Fix for-in for large indexes and indexes on proxies

test/mjsunit/harmony/proxies-for.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 147 matching lines @@
 
 TestForInThrow({
   getPropertyNames: function() { return ["a"] },
   getPropertyDescriptor: function() { throw "myexn" }
 })
 
 TestForInThrow(Proxy.create({
   get: function(pr, pk) {
     return function() { throw "myexn" }
   }
-}))
+}));
+
+(function() {
+  var p = Proxy.create({enumerate:function() { return [0]; }});
+  var o = [0];
+  o.__proto__ = p;
+  var keys = [];
+  for (var k in o) { keys.push(k); };
+  assertEquals(["0"], keys);
+})();