From 6292bee1ed3b1dcce520f97a3c51a0f736737501 Mon Sep 17 00:00:00 2001
From: win7-7 <win7-7@users.noreply.github.com>
Date: Sun, 11 Jan 2026 03:50:40 +0200
Subject: [PATCH] 903519 - Remove verifier assumption that only objects are in
 the nursery

903519 - Remove verifier assumption that only objects are in the nursery. This is only relevant after 55 verifier.
---
 js/src/gc/Verifier.cpp | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/js/src/gc/Verifier.cpp b/js/src/gc/Verifier.cpp
index ea2b290c2d..41839bf47e 100644
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -532,8 +532,15 @@ CheckHeapTracer::onChild(const JS::GCCellPtr& thing)
         return;
 
     // Don't trace into GC in zones being used by helper threads.
-    Zone* zone = thing.is<JSObject>() ? thing.as<JSObject>().zone() : cell->asTenured().zone();
-    if (zone->group() && zone->group()->usedByHelperThread())
+    Zone* zone;
+    if (thing.is<JSObject>())
+        zone = thing.as<JSObject>().zone();
+    else if (thing.is<JSString>())
+        zone = thing.as<JSString>().zone();
+    else
+        zone = cell->asTenured().zone();
+
+    if (zone->group() && zone->group()->usedByHelperThread)
         return;
     }