Bug 160211 – We don't optimize for-in properly in baseline JIT (maybe other JITs too) with an object with symbols

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Saam Barati]

```
var one = Symbol();

var args = {};
args[one] = 1;
args.two  = 2;

function kv(obj) {
  var arr = [];
  for (var key in obj) {
  	arr.push(key);
  	arr.push(obj[key]);
  }
  return arr;
}

log(kv(args));
var c = 30;
while (c--) {
  kv({c: c});
}
log(kv(args));

function log(m) {
  var div = document.createElement('div');
  document.body.appendChild(div);
  div.textContent = JSON.stringify(m);
}
```

The result should not change.
But we currently get:
["two",2]
["two",1]

expected:
["two",2]
["two",2]

[Radar WebKit Bug Importer]

<rdar://problem/27572612>

[Saam Barati]

Created attachment 284714 [details]
patch

[Geoffrey Garen]

Comment on attachment 284714 [details]
patch

r=me

[Saam Barati]

Created attachment 284719 [details]
patch for landing

[Saam Barati]

Created attachment 284727 [details]
patch for landing

added more to the test

[WebKit Commit Bot]

Comment on attachment 284727 [details]
patch for landing

Clearing flags on attachment: 284727

Committed r203793: <http://trac.webkit.org/changeset/203793>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Alexey Shvayka]

*** Bug 159664 has been marked as a duplicate of this bug. ***