[string] Fix null handling in MaybeCallFunctionAtSymbol

src/builtins/builtins-string-gen.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-regexp-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/objects.h"
@@ skipping 1041 matching lines @@
 
     BIND(&stub_call);
     Return(regexp_call());
 
     BIND(&slow_lookup);
   }
 
   GotoIf(IsNullOrUndefined(object), &out);
 
   // Fall back to a slow lookup of {object[symbol]}.
+  //
+  // The spec uses GetMethod({object}, {symbol}), which has a few quirks:
+  // * null values are turned into undefined, and
+  // * an exception is thrown if the value is not undefined, null, or callable.
+  // We handle the former by jumping to {out} for null values as well, while
+  // the latter is already handled by the Call({maybe_func}) operation.
 
   Node* const maybe_func = GetProperty(context, object, symbol);
   GotoIf(IsUndefined(maybe_func), &out);
+  GotoIf(IsNull(maybe_func), &out);
 
   // Attempt to call the function.
-
   Node* const result = generic_call(maybe_func);
   Return(result);
 
   BIND(&out);
 }
 
 compiler::Node* StringBuiltinsAssembler::IndexOfDollarChar(Node* const context,
                                                            Node* const string) {
   CSA_ASSERT(this, IsString(string));
 
@@ skipping 701 matching lines @@
     CallRuntime(Runtime::kThrowIncompatibleMethodReceiver, context,
                 HeapConstant(factory()->NewStringFromAsciiChecked(
                     "String Iterator.prototype.next", TENURED)),
                 iterator);
     Unreachable();
   }
 }
 
 }  // namespace internal
 }  // namespace v8