1 files changed, 4 insertions, 6 deletions
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/CollectorHeapIterator.h b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/CollectorHeapIterator.h
index e4f2f91..4a38df9 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/CollectorHeapIterator.h
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/CollectorHeapIterator.h
@@ -97,14 +97,12 @@ namespace JSC {
 
     inline LiveObjectIterator& LiveObjectIterator::operator++()
     {
-        if (m_block < m_heap.nextBlock || m_cell < m_heap.nextCell) {
-            advance(HeapConstants::cellsPerBlock);
+        advance(HeapConstants::cellsPerBlock - 1);
+        if (m_block < m_heap.nextBlock || (m_block == m_heap.nextBlock && m_cell < m_heap.nextCell))
             return *this;
-        }
 
-        do {
-            advance(HeapConstants::cellsPerBlock);
-        } while (m_block < m_heap.usedBlocks && !m_heap.blocks[m_block]->marked.get(m_cell));
+        while (m_block < m_heap.usedBlocks && !m_heap.blocks[m_block]->marked.get(m_cell))
+            advance(HeapConstants::cellsPerBlock - 1);
         return *this;
     }