This fixes a third-party cookie partitioning bypass on WebSocket requests that let cookies leak cross-site. In NetworkSessionCocoa::createWebSocketTask, the code that applies opt-in cookie partitioning was guarded by [mutableRequest respondsToSelector:@selector(_setAllowOnlyPartitionedCookies:)]. mutableRequest is produced lazily via ensureMutableRequest(); at that point it could be nil/unmaterialized, and -respondsToSelector: on nil returns NO, so the entire block that computes the third-party cookie blocking decision and calls _setAllowOnlyPartitionedCookies: was skipped.

As a result, a cross-site WebSocket did not have partitioned-cookie / third-party-cookie-blocking policy applied, so it could carry the user’s full (unpartitioned) first-party cookies to a third-party host — cross-site data exfiltration / tracking.

The fix changes the guard to [ensureMutableRequest() respondsToSelector:…], forcing the mutable request to be materialized so the selector check succeeds and the partitioning decision (thirdPartyCookieBlockingDecisionForRequest … AllExceptPartitioned) is actually applied via _setAllowOnlyPartitionedCookies:.

The restored invariant is that WebSocket requests receive the same third-party cookie partitioning/blocking decision as other requests. The regression test loads siteB, which opens a WebSocket to siteA, and asserts the WebSocket handshake to siteA carries NO Cookie header (third-party cookies blocked/partitioned).

A cross-site information-disclosure issue in the Network process: WebSocket requests bypassed third-party cookie partitioning/blocking and could carry unpartitioned cookies to third parties, enabling cross-site tracking and cookie exfiltration. No memory corruption; the impact is privacy/data leakage across origins.