-
Michael Starzinger authored
This fixes a corner-case in {KeyAccumulator::CollectOwnJSProxyKeys} where the keys returned by {JSReceiver::OwnPropertyKeys} for an array are not internalized and hence have a diverging identity from keys returned by the "ownKeys" trap of a proxy. R=cbruni@chromium.org TEST=mjsunit/regress/regress-crbug-700678 BUG=chromium:700678 Change-Id: I5efd012eade14bd45c69e4abb0aeda684baf38f0 Reviewed-on: https://chromium-review.googlesource.com/452979Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43775}
3b597bb7