[builtins] Sanitize receiver patching for API functions.

test/cctest/test-api.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 22154 matching lines @@
                       ->GetFunction(context.local())
                       .ToLocalChecked();
   global->Set(context.local(), v8_str("x"), function).FromJust();
 
   auto result = CompileRun("x()");
   CHECK(v8::Utils::OpenHandle(*result)->IsJSGlobalProxy());
 
   result = CompileRun("x(1,2,3)");
   CHECK(v8::Utils::OpenHandle(*result)->IsJSGlobalProxy());
 
+  result = CompileRun("x.call(undefined)");
+  CHECK(v8::Utils::OpenHandle(*result)->IsJSGlobalProxy());
+
+  result = CompileRun("x.call(null)");
+  CHECK(v8::Utils::OpenHandle(*result)->IsJSGlobalProxy());
+
   result = CompileRun("7 + x.call(3) + 11");
   CHECK(result->IsInt32());
   CHECK_EQ(21, result->Int32Value(context.local()).FromJust());
 
   result = CompileRun("7 + x.call(3, 101, 102, 103, 104) + 11");
   CHECK(result->IsInt32());
   CHECK_EQ(21, result->Int32Value(context.local()).FromJust());
 
   result = CompileRun("var y = []; x.call(y)");
   CHECK(result->IsArray());
@@ skipping 2153 matching lines @@
   CHECK(proxy->GetTarget()->SameValue(target));
   CHECK(proxy->GetHandler()->SameValue(handler));
 
   proxy->Revoke();
   CHECK(proxy->IsProxy());
   CHECK(!target->IsProxy());
   CHECK(proxy->IsRevoked());
   CHECK(proxy->GetTarget()->SameValue(target));
   CHECK(proxy->GetHandler()->IsNull());
 }