Jacek Caban (@jacek) commented about dlls/jscript/dispex.c:
}
/* Grab it since it gets removed when unlinked */
jsdisp_addref(obj);
unlink_props(obj);
if(obj->prototype) {
jsdisp_release(obj->prototype);
obj->prototype = NULL;
}
if(obj->builtin_info->gc_traverse)
obj->builtin_info->gc_traverse(obj, GC_TRAVERSE_UNLINK, NULL);
/* Unlinking possibly removed the next object from the list */
iter = list_next(&ctx->objects, iter);
How releasing iter object, which is already unlinked, can modify the list other than removing itself?