Fix cached EnumLength retrieval in JSObject::NumberOfOwnProperties

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 7b223c084a371ea7043b70f30108a91405eb9678..79ee09ad21eb59107e6e540a0c4d9ee18be052c6 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -14791,7 +14791,9 @@ int JSObject::NumberOfOwnProperties(PropertyAttributes filter) {
   if (HasFastProperties()) {
     Map* map = this->map();
     if (filter == NONE) return map->NumberOfOwnDescriptors();
-    if (filter & DONT_ENUM) {
+    if (filter == DONT_SHOW) {
+      // The cached enum length was computed with filter == DONT_SHOW, so
+      // that's the only filter for which it's valid to retrieve it.
       int result = map->EnumLength();
       if (result != kInvalidEnumCacheSentinel) return result;
     }