From b78f29c528554677e67b6f75efca1a8caa1e693d Mon Sep 17 00:00:00 2001
From: Brendan Eich <brendan@mozilla.org>
Date: Fri, 5 Jun 2009 12:24:20 -0700
Subject: [PATCH] Last gasp for 496605 (r=igor).

---
 js/src/jsfun.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 0de2649f2bea..cc1285f0a88e 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1351,7 +1351,7 @@ fun_getProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
              * it seems foo.caller is still used on the Web.
              */
             if (FUN_ESCAPE_HAZARD(caller)) {
-                JSObject *wrapper = WrapEscapingClosure(cx, fp, FUN_OBJECT(caller), caller);
+                JSObject *wrapper = WrapEscapingClosure(cx, fp->down, FUN_OBJECT(caller), caller);
                 if (!wrapper)
                     return JS_FALSE;
                 *vp = OBJECT_TO_JSVAL(wrapper);