Bug 124017 - Map.forEach crashes on deleted values
Summary: Map.forEach crashes on deleted values
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Oliver Hunt
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-11-07 15:39 PST by Alexandru Chiculita
Modified: 2013-11-08 11:10 PST (History)
2 users (show)

See Also:


Attachments
Test case (131 bytes, text/html)
2013-11-07 15:39 PST, Alexandru Chiculita
no flags Details
Patch (5.40 KB, patch)
2013-11-08 10:42 PST, Oliver Hunt
rniwa: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandru Chiculita 2013-11-07 15:39:32 PST
Created attachment 216338 [details]
Test case

Crash when using Map.forEach after deleting a value from the map. See the attached test case.
Comment 1 Oliver Hunt 2013-11-07 20:34:13 PST
Yeah, need to work out why the iterator is going wrong. :(
Comment 2 Oliver Hunt 2013-11-08 10:42:05 PST
Created attachment 216410 [details]
Patch
Comment 3 Oliver Hunt 2013-11-08 10:45:25 PST
Committed r158929: <http://trac.webkit.org/changeset/158929>
Comment 4 Joseph Pecoraro 2013-11-08 11:10:01 PST
Comment on attachment 216410 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=216410&action=review

> Source/JavaScriptCore/ChangeLog:10
> +        can perform an initialisation increment on construction, whle

Typo: "whle" => "while"