CSS outlines are still only vaguely defined and tables even less so (I mean, table-layout: auto, which is the initial value, is only now finally getting specified; it's probably the least defined but most relied upon bit of the web platform now). There's definitely still places where undefined behaviour still lives, especially around CSS.
Without actually digging into it (I'm on vacation damnit), I'm pretty sure all renderings are valid per CSS 2.1 (though I don't think they are per CSS UI 3 or 4? but maybe that's still a SHOULD level requirement given people wanting to publish as REC ).
The CSS WG has been pretty poor at actually tightening up specification for old features (on the face of it, due to lack of editorial time, which really points at a separate problem).
(Also, given the for(in) example, as I'm sure you know but for the benefit of others, note that iteration order of each object on the prototype chain is still undefined, and not interoperable.)
Some other good examples of things that have been standardised over the past decade: HTML parsing(!), what specific DOM exceptions are thrown all over the place, when the various document load events fire.
Sorry yes for(in) over prototype chains is where mutation of the property list actually becomes visible -- mutating own properties on an object while iterating is specified IIRC, it's what happens when own properties alias properties in the prototype chain, or when mutating properties in the prototype chain. I blame Brendan :D
Pretty sure mutating own properties is undefined, but I'm years out of working on any JS VM and only vaguely pay attention (and looked into this a few months ago and was surprised to find iteration order still undefined!). I wonder how many unique behaviours we have with iteration order now… Is Gecko the only odd one out? Is there still any implementation that has different behaviour with dense/sparse arrays (by which I mean properties not the Array object)?
Own properties are well define (and were in 3.1 IIRC). Deleted properties are not visited, added properties are not visited.
But behavior when you deleted an own property that shadowed a property on the proto chain, and what happens when you add such property back.
Also the historic spec mandated integer properties on regular objects were iterated in insertion order as well, but V8 chose not to implement that as doing so broke their "Indexed properties are just an array" semantics. Because of the huge perf impact other browsers had to go down that same path.
Nah, the spec has never defined it; it never even mandated insertion order. (I remember a bunch of discussions about this given we, in Carakan, decided to match V8.) https://tc39.github.io/ecma262/#sec-enumerate-object-propert... is the current definition of object enumeration.
Without actually digging into it (I'm on vacation damnit), I'm pretty sure all renderings are valid per CSS 2.1 (though I don't think they are per CSS UI 3 or 4? but maybe that's still a SHOULD level requirement given people wanting to publish as REC ).
The CSS WG has been pretty poor at actually tightening up specification for old features (on the face of it, due to lack of editorial time, which really points at a separate problem).
(Also, given the for(in) example, as I'm sure you know but for the benefit of others, note that iteration order of each object on the prototype chain is still undefined, and not interoperable.)
Some other good examples of things that have been standardised over the past decade: HTML parsing(!), what specific DOM exceptions are thrown all over the place, when the various document load events fire.