Fix bug 635137 (r=luke, a=blocker).

js/src/json.cpp

@@ -406,6 +406,7 @@ JO(JSContext *cx, Value *vp, StringifyContext *scx)
         if (!s)
             return JS_FALSE;
 
+        Anchor<JSString *> anchor(s);
         size_t length = s->length();
         const jschar *chars = s->getChars(cx);
         if (!chars)

js/src/jsstr.cpp

@@ -781,6 +781,7 @@ str_toSource(JSContext *cx, uintN argc, Value *vp)
     char buf[16];
     size_t j = JS_snprintf(buf, sizeof buf, "(new String(");
 
+    Anchor<JSString *> anchor(str);
     size_t k = str->length();
     const jschar *s = str->getChars(cx);
     if (!s)

js/src/jsxml.cpp

@@ -427,6 +427,7 @@ ConvertQNameToString(JSContext *cx, JSObject *obj)
         return NULL;
 
     if (obj->getClass() == &js_AttributeNameClass) {
+        Anchor<JSString *> anchor(str);
         size_t length = str->length();
         jschar *chars = (jschar *) cx->malloc((length + 2) * sizeof(jschar));
         if (!chars)