Bug 637859. Anchor a string for a bit. r=cdleary, a=bsmedberg

leto · Mar 3, 2011 · e974b41 · e974b41
1 parent cc99f71
commit e974b41
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/js/src/jsregexp.cpp b/js/src/jsregexp.cpp
@@ -640,20 +640,22 @@ EscapeNakedForwardSlashes(JSContext *cx, JSString *unescaped)
     const jschar *oldChars = unescaped->getChars(cx);
     if (!oldChars)
         return NULL;
+    JS::Anchor<JSString *> anchor(unescaped);
 
     js::Vector<jschar, 128> newChars(cx);
     for (const jschar *it = oldChars; it < oldChars + oldLen; ++it) {
         if (*it == '/' && (it == oldChars || it[-1] != '\\')) {
             if (!newChars.length()) {
                 if (!newChars.reserve(oldLen + 1))
                     return NULL;
-                newChars.append(oldChars, size_t(it - oldChars));
+                JS_ALWAYS_TRUE(newChars.append(oldChars, size_t(it - oldChars)));
             }
-            newChars.append('\\');
+            if (!newChars.append('\\'))
+                return NULL;
         }
 
-        if (newChars.length())
-            newChars.append(*it);
+        if (!newChars.empty() && !newChars.append(*it))
+            return NULL;
     }
 
     if (newChars.length()) {