From dc33c4cbddc53ddebd434bb4bd7d889f8fd0db40 Mon Sep 17 00:00:00 2001
From: "mrbkap%gmail.com"
 <mrbkap%gmail.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Tue, 11 Aug 2009 00:54:10 +0000
Subject: [PATCH] Bug 505305. r=gal a=dveditz

git-svn-id: svn://10.0.0.236/trunk@258051 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/js/src/jsstr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mozilla/js/src/jsstr.c b/mozilla/js/src/jsstr.c
index a54f4c1f3aa..5a33647957d 100644
--- a/mozilla/js/src/jsstr.c
+++ b/mozilla/js/src/jsstr.c
@@ -1607,6 +1607,8 @@ str_replace(JSContext *cx, uintN argc, jsval *vp)
     rdata.lambda = lambda;
     rdata.repstr = repstr;
     if (repstr) {
+        if (!js_MakeStringImmutable(cx, repstr))
+            return JS_FALSE;
         rdata.dollarEnd = JSSTRING_CHARS(repstr) + JSSTRING_LENGTH(repstr);
         rdata.dollar = js_strchr_limit(JSSTRING_CHARS(repstr), '$',
                                        rdata.dollarEnd);