Don't crash when reaching a non-wrapper along the proto chain of a wrapper (bug 634236, r=mrbkap).

js/src/jscompartment.cpp

@@ -180,7 +180,8 @@ JSCompartment::arenaListsAreEmpty()
 static bool
 IsCrossCompartmentWrapper(JSObject *wrapper)
 {
-    return !!(JSWrapper::wrapperHandler(wrapper)->flags() & JSWrapper::CROSS_COMPARTMENT);
+    return wrapper->isWrapper() &&
+           !!(JSWrapper::wrapperHandler(wrapper)->flags() & JSWrapper::CROSS_COMPARTMENT);
 }
 
 bool