Don't clear EnumLength but rather copy the enum cache. Added regression test for crashes from chrom…

test/mjsunit/regress/regress-convert-enum.js

Index: test/mjsunit/regress/regress-convert-enum.js
diff --git a/test/mjsunit/regress/regress-cnlt-enum-indices.js b/test/mjsunit/regress/regress-convert-enum.js
similarity index 68%
copy from test/mjsunit/regress/regress-cnlt-enum-indices.js
copy to test/mjsunit/regress/regress-convert-enum.js
index 03582bbbe424b10487fab13a6473e9b62781845e..c624cad5af798be005f25ce1a3e78fb8fc2f31ef 100644
--- a/test/mjsunit/regress/regress-cnlt-enum-indices.js
+++ b/test/mjsunit/regress/regress-convert-enum.js
@@ -25,21 +25,36 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --expose-gc
+// Flags: --expose-gc
 
+// Create a transition tree A (no descriptors) -> B (descriptor for a) -> C
+// (descriptor for a and c), that all share the descriptor array [a,c]. C is the
+// owner of the descriptor array.
 var o = {};
-var o2 = {};
-
 o.a = 1;
-o2.a = 1;
-function f() { return 10; }
-// Adds a non-field enumerable property.
-Object.defineProperty(o, "b", { get: f, enumerable: true });
-Object.defineProperty(o2, "b", { get: f, enumerable: true });
-assertTrue(%HaveSameMap(o, o2));
 o.c = 2;
 
-for (var x in o) { }
-o = null;
+// Add a transition B -> D where D has its own descriptor array [a,b] where b is
+// a constant function.
+var o1 = {};
+o1.a = 1;
+
+// Install an enumeration cache in the descriptor array [a,c] at map B.
+for (var x in o1) { }
+o1.b = function() { return 1; };
 
+// Return ownership of the descriptor array [a,c] to B and trim it to [a].
+o = null;
 gc();
+
+// Convert the transition B -> D into a transition to B -> E so that E uses the
+// instance descriptors [a,b] with b being a field.
+var o2 = {};
+o2.a = 1;
+o2.b = 10;
+
+// Create an object with map B and iterate over it.
+var o3 = {};
+o3.a = 1;
+
+for (var y in o3) { }