Bug 1107147 - toStringMethod: Check return value from StringBuffer::finishString(). r=fitzgen

js/src/vm/SavedStacks.cpp

@@ -392,12 +392,16 @@ SavedFrame::toStringMethod(JSContext *cx, unsigned argc, Value *vp)
             || !NumberValueToStringBuffer(cx, NumberValue(frame->getLine()), sb)
             || !sb.append(':')
             || !NumberValueToStringBuffer(cx, NumberValue(frame->getColumn()), sb)
-            || !sb.append('\n')) {
+            || !sb.append('\n'))
+        {
             return false;
         }
     } while ((frame = frame->getParent()));
 
-    args.rval().setString(sb.finishString());
+    JSString *str = sb.finishString();
+    if (!str)
+        return false;
+    args.rval().setString(str);
     return true;
 }