--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -464,16 +464,18 @@ PrepareForDebuggerOnIonCompilationHook(J
         scripts->resize(info->scriptIndex);
         info->numBlocks = 0;
     }
 }
 
 void
 jit::FinishOffThreadBuilder(JSContext* cx, IonBuilder* builder)
 {
+    MOZ_ASSERT(HelperThreadState().isLocked());
+
     // Clean the references to the pending IonBuilder, if we just finished it.
     if (builder->script()->baselineScript()->hasPendingIonBuilder() &&
         builder->script()->baselineScript()->pendingIonBuilder() == builder)
     {
         builder->script()->baselineScript()->removePendingIonBuilder(builder->script());
     }
 
     // If the builder is still in one of the helper thread list, then remove it.
@@ -578,33 +580,33 @@ jit::LazyLink(JSContext* cx, HandleScrip
     MOZ_ASSERT(calleeScript->hasBaselineScript());
     IonBuilder* builder = calleeScript->baselineScript()->pendingIonBuilder();
     calleeScript->baselineScript()->removePendingIonBuilder(calleeScript);
 
     // See PrepareForDebuggerOnIonCompilationHook
     AutoScriptVector debugScripts(cx);
     OnIonCompilationInfo info(builder->alloc().lifoAlloc());
 
-    // Remove from pending.
-    builder->removeFrom(HelperThreadState().ionLazyLinkList());
-
     {
         AutoEnterAnalysis enterTypes(cx);
         if (!LinkBackgroundCodeGen(cx, builder, &debugScripts, &info)) {
             // Silently ignore OOM during code generation. The assembly code
             // doesn't has code to handle it after linking happened. So it's
             // not OK to throw a catchable exception from there.
             cx->clearPendingException();
         }
     }
 
     if (info.filled())
         Debugger::onIonCompilation(cx, debugScripts, info.graph);
 
-    FinishOffThreadBuilder(cx, builder);
+    {
+        AutoLockHelperThreadState lock;
+        FinishOffThreadBuilder(cx, builder);
+    }
 
     MOZ_ASSERT(calleeScript->hasBaselineScript());
     MOZ_ASSERT(calleeScript->baselineOrIonRawPointer());
 }
 
 uint8_t*
 jit::LazyLinkTopActivation(JSContext* cx)
 {