[ForIn] Fix HasEnumerableProperty for Proxies with null prototype

test/mjsunit/regress/regress-5181.js

Index: test/mjsunit/regress/regress-5181.js
diff --git a/test/mjsunit/regress/regress-crbug-578039-Proxy_construct_prototype_change.js b/test/mjsunit/regress/regress-5181.js
similarity index 61%
copy from test/mjsunit/regress/regress-crbug-578039-Proxy_construct_prototype_change.js
copy to test/mjsunit/regress/regress-5181.js
index 30b3f219e9a1a733fefdac8b92a1e01b6be58f7e..d8dfc4a0b6e4690d6d1b0fb57a621e54cff30242 100644
--- a/test/mjsunit/regress/regress-crbug-578039-Proxy_construct_prototype_change.js
+++ b/test/mjsunit/regress/regress-5181.js
@@ -2,13 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-
-function target() {};
-
+var target = Object.create(null);
 var proxy = new Proxy(target, {
-  get() {
-    // Reset the initial map of the target.
-    target.prototype = 123;
-  }});
-
-new proxy();
+  ownKeys: function() {
+    return ['a'];
+  }
+});
+for (var key in proxy) ;