[builtins] Migrate Object.keys to CodeStubAssembler builtin.

test/mjsunit/object-keys.js

Index: test/mjsunit/object-keys.js
diff --git a/test/mjsunit/object-keys.js b/test/mjsunit/object-keys.js
new file mode 100644
index 0000000000000000000000000000000000000000..13aecdf7bf88897bda5a97818e8a5bbc23474cad
--- /dev/null
+++ b/test/mjsunit/object-keys.js
@@ -0,0 +1,30 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Ensure that mutation of the Object.keys result doesn't affect the
+// enumeration cache for fast-mode objects.
+(function() {
+  const a = {x:1, y:2};
+  let k = Object.keys(a);

[Camillo Bruni, 2017/05/03 08:40:44]

You could additionally do: %VerifyHeapObject(k)

[Benedikt Meurer, 2017/05/17 05:09:19]

Done.

+  assertEquals(2, k.length);
+  assertEquals("x", k[0]);
+  assertEquals("y", k[1]);
+  k[0] = "y";
+  k[1] = "x";
+  k = Object.keys(a);
+  assertEquals(2, k.length);
+  assertEquals("x", k[0]);
+  assertEquals("y", k[1]);
+})();
+
+// Ensure that the copy-on-write keys are handled properly, even in
+// the presence of Symbols.
+(function() {
+  const s = Symbol();
+  const a = {[s]: 1};
+  let k = Object.keys(a);
+  assertEquals(0, k.length);
+  k.shift();
+  assertEquals(0, k.length);
+})();