Pretty sure mutating own properties is undefined, but I'm years out of working on any JS VM and only vaguely pay attention (and looked into this a few months ago and was surprised to find iteration order still undefined!). I wonder how many unique behaviours we have with iteration order now… Is Gecko the only odd one out? Is there still any implementation that has different behaviour with dense/sparse arrays (by which I mean properties not the Array object)?
Own properties are well define (and were in 3.1 IIRC). Deleted properties are not visited, added properties are not visited.
But behavior when you deleted an own property that shadowed a property on the proto chain, and what happens when you add such property back.
Also the historic spec mandated integer properties on regular objects were iterated in insertion order as well, but V8 chose not to implement that as doing so broke their "Indexed properties are just an array" semantics. Because of the huge perf impact other browsers had to go down that same path.
Nah, the spec has never defined it; it never even mandated insertion order. (I remember a bunch of discussions about this given we, in Carakan, decided to match V8.) https://tc39.github.io/ecma262/#sec-enumerate-object-propert... is the current definition of object enumeration.
