Fix bug in iteration over DelaySet.

runtime/vm/gc_marker.cc

Index: runtime/vm/gc_marker.cc
diff --git a/runtime/vm/gc_marker.cc b/runtime/vm/gc_marker.cc
index 13ab9acb27e958f1ba3e2eefacd70f1342d1e985..57ac9f4553ba744929614df178a97662eba14e7c 100644
--- a/runtime/vm/gc_marker.cc
+++ b/runtime/vm/gc_marker.cc
@@ -6,6 +6,7 @@
 
 #include <map>
 #include <utility>
+#include <vector>
 
 #include "vm/allocation.h"
 #include "vm/dart_api_state.h"
@@ -193,10 +194,14 @@ class MarkingVisitor : public ObjectPointerVisitor {
       std::pair<DelaySet::iterator, DelaySet::iterator> ret;
       // Visit all elements with a key equal to raw_obj.
       ret = delay_set_.equal_range(raw_obj);
-      for (DelaySet::iterator it = ret.first; it != ret.second; ++it) {
+      // Create a copy of the range in a temporary vector to iterate over it
+      // while delay_set_ may be modified.
+      std::vector<DelaySetEntry> temp_copy(ret.first, ret.second);
+      delay_set_.erase(ret.first, ret.second);
+      for (std::vector<DelaySetEntry>::iterator it = temp_copy.begin();
+           it != temp_copy.end(); ++it) {
         it->second->VisitPointers(this);
       }
-      delay_set_.erase(ret.first, ret.second);
       raw_obj->ClearWatchedBit();
     }
     marking_stack_->Push(raw_obj);
@@ -268,6 +273,7 @@ class MarkingVisitor : public ObjectPointerVisitor {
   MarkingStack* marking_stack_;
   RawObject* visiting_old_object_;
   typedef std::multimap<RawObject*, RawWeakProperty*> DelaySet;
+  typedef std::pair<RawObject*, RawWeakProperty*> DelaySetEntry;
   DelaySet delay_set_;
   const bool visit_function_code_;
   GrowableArray<RawFunction*> skipped_code_functions_;