LibJS: Don't allocate property table during GC marking phase

Shape was allocating property tables inside visit_children(), which
could cause garbage collection to happen. It's not very good to start
a new garbage collection while you are in the middle of one already.

Libraries/LibJS/Runtime/Shape.cpp

@@ -104,9 +104,10 @@ void Shape::visit_children(Cell::Visitor& visitor)
     for (auto& it : m_forward_transitions)
         visitor.visit(it.value);
 
-    ensure_property_table();
-    for (auto& it : *m_property_table)
-        it.key.visit_children(visitor);
+    if (m_property_table) {
+        for (auto& it : *m_property_table)
+            it.key.visit_children(visitor);
+    }
 }
 
 Optional<PropertyMetadata> Shape::lookup(const StringOrSymbol& property_name) const