chakra Inconsistent execution results

[lionche]

Version

chakra-1.11.24.0, 1.13.0.0-beta

Test case

function foo(){
        const b = [{name:"bob",age:25}];
    const o = {"__proto__":[[]], "":""};
    for (const p in o) {
            var a = b[p];
            o.__proto__ = {};
        }
    return JSON.stringify(a)
}
print(foo())

Execution steps

.ch Testcase.js

Output

{"name":"bob","age":25}

Expected result

undefined

Description

The correct output of the test case should be undefined while chakra yields {"name":"bob","age":25} . I think it might be an issue of chakra.

[ShortDevelopment]

Seems like V8 terminates a for..in loop if the prototype changes; CC doesn't.

const obj = { "obj_prop": "value" };
const arrayPrototype = ["some_item", "some_item2"];
Object.setPrototypeOf(obj, arrayPrototype);

let counter = 0;
for (const prop in obj) {
    console.log(`${counter}: ${prop}`);
    Object.setPrototypeOf(obj, { "new_prop": "new_value", "new_prop2": "" });
    counter++;
}

[ShortDevelopment]

According to the spec this might actually be valid behavior!

[...] the iterator must behave as would the iterator given by CreateForInIterator(O) until one of the following occurs:

• the value of the [[Prototype]] internal slot of O or an object in its prototype chain changes
• ...

ECMAScript implementations are not required to implement the algorithm in 14.7.5.10.2.1 directly. They may choose any implementation whose behaviour will not deviate from that algorithm unless one of the constraints in the previous paragraph is violated.