<html>

    <head>

      <base href="https://bugs.webkit.org/" />

    </head>

    <body><table border="1" cellspacing="0" cellpadding="8">

        <tr>

          <th>Bug ID</th>

          <td><a class="bz_bug_link 

          bz_status_NEW "

   title="NEW - Iterator loops over key twice after delete"

   href="https://bugs.webkit.org/show_bug.cgi?id=149811">149811</a>

          </td>

        </tr>

        <tr>

          <th>Summary</th>

          <td>Iterator loops over key twice after delete

          </td>

        </tr>

        <tr>

          <th>Classification</th>

          <td>Unclassified

          </td>

        </tr>

        <tr>

          <th>Product</th>

          <td>WebKit

          </td>

        </tr>

        <tr>

          <th>Version</th>

          <td>WebKit Nightly Build

          </td>

        </tr>

        <tr>

          <th>Hardware</th>

          <td>All

          </td>

        </tr>

        <tr>

          <th>OS</th>

          <td>Unspecified

          </td>

        </tr>

        <tr>

          <th>Status</th>

          <td>NEW

          </td>

        </tr>

        <tr>

          <th>Severity</th>

          <td>Critical

          </td>

        </tr>

        <tr>

          <th>Priority</th>

          <td>P2

          </td>

        </tr>

        <tr>

          <th>Component</th>

          <td>JavaScriptCore

          </td>

        </tr>

        <tr>

          <th>Assignee</th>

          <td>webkit-unassigned&#64;lists.webkit.org

          </td>

        </tr>

        <tr>

          <th>Reporter</th>

          <td>timon&#64;orawski.com

          </td>

        </tr></table>

      <p>

        <div>

        <pre>Created <span class=""><a href="attachment.cgi?id=262446" name="attach_262446" title="reproducible test case">attachment 262446</a> <a href="attachment.cgi?id=262446&amp;action=edit" title="reproducible test case">[details]</a></span>

reproducible test case

The following code iterates twice over the key &quot;0&quot; in the object cols - despite it only existing in the object once.

&lt;html&gt;

&lt;head&gt;

&lt;script&gt;

var f = function() {

    &quot;use strict&quot;;

    var cols = {&quot;col&quot;:{&quot;title&quot;:&quot;&amp;nbsp;&quot;,&quot;type&quot;:&quot;sys&quot;,&quot;events&quot;:[],&quot;name&quot;:0,&quot;id&quot;:0,&quot;_i&quot;:0}};

    var len = 0;

    var remapcols = ['col'];

    for (var i = 0; i &lt; remapcols.length; i++) {

        cols[cols[remapcols[i]].name] = cols[remapcols[i]];

        delete cols[remapcols[i]];

    }

    var count = 0;

    console.group(&quot;object:&quot;)

    console.log(cols);

    console.groupEnd();

    console.group(&quot;This group should only contain one line&quot;);

    for (var col2 in cols) { console.log(&quot;&quot; + count++ +&quot;: Iterating over key: &quot; + col2); }

    console.groupEnd();

};

f();&lt;/script&gt;

&lt;/head&gt;

&lt;body&gt;

Check console log, expected output is a single log entry &quot;0: Iterating over key: 0&quot;

&lt;/body&gt;

&lt;/html&gt;</pre>

        </div>

      </p>

      <hr>

      <span>You are receiving this mail because:</span>

      <ul>

          <li>You are the assignee for the bug.</li>

      </ul>

    </body>

</html>