--- a/js/src/vm/String.cpp
+++ b/js/src/vm/String.cpp
@@ -480,44 +480,46 @@ js::ConcatStrings(ExclusiveContext *cx,
     if (!JSString::validateLength(cx, wholeLength))
         return nullptr;
 
     bool isLatin1 = left->hasLatin1Chars() && right->hasLatin1Chars();
     bool canUseFatInline = isLatin1
                            ? JSFatInlineString::latin1LengthFits(wholeLength)
                            : JSFatInlineString::twoByteLengthFits(wholeLength);
     if (canUseFatInline && cx->isJSContext()) {
-        JSFatInlineString *str = NewGCFatInlineString<allowGC>(cx);
+        Latin1Char *latin1Buf;
+        char16_t *twoByteBuf;
+        JSInlineString *str = isLatin1
+            ? AllocateFatInlineString<allowGC>(cx, wholeLength, &latin1Buf)
+            : AllocateFatInlineString<allowGC>(cx, wholeLength, &twoByteBuf);
         if (!str)
             return nullptr;
 
         AutoCheckCannotGC nogc;
         JSLinearString *leftLinear = left->ensureLinear(cx);
         if (!leftLinear)
             return nullptr;
         JSLinearString *rightLinear = right->ensureLinear(cx);
         if (!rightLinear)
             return nullptr;
 
         if (isLatin1) {
-            Latin1Char *buf = str->initLatin1(wholeLength);
-            PodCopy(buf, leftLinear->latin1Chars(nogc), leftLen);
-            PodCopy(buf + leftLen, rightLinear->latin1Chars(nogc), rightLen);
-            buf[wholeLength] = 0;
+            PodCopy(latin1Buf, leftLinear->latin1Chars(nogc), leftLen);
+            PodCopy(latin1Buf + leftLen, rightLinear->latin1Chars(nogc), rightLen);
+            latin1Buf[wholeLength] = 0;
         } else {
-            char16_t *buf = str->initTwoByte(wholeLength);
             if (leftLinear->hasTwoByteChars())
-                PodCopy(buf, leftLinear->twoByteChars(nogc), leftLen);
+                PodCopy(twoByteBuf, leftLinear->twoByteChars(nogc), leftLen);
             else
-                CopyAndInflateChars(buf, leftLinear->latin1Chars(nogc), leftLen);
+                CopyAndInflateChars(twoByteBuf, leftLinear->latin1Chars(nogc), leftLen);
             if (rightLinear->hasTwoByteChars())
-                PodCopy(buf + leftLen, rightLinear->twoByteChars(nogc), rightLen);
+                PodCopy(twoByteBuf + leftLen, rightLinear->twoByteChars(nogc), rightLen);
             else
-                CopyAndInflateChars(buf + leftLen, rightLinear->latin1Chars(nogc), rightLen);
-            buf[wholeLength] = 0;
+                CopyAndInflateChars(twoByteBuf + leftLen, rightLinear->latin1Chars(nogc), rightLen);
+            twoByteBuf[wholeLength] = 0;
         }
 
         return str;
     }
 
     return JSRope::new_<allowGC>(cx, left, right, wholeLength);
 }