--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -3891,18 +3891,18 @@ RemoveFromGrayList(RawObject wrapper)
     JSCompartment *c = CrossCompartmentPointerReferent(wrapper)->compartment();
     RawObject obj = c->gcIncomingGrayPointers;
     if (obj == wrapper) {
         c->gcIncomingGrayPointers = tail;
         return true;
     }
 
     while (obj) {
-        unsigned slot = GrayLinkSlot(o);
-        RawObject next = o->getReservedSlot(slot).toObjectOrNull();
+        unsigned slot = GrayLinkSlot(obj);
+        RawObject next = obj->getReservedSlot(slot).toObjectOrNull();
         if (next == wrapper) {
             obj->setCrossCompartmentSlot(slot, ObjectOrNullValue(tail));
             return true;
         }
         obj = next;
     }
     JS_NOT_REACHED("object not found in gray link list");
 }