Patch from Mats Palmgren for bug 424558 (r=me).
authorBrendan Eich <brendan@mozilla.org>
Sun, 14 Mar 2010 16:12:47 -0500
changeset 40260 eea1a473c07471e82be86511b993a75a274c4e01
parent 40259 d28d21557ea83f8b86900c1f8b4406e8376a405f
child 40261 03bc6bab82d9d718fd78c0e3b6d471cef4a3056b
push id12610
push userrsayre@mozilla.com
push dateMon, 05 Apr 2010 17:26:41 +0000
treeherdermozilla-central@1942c0b4e101 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersme
bugs424558
milestone1.9.3a3pre
Patch from Mats Palmgren for bug 424558 (r=me).
js/src/jsopcode.cpp
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -550,23 +550,28 @@ SprintEnsureBuffer(Sprinter *sp, size_t 
     sp->base = base;
     sp->size += nb;
     return JS_TRUE;
 }
 
 static ptrdiff_t
 SprintPut(Sprinter *sp, const char *s, size_t len)
 {
-    ptrdiff_t offset;
-    char *bp;
+    ptrdiff_t offset = sp->size; /* save old size */
+    char *bp = sp->base;         /* save old base */
 
     /* Allocate space for s, including the '\0' at the end. */
     if (!SprintEnsureBuffer(sp, len))
         return -1;
 
+    if (sp->base != bp &&               /* buffer was realloc'ed */
+        s >= bp && s < bp + offset) {   /* s was within the buffer */
+        s = sp->base + (s - bp);        /* this is where it lives now */
+    }
+
     /* Advance offset and copy s into sp's buffer. */
     offset = sp->offset;
     sp->offset += len;
     bp = sp->base + offset;
     memmove(bp, s, len);
     bp[len] = 0;
     return offset;
 }