Fix JSObject::EnsureCanContainElements to correctly iterate over Arguments

test/mjsunit/elements-kind.js

Index: test/mjsunit/elements-kind.js
diff --git a/test/mjsunit/elements-kind.js b/test/mjsunit/elements-kind.js
index cfd47c7781203078ecf7a3892cfa9abbe8ff62fa..2d687a1a5ffcedfb763ba9a0fcf73ac083fdb019 100644
--- a/test/mjsunit/elements-kind.js
+++ b/test/mjsunit/elements-kind.js
@@ -305,5 +305,14 @@ if (support_smi_only_arrays) {
   assertTrue(%HaveSameMap(e, f));
 }
 
+// Test that Array.push() correctly handles SMI elements.
+if (support_smi_only_arrays) {
+  var a = [1, 2];
+  assertKind(elements_kind.fast_smi_only, a);
+  a.push(3, 4, 5);
+  assertKind(elements_kind.fast_smi_only, a);
+  assertEquals([1, 2, 3, 4, 5], a);
+}
+
 // Throw away type information in the ICs for next stress run.
 gc();