--- a/js/src/jscntxtinlines.h
+++ b/js/src/jscntxtinlines.h
@@ -63,19 +63,21 @@ class CompartmentChecker
     }
 
     void checkZone(JS::Zone* z) {
         if (compartment && z != compartment->zone())
             fail(compartment->zone(), z);
     }
 
     void check(JSObject* obj) {
-        MOZ_ASSERT(JS::ObjectIsNotGray(obj));
-        if (obj)
+        if (obj) {
+            MOZ_ASSERT(JS::ObjectIsNotGray(obj));
+            MOZ_ASSERT(!js::gc::IsAboutToBeFinalizedUnbarriered(&obj));
             check(obj->compartment());
+        }
     }
 
     template<typename T>
     void check(const Rooted<T>& rooted) {
         check(rooted.get());
     }
 
     template<typename T>

--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -727,16 +727,19 @@ js::fun_symbolHasInstance(JSContext* cx,
 }
 
 /*
  * ES6 (4-25-16) 7.3.19 OrdinaryHasInstance
  */
 bool
 JS::OrdinaryHasInstance(JSContext* cx, HandleObject objArg, HandleValue v, bool* bp)
 {
+    AssertHeapIsIdle();
+    assertSameCompartment(cx, objArg, v);
+
     RootedObject obj(cx, objArg);
 
     /* Step 1. */
     if (!obj->isCallable()) {
         *bp = false;
         return true;
     }