Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 21b684a37876668e8f9d5eb038f525406cca0a10
https://github.com/WebKit/WebKit/commit/21b684a37876668e8f9d5eb038f525406cca0a10
Author: Sosuke Suzuki <[email protected]>
Date: 2026-10-08 (Thu, 08 Oct 2026)
Changed paths:
A JSTests/stress/for-in-indexed-properties-of-object-reifying-properties.js
M Source/JavaScriptCore/runtime/JSPropertyNameEnumeratorInlines.h
Log Message:
-----------
[JSC] for-in should not skip indexed properties of functions
https://bugs.webkit.org/show_bug.cgi?id=326173
Reviewed by Yusuke Suzuki.
function f() { }
f.a = 1;
f[0] = 2;
for (var key in f)
print(key); // Prints "a" only.
Collecting property names of a function reifies "length" and "name", which
changes its structure.
propertyNameEnumerator() then clears indexedLength. But own indexed properties
are not in
propertyNames in this case, so they are never enumerated.
This patch keeps indexedLength. The check of the structure was added in
232741@main, since a
Proxy's getPrototypeOf callback can change the structure while collecting
property names. It is
needed for OwnStructureMode, which loads properties with the offsets of the
structure. IndexedMode
does not rely on the structure: it checks each index against the base object.
Test: JSTests/stress/for-in-indexed-properties-of-object-reifying-properties.js
* JSTests/stress/for-in-indexed-properties-of-object-reifying-properties.js:
Added.
(shouldBe):
(keys):
(factories):
(return):
(async return):
* Source/JavaScriptCore/runtime/JSPropertyNameEnumeratorInlines.h:
(JSC::propertyNameEnumerator):
Canonical link: https://commits.webkit.org/323086@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
