Convert `obj` ToObject in Object.keys()

BUG=v8:3587
LOG=Y
R=arv@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/585373003

Patch from Caitlin Potter <caitpotter88@gmail.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

AUTHORS

@@ -24,6 +24,7 @@ Andreas Anyuru <andreas.anyuru@gmail.com>
 Baptiste Afsa <baptiste.afsa@arm.com>
 Bert Belder <bertbelder@gmail.com>
 Burcu Dogan <burcujdogan@gmail.com>
+Caitlin Potter <caitpotter88@gmail.com>
 Craig Schlenter <craig.schlenter@gmail.com>
 Chunyang Dai <chunyang.dai@intel.com>
 Daniel Andersson <kodandersson@gmail.com>

src/v8natives.js

@@ -325,9 +325,7 @@ function ObjectLookupSetter(name) {
 
 
 function ObjectKeys(obj) {
-  if (!IS_SPEC_OBJECT(obj)) {
-    throw MakeTypeError("called_on_non_object", ["Object.keys"]);
-  }
+  obj = ToObject(obj);
   if (%IsJSProxy(obj)) {
     var handler = %GetHandler(obj);
     var names = CallTrap0(handler, "keys", DerivedKeysTrap);

test/mjsunit/third_party/object-keys.js

@@ -31,8 +31,8 @@
 
 // Based on LayoutTests/fast/js/Object-keys.html
 
-assertThrows(function () { Object.keys(2) }, TypeError);
-assertThrows(function () { Object.keys("foo") }, TypeError);
+assertEquals(Object.keys(2), []);
+assertEquals(Object.keys("foo"), ["0", "1", "2"]);
 assertThrows(function () { Object.keys(null) }, TypeError);
 assertThrows(function () { Object.keys(undefined) }, TypeError);