Introduce a new mechanism to iterate over object properties

The old advanceIterator schema was extremely ugly and in addition
not flexible enough to support the requirements for Proxy.ownKeys
and some of the methods in Object

Implemented a new scheme through a OwnPropertyKeys method in the
Object VTable that creates and returns an iterator object. Ported
QJSValueIterator and for-in to use the new mechanism.

There's still many places where we use the old ObjectIterator (that
relies on advanceIterator). Those will be ported in subsequent
commits.

Change-Id: I091a9bea9ff6b2b63630cc336814700757a718be
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

15 files changed, 356 insertions, 37 deletions

diff --git a/src/qml/jsruntime/qv4argumentsobject.cpp b/src/qml/jsruntime/qv4argumentsobject.cpp
index cc2cb83b6b..6c1c4a6eea 100644
--- a/src/qml/jsruntime/qv4argumentsobject.cpp
+++ b/src/qml/jsruntime/qv4argumentsobject.cpp
@@ -212,3 +212,9 @@ qint64 ArgumentsObject::virtualGetLength(const Managed *m)
     const ArgumentsObject *a = static_cast<const ArgumentsObject *>(m);
     return a->propertyData(Heap::ArgumentsObject::LengthPropertyIndex)->toLength();
 }
+
+OwnPropertyKeyIterator *ArgumentsObject::virtualOwnPropertyKeys(const Object *m)
+{
+    static_cast<ArgumentsObject *>(const_cast<Object *>(m))->fullyCreate();
+    return Object::virtualOwnPropertyKeys(m);
+}
diff --git a/src/qml/jsruntime/qv4argumentsobject_p.h b/src/qml/jsruntime/qv4argumentsobject_p.h
index 85939071ed..6be1ab923f 100644
--- a/src/qml/jsruntime/qv4argumentsobject_p.h
+++ b/src/qml/jsruntime/qv4argumentsobject_p.h
@@ -106,6 +106,7 @@ struct ArgumentsObject: Object {
     static bool virtualDeleteProperty(Managed *m, PropertyKey id);
     static PropertyAttributes virtualGetOwnProperty(Managed *m, PropertyKey id, Property *p);
     static qint64 virtualGetLength(const Managed *m);
+    static OwnPropertyKeyIterator *virtualOwnPropertyKeys(const Object *m);
 
     void fullyCreate();
 
diff --git a/src/qml/jsruntime/qv4managed.cpp b/src/qml/jsruntime/qv4managed.cpp
index bb7b8086e4..d51b03d90b 100644
--- a/src/qml/jsruntime/qv4managed.cpp
+++ b/src/qml/jsruntime/qv4managed.cpp
@@ -142,3 +142,8 @@ bool Managed::virtualIsEqualTo(Managed *, Managed *)
 {
     return false;
 }
+
+
+OwnPropertyKeyIterator::~OwnPropertyKeyIterator()
+{
+}
diff --git a/src/qml/jsruntime/qv4object.cpp b/src/qml/jsruntime/qv4object.cpp
index 701c22331d..f4604dbce7 100644
--- a/src/qml/jsruntime/qv4object.cpp
+++ b/src/qml/jsruntime/qv4object.cpp
@@ -408,6 +408,78 @@ void Object::virtualAdvanceIterator(Managed *m, ObjectIterator *it, Value *name,
     *attrs = PropertyAttributes();
 }
 
+PropertyKey ObjectOwnPropertyKeyIterator::next(const Object *o, Property *pd, PropertyAttributes *attrs)
+{
+    if (arrayIndex != UINT_MAX && o->arrayData()) {
+        if (!arrayIndex)
+            arrayNode = o->sparseBegin();
+
+        // sparse arrays
+        if (arrayNode) {
+            while (arrayNode != o->sparseEnd()) {
+                uint k = arrayNode->key();
+                uint pidx = arrayNode->value;
+                Heap::SparseArrayData *sa = o->d()->arrayData.cast<Heap::SparseArrayData>();
+                const Property *p = reinterpret_cast<const Property *>(sa->values.data() + pidx);
+                arrayNode = arrayNode->nextNode();
+                PropertyAttributes a = sa->attrs ? sa->attrs[pidx] : Attr_Data;
+                arrayIndex = k + 1;
+                if (pd)
+                    pd->copy(p, a);
+                if (attrs)
+                    *attrs = a;
+                return PropertyKey::fromArrayIndex(k);
+            }
+            arrayNode = nullptr;
+            arrayIndex = UINT_MAX;
+        }
+        // dense arrays
+        while (arrayIndex < o->d()->arrayData->values.size) {
+            Heap::SimpleArrayData *sa = o->d()->arrayData.cast<Heap::SimpleArrayData>();
+            const Value &val = sa->data(arrayIndex);
+            PropertyAttributes a = o->arrayData()->attributes(arrayIndex);
+            int index = arrayIndex;
+            ++arrayIndex;
+            if (!val.isEmpty()) {
+                if (pd)
+                    pd->value = val;
+                if (attrs)
+                    *attrs = a;
+                return PropertyKey::fromArrayIndex(index);
+            }
+        }
+        arrayIndex = UINT_MAX;
+    }
+
+    while (memberIndex < o->internalClass()->size) {
+        PropertyKey n = o->internalClass()->nameMap.at(memberIndex);
+        if (!n.isStringOrSymbol()) {
+            // accessor properties have a dummy entry with n == 0
+            ++memberIndex;
+            continue;
+        }
+
+        uint index = memberIndex;
+        PropertyAttributes a = o->internalClass()->propertyData[memberIndex];
+        ++memberIndex;
+        if (pd) {
+            pd->value = *o->propertyData(index);
+            if (a.isAccessor())
+                pd->set = *o->propertyData(index + Object::SetterOffset);
+        }
+        if (attrs)
+            *attrs = a;
+        return n;
+    }
+
+    return PropertyKey::invalid();
+}
+
+OwnPropertyKeyIterator *Object::virtualOwnPropertyKeys(const Object *)
+{
+    return new ObjectOwnPropertyKeyIterator;
+}
+
 // Section 8.12.3
 ReturnedValue Object::internalGet(StringOrSymbol *name, const Value *receiver, bool *hasProperty) const
 {
diff --git a/src/qml/jsruntime/qv4object_p.h b/src/qml/jsruntime/qv4object_p.h
index a9ad926289..3f1eb2d537 100644
--- a/src/qml/jsruntime/qv4object_p.h
+++ b/src/qml/jsruntime/qv4object_p.h
@@ -280,8 +280,8 @@ public:
     }
 
     void initSparseArray();
-    SparseArrayNode *sparseBegin() { return arrayType() == Heap::ArrayData::Sparse ? d()->arrayData->sparse->begin() : nullptr; }
-    SparseArrayNode *sparseEnd() { return arrayType() == Heap::ArrayData::Sparse ? d()->arrayData->sparse->end() : nullptr; }
+    SparseArrayNode *sparseBegin() const { return arrayType() == Heap::ArrayData::Sparse ? d()->arrayData->sparse->begin() : nullptr; }
+    SparseArrayNode *sparseEnd() const { return arrayType() == Heap::ArrayData::Sparse ? d()->arrayData->sparse->end() : nullptr; }
 
     inline bool protoHasArray() {
         Scope scope(engine());
@@ -355,6 +355,8 @@ public:
     { return vtable()->deleteProperty(this, id); }
     void advanceIterator(ObjectIterator *it, Value *name, uint *index, Property *p, PropertyAttributes *attributes)
     { vtable()->advanceIterator(this, it, name, index, p, attributes); }
+    OwnPropertyKeyIterator *ownPropertyKeys() const
+    { return vtable()->ownPropertyKeys(this); }
     qint64 getLength() const { return vtable()->getLength(this); }
     ReturnedValue instanceOf(const Value &var) const
     { return vtable()->instanceOf(this, var); }
@@ -376,6 +378,7 @@ protected:
     static Heap::Object *virtualGetPrototypeOf(const Managed *);
     static bool virtualSetPrototypeOf(Managed *, const Object *);
     static void virtualAdvanceIterator(Managed *m, ObjectIterator *it, Value *name, uint *index, Property *p, PropertyAttributes *attributes);
+    static OwnPropertyKeyIterator *virtualOwnPropertyKeys(const Object *m);
     static qint64 virtualGetLength(const Managed *m);
     static ReturnedValue virtualInstanceOf(const Object *typeObject, const Value &var);
 
@@ -390,6 +393,16 @@ private:
     friend struct ObjectPrototype;
 };
 
+struct ObjectOwnPropertyKeyIterator : OwnPropertyKeyIterator
+{
+    uint arrayIndex = 0;
+    uint memberIndex = 0;
+    SparseArrayNode *arrayNode = nullptr;
+    ~ObjectOwnPropertyKeyIterator() override = default;
+    PropertyKey next(const Object *o, Property *pd = nullptr, PropertyAttributes *attrs = nullptr) override;
+
+};
+
 namespace Heap {
 
 struct BooleanObject : Object {
diff --git a/src/qml/jsruntime/qv4objectiterator.cpp b/src/qml/jsruntime/qv4objectiterator.cpp
index 73c09a864a..d4e07e3d77 100644
--- a/src/qml/jsruntime/qv4objectiterator.cpp
+++ b/src/qml/jsruntime/qv4objectiterator.cpp
@@ -43,6 +43,7 @@
 #include "qv4argumentsobject_p.h"
 #include "qv4string_p.h"
 #include "qv4iterator_p.h"
+#include "qv4propertykey_p.h"
 
 using namespace QV4;
 
@@ -51,20 +52,6 @@ void ForInIteratorPrototype::init(ExecutionEngine *)
     defineDefaultProperty(QStringLiteral("next"), method_next, 0);
 }
 
-ReturnedValue ForInIteratorPrototype::method_next(const FunctionObject *b, const Value *thisObject, const Value *, int)
-{
-    const ForInIteratorObject *forIn = thisObject->as<ForInIteratorObject>();
-    Q_ASSERT(forIn);
-    Scope scope(b->engine());
-    ScopedValue n(scope, forIn->nextPropertyName());
-    bool done = false;
-    if (n->asReturnedValue() == Encode::null()) {
-        done = true;
-        n = Primitive::undefinedValue();
-    }
-    return IteratorPrototype::createIterResultObject(scope.engine, n, done);
-}
-
 void ObjectIterator::init(const Object *o)
 {
     object->setM(o ? o->m() : nullptr);
@@ -200,7 +187,73 @@ DEFINE_OBJECT_VTABLE(ForInIteratorObject);
 void Heap::ForInIteratorObject::markObjects(Heap::Base *that, MarkStack *markStack)
 {
     ForInIteratorObject *o = static_cast<ForInIteratorObject *>(that);
+    o->object->mark(markStack);
     o->workArea[0].mark(markStack);
     o->workArea[1].mark(markStack);
     Object::markObjects(that, markStack);
 }
+
+void Heap::ForInIteratorObject::destroy()
+{
+    delete iterator;
+}
+
+ReturnedValue ForInIteratorPrototype::method_next(const FunctionObject *b, const Value *thisObject, const Value *, int)
+{
+    const ForInIteratorObject *forIn = static_cast<const ForInIteratorObject *>(thisObject);
+    Q_ASSERT(forIn);
+    Scope scope(b);
+
+    ScopedPropertyKey key(scope, forIn->nextProperty());
+    bool done = false;
+    if (!key->isValid())
+        done = true;
+    ScopedStringOrSymbol s(scope, key->toStringOrSymbol(scope.engine));
+    return IteratorPrototype::createIterResultObject(scope.engine, s, done);
+}
+
+
+PropertyKey ForInIteratorObject::nextProperty() const
+{
+    if (!d()->current)
+        return PropertyKey::invalid();
+
+    Scope scope(this);
+    ScopedObject c(scope, d()->current);
+    ScopedObject o(scope);
+    ScopedPropertyKey key(scope);
+    PropertyAttributes attrs;
+
+    while (1) {
+        while (1) {
+            key = d()->iterator->next(c, nullptr, &attrs);
+            if (!key->isValid())
+                break;
+            if (!attrs.isEnumerable() || key->isSymbol())
+                continue;
+            // check the property is not already defined earlier in the proto chain
+            if (d()->current != d()->object) {
+                o = d()->object;
+                bool shadowed = false;
+                while (o->d() != c->heapObject()) {
+                    if (o->getOwnProperty(key) != Attr_Invalid) {
+                        shadowed = true;
+                        break;
+                    }
+                    o = o->getPrototypeOf();
+                }
+                if (shadowed)
+                    continue;
+            }
+            return key;
+        }
+
+        c = c->getPrototypeOf();
+        d()->current.set(scope.engine, c->d());
+        if (!c)
+            break;
+        delete d()->iterator;
+        d()->iterator = c->ownPropertyKeys();
+    }
+    return PropertyKey::invalid();
+}
diff --git a/src/qml/jsruntime/qv4objectiterator_p.h b/src/qml/jsruntime/qv4objectiterator_p.h
index 1e7000ad1f..20eb918e12 100644
--- a/src/qml/jsruntime/qv4objectiterator_p.h
+++ b/src/qml/jsruntime/qv4objectiterator_p.h
@@ -111,14 +111,18 @@ private:
 };
 
 namespace Heap {
-struct ForInIteratorObject : Object {
+
+#define ForInIteratorObjectMembers(class, Member) \
+    Member(class, Pointer, Object *, object) \
+    Member(class, Pointer, Object *, current) \
+    Member(class, NoMark, OwnPropertyKeyIterator *, iterator)
+
+DECLARE_HEAP_OBJECT(ForInIteratorObject, Object) {
     void init(QV4::Object *o);
-    ObjectIterator &it() { return *reinterpret_cast<ObjectIterator*>(&itData); }
     Value workArea[2];
 
     static void markObjects(Heap::Base *that, MarkStack *markStack);
-private:
-    ObjectIteratorData itData;
+    void destroy();
 };
 
 }
@@ -135,16 +139,20 @@ struct ForInIteratorObject: Object {
     V4_OBJECT2(ForInIteratorObject, Object)
     Q_MANAGED_TYPE(ForInIterator)
     V4_PROTOTYPE(forInIteratorPrototype)
+    V4_NEEDS_DESTROY
 
-    ReturnedValue nextPropertyName() const { return d()->it().nextPropertyNameAsString(); }
+    PropertyKey nextProperty() const;
 };
 
 inline
 void Heap::ForInIteratorObject::init(QV4::Object *o)
 {
     Object::init();
-    it() = ObjectIterator(internalClass->engine, workArea, workArea + 1, o,
-                          ObjectIterator::EnumerableOnly | ObjectIterator::WithProtoChain);
+    if (!o)
+        return;
+    object.set(o->engine(), o->d());
+    current.set(o->engine(), o->d());
+    iterator = o->ownPropertyKeys();
 }
 
 
diff --git a/src/qml/jsruntime/qv4persistent.cpp b/src/qml/jsruntime/qv4persistent.cpp
index f8bc28160e..79c372348f 100644
--- a/src/qml/jsruntime/qv4persistent.cpp
+++ b/src/qml/jsruntime/qv4persistent.cpp
@@ -302,6 +302,10 @@ PersistentValue &PersistentValue::operator=(const PersistentValue &other)
             return *this;
         val = other.engine()->memoryManager->m_persistentValues->allocate();
     }
+    if (!other.val) {
+        *val = Encode::undefined();
+        return *this;
+    }
 
     Q_ASSERT(engine() == other.engine());
 
@@ -316,6 +320,10 @@ PersistentValue &PersistentValue::operator=(const WeakValue &other)
             return *this;
         val = other.engine()->memoryManager->m_persistentValues->allocate();
     }
+    if (!other.valueRef()) {
+        *val = Encode::undefined();
+        return *this;
+    }
 
     Q_ASSERT(engine() == other.engine());
 
@@ -379,6 +387,10 @@ WeakValue &WeakValue::operator=(const WeakValue &other)
             return *this;
         allocVal(other.engine());
     }
+    if (!other.val) {
+        *val = Encode::undefined();
+        return *this;
+    }
 
     Q_ASSERT(engine() == other.engine());
 
diff --git a/src/qml/jsruntime/qv4propertykey_p.h b/src/qml/jsruntime/qv4propertykey_p.h
index 14f8e961ea..7134b06c6d 100644
--- a/src/qml/jsruntime/qv4propertykey_p.h
+++ b/src/qml/jsruntime/qv4propertykey_p.h
@@ -130,6 +130,9 @@ public:
     Q_QML_EXPORT QString toQString() const;
     Heap::StringOrSymbol *toStringOrSymbol(ExecutionEngine *e);
     quint64 id() const { return val; }
+    static PropertyKey fromId(quint64 id) {
+        PropertyKey key; key.val = id; return key;
+    }
 
     enum FunctionNamePrefix {
         None,
diff --git a/src/qml/jsruntime/qv4qobjectwrapper.cpp b/src/qml/jsruntime/qv4qobjectwrapper.cpp
index a17de5d94d..61678acdad 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
+++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
@@ -814,6 +814,74 @@ void QObjectWrapper::virtualAdvanceIterator(Managed *m, ObjectIterator *it, Valu
     QV4::Object::virtualAdvanceIterator(m, it, name, index, p, attributes);
 }
 
+struct QObjectWrapperOwnPropertyKeyIterator : ObjectOwnPropertyKeyIterator
+{
+    int propertyIndex = 0;
+    ~QObjectWrapperOwnPropertyKeyIterator() override = default;
+    PropertyKey next(const Object *o, Property *pd = nullptr, PropertyAttributes *attrs = nullptr) override;
+
+};
+
+PropertyKey QObjectWrapperOwnPropertyKeyIterator::next(const Object *o, Property *pd, PropertyAttributes *attrs)
+{
+    // Used to block access to QObject::destroyed() and QObject::deleteLater() from QML
+    static const int destroyedIdx1 = QObject::staticMetaObject.indexOfSignal("destroyed(QObject*)");
+    static const int destroyedIdx2 = QObject::staticMetaObject.indexOfSignal("destroyed()");
+    static const int deleteLaterIdx = QObject::staticMetaObject.indexOfSlot("deleteLater()");
+
+    const QObjectWrapper *that = static_cast<const QObjectWrapper*>(o);
+
+    QObject *thatObject = that->d()->object();
+    if (thatObject && !QQmlData::wasDeleted(thatObject)) {
+        const QMetaObject *mo = thatObject->metaObject();
+        // These indices don't apply to gadgets, so don't block them.
+        const bool preventDestruction = mo->superClass() || mo == &QObject::staticMetaObject;
+        const int propertyCount = mo->propertyCount();
+        if (propertyIndex < propertyCount) {
+            ExecutionEngine *thatEngine = that->engine();
+            Scope scope(thatEngine);
+            const QMetaProperty property = mo->property(propertyIndex);
+            ScopedString propName(scope, thatEngine->newString(QString::fromUtf8(property.name())));
+            ++propertyIndex;
+            if (attrs)
+                *attrs= QV4::Attr_Data;
+            if (pd) {
+                QQmlPropertyData local;
+                local.load(property);
+                pd->value = that->getProperty(thatEngine, thatObject, &local);
+            }
+            return propName->toPropertyKey();
+        }
+        const int methodCount = mo->methodCount();
+        while (propertyIndex < propertyCount + methodCount) {
+            Q_ASSERT(propertyIndex >= propertyCount);
+            int index = propertyIndex - propertyCount;
+            const QMetaMethod method = mo->method(index);
+            ++propertyIndex;
+            if (method.access() == QMetaMethod::Private || (preventDestruction && (index == deleteLaterIdx || index == destroyedIdx1 || index == destroyedIdx2)))
+                continue;
+            ExecutionEngine *thatEngine = that->engine();
+            Scope scope(thatEngine);
+            ScopedString methodName(scope, thatEngine->newString(QString::fromUtf8(method.name())));
+            if (attrs)
+                *attrs = QV4::Attr_Data;
+            if (pd) {
+                QQmlPropertyData local;
+                local.load(method);
+                pd->value = that->getProperty(thatEngine, thatObject, &local);
+            }
+            return methodName->toPropertyKey();
+        }
+    }
+
+    return ObjectOwnPropertyKeyIterator::next(o, pd, attrs);
+}
+
+OwnPropertyKeyIterator *QObjectWrapper::virtualOwnPropertyKeys(const Object *)
+{
+    return new QObjectWrapperOwnPropertyKeyIterator;
+}
+
 namespace QV4 {
 
 struct QObjectSlotDispatcher : public QtPrivate::QSlotObjectBase
diff --git a/src/qml/jsruntime/qv4qobjectwrapper_p.h b/src/qml/jsruntime/qv4qobjectwrapper_p.h
index 7843289d33..203bbfa151 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper_p.h
+++ b/src/qml/jsruntime/qv4qobjectwrapper_p.h
@@ -182,12 +182,11 @@ struct Q_QML_EXPORT QObjectWrapper : public Object
 
     void destroyObject(bool lastCall);
 
-protected:
-    static bool virtualIsEqualTo(Managed *that, Managed *o);
-
     static ReturnedValue getProperty(ExecutionEngine *engine, QObject *object, QQmlPropertyData *property, bool captureRequired = true);
+protected:
     static void setProperty(ExecutionEngine *engine, QObject *object, QQmlPropertyData *property, const Value &value);
 
+    static bool virtualIsEqualTo(Managed *that, Managed *o);
     static ReturnedValue create(ExecutionEngine *engine, QObject *object);
 
     static QQmlPropertyData *findProperty(ExecutionEngine *engine, QObject *o, QQmlContextData *qmlContext, String *name, RevisionMode revisionMode, QQmlPropertyData *local);
@@ -197,6 +196,7 @@ protected:
     static bool virtualPut(Managed *m, PropertyKey id, const Value &value, Value *receiver);
     static PropertyAttributes virtualGetOwnProperty(Managed *m, PropertyKey id, Property *p);
     static void virtualAdvanceIterator(Managed *m, ObjectIterator *it, Value *name, uint *index, Property *p, PropertyAttributes *attributes);
+    static OwnPropertyKeyIterator *virtualOwnPropertyKeys(const Object *m);
 
     static ReturnedValue method_connect(const FunctionObject *, const Value *thisObject, const Value *argv, int argc);
     static ReturnedValue method_disconnect(const FunctionObject *, const Value *thisObject, const Value *argv, int argc);
diff --git a/src/qml/jsruntime/qv4sequenceobject.cpp b/src/qml/jsruntime/qv4sequenceobject.cpp
index 1ba889ee82..ab05a819c1 100644
--- a/src/qml/jsruntime/qv4sequenceobject.cpp
+++ b/src/qml/jsruntime/qv4sequenceobject.cpp
@@ -365,6 +365,38 @@ public:
         QV4::Object::virtualAdvanceIterator(this, it, name, index, p, attrs);
     }
 
+    struct OwnPropertyKeyIterator : ObjectOwnPropertyKeyIterator
+    {
+        ~OwnPropertyKeyIterator() override = default;
+        PropertyKey next(const Object *o, Property *pd = nullptr, PropertyAttributes *attrs = nullptr) override
+        {
+            const QQmlSequence *s = static_cast<const QQmlSequence *>(o);
+
+            if (s->d()->isReference) {
+                if (!s->d()->object)
+                    return ObjectOwnPropertyKeyIterator::next(o, pd, attrs);
+                s->loadReference();
+            }
+
+            if (arrayIndex < static_cast<uint>(s->d()->container->size())) {
+                uint index = arrayIndex;
+                ++arrayIndex;
+                if (attrs)
+                    *attrs = QV4::Attr_Data;
+                if (pd)
+                    pd->value = convertElementToValue(s->engine(), s->d()->container->at(index));
+                return PropertyKey::fromArrayIndex(index);
+            }
+
+            return ObjectOwnPropertyKeyIterator::next(o, pd, attrs);
+        }
+    };
+
+    static OwnPropertyKeyIterator *containerOwnPropertyKeys(const Object *)
+    {
+        return new OwnPropertyKeyIterator;
+    }
+
     bool containerDeleteIndexedProperty(uint index)
     {
         /* Qt containers have int (rather than uint) allowable indexes. */
@@ -589,6 +621,8 @@ public:
     { return static_cast<QQmlSequence<Container> *>(that)->containerIsEqualTo(other); }
     static void virtualAdvanceIterator(Managed *that, ObjectIterator *it, Value *name, uint *index, Property *p, PropertyAttributes *attrs)
     { return static_cast<QQmlSequence<Container> *>(that)->containerAdvanceIterator(it, name, index, p, attrs); }
+    static QV4::OwnPropertyKeyIterator *virtualOwnPropertyKeys(const Object *m)
+    { return static_cast<const QQmlSequence<Container> *>(m)->containerOwnPropertyKeys(m);}
 
 };
 
diff --git a/src/qml/jsruntime/qv4stringobject.cpp b/src/qml/jsruntime/qv4stringobject.cpp
index f2d0d52013..12fed62bcc 100644
--- a/src/qml/jsruntime/qv4stringobject.cpp
+++ b/src/qml/jsruntime/qv4stringobject.cpp
@@ -137,24 +137,58 @@ void StringObject::virtualAdvanceIterator(Managed *m, ObjectIterator *it, Value
     return Object::virtualAdvanceIterator(m, it, name, index, p, attrs);
 }
 
+
+struct StringObjectOwnPropertyKeyIterator : ObjectOwnPropertyKeyIterator
+{
+    ~StringObjectOwnPropertyKeyIterator() override = default;
+    PropertyKey next(const Object *o, Property *pd = nullptr, PropertyAttributes *attrs = nullptr) override;
+
+};
+
+PropertyKey StringObjectOwnPropertyKeyIterator::next(const Object *o, Property *pd, PropertyAttributes *attrs)
+{
+    const StringObject *s = static_cast<const StringObject *>(o);
+    uint slen = s->d()->string->toQString().length();
+    if (arrayIndex < slen) {
+        uint index = arrayIndex;
+        ++arrayIndex;
+        if (attrs)
+            *attrs = Attr_NotConfigurable|Attr_NotWritable;
+        if (pd)
+            pd->value = s->getIndex(index);
+        return PropertyKey::fromArrayIndex(index);
+    } else if (arrayIndex == slen) {
+        if (s->arrayData()) {
+            arrayNode = s->sparseBegin();
+            // iterate until we're past the end of the string
+            while (arrayNode && arrayNode->key() < slen)
+                arrayNode = arrayNode->nextNode();
+        }
+    }
+
+    return ObjectOwnPropertyKeyIterator::next(o, pd, attrs);
+}
+
+OwnPropertyKeyIterator *StringObject::virtualOwnPropertyKeys(const Object *)
+{
+    return new StringObjectOwnPropertyKeyIterator;
+}
+
 PropertyAttributes StringObject::virtualGetOwnProperty(Managed *m, PropertyKey id, Property *p)
 {
     PropertyAttributes attributes = Object::virtualGetOwnProperty(m, id, p);
     if (attributes != Attr_Invalid)
         return attributes;
 
-    Object *o = static_cast<Object *>(m);
-    if (id.isArrayIndex()) {
-        uint index = id.asArrayIndex();
-        if (o->isStringObject()) {
-            if (index >= static_cast<const StringObject *>(m)->length())
-                return Attr_Invalid;
-            if (p)
-                p->value = static_cast<StringObject *>(o)->getIndex(index);
-            return Attr_NotConfigurable|Attr_NotWritable;
-        }
+    StringObject *s = static_cast<StringObject *>(m);
+    uint slen = s->d()->string->toQString().length();
+    uint index = id.asArrayIndex();
+    if (index < slen) {
+        if (p)
+            p->value = static_cast<StringObject *>(s)->getIndex(index);
+        return Attr_NotConfigurable|Attr_NotWritable;
     }
-    return Attr_Invalid;
+    return Object::virtualGetOwnProperty(m, id, p);
 }
 
 DEFINE_OBJECT_VTABLE(StringCtor);
diff --git a/src/qml/jsruntime/qv4stringobject_p.h b/src/qml/jsruntime/qv4stringobject_p.h
index 2d37e36b34..4dd114e06a 100644
--- a/src/qml/jsruntime/qv4stringobject_p.h
+++ b/src/qml/jsruntime/qv4stringobject_p.h
@@ -102,6 +102,7 @@ struct StringObject: Object {
 protected:
     static bool virtualDeleteProperty(Managed *m, PropertyKey id);
     static void virtualAdvanceIterator(Managed *m, ObjectIterator *it, Value *name, uint *index, Property *p, PropertyAttributes *attrs);
+    static OwnPropertyKeyIterator *virtualOwnPropertyKeys(const Object *m);
     static PropertyAttributes virtualGetOwnProperty(Managed *m, PropertyKey id, Property *p);
 };
 
diff --git a/src/qml/jsruntime/qv4vtable_p.h b/src/qml/jsruntime/qv4vtable_p.h
index b4e868d45d..aff8eb83ac 100644
--- a/src/qml/jsruntime/qv4vtable_p.h
+++ b/src/qml/jsruntime/qv4vtable_p.h
@@ -56,6 +56,11 @@ QT_BEGIN_NAMESPACE
 
 namespace QV4 {
 
+struct OwnPropertyKeyIterator {
+    virtual ~OwnPropertyKeyIterator() = 0;
+    virtual PropertyKey next(const Object *o, Property *p = nullptr, PropertyAttributes *attrs = nullptr) = 0;
+};
+
 struct VTable
 {
     typedef void (*Destroy)(Heap::Base *);
@@ -74,6 +79,7 @@ struct VTable
     typedef bool (*SetPrototypeOf)(Managed *, const Object *);
     typedef qint64 (*GetLength)(const Managed *m);
     typedef void (*AdvanceIterator)(Managed *m, ObjectIterator *it, Value *name, uint *index, Property *p, PropertyAttributes *attributes);
+    typedef OwnPropertyKeyIterator *(*OwnPropertyKeys)(const Object *m);
     typedef ReturnedValue (*InstanceOf)(const Object *typeObject, const Value &var);
 
     typedef ReturnedValue (*Call)(const FunctionObject *, const Value *thisObject, const Value *argv, int argc);
@@ -109,6 +115,7 @@ struct VTable
     SetPrototypeOf setPrototypeOf;
     GetLength getLength;
     AdvanceIterator advanceIterator;
+    OwnPropertyKeys ownPropertyKeys;
     InstanceOf instanceOf;
 
     Call call;
@@ -133,6 +140,7 @@ protected:
     static constexpr VTable::SetPrototypeOf virtualSetPrototypeOf = nullptr;
     static constexpr VTable::GetLength virtualGetLength = nullptr;
     static constexpr VTable::AdvanceIterator virtualAdvanceIterator = nullptr;
+    static constexpr VTable::OwnPropertyKeys virtualOwnPropertyKeys = nullptr;
     static constexpr VTable::InstanceOf virtualInstanceOf = nullptr;
 
     static constexpr VTable::Call virtualCall = nullptr;
@@ -172,6 +180,7 @@ protected:
     classname::virtualSetPrototypeOf,       \
     classname::virtualGetLength,            \
     classname::virtualAdvanceIterator,      \
+    classname::virtualOwnPropertyKeys,      \
     classname::virtualInstanceOf,           \
     \
     classname::virtualCall,                 \