diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 0de2649f2bea..cc1285f0a88e 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1351,7 +1351,7 @@ fun_getProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
              * it seems foo.caller is still used on the Web.
              */
             if (FUN_ESCAPE_HAZARD(caller)) {
-                JSObject *wrapper = WrapEscapingClosure(cx, fp, FUN_OBJECT(caller), caller);
+                JSObject *wrapper = WrapEscapingClosure(cx, fp->down, FUN_OBJECT(caller), caller);
                 if (!wrapper)
                     return JS_FALSE;
                 *vp = OBJECT_TO_JSVAL(wrapper);