From 3186b30e34b4ecca7f99a5e0dc4f2f031442483a Mon Sep 17 00:00:00 2001
From: Andrey Kosyakov <caseq@chromium.org>
Date: Wed, 19 Aug 2026 17:24:44 -0700
Subject: [PATCH] Expect callback passed to Array::Iterate() may potentially cause a GC

We practically only need it in rare cases, but enforcing it consistently
across different array types may be difficult and confusing for the client.
On the other hand, these days, the embedder is supposed to use
TryToCopyAndConvertArrayToCppBuffer() for the **real** fast path.

Bug: 522061704
Change-Id: Ic917238e9618f08661dc88f620fc04fea66246a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8269609
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Andrey Kosyakov <caseq@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#109405}
---
diff --git a/include/v8-container.h b/include/v8-container.h
index 380999e5..213e38d 100644
--- a/include/v8-container.h
+++ b/include/v8-container.h
@@ -76,17 +76,8 @@
    * This function will typically be faster than calling {Get()} repeatedly.
    * As a consequence of being optimized for low overhead, the provided
    * callback must adhere to the following restrictions:
-   *  - It must not allocate any V8 objects and continue iterating; it may
-   *    allocate (e.g. an error message/object) and then immediately terminate
-   *    the iteration.
    *  - It must not modify the array being iterated.
-   *  - It must not call back into V8 (unless it can guarantee that such a
-   *    call does not violate the above restrictions, which is difficult).
-   *  - The {Local<Value> element} must not "escape", i.e. must not be assigned
-   *    to any other {Local}. Creating a {Global} from it, or updating a
-   *    v8::TypecheckWitness with it, is safe.
-   * These restrictions may be lifted in the future if use cases arise that
-   * justify a slower but more robust implementation.
+   *  - It must not call back into V8 to execute JavaScript.
    *
    * Returns {Nothing} on exception; use a {TryCatch} to catch and handle this
    * exception.
diff --git a/src/api/api.cc b/src/api/api.cc
index 8a7affc..9ed5925 100644
--- a/src/api/api.cc
+++ b/src/api/api.cc
@@ -8318,11 +8318,6 @@
                                    void* callback_data) {
   // Instead of relying on callers to check condition, this function returns
   // {kSlowPath} for situations it can't handle.
-  // Most code paths below don't allocate, and rely on {callback} not allocating
-  // either, but this isn't enforced with {DisallowHeapAllocation} to allow
-  // embedders to allocate error objects before terminating the iteration.
-  // Since {callback} must not allocate anyway, we can get away with fake
-  // handles, reducing per-element overhead.
   if (!CanUseFastIteration(isolate, array)) return FastIterateResult::kSlowPath;
   using Result = v8::Array::CallbackResult;
   DisallowJavascriptExecution no_js(isolate);
@@ -8334,14 +8329,12 @@
     case PACKED_FROZEN_ELEMENTS:
     case PACKED_SEALED_ELEMENTS:
     case PACKED_NONEXTENSIBLE_ELEMENTS: {
-      Tagged<FixedArray> elements = Cast<FixedArray>(array->elements());
-      for (uint32_t i = 0; i < length; i++) {
-        Tagged<Object> element = elements->get(static_cast<int>(i));
-        // TODO(13270): When we switch to CSS, we can pass {element} to
-        // the callback directly, without {fake_handle}.
-        IndirectHandle<Object> fake_handle(
-            reinterpret_cast<Address*>(&element));
-        Result result = callback(i, Utils::ToLocal(fake_handle), callback_data);
+      DirectHandle<FixedArray> elements(Cast<FixedArray>(array->elements()),
+                                        isolate);
+      FOR_WITH_HANDLE_SCOPE(isolate, uint32_t i = 0, i, i < length, i++) {
+        DirectHandle<Object> element(elements->get(static_cast<int>(i)),
+                                     isolate);
+        Result result = callback(i, Utils::ToLocal(element), callback_data);
         if (result != Result::kContinue) {
           return static_cast<FastIterateResult>(result);
         }
@@ -8354,16 +8347,16 @@
     case HOLEY_SEALED_ELEMENTS:
     case HOLEY_NONEXTENSIBLE_ELEMENTS:
     case HOLEY_ELEMENTS: {
-      Tagged<FixedArray> elements = Cast<FixedArray>(array->elements());
-      for (uint32_t i = 0; i < length; i++) {
-        Tagged<Object> element = elements->get(static_cast<int>(i));
-        // TODO(13270): When we switch to CSS, we can pass {element} to
-        // the callback directly, without {fake_handle}.
-        auto fake_handle =
-            IsTheHole(element)
-                ? isolate->factory()->undefined_value()
-                : IndirectHandle<Object>(reinterpret_cast<Address*>(&element));
-        Result result = callback(i, Utils::ToLocal(fake_handle), callback_data);
+      DirectHandle<FixedArray> elements(Cast<FixedArray>(array->elements()),
+                                        isolate);
+      FOR_WITH_HANDLE_SCOPE(isolate, uint32_t i = 0, i, i < length, i++) {
+        DirectHandle<Object> element(elements->get(static_cast<int>(i)),
+                                     isolate);
+        DirectHandle<Object> value =
+            IsTheHole(*element)
+                ? DirectHandle<Object>(isolate->factory()->undefined_value())
+                : element;
+        Result result = callback(i, Utils::ToLocal(value), callback_data);
         if (result != Result::kContinue) {
           return static_cast<FastIterateResult>(result);
         }
@@ -8379,10 +8372,10 @@
       FOR_WITH_HANDLE_SCOPE(isolate, uint32_t i = 0, i, i < length, i++) {
         DirectHandle<Object> value;
         if (elements->is_the_hole(i)) {
-          value = Handle<Object>(isolate->factory()->undefined_value());
+          value = isolate->factory()->undefined_value();
 #ifdef V8_ENABLE_UNDEFINED_DOUBLE
         } else if (elements->is_undefined(i)) {
-          value = Handle<Object>(isolate->factory()->undefined_value());
+          value = isolate->factory()->undefined_value();
 #endif  // V8_ENABLE_UNDEFINED_DOUBLE
         } else {
           value = isolate->factory()->NewNumber(elements->get_scalar(i));
@@ -8396,32 +8389,32 @@
       return FastIterateResult::kFinished;
     }
     case DICTIONARY_ELEMENTS: {
-      DisallowGarbageCollection no_gc;
-      Tagged<NumberDictionary> dict = array->element_dictionary();
       struct Entry {
         uint32_t index;
         InternalIndex entry;
       };
       std::vector<Entry> sorted;
-      sorted.reserve(dict->NumberOfElements());
-      ReadOnlyRoots roots(isolate);
-      for (InternalIndex i : dict->IterateEntries()) {
-        Tagged<Object> key = dict->KeyAt(i);
-        if (!dict->IsKey(roots, key)) continue;
-        uint32_t index =
-            static_cast<uint32_t>(Object::NumberValue(Cast<Number>(key)));
-        sorted.push_back({index, i});
+      DirectHandle<NumberDictionary> dict(array->element_dictionary(), isolate);
+      {
+        DisallowGarbageCollection no_gc;
+        ReadOnlyRoots roots(isolate);
+        sorted.reserve(dict->NumberOfElements());
+        for (InternalIndex i : dict->IterateEntries()) {
+          Tagged<Object> key = dict->KeyAt(i);
+          if (!dict->IsKey(roots, key)) continue;
+          uint32_t index =
+              static_cast<uint32_t>(Object::NumberValue(Cast<Number>(key)));
+          sorted.push_back({index, i});
+        }
+        std::sort(
+            sorted.begin(), sorted.end(),
+            [](const Entry& a, const Entry& b) { return a.index < b.index; });
       }
-      std::sort(
-          sorted.begin(), sorted.end(),
-          [](const Entry& a, const Entry& b) { return a.index < b.index; });
-      for (const Entry& entry : sorted) {
-        Tagged<Object> value = dict->ValueAt(entry.entry);
-        // TODO(13270): When we switch to CSS, we can pass {element} to
-        // the callback directly, without {fake_handle}.
-        IndirectHandle<Object> fake_handle(reinterpret_cast<Address*>(&value));
+      FOR_WITH_HANDLE_SCOPE(isolate, size_t i = 0, i, i < sorted.size(), i++) {
+        const Entry& entry = sorted[i];
+        DirectHandle<Object> value(dict->ValueAt(entry.entry), isolate);
         Result result =
-            callback(entry.index, Utils::ToLocal(fake_handle), callback_data);
+            callback(entry.index, Utils::ToLocal(value), callback_data);
         if (result != Result::kContinue) {
           return static_cast<FastIterateResult>(result);
         }
diff --git a/test/unittests/api/v8-array-unittest.cc b/test/unittests/api/v8-array-unittest.cc
index b0166eb..55eb0d5 100644
--- a/test/unittests/api/v8-array-unittest.cc
+++ b/test/unittests/api/v8-array-unittest.cc
@@ -5,7 +5,11 @@
 #include "include/v8-container.h"
 #include "include/v8-primitive.h"
 #include "include/v8-value.h"
+#include "src/api/api-inl.h"
 #include "src/execution/protectors-inl.h"
+#include "src/heap/heap-inl.h"
+#include "src/objects/js-array-inl.h"
+#include "test/unittests/heap/heap-utils.h"
 #include "test/unittests/interpreter/interpreter-tester.h"
 #include "test/unittests/test-utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -241,5 +245,167 @@
       internal::Isolate::Current()));
 }
 
+TEST_F(ArrayTest, IterateWithGC) {
+  i::v8_flags.expose_gc = true;
+  HandleScope scope(isolate());
+
+  struct ArrayTestCase {
+    const char* js_source;
+    internal::ElementsKind expected_kind;
+    std::vector<std::string> expected_values;
+  };
+
+  const ArrayTestCase test_cases[] = {
+      // PACKED_SMI_ELEMENTS
+      {"[10, 20, 30]", internal::PACKED_SMI_ELEMENTS, {"10", "20", "30"}},
+      // HOLEY_SMI_ELEMENTS
+      {"(() => { const a = [10, 20, 30]; delete a[1]; return a; })()",
+       internal::HOLEY_SMI_ELEMENTS,
+       {"10", "undefined", "30"}},
+      // PACKED_ELEMENTS
+      {"['foo', 'bar', 'baz']",
+       internal::PACKED_ELEMENTS,
+       {"foo", "bar", "baz"}},
+      // HOLEY_ELEMENTS
+      {"(() => { const a = ['foo', 'bar', 'baz']; delete a[1]; return a; })()",
+       internal::HOLEY_ELEMENTS,
+       {"foo", "undefined", "baz"}},
+      // PACKED_DOUBLE_ELEMENTS
+      {"[1.5, 2.5, 3.5]",
+       internal::PACKED_DOUBLE_ELEMENTS,
+       {"1.5", "2.5", "3.5"}},
+      // HOLEY_DOUBLE_ELEMENTS
+      {"(() => { const a = [1.5, 2.5, 3.5]; delete a[1]; return a; })()",
+       internal::HOLEY_DOUBLE_ELEMENTS,
+       {"1.5", "undefined", "3.5"}},
+      // PACKED_NONEXTENSIBLE_ELEMENTS (Object and Smi)
+      {"Object.preventExtensions(['a', 'b', 'c'])",
+       internal::PACKED_NONEXTENSIBLE_ELEMENTS,
+       {"a", "b", "c"}},
+      {"Object.preventExtensions([10, 20, 30])",
+       internal::PACKED_NONEXTENSIBLE_ELEMENTS,
+       {"10", "20", "30"}},
+      // HOLEY_NONEXTENSIBLE_ELEMENTS (Object and Smi)
+      {"(() => { const a = ['a', 'b', 'c']; delete a[1]; return "
+       "Object.preventExtensions(a); })()",
+       internal::HOLEY_NONEXTENSIBLE_ELEMENTS,
+       {"a", "undefined", "c"}},
+      {"(() => { const a = [10, 20, 30]; delete a[1]; return "
+       "Object.preventExtensions(a); })()",
+       internal::HOLEY_NONEXTENSIBLE_ELEMENTS,
+       {"10", "undefined", "30"}},
+      // PACKED_SEALED_ELEMENTS (Object and Smi)
+      {"Object.seal(['a', 'b', 'c'])",
+       internal::PACKED_SEALED_ELEMENTS,
+       {"a", "b", "c"}},
+      {"Object.seal([10, 20, 30])",
+       internal::PACKED_SEALED_ELEMENTS,
+       {"10", "20", "30"}},
+      // HOLEY_SEALED_ELEMENTS (Object and Smi)
+      {"(() => { const a = ['a', 'b', 'c']; delete a[1]; return "
+       "Object.seal(a); })()",
+       internal::HOLEY_SEALED_ELEMENTS,
+       {"a", "undefined", "c"}},
+      {"(() => { const a = [10, 20, 30]; delete a[1]; return "
+       "Object.seal(a); })()",
+       internal::HOLEY_SEALED_ELEMENTS,
+       {"10", "undefined", "30"}},
+      // PACKED_FROZEN_ELEMENTS (Object and Smi)
+      {"Object.freeze(['a', 'b', 'c'])",
+       internal::PACKED_FROZEN_ELEMENTS,
+       {"a", "b", "c"}},
+      {"Object.freeze([10, 20, 30])",
+       internal::PACKED_FROZEN_ELEMENTS,
+       {"10", "20", "30"}},
+      // HOLEY_FROZEN_ELEMENTS (Object and Smi)
+      {"(() => { const a = ['a', 'b', 'c']; delete a[1]; return "
+       "Object.freeze(a); })()",
+       internal::HOLEY_FROZEN_ELEMENTS,
+       {"a", "undefined", "c"}},
+      {"(() => { const a = [10, 20, 30]; delete a[1]; return "
+       "Object.freeze(a); })()",
+       internal::HOLEY_FROZEN_ELEMENTS,
+       {"10", "undefined", "30"}},
+      // DICTIONARY_ELEMENTS (Sparse array)
+      {"(() => { const a = []; a[0] = 'a'; a[10000] = 'b'; return a; })()",
+       internal::DICTIONARY_ELEMENTS,
+       {"a", "b"}},
+      // DICTIONARY_ELEMENTS (Dense array with reconfigured property)
+      {"(() => { const a = [10, 20, 30]; Object.defineProperty(a, '0', "
+       "{value: 10, configurable: false, writable: false}); return a; })()",
+       internal::DICTIONARY_ELEMENTS,
+       {"10", "20", "30"}},
+      // Empty array (PACKED_SMI_ELEMENTS, length 0)
+      {"[]", internal::PACKED_SMI_ELEMENTS, {}},
+  };
+
+  struct IterationData {
+    Isolate* isolate;
+    Local<Context> context;
+    std::vector<std::pair<uint32_t, std::string>> visited;
+  };
+
+  for (const auto& tc : test_cases) {
+    Local<Array> array = RunJS(tc.js_source).As<Array>();
+    CHECK(array->IsArray());
+    auto i_array = Utils::OpenDirectHandle(*array);
+    CHECK_EQ(i_array->GetElementsKind(), tc.expected_kind);
+
+    IterationData data{isolate(), context(), {}};
+    Array::IterationCallback callback = [](uint32_t index, Local<Value> element,
+                                           void* data_ptr) -> CbResult {
+      IterationData* d = static_cast<IterationData*>(data_ptr);
+      // Perform GC within the iteration callback.
+      d->isolate->RequestGarbageCollectionForTesting(
+          v8::Isolate::kFullGarbageCollection);
+
+      // Also allocate some new objects in the heap.
+      Local<String> allocated_str =
+          String::NewFromUtf8Literal(d->isolate, "test_alloc");
+      CHECK(!allocated_str.IsEmpty());
+
+      std::string val_str;
+      if (element->IsUndefined()) {
+        val_str = "undefined";
+      } else if (element->IsNumber()) {
+        double val = element.As<Number>()->Value();
+        if (val == static_cast<int64_t>(val)) {
+          val_str = std::to_string(static_cast<int64_t>(val));
+        } else {
+          val_str = std::to_string(val);
+          // Strip trailing zeroes for clean comparison with "1.5", "2.5", "3.5"
+          val_str.erase(val_str.find_last_not_of('0') + 1, std::string::npos);
+          if (val_str.back() == '.') val_str.pop_back();
+        }
+      } else if (element->IsString()) {
+        String::Utf8Value utf8(d->isolate, element.As<String>());
+        val_str = *utf8;
+      } else {
+        val_str = "unknown";
+      }
+      d->visited.emplace_back(index, val_str);
+      return CbResult::kContinue;
+    };
+
+    CHECK(array->Iterate(context(), callback, &data).IsJust());
+
+    if (tc.expected_kind == internal::DICTIONARY_ELEMENTS &&
+        tc.expected_values.size() == 2 && tc.expected_values[0] == "a" &&
+        tc.expected_values[1] == "b") {
+      CHECK_EQ(data.visited.size(), 2);
+      CHECK_EQ(data.visited[0].first, 0);
+      CHECK_EQ(data.visited[0].second, "a");
+      CHECK_EQ(data.visited[1].first, 10000);
+      CHECK_EQ(data.visited[1].second, "b");
+    } else {
+      CHECK_EQ(data.visited.size(), tc.expected_values.size());
+      for (size_t i = 0; i < tc.expected_values.size(); ++i) {
+        CHECK_EQ(data.visited[i].first, static_cast<uint32_t>(i));
+        CHECK_EQ(data.visited[i].second, tc.expected_values[i]);
+      }
+    }
+  }
+}
+
 }  // namespace
 }  // namespace v8

diff --git a/test/unittests/api/v8-array-unittest.cc b/test/unittests/api/v8-array-unittest.cc
index b0166eb..55eb0d5 100644
--- a/test/unittests/api/v8-array-unittest.cc
+++ b/test/unittests/api/v8-array-unittest.cc
@@ -5,7 +5,11 @@
 #include "include/v8-container.h"
 #include "include/v8-primitive.h"
 #include "include/v8-value.h"
+#include "src/api/api-inl.h"
 #include "src/execution/protectors-inl.h"
+#include "src/heap/heap-inl.h"
+#include "src/objects/js-array-inl.h"
+#include "test/unittests/heap/heap-utils.h"
 #include "test/unittests/interpreter/interpreter-tester.h"
 #include "test/unittests/test-utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -241,5 +245,167 @@
       internal::Isolate::Current()));
 }
 
+TEST_F(ArrayTest, IterateWithGC) {
+  i::v8_flags.expose_gc = true;
+  HandleScope scope(isolate());
+
+  struct ArrayTestCase {
+    const char* js_source;
+    internal::ElementsKind expected_kind;
+    std::vector<std::string> expected_values;
+  };
+
+  const ArrayTestCase test_cases[] = {
+      // PACKED_SMI_ELEMENTS
+      {"[10, 20, 30]", internal::PACKED_SMI_ELEMENTS, {"10", "20", "30"}},
+      // HOLEY_SMI_ELEMENTS
+      {"(() => { const a = [10, 20, 30]; delete a[1]; return a; })()",
+       internal::HOLEY_SMI_ELEMENTS,
+       {"10", "undefined", "30"}},
+      // PACKED_ELEMENTS
+      {"['foo', 'bar', 'baz']",
+       internal::PACKED_ELEMENTS,
+       {"foo", "bar", "baz"}},
+      // HOLEY_ELEMENTS
+      {"(() => { const a = ['foo', 'bar', 'baz']; delete a[1]; return a; })()",
+       internal::HOLEY_ELEMENTS,
+       {"foo", "undefined", "baz"}},
+      // PACKED_DOUBLE_ELEMENTS
+      {"[1.5, 2.5, 3.5]",
+       internal::PACKED_DOUBLE_ELEMENTS,
+       {"1.5", "2.5", "3.5"}},
+      // HOLEY_DOUBLE_ELEMENTS
+      {"(() => { const a = [1.5, 2.5, 3.5]; delete a[1]; return a; })()",
+       internal::HOLEY_DOUBLE_ELEMENTS,
+       {"1.5", "undefined", "3.5"}},
+      // PACKED_NONEXTENSIBLE_ELEMENTS (Object and Smi)
+      {"Object.preventExtensions(['a', 'b', 'c'])",
+       internal::PACKED_NONEXTENSIBLE_ELEMENTS,
+       {"a", "b", "c"}},
+      {"Object.preventExtensions([10, 20, 30])",
+       internal::PACKED_NONEXTENSIBLE_ELEMENTS,
+       {"10", "20", "30"}},
+      // HOLEY_NONEXTENSIBLE_ELEMENTS (Object and Smi)
+      {"(() => { const a = ['a', 'b', 'c']; delete a[1]; return "
+       "Object.preventExtensions(a); })()",
+       internal::HOLEY_NONEXTENSIBLE_ELEMENTS,
+       {"a", "undefined", "c"}},
+      {"(() => { const a = [10, 20, 30]; delete a[1]; return "
+       "Object.preventExtensions(a); })()",
+       internal::HOLEY_NONEXTENSIBLE_ELEMENTS,
+       {"10", "undefined", "30"}},
+      // PACKED_SEALED_ELEMENTS (Object and Smi)
+      {"Object.seal(['a', 'b', 'c'])",
+       internal::PACKED_SEALED_ELEMENTS,
+       {"a", "b", "c"}},
+      {"Object.seal([10, 20, 30])",
+       internal::PACKED_SEALED_ELEMENTS,
+       {"10", "20", "30"}},
+      // HOLEY_SEALED_ELEMENTS (Object and Smi)
+      {"(() => { const a = ['a', 'b', 'c']; delete a[1]; return "
+       "Object.seal(a); })()",
+       internal::HOLEY_SEALED_ELEMENTS,
+       {"a", "undefined", "c"}},
+      {"(() => { const a = [10, 20, 30]; delete a[1]; return "
+       "Object.seal(a); })()",
+       internal::HOLEY_SEALED_ELEMENTS,
+       {"10", "undefined", "30"}},
+      // PACKED_FROZEN_ELEMENTS (Object and Smi)
+      {"Object.freeze(['a', 'b', 'c'])",
+       internal::PACKED_FROZEN_ELEMENTS,
+       {"a", "b", "c"}},
+      {"Object.freeze([10, 20, 30])",
+       internal::PACKED_FROZEN_ELEMENTS,
+       {"10", "20", "30"}},
+      // HOLEY_FROZEN_ELEMENTS (Object and Smi)
+      {"(() => { const a = ['a', 'b', 'c']; delete a[1]; return "
+       "Object.freeze(a); })()",
+       internal::HOLEY_FROZEN_ELEMENTS,
+       {"a", "undefined", "c"}},
+      {"(() => { const a = [10, 20, 30]; delete a[1]; return "
+       "Object.freeze(a); })()",
+       internal::HOLEY_FROZEN_ELEMENTS,
+       {"10", "undefined", "30"}},
+      // DICTIONARY_ELEMENTS (Sparse array)
+      {"(() => { const a = []; a[0] = 'a'; a[10000] = 'b'; return a; })()",
+       internal::DICTIONARY_ELEMENTS,
+       {"a", "b"}},
+      // DICTIONARY_ELEMENTS (Dense array with reconfigured property)
+      {"(() => { const a = [10, 20, 30]; Object.defineProperty(a, '0', "
+       "{value: 10, configurable: false, writable: false}); return a; })()",
+       internal::DICTIONARY_ELEMENTS,
+       {"10", "20", "30"}},
+      // Empty array (PACKED_SMI_ELEMENTS, length 0)
+      {"[]", internal::PACKED_SMI_ELEMENTS, {}},
+  };
+
+  struct IterationData {
+    Isolate* isolate;
+    Local<Context> context;
+    std::vector<std::pair<uint32_t, std::string>> visited;
+  };
+
+  for (const auto& tc : test_cases) {
+    Local<Array> array = RunJS(tc.js_source).As<Array>();
+    CHECK(array->IsArray());
+    auto i_array = Utils::OpenDirectHandle(*array);
+    CHECK_EQ(i_array->GetElementsKind(), tc.expected_kind);
+
+    IterationData data{isolate(), context(), {}};
+    Array::IterationCallback callback = [](uint32_t index, Local<Value> element,
+                                           void* data_ptr) -> CbResult {
+      IterationData* d = static_cast<IterationData*>(data_ptr);
+      // Perform GC within the iteration callback.
+      d->isolate->RequestGarbageCollectionForTesting(
+          v8::Isolate::kFullGarbageCollection);
+
+      // Also allocate some new objects in the heap.
+      Local<String> allocated_str =
+          String::NewFromUtf8Literal(d->isolate, "test_alloc");
+      CHECK(!allocated_str.IsEmpty());
+
+      std::string val_str;
+      if (element->IsUndefined()) {
+        val_str = "undefined";
+      } else if (element->IsNumber()) {
+        double val = element.As<Number>()->Value();
+        if (val == static_cast<int64_t>(val)) {
+          val_str = std::to_string(static_cast<int64_t>(val));
+        } else {
+          val_str = std::to_string(val);
+          // Strip trailing zeroes for clean comparison with "1.5", "2.5", "3.5"
+          val_str.erase(val_str.find_last_not_of('0') + 1, std::string::npos);
+          if (val_str.back() == '.') val_str.pop_back();
+        }
+      } else if (element->IsString()) {
+        String::Utf8Value utf8(d->isolate, element.As<String>());
+        val_str = *utf8;
+      } else {
+        val_str = "unknown";
+      }
+      d->visited.emplace_back(index, val_str);
+      return CbResult::kContinue;
+    };
+
+    CHECK(array->Iterate(context(), callback, &data).IsJust());
+
+    if (tc.expected_kind == internal::DICTIONARY_ELEMENTS &&
+        tc.expected_values.size() == 2 && tc.expected_values[0] == "a" &&
+        tc.expected_values[1] == "b") {
+      CHECK_EQ(data.visited.size(), 2);
+      CHECK_EQ(data.visited[0].first, 0);
+      CHECK_EQ(data.visited[0].second, "a");
+      CHECK_EQ(data.visited[1].first, 10000);
+      CHECK_EQ(data.visited[1].second, "b");
+    } else {
+      CHECK_EQ(data.visited.size(), tc.expected_values.size());
+      for (size_t i = 0; i < tc.expected_values.size(); ++i) {
+        CHECK_EQ(data.visited[i].first, static_cast<uint32_t>(i));
+        CHECK_EQ(data.visited[i].second, tc.expected_values[i]);
+      }
+    }
+  }
+}
+
 }  // namespace
 }  // namespace v8