Fix ToNameArray

BUG=

Review URL: https://codereview.chromium.org/1146113004

Cr-Commit-Position: refs/heads/master@{#28580}

src/v8natives.js

@@ -955,7 +955,7 @@ function ToNameArray(obj, trap, includeSymbols) {
     if (%HasOwnProperty(names, s)) {
       throw MakeTypeError(kProxyRepeatedPropName, trap, s);
     }
-    array[index] = s;
+    array[realLength] = s;
     ++realLength;
     names[s] = 0;
   }

test/mjsunit/harmony/proxies-for.js

@@ -175,3 +175,9 @@ TestForInThrow(Proxy.create({
   for (var k in o) { keys.push(k); };
   assertEquals(["0"], keys);
 })();
+
+(function () {
+  var p = Proxy.create({getOwnPropertyNames:
+    function() { return [1, Symbol(), 2] }});
+  assertEquals(["1","2"], Object.getOwnPropertyNames(p));
+})();