[runtime] support new Proxy() instead of Proxy.create and install getPrototypeOf trap

test/mjsunit/harmony/regress/regress-crbug-461520.js

Index: test/mjsunit/harmony/regress/regress-crbug-461520.js
diff --git a/test/mjsunit/harmony/regress/regress-crbug-461520.js b/test/mjsunit/harmony/regress/regress-crbug-461520.js
index c30260db72ad16f95c2b0ded0571f8a15c09eca9..5239ecb6cae602b4d27da01af1841c8de7d0f6ac 100644
--- a/test/mjsunit/harmony/regress/regress-crbug-461520.js
+++ b/test/mjsunit/harmony/regress/regress-crbug-461520.js
@@ -13,6 +13,6 @@ var handler = {
   }
 };
 
-var p = Proxy.create(handler);
+var p = new Proxy({}, handler);
 var o = Object.create(p);
 with (o) { f() }