From 760aa68e90c3d32969a02895178d920ccf802255 Mon Sep 17 00:00:00 2001
From: Iain Ireland <iireland@mozilla.com>
Date: Tue, 26 May 2020 14:22:46 +0000
Subject: [PATCH] Bug 1640592: Don't allocate named capture groups template in
 the nursery r=tcampbell

The lifetime of the template is tied to the lifetime of the RegExpShared, and every RegExpShared is tenured, so there's no point allocating this in the nursery.

Depends on D76754

Differential Revision: https://phabricator.services.mozilla.com/D76755
---
 js/src/vm/RegExpObject.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
index 43eb796cf98b..a7e6b08eb34b 100644
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -1150,7 +1150,7 @@ bool RegExpShared::initializeNamedCaptures(JSContext* cx, HandleRegExpShared re,
 
   // Create a plain template object.
   RootedPlainObject templateObject(
-      cx, NewObjectWithGivenProto<PlainObject>(cx, nullptr));
+      cx, NewTenuredObjectWithGivenProto<PlainObject>(cx, nullptr));
   if (!templateObject) {
     return false;
   }