Properly handle non-JSFunction constructors in CanRetainOtherContext

src/type-info.cc

Index: src/type-info.cc
diff --git a/src/type-info.cc b/src/type-info.cc
index 48d516019911b6aaffdba9fe9ce4204f82499dd0..7e1d6011d0e82ad1a26cc47c272567a7c87cc3d0 100644
--- a/src/type-info.cc
+++ b/src/type-info.cc
@@ -438,6 +438,9 @@ bool TypeFeedbackOracle::CanRetainOtherContext(Map* map,
   }
   constructor = map->GetConstructor();
   if (constructor->IsNull()) return false;
+  // If the constructor is not null or a JSFunction, we have to conservatively
+  // assume that it may retain a native context.
+  if (!constructor->IsJSFunction()) return true;
   JSFunction* function = JSFunction::cast(constructor);
   return CanRetainOtherContext(function, native_context);
 }