Proxies: Fix ToStringArray function so that it does not reject some keys.

R=mstarzinger@chromium.org
BUG=v8:1543
TEST=

Review URL: https://chromiumcodereview.appspot.com/10453053

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11676 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/v8natives.js

@@ -337,7 +337,7 @@ function ObjectKeys(obj) {
   if (%IsJSProxy(obj)) {
     var handler = %GetHandler(obj);
     var names = CallTrap0(handler, "keys", DerivedKeysTrap);
-    return ToStringArray(names);
+    return ToStringArray(names, "keys");
   }
   return %LocalKeys(obj);
 }
@@ -963,7 +963,7 @@ function ToStringArray(obj, trap) {
   var names = {};  // TODO(rossberg): use sets once they are ready.
   for (var index = 0; index < n; index++) {
     var s = ToString(obj[index]);
-    if (s in names) {
+    if (%HasLocalProperty(names, s)) {
       throw MakeTypeError("proxy_repeated_prop_name", [obj, trap, s]);
     }
     array[index] = s;

test/mjsunit/harmony/proxies.js

@@ -1630,8 +1630,8 @@ TestPropertyNames([], {
   getOwnPropertyNames: function() { return [] }
 })
 
-TestPropertyNames(["a", "zz", " ", "0"], {
-  getOwnPropertyNames: function() { return ["a", "zz", " ", 0] }
+TestPropertyNames(["a", "zz", " ", "0", "toString"], {
+  getOwnPropertyNames: function() { return ["a", "zz", " ", 0, "toString"] }
 })
 
 TestPropertyNames(["throw", "function "], {
@@ -1678,8 +1678,8 @@ TestKeys([], {
   keys: function() { return [] }
 })
 
-TestKeys(["a", "zz", " ", "0"], {
-  keys: function() { return ["a", "zz", " ", 0] }
+TestKeys(["a", "zz", " ", "0", "toString"], {
+  keys: function() { return ["a", "zz", " ", 0, "toString"] }
 })
 
 TestKeys(["throw", "function "], {