Jacek Caban (@jacek) commented about dlls/jscript/set.c:
+} + +static HRESULT WeakMap_value(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsigned argc, jsval_t *argv, + jsval_t *r) +{ + FIXME("\n"); + return E_NOTIMPL; +} + +static void WeakMap_destructor(jsdisp_t *dispex) +{ + WeakMapInstance *weakmap = (WeakMapInstance*)dispex; + struct weakmap_entry *entry, *entry2; + + RB_FOR_EACH_ENTRY_DESTRUCTOR(entry, entry2, &weakmap->map, struct weakmap_entry, entry) + release_weakmap_entry(entry); `release_weakmap_entry` calls `jsval_release` which may free any other map entry, including entry2. You could, for example, keep removing root until map is empty instead.
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/3300#note_39261