js_DefaultValue now accepts that it is OK for a request with hint of JSTYPE_OBJECT to result in an object of type JSTYPE_FUNCTION. This is done so that objects that happen to have 'call' ops will not fail when being 'converted' to 'Object'. This Fix is going onto the trunk, SpiderMonkeyDev_BRANCH, and SpiderMonkey140_BRANCH

js/src/jsobj.c

@@ -2135,8 +2135,11 @@ js_DefaultValue(JSContext *cx, JSObject *obj, JSType hint, jsval *vp)
 	if (!OBJ_GET_CLASS(cx, obj)->convert(cx, obj, hint, &v))
 	    return JS_FALSE;
 	if (!JSVAL_IS_PRIMITIVE(v)) {
-	    if (JS_TypeOfValue(cx, v) == hint)
+	    JSType type = JS_TypeOfValue(cx, v);
+	    if (type == hint || 
+	        (type == JSTYPE_FUNCTION && hint == JSTYPE_OBJECT)) {
 		goto out;
+	    }
 	    /* Don't convert to string (source object literal) for JS1.2. */
 	    if (cx->version == JSVERSION_1_2 && hint == JSTYPE_BOOLEAN)
 		goto out;