for/in returns duplicate keys when key exists on object and its prototype

[Jesse Costello-Good]

The following code evaluates to "toString toString", however, for...in should never return duplicate keys.

var A = function() {};
A.prototype.toString = function() { "A" };

var B = function() {};
B.prototype = new A();
B.prototype.toString = function() { "B" };

var s = "";
for (var f in B.prototype) s += f + " ";
s

[Jesse Costello-Good]

I am evaluating Safari for a port of TIBCO(R) General Interface, a mature AJAX platform that is currently IE 
only. Fixing this bug would make the port more feasible.

[Mark Rowe (bdash)]

Created attachment 5754 [details]
Test case packged suitable for a layout test

[Mark Rowe (bdash)]

Thanks for the bug report.  I can confirm this fails in both WebKit 417.9 and ToT WebKit.

[Maciej Stachowiak]

I had a possible fix for this at one point but it caused an apparent performance regression. Maybe time to retest.

[Mark Rowe (bdash)]

Created attachment 6937 [details]
Further simplified test case

[Mark Rowe (bdash)]

*** Bug 7658 has been marked as a duplicate of this bug. ***

[Alexey Proskuryakov]

*** This bug has been marked as a duplicate of 9950 ***

[Jesse Costello-Good]

Thanks to the Safari team for being so responsive regarding requests for better advanced AJAX support. Safari is quickly becoming a 1st class AJAX platform.

[Jesse Costello-Good]

This is fixed in Safari 3 for iPhone 1.0.2