Bug 718293 - Anchor string in nsHTMLDocumentSH::CallToGetPropMapper. r=jorendorff

dom/base/nsDOMClassInfo.cpp

@@ -9173,6 +9173,7 @@ nsHTMLDocumentSH::CallToGetPropMapper(JSContext *cx, unsigned argc, jsval *vp)
   }
 
   size_t length;
+  JS::Anchor<JSString *> anchor(str)
   const jschar *chars = ::JS_GetStringCharsAndLength(cx, str, &length);
   if (!chars) {
     return JS_FALSE;