← WebKit Silent-Fix Report — 2026-W23
64ad3f36af0d8f25efc49f0390c7a3732e99c825 REGRESSION(305413.674@safari-7624-branch): Crash in StreamPipeToState::globalObject
severity low
class LogicError
confidence 0.55
WebCore Streams
Primitive: Null-pointer crash in StreamPipeToState::globalObject after frame detach
Triage note: StreamPipeToState::globalObject() passed context->globalObject() (which returns null once the owning iframe document is detached) to dynamicDowncast/jsDynamicCast, which does not null-check, crashing on a read from 0x0 during error propagation. Fix adds an explicit null check on jsGlobalObject. Web-reachable DoS.
Triage note: StreamPipeToState::globalObject() passed context->globalObject() (which returns null once the owning iframe document is detached) to dynamicDowncast/jsDynamicCast, which does not null-check, crashing on a read from 0x0 during error propagation. Fix adds an explicit null check on jsGlobalObject. Web-reachable DoS.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…