Fix Map::AsArray to properly iterate over the backing store

test/cctest/test-api.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 24606 matching lines @@
   set->Clear();
   CHECK_EQ(0U, set->Size());
 }
 
 TEST(SetDeleteThenAsArray) {
   // https://bugs.chromium.org/p/v8/issues/detail?id=4946
   v8::Isolate* isolate = CcTest::isolate();
   v8::HandleScope handle_scope(isolate);
   LocalContext env;
 
-  // make an array
+  // make a Set
   v8::Local<v8::Value> val = CompileRun("new Set([1, 2, 3])");
   v8::Local<v8::Set> set = v8::Local<v8::Set>::Cast(val);
   CHECK_EQ(3U, set->Size());
 
   // delete the "middle" element (using AsArray to
   // determine which element is the "middle" element)
   v8::Local<v8::Array> array1 = set->AsArray();
   CHECK_EQ(3U, array1->Length());
   CHECK(set->Delete(env.local(), array1->Get(env.local(), 1).ToLocalChecked())
             .FromJust());
 
   // make sure there are no undefined values when we convert to an array again.
   v8::Local<v8::Array> array2 = set->AsArray();
   uint32_t length = array2->Length();
   CHECK_EQ(2U, length);
   for (uint32_t i = 0; i < length; i++) {
     CHECK(!array2->Get(env.local(), i).ToLocalChecked()->IsUndefined());
   }
 }
 
+TEST(MapDeleteThenAsArray) {
+  // https://bugs.chromium.org/p/v8/issues/detail?id=4946
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope handle_scope(isolate);
+  LocalContext env;
+
+  // make a Map
+  v8::Local<v8::Value> val = CompileRun("new Map([[1, 2], [3, 4], [5, 6]])");
+  v8::Local<v8::Map> map = v8::Local<v8::Map>::Cast(val);
+  CHECK_EQ(3U, map->Size());
+
+  // delete the "middle" element (using AsArray to
+  // determine which element is the "middle" element)
+  v8::Local<v8::Array> array1 = map->AsArray();
+  CHECK_EQ(6U, array1->Length());
+  // Map::AsArray returns a flat array, so the second key is at index 2.
+  v8::Local<v8::Value> key = array1->Get(env.local(), 2).ToLocalChecked();
+  CHECK(map->Delete(env.local(), key).FromJust());
+
+  // make sure there are no undefined values when we convert to an array again.
+  v8::Local<v8::Array> array2 = map->AsArray();
+  uint32_t length = array2->Length();
+  CHECK_EQ(4U, length);
+  for (uint32_t i = 0; i < length; i++) {
+    CHECK(!array2->Get(env.local(), i).ToLocalChecked()->IsUndefined());
+  }
+}
+
 TEST(CompatibleReceiverCheckOnCachedICHandler) {
   v8::Isolate* isolate = CcTest::isolate();
   v8::HandleScope scope(isolate);
   v8::Local<v8::FunctionTemplate> parent = FunctionTemplate::New(isolate);
   v8::Local<v8::Signature> signature = v8::Signature::New(isolate, parent);
   auto returns_42 =
       v8::FunctionTemplate::New(isolate, Returns42, Local<Value>(), signature);
   parent->PrototypeTemplate()->SetAccessorProperty(v8_str("age"), returns_42);
   v8::Local<v8::FunctionTemplate> child = v8::FunctionTemplate::New(isolate);
   child->Inherit(parent);
@@ skipping 375 matching lines @@
 }
 
 TEST(PrivateForApiIsNumber) {
   LocalContext context;
   v8::Isolate* isolate = CcTest::isolate();
   v8::HandleScope scope(isolate);
 
   // Shouldn't crash.
   v8::Private::ForApi(isolate, v8_str("42"));
 }