Hi Sebastian,
I took a deeper look at this. It seems that we have at least two more jsstr_alloc_buf callers to fix (jsstr_concat and JSGlobal_decodeURIComponent). All those seem to be mistakes caused by wrong choice of function signature, requiring not intuitive error handling. I'd prefer to change the root of those problems, making the function: jsstr_t *jsstr_alloc_buf(unsigned,WCHAR**) This should avoid similar mistakes in the future.
This will be much larger patch than you originally meant, so please let me know if you'd like to prepare a patch or should I take care of that.
Thanks, Jacek