[ES6] for...in iteration doesn't comply with the specification
authorsbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 26 Feb 2016 00:15:58 +0000 (00:15 +0000)
committersbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 26 Feb 2016 00:15:58 +0000 (00:15 +0000)
commit9b7645f6180f0081183bb75db7866920dd292d7f
tree24c45f6819537803de7ba2a3c92eaf718d2e1ff5
parent285a19a0419681e0617a625904bb74147fd829e8
[ES6] for...in iteration doesn't comply with the specification
https://bugs.webkit.org/show_bug.cgi?id=154665

Reviewed by Michael Saboff.

If you read ForIn/OfHeadEvaluation inside the spec:
https://tc39.github.io/ecma262/#sec-runtime-semantics-forin-div-ofheadevaluation-tdznames-expr-iterationkind
It calls EnumerateObjectProperties(obj) to get a set of properties
to enumerate over (it models this "set" as en ES6 generator function).
EnumerateObjectProperties is defined in section 13.7.5.15:
https://tc39.github.io/ecma262/#sec-enumerate-object-properties
The implementation calls Reflect.getOwnPropertyDescriptor(.) on the
properties it sees. We must do the same by modeling the operation as
a [[GetOwnProperty]] instead of a [[HasProperty]] internal method call.

* jit/JITOperations.cpp:
* jit/JITOperations.h:
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):
* runtime/JSObject.cpp:
(JSC::JSObject::hasProperty):
(JSC::JSObject::hasPropertyGeneric):
* runtime/JSObject.h:
* tests/stress/proxy-get-own-property.js:
(assert):
(let.handler.getOwnPropertyDescriptor):
(i.set assert):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@197144 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/jit/JITOperations.cpp
Source/JavaScriptCore/jit/JITOperations.h
Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
Source/JavaScriptCore/runtime/JSObject.cpp
Source/JavaScriptCore/runtime/JSObject.h
Source/JavaScriptCore/tests/stress/proxy-get-own-property.js