From 2d1ad149c160f4442394d53f7bb8d71818bb442a Mon Sep 17 00:00:00 2001
From: Robert Fancsik <frobert@inf.u-szeged.hu>
Date: Wed, 8 May 2019 15:21:43 +0200
Subject: [PATCH] Fix key iteration in ecma_op_map_foreach (#2855)

This patch fixes #2852 and fixes #2853 as well.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
---
 jerry-core/ecma/operations/ecma-map-object.c  | 17 +++++++++--
 .../es2015/regression-test-issue-2852.js      | 29 +++++++++++++++++++
 .../es2015/regression-test-issue-2853.js      | 27 +++++++++++++++++
 3 files changed, 71 insertions(+), 2 deletions(-)
 create mode 100644 tests/jerry/es2015/regression-test-issue-2852.js
 create mode 100644 tests/jerry/es2015/regression-test-issue-2853.js

diff --git a/jerry-core/ecma/operations/ecma-map-object.c b/jerry-core/ecma/operations/ecma-map-object.c
index 32d3f973f..490b85675 100644
--- a/jerry-core/ecma/operations/ecma-map-object.c
+++ b/jerry-core/ecma/operations/ecma-map-object.c
@@ -377,7 +377,12 @@ ecma_op_map_foreach (ecma_value_t this_arg, /**< this argument */
   {
     ecma_string_t *prop_name_p = ecma_get_prop_name_from_value (*ecma_value_p);
     ecma_property_t *property_p = ecma_find_named_property (internal_obj_p, prop_name_p);
-    JERRY_ASSERT (property_p != NULL);
+
+    if (property_p == NULL)
+    {
+      ecma_value_p = ecma_collection_iterator_next (ecma_value_p);
+      continue;
+    }
 
     ecma_value_t value = ecma_copy_value (ECMA_PROPERTY_VALUE_PTR (property_p)->value);
     ecma_value_t key_arg;
@@ -388,7 +393,15 @@ ecma_op_map_foreach (ecma_value_t this_arg, /**< this argument */
     }
     else
     {
-      key_arg = *ecma_value_p;
+      if (ECMA_IS_DIRECT_STRING (prop_name_p)
+          && ECMA_GET_DIRECT_STRING_TYPE (prop_name_p) == ECMA_DIRECT_STRING_ECMA_INTEGER)
+      {
+        key_arg = ecma_make_uint32_value ((uint32_t) ECMA_GET_DIRECT_STRING_VALUE (prop_name_p));
+      }
+      else
+      {
+        key_arg = *ecma_value_p;
+      }
     }
 
     ecma_value_t call_args[] = { value, key_arg };
diff --git a/tests/jerry/es2015/regression-test-issue-2852.js b/tests/jerry/es2015/regression-test-issue-2852.js
new file mode 100644
index 000000000..839e804ec
--- /dev/null
+++ b/tests/jerry/es2015/regression-test-issue-2852.js
@@ -0,0 +1,29 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+function createMap (count) {
+  var map = new Map()
+  for (var i = 0; i < count; i++) {
+    map.set(i)
+  }
+  return map
+}
+
+var counter = 0;
+createMap(2000).forEach(function ($, key) {
+  counter++;
+  $ += key
+})
+
+assert(counter === 2000);
diff --git a/tests/jerry/es2015/regression-test-issue-2853.js b/tests/jerry/es2015/regression-test-issue-2853.js
new file mode 100644
index 000000000..cbb2d7f8e
--- /dev/null
+++ b/tests/jerry/es2015/regression-test-issue-2853.js
@@ -0,0 +1,27 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var map = new Map()
+map.set()
+map.set('bar')
+
+var count = 0
+map.forEach(function () {
+  if (count === 0) {
+    map.delete('bar')
+  }
+  count++;
+})
+
+assert(count === 1);