1 files changed, 6 insertions, 2 deletions
diff --git a/JavaScriptCore/runtime/JSCell.h b/JavaScriptCore/runtime/JSCell.h
index ae5aca3..c083825 100644
--- a/JavaScriptCore/runtime/JSCell.h
+++ b/JavaScriptCore/runtime/JSCell.h
@@ -207,12 +207,16 @@ namespace JSC {
 
     inline CallType JSValue::getCallData(CallData& callData)
     {
-        return isCell() ? asCell()->getCallData(callData) : CallTypeNone;
+        CallType result = isCell() ? asCell()->getCallData(callData) : CallTypeNone;
+        ASSERT(result == CallTypeNone || isValidCallee());
+        return result;
     }
 
     inline ConstructType JSValue::getConstructData(ConstructData& constructData)
     {
-        return isCell() ? asCell()->getConstructData(constructData) : ConstructTypeNone;
+        ConstructType result = isCell() ? asCell()->getConstructData(constructData) : ConstructTypeNone;
+        ASSERT(result == ConstructTypeNone || isValidCallee());
+        return result;
     }
 
     ALWAYS_INLINE bool JSValue::getUInt32(uint32_t& v) const