Bug 273590

Summary:	Debug assert fired when cloning object with no inline storage
Product:	WebKit	Reporter:	Marcus Plutowski <marcus_plutowski>
Component:	JavaScriptCore	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Marcus Plutowski

Reported 2024-05-01 16:45:24 PDT

rdar://127227132 When running a debug build, hasInlineStorage() sometimes crashes when it tries to do a gcSafeMemcpy of the inline storage -- practically this call has no effect in the cases where the crash happens, as the copy is 0-width, but to make the call it still needs to call JSObject::inlineStorage() which in turn asserts and causes the crash.

Attachments
Add attachment proposed patch, testcase, etc.

Marcus Plutowski

Comment 1 2024-05-01 16:53:29 PDT

Pull request: https://github.com/WebKit/WebKit/pull/28019

EWS

Comment 2 2024-05-02 11:08:43 PDT

Committed 278270@main (eba5b36f9461): <https://commits.webkit.org/278270@main> Reviewed commits have been landed. Closing PR #28019 and removing active labels.

Radar WebKit Bug Importer

Comment 3 2024-05-02 11:09:14 PDT

<rdar://problem/127441722>

Note You need to log in before you can comment on or make changes to this bug.