Bug 29214

Summary: getPropertyNames caching is invalid when the prototype chain contains objects with custom getPropertyNames
Product: WebKit Reporter: Oliver Hunt <oliver>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Attachments:
Description Flags
Patch v1 sam: review+

Description Oliver Hunt 2009-09-11 17:14:37 PDT
a={};
a.__proto__=[];
for(i in a)
   print(i);
a.__proto__[0]=1;
for(i in a)
   print(i); // should print 0 but doesn't get hit
Comment 1 Oliver Hunt 2009-09-11 18:31:35 PDT
Created attachment 39499 [details]
Patch v1
Comment 2 Oliver Hunt 2009-09-11 21:53:17 PDT
Committed r48331