Fix bug in iteration over DelaySet.

runtime/vm/gc_marker.cc

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/gc_marker.h"
 
 #include <map>
 #include <utility>
+#include <vector>
 
 #include "vm/allocation.h"
 #include "vm/dart_api_state.h"
 #include "vm/isolate.h"
 #include "vm/pages.h"
 #include "vm/raw_object.h"
 #include "vm/stack_frame.h"
 #include "vm/visitor.h"
 #include "vm/object_id_ring.h"
 
@@ skipping 167 matching lines @@
 
     // Mark the object and push it on the marking stack.
     ASSERT(!raw_obj->IsMarked());
     RawClass* raw_class = isolate()->class_table()->At(raw_obj->GetClassId());
     raw_obj->SetMarkBit();
     raw_obj->ClearRememberedBit();
     if (raw_obj->IsWatched()) {
       std::pair<DelaySet::iterator, DelaySet::iterator> ret;
       // Visit all elements with a key equal to raw_obj.
       ret = delay_set_.equal_range(raw_obj);
-      for (DelaySet::iterator it = ret.first; it != ret.second; ++it) {
+      // Create a copy of the range in a temporary vector to iterate over it
+      // while delay_set_ may be modified.
+      std::vector<DelaySetEntry> temp_copy(ret.first, ret.second);
+      delay_set_.erase(ret.first, ret.second);
+      for (std::vector<DelaySetEntry>::iterator it = temp_copy.begin();
+           it != temp_copy.end(); ++it) {
         it->second->VisitPointers(this);
       }
-      delay_set_.erase(ret.first, ret.second);
       raw_obj->ClearWatchedBit();
     }
     marking_stack_->Push(raw_obj);
 
     // TODO(iposva): Should we mark the classes early?
     MarkObject(raw_class, NULL);
   }
 
   void MarkObject(RawObject* raw_obj, RawObject** p) {
     // Fast exit if the raw object is a Smi.
@@ skipping 51 matching lines @@
     }
   }
 
   Heap* heap_;
   Heap* vm_heap_;
   ClassTable* class_table_;
   PageSpace* page_space_;
   MarkingStack* marking_stack_;
   RawObject* visiting_old_object_;
   typedef std::multimap<RawObject*, RawWeakProperty*> DelaySet;
+  typedef std::pair<RawObject*, RawWeakProperty*> DelaySetEntry;
   DelaySet delay_set_;
   const bool visit_function_code_;
   GrowableArray<RawFunction*> skipped_code_functions_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(MarkingVisitor);
 };
 
 
 bool IsUnreachable(const RawObject* raw_obj) {
   if (!raw_obj->IsHeapObject()) {
@@ skipping 210 matching lines @@
   MarkingWeakVisitor mark_weak;
   IterateWeakRoots(isolate, &mark_weak, invoke_api_callbacks);
   mark.Finalize();
   ProcessWeakTables(page_space);
   ProcessObjectIdTable(isolate);
 
   Epilogue(isolate, invoke_api_callbacks);
 }
 
 }  // namespace dart