diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index ec87f8fa85ed..4f652bbe4b1c 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -7682,7 +7682,10 @@ class MStringReplace
     bool writeRecoverData(CompactBufferWriter& writer) const override;
     bool canRecoverOnBailout() const override {
         if (isFlatReplacement_)
-            return false;
+        {
+            MOZ_ASSERT(!pattern()->isRegExp());
+            return true;
+        }
         if (pattern()->isRegExp())
             return !pattern()->toRegExp()->source()->global();
         return false;
diff --git a/js/src/jit/Recover.cpp b/js/src/jit/Recover.cpp
index b5c6bcd42d4f..a22a9a81eeed 100644
--- a/js/src/jit/Recover.cpp
+++ b/js/src/jit/Recover.cpp
@@ -1514,11 +1514,14 @@ MStringReplace::writeRecoverData(CompactBufferWriter& writer) const
 {
     MOZ_ASSERT(canRecoverOnBailout());
     writer.writeUnsigned(uint32_t(RInstruction::Recover_StringReplace));
+    writer.writeByte(isFlatReplacement_);
     return true;
 }
 
 RStringReplace::RStringReplace(CompactBufferReader& reader)
-{ }
+{
+    isFlatReplacement_ = reader.readByte();
+}
 
 bool RStringReplace::recover(JSContext* cx, SnapshotIterator& iter) const
 {
@@ -1526,7 +1529,9 @@ bool RStringReplace::recover(JSContext* cx, SnapshotIterator& iter) const
     RootedString pattern(cx, iter.read().toString());
     RootedString replace(cx, iter.read().toString());
 
-    JSString* result = js::str_replace_string_raw(cx, string, pattern, replace);
+    JSString* result = isFlatReplacement_ ? js::str_flat_replace_string(cx, string, pattern, replace) :
+                                            js::str_replace_string_raw(cx, string, pattern, replace);
+
     if (!result)
         return false;
 
diff --git a/js/src/jit/Recover.h b/js/src/jit/Recover.h
index 4d2d8792676d..912d740781b1 100644
--- a/js/src/jit/Recover.h
+++ b/js/src/jit/Recover.h
@@ -596,6 +596,9 @@ class RRegExpReplace final : public RInstruction
 
 class RStringReplace final : public RInstruction
 {
+  private:
+    bool isFlatReplacement_;
+
   public:
     RINSTRUCTION_HEADER_(StringReplace)