[proxies] use [[GetPrototypeOf]] trap in for-in

src/prototype.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_PROTOTYPE_H_
 #define V8_PROTOTYPE_H_
 
 #include "src/isolate.h"
 #include "src/objects.h"
 
@@ skipping 107 matching lines @@
 
     if (handle_.is_null()) {
       object_ = prototype;
     } else {
       handle_ = handle(prototype, isolate_);
     }
   }
 
   // Returns false iff a call to JSProxy::GetPrototype throws.
   // TODO(neis): This should probably replace Advance().
-  bool AdvanceFollowingProxies() {
+  MUST_USE_RESULT bool AdvanceFollowingProxies() {
     DCHECK(!(handle_.is_null() && object_->IsJSProxy()));
     if (!HasAccess()) {
       // Abort the lookup if we do not have access to the current object.
       handle_ = isolate_->factory()->null_value();
       is_at_end_ = true;
       return true;
     }
+    return AdvanceFollowingProxiesIgnoringAccessChecks();
+  }
+
+  MUST_USE_RESULT bool AdvanceFollowingProxiesIgnoringAccessChecks() {
     if (handle_.is_null() || !handle_->IsJSProxy()) {
       AdvanceIgnoringProxies();
       return true;
     }
+
     // Due to possible __proto__ recursion limit the number of Proxies
     // we visit to an arbitrarily chosen large number.
     seen_proxies_++;
     if (seen_proxies_ > kProxyPrototypeLimit) {
       isolate_->Throw(
           *isolate_->factory()->NewRangeError(MessageTemplate::kStackOverflow));
       return false;
     }
     MaybeHandle<Object> proto =
         JSProxy::GetPrototype(Handle<JSProxy>::cast(handle_));
@@ skipping 14 matching lines @@
 
   DISALLOW_COPY_AND_ASSIGN(PrototypeIterator);
 };
 
 
 }  // namespace internal
 
 }  // namespace v8
 
 #endif  // V8_PROTOTYPE_H_