Basically, we end up with code that does this: Ref<P>(Ref<P>(HashTableEmptyValue)) Which: - invokes move constructor on an incoming empty value - that incoming empty value has nullptr for m_ptr - The move constructor calls leakRef on the incoming value - leakRef does: ASSERT(m_ptr)
Created attachment 347141 [details] patch
Comment on attachment 347141 [details] patch Clearing flags on attachment: 347141 Committed r234879: <https://trac.webkit.org/changeset/234879>
All reviewed patches have been landed. Closing bug.
<rdar://problem/43318499>