Bugzilla

### Security Approval Request
* **How easily could an exploit be constructed based on the patch?**: The JS API where this is triggered is not web-exposed, and is only exposed to browser chrome. I could not see anywhere where the JS APIs were exposed to custom user input. So it seems low likelihood. I don't have experience with read after frees and how to turn them into exploits, so I'm unsure how easy it is to turn them into exploits in general, but it doesn't seem like there is a big surface here to throw arbitrary data at it at least.
* **Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?**: No
* **Which older supported branches are affected by this flaw?**: Nightly-only
* **If not all supported branches, which bug introduced the flaw?**: Bug 1719735
* **Do you have backports for the affected branches?**: No
* **If not, how different, hard to create, and risky will they be?**: 
* **How likely is this patch to cause regressions; how much testing does it need?**: Low. This is moving around how a string span is passed into the code. I'm fairly confident if it compiles, it won't cause regression. The intl/components gtests and SpiderMonkey test262 cover this code.

### Security Approval Request
* **How easily could an exploit be constructed based on the patch?**: The JS API where this is triggered is not web-exposed, and is only exposed to browser chrome. I could not see anywhere where the JS APIs were exposed to custom user input. So it seems low likelihood. I don't have experience with read after frees and how to turn them into exploits, so I'm unsure how easy it is to turn them into exploits in general, but it doesn't seem like there is a big surface here to throw arbitrary data at it at least.
* **Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?**: No
* **Which older supported branches are affected by this flaw?**: Nightly-only
* **If not all supported branches, which bug introduced the flaw?**: Bug 1719735
* **Do you have backports for the affected branches?**: No
* **If not, how different, hard to create, and risky will they be?**: 
* **How likely is this patch to cause regressions; how much testing does it need?**: Low. This is moving around how a string span is passed into the code. I'm fairly confident if it compiles, it won't cause regression. The intl/components gtests and SpiderMonkey test262 cover this code. I ran the gtests and test262 tests locally.