This fixes a use-after-free of the IPC Connection’s Client during message dispatch by replacing non-owning CheckedPtr access with a ref-holding RefPtr. Connection dispatches incoming messages to its Client (didReceiveMessage, didReceiveSyncMessage, didClose, didReceiveInvalidMessage) via checkedClient(), which returned a CheckedPtr<Client>. A CheckedPtr only verifies (in debug) that the pointee has not been freed; it does NOT keep the Client alive. Message handlers can run code that re-entrantly tears down the connection’s client (or the client can be destroyed on another thread), so a call like checkedClient()->didReceiveMessage(*this, decoder) could dereference a Client that is being or has been destroyed — a use-after-free.

The fix renames checkedClient() to protectedClient() returning RefPtr<Client> (m_client.get()), and updates the hot dispatch paths to take a local RefPtr client = m_client.get(), null-check it, and call through it, so the Client is guaranteed to stay alive for the duration of each dispatch call. dispatchDidCloseAndInvalidate and the throttling-termination path likewise load a RefPtr and bail if null.

The restored invariant is that the Client outlives every dispatch call made on it; a checked (non-owning) pointer was insufficient across calls that can drop the last reference.

A use-after-free on the IPC Client in whichever process receives the messages (UI, GPU, Network or WebContent), reachable when a peer sends messages that trigger re-entrant client teardown during dispatch. UAFs on core IPC objects are broadly reachable and exploitable with grooming; the advisory rates it a crash, but the class routinely escalates toward code execution in the receiving process.