Check that receiver is JSObject on API calls.

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index 377de057a3e054b35fb17b54875187ee58701910..f473559638f1c1a5b261cdc88ac0234254dc1f99 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -1026,6 +1026,8 @@ static inline Object* TypeCheck(Heap* heap,
                                 Object** argv,
                                 FunctionTemplateInfo* info) {
   Object* recv = argv[0];
+  // API calls are only supported with JSObject receivers.
+  if (!recv->IsJSObject()) return heap->null_value();
   Object* sig_obj = info->signature();
   if (sig_obj->IsUndefined()) return recv;
   SignatureInfo* sig = SignatureInfo::cast(sig_obj);