[key] Fix for-in with trailing shadowing keys with dict-mode receiver

BUG=688307

Review-Url: https://codereview.chromium.org/2686513002
Cr-Commit-Position: refs/heads/master@{#43006}

src/objects.cc

@@ -18047,6 +18047,7 @@ void Dictionary<Derived, Shape, Key>::CopyEnumKeysTo(
     Handle<Dictionary<Derived, Shape, Key>> dictionary,
     Handle<FixedArray> storage, KeyCollectionMode mode,
     KeyAccumulator* accumulator) {
+  DCHECK_IMPLIES(mode != KeyCollectionMode::kOwnOnly, accumulator != nullptr);
   Isolate* isolate = dictionary->GetIsolate();
   int length = storage->length();
   int capacity = dictionary->Capacity();
@@ -18072,7 +18073,7 @@ void Dictionary<Derived, Shape, Key>::CopyEnumKeysTo(
       storage->set(properties, Smi::FromInt(i));
     }
     properties++;
-    if (properties == length) break;
+    if (mode == KeyCollectionMode::kOwnOnly && properties == length) break;
   }
 
   CHECK_EQ(length, properties);

test/mjsunit/for-in.js

@@ -114,6 +114,32 @@ function props(x) {
   }
 })();
 
+(function forInShadowingSlowReceiver() {
+  // crbug 688307
+  // Make sure we track all non-enumerable keys on a slow-mode receiver.
+  let receiver = {a:1};
+  delete receiver.a;
+  let proto = Object.create(null);
+  let enumProperties = [];
+  for (let i = 0; i < 10; i++) {
+    let key = "property_"+i;
+    enumProperties.push(key);
+    receiver[key] = i;
+    proto[key] = i;
+  }
+  for (let i = 0; i < 1000; i++) {
+    let nonEnumKey = "nonEnumerableProperty_"+ i;
+    Object.defineProperty(receiver, nonEnumKey, {});
+    // Add both keys as enumerable to the prototype.
+    proto[nonEnumKey] = i;
+  }
+  receiver.__proto__ = proto;
+  // Only the enumerable properties from the receiver should be visible.
+  for (let key in receiver) {
+    assertEquals(key, enumProperties.shift());
+  }
+})();
+
 (function forInCharCodes() {
   var o = {};
   var a = [];