Bug 830049 - Don't crash when trying to attach caches for property sets on non-native objects, r=dvander.

js/src/ion/IonCaches.cpp

@@ -1435,6 +1435,9 @@ IsPropertySetterCallInlineable(JSContext *cx, HandleObject obj, HandleObject hol
     if (!shape)
         return false;
 
+    if (!holder->isNative())
+        return false;
+
     if (shape->hasSlot())
         return false;
 

js/src/jit-test/tests/basic/bug830049.js

@@ -0,0 +1,10 @@
+// |jit-test| error: InternalError
+
+p = Proxy.create({
+  has: function() function r() s += ''
+})
+Object.prototype.__proto__ = p
+function TestCase(n) {
+    this.name = n
+}
+new TestCase()