Skip to content
  • oliver@apple.com's avatar
    Map.forEach crashes on deleted values · 8eb44c70
    oliver@apple.com authored
    https://bugs.webkit.org/show_bug.cgi?id=124017
    
    Reviewed by Ryosuke Niwa.
    
    Source/JavaScriptCore:
    
    MapData iterator did not consider the case of the first entries
    being holes.  To fix this I've refactored iteration so that we
    can perform an initialisation increment on construction, whle
    retaining the useful assertion in MapData::const_iterator::operator++
    
    * runtime/MapData.h:
    (JSC::MapData::const_iterator::operator++):
    (JSC::MapData::const_iterator::internalIncrement):
    (JSC::MapData::const_iterator::const_iterator):
    
    LayoutTests:
    
    Test case
    
    * js/map-iterate-first-entry-is-a-hole-expected.txt: Added.
    * js/map-iterate-first-entry-is-a-hole.html: Added.
    * js/script-tests/map-iterate-first-entry-is-a-hole.js: Added.
    (set map0):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158929 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    8eb44c70