Last gasp for 496605 (r=igor).
authorBrendan Eich <brendan@mozilla.org>
Fri, 05 Jun 2009 12:24:20 -0700
changeset 25908 7e440eed8c443acc564c052d24dd27da6232fb55
parent 25907 8543216f2cad0cc0d8d124aa3f22359dff6a6922
child 25909 3b76e2b5482b6a93d0eefecc764e5e9217fb6dcc
push id1664
push userrsayre@mozilla.com
push dateMon, 08 Jun 2009 17:47:56 +0000
reviewersigor
bugs496605
milestone1.9.1pre
Last gasp for 496605 (r=igor).
js/src/jsfun.cpp
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1346,17 +1346,17 @@ fun_getProperty(JSContext *cx, JSObject 
             JSFunction *caller = fp->down->fun;
             /*
              * See equivalent condition in args_getProperty for ARGS_CALLEE,
              * but here we do not want to throw, since this escape can happen
              * via foo.caller alone, without any debugger or indirect eval. And
              * it seems foo.caller is still used on the Web.
              */
             if (FUN_ESCAPE_HAZARD(caller)) {
-                JSObject *wrapper = WrapEscapingClosure(cx, fp, FUN_OBJECT(caller), caller);
+                JSObject *wrapper = WrapEscapingClosure(cx, fp->down, FUN_OBJECT(caller), caller);
                 if (!wrapper)
                     return JS_FALSE;
                 *vp = OBJECT_TO_JSVAL(wrapper);
                 return JS_TRUE;
             }
 
             *vp = OBJECT_TO_JSVAL(fp->down->callee);
         } else {