[proxies] Fix JSObject::AllCanRead for Proxies on the prototype chain

test/mjsunit/harmony/proxies-accesschecks.js

Index: test/mjsunit/harmony/proxies-accesschecks.js
diff --git a/test/mjsunit/harmony/proxies-accesschecks.js b/test/mjsunit/harmony/proxies-accesschecks.js
new file mode 100644
index 0000000000000000000000000000000000000000..209d4329f956f50464947aa4c3e59d189e66ca9c
--- /dev/null
+++ b/test/mjsunit/harmony/proxies-accesschecks.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-proxies
+
+var realm = Realm.create();
+
+this.__proto__ = new Proxy({}, {
+  getPrototypeOf() { assertUnreachable() },
+  get() { assertUnreachable() }
+});
+
+var other_type_error = Realm.eval(realm, "TypeError");
+assertThrows(() => Realm.eval(realm, "Realm.global(0).foo"), other_type_error);