This is reported at bug 591836 comment 18 (thanks, Travis). Must fix ASAP. /be
Created attachment 474958 [details] [diff] [review] proposed fix Hope this is clear enough -- I fixed a fencepost bug enforcing max property tree height along the way. Shape::getChild is the future, JSObject::getChildProperty should go away with the patch for bug 593129. /be
Comment on attachment 474958 [details] [diff] [review] proposed fix Looks good.