2 files changed, 12 insertions, 1 deletions
diff --git a/deps/v8/src/builtins/proxy-get-prototype-of.tq b/deps/v8/src/builtins/proxy-get-prototype-of.tq
index 653d4503d1..5b90a1bb02 100644
--- a/deps/v8/src/builtins/proxy-get-prototype-of.tq
+++ b/deps/v8/src/builtins/proxy-get-prototype-of.tq
@@ -33,7 +33,7 @@ namespace proxy {
 
       // 8. If Type(handlerProto) is neither Object nor Null, throw a TypeError
       // exception.
-      if (!Is<JSReceiver>(handlerProto)) {
+      if (!Is<JSReceiver>(handlerProto) && handlerProto != Null) {
         goto ThrowProxyGetPrototypeOfInvalid;
       }
 
diff --git a/deps/v8/test/mjsunit/regress/regress-9781.js b/deps/v8/test/mjsunit/regress/regress-9781.js
new file mode 100644
index 0000000000..6d3e3162d3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-9781.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var proto = Object.getPrototypeOf(new Proxy(Object.create(null), {
+  getPrototypeOf(target) {
+    return Reflect.getPrototypeOf(target);
+  }
+} ));
+
+assertEquals(proto, null);