackIdentifier, contextIdentifier = m_scope->identifier(), origin = WTFMove(origin).isolatedCopy()](auto& context) mutable {
+    workerLoaderProxy->postTaskToLoader([callbackIdentifier, contextIdentifier = m_scope->identifier(), origin = WTFMove(origin).isolatedCopy()](auto& context) mutable {
         ASSERT(isMainThread());
 
         auto& document = downcast<Document>(context);
@@ -123,11 +131,15 @@ void WorkerStorageConnection::didGetEstimate(uint64_t callbackIdentifier, Except
 void WorkerStorageConnection::fileSystemGetDirectory(ClientOrigin&& origin, StorageConnection::GetDirectoryCallback&& completionHandler)
 {
     ASSERT(m_scope);
+
+    auto* workerLoaderProxy = m_scope->thread().workerLoaderProxy();
+    if (!workerLoaderProxy)
+        return completionHandler(Exception { InvalidStateError });
 
     auto callbackIdentifier = ++m_lastCallbackIdentifier;
     m_getDirectoryCallbacks.add(callbackIdentifier, WTFMove(completionHandler));
 
-    m_scope->thread().workerLoaderProxy().postTaskToLoader([callbackIdentifier, contextIdentifier = m_scope->identifier(), origin = WTFMove(origin).isolatedCopy()](auto& context) mutable {
+    workerLoaderProxy->postTaskToLoader([callbackIdentifier, contextIdentifier = m_scope->identifier(), origin = WTFMove(origin).isolatedCopy()](auto& context) mutable {
         ASSERT(isMainThread());
 
         auto& document = downcast<Document>(context);

Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp

@@ -119,7 +119,11 @@ ExceptionOr<void> AudioWorkletGlobalScope::registerProcessor(String&& name, Ref<
     if (!addResult.isNewEntry)
         return Exception { NotSupportedError, "A processor was already registered with this name"_s };
 
-    thread().messagingProxy().postTaskToAudioWorklet([name = WTFMove(name).isolatedCopy(), parameterDescriptors = crossThreadCopy(WTFMove(parameterDescriptors))](AudioWorklet& worklet) mutable {
+    auto* messagingProxy = thread().messagingProxy();
+    if (!messagingProxy)
+        return Exception { InvalidStateError };
+
+    messagingProxy->postTaskToAudioWorklet([name = WTFMove(name).isolatedCopy(), parameterDescriptors = crossThreadCopy(WTFMove(parameterDescriptors))](AudioWorklet& worklet) mutable {
         ASSERT(isMainThread());
         if (auto* audioContext = worklet.audioContext())
             audioContext->addAudioParamDescriptors(name, WTFMove(parameterDescriptors));

Source/WebCore/Modules/webaudio/AudioWorkletMessagingProxy.cpp

@@ -77,6 +77,7 @@ AudioWorkletMessagingProxy::AudioWorkletMessagingProxy(AudioWorklet& worklet)
 AudioWorkletMessagingProxy::~AudioWorkletMessagingProxy()
 {
     m_workletThread->stop();
+    m_workletThread->clearProxies();
 }
 
 bool AudioWorkletMessagingProxy::postTaskForModeToWorkletGlobalScope(ScriptExecutionContext::Task&& task, const String& mode)

Source/WebCore/Modules/webaudio/AudioWorkletThread.cpp

@@ -39,7 +39,7 @@ namespace WebCore {
 
 AudioWorkletThread::AudioWorkletThread(AudioWorkletMessagingProxy& messagingProxy, WorkletParameters&& parameters)
     : WorkerOrWorkletThread(parameters.identifier.isolatedCopy())
-    , m_messagingProxy(messagingProxy)
+    , m_messagingProxy(&messagingProxy)
     , m_parameters(WTFMove(parameters).isolatedCopy())
 {
 }
@@ -51,7 +51,12 @@ RefPtr<WorkerOrWorkletGlobalScope> AudioWorkletThread::createGlobalScope()
     return AudioWorkletGlobalScope::tryCreate(*this, m_parameters);
 }
 
-WorkerLoaderProxy& AudioWorkletThread::workerLoaderProxy()
+void AudioWorkletThread::clearProxies()
+{
+    m_messagingProxy = nullptr;
+}
+
+WorkerLoaderProxy* AudioWorkletThread::workerLoaderProxy()
 {
     return m_messagingProxy;
 }

Source/WebCore/Modules/webaudio/AudioWorkletThread.h

@@ -47,11 +47,13 @@ class AudioWorkletThread : public WorkerOrWorkletThread {
 
     AudioWorkletGlobalScope* globalScope() const;
 
+    void clearProxies() final;
+
     // WorkerOrWorkletThread.
-    WorkerLoaderProxy& workerLoaderProxy() final;
+    WorkerLoaderProxy* workerLoaderProxy() final;
     WorkerDebuggerProxy* workerDebuggerProxy() const final;
 
-    AudioWorkletMessagingProxy& messagingProxy() { return m_messagingProxy; }
+    AudioWorkletMessagingProxy* messagingProxy() { return m_messagingProxy; }
 
 private:
     AudioWorkletThread(AudioWorkletMessagingProxy&, WorkletParameters&&);
@@ -60,7 +62,7 @@ class AudioWorkletThread : public WorkerOrWorkletThread {
     Ref<Thread> createThread() final;
     RefPtr<WorkerOrWorkletGlobalScope> createGlobalScope() final;
 
-    AudioWorkletMessagingProxy& m_messagingProxy;
+    AudioWorkletMessagingProxy* m_messagingProxy; // FIXME: Adopt CheckedPtr.
     WorkletParameters m_parameters;
 };
 

Source/WebCore/Modules/websockets/WebSocket.cpp

@@ -336,8 +336,8 @@ ExceptionOr<void> WebSocket::connect(const String& url, const Vector<String>& pr
     };
     if (is<Document>(context))
         reportRegistrableDomain(context);
-    else
-        downcast<WorkerGlobalScope>(context).thread().workerLoaderProxy().postTaskToLoader(WTFMove(reportRegistrableDomain));
+    else if (auto* workerLoaderProxy = downcast<WorkerGlobalScope>(context).thread().workerLoaderProxy())
+        workerLoaderProxy->postTaskToLoader(WTFMove(reportRegistrableDomain));
 #endif
 
     m_pendingActivity = makePendingActivity(*this);

Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp

@@ -346,7 +346,7 @@ void WorkerThreadableWebSocketChannel::Peer::didUpgradeURL()
 WorkerThreadableWebSocketChannel::Bridge::Bridge(Ref<ThreadableWebSocketChannelClientWrapper>&& workerClientWrapper, Ref<WorkerGlobalScope>&& workerGlobalScope, const String& taskMode, Ref<SocketProvider>&& socketProvider)
     : m_workerClientWrapper(WTFMove(workerClientWrapper))
     , m_workerGlobalScope(WTFMove(workerGlobalScope))
-    , m_loaderProxy(m_workerGlobalScope->thread().workerLoaderProxy())
+    , m_loaderProxy(*m_workerGlobalScope->thread().workerLoaderProxy())
     , m_taskMode(taskMode)
     , m_socketProvider(WTFMove(socketProvider))
 {
@@ -374,10 +374,12 @@ void WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize(ScriptExecut
             ASSERT(context.isWorkerGlobalScope() || context.isWorkletGlobalScope());
             if (clientWrapper->failedWebSocketChannelCreation()) {
                 // If Bridge::initialize() quitted earlier, we need to kick mainThreadDestroy() to delete the peer.
-                downcast<WorkerOrWorkletGlobalScope>(context).workerOrWorkletThread()->workerLoaderProxy().postTaskToLoader([peer = WTFMove(peer)](ScriptExecutionContext& context) {
-                    ASSERT(isMainThread());
-                    ASSERT_UNUSED(context, context.isDocument());
-                });
+                if (auto* workerLoaderProxy = downcast<WorkerOrWorkletGlobalScope>(context).workerOrWorkletThread()->workerLoaderProxy()) {
+                    workerLoaderProxy->postTaskToLoader([peer = WTFMove(peer)](ScriptExecutionContext& context) {
+                        ASSERT(isMainThread());
+                        ASSERT_UNUSED(context, context.isDocument());
+                    });
+                }
             } else
                 clientWrapper->didCreateWebSocketChannel(peer.release());
         }

Source/WebCore/dom/BroadcastChannel.cpp

@@ -117,7 +117,11 @@ void BroadcastChannel::MainThreadBridge::ensureOnMainThread(Function<void(Page*)
         return;
     }
 
-    downcast<WorkerGlobalScope>(*context).thread().workerLoaderProxy().postTaskToLoader([protectedThis = WTFMove(protectedThis), task = WTFMove(task)](auto& context) {
+    auto* workerLoaderProxy = downcast<WorkerGlobalScope>(*context).thread().workerLoaderProxy();
+    if (!workerLoaderProxy)
+        return;
+
+    workerLoaderProxy->postTaskToLoader([protectedThis = WTFMove(protectedThis), task = WTFMove(task)](auto& context) {
         task(downcast<Document>(context).page());
     });
 }

Source/WebCore/dom/ScriptExecutionContext.cpp

@@ -776,9 +776,11 @@ void ScriptExecutionContext::postTaskToResponsibleDocument(Function<void(Documen
 
     auto* thread = downcast<WorkerOrWorkletGlobalScope>(this)->workerOrWorkletThread();
     if (thread) {
-        thread->workerLoaderProxy().postTaskToLoader([callback = WTFMove(callback)](auto&& context) {
-            callback(downcast<Document>(context));
-        });
+        if (auto* workerLoaderProxy = thread->workerLoaderProxy()) {
+            workerLoaderProxy->postTaskToLoader([callback = WTFMove(callback)](auto&& context) {
+                callback(downcast<Document>(context));
+            });
+        }
         return;
     }
 

Source/WebCore/loader/WorkerThreadableLoader.cpp

@@ -108,14 +108,15 @@ LoaderTaskOptions::LoaderTaskOptions(const ThreadableLoaderOptions& options, con
 {
 }
 
-WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(ThreadableLoaderClientWrapper& workerClientWrapper, WorkerLoaderProxy& loaderProxy, ScriptExecutionContextIdentifier contextIdentifier, const String& taskMode,
+WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(ThreadableLoaderClientWrapper& workerClientWrapper, WorkerLoaderProxy* loaderProxy, ScriptExecutionContextIdentifier contextIdentifier, const String& taskMode,
     ResourceRequest&& request, const ThreadableLoaderOptions& options, const String& outgoingReferrer, WorkerOrWorkletGlobalScope& globalScope)
     : m_workerClientWrapper(&workerClientWrapper)
     , m_loaderProxy(loaderProxy)
     , m_taskMode(taskMode.isolatedCopy())
     , m_workerRequestIdentifier { ResourceLoaderIdentifier::generate() }
     , m_contextIdentifier(contextIdentifier)
 {
+    ASSERT(m_loaderProxy);
     auto* securityOrigin = globalScope.securityOrigin();
     auto* contentSecurityPolicy = globalScope.contentSecurityPolicy();
 
@@ -124,7 +125,7 @@ WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(ThreadableLoaderClien
 
     auto securityOriginCopy = securityOrigin->isolatedCopy();
     ReportingClient* reportingClient = nullptr;
-    if (auto* client = m_loaderProxy.reportingClient())
+    if (auto* client = m_loaderProxy ? m_loaderProxy->reportingClient() : nullptr)
         reportingClient = client;
     else if (auto* workerScope = dynamicDowncast<WorkerGlobalScope>(globalScope))
         reportingClient = workerScope;
@@ -158,8 +159,11 @@ WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(ThreadableLoaderClien
     if (is<WorkerGlobalScope>(globalScope))
         InspectorInstrumentation::willSendRequest(downcast<WorkerGlobalScope>(globalScope), m_workerRequestIdentifier, request);
 
+    if (!m_loaderProxy)
+        return;
+
     // Can we benefit from request being an r-value to create more efficiently its isolated copy?
-    m_loaderProxy.postTaskToLoader([this, request = WTFMove(request).isolatedCopy(), options = WTFMove(optionsCopy), contentSecurityPolicyIsolatedCopy = WTFMove(contentSecurityPolicyIsolatedCopy), crossOriginEmbedderPolicyCopy = WTFMove(crossOriginEmbedderPolicyCopy)](ScriptExecutionContext& context) mutable {
+    m_loaderProxy->postTaskToLoader([this, request = WTFMove(request).isolatedCopy(), options = WTFMove(optionsCopy), contentSecurityPolicyIsolatedCopy = WTFMove(contentSecurityPolicyIsolatedCopy), crossOriginEmbedderPolicyCopy = WTFMove(crossOriginEmbedderPolicyCopy)](ScriptExecutionContext& context) mutable {
         ASSERT(isMainThread());
         Document& document = downcast<Document>(context);
 
@@ -175,8 +179,11 @@ void WorkerThreadableLoader::MainThreadBridge::destroy()
     // Ensure that no more client callbacks are done in the worker context's thread.
     clearClientWrapper();
 
+    if (!m_loaderProxy)
+        return;
+
     // "delete this" and m_mainThreadLoader::deref() on the worker object's thread.
-    m_loaderProxy.postTaskToLoader([self = std::unique_ptr<WorkerThreadableLoader::MainThreadBridge>(this)] (ScriptExecutionContext& context) {
+    m_loaderProxy->postTaskToLoader([self = std::unique_ptr<WorkerThreadableLoader::MainThreadBridge>(this)] (ScriptExecutionContext& context) {
         ASSERT(isMainThread());
         ASSERT_UNUSED(context, context.isDocument());
         if (self->m_mainThreadLoader)
@@ -186,15 +193,17 @@ void WorkerThreadableLoader::MainThreadBridge::destroy()
 
 void WorkerThreadableLoader::MainThreadBridge::cancel()
 {
-    m_loaderProxy.postTaskToLoader([this] (ScriptExecutionContext& context) {
-        ASSERT(isMainThread());
-        ASSERT_UNUSED(context, context.isDocument());
-
-        if (!m_mainThreadLoader)
-            return;
-        m_mainThreadLoader->cancel();
-        m_mainThreadLoader = nullptr;
-    });
+    if (m_loaderProxy) {
+        m_loaderProxy->postTaskToLoader([this] (ScriptExecutionContext& context) {
+            ASSERT(isMainThread());
+            ASSERT_UNUSED(context, context.isDocument());
+
+            if (!m_mainThreadLoader)
+                return;
+            m_mainThreadLoader->cancel();
+            m_mainThreadLoader = nullptr;
+        });
+    }
 
     // Taking a ref of client wrapper as call to didFail may take out the last reference of it.
     Ref<ThreadableLoaderClientWrapper> protectedWorkerClientWrapper(*m_workerClientWrapper);
@@ -207,7 +216,10 @@ void WorkerThreadableLoader::MainThreadBridge::cancel()
 
 void WorkerThreadableLoader::MainThreadBridge::computeIsDone()
 {
-    m_loaderProxy.postTaskToLoader([this](auto&) {
+    if (!m_loaderProxy)
+        return;
+
+    m_loaderProxy->postTaskToLoader([this](auto&) {
         if (!m_mainThreadLoader) {
             notifyIsDone(true);
             return;

Source/WebCore/loader/WorkerThreadableLoader.h

@@ -93,7 +93,7 @@ class WorkerThreadableLoader : public RefCounted<WorkerThreadableLoader>, public
     class MainThreadBridge : public ThreadableLoaderClient {
     public:
         // All executed on the worker context's thread.
-        MainThreadBridge(ThreadableLoaderClientWrapper&, WorkerLoaderProxy&, ScriptExecutionContextIdentifier, const String& taskMode, ResourceRequest&&, const ThreadableLoaderOptions&, const String& outgoingReferrer, WorkerOrWorkletGlobalScope&);
+        MainThreadBridge(ThreadableLoaderClientWrapper&, WorkerLoaderProxy*, ScriptExecutionContextIdentifier, const String& taskMode, ResourceRequest&&, const ThreadableLoaderOptions&, const String& outgoingReferrer, WorkerOrWorkletGlobalScope&);
         void cancel();
         void destroy();
         void computeIsDone();
@@ -120,7 +120,7 @@ class WorkerThreadableLoader : public RefCounted<WorkerThreadableLoader>, public
         RefPtr<ThreadableLoaderClientWrapper> m_workerClientWrapper;
 
         // May be used on either thread.
-        WorkerLoaderProxy& m_loaderProxy;
+        WorkerLoaderProxy* m_loaderProxy;
 
         // For use on the main thread.
         String m_taskMode;

Source/WebCore/loader/cache/MemoryCache.cpp

@@ -686,7 +686,10 @@ void MemoryCache::adjustSize(bool live, long long delta)
 void MemoryCache::removeRequestFromSessionCaches(ScriptExecutionContext& context, const ResourceRequest& request)
 {
     if (is<WorkerGlobalScope>(context)) {
-        downcast<WorkerGlobalScope>(context).thread().workerLoaderProxy().postTaskToLoader([request = request.isolatedCopy()] (ScriptExecutionContext& context) {
+        auto* workerLoaderProxy = downcast<WorkerGlobalScope>(context).thread().workerLoaderProxy();
+        if (!workerLoaderProxy)
+            return;
+        workerLoaderProxy->postTaskToLoader([request = request.isolatedCopy()] (ScriptExecutionContext& context) {
             MemoryCache::removeRequestFromSessionCaches(context, request);
         });
         return;

Source/WebCore/page/WorkerNavigator.cpp

@@ -66,7 +66,8 @@ void WorkerNavigator::setAppBadge(std::optional<unsigned long long> badge, Ref<D
         return;
     }
 
-    scope->thread().workerBadgeProxy().setAppBadge(badge);
+    if (auto* workerBadgeProxy = scope->thread().workerBadgeProxy())
+        workerBadgeProxy->setAppBadge(badge);
     promise->resolve();
 }