1 files changed, 5 insertions, 1 deletions
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
index 3597a5c..5dfd919 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
@@ -306,8 +306,11 @@ void Structure::getEnumerablePropertyNames(ExecState* exec, PropertyNameArray& p
     }
 
     if (shouldCache) {
+        StructureChain* protoChain = prototypeChain(exec);
         m_cachedPropertyNameArrayData = propertyNames.data();
-        m_cachedPropertyNameArrayData->setCachedPrototypeChain(prototypeChain(exec));
+        if (!protoChain->isCacheable())
+            return;
+        m_cachedPropertyNameArrayData->setCachedPrototypeChain(protoChain);
         m_cachedPropertyNameArrayData->setCachedStructure(this);
     }
 }
@@ -407,6 +410,7 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
 
     if (structure->transitionCount() > s_maxTransitionLength) {
         RefPtr<Structure> transition = toDictionaryTransition(structure);
+        ASSERT(structure != transition);
         offset = transition->put(propertyName, attributes, specificValue);
         if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
             transition->growPropertyStorageCapacity();