Bug 147071 – In strict mode, `Object.keys(arguments)` includes "length"

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Jordan Harband]

Given this JS:
```
var argsSloppy = (function () { return arguments; }(1,2,3));
var argsStrict = (function () { 'use strict'; return arguments; }(1,2,3));

assert(!Object.prototype.propertyIsEnumerable(argsSloppy, 'length'));
assert(!Object.prototype.propertyIsEnumerable(argsStrict, 'length'));

assert(Object.keys(argsSloppy).length === Object.keys(argsStrict).length); // fails
assert(Object.keys(argsSloppy).indexOf('length') === -1)
assert(Object.keys(argsStrict).indexOf('length') === -1); // fails
```

Even though `length` is non-enumerable on both arguments objects, `Object.keys` returns "length" for the one created in strict mode.

Additionally, in the inspector, both look different - the sloppy one looks nice and pretty; the strict one doesn't.

This is not broken in Safari, but it is in the latest WebKit Nightly.

Note that it's a type error to do `argsStrict.callee` but not `argsSloppy.callee` - I suspect this is implementation difference between the two modes is the cause of this bug.

[Yusuke Suzuki]

Nice catch.
This is because, ClonedArguments doesn't set "length" with DontEnum.
I'll upload the patch to fix this.

[Yusuke Suzuki]

Created attachment 257034 [details]
Patch

[Jordan Harband]

I'm surprised that a property that's not set with DontEnum would report "propertyIsEnumerable" as false :-/ Why aren't they consistent?

When you fix this, could you also make ClonedArguments look the same in the inspector?

[Yusuke Suzuki]

Comment on attachment 257034 [details]
Patch

Thank you for your review, darin!

[WebKit Commit Bot]

Comment on attachment 257034 [details]
Patch

Clearing flags on attachment: 257034

Committed r187017: <http://trac.webkit.org/changeset/187017>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/22455520>