diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp index acb408c419..2642ed06c0 100644 --- a/js/src/jit/CodeGenerator.cpp +++ b/js/src/jit/CodeGenerator.cpp @@ -9472,6 +9472,11 @@ CodeGenerator::linkSharedStubs(JSContext* cx) bool CodeGenerator::link(JSContext* cx, CompilerConstraintList* constraints) { + // We cancel off-thread Ion compilations in a few places during GC, but if + // this compilation was performed off-thread it will already have been + // removed from the relevant lists by this point. Don't allow GC here. + JS::AutoAssertNoGC nogc(cx); + RootedScript script(cx, gen->info().script()); OptimizationLevel optimizationLevel = gen->optimizationInfo().level(); @@ -9546,7 +9551,7 @@ CodeGenerator::link(JSContext* cx, CompilerConstraintList* constraints) // read barriers which were skipped while compiling the script off thread. Linker linker(masm); AutoFlushICache afc("IonLink"); - JitCode* code = linker.newCode(cx, ION_CODE, !patchableBackedges_.empty()); + JitCode* code = linker.newCode(cx, ION_CODE, !patchableBackedges_.empty()); if (!code) return false;