[runtime] Do not add shadowing key for end prototype

Shadowing key is used to exclude non-enumerable keys when iterating
over the prototype chain. This CL skips adding shadowing key for
end prototype to improve for-in performance. It can improve the
performance of below microbench by ~50%.

Object.prototype.foo = function() {};
let obj = {
	a:0,
	b:1
};
let start = Date.now();
for (let i = 0; i<1e6; i++) {
	for (var j in obj) {}
}
console.log(Date.now() - start);

This CL also improves the score of JetStream2-tagcloud-SP case
by 8% on IA Chromebook.

Contributed by tao.pan@intel.com

Change-Id: I456082c08bf70f1f450ff54f657cdab26eb7bc2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781113Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
Cr-Commit-Position: refs/heads/master@{#63587}

src/objects/keys.cc

@@ -689,13 +689,15 @@ Maybe<bool> KeyAccumulator::CollectOwnPropertyNames(Handle<JSReceiver> receiver,
       Map map = object->map();
       int nof_descriptors = map.NumberOfOwnDescriptors();
       if (enum_keys->length() != nof_descriptors) {
-        Handle<DescriptorArray> descs =
-            Handle<DescriptorArray>(map.instance_descriptors(), isolate_);
-        for (int i = 0; i < nof_descriptors; i++) {
-          PropertyDetails details = descs->GetDetails(i);
-          if (!details.IsDontEnum()) continue;
-          Object key = descs->GetKey(i);
-          this->AddShadowingKey(key);
+        if (map.prototype(isolate_) != ReadOnlyRoots(isolate_).null_value()) {
+          Handle<DescriptorArray> descs =
+              Handle<DescriptorArray>(map.instance_descriptors(), isolate_);
+          for (int i = 0; i < nof_descriptors; i++) {
+            PropertyDetails details = descs->GetDetails(i);
+            if (!details.IsDontEnum()) continue;
+            Object key = descs->GetKey(i);
+            this->AddShadowingKey(key);
+          }
         }
       }
     } else if (object->IsJSGlobalObject()) {