Fixing tinderbox orangeness (Thunderbird) and bug 296467. Get the function object off of the stack frame through fp->argv[-2] and not through fp->fun->object as the latter may be null if the function on the frame is a clone and the real function object no longer exists. reviews and approval pending.

js/src/jsexn.c

@@ -426,7 +426,8 @@ InitExceptionObject(JSContext *cx, JSObject *obj, JSString *message,
         if (checkAccess) {
             v = (fp->fun && fp->argv) ? fp->argv[-2] : JSVAL_NULL;
             if (!JSVAL_IS_PRIMITIVE(v)) {
-                ok = checkAccess(cx, fp->fun->object, callerid, JSACC_READ, &v);
+                ok = checkAccess(cx, JSVAL_TO_OBJECT(fp->argv[-2]), callerid,
+                                 JSACC_READ, &v /* ignored */);
                 if (!ok) {
                     ok = JS_TRUE;
                     break;