Super property loads and stores should throw if [[Prototype]] is null

test/mjsunit/es6/super.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
 (function TestSuperNamedLoads() {
   function Base() { }
   function fBase() { }
   Base.prototype = {
@@ skipping 2195 matching lines @@
   }
   class Derived extends Base {
     constructor(x) {
       let r = (() => super(...[x]))();
       assertEquals(this, r);
     }
   }
   let d = new Derived(42);
   assertSame(42, d.x);
 })();
+
+(function TestNullSuperPropertyLoad() {
+  var obj = {
+    __proto__: null,
+    named() { return super.x },
+    keyed() { return super[5] }
+  };
+  assertThrows(obj.named, TypeError);
+  assertThrows(obj.keyed, TypeError);
+  class C extends null {
+    named() { return super.x }
+    keyed() { return super[5] }
+  }
+  assertThrows(C.prototype.named, TypeError);
+  assertThrows(C.prototype.keyed, TypeError);
+})();
+
+(function TestNullSuperPropertyStore() {
+  var obj = {
+    __proto__: null,
+    named() { super.x = 42 },
+    keyed() { super[5] = 42 }
+  };
+  assertThrows(obj.named, TypeError);
+  assertThrows(obj.keyed, TypeError);
+  class C extends null {
+    named() { super.x = 42 }
+    keyed() { super[5] = 42 }
+  }
+  assertThrows(C.prototype.named, TypeError);
+  assertThrows(C.prototype.keyed, TypeError);
+})();