diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 77464eb2cce2f..d8601f54d2942 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -1281,6 +1281,10 @@ ALWAYS_INLINE bool JSObject::getPropertySlot(JSGlobalObject* globalObject, Prope
         }
         // FIXME: This doesn't look like it's following the specification:
         // https://bugs.webkit.org/show_bug.cgi?id=172572
+        // Reload the structure: reifying a static lazy property above can transition
+        // the object and still miss (its PropertyCallback builder threw), like the
+        // megamorphic slow paths in JITOperations.cpp do.
+        structure = object->structureID().decode();
         JSValue prototype = structure->storedPrototype(object);
         if (!prototype.isObject())
             break;