Fix element enumeration on String wrappers with dictionary elements

test/mjsunit/regress/regress-crbug-510426.js

Index: test/mjsunit/regress/regress-crbug-510426.js
diff --git a/test/message/arrow-param-after-rest-2.js b/test/mjsunit/regress/regress-crbug-510426.js
similarity index 63%
copy from test/message/arrow-param-after-rest-2.js
copy to test/mjsunit/regress/regress-crbug-510426.js
index 3b42f1924705ffbc30094ec1288c696629c7da9b..c82dbacfa92908a6fe831835e9ef6d887c215534 100644
--- a/test/message/arrow-param-after-rest-2.js
+++ b/test/mjsunit/regress/regress-crbug-510426.js
@@ -1,7 +1,7 @@
 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --harmony-rest-parameters --harmony-arrow-functions
 
-(w, ...x, y) => 10
+var s = new String('a');
+s[10000000] = 'bente';
+assertEquals(['0', '10000000'], Object.keys(s));