Always early return from HandleApiCallHelper on access check failure.

src/builtins/builtins-api.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 
 #include "src/api-arguments.h"
 #include "src/api-natives.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/counters.h"
@@ skipping 63 matching lines @@
           isolate, NewTypeError(MessageTemplate::kIllegalInvocation), Object);
     }
 
     js_receiver = Handle<JSObject>::cast(receiver);
 
     if (!fun_data->accept_any_receiver() &&
         js_receiver->IsAccessCheckNeeded() &&
         !isolate->MayAccess(handle(isolate->context()), js_receiver)) {
       isolate->ReportFailedAccessCheck(js_receiver);
       RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate, Object);
+      return isolate->factory()->undefined_value();
     }
 
     raw_holder = GetCompatibleReceiver(isolate, *fun_data, *js_receiver);
 
     if (raw_holder == nullptr) {
       // This function cannot be called with the given receiver.  Abort!
       THROW_NEW_ERROR(
           isolate, NewTypeError(MessageTemplate::kIllegalInvocation), Object);
     }
   }
@@ skipping 192 matching lines @@
 }
 
 // Handle calls to non-function objects created through the API. This delegate
 // function is used when the call is a construct call.
 BUILTIN(HandleApiCallAsConstructor) {
   return HandleApiCallAsFunctionOrConstructor(isolate, true, args);
 }
 
 }  // namespace internal
 }  // namespace v8