Backout 67f60ef5c92f (bug 818023) for causing bug 829512

js/src/jit-test/tests/ion/bug818023.js

@@ -1,53 +0,0 @@
-Function.prototype.callX = Function.prototype.call;
-var x;
-function f() {
-    x = f.caller;
-    return x;
-}
-
-function g() {
-    return f.callX(null);
-}
-
-function h1() {
-    // native
-    return ([0].map(f))[0];
-}
-
-function h2() {
-    // self-hosted
-    x = null;
-    [0].forEach(f);
-    return x;
-}
-
-function k() {
-    x = null;
-    [0, 1].sort(f);
-    return x;
-}
-
-function l() {
-    return f();
-}
-
-assertEq(g(), g);
-assertEq(h1(), h1);
-assertEq(h2(), h2);
-assertEq(k(), k);
-assertEq(l(), l);
-
-var baz;
-var foo = {callX: function() { return "m"; }};
-function bar() {
-    return baz.caller;
-}
-function m() {
-    return baz.callX(null);
-}
-
-baz = foo;
-assertEq(m(), "m");
-baz = bar;
-assertEq(m(), m);
-assertEq(m(), m);

js/src/jsfun.cpp

@@ -99,7 +99,7 @@ fun_getProperty(JSContext *cx, HandleObject obj_, HandleId id, MutableHandleValu
     vp.setNull();
 
     /* Find fun's top-most activation record. */
-    NonBuiltinScriptFrameIter iter(cx);
+    StackIter iter(cx);
     for (; !iter.done(); ++iter) {
         if (!iter.isFunctionFrame() || iter.isEvalFrame())
             continue;