Fix spec-compliance bug in Array.prototype.join.

The code used to [[Get]] the first element twice instead of once, which can be
observed (one of the kangax tests does so).

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1747933002

Cr-Commit-Position: refs/heads/master@{#34383}

src/js/array.js

@@ -214,15 +214,19 @@ function Join(array, length, separator, convert) {
     // Non-empty separator case.
     // If the first element is a number then use the heuristic that the
     // remaining elements are also likely to be numbers.
-    if (!IS_NUMBER(array[0])) {
-      for (var i = 0; i < length; i++) {
-        var e = array[i];
+    var e = array[0];
+    if (!IS_NUMBER(e)) {
+      if (!IS_STRING(e)) e = convert(e);
+      elements[0] = e;
+      for (var i = 1; i < length; i++) {
+        e = array[i];
         if (!IS_STRING(e)) e = convert(e);
         elements[i] = e;
       }
     } else {
-      for (var i = 0; i < length; i++) {
-        var e = array[i];
+      elements[0] = %_NumberToString(e);
+      for (var i = 1; i < length; i++) {
+        e = array[i];
         if (IS_NUMBER(e)) {
           e = %_NumberToString(e);
         } else if (!IS_STRING(e)) {

test/mjsunit/array-join.js

@@ -91,3 +91,16 @@ for (var i = 0; i < a.length; i++) a[i] = undefined;
 a[5] = "ab";
 a[90000] = "cd";
 assertEquals("abcd", a.join(""));  // Must not throw.
+
+
+// Make sure that each element is accessed exactly once, and in the correct
+// order.
+{
+  var log = [];
+  var p = new Proxy({length: 3, 0: 'a', 1: 'b'}, {
+      get: function(t, k, r) { log.push(k); return Reflect.get(t, k, r); }
+  });
+
+  assertEquals("a,b,", Array.prototype.join.call(p));
+  assertEquals(["length", "0", "1", "2"], log);
+}