[key] Fix for-in with trailing shadowing keys with dict-mode receiver

test/mjsunit/for-in.js

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 96 matching lines @@
   delete obj.a;
   for (var i = 0; i < 3; i++) {
     assertArrayEquals("34159bx".split(""), props(obj));
   }
   delete obj[3];
   for (var i = 0; i < 3; i++) {
     assertArrayEquals("4159bx".split(""), props(obj));
   }
 })();
 
+(function forInShadowingSlowReceiver() {
+  // crbug 688307
+  // Make sure we track all non-enumerable keys on a slow-mode receiver.
+  let receiver = {a:1};
+  delete receiver.a;
+  let proto = Object.create(null);
+  let enumProperties = [];
+  for (let i = 0; i < 10; i++) {
+    let key = "property_"+i;
+    enumProperties.push(key);
+    receiver[key] = i;
+    proto[key] = i;
+  }
+  for (let i = 0; i < 1000; i++) {
+    let nonEnumKey = "nonEnumerableProperty_"+ i;
+    Object.defineProperty(receiver, nonEnumKey, {});
+    // Add both keys as enumerable to the prototype.
+    proto[nonEnumKey] = i;
+  }
+  receiver.__proto__ = proto;
+  // Only the enumerable properties from the receiver should be visible.
+  for (let key in receiver) {
+    assertEquals(key, enumProperties.shift());
+  }
+})();
+
 (function forInCharCodes() {
   var o = {};
   var a = [];
   for (var i = 0x0020; i < 0x01ff; i+=2) {
     var s = 'char:' + String.fromCharCode(i);
     a.push(s);
     o[s] = i;
   }
   assertArrayEquals(a, props(o), "charcodes");
 })();
@@ skipping 109 matching lines @@
     assertUnreachable();
   }
 })();
 
 (function testNonEnumerableSloppyArgumentsIndex(a) {
   Object.defineProperty(arguments, 0, {enumerable:false});
   for (var k in arguments) {
     assertUnreachable();
   }
 })(true);