From 4105e6bba47788f49cee4ff6d8fc3b915429658b Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Fri, 22 Mar 2019 13:17:31 +0100
Subject: [PATCH] Reset nursery position when it's disabled.

---
 js/src/gc/Nursery.cpp | 1 +
 js/src/gc/Nursery.h   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp
index ea4350fb86..93a0eb6a8b 100644
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -210,6 +210,7 @@ js::Nursery::disable()
         return;
     updateNumChunks(0);
     currentEnd_ = 0;
+    position_ = 0;
     runtime()->gc.storeBuffer.disable();
 }
 
diff --git a/js/src/gc/Nursery.h b/js/src/gc/Nursery.h
index 0d215d9975..a839a49790 100644
--- a/js/src/gc/Nursery.h
+++ b/js/src/gc/Nursery.h
@@ -245,6 +245,7 @@ class Nursery
 
     // Free space remaining, not counting chunk trailers.
     MOZ_ALWAYS_INLINE size_t freeSpace() const {
+        MOZ_ASSERT(isEnabled());
         MOZ_ASSERT(currentEnd_ - position_ <= NurseryChunkUsableSize);
         return (currentEnd_ - position_) +
                (numChunks() - currentChunk_ - 1) * NurseryChunkUsableSize;