Remove oob elements collected from the prototype chain by trimming in GetArrayKeys

src/runtime/runtime-array.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/conversions-inl.h"
 #include "src/elements.h"
 #include "src/factory.h"
@@ skipping 193 matching lines @@
             ->HasIndexedInterceptor()) {
       // Bail out if we find a proxy or interceptor, likely not worth
       // collecting keys in that case.
       return *isolate->factory()->NewNumberFromUint(length);
     }
     accumulator.NextPrototype();
     Handle<JSObject> current = PrototypeIterator::GetCurrent<JSObject>(iter);
     JSObject::CollectOwnElementKeys(current, &accumulator, ALL_PROPERTIES);
   }
   // Erase any keys >= length.
-  // TODO(adamk): Remove this step when the contract of %GetArrayKeys
-  // is changed to let this happen on the JS side.
   Handle<FixedArray> keys = accumulator.GetKeys(KEEP_NUMBERS);
+  int j = 0;
   for (int i = 0; i < keys->length(); i++) {
-    if (NumberToUint32(keys->get(i)) >= length) keys->set_undefined(i);
+    if (NumberToUint32(keys->get(i)) >= length) continue;
+    if (i != j) keys->set(j, keys->get(i));
+    j++;
   }
+
+  if (j != keys->length()) {
+    isolate->heap()->RightTrimFixedArray<Heap::CONCURRENT_TO_SWEEPER>(
+        *keys, keys->length() - j);
+  }
+
   return *isolate->factory()->NewJSArrayWithElements(keys);
 }
 
 
 namespace {
 
 Object* ArrayConstructorCommon(Isolate* isolate, Handle<JSFunction> constructor,
                                Handle<JSReceiver> new_target,
                                Handle<AllocationSite> site,
                                Arguments* caller_args) {
@@ skipping 244 matching lines @@
   CONVERT_ARG_HANDLE_CHECKED(Object, original_array, 0);
   Handle<Object> constructor;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, constructor,
       Object::ArraySpeciesConstructor(isolate, original_array));
   return *constructor;
 }
 
 }  // namespace internal
 }  // namespace v8