--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1346,17 +1346,17 @@ fun_getProperty(JSContext *cx, JSObject 
             JSFunction *caller = fp->down->fun;
             /*
              * See equivalent condition in args_getProperty for ARGS_CALLEE,
              * but here we do not want to throw, since this escape can happen
              * via foo.caller alone, without any debugger or indirect eval. And
              * it seems foo.caller is still used on the Web.
              */
             if (FUN_ESCAPE_HAZARD(caller)) {
-                JSObject *wrapper = WrapEscapingClosure(cx, fp, FUN_OBJECT(caller), caller);
+                JSObject *wrapper = WrapEscapingClosure(cx, fp->down, FUN_OBJECT(caller), caller);
                 if (!wrapper)
                     return JS_FALSE;
                 *vp = OBJECT_TO_JSVAL(wrapper);
                 return JS_TRUE;
             }
 
             *vp = OBJECT_TO_JSVAL(fp->down->callee);
         } else {