Support all fast elements kinds in the major array operations.

test/mjsunit/array-slice.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 272 matching lines @@
 // Check slicing on arguments object when argument has been deleted by index.
 (function() {
   function func(x, y, z) {
     assertEquals(3, arguments.length);
     delete arguments[1];
     assertEquals([x,,z], Array.prototype.slice.call(arguments, 0));
   }
 
   func('a', 'b', 'c');
 })();
+
+// Check slicing of holey objects with elements in the prototype
+(function() {
+  function f() {
+    delete arguments[1];
+    arguments.__proto__[1] = 5;
+    var result = Array.prototype.slice.call(arguments);
+    delete arguments.__proto__[1];
+    assertEquals([1,5,3], result);
+  }
+  f(1,2,3);
+})();