As above rdar://7214113
Created attachment 39829 [details] Patch v1
Comment on attachment 39829 [details] Patch v1 r=me
Committed r48568
Doesn't seem to work reliably. The following causes a crash: function valueGet() { }; var MagicValueProps = { foo: Object.create(null, { value: { get: valueGet }})}; Object.create(null, MagicValueProps)
This should not have been reopened -- a new bug should have been filed.