From d4d926c17413b0bdfdda3563cf5c64d1827922af Mon Sep 17 00:00:00 2001
From: Jason Orendorff <jorendorff@mozilla.com>
Date: Wed, 25 Feb 2009 13:11:34 -0600
Subject: [PATCH] Bug 477351 - Assertion failure: cx->bailExit (from
 js_ReportAllocationOverflow from js_ConcatStrings). r=gal.

--HG--
extra : rebase_source : 52b5fea9846cfb36eeb4e295005634d9d490598e
---
 js/src/jsstr.cpp | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index 8494dbc42a4..a7937232d2f 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -165,6 +165,17 @@ js_ConcatStrings(JSContext *cx, JSString *left, JSString *right)
     js_strncpy(s + ln, rs, rn);
     n = ln + rn;
     s[n] = 0;
+
+#ifdef JS_TRACER
+    /*
+     * Lame hack to avoid trying to deep-bail (@js_ReportAllocationOverflow)
+     * when called directly from trace.  Instead, retry from the interpreter.
+     * See bug 477351.
+     */
+    if (n > JSSTRING_LENGTH_MASK && JS_ON_TRACE(cx) && !cx->bailExit)
+        return NULL;
+#endif
+
     str = js_NewString(cx, s, n);
     if (!str) {
         /* Out of memory: clean up any space we (re-)allocated. */