I was reading the for-in code looking for Speedometer speedups, and the code is clearly wrong when it comes to indexed properties in the prototype chain. Fix should be trivial.
Created attachment 330999 [details] patch
Comment on attachment 330999 [details] patch r=me, nice catch.
Comment on attachment 330999 [details] patch Clearing flags on attachment: 330999 Committed r226767: <https://trac.webkit.org/changeset/226767>
All reviewed patches have been landed. Closing bug.
<rdar://problem/36430219>