[runtime] support new Proxy() instead of Proxy.create and install getPrototypeOf trap

test/mjsunit/readonly.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 107 matching lines @@
   var p = Object.create(o.__proto__);
   Object.defineProperty(p, name, {value: -45, writable: false});
   o.__proto__ = p;
 }
 
 // Allow Proxy to be undefined, so test can run in non-Harmony mode as well.
 var global = this;
 
 function ReadonlyByProxy(o, name) {
   if (!global.Proxy) return ReadonlyByFreeze(o, name);  // Dummy.
-  var p = global.Proxy.create({
+  var p = new global.Proxy({}, {
     getPropertyDescriptor: function() {
       return {value: -46, writable: false, configurable: true};
     }
   });
   o.__proto__ = p;
 }
 
 var readonlys = [
   ReadonlyByNonwritableDataProperty, ReadonlyByAccessorPropertyWithoutSetter,
   ReadonlyByGetter, ReadonlyByFreeze, ReadonlyByProto, ReadonlyByProxy
@@ skipping 84 matching lines @@
     var o = c();
     Assign2(o, i);
     assertEquals(i, o.a);
   }
   %OptimizeFunctionOnNextCall(Assign2);
   ReadonlyByNonwritableDataProperty(p, "a");
   var o = c();
   Assign2(o, 0);
   assertTrue(o.a < 0);
 })();