<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>124017</bug_id>
          
          <creation_ts>2013-11-07 15:39:32 -0800</creation_ts>
          <short_desc>Map.forEach crashes on deleted values</short_desc>
          <delta_ts>2013-11-08 11:10:01 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Alexandru Chiculita">achicu</reporter>
          <assigned_to name="Oliver Hunt">oliver</assigned_to>
          <cc>joepeck</cc>
    
    <cc>oliver</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>948446</commentid>
    <comment_count>0</comment_count>
      <attachid>216338</attachid>
    <who name="Alexandru Chiculita">achicu</who>
    <bug_when>2013-11-07 15:39:32 -0800</bug_when>
    <thetext>Created attachment 216338
Test case

Crash when using Map.forEach after deleting a value from the map. See the attached test case.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>948535</commentid>
    <comment_count>1</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-11-07 20:34:13 -0800</bug_when>
    <thetext>Yeah, need to work out why the iterator is going wrong. :(</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>948727</commentid>
    <comment_count>2</comment_count>
      <attachid>216410</attachid>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-11-08 10:42:05 -0800</bug_when>
    <thetext>Created attachment 216410
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>948728</commentid>
    <comment_count>3</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2013-11-08 10:45:25 -0800</bug_when>
    <thetext>Committed r158929: &lt;http://trac.webkit.org/changeset/158929&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>948741</commentid>
    <comment_count>4</comment_count>
      <attachid>216410</attachid>
    <who name="Joseph Pecoraro">joepeck</who>
    <bug_when>2013-11-08 11:10:01 -0800</bug_when>
    <thetext>Comment on attachment 216410
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=216410&amp;action=review

&gt; Source/JavaScriptCore/ChangeLog:10
&gt; +        can perform an initialisation increment on construction, whle

Typo: &quot;whle&quot; =&gt; &quot;while&quot;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>216338</attachid>
            <date>2013-11-07 15:39:32 -0800</date>
            <delta_ts>2013-11-07 15:39:32 -0800</delta_ts>
            <desc>Test case</desc>
            <filename>map_crash_2.html</filename>
            <type>text/html</type>
            <size>131</size>
            <attacher name="Alexandru Chiculita">achicu</attacher>
            
              <data encoding="base64">PHNjcmlwdD4KdmFyIG1hcDA9IG5ldyBNYXA7Cm1hcDAuc2V0KDEyNSwge30pOwptYXAwLmRlbGV0
ZSgxMjUpOwptYXAwLmZvckVhY2goZnVuY3Rpb24obm9kZSkgewogICAgY29uc29sZS5sb2cobm9k
ZSk7Cn0pOwo8L3NjcmlwdD4=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>216410</attachid>
            <date>2013-11-08 10:42:05 -0800</date>
            <delta_ts>2013-11-08 11:10:01 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-124017-20131108104204.patch</filename>
            <type>text/plain</type>
            <size>5527</size>
            <attacher name="Oliver Hunt">oliver</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTU4ODc1CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw
dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA4
NDdlMjczNTAwZWMxYmQ3Nzg4NWIxY2M2NDkwNjU2NmI5MWUwZTM2Li5hZWEzODcxM2E5M2UzNTg0
YzRiY2NkODc0ODdmYmYwMzA3YWRmNWJkIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv
cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs
MyArMSwyMCBAQAorMjAxMy0xMS0wOCAgT2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUuY29tPgor
CisgICAgICAgIE1hcC5mb3JFYWNoIGNyYXNoZXMgb24gZGVsZXRlZCB2YWx1ZXMKKyAgICAgICAg
aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEyNDAxNworCisgICAgICAg
IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE1hcERhdGEgaXRlcmF0b3Ig
ZGlkIG5vdCBjb25zaWRlciB0aGUgY2FzZSBvZiB0aGUgZmlyc3QgZW50cmllcworICAgICAgICBi
ZWluZyBob2xlcy4gIFRvIGZpeCB0aGlzIEkndmUgcmVmYWN0b3JlZCBpdGVyYXRpb24gc28gdGhh
dCB3ZQorICAgICAgICBjYW4gcGVyZm9ybSBhbiBpbml0aWFsaXNhdGlvbiBpbmNyZW1lbnQgb24g
Y29uc3RydWN0aW9uLCB3aGxlCisgICAgICAgIHJldGFpbmluZyB0aGUgdXNlZnVsIGFzc2VydGlv
biBpbiBNYXBEYXRhOjpjb25zdF9pdGVyYXRvcjo6b3BlcmF0b3IrKworCisgICAgICAgICogcnVu
dGltZS9NYXBEYXRhLmg6CisgICAgICAgIChKU0M6Ok1hcERhdGE6OmNvbnN0X2l0ZXJhdG9yOjpv
cGVyYXRvcisrKToKKyAgICAgICAgKEpTQzo6TWFwRGF0YTo6Y29uc3RfaXRlcmF0b3I6OmludGVy
bmFsSW5jcmVtZW50KToKKyAgICAgICAgKEpTQzo6TWFwRGF0YTo6Y29uc3RfaXRlcmF0b3I6OmNv
bnN0X2l0ZXJhdG9yKToKKwogMjAxMy0xMS0wNyAgT2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUu
Y29tPgogCiAgICAgICAgIFJlcHJvZHVjaWJsZSBjcmFzaCB3aGVuIHVzaW5nIE1hcCAoYWZmZWN0
cyBXZWIgSW5zcGVjdG9yKQpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRp
bWUvTWFwRGF0YS5oIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvTWFwRGF0YS5oCmlu
ZGV4IDhiOTY0MDhkYzVkOWRjYzUzMTk1MmMyZWNiNzBiOGQ5ZmYwOGNjNTAuLjRhMzBlYWFmMWZl
NzE3Y2VjM2ZlMGJjZGZlMTRmOTU5N2EyNjVlYWUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2Ny
aXB0Q29yZS9ydW50aW1lL01hcERhdGEuaAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVu
dGltZS9NYXBEYXRhLmgKQEAgLTQ0LDcgKzQ0LDcgQEAgcHVibGljOgogICAgICAgICBjb25zdCBX
VEY6OktleVZhbHVlUGFpcjxKU1ZhbHVlLCBKU1ZhbHVlPiBvcGVyYXRvciooKSBjb25zdDsKICAg
ICAgICAgSlNWYWx1ZSBrZXkoKSBjb25zdCB7IEFTU0VSVCghYXRFbmQoKSk7IHJldHVybiBtX21h
cERhdGEtPm1fZW50cmllc1ttX2luZGV4XS5rZXkuZ2V0KCk7IH0KICAgICAgICAgSlNWYWx1ZSB2
YWx1ZSgpIGNvbnN0IHsgQVNTRVJUKCFhdEVuZCgpKTsgcmV0dXJuIG1fbWFwRGF0YS0+bV9lbnRy
aWVzW21faW5kZXhdLnZhbHVlLmdldCgpOyB9Ci0gICAgICAgIHZvaWQgb3BlcmF0b3IrKygpOwor
ICAgICAgICB2b2lkIG9wZXJhdG9yKysoKSB7IEFTU0VSVCghYXRFbmQoKSk7IGludGVybmFsSW5j
cmVtZW50KCk7IH0KICAgICAgICAgc3RhdGljIGNvbnN0X2l0ZXJhdG9yIGVuZChjb25zdCBNYXBE
YXRhKik7CiAgICAgICAgIGJvb2wgb3BlcmF0b3IhPShjb25zdCBjb25zdF9pdGVyYXRvciYgb3Ro
ZXIpOwogICAgICAgICBib29sIG9wZXJhdG9yPT0oY29uc3QgY29uc3RfaXRlcmF0b3ImIG90aGVy
KTsKQEAgLTU2LDYgKzU2LDcgQEAgcHVibGljOgogICAgICAgICAvLyBXZSBuZWVkIHRoaXMgaW4g
b3JkZXIgdG8ga2VlcCB0aGUgY29tbW9uIGNhc2UgKGVnLiBpdGVyICE9IGVuZCgpKQogICAgICAg
ICAvLyBmYXN0LgogICAgICAgICBib29sIGF0RW5kKCkgY29uc3QgeyByZXR1cm4gc3RhdGljX2Nh
c3Q8c2l6ZV90PihtX2luZGV4KSA+PSBzdGF0aWNfY2FzdDxzaXplX3Q+KG1fbWFwRGF0YS0+bV9z
aXplKTsgfQorICAgICAgICB2b2lkIGludGVybmFsSW5jcmVtZW50KCk7CiAgICAgICAgIGNvbnN0
IE1hcERhdGEqIG1fbWFwRGF0YTsKICAgICAgICAgaW50MzJfdCBtX2luZGV4OwogICAgIH07CkBA
IC0xNjYsOSArMTY3LDggQEAgQUxXQVlTX0lOTElORSBNYXBEYXRhOjpLZXlUeXBlOjpLZXlUeXBl
KEpTVmFsdWUgdikKICAgICAgICAgdmFsdWUgPSBqc051bWJlcihpKTsKIH0KIAotQUxXQVlTX0lO
TElORSB2b2lkIE1hcERhdGE6OmNvbnN0X2l0ZXJhdG9yOjpvcGVyYXRvcisrKCkKK0FMV0FZU19J
TkxJTkUgdm9pZCBNYXBEYXRhOjpjb25zdF9pdGVyYXRvcjo6aW50ZXJuYWxJbmNyZW1lbnQoKQog
ewotICAgIEFTU0VSVCghYXRFbmQoKSk7CiAgICAgRW50cnkqIGVudHJpZXMgPSBtX21hcERhdGEt
Pm1fZW50cmllczsKICAgICBzaXplX3QgaW5kZXggPSBtX2luZGV4ICsgMTsKICAgICBzaXplX3Qg
ZW5kID0gbV9tYXBEYXRhLT5tX3NpemU7CkBAIC0xNzksOSArMTc5LDkgQEAgQUxXQVlTX0lOTElO
RSB2b2lkIE1hcERhdGE6OmNvbnN0X2l0ZXJhdG9yOjpvcGVyYXRvcisrKCkKIAogQUxXQVlTX0lO
TElORSBNYXBEYXRhOjpjb25zdF9pdGVyYXRvcjo6Y29uc3RfaXRlcmF0b3IoY29uc3QgTWFwRGF0
YSogbWFwRGF0YSkKICAgICA6IG1fbWFwRGF0YShtYXBEYXRhKQotICAgICwgbV9pbmRleCgwKQor
ICAgICwgbV9pbmRleCgtMSkKIHsKLSAgICBtX21hcERhdGEtPm1faXRlcmF0b3JDb3VudCsrOwor
ICAgIGludGVybmFsSW5jcmVtZW50KCk7CiB9CiAKIEFMV0FZU19JTkxJTkUgTWFwRGF0YTo6Y29u
c3RfaXRlcmF0b3I6On5jb25zdF9pdGVyYXRvcigpCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9D
aGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggN2U0YmMyOGEwYTQwM2YyYjQ3
ZDFiMWRkZjZkZWZhYTYxMjFlNzAwYS4uMDU3NjY4MjE0OGU5OTQ5YjA0MjZlZGMzMWRlZDY1NjM0
MWZhNmUzOCAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRl
c3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDEzLTExLTA4ICBPbGl2ZXIgSHVudCAg
PG9saXZlckBhcHBsZS5jb20+CisKKyAgICAgICAgTWFwLmZvckVhY2ggY3Jhc2hlcyBvbiBkZWxl
dGVkIHZhbHVlcworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/
aWQ9MTI0MDE3CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg
ICAgVGVzdCBjYXNlCisKKyAgICAgICAgKiBqcy9tYXAtaXRlcmF0ZS1maXJzdC1lbnRyeS1pcy1h
LWhvbGUtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBqcy9tYXAtaXRlcmF0ZS1maXJz
dC1lbnRyeS1pcy1hLWhvbGUuaHRtbDogQWRkZWQuCisgICAgICAgICoganMvc2NyaXB0LXRlc3Rz
L21hcC1pdGVyYXRlLWZpcnN0LWVudHJ5LWlzLWEtaG9sZS5qczogQWRkZWQuCisgICAgICAgIChz
ZXQgbWFwMCk6CisKIDIwMTMtMTEtMDcgIE9saXZlciBIdW50ICA8b2xpdmVyQGFwcGxlLmNvbT4K
IAogICAgICAgICBSZXByb2R1Y2libGUgY3Jhc2ggd2hlbiB1c2luZyBNYXAgKGFmZmVjdHMgV2Vi
IEluc3BlY3RvcikKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2pzL21hcC1pdGVyYXRlLWZpcnN0
LWVudHJ5LWlzLWEtaG9sZS1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9qcy9tYXAtaXRlcmF0
ZS1maXJzdC1lbnRyeS1pcy1hLWhvbGUtZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0
CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLmIzYjFjZjVj
YTUzMGY0MWIzYzZkOGRhYmZiZTA1NmRkYmY4MTJiMTcKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlv
dXRUZXN0cy9qcy9tYXAtaXRlcmF0ZS1maXJzdC1lbnRyeS1pcy1hLWhvbGUtZXhwZWN0ZWQudHh0
CkBAIC0wLDAgKzEsOSBAQAorVGVzdHMgdG8gbWFrZSBzdXJlIHdlIGNvcnJlY3RseSBoYW5kbGUg
aXRlcmF0aW5nIGEgbWFwIHdoZW4gdGhlIGZpcnN0IGVudHJ5IGlzIGEgaG9sZQorCitPbiBzdWNj
ZXNzLCB5b3Ugd2lsbCBzZWUgYSBzZXJpZXMgb2YgIlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dlZCBi
eSAiVEVTVCBDT01QTEVURSIuCisKKworUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQgaXMgdHJ1ZQor
CitURVNUIENPTVBMRVRFCisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2pzL21hcC1pdGVyYXRl
LWZpcnN0LWVudHJ5LWlzLWEtaG9sZS5odG1sIGIvTGF5b3V0VGVzdHMvanMvbWFwLWl0ZXJhdGUt
Zmlyc3QtZW50cnktaXMtYS1ob2xlLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uMjA1ZmQwOWI5ODM2NjI0YTkz
NzQ2Mjc4OTRjMjZjNGE0NTE1M2ViNwotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2pz
L21hcC1pdGVyYXRlLWZpcnN0LWVudHJ5LWlzLWEtaG9sZS5odG1sCkBAIC0wLDAgKzEsMTAgQEAK
KzwhRE9DVFlQRSBIVE1MIFBVQkxJQyAiLS8vSUVURi8vRFREIEhUTUwvL0VOIj4KKzxodG1sPgor
PGhlYWQ+Cis8c2NyaXB0IHNyYz0iLi4vcmVzb3VyY2VzL2pzLXRlc3QtcHJlLmpzIj48L3Njcmlw
dD4KKzwvaGVhZD4KKzxib2R5PgorPHNjcmlwdCBzcmM9InNjcmlwdC10ZXN0cy9tYXAtaXRlcmF0
ZS1maXJzdC1lbnRyeS1pcy1hLWhvbGUuanMiPjwvc2NyaXB0PgorPHNjcmlwdCBzcmM9Ii4uL3Jl
c291cmNlcy9qcy10ZXN0LXBvc3QuanMiPjwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgpkaWZm
IC0tZ2l0IGEvTGF5b3V0VGVzdHMvanMvc2NyaXB0LXRlc3RzL21hcC1pdGVyYXRlLWZpcnN0LWVu
dHJ5LWlzLWEtaG9sZS5qcyBiL0xheW91dFRlc3RzL2pzL3NjcmlwdC10ZXN0cy9tYXAtaXRlcmF0
ZS1maXJzdC1lbnRyeS1pcy1hLWhvbGUuanMKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uMDE1ZGYyZGZkYTRmYjdlYTdl
MDI5NjU5MmViNWVmNjdlNWNiNjVkZgotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2pz
L3NjcmlwdC10ZXN0cy9tYXAtaXRlcmF0ZS1maXJzdC1lbnRyeS1pcy1hLWhvbGUuanMKQEAgLTAs
MCArMSw3IEBACitkZXNjcmlwdGlvbigiVGVzdHMgdG8gbWFrZSBzdXJlIHdlIGNvcnJlY3RseSBo
YW5kbGUgaXRlcmF0aW5nIGEgbWFwIHdoZW4gdGhlIGZpcnN0IGVudHJ5IGlzIGEgaG9sZSIpOwor
dmFyIG1hcDA9IG5ldyBNYXA7CittYXAwLnNldCgxMjUsIHt9KTsKK21hcDAuZGVsZXRlKDEyNSk7
CittYXAwLmZvckVhY2goZnVuY3Rpb24obm9kZSkgeworICAgIHByaW50KG5vZGUpOworfSk7Cg==
</data>
<flag name="review"
          id="239375"
          type_id="1"
          status="+"
          setter="rniwa"
    />
          </attachment>
      

    </bug>

</bugzilla>