RESOLVED FIXED 273590
Debug assert fired when cloning object with no inline storage 
https://bugs.webkit.org/show_bug.cgi?id=273590
Summary Debug assert fired when cloning object with no inline storage
Marcus Plutowski
Reported 2024-05-01 16:45:24 PDT
rdar://127227132 When running a debug build, hasInlineStorage() sometimes crashes when it tries to do a gcSafeMemcpy of the inline storage -- practically this call has no effect in the cases where the crash happens, as the copy is 0-width, but to make the call it still needs to call JSObject::inlineStorage() which in turn asserts and causes the crash.
Attachments
Add attachment proposed patch, testcase, etc.
Marcus Plutowski
Comment 1 2024-05-01 16:53:29 PDT
Pull request: https://github.com/WebKit/WebKit/pull/28019
EWS
Comment 2 2024-05-02 11:08:43 PDT
Committed 278270@main (eba5b36f9461): <https://commits.webkit.org/278270@main> Reviewed commits have been landed. Closing PR #28019 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2024-05-02 11:09:14 PDT
<rdar://problem/127441722>
Note You need to log in before you can comment on or make changes to this bug.