NativeError.js_captureStackTrace causes ClassCastException when 'Error' has been overridden

[tmallery]

java.lang.ClassCastException: org.mozilla.v17.javascript.NativeObject cannot be cast to org.mozilla.v17.javascript.Function

var oldError = Error;
Error = {};
oldError.captureStackTrace({});

The issue is because NativeError.js_captureStackTrace creates a new "Error" on line 303.
NativeError err = (NativeError)cx.newObject(thisObj, "Error");

It needs to create NativeError directly instead of assuming JS defined "Error" is the object it wants.

[p-bakker]

Not sure how relevant this still is: as of Rhino 1.7.14 all Error instances should automatically have their stack property initialized

Also: taggin this as an EcmaScript Incompatibility, because Error.captureStackTrace is not in the EcmaScript spec. This is a V8 feature, but as far as I can tell, this function availability is not controlled by the Context.FEATURE_V8_EXTENSIONS flag