[string] Fix null handling in MaybeCallFunctionAtSymbol

test/mjsunit/es6/string-replace.js

Index: test/mjsunit/es6/string-replace.js
diff --git a/test/mjsunit/es6/string-replace.js b/test/mjsunit/es6/string-replace.js
index 0beb57a5368607af0ead51fb3f1d334c2c41b664..16cadc5369f9d57d693137f0f8c014da65096703 100644
--- a/test/mjsunit/es6/string-replace.js
+++ b/test/mjsunit/es6/string-replace.js
@@ -3,7 +3,8 @@
 // found in the LICENSE file.
 
 var pattern = {
-  [Symbol.replace]: (string, newValue) => string + newValue
+  [Symbol.replace]: (string, newValue) => string + newValue,
+  toString: () => "c"
 };
 // Check object coercible fails.
 assertThrows(() => String.prototype.replace.call(null, pattern, "x"),
@@ -13,5 +14,8 @@ assertEquals("abcdex", "abcde".replace(pattern, "x"));
 // Non-callable override.
 pattern[Symbol.replace] = "dumdidum";
 assertThrows(() => "abcde".replace(pattern, "x"), TypeError);
+// Null override.
+pattern[Symbol.replace] = null;
+assertEquals("abXde", "abcde".replace(pattern, "X"));
 
 assertEquals("[Symbol.replace]", RegExp.prototype[Symbol.replace].name);