diff --git a/src/isolate.cc b/src/isolate.cc
index 80138c0aab..5fb90a8aca 100644
--- a/src/isolate.cc
+++ b/src/isolate.cc
@@ -924,7 +924,11 @@ bool Isolate::MayNamedAccess(JSObject* receiver, Object* key,
   if (decision != UNKNOWN) return decision == YES;
 
   // Get named access check callback
-  JSFunction* constructor = JSFunction::cast(receiver->map()->constructor());
+  // TODO(dcarney): revert
+  Map* map = receiver->map();
+  CHECK(map->IsMap());
+  CHECK(map->constructor()->IsJSFunction());
+  JSFunction* constructor = JSFunction::cast(map->constructor());
   if (!constructor->shared()->IsApiFunction()) return false;
 
   Object* data_obj =
diff --git a/src/objects.cc b/src/objects.cc
index 2f2bd64348..b77163617e 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -627,6 +627,8 @@ MaybeObject* Object::GetProperty(Object* receiver,
         // that even though we may not actually end up loading the named
         // property from the current object, we still check that we have
         // access to it.
+        // TODO(dcarney): revert.
+        CHECK(current->IsJSObject());
         JSObject* checked = JSObject::cast(current);
         if (!heap->isolate()->MayNamedAccess(checked, name, v8::ACCESS_GET)) {
           return checked->GetPropertyWithFailedAccessCheck(receiver,