Fix ToNameArray

src/v8natives.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var $delete;
 var $functionSourceString;
 var $getIterator;
 var $getMethod;
 var $globalEval;
 var $installConstants;
@@ skipping 1061 matching lines @@
   var array = new GlobalArray(n);
   var realLength = 0;
   var names = { __proto__: null };  // TODO(rossberg): use sets once ready.
   for (var index = 0; index < n; index++) {
     var s = $toName(obj[index]);
     // TODO(rossberg): adjust once there is a story for symbols vs proxies.
     if (IS_SYMBOL(s) && !includeSymbols) continue;
     if (%HasOwnProperty(names, s)) {
       throw MakeTypeError(kProxyRepeatedPropName, trap, s);
     }
-    array[index] = s;
+    array[realLength] = s;
     ++realLength;
     names[s] = 0;
   }
   array.length = realLength;
   return array;
 }
 
 
 function ObjectGetOwnPropertyKeys(obj, filter) {
   var nameArrays = new InternalArray();
@@ skipping 877 matching lines @@
 $objectLookupSetter = ObjectLookupSetter;
 $objectToString = ObjectToString;
 $overrideFunction = OverrideFunction;
 $ownPropertyKeys = OwnPropertyKeys;
 $setFunctionName = SetFunctionName;
 $setUpLockedPrototype = SetUpLockedPrototype;
 $toCompletePropertyDescriptor = ToCompletePropertyDescriptor;
 $toNameArray = ToNameArray;
 
 })