new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug709634.js
@@ -0,0 +1,6 @@
+
+Function.prototype.toString = function () f(this, true);
+function f(obj) {
+  f.caller.p
+}
+decodeURI + 3;

--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1043,16 +1043,17 @@ StackFrame::getValidCalleeObject(JSConte
                     return true;
                 }
 
                 if (shape->hasSlot()) {
                     Value v = thisp->getSlot(shape->slot());
                     JSFunction *clone;
 
                     if (IsFunctionObject(v, &clone) &&
+                        clone->isInterpreted() &&
                         clone->script() == fun->script() &&
                         clone->methodObj() == thisp) {
                         /*
                          * N.B. If the method barrier was on a function
                          * with singleton type, then while crossing the
                          * method barrier CloneFunctionObject will have
                          * ignored the attempt to clone the function.
                          */