[builtins] Take fast path in Array.prototype.keys() only if length is an Smi

test/mjsunit/es6/regress/regress-660925.js

Index: test/mjsunit/es6/regress/regress-660925.js
diff --git a/test/mjsunit/es6/regress/regress-660925.js b/test/mjsunit/es6/regress/regress-660925.js
new file mode 100644
index 0000000000000000000000000000000000000000..12c370cb6ce3996ac5682329562ef486244a5688
--- /dev/null
+++ b/test/mjsunit/es6/regress/regress-660925.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let array = new Array(0xFFFFFFFF);
+let it = array.keys();
+assertEquals({ value: 0, done: false }, it.next());
+
+it = array.entries();
+assertEquals({ value: [0, undefined], done: false }, it.next());
+
+it = array[Symbol.iterator]();
+assertEquals({ value: undefined, done: false }, it.next());