[builtins] Migrate Object.keys to CodeStubAssembler builtin.

test/mjsunit/object-keys.js

Index: test/mjsunit/object-keys.js
diff --git a/test/mjsunit/object-keys.js b/test/mjsunit/object-keys.js
new file mode 100644
index 0000000000000000000000000000000000000000..29eb85d6aa7bac7072a7109432c3698ea0d1f9e2
--- /dev/null
+++ b/test/mjsunit/object-keys.js
@@ -0,0 +1,34 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Ensure that mutation of the Object.keys result doesn't affect the
+// enumeration cache for fast-mode objects.
+(function() {
+  const a = {x:1, y:2};
+  let k = Object.keys(a);
+  %HeapObjectVerify(k);
+  assertEquals(2, k.length);
+  assertEquals("x", k[0]);
+  assertEquals("y", k[1]);
+  k[0] = "y";
+  k[1] = "x";
+  k = Object.keys(a);
+  assertEquals(2, k.length);
+  assertEquals("x", k[0]);
+  assertEquals("y", k[1]);
+})();
+
+// Ensure that the copy-on-write keys are handled properly, even in
+// the presence of Symbols.
+(function() {
+  const s = Symbol();
+  const a = {[s]: 1};
+  let k = Object.keys(a);
+  %HeapObjectVerify(k);
+  assertEquals(0, k.length);
+  k.shift();
+  assertEquals(0, k.length);
+})();