diff --git a/implementation-contributed/curation_logs/javascriptcore.json b/implementation-contributed/curation_logs/javascriptcore.json
index 8bf7f05d11355fcfe69878305b412c620a1dcafb..8c13dab7168bf1469fdfc5c13d2227d53e3b3a12 100644
--- a/implementation-contributed/curation_logs/javascriptcore.json
+++ b/implementation-contributed/curation_logs/javascriptcore.json
@@ -1,6 +1,6 @@
 {
-  "sourceRevisionAtLastExport": "3ced8564a6",
-  "targetRevisionAtLastExport": "f8c62a49f",
+  "sourceRevisionAtLastExport": "a2f7b0c562",
+  "targetRevisionAtLastExport": "5594c916b",
   "curatedFiles": {
     "/stress/Number-isNaN-basics.js": "DELETED_IN_TARGET",
     "/stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js": "DELETED_IN_TARGET",
diff --git a/implementation-contributed/javascriptcore/stress/regress-189124.js b/implementation-contributed/javascriptcore/stress/regress-189124.js
new file mode 100644
index 0000000000000000000000000000000000000000..cd5532fde41a4973f56853b7fbfdf44f5344ec29
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/regress-189124.js
@@ -0,0 +1,31 @@
+//@ runDefault("--jitPolicyScale=0")
+
+function makeTmp() {
+    let tmp = {a: 1};
+    gc();
+    tmp.__proto__ = {};
+    return tmp;
+}
+
+function foo(tmp, obj) {
+    for (let k in tmp) {
+        tmp.__proto__ = {};
+        gc();
+        obj.__proto__ = {};
+
+        var result = obj[k];
+        return result;
+    }
+}
+
+foo(makeTmp(), {});
+
+let memory = new Uint32Array(100);
+memory[0] = 0x1234;
+
+let fooResult = foo(makeTmp(), memory);
+var result = $vm.value(fooResult);
+
+if (result != "Undefined")
+    throw "FAIL";
+