`1..isPrototypeOf.call(null)` should return false, not throw TypeError.

test/mjsunit/function-call.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 144 matching lines @@
       e.message.indexOf("Cannot convert undefined or null to object") >= 0);
 }
 
 // Test that all natives using the ToObject call throw the right exception.
 for (var i = 0; i < should_throw_on_null_and_undefined.length; i++) {
   // Sanity check that all functions are correct
   assertEquals(typeof(should_throw_on_null_and_undefined[i]), "function");
 
   var exception = false;
   try {
-    // We call all functions with no parameters, which means that essential
-    // parameters will have the undefined value.
-    // The test for whether the "this" value is null or undefined is always
-    // performed before access to the other parameters, so even if the
-    // undefined value is an invalid argument value, it mustn't change
-    // the result of the test.
-    should_throw_on_null_and_undefined[i].call(null);
+    // We need to pass a dummy object argument ({}) to these functions because
+    // of Object.prototype.isPrototypeOf's special behavior, see issue 3483
+    // for more details.
+    should_throw_on_null_and_undefined[i].call(null, {});
   } catch (e) {
     exception = true;
     checkExpectedMessage(e);
   }
   assertTrue(exception);
 
   exception = false;
   try {
-    should_throw_on_null_and_undefined[i].call(undefined);
+    should_throw_on_null_and_undefined[i].call(undefined, {});
   } catch (e) {
     exception = true;
     checkExpectedMessage(e);
   }
   assertTrue(exception);
 
   exception = false;
   try {
-    should_throw_on_null_and_undefined[i].apply(null);
+    should_throw_on_null_and_undefined[i].apply(null, [{}]);
   } catch (e) {
     exception = true;
     checkExpectedMessage(e);
   }
   assertTrue(exception);
 
   exception = false;
   try {
-    should_throw_on_null_and_undefined[i].apply(undefined);
+    should_throw_on_null_and_undefined[i].apply(undefined, [{}]);
   } catch (e) {
     exception = true;
     checkExpectedMessage(e);
   }
   assertTrue(exception);
 }
 
 // Test that all natives that are non generic throw on null and undefined.
 for (var i = 0; i < non_generic.length; i++) {
   // Sanity check that all functions are correct
@@ skipping 32 matching lines @@
   } catch (e) {
     exception = true;
     assertTrue(e instanceof TypeError);
   }
   assertTrue(exception);
 }
 
 
 // Test that we still throw when calling with thisArg null or undefined
 // through an array mapping function.
-var array = [1,2,3,4,5];
+// We need to make sure that the elements of `array` are all object values,
+// see issue 3483 for more details.
+var array = [{}, [], new Number, new Map, new WeakSet];
 for (var j = 0; j < mapping_functions.length; j++) {
   for (var i = 0; i < should_throw_on_null_and_undefined.length; i++) {
     exception = false;
     try {
       mapping_functions[j].call(array,
                                 should_throw_on_null_and_undefined[i],
                                 null);
     } catch (e) {
       exception = true;
       checkExpectedMessage(e);
@@ skipping 85 matching lines @@
   }
 }
 
 
 // Object.prototype.toString()
 assertEquals(Object.prototype.toString.call(null),
              '[object Null]')
 
 assertEquals(Object.prototype.toString.call(undefined),
              '[object Undefined]')