293369 2025-05-21 09:00:11 -0700 NSData created by dataWithUserTypedString causes a crash when MALLOC_HEAP_BREAKDOWN is turned on 2025-05-21 13:29:45 -0700 1 1 1 Unclassified WebKit WebKit Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 v_bykov v_bykov webkit-bug-importer oldest_to_newest 2118688 0 v_bykov 2025-05-21 09:00:11 -0700 The function has been changed some 6 months ago to use a Vector<char> to allocate and populate the memory buffer, instead of a raw malloc and pointer operations. The buffer is then extracted from the vector and registered to be freed using FastMalloc::free(). This assumes that the buffer was initially allocated by FastMalloc. The assumption doesn't hold when MALLOC_HEAP_BREAKDOWN is on and vector buffers are allocated by VectorBufferMalloc. FastMalloc::free() in that case sees the pointer as misaligned and crashes. This happens on startup in both Safari and MiniBrowser. A patch will follow. 2118689 1 webkit-bug-importer 2025-05-21 09:00:24 -0700 <rdar://problem/151776839> 2118691 2 v_bykov 2025-05-21 09:09:40 -0700 Pull request: https://github.com/WebKit/WebKit/pull/45706 2118757 3 ews-feeder 2025-05-21 13:29:43 -0700 Committed 295226@main (4fbe97d9d0c4): <https://commits.webkit.org/295226@main> Reviewed commits have been landed. Closing PR #45706 and removing active labels.