From 343d69962715b494a538324694ee624d81439849 Mon Sep 17 00:00:00 2001
From: Andreas Kling <kling@serenityos.org>
Date: Wed, 13 Apr 2022 21:01:29 +0200
Subject: [PATCH] LibJS: Add missing Vector::in_reverse() in
 ensure_property_table()

Regressed with 35fcb028e950c804f8f0e5295b369ee1bc541ae3.
---
 Userland/Libraries/LibJS/Runtime/Shape.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Userland/Libraries/LibJS/Runtime/Shape.cpp b/Userland/Libraries/LibJS/Runtime/Shape.cpp
index 291f1031cf..d4090418c9 100644
--- a/Userland/Libraries/LibJS/Runtime/Shape.cpp
+++ b/Userland/Libraries/LibJS/Runtime/Shape.cpp
@@ -173,7 +173,7 @@ void Shape::ensure_property_table() const
     }
     transition_chain.append(*this);
 
-    for (auto const& shape : transition_chain) {
+    for (auto const& shape : transition_chain.in_reverse()) {
         if (!shape.m_property_key.is_valid()) {
             // Ignore prototype transitions as they don't affect the key map.
             continue;