1 files changed, 7 insertions, 4 deletions
diff --git a/Source/JavaScriptCore/heap/CopiedSpace.cpp b/Source/JavaScriptCore/heap/CopiedSpace.cpp
index 063ea65a2..d52c4e756 100644
--- a/Source/JavaScriptCore/heap/CopiedSpace.cpp
+++ b/Source/JavaScriptCore/heap/CopiedSpace.cpp
@@ -183,6 +183,9 @@ void CopiedSpace::doneCopying()
         CopiedBlock* block = static_cast<CopiedBlock*>(m_fromSpace->removeHead());
         if (block->m_isPinned) {
             block->m_isPinned = false;
+            // We don't add the block to the toSpaceSet because it was never removed.
+            ASSERT(m_toSpaceSet.contains(block));
+            m_toSpaceFilter.add(reinterpret_cast<Bits>(block));
             m_toSpace->push(block);
             continue;
         }
@@ -212,10 +215,10 @@ void CopiedSpace::doneCopying()
 CheckedBoolean CopiedSpace::getFreshBlock(AllocationEffort allocationEffort, CopiedBlock** outBlock)
 {
     CopiedBlock* block = 0;
-    if (HeapBlock* heapBlock = m_heap->blockAllocator().allocate())
-        block = new (NotNull, heapBlock) CopiedBlock(heapBlock->m_allocation);
-    else if (allocationEffort == AllocationMustSucceed) {
-        if (!allocateNewBlock(&block)) {
+    if (allocationEffort == AllocationMustSucceed) {
+        if (HeapBlock* heapBlock = m_heap->blockAllocator().allocate())
+            block = new (NotNull, heapBlock) CopiedBlock(heapBlock->m_allocation);
+        else if (!allocateNewBlock(&block)) {
             *outBlock = 0;
             ASSERT_NOT_REACHED();
             return false;