Bug 103342, 113590: ns{C}String::SubstituteString hangs/crashes. r=dbaron, sr=alecf

string/obsolete/nsString.cpp

@@ -413,14 +413,16 @@ nsCString::ReplaceSubstring(const nsCString& aTarget,const nsCString& aNewValue)
           //Since target is longer than newValue, we should delete a few chars first, then overwrite.
           PRInt32 theDelLen=aTarget.mLength-aNewValue.mLength;
           nsStr::Delete(*this,theIndex,theDelLen);
+          nsStr::Overwrite(*this,aNewValue,theIndex);
         }
         else {
           //this is the worst case: the newvalue is larger than the substr it's replacing
           //so we have to insert some characters...
           PRInt32 theInsLen=aNewValue.mLength-aTarget.mLength;
           StrInsert(*this,theIndex,aNewValue,0,theInsLen);
-        }
           nsStr::Overwrite(*this,aNewValue,theIndex);
+          theIndex += aNewValue.mLength;
+        }
       }
     }
   }

string/obsolete/nsString2.cpp

@@ -430,14 +430,16 @@ nsString::ReplaceSubstring(const nsString& aTarget,const nsString& aNewValue){
           //Since target is longer than newValue, we should delete a few chars first, then overwrite.
           PRInt32 theDelLen=aTarget.mLength-aNewValue.mLength;
           nsStr::Delete(*this,theIndex,theDelLen);
+          nsStr::Overwrite(*this,aNewValue,theIndex);
         }
         else {
           //this is the worst case: the newvalue is larger than the substr it's replacing
           //so we have to insert some characters...
           PRInt32 theInsLen=aNewValue.mLength-aTarget.mLength;
           StrInsert(*this,theIndex,aNewValue,0,theInsLen);
-        }
           nsStr::Overwrite(*this,aNewValue,theIndex);
+          theIndex += aNewValue.mLength;
+        }
       }
     }
   }

xpcom/string/obsolete/nsString.cpp

@@ -413,14 +413,16 @@ nsCString::ReplaceSubstring(const nsCString& aTarget,const nsCString& aNewValue)
           //Since target is longer than newValue, we should delete a few chars first, then overwrite.
           PRInt32 theDelLen=aTarget.mLength-aNewValue.mLength;
           nsStr::Delete(*this,theIndex,theDelLen);
+          nsStr::Overwrite(*this,aNewValue,theIndex);
         }
         else {
           //this is the worst case: the newvalue is larger than the substr it's replacing
           //so we have to insert some characters...
           PRInt32 theInsLen=aNewValue.mLength-aTarget.mLength;
           StrInsert(*this,theIndex,aNewValue,0,theInsLen);
-        }
           nsStr::Overwrite(*this,aNewValue,theIndex);
+          theIndex += aNewValue.mLength;
+        }
       }
     }
   }

xpcom/string/obsolete/nsString2.cpp

@@ -430,14 +430,16 @@ nsString::ReplaceSubstring(const nsString& aTarget,const nsString& aNewValue){
           //Since target is longer than newValue, we should delete a few chars first, then overwrite.
           PRInt32 theDelLen=aTarget.mLength-aNewValue.mLength;
           nsStr::Delete(*this,theIndex,theDelLen);
+          nsStr::Overwrite(*this,aNewValue,theIndex);
         }
         else {
           //this is the worst case: the newvalue is larger than the substr it's replacing
           //so we have to insert some characters...
           PRInt32 theInsLen=aNewValue.mLength-aTarget.mLength;
           StrInsert(*this,theIndex,aNewValue,0,theInsLen);
-        }
           nsStr::Overwrite(*this,aNewValue,theIndex);
+          theIndex += aNewValue.mLength;
+        }
       }
     }
   }