[proxies] use [[GetPrototypeOf]] trap in for-in

src/keys.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/keys.h"
 
 #include "src/elements.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
 #include "src/objects-inl.h"
@@ skipping 234 matching lines @@
     store_position++;
   }
   if (store_position == 0) return isolate->factory()->empty_fixed_array();
   keys->Shrink(store_position);
   return keys;
 }
 
 // Returns "nothing" in case of exception, "true" on success.
 Maybe<bool> KeyAccumulator::AddKeysFromProxy(Handle<JSProxy> proxy,
                                              Handle<FixedArray> keys) {
-  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-      isolate_, keys, FilterProxyKeys(isolate_, proxy, keys, filter_),
-      Nothing<bool>());
+  if (filter_proxy_keys_) {
+    ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+        isolate_, keys, FilterProxyKeys(isolate_, proxy, keys, filter_),
+        Nothing<bool>());
+  }
   // Proxies define a complete list of keys with no distinction of
   // elements and properties, which breaks the normal assumption for the
   // KeyAccumulator.
   if (type_ == OWN_ONLY) {
     ownProxyKeys_ = keys;
     level_string_length_ = keys->length();
     length_ = level_string_length_;
   } else {
     AddKeys(keys, PROXY_MAGIC);
   }
@@ skipping 163 matching lines @@
       return keys;
     }
   }
   // The properties-only case failed because there were probably elements on the
   // receiver.
   return GetOwnKeysWithElements(isolate_, object, convert);
 }
 
 MaybeHandle<FixedArray> FastKeyAccumulator::GetKeysSlow(
     GetKeysConversion convert) {
-  return JSReceiver::GetKeys(receiver_, type_, ENUMERABLE_STRINGS);
+  return JSReceiver::GetKeys(receiver_, type_, ENUMERABLE_STRINGS, KEEP_NUMBERS,
+                             filter_proxy_keys_);
 }
 
 }  // namespace internal
 }  // namespace v8