Bug 231572 - REGRESSION (Safari 15.1 beta): Unexpected behaviour for-in-loop
Summary: REGRESSION (Safari 15.1 beta): Unexpected behaviour for-in-loop
Status: RESOLVED DUPLICATE of bug 231202
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari Technology Preview
Hardware: All All
: P2 Major
Assignee: Nobody
URL:
Keywords: InRadar, Regression
Depends on:
Blocks:
 
Reported: 2021-10-12 06:43 PDT by Christian Jaentsch
Modified: 2022-07-12 21:08 PDT (History)
5 users (show)

See Also:


Attachments
screenshots from debugging (1.99 MB, image/png)
2021-10-12 06:43 PDT, Christian Jaentsch
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Christian Jaentsch 2021-10-12 06:43:26 PDT
Created attachment 440923 [details]
screenshots from debugging

Since Safari 15.1 we are experiencing a strange behaviour when using for-in-loops on objects with are themselves inherited from Object which have no own properties but only inherited ones.

In this case the for-in-loop does not iterate on any properties - which it correctly does on Safari until version 15.0 and other browsers (e.g. latest Chrome).

Unfortunately I can't reproduce this behaviour with a plain JS snippet, but it occurs in our app, so it might have some relation to certain scope scenarios.

The attached screenshot shows an example of the different behaviour on latest Safari 15.0 (MacOS) compared to latest Safari Technology Preview 15.4 (MacOS) (the bug also occurs on Safari 15.1 with iOS beta 3).

Above: On the left side you can see the related code snippet and on the right the watched variables on 15.0 (left) and 15.4 (right).
The variable "obj" holds an object which itself has no properties, but inherits the properties "reader" and "type". The for-in-loop then concats the keys and values of the properites into "debugString". On 15.0 you can see that it results in "type > memory reader > array". On 15.4 it does not enter the for-in-loop, so "debugString" stays empty.

Below: Now when adding a local property to "obj", we suddenly can iterate over all properties (even the not before considered "type" and "reader") as you can see from the content of "debugString2".
Comment 1 Radar WebKit Bug Importer 2021-10-12 09:29:34 PDT
<rdar://problem/84150852>
Comment 2 Alexey Proskuryakov 2021-10-12 13:32:14 PDT
Could you please provide a test case that reproduces the issue? It doesn't have to be very reduced, although that helps of course.
Comment 3 Yusuke Suzuki 2021-10-12 13:36:30 PDT
Probably, it is fixed in bug 231202, but it is helpful if we can get a test case :)
Comment 4 Yusuke Suzuki 2022-07-12 21:08:40 PDT
Duping it to bug 231202, described issue was fixed in that bug.

*** This bug has been marked as a duplicate of bug 231202 ***