[proxies] use [[GetPrototypeOf]] trap in for-in

src/prototype.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_PROTOTYPE_H_
 #define V8_PROTOTYPE_H_
 
 #include "src/isolate.h"
 #include "src/objects.h"
 
@@ skipping 11 matching lines @@
  * The PrototypeIterator can either run to the null_value(), the first
  * non-hidden prototype, or a given object.
  */
 
 class PrototypeIterator {
  public:
   enum WhereToStart { START_AT_RECEIVER, START_AT_PROTOTYPE };
 
   enum WhereToEnd { END_AT_NULL, END_AT_NON_HIDDEN };
 
+  enum WhenToCallProxyTrap { TRAP_CALL_ALWAYS, STOP_EARLY };
+
   const int kProxyPrototypeLimit = 100 * 1000;
 
   PrototypeIterator(Isolate* isolate, Handle<JSReceiver> receiver,
                     WhereToStart where_to_start = START_AT_PROTOTYPE,
                     WhereToEnd where_to_end = END_AT_NULL)
       : object_(NULL),
         handle_(receiver),
         isolate_(isolate),
         where_to_end_(where_to_end),
         is_at_end_(false),
@@ skipping 76 matching lines @@
 
     if (handle_.is_null()) {
       object_ = prototype;
     } else {
       handle_ = handle(prototype, isolate_);
     }
   }
 
   // Returns false iff a call to JSProxy::GetPrototype throws.
   // TODO(neis): This should probably replace Advance().
-  bool AdvanceFollowingProxies() {
+  bool AdvanceFollowingProxies(
+      WhenToCallProxyTrap when_to_call_trap = TRAP_CALL_ALWAYS) {
     DCHECK(!(handle_.is_null() && object_->IsJSProxy()));
     if (!HasAccess()) {
       // Abort the lookup if we do not have access to the current object.
       handle_ = isolate_->factory()->null_value();
       is_at_end_ = true;
       return true;
     }
     if (handle_.is_null() || !handle_->IsJSProxy()) {
       AdvanceIgnoringProxies();
       return true;
     }
+
+    // Proxies can never have hidden protoypes
+    if (where_to_end_ == END_AT_NON_HIDDEN) {
+      is_at_end_ = true;
+      if (when_to_call_trap == STOP_EARLY) return true;
+    }
+
     // Due to possible __proto__ recursion limit the number of Proxies
     // we visit to an arbitrarily chosen large number.
     seen_proxies_++;
     if (seen_proxies_ > kProxyPrototypeLimit) {
       isolate_->Throw(
           *isolate_->factory()->NewRangeError(MessageTemplate::kStackOverflow));
       return false;
     }
     MaybeHandle<Object> proto =
         JSProxy::GetPrototype(Handle<JSProxy>::cast(handle_));
     if (!proto.ToHandle(&handle_)) return false;
-    is_at_end_ = where_to_end_ == END_AT_NON_HIDDEN || handle_->IsNull();
+    if (handle_->IsNull()) is_at_end_ = true;
     return true;
   }
 
   bool IsAtEnd() const { return is_at_end_; }
 
  private:
   Object* object_;
   Handle<Object> handle_;
   Isolate* isolate_;
   WhereToEnd where_to_end_;
   bool is_at_end_;
   int seen_proxies_;
 
   DISALLOW_COPY_AND_ASSIGN(PrototypeIterator);
 };
 
 
 }  // namespace internal
 
 }  // namespace v8
 
 #endif  // V8_PROTOTYPE_H_