[Webkit-unassigned] [Bug 135879] New: iOS 8 beta 5 Set forEach sometimes triggers wrong number of times

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=135879

           Summary: iOS 8 beta 5 Set forEach sometimes triggers wrong
                    number of times
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: iOS
               URL: http://www.scirra.com/labs/bugs/sbtestbug2/
        OS/Version: Other
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: ashley at scirra.com


In our HTML5 game engine we use Sets when supported, and the latest iOS 8 betas have turned up a strange issue that does not happen in any other browser that supports Set: sometimes Set forEach will fire its callback a different number of times to the Set.size property.

I can only reproduce this in a real-world example of our engine, which is pretty complex: http://www.scirra.com/labs/bugs/sbtestbug2/

After about a minute or so, the game will alert a message like "Set forEach mismatch: iterated 7 times when Set size returns 6".

The code in question is below. ObjectSet_.update_cache aims to dump the contents of the Set in to the array this.values_cache.

var current_arr = null;
    var current_index = 0;

    function set_append_to_arr(x)
    {
        current_arr[current_index++] = x;
    };

    ObjectSet_.prototype.update_cache = function ()
    {
        if (this.cache_valid)
            return;

        if (supports_set)
        {
            this.values_cache.length = this.s["size"];

            current_arr = this.values_cache;
            current_index = 0;

            this.s["forEach"](set_append_to_arr);

            // CHECK FOR THE BUG
            if (current_index !== this.s["size"])
            {
                alert("Set forEach mismatch: iterated " + current_index + " times when Set size returns " + this.s["size"]);
            }

            current_arr = null;
            current_index = 0;
        }
        else
        {
            // (unrelated workaround when Set not supported)
        }

        // Cache now up to date
        this.cache_valid = true;
    };

I tried to reproduce this in a standalone example trying to emulate what our engine does, but it does not reproduce. For what it's worth, the example that appears to demonstrate everything working is here: http://www.scirra.com/labs/bugs/testsetforeach.html

I know it's difficult to investigate bugs without a standalone repro, but in this case I can't make one outside of the actual game engine, but it does reproduce every time here.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.