Bug 723791 - fun_getProperty needs a method barrier (r=jorendorff)

--HG--
extra : rebase_source : 3fea7a8d9f965e921bb2744b8588f241e2e7c843

js/src/jsfun.cpp

@@ -1095,15 +1095,18 @@ fun_getProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 
     /* Find fun's top-most activation record. */
     StackFrame *fp = js_GetTopStackFrame(cx, FRAME_EXPAND_NONE);
+    for (; fp; fp = fp->prev()) {
+        if (!fp->isFunctionFrame() || fp->isEvalFrame())
+            continue;
+        Value callee;
+        if (!fp->getValidCalleeObject(cx, &callee))
+            return false;
+        if (&callee.toObject() == fun)
+            break;
+    }
     if (!fp)
         return true;
 
-    while (!fp->isFunctionFrame() || &fp->callee() != fun || fp->isEvalFrame()) {
-        fp = fp->prev();
-        if (!fp)
-            return true;
-    }
-
 #ifdef JS_METHODJIT
     if (JSID_IS_ATOM(id, cx->runtime->atomState.callerAtom) && fp && fp->prev()) {
         /*