Bug 129993

Summary: Completed iterator can be revived by adding more than one new entry to the target object
Product: WebKit Reporter: Oliver Hunt <oliver>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, dpino, ggaren, oliver, webkit-bug-importer
Priority: P2 Keywords: EasyFix, InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch none

Description Oliver Hunt 2014-03-09 13:05:03 PDT 
map = new Map
map.set(1,"foo")
keys = map.keys()
for (key of keys) ;
map.set(2, "bar")
map.set(3, "wibble")
for (key of keys) alert(key) // incorrectly shows 3

iterator spec says that a dead iterator has to remain dead.
Comment 1 Diego Pino 2014-08-17 03:12:52 PDT 
Created attachment 236728 [details]
Patch
Comment 2 Radar WebKit Bug Importer 2014-08-17 03:13:05 PDT 
<rdar://problem/18043281>
Comment 3 Oliver Hunt 2014-08-17 21:49:17 PDT 
Comment on attachment 236728 [details]
Patch

whoops, cq- needs a testcase
Comment 4 Diego Pino 2014-08-18 00:34:42 PDT 
Created attachment 236744 [details]
Patch
Comment 5 Diego Pino 2014-08-18 00:35:43 PDT 
Test cases added for Map and Set iterators. PTAL.
Comment 6 WebKit Commit Bot 2014-08-18 10:08:38 PDT 
Comment on attachment 236744 [details]
Patch

Clearing flags on attachment: 236744

Committed r172707: <http://trac.webkit.org/changeset/172707>
Comment 7 WebKit Commit Bot 2014-08-18 10:08:41 PDT 
All reviewed patches have been landed.  Closing bug.