From cd1920af58ca0038f1ccbd438de52ef003b68ee5 Mon Sep 17 00:00:00 2001
From: Martok <martok@martoks-place.de>
Date: Sun, 6 Aug 2023 18:08:59 +0200
Subject: [PATCH 1/3] Issue #2172 - add missing RegExpShared TraceKind
 declaration

---
 js/src/gc/Tracer.cpp     | 4 ++++
 js/src/vm/RegExpObject.h | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/js/src/gc/Tracer.cpp b/js/src/gc/Tracer.cpp
index ea7f613e38..7be4543029 100644
--- a/js/src/gc/Tracer.cpp
+++ b/js/src/gc/Tracer.cpp
@@ -344,6 +344,10 @@ JS_GetTraceThingInfo(char* buf, size_t bufsize, JSTracer* trc, void* thing,
         name = "object_group";
         break;
 
+      case JS::TraceKind::RegExpShared:
+        name = "reg_exp_shared";
+        break;
+
       default:
         name = "INVALID";
         break;
diff --git a/js/src/vm/RegExpObject.h b/js/src/vm/RegExpObject.h
index 14ec8509ee..5247731112 100644
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -259,6 +259,9 @@ class RegExpShared : public gc::TenuredCell
     static bool dumpBytecode(JSContext* cx, MutableHandleRegExpShared res, bool match_only,
                              HandleLinearString input);
 #endif
+
+  public:
+    static const JS::TraceKind TraceKind = JS::TraceKind::RegExpShared;
 };
 
 class RegExpCompartment

From 8893997378acc744750bd558428b66f142148190 Mon Sep 17 00:00:00 2001
From: Martok <martok@martoks-place.de>
Date: Sun, 6 Aug 2023 20:51:59 +0200
Subject: [PATCH 2/3] Issue #2172 - ensure pointers in RegExpShared are updated
 after GC compacting

---
 js/src/jsgc.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 5c2835cca9..c849bacc8c 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2323,7 +2323,8 @@ static const AllocKinds UpdatePhaseMisc {
     AllocKind::ACCESSOR_SHAPE,
     AllocKind::OBJECT_GROUP,
     AllocKind::STRING,
-    AllocKind::JITCODE
+    AllocKind::JITCODE,
+    AllocKind::REGEXP_SHARED
 };
 
 static const AllocKinds UpdatePhaseObjects {

From dc5702a0f24c9bdcf4eded160a7327079dd6edcb Mon Sep 17 00:00:00 2001
From: Martok <martok@martoks-place.de>
Date: Wed, 9 Aug 2023 22:41:30 +0200
Subject: [PATCH 3/3] Issue #2172 - add null zone sanity checks

---
 js/src/gc/Marking.cpp | 3 ++-
 js/src/vm/Runtime.cpp | 3 +++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 13ec5b0c05..1376df5a4d 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -788,7 +788,8 @@ ShouldMark<JSObject*>(GCMarker* gcmarker, JSObject* obj)
     // Don't mark things outside a zone if we are in a per-zone GC. It is
     // faster to check our own arena, which we can do since we know that
     // the object is tenured.
-    return obj->asTenured().zone()->shouldMarkInZone();
+    Zone* zone = obj->asTenured().zone();
+    return (zone && zone->shouldMarkInZone());
 }
 
 template <typename T>
diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
index ceb7a498b0..053b7c44b0 100644
--- a/js/src/vm/Runtime.cpp
+++ b/js/src/vm/Runtime.cpp
@@ -877,6 +877,9 @@ js::CurrentThreadCanAccessRuntime(const JSRuntime* rt)
 bool
 js::CurrentThreadCanAccessZone(Zone* zone)
 {
+    if (!zone)
+        return false;
+
     if (CurrentThreadCanAccessRuntime(zone->runtime_))
         return true;