Fix ToNameArray

BUG=

Review URL: https://codereview.chromium.org/1146113004

Cr-Commit-Position: refs/heads/master@{#28580}

diff --git a/src/v8natives.js b/src/v8natives.js
index 834b41ce82efcfb4e9f8a84752116e4ee446b612..eb259177e2a5e24cf859019a9286f3e03abaaba2 100644 (file)
--- a/src/v8natives.js
+++ b/src/v8natives.js
@@ -955,7 +955,7 @@ function ToNameArray(obj, trap, includeSymbols) {
     if (%HasOwnProperty(names, s)) {
       throw MakeTypeError(kProxyRepeatedPropName, trap, s);
     }
-    array[index] = s;
+    array[realLength] = s;
     ++realLength;
     names[s] = 0;
   }

diff --git a/test/mjsunit/harmony/proxies-for.js b/test/mjsunit/harmony/proxies-for.js
index ea162496ba483f8d46739f3dff6386e1d989bc07..e98c34afe58f3c509b9dd8a7c0800fb784138ac0 100644 (file)
--- a/test/mjsunit/harmony/proxies-for.js
+++ b/test/mjsunit/harmony/proxies-for.js
@@ -175,3 +175,9 @@ TestForInThrow(Proxy.create({
   for (var k in o) { keys.push(k); };
   assertEquals(["0"], keys);
 })();
+
+(function () {
+  var p = Proxy.create({getOwnPropertyNames:
+    function() { return [1, Symbol(), 2] }});
+  assertEquals(["1","2"], Object.getOwnPropertyNames(p));
+})();