commit ac0f7d653b1e
Author: Daniel Holbert <dholbert@cs.stanford.edu>
Date:   Sat Feb 10 08:46:49 2018 -0800

    Bug 1324042: Fix trimmedOffsets arithmetic in GetRenderedText(). r=mats a=abillings
    
    MozReview-Commit-ID: H4ngU8Juyln
    
    --HG--
    extra : source : fbf54020043bd09c162530907b2a1091a10f4f92
---
 layout/generic/nsTextFrame.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git layout/generic/nsTextFrame.cpp layout/generic/nsTextFrame.cpp
index 42891e960eea..f8b49e4d07cf 100644
--- layout/generic/nsTextFrame.cpp
+++ layout/generic/nsTextFrame.cpp
@@ -10116,9 +10116,13 @@ nsTextFrame::GetRenderedText(uint32_t aStartOffset,
       startOffset = aStartOffset;
       endOffset = std::min<uint32_t>(INT32_MAX, aEndOffset);
     }
+
+    // If startOffset and/or endOffset are inside of trimmedOffsets' range,
+    // then clamp the edges of trimmedOffsets accordingly.
+    int32_t origTrimmedOffsetsEnd = trimmedOffsets.GetEnd();
     trimmedOffsets.mStart = std::max<uint32_t>(trimmedOffsets.mStart,
         startOffset);
-    trimmedOffsets.mLength = std::min<uint32_t>(trimmedOffsets.GetEnd(),
+    trimmedOffsets.mLength = std::min<uint32_t>(origTrimmedOffsetsEnd,
         endOffset) - trimmedOffsets.mStart;
     if (trimmedOffsets.mLength <= 0) {
       offsetInRenderedString = nextOffsetInRenderedString;