Properly handle non-JSFunction constructors in CanRetainOtherContext

src/type-info.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/ast.h"
 #include "src/code-stubs.h"
 #include "src/compiler.h"
 #include "src/ic/ic.h"
@@ skipping 420 matching lines @@
       // Check if the constructor directly references a foreign context.
       if (CanRetainOtherContext(JSFunction::cast(constructor),
                                 native_context)) {
         return true;
       }
     }
     map = HeapObject::cast(map->prototype())->map();
   }
   constructor = map->GetConstructor();
   if (constructor->IsNull()) return false;
+  // If the constructor is not null or a JSFunction, we have to conservatively
+  // assume that it may retain a native context.
+  if (!constructor->IsJSFunction()) return true;
   JSFunction* function = JSFunction::cast(constructor);
   return CanRetainOtherContext(function, native_context);
 }
 
 
 bool TypeFeedbackOracle::CanRetainOtherContext(JSFunction* function,
                                                Context* native_context) {
   return function->context()->global_object() != native_context->global_object()
       && function->context()->global_object() != native_context->builtins();
 }
@@ skipping 112 matching lines @@
          UnseededNumberDictionary::kNotFound);
   // Dictionary has been allocated with sufficient size for all elements.
   DisallowHeapAllocation no_need_to_resize_dictionary;
   HandleScope scope(isolate());
   USE(UnseededNumberDictionary::AtNumberPut(
       dictionary_, IdToKey(ast_id), handle(target, isolate())));
 }
 
 
 } }  // namespace v8::internal