Add missing null condition in Proxy GetPrototypeof

Bug: v8:9781
Change-Id: I1f82a828f103cc2aa3f9553214f6b4867ffc3b17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1829897
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64049}

src/builtins/proxy-get-prototype-of.tq

@@ -33,7 +33,7 @@ namespace proxy {
 
       // 8. If Type(handlerProto) is neither Object nor Null, throw a TypeError
       // exception.
-      if (!Is<JSReceiver>(handlerProto)) {
+      if (!Is<JSReceiver>(handlerProto) && handlerProto != Null) {
         goto ThrowProxyGetPrototypeOfInvalid;
       }
 

test/mjsunit/regress/regress-9781.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var proto = Object.getPrototypeOf(new Proxy(Object.create(null), {
+  getPrototypeOf(target) {
+    return Reflect.getPrototypeOf(target);
+  }
+} ));
+
+assertEquals(proto, null);