diff --git a/dlls/mshtml/dispex.c b/dlls/mshtml/dispex.c
index 793bbb9d974..ed799d2e749 100644
--- a/dlls/mshtml/dispex.c
+++ b/dlls/mshtml/dispex.c
@@ -373,6 +373,22 @@ static dispex_data_t *preprocess_dispex_data(DispatchEx *This)
     data->funcs = heap_realloc(data->funcs, data->func_cnt * sizeof(func_info_t));
     qsort(data->funcs, data->func_cnt, sizeof(func_info_t), dispid_cmp);
 
+    for(i = 1; i < data->func_cnt && data->funcs[i-1].id != data->funcs[i].id; i++);
+    if(i < data->func_cnt) {
+        unsigned j = i--;
+
+        /* We have at least one duplicated property. This may happen if more than one
+         * interface implements the same property. We have to remove these duplicated
+         * entries. */
+
+        while(j < data->func_cnt) {
+            while(j+1 < data->func_cnt && data->funcs[j+1].id == data->funcs[j].id)
+                j++;
+            data->funcs[i++] = data->funcs[j++];
+        }
+        data->func_cnt = i;
+    }
+
     data->name_table = heap_alloc(data->func_cnt * sizeof(func_info_t*));
     for(i=0; i < data->func_cnt; i++)
         data->name_table[i] = data->funcs+i;
diff --git a/dlls/mshtml/tests/jstest.html b/dlls/mshtml/tests/jstest.html
index 2bd87b1b89a..ebf28618b89 100644
--- a/dlls/mshtml/tests/jstest.html
+++ b/dlls/mshtml/tests/jstest.html
@@ -165,6 +165,18 @@ function test_override_functions() {
     ok(tmp === "test", "div.addBehavior() = " + tmp);
 }
 
+function test_forin() {
+    var cnt=0;
+
+    document.body.innerHTML = '<a id="aid"></a>';
+
+    for(var x in document.getElementById("aid")) {
+        cnt++;
+    }
+
+    ok(cnt > 100, "cnt = " + cnt);
+}
+
 var globalVar = false;
 
 function runTests() {
@@ -185,6 +197,7 @@ function runTests() {
     test_attribute_collection();
     test_arg_conv();
     test_override_functions();
+    test_forin();
 
     var r = window.execScript("globalVar = true;");
     ok(r === undefined, "execScript returned " + r);