See these examples: http://dev.sencha.com/deploy/ext-3.4.0/examples/form/combos.html I'm assuming it's a JSC bug because it's reproducible in different ports and it's js code, but I'm still bisecting to find the commit that introduced the regression.
Finally found the commit that introduced the regression, according to git bisect, r156791 is the commit to blame.
<rdar://problem/15363658>
If it is 156791 it implies that Ext is assuming Array.values, .entries, or .keys is something special with no basis for that decision.
(In reply to comment #3) > If it is 156791 it implies that Ext is assuming Array.values, .entries, or .keys is something special with no basis for that decision. In any case shouldn't we do something about it while they don't fix it?
ExtJS holds back the web _again_. Emailed ES list, we're going to have to remove Array.prototype.values. Congratulations!
Created attachment 216600 [details] Patch
Committed r159063: <http://trac.webkit.org/changeset/159063>