Bug 124017

Summary: Map.forEach crashes on deleted values
Product: WebKit Reporter: Alexandru Chiculita <achicu>
Component: JavaScriptCoreAssignee: Oliver Hunt <oliver>
Status: RESOLVED FIXED    
Severity: Normal CC: joepeck, oliver
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Test case
none
Patch rniwa: review+

Alexandru Chiculita
Reported 2013-11-07 15:39:32 PST
Created attachment 216338 [details] Test case Crash when using Map.forEach after deleting a value from the map. See the attached test case.
Attachments
Test case (131 bytes, text/html)
2013-11-07 15:39 PST, Alexandru Chiculita 		no flags
Details
Patch (5.40 KB, patch)
2013-11-08 10:42 PST, Oliver Hunt 		rniwa: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Oliver Hunt
Comment 1 2013-11-07 20:34:13 PST
Yeah, need to work out why the iterator is going wrong. :(
Oliver Hunt
Comment 2 2013-11-08 10:42:05 PST
Created attachment 216410 [details] Patch
Oliver Hunt
Comment 3 2013-11-08 10:45:25 PST
Committed r158929: <http://trac.webkit.org/changeset/158929>
Joseph Pecoraro
Comment 4 2013-11-08 11:10:01 PST
Comment on attachment 216410 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=216410&action=review > Source/JavaScriptCore/ChangeLog:10 > + can perform an initialisation increment on construction, whle Typo: "whle" => "while"
Note You need to log in before you can comment on or make changes to this bug.