[proxies] use [[GetPrototypeOf]] trap in for-in

src/prototype.h

Index: src/prototype.h
diff --git a/src/prototype.h b/src/prototype.h
index c5e954554ca88cf6f76f2a06e03be2710b52a383..e09ff0ff0cd28edc6d0c5d86c8d13c4e21fc708e 100644
--- a/src/prototype.h
+++ b/src/prototype.h
@@ -125,7 +125,7 @@ class PrototypeIterator {
 
   // Returns false iff a call to JSProxy::GetPrototype throws.
   // TODO(neis): This should probably replace Advance().
-  bool AdvanceFollowingProxies() {
+  MUST_USE_RESULT bool AdvanceFollowingProxies() {
     DCHECK(!(handle_.is_null() && object_->IsJSProxy()));
     if (!HasAccess()) {
       // Abort the lookup if we do not have access to the current object.
@@ -133,10 +133,15 @@ class PrototypeIterator {
       is_at_end_ = true;
       return true;
     }
+    return AdvanceFollowingProxiesIgnoringAccessChecks();
+  }
+
+  MUST_USE_RESULT bool AdvanceFollowingProxiesIgnoringAccessChecks() {
     if (handle_.is_null() || !handle_->IsJSProxy()) {
       AdvanceIgnoringProxies();
       return true;
     }
+
     // Due to possible __proto__ recursion limit the number of Proxies
     // we visit to an arbitrarily chosen large number.
     seen_proxies_++;