3 files changed, 6 insertions, 2 deletions
diff --git a/actionpack/lib/action_view/helpers/javascript_helper.rb b/actionpack/lib/action_view/helpers/javascript_helper.rb
index 8a6f2e84be..4484390fde 100644
--- a/actionpack/lib/action_view/helpers/javascript_helper.rb
+++ b/actionpack/lib/action_view/helpers/javascript_helper.rb
@@ -18,7 +18,8 @@ module ActionView
       #   $('some_element').replaceWith('<%=j render 'some/element_template' %>');
       def escape_javascript(javascript)
         if javascript
-          javascript.gsub(/(\\|<\/|\r\n|[\n\r"'])/) {|match| JS_ESCAPE_MAP[match] }
+          result = javascript.gsub(/(\\|<\/|\r\n|[\n\r"'])/) {|match| JS_ESCAPE_MAP[match] }
+          javascript.html_safe? ? result.html_safe : result
         else
           ''
         end
diff --git a/actionpack/lib/action_view/helpers/number_helper.rb b/actionpack/lib/action_view/helpers/number_helper.rb
index 4dafb7739a..fe0288521f 100644
--- a/actionpack/lib/action_view/helpers/number_helper.rb
+++ b/actionpack/lib/action_view/helpers/number_helper.rb
@@ -211,7 +211,7 @@ module ActionView
         defaults = I18n.translate(:'number.format', :locale => options[:locale], :default => {})
         options = options.reverse_merge(defaults)
 
-        parts = number.to_s.split('.')
+        parts = number.to_s.to_str.split('.')
         parts[0].gsub!(/(\d)(?=(\d\d\d)+(?!\d))/, "\\1#{options[:delimiter]}")
         parts.join(options[:separator]).html_safe
 
diff --git a/actionpack/lib/action_view/template.rb b/actionpack/lib/action_view/template.rb
index 10797c010f..9c59d18310 100644
--- a/actionpack/lib/action_view/template.rb
+++ b/actionpack/lib/action_view/template.rb
@@ -218,6 +218,9 @@ module ActionView
         method_name = self.method_name
 
         if source.encoding_aware?
+          # Avoid performing in-place mutation for SafeBuffer
+          @source = source.to_str if source.html_safe?
+
           # Look for # encoding: *. If we find one, we'll encode the
           # String in that encoding, otherwise, we'll use the
           # default external encoding.