From 51d5c3cda81ecb1ac8e08c72c7cb37b7941ba6f4 Mon Sep 17 00:00:00 2001 From: win7-7 Date: Fri, 16 Jan 2026 09:38:08 +0200 Subject: [PATCH] Where did this come from? Where did this come from? It fixes two crashing assertions. Still another crash further down. --- js/src/jit/CodeGenerator.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp index cbd5ec173e..6e8ed318f2 100644 --- a/js/src/jit/CodeGenerator.cpp +++ b/js/src/jit/CodeGenerator.cpp @@ -1572,6 +1572,11 @@ CreateDependentString::generate(MacroAssembler& masm, const JSAtomState& names, masm.storePtr(temp1, Address(string, JSDependentString::offsetOfBase())); masm.bind(&noBase); } + + // Post-barrier the base store, whether it was the direct or indirect + // base (both will end up in temp1 here). + masm.branchPtrInNurseryChunk(Assembler::Equal, string, temp2, &done); + masm.branchPtrInNurseryChunk(Assembler::NotEqual, temp1, temp2, &done); masm.bind(&done); }