[ForIn] Fix HasEnumerableProperty for Proxies with null prototype

src/runtime/runtime-forin.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/elements.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
@@ skipping 47 matching lines @@
       case LookupIterator::JSPROXY: {
         // For proxies we have to invoke the [[GetOwnProperty]] trap.
         result = JSProxy::GetPropertyAttributes(&it);
         if (result.IsNothing()) return MaybeHandle<Object>();
         if (result.FromJust() == ABSENT) {
           // Continue lookup on the proxy's prototype.
           Handle<JSProxy> proxy = it.GetHolder<JSProxy>();
           Handle<Object> prototype;
           ASSIGN_RETURN_ON_EXCEPTION(isolate, prototype,
                                      JSProxy::GetPrototype(proxy), Object);
-          if (prototype->IsNull(isolate)) break;
+          if (prototype->IsNull(isolate)) {
+            return isolate->factory()->undefined_value();
+          }
           // We already have a stack-check in JSProxy::GetPrototype.
           return HasEnumerableProperty(
               isolate, Handle<JSReceiver>::cast(prototype), key);
         } else if (result.FromJust() & DONT_ENUM) {
           return isolate->factory()->undefined_value();
         } else {
           return it.GetName();
         }
       }
       case LookupIterator::INTERCEPTOR: {
@@ skipping 106 matching lines @@
   SealHandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_SMI_ARG_CHECKED(index, 0);
   DCHECK_LE(0, index);
   DCHECK_LT(index, Smi::kMaxValue);
   return Smi::FromInt(index + 1);
 }
 
 }  // namespace internal
 }  // namespace v8