QML: Fix proxy iteration

If the target of a proxy was extensible, we did not set the
iteratorTarget to its correct value, and thus the ForInIteratorObject
would not be usable.

Fixes: QTBUG-86323
Change-Id: Id1924ac4087bab38c006b8eba92b619b79d36b7a
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
(cherry picked from commit dd740d6b3469448dc1fd31c1742781e923e9f274)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

2 files changed, 39 insertions, 0 deletions

diff --git a/tests/auto/qml/qqmlecmascript/data/proxyIteration.qml b/tests/auto/qml/qqmlecmascript/data/proxyIteration.qml
new file mode 100644
index 0000000000..affba7d9f1
--- /dev/null
+++ b/tests/auto/qml/qqmlecmascript/data/proxyIteration.qml
@@ -0,0 +1,29 @@
+import QtQml 2
+
+QtObject {
+  id: root
+  property int sum
+  Component.onCompleted: {
+    const target = { prop1: 1, prop2: 2, prop3: 3 };
+    const handler = {
+      get: function(target, key) {
+        return target[key]+1;
+      },
+      ownKeys: function() {
+        return ["prop1", "prop3"];
+      },
+      getOwnPropertyDescriptor: function(target, key) {
+        return {
+          value: this.get(target, key),
+          enumerable: true,
+          configurable: true
+        };
+      }
+    };
+    const proxy = new Proxy(target, handler);
+    for (var prop in proxy) {
+      root.sum += proxy[prop] // prop2 gets skipped, the values of 1 and 3 get incremented
+    }
+    // so root.sum should be 6 now
+  }
+}
diff --git a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
index 31611f2f27..73c2267dca 100644
--- a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
+++ b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
@@ -393,6 +393,7 @@ private slots:
     void urlSearchParamsMethods();
     void variantConversionMethod();
     void sequenceConversionMethod();
+    void proxyIteration();
     void proxyHandlerTraps();
     void gcCrashRegressionTest();
 
@@ -9525,6 +9526,15 @@ void tst_qqmlecmascript::sequenceConversionMethod()
     QCOMPARE(obj.funcCalled, QLatin1String("stringlist"));
 }
 
+void tst_qqmlecmascript::proxyIteration()
+{
+    QQmlEngine engine;
+    QQmlComponent component(&engine, testFileUrl("proxyIteration.qml"));
+    QScopedPointer<QObject> root(component.create());
+    QVERIFY2(root != nullptr, qPrintable(component.errorString()));
+    QCOMPARE(root->property("sum").toInt(), 6);
+}
+
 void tst_qqmlecmascript::proxyHandlerTraps()
 {
     const QString expression = QStringLiteral(R"SNIPPET(