[JSC] Object.keys() must discard property names with no PropertyDescriptor
authorcaitp@igalia.com <caitp@igalia.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 26 Apr 2017 14:56:53 +0000 (14:56 +0000)
committercaitp@igalia.com <caitp@igalia.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 26 Apr 2017 14:56:53 +0000 (14:56 +0000)
commitf9c0c79541b7ae2fecde056a21c6a1d3566c9f7b
tree80719118788dd044fd636d3a764d33d96ab94b45
parentf42e82b9e8ecf2d0fde46f576a5e71d398ab3de9
[JSC] Object.keys() must discard property names with no PropertyDescriptor
https://bugs.webkit.org/show_bug.cgi?id=171291

Reviewed by Yusuke Suzuki.

JSTests:

* es6/Proxy_ownKeys_duplicates.js:
* stress/proxy-own-keys.js:
(let.handler.getOwnPropertyDescriptor):
(let.handler.ownKeys):

Source/JavaScriptCore:

Proxy objects can produce an arbitrary list of property names from the
"ownKeys" trap, however the Object.keys() algorithm is required to
discard names which do not have a PropertyDescriptor. This also
applies to other uses of the EnumerableOwnProperties() algorithm
(https://tc39.github.io/ecma262/#sec-enumerableownproperties)

Related to https://bugs.chromium.org/p/v8/issues/detail?id=6290

* runtime/ObjectConstructor.cpp:
(JSC::ownPropertyKeys):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@215799 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/es6/Proxy_ownKeys_duplicates.js
JSTests/stress/proxy-own-keys.js
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/ObjectConstructor.cpp