Don't crash when creating backtrace for built-in JS function

When the JIT is enabled, NativeFunctionWrapper (used for
built-in functions such as Array.prototype.forEach) inherits
JSFunction, so we must check whether the function is
actually a JS (script) function before we start accessing
script-specific properties.

Task-number: QTBUG-17137
Reviewed-by: Olivier Goffart

1 files changed, 15 insertions, 0 deletions

diff --git a/tests/auto/qscriptcontext/tst_qscriptcontext.cpp b/tests/auto/qscriptcontext/tst_qscriptcontext.cpp
index 1a1576b..dd21555 100644
--- a/tests/auto/qscriptcontext/tst_qscriptcontext.cpp
+++ b/tests/auto/qscriptcontext/tst_qscriptcontext.cpp
@@ -860,6 +860,21 @@ void tst_QScriptContext::backtrace_data()
 
         QTest::newRow("js recursive") << source << expected;
     }
+
+    {
+        QString source = QString::fromLatin1(
+            "[0].forEach(\n"
+            "    function() {\n"
+            "        result = bt();\n"
+            "}); result");
+
+        QStringList expected;
+        expected << "<native>() at -1"
+                 << "<anonymous>(0, 0, 0) at testfile:3"
+                 << "forEach(0) at -1"
+                 << "<global>() at testfile:4";
+        QTest::newRow("js callback from built-in") << source << expected;
+    }
 }