[runtime] Do not add shadowing key for end prototype

Shadowing key is used to exclude non-enumerable keys when iterating
over the prototype chain. This CL skips adding shadowing key for
end prototype to improve for-in performance. It can improve the
performance of below microbench by ~50%.

Object.prototype.foo = function() {};
let obj = {
	a:0,
	b:1
};
let start = Date.now();
for (let i = 0; i<1e6; i++) {
	for (var j in obj) {}
}
console.log(Date.now() - start);

This CL also improves the score of JetStream2-tagcloud-SP case
by 8% on IA Chromebook.

Contributed by tao.pan@intel.com

Change-Id: I456082c08bf70f1f450ff54f657cdab26eb7bc2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781113Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
Cr-Commit-Position: refs/heads/master@{#63587}

src/objects/keys.cc

@@ -689,6 +689,7 @@ Maybe<bool> KeyAccumulator::CollectOwnPropertyNames(Handle<JSReceiver> receiver,
       Map map = object->map();
       int nof_descriptors = map.NumberOfOwnDescriptors();
       if (enum_keys->length() != nof_descriptors) {
+        if (map.prototype(isolate_) != ReadOnlyRoots(isolate_).null_value()) {
           Handle<DescriptorArray> descs =
               Handle<DescriptorArray>(map.instance_descriptors(), isolate_);
           for (int i = 0; i < nof_descriptors; i++) {
@@ -698,6 +699,7 @@ Maybe<bool> KeyAccumulator::CollectOwnPropertyNames(Handle<JSReceiver> receiver,
             this->AddShadowingKey(key);
           }
         }
+      }
     } else if (object->IsJSGlobalObject()) {
       enum_keys = GetOwnEnumPropertyDictionaryKeys(
           isolate_, mode_, this, object,