[runtime] fix getting element keys from SLOW_SLOPPY_ARGUMENTS_ELEMENTS

test/mjsunit/regress/regress-4825.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function()  {
+  function slowSloppyArgumentsElements(a, b, c) {
+    arguments[10000] = 1;
+    return Object.keys(arguments);
+  }
+  assertEquals(["0", "1", "2", "10000"], slowSloppyArgumentsElements(1, 2, 3));
+
+  function slowSloppyArguments(a, b, c) {
+    arguments[10000] = 1;
+    return arguments;
+  }
+
+  var args = slowSloppyArguments(1,2,3);
+  var keys = [];
+  for (var key in args) keys.push(key);
+
+  assertEquals(["0", "1", "2", "10000"], keys);
+})();
+
+(function() {
+  function slowSloppyArgumentsElements2(a, b, c) {
+    Object.defineProperty(arguments, 10000, {
+      enumerable: false, configurable: false, value: "NOPE"
+    });
+    return Object.keys(arguments);
+  }
+  assertEquals(["0", "1", "2"], slowSloppyArgumentsElements2(1, 2, 3));
+
+  function slowSloppyArguments2(a, b, c) {
+    Object.defineProperty(arguments, 10000, {
+      enumerable: false, configurable: false, value: "NOPE"
+    });
+    return arguments;
+  }
+
+  var args = slowSloppyArguments2(1,2,3);
+  var keys = [];
+  for (var key in args) keys.push(key);
+
+  assertEquals(["0", "1", "2"], keys);
+})();

[Camillo Bruni, 2016/03/10 09:15:14]

Nice tests!
Could you create a second set with a lower index (3, instead of 10000), to test
FastSloppyArguments (that is HOLEY secondary backing_store to the arguments
object instead of a DICTIONARY)?
Like that we should be more or less safe that we hit all paths...

[caitp (gmail), 2016/03/10 16:58:34]

Done