[proxies] allow duplicate keys for [[OwnPropertyKeys]] trap.

src/runtime/runtime-array.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/conversions-inl.h"
 #include "src/elements.h"
 #include "src/factory.h"
@@ skipping 188 matching lines @@
   CONVERT_ARG_HANDLE_CHECKED(JSObject, array, 0);
   CONVERT_NUMBER_CHECKED(uint32_t, length, Uint32, args[1]);
 
   if (!array->elements()->IsDictionary()) {
     RUNTIME_ASSERT(array->HasFastSmiOrObjectElements() ||
                    array->HasFastDoubleElements());
     uint32_t actual_length = static_cast<uint32_t>(array->elements()->length());
     return *isolate->factory()->NewNumberFromUint(Min(actual_length, length));
   }
 
-  KeyAccumulator accumulator(isolate, ALL_PROPERTIES);
+  KeyAccumulator accumulator(isolate, OWN_ONLY, ALL_PROPERTIES);
   // No need to separate protoype levels since we only get numbers/element keys
   for (PrototypeIterator iter(isolate, array,
                               PrototypeIterator::START_AT_RECEIVER);
        !iter.IsAtEnd(); iter.Advance()) {
     if (PrototypeIterator::GetCurrent(iter)->IsJSProxy() ||
         PrototypeIterator::GetCurrent<JSObject>(iter)
             ->HasIndexedInterceptor()) {
       // Bail out if we find a proxy or interceptor, likely not worth
       // collecting keys in that case.
       return *isolate->factory()->NewNumberFromUint(length);
@@ skipping 275 matching lines @@
   CONVERT_ARG_HANDLE_CHECKED(Object, original_array, 0);
   Handle<Object> constructor;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, constructor,
       Object::ArraySpeciesConstructor(isolate, original_array));
   return *constructor;
 }
 
 }  // namespace internal
 }  // namespace v8