diff --git a/js/src/gc/WeakMap-inl.h b/js/src/gc/WeakMap-inl.h index fe3310af52e0..b1e52aacc8ba 100644 --- a/js/src/gc/WeakMap-inl.h +++ b/js/src/gc/WeakMap-inl.h @@ -402,7 +402,8 @@ void WeakMap::checkAfterMovingGC() const { gc::Cell* value = gc::ToMarkable(r.front().value()); CheckGCThingAfterMovingGC(key); if (!allowKeysInOtherZones()) { - MOZ_RELEASE_ASSERT(key->zone() == zone() || key->zone()->isAtomsZone()); + Zone* keyZone = key->zoneFromAnyThread(); + MOZ_RELEASE_ASSERT(keyZone == zone() || keyZone->isAtomsZone()); } CheckGCThingAfterMovingGC(value, zone()); auto ptr = lookupUnbarriered(r.front().key()); diff --git a/js/src/jit-test/tests/gc/bug-1894442.js b/js/src/jit-test/tests/gc/bug-1894442.js new file mode 100644 index 000000000000..93bedb74debb --- /dev/null +++ b/js/src/jit-test/tests/gc/bug-1894442.js @@ -0,0 +1,6 @@ +// |jit-test| --enable-symbols-as-weakmap-keys; skip-if: helperThreadCount() === 0 || getBuildConfiguration("release_or_beta") +evalInWorker(` + a = new WeakSet + a.add(Symbol.hasInstance) + gczeal(14)(0 .b) +`)