Summary
Constructing a Blob whose parts array contains another Blob crashes with SIGSEGV on construction (before any read). Nesting Blobs is idiomatic (composing multipart/form bodies, concatenating chunks), and every non-nested Blob operation works — only a Blob used as a BlobPart crashes.
Minimal repro
const inner = new Blob(["x"]);
const outer = new Blob([inner]); // SIGSEGV here (even just reading outer.size)
console.log(outer.size);
Also crashes as new Blob(["a", inner, "b"]). Exit code 139 (SIGSEGV).
Boundary (all of these WORK — only a nested Blob part crashes)
new Blob([uint8array]), even 12 MB → oknew Blob([string]), .text(), .arrayBuffer() → okblob.slice(...).arrayBuffer() → oknew Blob([...10000 strings]) → ok- a
Blob value as a BlobPart → SIGSEGV
Likely cause
The Blob constructor's BlobPart handling almost certainly mishandles the case where a part is itself a Blob (it should copy the inner blob's bytes), dereferencing an invalid pointer.
Related: #2959 (coerce Blob/File constructor inputs like Node).
Environment
perry release binary dated 2026-07-05, PERRY_NO_AUTO_OPTIMIZE=1, with libperry_stdlib.a. Found via secret-tests/bun-suite; hit by Bun's web/fetch/blob-array-fast-path.test.ts and blob-cow.test.ts.
Summary
Constructing a
Blobwhose parts array contains anotherBlobcrashes with SIGSEGV on construction (before any read). Nesting Blobs is idiomatic (composing multipart/form bodies, concatenating chunks), and every non-nested Blob operation works — only aBlobused as aBlobPartcrashes.Minimal repro
Also crashes as
new Blob(["a", inner, "b"]). Exit code 139 (SIGSEGV).Boundary (all of these WORK — only a nested Blob part crashes)
new Blob([uint8array]), even 12 MB → oknew Blob([string]),.text(),.arrayBuffer()→ okblob.slice(...).arrayBuffer()→ oknew Blob([...10000 strings])→ okBlobvalue as aBlobPart→ SIGSEGVLikely cause
The Blob constructor's
BlobParthandling almost certainly mishandles the case where a part is itself aBlob(it should copy the inner blob's bytes), dereferencing an invalid pointer.Related: #2959 (coerce Blob/File constructor inputs like Node).
Environment
perry release binary dated 2026-07-05,
PERRY_NO_AUTO_OPTIMIZE=1, withlibperry_stdlib.a. Found via secret-tests/bun-suite; hit by Bun'sweb/fetch/blob-array-fast-path.test.tsandblob-cow.test.ts.