--- a/js/src/jslock.cpp
+++ b/js/src/jslock.cpp
@@ -182,18 +182,24 @@ NativeCompareAndSwap(jsword *w, jsword o
 typedef int (__kernel_cmpxchg_t)(int oldval, int newval, volatile int *ptr);
 #define __kernel_cmpxchg (*(__kernel_cmpxchg_t *)0xffff0fc0)
 
 JS_STATIC_ASSERT(sizeof(jsword) == sizeof(int));
 
 static JS_INLINE int
 NativeCompareAndSwap(jsword *w, jsword ov, jsword nv)
 {
-    volatile int *vp = (volatile int*)w;
-    return !__kernel_cmpxchg(ov, nv, vp);
+    volatile int *vp = (volatile int *) w;
+    PRInt32 failed = 1;
+
+    /* Loop until a __kernel_cmpxchg succeeds. See bug 446169 */
+    do {
+        failed = __kernel_cmpxchg(ov, nv, vp);
+    } while (failed && *vp == ov);
+    return !failed;
 }
 
 #else
 
 #error "JS_HAS_NATIVE_COMPARE_AND_SWAP should be 0 if your platform lacks a compare-and-swap instruction."
 
 #endif /* arch-tests */