Bug 124017

Summary: Map.forEach crashes on deleted values
Product: WebKit Reporter: Alexandru Chiculita <achicu>
Component: JavaScriptCoreAssignee: Oliver Hunt <oliver>
Status: RESOLVED FIXED    
Severity: Normal CC: joepeck, oliver
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Test case
none
Patch rniwa: review+

Description Alexandru Chiculita 2013-11-07 15:39:32 PST
Created attachment 216338 [details]
Test case

Crash when using Map.forEach after deleting a value from the map. See the attached test case.
Comment 1 Oliver Hunt 2013-11-07 20:34:13 PST
Yeah, need to work out why the iterator is going wrong. :(
Comment 2 Oliver Hunt 2013-11-08 10:42:05 PST
Created attachment 216410 [details]
Patch
Comment 3 Oliver Hunt 2013-11-08 10:45:25 PST
Committed r158929: <http://trac.webkit.org/changeset/158929>
Comment 4 Joseph Pecoraro 2013-11-08 11:10:01 PST
Comment on attachment 216410 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=216410&action=review

> Source/JavaScriptCore/ChangeLog:10
> +        can perform an initialisation increment on construction, whle

Typo: "whle" => "while"