[Webkit-unassigned] [Bug 146931] New: Defining non-enumerable, non-numeric property breaks for (key in obj) on enumerable, numeric properties

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=146931

            Bug ID: 146931
           Summary: Defining non-enumerable, non-numeric property breaks
                    for (key in obj) on enumerable, numeric properties
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.s.dittmer at gmail.com

This was originally discovered on arrays, but I have since determined that it breaks objects in general. I'm writing a test inline because I'm not sure whether it should be a JavaScriptCore test or LayoutTest.

Test code:

var obj = { 0: 0, 1: 1, _2: 2 };
Object.defineProperty(obj, '_3', {});
for (var key in obj) console.log(key);

Test output:

0
1
0
1
_2

Testing notes:
- Problem occurs on arrays as well as Objects (given that it occurs on plain-old objects, this is not surprising)
- Problem occurs with Object.defineProperty and Object.defineProperties under the same conditions
- Problem only occurs when the newly define property is both non-numeric and non-enumerable (other property attributes do not appear to influence the outcome)
- The only keys that duplicate themselves are numeric keys (that are enumerable)
- Problem does not occur in return value of Object.keys(obj)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150714/e7a68065/attachment.html>