[ForIn] Fix HasEnumerableProperty for Proxies with null prototype

test/mjsunit/regress/regress-5181.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-
-function target() {};
-
+var target = Object.create(null);
 var proxy = new Proxy(target, {
-  get() {
-    // Reset the initial map of the target.
-    target.prototype = 123;
-  }});
-
-new proxy();
+  ownKeys: function() {
+    return ['a'];
+  }
+});
+for (var key in proxy) ;