Index: src/compiler/js-typed-lowering.cc |
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc |
index 5ad2f95fee6fdb7c5532670f022cd7828d1cc879..09322f31465afd774fb9ff8085a61f6877416e7b 100644 |
--- a/src/compiler/js-typed-lowering.cc |
+++ b/src/compiler/js-typed-lowering.cc |
@@ -1345,6 +1345,8 @@ Reduction JSTypedLowering::ReduceJSCreate(Node* node) { |
target_type->AsConstant()->Value()->IsJSFunction()) { |
Handle<JSFunction> constructor = |
Handle<JSFunction>::cast(target_type->AsConstant()->Value()); |
+ // Check that function is a constructor. |
+ if (!constructor->IsConstructor()) return NoChange(); |
// Force completion of inobject slack tracking before |
// generating code to finalize the instance size. |
if (constructor->IsInobjectSlackTrackingInProgress()) { |