Fix Array.prototype.{reduce,reduceRight} to pass undefined as receiver

src/v8natives.js

Index: src/v8natives.js
diff --git a/src/v8natives.js b/src/v8natives.js
index a5627c8cf35fd93a93eb549a3fe7ad4cad10aeef..6174b4134849a62e80ed37de0a4adcd977a88aae 100644
--- a/src/v8natives.js
+++ b/src/v8natives.js
@@ -572,7 +572,7 @@ function GetProperty(obj, p) {
       throw MakeTypeError("handler_trap_missing",
                           [handler, "getPropertyDescriptor"]);
     }
-    var descriptor = getProperty.call(handler, p);
+    var descriptor = %_CallFunction(handler, p, getProperty);
     if (IS_UNDEFINED(descriptor)) return descriptor;
     var desc = ToCompletePropertyDescriptor(descriptor);
     if (!desc.configurable) {
@@ -592,10 +592,10 @@ function GetProperty(obj, p) {
 // ES5 section 8.12.6
 function HasProperty(obj, p) {
   if (%IsJSProxy(obj)) {
-    var handler = %GetHandler(obj)
-    var has = handler.has
-    if (IS_UNDEFINED(has)) has = DerivedHasTrap
-    return ToBoolean(has.call(handler, obj, p))
+    var handler = %GetHandler(obj);
+    var has = handler.has;
+    if (IS_UNDEFINED(has)) has = DerivedHasTrap;
+    return ToBoolean(%_CallFunction(handler, obj, p, has))
   }
   var desc = GetProperty(obj, p);
   return IS_UNDEFINED(desc) ? false : true;
@@ -831,7 +831,7 @@ function ObjectGetOwnPropertyNames(obj) {
       throw MakeTypeError("handler_trap_missing",
                           [handler, "getOwnPropertyNames"]);
     }
-    var names = getOwnPropertyNames.call(handler);
+    var names = %_CallFunction(handler, getOwnPropertyNames);
     return ToStringArray(names, "getOwnPropertyNames");
   }