171158 2017-04-21 21:20:19 -0700 Incorrect behavior for array iteration if iterator behavior changes partway through 2017-04-24 12:35:00 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 171150 P2 Normal --- 1 bzbarsky webkit-unassigned saam sam oldest_to_newest 1300107 0 bzbarsky 2017-04-21 21:20:19 -0700 Consider this (shell; in a browser, replace print with alert) testcase: var iter = [][Symbol.iterator](); var iterProto = Object.getPrototypeOf(iter); var oldNext = iterProto.next; function hackedNext() { var val = oldNext.call(this); if ("value" in val) { val.value++; } return val; } var arr = [1,,3]; Object.defineProperty(arr, 1, { get: function() { iterProto.next = hackedNext; return 2 } }); print([...arr]); This should print "1,2,4", and does in SpiderMonkey and V8. In JSC, at least as tested via Safari and WebKit nightlies, it prints "1,2,3". I believe that this is because isIteratorProtocolFastAndNonObservable() (as called from either operationSpreadGeneric or the slow_path_spread slow path) is true for this array when the spread operation starts. But it starts being false partway through, when the getter for the property at index 1 runs... 1300611 1 saam 2017-04-24 12:35:00 -0700 *** This bug has been marked as a duplicate of bug 171150 ***