--- a/js/src/jit-test/tests/basic/string-contains.js
+++ b/js/src/jit-test/tests/basic/string-contains.js
@@ -35,8 +35,12 @@ myobj = {toString : (function () {
 contains : String.prototype.contains};
 var idx = {valueOf : (function () {
     assertEq(gotStr, true);
     gotPos = true;
     return 42;
 })};
 myobj.contains("elephant", idx);
 assertEq(gotPos, true);
+assertEq("xyzzy".contains("zy\0", 2), false);
+var dots = Array(10000).join('.');
+assertEq(dots.contains("\x01", 10000), false);
+assertEq(dots.contains("\0", 10000), false);

--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -1155,17 +1155,19 @@ str_contains(JSContext *cx, unsigned arg
 
     if (args.hasDefined(1)) {
         // Step 4
         double posDouble;
         if (!ToInteger(cx, args[1], &posDouble))
             return false;
 
         // Step 6
-        text += uint32_t(Min(double(textlen), Max(0.0, posDouble)));
+        uint32_t delta = uint32_t(Min(double(textlen), Max(0.0, posDouble)));
+        text += delta;
+        textlen -= delta;
     }
 
     // Step 7
     uint32_t patlen = patstr->length();
     const jschar *pat = patstr->chars();
 
     // Step 8
     args.rval().setBoolean(StringMatch(text, textlen, pat, patlen) >= 0);