Fix a bug in for/in iteration of arguments objects.

Fix a bug in for/in iteration of arguments objects.

We did not properly combine the property names from the parameter map
and the arguments backing store.  They could overwrite each other and
be unsorted.

Also fix an unrelated bug: deleting from a dictionary-mode arguments
backing store could corrupt the parameter map.

R=rossberg@chromium.org
BUG=1531
TEST=mjsunit/regress/regress-1531.js

Committed: http://code.google.com/p/v8/source/detail?r=8571

[fschneider, 2011-07-07 09:03:33]

LGTM.

http://codereview.chromium.org/7278033/diff/1/src/objects.cc
File src/objects.cc (right):

http://codereview.chromium.org/7278033/diff/1/src/objects.cc#newcode3087
src/objects.cc:3087: FixedArray::cast(elements())->set(1, new_elements);
Is there a named constant for the slots in the arguments-elements to use instead
of 1?