diff --git a/js/src/jsscope.cpp b/js/src/jsscope.cpp
index 5d5f06c1ef53..66559a042f91 100644
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -1138,6 +1138,7 @@ JSScope::newDictionaryProperty(JSContext *cx, const JSScopeProperty &child,
 
     dprop->childp = NULL;
     insertDictionaryProperty(dprop, childp);
+    updateFlags(dprop);
     return dprop;
 }
 
diff --git a/js/src/jsscope.h b/js/src/jsscope.h
index bdbce9a45348..2bfd4eb7b9cd 100644
--- a/js/src/jsscope.h
+++ b/js/src/jsscope.h
@@ -257,6 +257,7 @@ struct JSScope : public JSObjectMap
 
     /* Defined in jsscopeinlines.h to avoid including implementation dependencies here. */
     inline void updateShape(JSContext *cx);
+    inline void updateFlags(const JSScopeProperty *sprop);
 
     void initMinimal(JSContext *cx, uint32 newShape);
     bool createTable(JSContext *cx, bool report);
diff --git a/js/src/jsscopeinlines.h b/js/src/jsscopeinlines.h
index b572d332b038..aae853894216 100644
--- a/js/src/jsscopeinlines.h
+++ b/js/src/jsscopeinlines.h
@@ -56,12 +56,8 @@ JSScope::updateShape(JSContext *cx)
 }
 
 inline void
-JSScope::extend(JSContext *cx, JSScopeProperty *sprop)
+JSScope::updateFlags(const JSScopeProperty *sprop)
 {
-    ++entryCount;
-    setLastProperty(sprop);
-    updateShape(cx);
-
     jsuint index;
     if (js_IdIsIndex(sprop->id, &index))
         setIndexedProperties();
@@ -70,6 +66,15 @@ JSScope::extend(JSContext *cx, JSScopeProperty *sprop)
         setMethodBarrier();
 }
 
+inline void
+JSScope::extend(JSContext *cx, JSScopeProperty *sprop)
+{
+    ++entryCount;
+    setLastProperty(sprop);
+    updateShape(cx);
+    updateFlags(sprop);
+}
+
 /*
  * Property read barrier for deferred cloning of compiler-created function
  * objects optimized as typically non-escaping, ad-hoc methods in obj.