[NTI] Fix DevirtualizePrototypeMethods to handle inlined static.

In certain circumstances, a static function's body can be inlined to the RHS of a prototype method, and this currently causes devirtualization to fail in NTI since the receiver type is null. We now explicitly replace a null receiver with UNKNOWN, which prevents the runtime exception while still allowing correct optimization.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=170098793

src/com/google/javascript/jscomp/newtypes/FunctionType.java

@@ -1370,9 +1370,10 @@ public FunctionType instantiateGenericsFromArgumentTypes(JSType recvtype, List<J
 
   /** Returns a new FunctionType with the receiverType promoted to the first argument type. */
   FunctionType devirtualize() {
+    JSType firstArg = receiverType != null ? receiverType : commonTypes.UNKNOWN;
     return new FunctionType(
         commonTypes,
-        ImmutableList.<JSType>builder().add(receiverType).addAll(requiredFormals).build(),
+        ImmutableList.<JSType>builder().add(firstArg).addAll(requiredFormals).build(),
         optionalFormals,
         restFormals,
         returnType,