Hash iterators: Check for concurrent modification and fix 1 place where it happened

Source/core/page/HistoryController.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
@@ skipping 65 matching lines @@
         m_entry->m_framesToItems.add(frameID, this);
     String target = value->target();
     if (target.isNull())
         target = emptyString();
     m_entry->m_uniqueNamesToItems.add(target, this);
 }
 
 void HistoryNode::removeChildren()
 {
     // FIXME: This is inefficient. Figure out a cleaner way to ensure this HistoryNode isn't cached anywhere.
+    // We need these vectors because you can't remove things from
+    // collections you are iterating over.
+    Vector<uint64_t, 10> framesToRemove;
+    Vector<String, 10> uniqueNamesToRemove;
     for (unsigned i = 0; i < m_children.size(); i++) {
         m_children[i]->removeChildren();
 
         HashMap<uint64_t, HistoryNode*>::iterator framesEnd = m_entry->m_framesToItems.end();
         HashMap<String, HistoryNode*>::iterator uniqueNamesEnd = m_entry->m_uniqueNamesToItems.end();
         for (HashMap<uint64_t, HistoryNode*>::iterator it = m_entry->m_framesToItems.begin(); it != framesEnd; ++it) {
             if (it->value == m_children[i])
-                m_entry->m_framesToItems.remove(it);
+                framesToRemove.append(it->key);
         }
         for (HashMap<String, HistoryNode*>::iterator it = m_entry->m_uniqueNamesToItems.begin(); it != uniqueNamesEnd; ++it) {
             if (it->value == m_children[i])
-                m_entry->m_uniqueNamesToItems.remove(it);
+                uniqueNamesToRemove.append(it->key);
         }
     }
+    for (unsigned i = 0; i < framesToRemove.size(); i++)
+        m_entry->m_framesToItems.remove(framesToRemove[i]);
+    for (unsigned i = 0; i < uniqueNamesToRemove.size(); i++)
+        m_entry->m_uniqueNamesToItems.remove(uniqueNamesToRemove[i]);
     m_children.clear();
 }
 
 HistoryEntry::HistoryEntry(HistoryItem* root, int64_t frameID)
 {
     m_root = HistoryNode::create(this, root, frameID);
 }
 
 PassOwnPtr<HistoryEntry> HistoryEntry::create(HistoryItem* root, int64_t frameID)
 {
@@ skipping 187 matching lines @@
     } else {
         HistoryItem* oldItem = m_currentEntry->itemForFrame(targetFrame);
         if (!clipAtTarget && oldItem)
             newItem->setDocumentSequenceNumber(oldItem->documentSequenceNumber());
         m_previousEntry = m_currentEntry.release();
         m_currentEntry = m_previousEntry->cloneAndReplace(newItem.get(), clipAtTarget, targetFrame, m_page);
     }
 }
 
 } // namespace WebCore