Built-in properties (like Array.length) should not be enumerated even when they are defined in Object.prototype

lib/Runtime/Library/ForInObjectEnumerator.cpp

@@ -210,6 +210,18 @@ namespace Js
                     return nullptr;
                 }
 
+                // Ignore special properties (ex: Array.length)
+                uint specialPropertyCount = this->shadowData->currentObject->GetSpecialPropertyCount();
+                if (specialPropertyCount > 0)
+                {
+                    PropertyId const* specialPropertyIds = this->shadowData->currentObject->GetSpecialPropertyIds();
+                    Assert(specialPropertyIds != nullptr);
+                    for (uint i = 0; i < specialPropertyCount; i++)
+                    {
+                        TestAndSetEnumerated(specialPropertyIds[i]);
+                    }
+                }
+
                 RecyclableObject * object;
                 if (!this->enumeratingPrototype)
                 {

test/Bugs/bug_OS17614914.js

@@ -0,0 +1,18 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+Object.prototype.length = undefined;
+var ary = Array();
+ary.prop1 = 1;
+Object.defineProperty(ary, "prop2", {
+    value: 1,
+    enumerable: false
+});
+for (var prop in ary) {
+    if (prop !== "prop1") {
+        console.log(`Fail: ${prop} property should not show in for-in`);
+    }
+}
+console.log("pass");

test/Bugs/rlexe.xml

@@ -501,4 +501,9 @@
       <files>withSplitScope.js</files>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bug_OS17614914.js</files>
+    </default>
+  </test>  
 </regress-exe>