Fix for-in for large indexes and indexes on proxies

test/mjsunit/for-in.js

Index: test/mjsunit/for-in.js
diff --git a/test/mjsunit/for-in.js b/test/mjsunit/for-in.js
index ab35e95ee3132c35bf20025ea3bbb6d56f5cc240..644c27a63277b25729734afb061a286f38e1e801 100644
--- a/test/mjsunit/for-in.js
+++ b/test/mjsunit/for-in.js
@@ -119,3 +119,15 @@ for (i=0 ; i < 3; ++i) {
   assertEquals("undefined", typeof y[2], "y[2]");
   assertEquals("undefined", typeof y[0], "y[0]");
 }
+
+(function() {
+  var large_key = 2147483650;
+  var o = {__proto__: {}};
+  o[large_key] = 1;
+  o.__proto__[large_key] = 1;
+  var keys = [];
+  for (var k in o) {
+    keys.push(k);
+  }
+  assertEquals(["2147483650"], keys);
+})();