Back port r12439 and r12442 to the 3.10 branch:

src/accessors.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 737 matching lines @@
     if (caller == NULL) return isolate->heap()->null_value();
   } while (caller->shared()->is_toplevel());
 
   // If caller is a built-in function and caller's caller is also built-in,
   // use that instead.
   JSFunction* potential_caller = caller;
   while (potential_caller != NULL && potential_caller->IsBuiltin()) {
     caller = potential_caller;
     potential_caller = it.next();
   }
+  if (!caller->shared()->native() && potential_caller != NULL) {
+    caller = potential_caller;
+  }
   // If caller is bound, return null. This is compatible with JSC, and
   // allows us to make bound functions use the strict function map
   // and its associated throwing caller and arguments.
   if (caller->shared()->bound()) {
     return isolate->heap()->null_value();
   }
   return CheckNonStrictCallerOrThrow(isolate, caller);
 }
 
 
@@ skipping 28 matching lines @@
 }
 
 
 const AccessorDescriptor Accessors::ObjectPrototype = {
   ObjectGetPrototype,
   ObjectSetPrototype,
   0
 };
 
 } }  // namespace v8::internal