--- a/js/src/vm/String.cpp
+++ b/js/src/vm/String.cpp
@@ -698,16 +698,24 @@ template <typename CharT>
 JSFlatString*
 JSDependentString::undependInternal(JSContext* cx)
 {
     size_t n = length();
     CharT* s = cx->pod_malloc<CharT>(n + 1);
     if (!s)
         return nullptr;
 
+    if (!isTenured()) {
+        if (!cx->runtime()->gc.nursery().registerMallocedBuffer(s)) {
+            js_free(s);
+            ReportOutOfMemory(cx);
+            return nullptr;
+        }
+    }
+
     AutoCheckCannotGC nogc;
     PodCopy(s, nonInlineChars<CharT>(nogc), n);
     s[n] = '\0';
     setNonInlineChars<CharT>(s);
 
     /*
      * Transform *this into an undepended string so 'base' will remain rooted
      * for the benefit of any other dependent string that depends on *this.
@@ -1100,16 +1108,24 @@ JSExternalString::ensureFlat(JSContext* 
 {
     MOZ_ASSERT(hasTwoByteChars());
 
     size_t n = length();
     char16_t* s = cx->pod_malloc<char16_t>(n + 1);
     if (!s)
         return nullptr;
 
+    if (!isTenured()) {
+        if (!cx->runtime()->gc.nursery().registerMallocedBuffer(s)) {
+            js_free(s);
+            ReportOutOfMemory(cx);
+            return nullptr;
+        }
+    }
+
     // Copy the chars before finalizing the string.
     {
         AutoCheckCannotGC nogc;
         PodCopy(s, nonInlineChars<char16_t>(nogc), n);
         s[n] = '\0';
     }
 
     // Release the external chars.