IE8 property enumeration of replaced built-in properties (e.g. `toString`)

I've run into a very odd issue with IE8's JS engine (possibly previous versions as well, but NOT IE9 in IE8 mode since the JS engine doesn't fallback). Simplified example:

var foo = { toString : 42, x : 22 };
for(var n in foo){ 
    console.log(n)
}

// result: "x"

In other words, the toString property never gets enumerated. Nor would valueOf, hasOwnProperty, etc... or var x = 5; x.toFixed = 42;

So any property that natively exists can not be enumerated as far as I can tell, even after you replace it...

My question -- Does anyone know of any way to actually access these?!? I need to because I'm walking the prototype of an object and the toString function 开发者_如何学Cisn't getting picked up.

So, the behavior you're experiencing in IE is the so-called "JScript DontEnum Bug" which exists in IE8 and below.

In IE < 9, JScript will skip over any property in any object where there is a same-named property in the object's prototype chain that has the DontEnum attribute.

Source: https://developer.mozilla.org/en/ECMAScript_DontEnum_attribute#JScript_DontEnum_Bug