LibJS: Bring ForIn body evaluation closer to the specification

This fixes 2 bugs in our current implementation:
 * Properties deleted during iteration were still being iterated
 * Properties with the same name in both the object and it's prototype
   were iterated twice

Userland/Libraries/LibJS/AST.cpp

@@ -1021,9 +1021,7 @@ Completion ForInStatement::loop_evaluation(Interpreter& interpreter, GlobalObjec
     // 3. Let V be undefined.
     auto last_value = js_undefined();
 
-    while (object) {
-        auto property_names = TRY(object->enumerable_own_property_names(Object::PropertyKind::Key));
-        for (auto& value : property_names) {
+    auto result = object->enumerate_object_properties([&](auto value) -> Optional<Completion> {
         TRY(for_in_head_state.execute_head(interpreter, global_object, value));
 
         // l. Let result be the result of evaluating stmt.
@@ -1041,10 +1039,11 @@ Completion ForInStatement::loop_evaluation(Interpreter& interpreter, GlobalObjec
         // o. If result.[[Value]] is not empty, set V to result.[[Value]].
         if (result.value().has_value())
             last_value = *result.value();
-        }
-        object = TRY(object->internal_get_prototype_of());
-    }
-    return last_value;
+
+        return {};
+    });
+
+    return result.value_or(last_value);
 }
 
 // 14.1.1 Runtime Semantics: Evaluation, https://tc39.es/ecma262/#sec-statement-semantics-runtime-semantics-evaluation

Userland/Libraries/LibJS/Tests/loops/for-in-basic.js

@@ -99,3 +99,24 @@ describe("special left hand sides", () => {
         }).toThrowWithMessage(ReferenceError, "Invalid left-hand side in assignment");
     });
 });
+
+test("remove properties while iterating", () => {
+    const from = [1, 2, 3];
+    const to = [];
+    for (const prop in from) {
+        to.push(prop);
+        from.pop();
+    }
+    expect(to).toEqual(["0", "1"]);
+});
+
+test("duplicated properties in prototype", () => {
+    const object = { a: 1 };
+    const proto = { a: 2 };
+    Object.setPrototypeOf(object, proto);
+    const a = [];
+    for (const prop in object) {
+        a.push(prop);
+    }
+    expect(a).toEqual(["a"]);
+});