Bug 818023 - fun_getProperty: Use non-buitin script iterator. r=waldo

js/src/jit-test/tests/ion/bug818023.js

@@ -0,0 +1,53 @@
+Function.prototype.callX = Function.prototype.call;
+var x;
+function f() {
+    x = f.caller;
+    return x;
+}
+
+function g() {
+    return f.callX(null);
+}
+
+function h1() {
+    // native
+    return ([0].map(f))[0];
+}
+
+function h2() {
+    // self-hosted
+    x = null;
+    [0].forEach(f);
+    return x;
+}
+
+function k() {
+    x = null;
+    [0, 1].sort(f);
+    return x;
+}
+
+function l() {
+    return f();
+}
+
+assertEq(g(), g);
+assertEq(h1(), h1);
+assertEq(h2(), h2);
+assertEq(k(), k);
+assertEq(l(), l);
+
+var baz;
+var foo = {callX: function() { return "m"; }};
+function bar() {
+    return baz.caller;
+}
+function m() {
+    return baz.callX(null);
+}
+
+baz = foo;
+assertEq(m(), "m");
+baz = bar;
+assertEq(m(), m);
+assertEq(m(), m);

js/src/jsfun.cpp

@@ -99,7 +99,7 @@ fun_getProperty(JSContext *cx, HandleObject obj_, HandleId id, MutableHandleValu
     vp.setNull();
 
     /* Find fun's top-most activation record. */
-    StackIter iter(cx);
+    NonBuiltinScriptFrameIter iter(cx);
     for (; !iter.done(); ++iter) {
         if (!iter.isFunctionFrame() || iter.isEvalFrame())
             continue;