--- a/js/src/ion/Ion.cpp
+++ b/js/src/ion/Ion.cpp
@@ -1053,16 +1053,18 @@ InvalidateActivation(JSContext *cx, uint
         IonScript *ionScript = script->ion;
         ionScript->incref();
         IonSpew(IonSpew_Invalidate, "   ionScript %p ref %u", (void *) ionScript,
                 unsigned(ionScript->refcount()));
 
         const SafepointIndex *si = ionScript->getSafepointIndex(it.returnAddressToFp());
         IonCode *ionCode = ionScript->method();
 
+        ionCode->setInvalidated();
+
         // Write the delta (from the return address offset to the
         // IonScript pointer embedded into the invalidation epilogue)
         // where the safepointed call instruction used to be. We rely on
         // the call sequence causing the safepoint being >= the size of
         // a uint32, which is checked during safepoint index
         // construction.
         CodeLocationLabel dataLabelToMunge(it.returnAddressToFp());
         ptrdiff_t delta = ionScript->invalidateEpilogueDataOffset() -
@@ -1123,18 +1125,16 @@ ion::Invalidate(JSContext *cx, const Vec
 }
 
 void
 ion::FinishInvalidation(JSContext *cx, JSScript *script)
 {
     if (!script->hasIonScript())
         return;
 
-    script->ion->method()->setInvalidated();
-
     /*
      * If this script has Ion code on the stack, invalidation() will return
      * true. In this case we have to wait until destroying it.
      */
     if (!script->ion->invalidated())
         ion::IonScript::Destroy(cx, script->ion);
 
     /* In all cases, NULL out script->ion to avoid re-entry. */

--- a/js/src/ion/IonCode.h
+++ b/js/src/ion/IonCode.h
@@ -109,16 +109,20 @@ class IonCode : public gc::Cell
     size_t bufferSize() const {
         return bufferSize_;
     }
     void trace(JSTracer *trc);
     void finalize(JSContext *cx, bool background);
     void setInvalidated() {
         invalidated_ = true;
     }
+
+    // If this IonCode object has been, effectively, corrupted due to
+    // invalidation patching, then we have to remember this so we don't try and
+    // trace relocation entries that may now be corrupt.
     bool invalidated() const {
         return !!invalidated_;
     }
 
     template <typename T> T as() const {
         return JS_DATA_TO_FUNC_PTR(T, raw());
     }