--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -2192,28 +2192,31 @@ static JSBool
 str_concat(JSContext *cx, uintN argc, jsval *vp)
 {
     JSString *str, *str2;
     jsval *argv;
     uintN i;
 
     NORMALIZE_THIS(cx, vp, str);
 
+    /* Set vp (aka rval) early to handle the argc == 0 case. */
+    *vp = STRING_TO_JSVAL(str);
+
     for (i = 0, argv = vp + 2; i < argc; i++) {
         str2 = js_ValueToString(cx, argv[i]);
         if (!str2)
             return JS_FALSE;
         argv[i] = STRING_TO_JSVAL(str2);
 
         str = js_ConcatStrings(cx, str, str2);
         if (!str)
             return JS_FALSE;
+        *vp = STRING_TO_JSVAL(str);
     }
 
-    *vp = STRING_TO_JSVAL(str);
     return JS_TRUE;
 }
 
 #ifdef JS_TRACER
 static JSString* FASTCALL
 String_p_concat_1int(JSContext* cx, JSString* str, int32 i)
 {
     // FIXME: should be able to use stack buffer and avoid istr...