This fixes a use-after-free (and a related teardown race) in the Web Audio HRTF panner’s per-sample-rate loader cache. loaderMap() cached each HRTFDatabaseLoader keyed by sample rate as a RAW pointer (HashMap<double, HRTFDatabaseLoader*>). HRTFDatabaseLoader is ref-counted (created via adoptRef), so the map held a non-owning raw pointer to an object whose lifetime is controlled elsewhere. createAndLoadAsynchronouslyIfNecessary looked the loader up with loaderMap().get(sampleRate) and adopted it into a RefPtr; if the cached loader had already reached refcount zero and begun destruction, that raw pointer was dangling and reviving it was a use-after-free. Symmetrically, ~HRTFDatabaseLoader unconditionally did loaderMap().remove(m_databaseSampleRate), which — if a NEW loader for the same sample rate had already replaced the entry — removed the wrong (live) entry.

The fix stores ThreadSafeWeakPtr<HRTFDatabaseLoader> in the map: the lookup upgrades with .get() and safely returns null when the object is gone (forcing creation of a fresh loader), add() becomes set(), and the destructor now finds the entry, upgrades it, and only removes it when the cached loader is actually ’this’ (guarding against clobbering a replacement).

The restored invariant is that the cache never hands out or removes a loader whose lifetime has ended; the weak pointer makes destruction observable across threads.

A use-after-free in the WebContent process reachable from ordinary Web Audio content, with a cross-thread component (the loader thread). Reviving a freed ref-counted object via a stale cache pointer is a controllable UAF; with heap grooming it can escalate beyond the crash the advisory describes toward memory disclosure or control-flow hijack in WebContent.