Null pointer defense in FUN_CALLER fun_getProperty case (117307, r/sr skipped, trivial).

js/src/jsfun.c

@@ -931,7 +931,7 @@ fun_getProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
         break;
 
       case FUN_CALLER:
-        if (fp && fp->down && fp->down->fun)
+        if (fp && fp->down && fp->down->fun && fp->down->argv)
             *vp = fp->down->argv[-2];
         else
             *vp = JSVAL_NULL;