Fix for-in for large indexes and indexes on proxies

test/mjsunit/for-in.js

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 101 matching lines @@
   }
 
   assertEquals(5, y.foo, "y.foo");
   assertEquals("undefined", typeof y.bar, "y.bar");
   assertEquals(7, y.zip, "y.zip");
   assertEquals(9, y.glep, "y.glep");
   assertEquals(11, y[10], "y[10]");
   assertEquals("undefined", typeof y[2], "y[2]");
   assertEquals("undefined", typeof y[0], "y[0]");
 }
+
+(function() {
+  var large_key = 2147483650;
+  var o = {__proto__: {}};
+  o[large_key] = 1;
+  o.__proto__[large_key] = 1;
+  var keys = [];
+  for (var k in o) {
+    keys.push(k);
+  }
+  assertEquals(["2147483650"], keys);
+})();