[proxies] use [[GetPrototypeOf]] trap in for-in

src/prototype.h

Index: src/prototype.h
diff --git a/src/prototype.h b/src/prototype.h
index c5e954554ca88cf6f76f2a06e03be2710b52a383..465e4d24b3069126cf685cca3c9c166b873518a8 100644
--- a/src/prototype.h
+++ b/src/prototype.h
@@ -29,6 +29,8 @@ class PrototypeIterator {
 
   enum WhereToEnd { END_AT_NULL, END_AT_NON_HIDDEN };
 
+  enum WhenToCallProxyTrap { TRAP_CALL_ALWAYS, STOP_EARLY };
+
   const int kProxyPrototypeLimit = 100 * 1000;
 
   PrototypeIterator(Isolate* isolate, Handle<JSReceiver> receiver,
@@ -125,7 +127,8 @@ class PrototypeIterator {
 
   // Returns false iff a call to JSProxy::GetPrototype throws.
   // TODO(neis): This should probably replace Advance().
-  bool AdvanceFollowingProxies() {
+  bool AdvanceFollowingProxies(
+      WhenToCallProxyTrap when_to_call_trap = TRAP_CALL_ALWAYS) {
     DCHECK(!(handle_.is_null() && object_->IsJSProxy()));
     if (!HasAccess()) {
       // Abort the lookup if we do not have access to the current object.
@@ -137,6 +140,13 @@ class PrototypeIterator {
       AdvanceIgnoringProxies();
       return true;
     }
+
+    // Proxies can never have hidden protoypes
+    if (where_to_end_ == END_AT_NON_HIDDEN) {
+      is_at_end_ = true;
+      if (when_to_call_trap == STOP_EARLY) return true;
+    }
+
     // Due to possible __proto__ recursion limit the number of Proxies
     // we visit to an arbitrarily chosen large number.
     seen_proxies_++;
@@ -148,7 +158,7 @@ class PrototypeIterator {
     MaybeHandle<Object> proto =
         JSProxy::GetPrototype(Handle<JSProxy>::cast(handle_));
     if (!proto.ToHandle(&handle_)) return false;
-    is_at_end_ = where_to_end_ == END_AT_NON_HIDDEN || handle_->IsNull();
+    if (handle_->IsNull()) is_at_end_ = true;
     return true;
   }