Version 4.2.77.15 (cherry-pick)

src/type-info.cc

Index: src/type-info.cc
diff --git a/src/type-info.cc b/src/type-info.cc
index 01943414a7cb60d8495bab94a0adacf13149dd4b..96bd0ed0e3ae4a95e1e102705c48898dcc5c8800 100644
--- a/src/type-info.cc
+++ b/src/type-info.cc
@@ -437,6 +437,9 @@ bool TypeFeedbackOracle::CanRetainOtherContext(Map* map,
   }
   constructor = map->constructor();
   if (constructor->IsNull()) return false;
+  // If the constructor is not null or a JSFunction, we have to conservatively
+  // assume that it may retain a native context.
+  if (!constructor->IsJSFunction()) return true;
   JSFunction* function = JSFunction::cast(constructor);
   return CanRetainOtherContext(function, native_context);
 }