[runtime] Don't call GetArrayKeys on proxies.

test/mjsunit/array-sort.js

Index: test/mjsunit/array-sort.js
diff --git a/test/mjsunit/array-sort.js b/test/mjsunit/array-sort.js
index beb8b95b014bb402ce7e7fe715b333489e4d913c..ae9f6efa663bb8aa610321898429defb03cb8d10 100644
--- a/test/mjsunit/array-sort.js
+++ b/test/mjsunit/array-sort.js
@@ -466,7 +466,16 @@ function TestSortToObject() {
 TestSortToObject();
 
 function TestSortOnProxy() {
-  var p = new Proxy([2,1,3], {});
-  assertEquals([1,2,3], p.sort());
+  {
+    var p = new Proxy([2,1,3], {});
+    assertEquals([1,2,3], p.sort());
+  }
+
+  {
+    function f() { return arguments };
+    var a = f(2,1,3);
+    a.__proto__ = new Proxy({}, {});
+    assertEquals([1,2,3], [...(Array.prototype.sort.apply(a))]);
+  }
 }
 TestSortOnProxy();