Bug 735313 - StringBuffer still needs length validation. r=luke

js/src/vm/StringBuffer-inl.h

@@ -13,57 +13,39 @@
 
 namespace js {
 
-inline bool
-StringBuffer::checkLength(size_t length)
-{
-    return JSString::validateLength(context(), length);
-}
-
 inline bool
 StringBuffer::reserve(size_t len)
 {
-    if (!checkLength(len))
-        return false;
     return cb.reserve(len);
 }
 
 inline bool
 StringBuffer::resize(size_t len)
 {
-    if (!checkLength(len))
-        return false;
     return cb.resize(len);
 }
 
 inline bool
 StringBuffer::append(const jschar c)
 {
-    if (!checkLength(cb.length() + 1))
-        return false;
     return cb.append(c);
 }
 
 inline bool
 StringBuffer::append(const jschar *chars, size_t len)
 {
-    if (!checkLength(cb.length() + len))
-        return false;
     return cb.append(chars, len);
 }
 
 inline bool
 StringBuffer::append(const jschar *begin, const jschar *end)
 {
-    if (!checkLength(cb.length() + (end - begin)))
-        return false;
     return cb.append(begin, end);
 }
 
 inline bool
 StringBuffer::appendN(const jschar c, size_t n)
 {
-    if (!checkLength(cb.length() + n))
-        return false;
     return cb.appendN(c, n);
 }
 

js/src/vm/StringBuffer.cpp

@@ -47,7 +47,8 @@ StringBuffer::finishString()
         return cx->runtime->atomState.emptyAtom;
 
     size_t length = cb.length();
-    JS_ASSERT(checkLength(length));
+    if (!JSString::validateLength(cx, length))
+        return NULL;
 
     JS_STATIC_ASSERT(JSShortString::MAX_SHORT_LENGTH < CharBuffer::InlineLength);
     if (JSShortString::lengthFits(length))

js/src/vm/StringBuffer.h

@@ -34,7 +34,6 @@ class StringBuffer
 
     CharBuffer cb;
 
-    inline bool checkLength(size_t length);
     JSContext *context() const { return cb.allocPolicy().context(); }
     jschar *extractWellSized();