PropertyTable supports C++ iteration by offering begin() and end() methods, and an iterator class. The begin() methods and the iterator operator++() method uses PropertyTable::skipDeletedEntries() to skip over deleted entries in the table. However, PropertyTable::skipDeletedEntries() does not prevent the iteration pointer from being incremented past the end of the table. As a result, we can iterate past the end of the table. Note that the C++ iteration protocol tests for the iterator not being equal to the end() value. It does not do a <= test. If the iterator ever shoots past end, the loop will effectively not terminate. This issue can manifest if and only if the last entry in the table is a deleted one. <rdar://problem/41282849>
Created attachment 344540 [details] proposed patch.
Created attachment 344541 [details] proposed patch.
Comment on attachment 344541 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=344541&action=review > Source/JavaScriptCore/ChangeLog:18 > + This issue can manifest if and only if the last entry in the table is a deleted Crazy
Comment on attachment 344541 [details] proposed patch. Thanks for the review. Landing.
Comment on attachment 344541 [details] proposed patch. Clearing flags on attachment: 344541 Committed r233625: <https://trac.webkit.org/changeset/233625>
All reviewed patches have been landed. Closing bug.