gistfile1.diff

diff --git a/src/qt/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSONObject.cpp b/src/qt/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSONObject.cpp
index 27a508a..daeb4e9 100644
--- a/src/qt/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/src/qt/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -370,6 +370,7 @@ inline JSValue Stringifier::toJSON(JSValue value, const PropertyNameForFunctionC
 
 Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder& builder, JSValue value, JSObject* holder, const PropertyNameForFunctionCall& propertyNa
 {
+    JSValue oldValue = value;
     // Call the toJSON function.
     value = toJSON(value, propertyName);
     if (m_exec->hadException())
@@ -433,7 +434,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
 
     // Handle cycle detection, and put the holder on the stack.
     for (unsigned i = 0; i < m_holderStack.size(); i++) {
-        if (m_holderStack[i].object() == object) {
+        if (m_holderStack[i].object() == object || (oldValue.isObject() && m_holderStack[i].object() == asObject(oldValue))) {
             throwError(m_exec, createTypeError(m_exec, "JSON.stringify cannot serialize cyclic structures."));
             return StringifyFailed;
         }