New issue
Advanced search Search tips
Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Sep 13
Cc:
Components:
HW: All
NextAction: ----
OS: All
Priority: ----
Type: Bug



Sign in to add a comment

For-in enumeration of non-enumerable properties shadowing enumerable properties is inconsistent

Reported by bak...@gmail.com, Sep 11

Issue description

Version: V8 version 7.1.78


`for-in` is inconsistent about whether it hits properties which are non-enumerable and shadow enumerable properties of the same name further up the prototype chain.

Compare:


```

let base = { prop: 0 };

let derived = Object.create(null, {
  prop: { enumerable: false, configurable: true, value: 0 },
});

Object.setPrototypeOf(derived, base);


for (let key in derived) {
  console.log(key);
}
```


vs


```
let base = { prop: 0 };

let derived = Object.create(base, {
  prop: { enumerable: false, configurable: true, value: 0 },
});


for (let key in derived) {
  console.log(key);
}
```


The first of these prints 'prop', the second nothing. But they're enumerating over objects with _exactly_ the same shape; the only difference is whether the object is created with its prototype already in place or has its prototype set afterwards.

It's hard to say which if either of these are wrong, since the spec text here [1] is quite difficult to interpret. But it seems very odd that they should be inconsistent.

See also (and please comment on) this open spec bug [2] about more precisely specifying the behavior of for-in, which prompted the investigation which lead me to discovering this.

[1] https://tc39.github.io/ecma262/#sec-enumerate-object-properties

[2] https://github.com/tc39/ecma262/issues/1281

 
Cc: cbruni@chromium.org jkummerow@chromium.org
Components: Runtime Language
Labels: HW-All OS-All
Status: Available (was: Untriaged)
Owner: cbruni@chromium.org
Status: Started (was: Available)
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 13

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/ec348ef152e0cb9eb8f4f0ac3f1668d5a5c3853b

commit ec348ef152e0cb9eb8f4f0ac3f1668d5a5c3853b
Author: Camillo Bruni <cbruni@chromium.org>
Date: Thu Sep 13 14:55:34 2018

[keys] Fix for-in with only non-enumerable properties in dictionary mode

Bug:  v8:8163 
Change-Id: I2aacbb13dc16772b173d56051a84399b8c34d4f2
Reviewed-on: https://chromium-review.googlesource.com/1224417
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55872}
[modify] https://crrev.com/ec348ef152e0cb9eb8f4f0ac3f1668d5a5c3853b/src/keys.cc
[modify] https://crrev.com/ec348ef152e0cb9eb8f4f0ac3f1668d5a5c3853b/test/mjsunit/for-in-special-cases.js

Status: Fixed (was: Started)

Sign in to add a comment