Bug 637859. Anchor a string for a bit. r=cdleary, a=bsmedberg

js/src/jsregexp.cpp

@@ -640,6 +640,7 @@ EscapeNakedForwardSlashes(JSContext *cx, JSString *unescaped)
     const jschar *oldChars = unescaped->getChars(cx);
     if (!oldChars)
         return NULL;
+    JS::Anchor<JSString *> anchor(unescaped);
 
     js::Vector<jschar, 128> newChars(cx);
     for (const jschar *it = oldChars; it < oldChars + oldLen; ++it) {
@@ -647,13 +648,14 @@ EscapeNakedForwardSlashes(JSContext *cx, JSString *unescaped)
             if (!newChars.length()) {
                 if (!newChars.reserve(oldLen + 1))
                     return NULL;
-                newChars.append(oldChars, size_t(it - oldChars));
+                JS_ALWAYS_TRUE(newChars.append(oldChars, size_t(it - oldChars)));
             }
-            newChars.append('\\');
+            if (!newChars.append('\\'))
+                return NULL;
         }
 
-        if (newChars.length())
-            newChars.append(*it);
+        if (!newChars.empty() && !newChars.append(*it))
+            return NULL;
     }
 
     if (newChars.length()) {