Bug 963077 - Bustage followup on a CLOSED TREE. r=jandem

js/src/jsfun.cpp

@@ -1055,10 +1055,13 @@ js_fun_apply(JSContext *cx, unsigned argc, Value *vp)
         args.setCallee(fval);
         args.setThis(vp[2]);
 
+        // Make sure the function is delazified before querying its arguments.
+        if (args.callee().is<JSFunction>()) {
+            JSFunction *fun = &args.callee().as<JSFunction>();
+            if (fun->isInterpreted() && !fun->getOrCreateScript(cx))
+                return false;
+        }
         /* Steps 7-8. */
-        JSFunction *fun = &args.callee().as<JSFunction>();
-        if (fun->isInterpreted() && !fun->getOrCreateScript(cx))
-            return false;
         if (!GetElements(cx, aobj, length, args.array()))
             return false;
     }