QML: Fix proxy iteration

If the target of a proxy was extensible, we did not set the
iteratorTarget to its correct value, and thus the ForInIteratorObject
would not be usable.

Fixes: QTBUG-86323
Change-Id: Id1924ac4087bab38c006b8eba92b619b79d36b7a
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
(cherry picked from commit dd740d6b3469448dc1fd31c1742781e923e9f274)

3 files changed, 45 insertions, 2 deletions

diff --git a/src/qml/jsruntime/qv4proxy.cpp b/src/qml/jsruntime/qv4proxy.cpp
index 1505eae426..8bfc9fc3ba 100644
--- a/src/qml/jsruntime/qv4proxy.cpp
+++ b/src/qml/jsruntime/qv4proxy.cpp
@@ -624,8 +624,10 @@ OwnPropertyKeyIterator *ProxyObject::virtualOwnPropertyKeys(const Object *m, Val
         else
             targetNonConfigurableKeys->push_back(keyAsValue);
     }
-    if (target->isExtensible() && targetNonConfigurableKeys->getLength() == 0)
+    if (target->isExtensible() && targetNonConfigurableKeys->getLength() == 0) {
+        *iteratorTarget = *m;
         return new ProxyObjectOwnPropertyKeyIterator(trapKeys);
+    }
 
     ScopedArrayObject uncheckedResultKeys(scope, scope.engine->newArrayObject());
     uncheckedResultKeys->copyArrayData(trapKeys);
@@ -639,8 +641,10 @@ OwnPropertyKeyIterator *ProxyObject::virtualOwnPropertyKeys(const Object *m, Val
         }
     }
 
-    if (target->isExtensible())
+    if (target->isExtensible()) {
+        *iteratorTarget = *m;
         return new ProxyObjectOwnPropertyKeyIterator(trapKeys);
+    }
 
     len = targetConfigurableKeys->getLength();
     for (uint i = 0; i < len; ++i) {
diff --git a/tests/auto/qml/qqmlecmascript/data/proxyIteration.qml b/tests/auto/qml/qqmlecmascript/data/proxyIteration.qml
new file mode 100644
index 0000000000..affba7d9f1
--- /dev/null
+++ b/tests/auto/qml/qqmlecmascript/data/proxyIteration.qml
@@ -0,0 +1,29 @@
+import QtQml 2
+
+QtObject {
+  id: root
+  property int sum
+  Component.onCompleted: {
+    const target = { prop1: 1, prop2: 2, prop3: 3 };
+    const handler = {
+      get: function(target, key) {
+        return target[key]+1;
+      },
+      ownKeys: function() {
+        return ["prop1", "prop3"];
+      },
+      getOwnPropertyDescriptor: function(target, key) {
+        return {
+          value: this.get(target, key),
+          enumerable: true,
+          configurable: true
+        };
+      }
+    };
+    const proxy = new Proxy(target, handler);
+    for (var prop in proxy) {
+      root.sum += proxy[prop] // prop2 gets skipped, the values of 1 and 3 get incremented
+    }
+    // so root.sum should be 6 now
+  }
+}
diff --git a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
index 3a9d1bfb4c..9198d3bebf 100644
--- a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
+++ b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
@@ -382,6 +382,7 @@ private slots:
     void semicolonAfterProperty();
     void hugeStack();
     void variantConversionMethod();
+    void proxyIteration();
     void proxyHandlerTraps();
     void gcCrashRegressionTest();
 
@@ -9306,6 +9307,15 @@ void tst_qqmlecmascript::variantConversionMethod()
     QCOMPARE(obj.funcCalled, QLatin1String("QModelIndex"));
 }
 
+void tst_qqmlecmascript::proxyIteration()
+{
+    QQmlEngine engine;
+    QQmlComponent component(&engine, testFileUrl("proxyIteration.qml"));
+    QScopedPointer<QObject> root(component.create());
+    QVERIFY2(root != nullptr, qPrintable(component.errorString()));
+    QCOMPARE(root->property("sum").toInt(), 6);
+}
+
 void tst_qqmlecmascript::proxyHandlerTraps()
 {
     const QString expression = QStringLiteral(R"SNIPPET(