From 422e4198fe761012f39185ae7f9f8e798740e355 Mon Sep 17 00:00:00 2001
From: Brendan Eich <brendan@mozilla.org>
Date: Sat, 13 Dec 2008 17:30:04 -0800
Subject: [PATCH] Bug 469313 - TM: crash (GMail): JS_Assert (s=0x368d8f
 "!JS_ON_TRACE(cx)", file=0x3724c8
 "/Users/roc/mozilla-checkin/js/src/jsobj.cpp", ln=3765) (r=gal).

---
 js/src/jsinterp.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index ae5d75d6f94..62141b5ada7 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -231,7 +231,8 @@ js_FillPropertyCache(JSContext *cx, JSObject *obj, jsuword kshape,
 #endif
                         SCOPE_MAKE_UNIQUE_SHAPE(cx, scope);
                         SCOPE_SET_BRANDED(scope);
-                        kshape = scope->shape;
+                        if (OBJ_SCOPE(obj) == scope)
+                            kshape = scope->shape;
                     }
                     vword = JSVAL_OBJECT_TO_PCVAL(v);
                     break;