diff --git a/js/public/HashTable.h b/js/public/HashTable.h
index 9f51cdafa2b..c6cb3e09837 100644
--- a/js/public/HashTable.h
+++ b/js/public/HashTable.h
@@ -815,8 +815,10 @@ class HashTable : private AllocPolicy
 
         // Potentially rehashes the table.
         ~Enum() {
-            if (rekeyed)
+            if (rekeyed) {
+                table.gen++;
                 table.checkOverRemoved();
+            }
 
             if (removed)
                 table.compactIfUnderloaded();
@@ -1189,9 +1191,8 @@ class HashTable : private AllocPolicy
     void checkOverRemoved()
     {
         if (overloaded()) {
-            METER(stats.rehashes++);
-            rehashTable();
-            JS_ASSERT(!overloaded());
+            if (checkOverloaded() == RehashFailed)
+                rehashTableInPlace();
         }
     }
 
@@ -1241,8 +1242,9 @@ class HashTable : private AllocPolicy
     // the element is already inserted or still waiting to be inserted.  Since
     // already-inserted elements win any conflicts, we get the same table as we
     // would have gotten through random insertion order.
-    void rehashTable()
+    void rehashTableInPlace()
     {
+        METER(stats.rehashes++);
         removedCount = 0;
         for (size_t i = 0; i < capacity(); ++i)
             table[i].unsetCollision();