Use GetProperty for getting elements.

test/mjsunit/enumeration-order.js

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 53 matching lines @@
 // properties of the prototype object in insertion order, and so on.
 //
 // This enumeration order is not required by the specification, so
 // this just documents our choice.
 var proto2 = {};
 proto2[140000] = 0;
 proto2.a = 0;
 proto2[2] = 0;
 proto2[3] = 0;  // also on the 'proto1' object
 proto2.b = 0;
+proto2[4294967294] = 0;
+proto2.c = 0;
 proto2[4294967295] = 0;
-proto2.c = 0;
-proto2[4294967296] = 0;
 
 var proto1 = {};
 proto1[5] = 0;
 proto1.d = 0;
 proto1[3] = 0;
 proto1.e = 0;
 proto1.f = 0;  // also on the 'o' object
 
 var o = {};
 o[-23] = 0;
 o[300000000000] = 0;
 o[23] = 0;
 o.f = 0;
 o.g = 0;
 o[-4] = 0;
 o[42] = 0;
 
 o.__proto__ = proto1;
 proto1.__proto__ = proto2;
 
 var expected = ['23', '42',  // indexed from 'o'
                 '-23', '300000000000', 'f', 'g', '-4',  // named from 'o'
                 '3', '5',  // indexed from 'proto1'
                 'd', 'e',  // named from 'proto1'
-                '2', '140000', '4294967295',  // indexed from 'proto2'
-                'a', 'b', 'c', '4294967296'];  // named from 'proto2'
+                '2', '140000', '4294967294',  // indexed from 'proto2'
+                'a', 'b', 'c', '4294967295'];  // named from 'proto2'
 var actual = [];
 for (var p in o) actual.push(p);
 assertArrayEquals(expected, actual);