From 57230defd890bd5281207fa8f4c29d32780474f8 Mon Sep 17 00:00:00 2001
From: Benjamin Peterson <benjamin@python.org>
Date: Thu, 13 Sep 2012 14:34:33 -0400
Subject: [PATCH] Bug 788701 - Decrease the length of the text to match when
 there is a start position. r=jorendorff

---
 js/src/jit-test/tests/basic/string-contains.js | 4 ++++
 js/src/jsstr.cpp                               | 4 +++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/js/src/jit-test/tests/basic/string-contains.js b/js/src/jit-test/tests/basic/string-contains.js
index 017b94f7eccf..368263162f40 100644
--- a/js/src/jit-test/tests/basic/string-contains.js
+++ b/js/src/jit-test/tests/basic/string-contains.js
@@ -40,3 +40,7 @@ var idx = {valueOf : (function () {
 })};
 myobj.contains("elephant", idx);
 assertEq(gotPos, true);
+assertEq("xyzzy".contains("zy\0", 2), false);
+var dots = Array(10000).join('.');
+assertEq(dots.contains("\x01", 10000), false);
+assertEq(dots.contains("\0", 10000), false);
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index 307d364ff822..e683ba0d3454 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -1160,7 +1160,9 @@ str_contains(JSContext *cx, unsigned argc, Value *vp)
             return false;
 
         // Step 6
-        text += uint32_t(Min(double(textlen), Max(0.0, posDouble)));
+        uint32_t delta = uint32_t(Min(double(textlen), Max(0.0, posDouble)));
+        text += delta;
+        textlen -= delta;
     }
 
     // Step 7