If object B inherits from prototype A and prototype A has more than 64 properties, it seems that the enumeration of properties of object B is cached. However, if more properties are added to the prototype the cache is not invalidated. So if an additional property is added to the prototype between enumerations, the new property is not enumerated over. The linked example clearly illustrates this issue.
Created attachment 31625 [details] Test case
<rdar://problem/6992822>
Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/interpreter/Interpreter.cpp M JavaScriptCore/jit/JITStubs.cpp M JavaScriptCore/runtime/Structure.cpp M JavaScriptCore/runtime/StructureChain.cpp M JavaScriptCore/runtime/StructureChain.h M LayoutTests/ChangeLog A LayoutTests/fast/js/dictionary-no-cache.html A LayoutTests/fast/js/resources/dictionary-no-cache.js Committed r45039 Please verify in the next nightly :D
In the attachment I noticed that performing something like test2._x = 1; delete test2._x; before the for-in loop seems to fix the issue.
Sebastian's test case works now here (nighly).