From 2f815b1d5b961b02ac155d07a816d93785b5bddd Mon Sep 17 00:00:00 2001
From: win7-7 <win7-7@users.noreply.github.com>
Date: Fri, 16 Jan 2026 00:03:21 +0200
Subject: [PATCH] 903519 - Strings in the nursery: barriers

Cell.h was missed after headers split to nursery support. Third crash.
---
 js/src/gc/Cell.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/js/src/gc/Cell.h b/js/src/gc/Cell.h
index b9243e0898..fde676f5d3 100644
--- a/js/src/gc/Cell.h
+++ b/js/src/gc/Cell.h
@@ -246,7 +246,11 @@ Cell::storeBuffer() const
 inline JS::TraceKind
 Cell::getTraceKind() const
 {
-    return isTenured() ? asTenured().getTraceKind() : JS::TraceKind::Object;
+    if (isTenured())
+        return asTenured().getTraceKind();
+    if (js::shadow::String::nurseryCellIsString(this))
+        return JS::TraceKind::String;
+    return JS::TraceKind::Object;
 }
 
 /* static */ MOZ_ALWAYS_INLINE bool