[runtime] support new Proxy() instead of Proxy.create and install getPrototypeOf trap

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index e4ceec99be4f17a12d42cb3a6614d0662c2e58ea..56c9641d4193afcb5b17bc05c8e6c9992a62d162 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -1576,8 +1576,10 @@ BUILTIN(ReflectGetPrototypeOf) {
                               isolate->factory()->NewStringFromAsciiChecked(
                                   "Reflect.getPrototypeOf")));
   }
-
-  return *Object::GetPrototype(isolate, target);
+  Handle<Object> prototype;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, prototype,
+                                     Object::GetPrototype(isolate, target));

[rossberg, 2015/11/12 17:04:39]

That is not correct, I'm afraid. The proxy handler may have a custom trap.

Edit: Ah, I get it, you're abusing the prototype for the target. You dirty
bastard! Please let's not do such hacks, not even temporarily.

[Toon Verwaest, 2015/11/12 19:39:05]

Independent of whether the target is stored as the prototype (it really
shouldn't, we've discussed this before...), this is Object::GetPrototype, which
calls to JSProxy::GetPrototype in case it's a JSProxy; which in turn calls to
the trap if there is one.

+  return *prototype;
 }