Fix infinite loop in NSCFDictionary/NSCFSet fast enumeration

ChangeLog

@@ -1,3 +1,13 @@
+2026-07-02  Rupert Daniel <rupert@algoriddim.com>
+	* Source/NSCFDictionary.m,
+	* Source/NSCFSet.m: Fix -countByEnumeratingWithState:objects:count:,
+	which created a fresh enumerator on every call so fast enumeration
+	never terminated.  Iterate the backing hash table directly, keeping
+	the resume position in the enumeration state.
+	* Source/GSHashTable.c,
+	* Source/GSHashTable.h: Add GSHashTableGetKeysFromCursor(), an
+	allocation-free resumable key iterator used by the above.
+
 2021-09-30  Frederik Seiffert <frederik@algoriddim.com>
 	* Source/CFDate.c: Fix logic in CFGregorianDateIsValid()
 

Source/GSHashTable.c

@@ -490,6 +490,25 @@ GSHashTableGetKeysAndValues (GSHashTableRef table, const void **keys,
     }
 }
 
+CFIndex
+GSHashTableGetKeysFromCursor (GSHashTableRef table, CFIndex *cursor,
+                              const void **keybuf, CFIndex bufSize)
+{
+  GSHashTableBucket *buckets = table->_buckets;
+  CFIndex capacity = table->_capacity;
+  CFIndex idx = *cursor;
+  CFIndex n = 0;
+
+  while (n < bufSize && idx < capacity)
+    {
+      if (buckets[idx].count > 0)
+        keybuf[n++] = buckets[idx].key;
+      ++idx;
+    }
+  *cursor = idx;
+  return n;
+}
+
 const void *
 GSHashTableGetValue (GSHashTableRef table, const void *key)
 {

Source/GSHashTable.h

@@ -114,6 +114,15 @@ GS_PRIVATE void
 GSHashTableGetKeysAndValues (GSHashTableRef table, const void **keys,
                              const void **values);
 
+/* Resumable key iterator.  Writes up to bufSize keys into keybuf starting at
+ * bucket *cursor, advances *cursor past them, and returns the number written
+ * (0 once the table is exhausted).  Reads live buckets in place and allocates
+ * nothing, so it is suitable as a fast-enumeration primitive.
+ */
+GS_PRIVATE CFIndex
+GSHashTableGetKeysFromCursor (GSHashTableRef table, CFIndex *cursor,
+                              const void **keybuf, CFIndex bufSize);
+
 GS_PRIVATE const void *GSHashTableGetValue (GSHashTableRef table,
                                           const void *key);
 

Source/NSCFDictionary.m

@@ -29,6 +29,7 @@
 
 #include "NSCFType.h"
 #include "CoreFoundation/CFDictionary.h"
+#include "GSHashTable.h"
 
 @interface NSCFDictionary : NSMutableDictionary
 NSCFTYPE_VARS
@@ -136,11 +137,18 @@ - (NSUInteger) countByEnumeratingWithState: (NSFastEnumerationState*)state
                                    objects: (id[])stackbuf
                                      count: (NSUInteger)len
 {
-  NSEnumerator *enuM = [self keyEnumerator];
-
-  return [enuM countByEnumeratingWithState: state
-                                   objects: stackbuf
-                                     count: len];
+  /* Walk the buckets across calls, keeping the resume position in extra[0].
+   * Reading keys in place needs no per-call allocation, and returning 0 when
+   * exhausted ends the enumeration. */
+  CFIndex cursor = (state->state == 0) ? 0 : (CFIndex) state->extra[0];
+  CFIndex n = GSHashTableGetKeysFromCursor ((GSHashTableRef) self, &cursor,
+                                            (const void **) stackbuf,
+                                            (CFIndex) len);
+  state->extra[0] = (unsigned long) cursor;
+  state->itemsPtr = stackbuf;
+  state->mutationsPtr = (unsigned long *) self;
+  state->state += n;
+  return n;
 }
 
 - (void) setObject: anObject forKey: (id)aKey

Source/NSCFSet.m

@@ -29,6 +29,7 @@
 
 #include "NSCFType.h"
 #include "CoreFoundation/CFSet.h"
+#include "GSHashTable.h"
 
 @interface NSCFSet : NSMutableSet
 NSCFTYPE_VARS
@@ -108,12 +109,17 @@ - (NSUInteger) countByEnumeratingWithState: (NSFastEnumerationState*)state
                                    objects: (id*)stackbuf
                                      count: (NSUInteger)len
 {
-  // TODO: inefficient
-  NSEnumerator *enuM = [self objectEnumerator];
-
-  return [enuM countByEnumeratingWithState: state
-                                   objects: stackbuf
-                                     count: len];
+  /* Set elements are stored as the hash table's keys; enumerate them in place,
+   * keeping the resume position in extra[0]. */
+  CFIndex cursor = (state->state == 0) ? 0 : (CFIndex) state->extra[0];
+  CFIndex n = GSHashTableGetKeysFromCursor ((GSHashTableRef) self, &cursor,
+                                            (const void **) stackbuf,
+                                            (CFIndex) len);
+  state->extra[0] = (unsigned long) cursor;
+  state->itemsPtr = stackbuf;
+  state->mutationsPtr = (unsigned long *) self;
+  state->state += n;
+  return n;
 }
 
 - (void) addObject: (id)anObject