Source Code

    var k = -1;  // k >= 0 is no problem, k < 0 is problem
    var o = {};
    o[k] = true;

    function f() {
        // `(k + "") in o` is no problem
        if (k in o) {
            return;
        }
        // `k in o` must be true, but Safari 11 reach here
        throw new Error("Never reach");
    }

    var i = 0;
    try {
        for (i = 0; i < 100000; i++) {
            f();
        }
    } catch (e) {
        // Reach here is problem
        // Safari on iOS 11.1.2
        // i: 5000~20000
        // Safari 11.0.1 (12604.3.5.1.1) on mac sierra
        // i: 1000~5000
        alert(e.message + " : " + JSON.stringify({
            "i": i,
            "k in o": (k in o),
            "(''+k) in o": (('' + k) in o),
            "o.hasOwnProperty(k)": o.hasOwnProperty(k)
        }, null, 2));
    }

    alert("Done");