[json] Fix iteration over object keys in InternalizeJSONProperty.

[json] Fix iteration over object keys in InternalizeJSONProperty.

We must not use for-of since that could be observed.

R=yangguo@chromium.org
BUG=v8:4769
LOG=n

Committed: https://crrev.com/0ad44590e0a3bdbd2c677bba24cb574dc65d0bd9
Cr-Commit-Position: refs/heads/master@{#34387}

[neis, 2016-02-29 13:24:20]

Description was changed from

==========
[json] Fix iteration over object keys in InternalizeJSONProperty.

We must not use for-of since that could be observed.

R=yangguo@chromium.org
BUG=
==========

to

==========
[json] Fix iteration over object keys in InternalizeJSONProperty.

We must not use for-of since that could be observed.

R=yangguo@chromium.org
BUG=v8:4769
==========

[neis, 2016-02-29 16:27:57]

ptal

[caitp (gmail), 2016-02-29 16:48:09]

caitpotter88@gmail.com changed reviewers:
+ caitpotter88@gmail.com

[caitp (gmail), 2016-02-29 16:48:10]

https://codereview.chromium.org/1748633002/diff/1/src/js/json.js
File src/js/json.js (right):

https://codereview.chromium.org/1748633002/diff/1/src/js/json.js#newcode54
src/js/json.js:54: var keys = %object_keys(val);
I believe this is still observable, eg if accessors for Array elements are
installed on the prototype. the ObjectKeys() builtin returns a plain JSArray, so
accessors installed on Array.prototype will be invoked.

[caitp (gmail), 2016-02-29 17:01:09]

https://codereview.chromium.org/1748633002/diff/1/src/js/json.js
File src/js/json.js (right):

https://codereview.chromium.org/1748633002/diff/1/src/js/json.js#newcode54
src/js/json.js:54: var keys = %object_keys(val);
On 2016/02/29 16:48:10, caitp wrote:
> I believe this is still observable, eg if accessors for Array elements are
> installed on the prototype. the ObjectKeys() builtin returns a plain JSArray,
so
> accessors installed on Array.prototype will be invoked.

Okay, I guess accessors on the prototype don't matter here, since ObjectKeys()
looks at own properties only. S'all good :>

[Yang, 2016-03-01 11:32:13]

lgtm

[neis, 2016-03-01 11:33:01]

The CQ bit was checked by neis@chromium.org

[commit-bot: I haz the power, 2016-03-01 11:33:06]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1748633002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1748633002/1

[commit-bot: I haz the power, 2016-03-01 11:36:43]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-03-01 11:36:43]

Try jobs failed on following builders:
  v8_presubmit on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_presubmit/builds/11688)

[neis, 2016-03-01 11:49:47]

Description was changed from

==========
[json] Fix iteration over object keys in InternalizeJSONProperty.

We must not use for-of since that could be observed.

R=yangguo@chromium.org
BUG=v8:4769
==========

to

==========
[json] Fix iteration over object keys in InternalizeJSONProperty.

We must not use for-of since that could be observed.

R=yangguo@chromium.org
BUG=v8:4769
LOG=n
==========

[neis, 2016-03-01 11:49:58]

The CQ bit was checked by neis@chromium.org

[commit-bot: I haz the power, 2016-03-01 11:50:03]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1748633002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1748633002/1

[commit-bot: I haz the power, 2016-03-01 11:51:59]

Description was changed from

==========
[json] Fix iteration over object keys in InternalizeJSONProperty.

We must not use for-of since that could be observed.

R=yangguo@chromium.org
BUG=v8:4769
LOG=n
==========

to

==========
[json] Fix iteration over object keys in InternalizeJSONProperty.

We must not use for-of since that could be observed.

R=yangguo@chromium.org
BUG=v8:4769
LOG=n
==========

[commit-bot: I haz the power, 2016-03-01 11:51:59]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-03-01 11:53:36]

Description was changed from

==========
[json] Fix iteration over object keys in InternalizeJSONProperty.

We must not use for-of since that could be observed.

R=yangguo@chromium.org
BUG=v8:4769
LOG=n
==========

to

==========
[json] Fix iteration over object keys in InternalizeJSONProperty.

We must not use for-of since that could be observed.

R=yangguo@chromium.org
BUG=v8:4769
LOG=n

Committed: https://crrev.com/0ad44590e0a3bdbd2c677bba24cb574dc65d0bd9
Cr-Commit-Position: refs/heads/master@{#34387}
==========

[commit-bot: I haz the power, 2016-03-01 11:53:37]

Patchset 1 (id:??) landed as
https://crrev.com/0ad44590e0a3bdbd2c677bba24cb574dc65d0bd9
Cr-Commit-Position: refs/heads/master@{#34387}