Duh.

js/src/jsapi.c

@@ -3167,6 +3167,18 @@ JS_NewFunction(JSContext *cx, JSNative native, uintN nargs, uintN flags,
     return js_NewFunction(cx, NULL, native, nargs, flags, parent, atom);
 }
 
+JS_PUBLIC_API(JSClass *)
+JS_GetFunctionBoundClass(JSContext *cx, JSFunction *fun)
+{
+    return fun->clasp;
+}
+
+JS_PUBLIC_API(void)
+JS_SetFunctionBoundClass(JSContext *cx, JSFunction *fun, JSClass *clasp)
+{
+    fun->clasp = clasp;
+}
+
 JS_PUBLIC_API(JSObject *)
 JS_CloneFunctionObject(JSContext *cx, JSObject *funobj, JSObject *parent)
 {
@@ -3579,13 +3591,12 @@ JS_CompileUCFunctionForPrincipals(JSContext *cx, JSObject *obj,
             argAtom = js_Atomize(cx, argnames[i], strlen(argnames[i]), 0);
             if (!argAtom)
                 break;
-            if (!js_AddNativeProperty(cx, fun->object, ATOM_TO_JSID(argAtom),
+            if (!js_AddHiddenProperty(cx, fun->object, ATOM_TO_JSID(argAtom),
                                       js_GetArgument, js_SetArgument,
                                       SPROP_INVALID_SLOT,
                                       JSPROP_ENUMERATE | JSPROP_PERMANENT |
                                       JSPROP_SHARED,
-                                      SPROP_HAS_SHORTID | SPROP_IS_HIDDEN,
-                                      i)) {
+                                      SPROP_HAS_SHORTID, i)) {
                 break;
             }
         }