diff --git a/mozilla/js/src/jsregexp.c b/mozilla/js/src/jsregexp.c
index f59b2bf17ca..ec668af95f4 100644
--- a/mozilla/js/src/jsregexp.c
+++ b/mozilla/js/src/jsregexp.c
@@ -2034,10 +2034,6 @@ js_NewRegExpOpt(JSContext *cx, JSTokenStream *ts,
     return js_NewRegExp(cx, ts, str, flags, flat);
 }
 
-
-#define HOLD_REGEXP(cx, re) JS_ATOMIC_INCREMENT(&(re)->nrefs)
-#define DROP_REGEXP(cx, re) js_DestroyRegExp(cx, re)
-
 /*
  * Save the current state of the match - the position in the input
  * text as well as the position in the bytecode. The state of any
diff --git a/mozilla/js/src/jsregexp.h b/mozilla/js/src/jsregexp.h
index d8c4cc2955d..50789832d09 100644
--- a/mozilla/js/src/jsregexp.h
+++ b/mozilla/js/src/jsregexp.h
@@ -117,6 +117,9 @@ extern JSRegExp *
 js_NewRegExpOpt(JSContext *cx, JSTokenStream *ts,
                 JSString *str, JSString *opt, JSBool flat);
 
+#define HOLD_REGEXP(cx, re) JS_ATOMIC_INCREMENT(&(re)->nrefs)
+#define DROP_REGEXP(cx, re) js_DestroyRegExp(cx, re)
+
 extern void
 js_DestroyRegExp(JSContext *cx, JSRegExp *re);
 
diff --git a/mozilla/js/src/jsstr.c b/mozilla/js/src/jsstr.c
index 134cd4e5696..1ff964fdc29 100644
--- a/mozilla/js/src/jsstr.c
+++ b/mozilla/js/src/jsstr.c
@@ -1168,7 +1168,9 @@ match_or_replace(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
             return JS_FALSE;
         reobj = NULL;
     }
+    /* From here on, all control flow must reach the matching DROP. */
     data->regexp = re;
+    HOLD_REGEXP(cx, re);
 
     if (re->flags & JSREG_GLOB)
         data->flags |= GLOBAL_REGEXP;
@@ -1184,23 +1186,23 @@ match_or_replace(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
         if (reobj) {
             /* Set the lastIndex property's reserved slot to 0. */
             ok = js_SetLastIndex(cx, reobj, 0);
-            if (!ok)
-                return JS_FALSE;
         } else {
             ok = JS_TRUE;
         }
-        length = JSSTRING_LENGTH(str);
-        for (count = 0; index <= length; count++) {
-            ok = js_ExecuteRegExp(cx, re, str, &index, JS_TRUE, rval);
-            if (!ok || *rval != JSVAL_TRUE)
-                break;
-            ok = glob(cx, count, data);
-            if (!ok)
-                break;
-            if (cx->regExpStatics.lastMatch.length == 0) {
-                if (index == length)
+        if (ok) {
+            length = JSSTRING_LENGTH(str);
+            for (count = 0; index <= length; count++) {
+                ok = js_ExecuteRegExp(cx, re, str, &index, JS_TRUE, rval);
+                if (!ok || *rval != JSVAL_TRUE)
                     break;
-                index++;
+                ok = glob(cx, count, data);
+                if (!ok)
+                    break;
+                if (cx->regExpStatics.lastMatch.length == 0) {
+                    if (index == length)
+                        break;
+                    index++;
+                }
             }
         }
     } else {
@@ -1241,6 +1243,7 @@ match_or_replace(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
         ok = js_ExecuteRegExp(cx, re, str, &index, test, rval);
     }
 
+    DROP_REGEXP(cx, re);
     if (reobj) {
         /* Tell our caller that it doesn't need to destroy data->regexp. */
         data->flags &= ~KEEP_REGEXP;
@@ -1249,6 +1252,7 @@ match_or_replace(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
         data->regexp = NULL;
         js_DestroyRegExp(cx, re);
     }
+
     return ok;
 }