From d830c107cef94dce55ed41380114ac799d0c5eb2 Mon Sep 17 00:00:00 2001
From: Andreas Kling <kling@serenityos.org>
Date: Wed, 9 Sep 2020 21:34:02 +0200
Subject: [PATCH] LibJS: Deal with a FIXME in Shape::ensure_property_table()

Prevent GC while messing with the shape transition chain.
---
 Libraries/LibJS/Runtime/Shape.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Libraries/LibJS/Runtime/Shape.cpp b/Libraries/LibJS/Runtime/Shape.cpp
index 9d5e79eeaa..ecfb4b1145 100644
--- a/Libraries/LibJS/Runtime/Shape.cpp
+++ b/Libraries/LibJS/Runtime/Shape.cpp
@@ -24,6 +24,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include <LibJS/Heap/DeferGC.h>
 #include <LibJS/Interpreter.h>
 #include <LibJS/Runtime/GlobalObject.h>
 #include <LibJS/Runtime/Shape.h>
@@ -145,8 +146,7 @@ void Shape::ensure_property_table() const
         return;
     m_property_table = make<HashMap<StringOrSymbol, PropertyMetadata>>();
 
-    // FIXME: We need to make sure the GC doesn't collect the transition chain as we're building it.
-    //        Maybe some kind of RAII "prevent GC for a moment" helper thingy?
+    DeferGC defer(heap());
 
     Vector<const Shape*> transition_chain;
     for (auto* shape = this; shape->m_previous; shape = shape->m_previous) {