IE8 bug in for-in JavaScript statement?

Question

I think I've found a bug in IE's (IE8) handling for the for-in javascript statement. After several hours of boiling this down to a small example, it looks like IE specifically skips any property called "toString" in a for-in loop - regardless of whether it is in a prototype or is an "Own Property" of the object.

I've placed my test code here:

function countProps(obj) {
    var c = 0;
    for (var prop in obj) {
        c++;
    }
    return c;
}

var obj = {
    toString: function() {
        return "hello";
    }
};

function test() {
    var o = "";
    var d = document.getElementById('output');

    o += "<br/>obj.hasOwnProperty('toString') == " + obj.hasOwnProperty('toString');
    o += "<br/>countProps(obj) = " + countProps(obj);
    o += "<br/>obj.toString() = " + obj.toString();

    d.innerHTML = o;
}

This should produce:

obj.hasOwnProperty('toString') == true
countProps(obj) = 1
obj.toString() = hello

but in IE, I'm getting:

obj.hasOwnProperty('toString') == true
countProps(obj) = 0
obj.toString() = hello

This special casing of any property called 'toString' is wrecking havoc with my code that tries to copy methods into a Function.prototype - my custom toString function is always skipped.

Does anyone know a work-around? Is this some sort of quirks-mode only behavior - or just a BUG?

score 10 · Accepted Answer · edited May 23 '17 at 11:46

10

Yes, it is a bug. See this answer.

Quoting CMS:

Another well known JScript bug is the "DontEnum Bug", if an object in its scope chain contains a property that is not enumerable (has the { DontEnum } attribute), if the property is shadowed on other object, it will stay as non-enumerable, for example:

var dontEnumBug = {toString:'foo'}.propertyIsEnumerable('toString');

It will evaluate to false on IE, this causes problems when using the for-in statement, because the properties will not be visited.

edited May 23 '17 at 11:46

Community

1
1

answered Sep 14 '10 at 00:42

Cristian Sanchez

31,171
11
57
63

1

Thanks for quoting my answer, I will post some workaround to the problem in the other thread -and maybe more implementation bugs- ;) – Christian C. Salvadó Sep 14 '10 at 02:31
Thanks. So, contrary to the JavaScript spec, this is a case where a user defined property is not enumerable. Is there a list of all such properties so I can add a special test to my code when dontEnumBug is true? – mckoss Sep 14 '10 at 06:12
I updated my test code: http://startpad.googlecode.com/hg/labs/js/misc/tostring.html A work around should specifically test for the presence of properties named: toString, toLocaleString, valueOf, constructor, and isPrototypeOf, from my tests of IE8. – mckoss Sep 14 '10 at 20:11

score 2 · Answer 2 · answered Sep 14 '10 at 00:57

2

This is a bug in IE, and also applies to properties named valueOf.

You can work around it like this:

if(obj.toString !== Object.prototype.toString || obj.hasOwnProperty("toString"))
    //Handle it
if(obj.valueOf !== Object.prototype.valueOf || obj.hasOwnProperty("valueOf"))
    //Handle it

answered Sep 14 '10 at 00:57

SLaks

868,454
176
1,908
1,964

1

It applies to others too. Here's one list: https://developer.mozilla.org/en/ECMAScript_DontEnum_attribute#JScript_DontEnum_Bug – Cristian Sanchez Sep 14 '10 at 01:03
had the same problem with includes. if(obj.includes !== Object.prototype.includes || obj.hasOwnProperty("includes")) { //handleit } – Dominik Heim May 05 '17 at 09:18

IE8 bug in for-in JavaScript statement?

2 Answers2

Linked