diff --git a/mozilla/js/src/jsapi.c b/mozilla/js/src/jsapi.c
index 4f59f5fa44c..57cd41e032d 100644
--- a/mozilla/js/src/jsapi.c
+++ b/mozilla/js/src/jsapi.c
@@ -242,10 +242,18 @@ JS_ConvertArgumentsVA(JSContext *cx, uintN argc, jsval *argv,
             *va_arg(ap, JSObject **) = obj;
             break;
           case 'f':
-            fun = js_ValueToFunction(cx, sp, 0);
-            if (!fun)
-                return JS_FALSE;
-            *sp = OBJECT_TO_JSVAL(fun->object);
+            /*
+             * Don't convert a cloned function object to its shared private
+             * data, then follow fun->object back to the clone-parent.
+             */
+            if (JSVAL_IS_FUNCTION(cx, *sp)) {
+                fun = (JSFunction *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(*sp));
+            } else {
+                fun = js_ValueToFunction(cx, sp, 0);
+                if (!fun)
+                    return JS_FALSE;
+                *sp = OBJECT_TO_JSVAL(fun->object);
+            }
             *va_arg(ap, JSFunction **) = fun;
             break;
           case 'v':
@@ -464,10 +472,19 @@ JS_ConvertValue(JSContext *cx, jsval v, JSType type, jsval *vp)
             *vp = OBJECT_TO_JSVAL(obj);
         break;
       case JSTYPE_FUNCTION:
-        fun = js_ValueToFunction(cx, &v, JSV2F_SEARCH_STACK);
-        ok = (fun != NULL);
-        if (ok)
-            *vp = OBJECT_TO_JSVAL(fun->object);
+        /*
+         * Don't convert a cloned function object to its shared private data,
+         * then follow fun->object back to the clone-parent.
+         */
+        if (JSVAL_IS_FUNCTION(cx, v)) {
+            ok = JS_TRUE;
+            *vp = v;
+        } else {
+            fun = js_ValueToFunction(cx, &v, JSV2F_SEARCH_STACK);
+            ok = (fun != NULL);
+            if (ok)
+                *vp = OBJECT_TO_JSVAL(fun->object);
+        }
         break;
       case JSTYPE_STRING:
         str = js_ValueToString(cx, v);
diff --git a/mozilla/js/src/jsobj.c b/mozilla/js/src/jsobj.c
index e66599c8fd5..f0a1fb85a3a 100644
--- a/mozilla/js/src/jsobj.c
+++ b/mozilla/js/src/jsobj.c
@@ -1223,15 +1223,21 @@ obj_watch_handler(JSContext *cx, JSObject *obj, jsval id, jsval old, jsval *nvp,
 static JSBool
 obj_watch(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
 {
+    JSObject *funobj;
     JSFunction *fun;
     jsval userid, value;
     jsid propid;
     uintN attrs;
 
-    fun = js_ValueToFunction(cx, &argv[1], 0);
-    if (!fun)
-        return JS_FALSE;
-    argv[1] = OBJECT_TO_JSVAL(fun->object);
+    if (JSVAL_IS_FUNCTION(cx, argv[1])) {
+        funobj = JSVAL_TO_OBJECT(argv[1]);
+    } else {
+        fun = js_ValueToFunction(cx, &argv[1], 0);
+        if (!fun)
+            return JS_FALSE;
+        funobj = fun->object;
+    }
+    argv[1] = OBJECT_TO_JSVAL(funobj);
 
     /* Compute the unique int/atom symbol id needed by js_LookupProperty. */
     userid = argv[0];
@@ -1242,7 +1248,7 @@ obj_watch(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
         return JS_FALSE;
     if (attrs & JSPROP_READONLY)
         return JS_TRUE;
-    return JS_SetWatchPoint(cx, obj, userid, obj_watch_handler, fun->object);
+    return JS_SetWatchPoint(cx, obj, userid, obj_watch_handler, funobj);
 }
 
 static JSBool