Crash JS for x in o { delete o[x] } if o is a sparsearray

let o = [];
o[10000] = 10;
o[20000] = 20;
for (let k in o)
    delete o[k]

let o = {};
o.a = 10;
o.b = 20;
for (let k in o)
    delete o[k]

~SparseArray() {
    if (root())
        freeTree(header.left, Q_ALIGNOF(SparseArrayNode));
}
inline const SparseArrayNode *SparseArray::lowerBound(uint akey) const
{
    const SparseArrayNode *lb = root()->lowerBound(akey);
    ...
}
inline SparseArrayNode *SparseArrayNode::lowerBound(uint akey)
{
    SparseArrayNode *n = this;
    SparseArrayNode *last = nullptr;
    while (n) {
      ...
    }
    return last;
}