Bug 808483: Fix dependent string assertion; r=luke

Undepended strings can break the assertion in JSDependentString::new_. This
generalizes the assertion to work for all cases.

--HG--
extra : rebase_source : 62b7fa786c6250054092723b92cd97bded92d6b1

js/src/jit-test/tests/basic/bug808483.js

@@ -0,0 +1,16 @@
+pSandbox = newGlobal('new-compartment');
+evalcx("\
+    x = ArrayBuffer;\
+    y = Map();\
+    x += 1;\
+    w = x;\
+    x += '0';\
+    z = x;\
+", pSandbox);
+evalcx("\
+    x + '0';\
+", pSandbox);
+evalcx("\
+    y.delete(z);\
+    w.slice(2);\
+", pSandbox)

js/src/vm/String-inl.h

@@ -162,17 +162,29 @@ JSDependentString::init(JSLinearString *base, const jschar *chars, size_t length
 }
 
 JS_ALWAYS_INLINE JSLinearString *
-JSDependentString::new_(JSContext *cx, JSLinearString *base_, const jschar *chars, size_t length)
+JSDependentString::new_(JSContext *cx, JSLinearString *baseArg, const jschar *chars, size_t length)
 {
-    js::Rooted<JSLinearString*> base(cx, base_);
+    js::Rooted<JSLinearString*> base(cx, baseArg);
 
     /* Try to avoid long chains of dependent strings. */
     while (base->isDependent())
         base = base->asDependent().base();
 
     JS_ASSERT(base->isFlat());
-    JS_ASSERT(chars >= base->chars() && chars < base->chars() + base->length());
-    JS_ASSERT(length <= base->length() - (chars - base->chars()));
+
+    /*
+     * The chars we are pointing into must be owned by something in the chain
+     * of dependent or undepended strings kept alive by our base pointer.
+     */
+#ifdef DEBUG
+    for (JSLinearString *b = base; ; b = b->base()) {
+        if (chars >= b->chars() && chars < b->chars() + b->length() &&
+            length <= b->length() - (chars - b->chars()))
+        {
+            break;
+        }
+    }
+#endif
 
     /*
      * Do not create a string dependent on inline chars from another string,