1 files changed, 13 insertions, 15 deletions

diff --git a/js/public/HeapAPI.h b/js/public/HeapAPI.h
index 3dfe00bd0d..26cca9e1c3 100644
--- a/js/public/HeapAPI.h
+++ b/js/public/HeapAPI.h
@@ -535,9 +535,11 @@ static MOZ_ALWAYS_INLINE TenuredChunkBase* GetCellChunkBase(
   return chunk;
 }
 
-static MOZ_ALWAYS_INLINE JS::Zone* GetTenuredGCThingZone(const uintptr_t addr) {
-  MOZ_ASSERT(addr);
-  const uintptr_t zone_addr = (addr & ~ArenaMask) | ArenaZoneOffset;
+static MOZ_ALWAYS_INLINE JS::Zone* GetTenuredGCThingZone(const void* ptr) {
+  // This takes a void* because the compiler can't see type relationships in
+  // this header. |ptr| must be a pointer to a tenured GC thing.
+  MOZ_ASSERT(ptr);
+  const uintptr_t zone_addr = (uintptr_t(ptr) & ~ArenaMask) | ArenaZoneOffset;
   return *reinterpret_cast<JS::Zone**>(zone_addr);
 }
 
@@ -631,7 +633,7 @@ MOZ_ALWAYS_INLINE bool IsCellPointerValid(const void* ptr) {
 
   auto* cell = reinterpret_cast<const Cell*>(ptr);
   if (!IsInsideNursery(cell)) {
-    return detail::GetTenuredGCThingZone(addr) != nullptr;
+    return detail::GetTenuredGCThingZone(cell) != nullptr;
   }
 
   return true;
@@ -649,16 +651,13 @@ MOZ_ALWAYS_INLINE bool IsCellPointerValidOrNull(const void* cell) {
 
 namespace JS {
 
-static MOZ_ALWAYS_INLINE Zone* GetTenuredGCThingZone(GCCellPtr thing) {
-  MOZ_ASSERT(!js::gc::IsInsideNursery(thing.asCell()));
-  return js::gc::detail::GetTenuredGCThingZone(thing.unsafeAsUIntPtr());
-}
+extern JS_PUBLIC_API Zone* GetTenuredGCThingZone(GCCellPtr thing);
 
 extern JS_PUBLIC_API Zone* GetNurseryCellZone(js::gc::Cell* cell);
 
 static MOZ_ALWAYS_INLINE Zone* GetGCThingZone(GCCellPtr thing) {
   if (!js::gc::IsInsideNursery(thing.asCell())) {
-    return js::gc::detail::GetTenuredGCThingZone(thing.unsafeAsUIntPtr());
+    return js::gc::detail::GetTenuredGCThingZone(thing.asCell());
   }
 
   return GetNurseryCellZone(thing.asCell());
@@ -666,9 +665,9 @@ static MOZ_ALWAYS_INLINE Zone* GetGCThingZone(GCCellPtr thing) {
 
 static MOZ_ALWAYS_INLINE Zone* GetStringZone(JSString* str) {
   if (!js::gc::IsInsideNursery(str)) {
-    return js::gc::detail::GetTenuredGCThingZone(
-        reinterpret_cast<uintptr_t>(str));
+    return js::gc::detail::GetTenuredGCThingZone(str);
   }
+
   return GetNurseryCellZone(reinterpret_cast<js::gc::Cell*>(str));
 }
 
@@ -767,7 +766,7 @@ static MOZ_ALWAYS_INLINE void ExposeGCThingToActiveJS(JS::GCCellPtr thing) {
   // GC things owned by other runtimes are always black.
   MOZ_ASSERT(!thing.mayBeOwnedByOtherRuntime());
 
-  auto* zone = JS::shadow::Zone::from(JS::GetTenuredGCThingZone(thing));
+  auto* zone = JS::shadow::Zone::from(detail::GetTenuredGCThingZone(cell));
   if (zone->needsIncrementalBarrier()) {
     PerformIncrementalReadBarrier(thing);
   } else if (!zone->isGCPreparing() && detail::NonBlackCellIsMarkedGray(cell)) {
@@ -785,8 +784,8 @@ static MOZ_ALWAYS_INLINE void IncrementalReadBarrier(JS::GCCellPtr thing) {
     return;
   }
 
-  auto* zone = JS::shadow::Zone::from(JS::GetTenuredGCThingZone(thing));
   auto* cell = reinterpret_cast<TenuredCell*>(thing.asCell());
+  auto* zone = JS::shadow::Zone::from(detail::GetTenuredGCThingZone(cell));
   if (zone->needsIncrementalBarrier() &&
       !detail::TenuredCellIsMarkedBlack(cell)) {
     // GC things owned by other runtimes are always black.
@@ -807,8 +806,7 @@ static MOZ_ALWAYS_INLINE bool EdgeNeedsSweepUnbarriered(JSObject** objp) {
     return false;
   }
 
-  auto zone =
-      JS::shadow::Zone::from(detail::GetTenuredGCThingZone(uintptr_t(*objp)));
+  auto zone = JS::shadow::Zone::from(detail::GetTenuredGCThingZone(*objp));
   if (!zone->isGCSweepingOrCompacting()) {
     return false;
   }