Issue 2363 in v8: Object.keys() is not returning property that is enumerable and on object

[codesite...@google.com]

Status: New
Owner: ----

New issue 2363 by fastest...@gmail.com: Object.keys() is not returning
property that is enumerable and on object
http://code.google.com/p/v8/issues/detail?id=2363

Chrome: 24.0.1294.0 (Official Build 161699) canary
V8: 3.14.3

I have an object: GS.Views.SongGrid.prototype.defaults and for some reason
the property "columns" is not being enumerated in a for...in loop. I
investigated further and possibly discovered a bug.

Object.keys(GS.Views.SongGrid.prototype.defaults)
["axis", "itemHeight", "bufferBefore", "bufferAfter", "itemsPerRow", "header", "allowMultiSelect", "pageEl", "canDragFrom", "canDragTo", "dropIndicatorType", "dropIsValid", "acceptDrop", "itemRenderer", "showCount"]

Object.getOwnPropertyNames(GS.Views.SongGrid.prototype.defaults)
["axis", "itemHeight", "bufferBefore", "bufferAfter", "itemsPerRow", "header", "allowMultiSelect", "pageEl", "canDragFrom", "canDragTo", "dropIndicatorType", "dropIsValid", "acceptDrop", "itemRenderer", "columns"]


Information about the "columns" property and how it is enumerable.

Object.getOwnPropertyDescriptor(GS.Views.SongGrid.prototype.defaults, 'columns')
{
configurable: true
enumerable: true
value: Array[6]
writable: true
}
Object.constructor.hasOwnProperty.call(GS.Views.SongGrid.prototype.defaults, 'columns')
true
Object.constructor.propertyIsEnumerable.call(GS.Views.SongGrid.prototype.defaults, 'columns')
true


The issue is that "showCount" is being returned at the end of keys()
instead of "columns". You'll notice that "showCount" is not enumerable and
not on the object:

Object.constructor.propertyIsEnumerable.call(GS.Views.SongGrid.prototype.defaults, 'showCount')
false
Object.constructor.hasOwnProperty.call(GS.Views.SongGrid.prototype.defaults, 'showCount')
false
Object.getOwnPropertyDescriptor(GS.Views.SongGrid.prototype.defaults, 'showCount')
undefined

If I modify the object at all, for instance:
delete GS.Views.SongGrid.prototype.defaults.axis
true

keys() will now return the correct array (including columns):
Object.keys(GS.Views.SongGrid.prototype.defaults)
["itemHeight", "bufferBefore", "bufferAfter", "itemsPerRow", "header", "allowMultiSelect", "pageEl", "canDragFrom", "canDragTo", "dropIndicatorType", "dropIsValid", "acceptDrop", "itemRenderer", "columns"]

We define GS.Views.SongGrid to be:
http://cl.ly/image/3X2k3P1k3V0q

GS.Views.SongGridTall contains the showCount property in it's defaults a
few lines later in the file (next defined grid object in file):
http://cl.ly/image/3t3s3a1F1Q2f


Let me know if you need any more information. I have a heap snapshot if
that will help.

Thanks,
James Hartig
Software Engineer @ Grooveshark.com

[codesite...@google.com]

Updates:
Status: Assigned
Owner: verwa...@chromium.org

Comment #1 on issue 2363 by jkum...@chromium.org: Object.keys() is not

returning property that is enumerable and on object
http://code.google.com/p/v8/issues/detail?id=2363

Thanks for the report, this does indeed sound like a bug.

If you could provide a URL (or even better, a reduced self-contained test
case) that reliably produces an object in this state, that would be awesome.

[codesite...@google.com]

Comment #2 on issue 2363 by fastest...@gmail.com: Object.keys() is not

returning property that is enumerable and on object
http://code.google.com/p/v8/issues/detail?id=2363

If you go to: http://preview.grooveshark.com/#!/playlist/Housectro/78329949
and login as jawharp13 and 123456. Then refresh on that page (after having
logged in) then you'll notice the song grid on that page looks like:
http://cl.ly/image/13193u2c4647

At that point, the issue has happened and you can start to investigate. You
might have to refresh a few times since it only seems to not happen rarely.

I'd like to point out that I managed to solve the issue by making the
following change:
(reference the screenshots in the original comment to the definitions)
http://cl.ly/image/3t3R1w2Y1p1C

That code was scheduled to go live sometime within the next 24 hours but
I'll revert the commit if you need to test more.

[codesite...@google.com]

Comment #3 on issue 2363 by fastest...@gmail.com: Object.keys() is not

returning property that is enumerable and on object
http://code.google.com/p/v8/issues/detail?id=2363

If you go to: http://preview.grooveshark.com/#!/playlist/Housectro/78329949
and login as jawharp13 and 123456. Then refresh on that page (after having
logged in) then you'll notice the song grid on that page looks like:
http://cl.ly/image/13193u2c4647

At that point, the issue has happened and you can start to investigate. You

might have to refresh a few times since rarely it seems to not be an issue.

I'd like to point out that I managed to solve the issue by making the
following change:
(reference the screenshots in the original comment to the definitions)
http://cl.ly/image/3t3R1w2Y1p1C

That code was scheduled to go live sometime within the next 24 hours but

I'll revert the commit if you need to test more. Unfortunately it was hard
to try and provide self-contained test code that could reproduce it.

[codesite...@google.com]

Updates:
Status: Accepted

Comment #4 on issue 2363 by verwa...@chromium.org: Object.keys() is not

returning property that is enumerable and on object
http://code.google.com/p/v8/issues/detail?id=2363

Yesterday I've solved an issue that looks very similar to this one. Could
you please verify that the issue is gone in the latest canary?

[codesite...@google.com]

Updates:
Status: Fixed

Comment #5 on issue 2363 by verwa...@chromium.org: Object.keys() is not

returning property that is enumerable and on object
http://code.google.com/p/v8/issues/detail?id=2363

(No comment was entered for this change.)

[codesite...@google.com]

Comment #6 on issue 2363 by fastest...@gmail.com: Object.keys() is not

returning property that is enumerable and on object
http://code.google.com/p/v8/issues/detail?id=2363

I can confirm that the issue is resolved. Thanks guys!