1 files changed, 20 insertions, 0 deletions
diff --git a/js/src/vm/TypedArrayObject-inl.h b/js/src/vm/TypedArrayObject-inl.h
index 95ba7b23d4..ffb9a3c9f6 100644
--- a/js/src/vm/TypedArrayObject-inl.h
+++ b/js/src/vm/TypedArrayObject-inl.h
@@ -760,6 +760,26 @@ class ElementSpecific {
   }
 };
 
+inline gc::AllocKind js::FixedLengthTypedArrayObject::allocKindForTenure()
+    const {
+  // Fixed length typed arrays in the nursery may have a lazily allocated
+  // buffer. Make sure there is room for the array's fixed data when moving the
+  // array.
+
+  if (hasBuffer()) {
+    return NativeObject::allocKindForTenure();
+  }
+
+  gc::AllocKind allocKind;
+  if (hasInlineElements()) {
+    allocKind = AllocKindForLazyBuffer(byteLength());
+  } else {
+    allocKind = gc::GetGCObjectKind(getClass());
+  }
+
+  return gc::ForegroundToBackgroundAllocKind(allocKind);
+}
+
 /* static */ gc::AllocKind
 js::FixedLengthTypedArrayObject::AllocKindForLazyBuffer(size_t nbytes) {
   MOZ_ASSERT(nbytes <= INLINE_BUFFER_LIMIT);