--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -550,23 +550,28 @@ SprintEnsureBuffer(Sprinter *sp, size_t 
     sp->base = base;
     sp->size += nb;
     return JS_TRUE;
 }
 
 static ptrdiff_t
 SprintPut(Sprinter *sp, const char *s, size_t len)
 {
-    ptrdiff_t offset;
-    char *bp;
+    ptrdiff_t offset = sp->size; /* save old size */
+    char *bp = sp->base;         /* save old base */
 
     /* Allocate space for s, including the '\0' at the end. */
     if (!SprintEnsureBuffer(sp, len))
         return -1;
 
+    if (sp->base != bp &&               /* buffer was realloc'ed */
+        s >= bp && s < bp + offset) {   /* s was within the buffer */
+        s = sp->base + (s - bp);        /* this is where it lives now */
+    }
+
     /* Advance offset and copy s into sp's buffer. */
     offset = sp->offset;
     sp->offset += len;
     bp = sp->base + offset;
     memmove(bp, s, len);
     bp[len] = 0;
     return offset;
 }