Dict: Invalidate iterators during Clear()

If we don't do this, a RobustDictIterator owned by someone else holds
dangling pointers to the Dictionary that is being cleared.

Closes #3523

src/Dict.h

@@ -382,7 +382,9 @@ public:
     pointer operator->() { return &curr; }
 
     RobustDictIterator& operator++() {
-        curr = dict->GetNextRobustIteration(this);
+        if ( dict )
+            curr = dict->GetNextRobustIteration(this);
+
         return *this;
     }
 
@@ -475,6 +477,7 @@ private:
             inserted = nullptr;
             visited = nullptr;
             dict = nullptr;
+            curr = nullptr; // make this same as robust_end()
         }
     }
 
@@ -765,6 +768,11 @@ public:
             order.reset();
 
         if ( iterators ) {
+            // Complete() erases from this Dictionary's iterators member, use a copy.
+            auto copied_iterators = *iterators;
+            for ( auto* i : copied_iterators )
+                i->Complete();
+
             delete iterators;
             iterators = nullptr;
         }

testing/btest/core/dict-iteration-expire-3523.zeek

@@ -0,0 +1,14 @@
+# @TEST-EXEC: zcat <$TRACES/smb/smb_many_open_files_500.pcap.gz | zeek -b -Cr - %INPUT
+# @TEST-DOC:  Regression test #3523; no output check, just shouldn't crash
+
+redef table_expire_delay = 0.1sec;
+redef table_incremental_step = 1;
+redef table_expire_interval = 0.1sec;
+
+redef record connection += {
+	recent_tcp: set[string] &default=set() &read_expire=3min;
+};
+
+event new_packet(c: connection, pkt: pkt_hdr) {
+	add c$recent_tcp[cat(pkt$tcp)];
+}