Bug 1303396 - Don't assert when calling intrinsic_ConstructFunction with non-JSFunction. r=till

js/src/tests/ecma_6/Function/construct-bound-proxy-with-many-arguments.js

@@ -0,0 +1,13 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+var proxy = Function.prototype.bind.call(new Proxy(Array, {}));
+for (var i = 10; i < 50; ++i) {
+    var args = Array(i).fill(i);
+    var array = new proxy(...args);
+    assertEqArray(array, args);
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(0, 0, "ok");

js/src/vm/SelfHosting.cpp

@@ -1907,7 +1907,7 @@ intrinsic_ConstructFunction(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     MOZ_ASSERT(args.length() == 3);
-    MOZ_ASSERT(args[0].toObject().is<JSFunction>());
+    MOZ_ASSERT(IsConstructor(args[0]));
     MOZ_ASSERT(IsConstructor(args[1]));
     MOZ_ASSERT(args[2].toObject().is<ArrayObject>());