diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 8285e7e13d..668d4c0eee 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -1150,7 +1150,8 @@ Reduction JSTypedLowering::ReduceJSInstanceOf(Node* node) {
     Handle<JSFunction> function =
         Handle<JSFunction>::cast(r.right_type()->AsConstant()->Value());
     Handle<SharedFunctionInfo> shared(function->shared(), isolate());
-    if (!function->map()->has_non_instance_prototype()) {
+    if (function->IsConstructor() &&
+        !function->map()->has_non_instance_prototype()) {
       JSFunction::EnsureHasInitialMap(function);
       DCHECK(function->has_initial_map());
       Handle<Map> initial_map(function->initial_map(), isolate());
diff --git a/src/crankshaft/hydrogen.cc b/src/crankshaft/hydrogen.cc
index 2c8a5f2adc..81c6ed4281 100644
--- a/src/crankshaft/hydrogen.cc
+++ b/src/crankshaft/hydrogen.cc
@@ -11459,7 +11459,8 @@ void HOptimizedGraphBuilder::VisitCompareOperation(CompareOperation* expr) {
         HConstant::cast(right)->handle(isolate())->IsJSFunction()) {
       Handle<JSFunction> constructor =
           Handle<JSFunction>::cast(HConstant::cast(right)->handle(isolate()));
-      if (!constructor->map()->has_non_instance_prototype()) {
+      if (constructor->IsConstructor() &&
+          !constructor->map()->has_non_instance_prototype()) {
         JSFunction::EnsureHasInitialMap(constructor);
         DCHECK(constructor->has_initial_map());
         Handle<Map> initial_map(constructor->initial_map(), isolate());
diff --git a/src/objects.cc b/src/objects.cc
index 3fd653067f..41d85c7c1c 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -12524,6 +12524,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
 
 
 void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
+  DCHECK(function->IsConstructor() || function->shared()->is_generator());
   if (function->has_initial_map()) return;
   Isolate* isolate = function->GetIsolate();
 
diff --git a/test/mjsunit/regress/regress-ensure-initial-map.js b/test/mjsunit/regress/regress-ensure-initial-map.js
new file mode 100644
index 0000000000..dbd4762fcd
--- /dev/null
+++ b/test/mjsunit/regress/regress-ensure-initial-map.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var x = Object.getOwnPropertyDescriptor({get x() {}}, "x").get;
+function f(o, b) {
+  if (b) {
+    return o instanceof x;
+  }
+}
+
+%OptimizeFunctionOnNextCall(f);
+f();
+
+function g() {
+  return new x();
+}
+
+%OptimizeFunctionOnNextCall(g);
+assertThrows(()=>g());