Fix nul-termination assumption hidden in lastIndexOf, broken by dependent strings fix for bug 56940 (107771, r=jag, sr=waterson).

js/src/jsstr.c

@@ -1002,7 +1002,8 @@ str_lastIndexOf(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
 
     j = 0;
     while (i >= 0) {
-        if (text[i + j] == pat[j]) {
+        /* Don't assume that text is NUL-terminated: it could be dependent. */
+        if (i + j < textlen && text[i + j] == pat[j]) {
             if (++j == patlen)
                 break;
         } else {