diff --git a/js/src/jsatom.cpp b/js/src/jsatom.cpp
index 02818fc15ca..6a921d9b0b9 100644
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -1094,6 +1094,7 @@ JSAtomList::add(JSCompiler *jsc, JSAtom *atom, AddHow how)
              * with the given key.
              */
             if (how == HOIST && ale->entry.next) {
+                JS_ASSERT(*hep == &ale->entry);
                 *hep = ale->entry.next;
                 ale->entry.next = NULL;
                 do {
diff --git a/js/src/jshash.cpp b/js/src/jshash.cpp
index 1288a9055e2..9e9466e4b6e 100644
--- a/js/src/jshash.cpp
+++ b/js/src/jshash.cpp
@@ -246,7 +246,7 @@ Resize(JSHashTable *ht, uint32 newshift)
 }
 
 JS_PUBLIC_API(JSHashEntry *)
-JS_HashTableRawAdd(JSHashTable *ht, JSHashEntry **hep,
+JS_HashTableRawAdd(JSHashTable *ht, JSHashEntry **&hep,
                    JSHashNumber keyHash, const void *key, void *value)
 {
     uint32 n;
diff --git a/js/src/jshash.h b/js/src/jshash.h
index 45f6016fe35..c6c00ba59cd 100644
--- a/js/src/jshash.h
+++ b/js/src/jshash.h
@@ -116,7 +116,7 @@ extern JS_PUBLIC_API(JSHashEntry **)
 JS_HashTableRawLookup(JSHashTable *ht, JSHashNumber keyHash, const void *key);
 
 extern JS_PUBLIC_API(JSHashEntry *)
-JS_HashTableRawAdd(JSHashTable *ht, JSHashEntry **hep, JSHashNumber keyHash,
+JS_HashTableRawAdd(JSHashTable *ht, JSHashEntry **&hep, JSHashNumber keyHash,
                    const void *key, void *value);
 
 extern JS_PUBLIC_API(void)