[ForIn] Fix HasEnumerableProperty for Proxies with null prototype

src/runtime/runtime-forin.cc

Index: src/runtime/runtime-forin.cc
diff --git a/src/runtime/runtime-forin.cc b/src/runtime/runtime-forin.cc
index e57016a6d39c847d2ea51bfc9630fc772cdd9f32..916ff17a9ebfd2c13083f82e25701549d209f0bd 100644
--- a/src/runtime/runtime-forin.cc
+++ b/src/runtime/runtime-forin.cc
@@ -65,7 +65,9 @@ MaybeHandle<Object> HasEnumerableProperty(Isolate* isolate,
           Handle<Object> prototype;
           ASSIGN_RETURN_ON_EXCEPTION(isolate, prototype,
                                      JSProxy::GetPrototype(proxy), Object);
-          if (prototype->IsNull(isolate)) break;
+          if (prototype->IsNull(isolate)) {
+            return isolate->factory()->undefined_value();
+          }
           // We already have a stack-check in JSProxy::GetPrototype.
           return HasEnumerableProperty(
               isolate, Handle<JSReceiver>::cast(prototype), key);