--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -103,18 +103,16 @@ js_GetStringChars(JSContext *cx, JSStrin
 
 void
 JSString::flatten()
 {
     JSString *topNode;
     jschar *chars;
     size_t capacity;
     JS_ASSERT(isRope());
-    if (!isRope())
-        JS_CRASH(0xe0 | (mLengthAndFlags & TYPE_FLAGS_MASK));
 
     /*
      * This can be called from any string in the rope, so first traverse to the
      * top node.
      */
     topNode = this;
     while (topNode->isInteriorNode())
         topNode = topNode->interiorNodeParent();
@@ -126,25 +124,25 @@ JSString::flatten()
     capacity = topNode->topNodeCapacity();
     chars = (jschar *) topNode->topNodeBuffer();
 
     /*
      * To make the traversal simpler, convert the top node to be marked as an
      * interior node with a NULL parent, so that we end up at NULL when we are
      * done processing it.
      */
-    topNode->convertToInteriorNode((JSString *) 0x2);
+    topNode->convertToInteriorNode(NULL);
     JSString *str = topNode, *next;
     size_t pos = 0;
 
     /*
      * Traverse the tree, making each interior string dependent on the resulting
      * string.
      */
-    while (str != (JSString *) 0x2) {
+    while (str) {
         switch (str->ropeTraversalCount()) {
           case 0:
             next = str->ropeLeft();
 
             /*
              * We know the "offset" field for the new dependent string now, but
              * not later, so store it early. We have to be careful with this:
              * mLeft is replaced by mOffset.
@@ -295,19 +293,16 @@ js_ConcatStrings(JSContext *cx, JSString
 
         jschar *buf = shortStr->init(length);
         js_short_strncpy(buf, left->chars(), leftLen);
         js_short_strncpy(buf + leftLen, right->chars(), rightLen);
         buf[length] = 0;
         return shortStr->header();
     }
 
-    left->checkCompartment(cx, 0xd0);
-    right->checkCompartment(cx, 0xd4);
-
     /*
      * We need to enforce a tree structure in ropes: every node needs to have a
      * unique parent. So, we can't have the left or right child be in the middle
      * of a rope tree. One potential solution is to traverse the subtree for the
      * argument string and create a new flat string, but that would add
      * complexity and is a rare case, so we simply flatten the entire rope that
      * contains it. The case where left and right are part of the same rope is
      * handled implicitly.

--- a/js/src/jsstr.h
+++ b/js/src/jsstr.h
@@ -52,18 +52,16 @@
 #include "jsapi.h"
 #include "jsprvtd.h"
 #include "jshashtable.h"
 #include "jslock.h"
 #include "jsobj.h"
 #include "jsvalue.h"
 #include "jscell.h"
 
-#define JS_CRASH(addr) *(int *) (addr) = 0;
-
 #define JSSTRING_BIT(n)             ((size_t)1 << (n))
 #define JSSTRING_BITMASK(n)         (JSSTRING_BIT(n) - 1)
 
 enum {
     UNIT_STRING_LIMIT        = 256U,
     SMALL_CHAR_LIMIT         = 128U, /* Bigger chars cannot be in a length-2 string. */
     NUM_SMALL_CHARS          = 64U,
     INT_STRING_LIMIT         = 256U,
@@ -201,23 +199,16 @@ struct JSString {
     inline js::gc::Cell *asCell() {
         return reinterpret_cast<js::gc::Cell *>(this);
     }
     
     inline js::gc::FreeCell *asFreeCell() {
         return reinterpret_cast<js::gc::FreeCell *>(this);
     }
 
-    inline void checkInteriorParent(int addr) {
-        if (isInteriorNode() && e.mParent == NULL)
-            JS_CRASH(addr);
-    }
-
-    inline void checkCompartment(JSContext *cx, int addr);
-
     /*
      * Generous but sane length bound; the "-1" is there for comptibility with
      * OOM tests.
      */
     static const size_t MAX_LENGTH = (1 << 28) - 1;
 
     inline size_t type() const {
         return mLengthAndFlags & TYPE_MASK;
@@ -282,27 +273,25 @@ struct JSString {
     /* Specific flat string initializer and accessor methods. */
     JS_ALWAYS_INLINE void initFlat(jschar *chars, size_t length) {
         JS_ASSERT(length <= MAX_LENGTH);
         JS_ASSERT(!isStatic(this));
         e.mBase = NULL;
         e.mCapacity = 0;
         mLengthAndFlags = (length << FLAGS_LENGTH_SHIFT) | FLAT;
         mChars = chars;
-        checkInteriorParent(0x90);
     }
 
     JS_ALWAYS_INLINE void initFlatMutable(jschar *chars, size_t length, size_t cap) {
         JS_ASSERT(length <= MAX_LENGTH);
         JS_ASSERT(!isStatic(this));
         e.mBase = NULL;
         e.mCapacity = cap;
         mLengthAndFlags = (length << FLAGS_LENGTH_SHIFT) | FLAT | MUTABLE;
         mChars = chars;
-        checkInteriorParent(0x94);
     }
 
     JS_ALWAYS_INLINE jschar *flatChars() const {
         JS_ASSERT(isFlat());
         return mChars;
     }
 
     JS_ALWAYS_INLINE size_t flatLength() const {
@@ -341,50 +330,46 @@ struct JSString {
      * and set the flag. But this can lead only to an extra call to
      * js_AtomizeString. This function would find that the string was already
      * hashed and return it with the atomized bit set.
      */
     inline void flatSetAtomized() {
         JS_ASSERT(isFlat());
         JS_ASSERT(!isStatic(this));
         JS_ATOMIC_SET_MASK((jsword *)&mLengthAndFlags, ATOMIZED);
-        checkInteriorParent(0x98);
     }
 
     inline void flatSetMutable() {
         JS_ASSERT(isFlat());
         JS_ASSERT(!isAtomized());
         mLengthAndFlags |= MUTABLE;
-        checkInteriorParent(0x9c);
     }
 
     inline void flatClearMutable() {
         JS_ASSERT(isFlat());
 
         /*
          * We cannot eliminate the flag check before writing to mLengthAndFlags as
          * static strings may reside in write-protected memory. See bug 599481.
          */
         if (mLengthAndFlags & MUTABLE)
             mLengthAndFlags &= ~MUTABLE;
-        checkInteriorParent(0xa0);
     }
 
     /*
      * The chars pointer should point somewhere inside the buffer owned by bstr.
      * The caller still needs to pass bstr for GC purposes.
      */
     inline void initDependent(JSString *bstr, jschar *chars, size_t len) {
         JS_ASSERT(len <= MAX_LENGTH);
         JS_ASSERT(!isStatic(this));
         e.mParent = NULL;
         mChars = chars;
         mLengthAndFlags = DEPENDENT | (len << FLAGS_LENGTH_SHIFT);
         e.mBase = bstr;
-        checkInteriorParent(0xa4);
     }
 
     inline JSString *dependentBase() const {
         JS_ASSERT(isDependent());
         return e.mBase;
     }
 
     JS_ALWAYS_INLINE jschar *dependentChars() {
@@ -400,26 +385,22 @@ struct JSString {
     inline void initTopNode(JSString *left, JSString *right, size_t len,
                             JSRopeBufferInfo *buf) {
         JS_ASSERT(left->length() + right->length() <= MAX_LENGTH);
         JS_ASSERT(!isStatic(this));
         mLengthAndFlags = TOP_NODE | (len << FLAGS_LENGTH_SHIFT);
         mLeft = left;
         e.mRight = right;
         e.mBufferWithInfo = buf;
-        checkInteriorParent(0xa8);
     }
 
     inline void convertToInteriorNode(JSString *parent) {
         JS_ASSERT(isTopNode());
-        if (parent == NULL)
-            JS_CRASH(0x80);
         e.mParent = parent;
         mLengthAndFlags = INTERIOR_NODE | (length() << FLAGS_LENGTH_SHIFT);
-        checkInteriorParent(0xac);
     }
 
     inline JSString *interiorNodeParent() const {
         JS_ASSERT(isInteriorNode());
         return e.mParent;
     }
 
     inline JSString *ropeLeft() const {
@@ -439,20 +420,17 @@ struct JSString {
 
     inline JSRopeBufferInfo *topNodeBuffer() const {
         JS_ASSERT(isTopNode());
         return e.mBufferWithInfo;
     }
 
     inline void nullifyTopNodeBuffer() {
         JS_ASSERT(isTopNode());
-        if (!isTopNode())
-            JS_CRASH(0x84);
         e.mBufferWithInfo = NULL;
-        checkInteriorParent(0xb0);
     }
 
     /*
      * When flattening a rope, we need to convert a rope node to a dependent
      * string in two separate parts instead of calling initDependent.
      */
     inline void startTraversalConversion(jschar *chars, size_t offset) {
         JS_ASSERT(isInteriorNode());
@@ -461,35 +439,32 @@ struct JSString {
 
     inline void finishTraversalConversion(JSString *base, jschar *chars,
                                           size_t end) {
         JS_ASSERT(isInteriorNode());
         /* Note that setting flags also clears the traversal count. */
         mLengthAndFlags = JSString::DEPENDENT |
             ((chars + end - mChars) << JSString::FLAGS_LENGTH_SHIFT);
         e.mBase = base;
-        checkInteriorParent(0xb4);
     }
 
     inline void ropeClearTraversalCount() {
         JS_ASSERT(isRope());
         mLengthAndFlags &= ~ROPE_TRAVERSAL_COUNT_MASK;
-        checkInteriorParent(0xb8);
     }
 
     inline size_t ropeTraversalCount() const {
         JS_ASSERT(isRope());
         return (mLengthAndFlags & ROPE_TRAVERSAL_COUNT_MASK) >>
                 ROPE_TRAVERSAL_COUNT_SHIFT;
     }
 
     inline void ropeIncrementTraversalCount() {
         JS_ASSERT(isRope());
         mLengthAndFlags += ROPE_TRAVERSAL_COUNT_UNIT;
-        checkInteriorParent(0xbc);
     }
 
     inline bool ensureNotDependent(JSContext *cx) {
         return !isDependent() || undepend(cx);
     }
 
     inline void ensureNotRope() {
         if (isRope())

--- a/js/src/jsstrinlines.h
+++ b/js/src/jsstrinlines.h
@@ -118,16 +118,9 @@ JSShortString::finalize(JSContext *cx, u
     JS_ASSERT(header()->isFlat());
     JS_RUNTIME_UNMETER(cx->runtime, liveStrings);
 }
 
 inline
 JSRopeBuilder::JSRopeBuilder(JSContext *cx)
   : cx(cx), mStr(cx->runtime->emptyString) {}
 
-inline void
-JSString::checkCompartment(JSContext *cx, int addr)
-{
-    if (isRope() && asCell()->compartment() != cx->compartment)
-        JS_CRASH(addr);
-}
-
 #endif /* jsstrinlines_h___ */