From 8fe53f59d01de6f60b3be2db0de8d89e10bf1b70 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Wed, 20 Dec 2023 13:19:00 +0100 Subject: [PATCH] [layout] Always check against fragment length in nsTextFrame --- layout/generic/nsTextFrame.cpp | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/layout/generic/nsTextFrame.cpp b/layout/generic/nsTextFrame.cpp index 1fccf48a18..7e73692c42 100644 --- a/layout/generic/nsTextFrame.cpp +++ b/layout/generic/nsTextFrame.cpp @@ -711,7 +711,11 @@ GlyphObserver::NotifyGlyphsChanged() int32_t nsTextFrame::GetContentEnd() const { nsTextFrame* next = static_cast(GetNextContinuation()); - return next ? next->GetContentOffset() : mContent->GetText()->GetLength(); + // In case of allocation failure when setting/modifying the textfragment, + // it's possible our text might be missing. So we check the fragment length, + // in addition to the offset of the next continuation (if any). + int32_t fragLen = mContent->GetText()->GetLength(); + return next ? std::min(fragLen, next->GetContentOffset()) : fragLen; } struct FlowLengthProperty { @@ -1078,8 +1082,8 @@ public: nsIFrame* mAncestorControllingInitialBreak; int32_t GetContentEnd() { - return mEndFrame ? mEndFrame->GetContentOffset() - : mStartFrame->GetContent()->GetText()->GetLength(); + int32_t fragLen = mStartFrame->GetContent()->GetText()->GetLength(); + return mEndFrame ? std::min(fragLen, mEndFrame->GetContentOffset()) : fragLen; } };