Fixed assertion botch, (fallout from bug 512029 desk r=jorendorff).

--HG--
extra : rebase_source : a934cbfbc1e641d2c49511d1041105d8bec4aa66

js/src/jstracer.cpp

@@ -5685,7 +5685,7 @@ LeaveTree(InterpState& state, VMSideExit* lr)
          */
         if (!cx->fp->script) {
             JSStackFrame *fp = cx->fp;
-            JS_ASSERT(FUN_SLOW_NATIVE(GET_FUNCTION_PRIVATE(cx, fp->callee())));
+            JS_ASSERT(FUN_SLOW_NATIVE(fp->fun));
             JS_ASSERT(fp->regs == NULL);
             JS_ASSERT(fp->down->regs != &((JSInlineFrame *) fp)->callerRegs);
             cx->fp = fp->down;