diff --git a/mozilla/content/html/document/src/nsHTMLContentSink.cpp b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
index 1df5517d919..475f82e0c86 100644
--- a/mozilla/content/html/document/src/nsHTMLContentSink.cpp
+++ b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
@@ -548,7 +548,7 @@ void HTMLContentSink::ReduceEntities(nsString& aString) {
 
         theStartPos=theSemiPos+1;
 
-        PRUnichar theChar=aString.CharAt(theAmpPos+1);
+        PRUnichar theChar=(theLen>theAmpPos+1) ? aString.CharAt(theAmpPos+1) : '\0';
         PRUnichar theEntity=0;
         PRInt32   theErr=0;
         PRInt32   theNCRValue=0;
@@ -3059,7 +3059,7 @@ HTMLContentSink::AddDocTypeDecl(const nsIParserNode& aNode, PRInt32 aMode)
       publicId.Trim(" \t\n\r");
 
       // Strip quotes
-      PRUnichar ch = publicId.First();
+      PRUnichar ch = publicId.Length() ? publicId.First() : '\0';
 
       if (ch == '"' || ch == '\'') {
         publicId.Cut(0, 1);
@@ -3120,7 +3120,7 @@ HTMLContentSink::AddDocTypeDecl(const nsIParserNode& aNode, PRInt32 aMode)
       systemId.Trim(" \t\n\r");
 
       // Strip quotes
-      PRUnichar ch = systemId.First();
+      PRUnichar ch = systemId.Length() ? systemId.First() : '\0';
 
       if (ch == '"' || ch == '\'') {
         systemId.Cut(0, 1);
@@ -3168,7 +3168,7 @@ HTMLContentSink::AddDocTypeDecl(const nsIParserNode& aNode, PRInt32 aMode)
    */
   PRInt32 nameEnd = 0;
 
-  if (name.First() != '"' && name.First() != '\'') {
+  if (name.Length() && name.First() != '"' && name.First() != '\'') {
     nameEnd = name.FindCharInSet(" \n\r\t");
   }
 
@@ -3180,7 +3180,7 @@ HTMLContentSink::AddDocTypeDecl(const nsIParserNode& aNode, PRInt32 aMode)
     name.Mid(publicId, nameEnd, name.Length() - nameEnd);
     publicId.Trim(" \t\n\r");
 
-    PRUnichar ch = publicId.First();
+    PRUnichar ch = publicId.Length() ? publicId.First() : '\0';
 
     if (ch == '"' || ch == '\'') {
       publicId.Cut(0, 1);
diff --git a/mozilla/htmlparser/src/nsViewSourceHTML.cpp b/mozilla/htmlparser/src/nsViewSourceHTML.cpp
index 3260646a401..b9623e88301 100644
--- a/mozilla/htmlparser/src/nsViewSourceHTML.cpp
+++ b/mozilla/htmlparser/src/nsViewSourceHTML.cpp
@@ -665,11 +665,11 @@ nsresult WriteText(const nsString& aTextString,nsIContentSink& aSink,PRBool aPre
   PRUnichar theNextChar=0;
 
   while(++theOffset<theEnd){
-    theNextChar=aTextString[theOffset-1];
+    //theNextChar=aTextString[theOffset-1];
     theChar=aTextString[theOffset];
     switch(theChar){
       case kSpace:
-        theNextChar=aTextString[theOffset+1];
+        theNextChar=(theOffset+1 != theEnd) ? aTextString[theOffset+1] : '\0';
         if((!aPlainText) && aPreserveSpace) { //&& ((kSpace==theNextChar) || (0==theNextChar)))
           if(theTextOffset<theOffset) {
             if(kSpace==theNextChar) {
@@ -705,7 +705,7 @@ nsresult WriteText(const nsString& aTextString,nsIContentSink& aSink,PRBool aPre
           theTextOffset=theOffset--;  //back up one on purpose...
         }
         else {
-          theNextChar=aTextString.CharAt(theOffset+1);
+          theNextChar=(theOffset+1 != theEnd) ? aTextString.CharAt(theOffset+1) : '\0';
           if((kCR==theChar) && (kLF==theNextChar)) {
             theOffset++;
           }
diff --git a/mozilla/layout/html/document/src/nsHTMLContentSink.cpp b/mozilla/layout/html/document/src/nsHTMLContentSink.cpp
index 1df5517d919..475f82e0c86 100644
--- a/mozilla/layout/html/document/src/nsHTMLContentSink.cpp
+++ b/mozilla/layout/html/document/src/nsHTMLContentSink.cpp
@@ -548,7 +548,7 @@ void HTMLContentSink::ReduceEntities(nsString& aString) {
 
         theStartPos=theSemiPos+1;
 
-        PRUnichar theChar=aString.CharAt(theAmpPos+1);
+        PRUnichar theChar=(theLen>theAmpPos+1) ? aString.CharAt(theAmpPos+1) : '\0';
         PRUnichar theEntity=0;
         PRInt32   theErr=0;
         PRInt32   theNCRValue=0;
@@ -3059,7 +3059,7 @@ HTMLContentSink::AddDocTypeDecl(const nsIParserNode& aNode, PRInt32 aMode)
       publicId.Trim(" \t\n\r");
 
       // Strip quotes
-      PRUnichar ch = publicId.First();
+      PRUnichar ch = publicId.Length() ? publicId.First() : '\0';
 
       if (ch == '"' || ch == '\'') {
         publicId.Cut(0, 1);
@@ -3120,7 +3120,7 @@ HTMLContentSink::AddDocTypeDecl(const nsIParserNode& aNode, PRInt32 aMode)
       systemId.Trim(" \t\n\r");
 
       // Strip quotes
-      PRUnichar ch = systemId.First();
+      PRUnichar ch = systemId.Length() ? systemId.First() : '\0';
 
       if (ch == '"' || ch == '\'') {
         systemId.Cut(0, 1);
@@ -3168,7 +3168,7 @@ HTMLContentSink::AddDocTypeDecl(const nsIParserNode& aNode, PRInt32 aMode)
    */
   PRInt32 nameEnd = 0;
 
-  if (name.First() != '"' && name.First() != '\'') {
+  if (name.Length() && name.First() != '"' && name.First() != '\'') {
     nameEnd = name.FindCharInSet(" \n\r\t");
   }
 
@@ -3180,7 +3180,7 @@ HTMLContentSink::AddDocTypeDecl(const nsIParserNode& aNode, PRInt32 aMode)
     name.Mid(publicId, nameEnd, name.Length() - nameEnd);
     publicId.Trim(" \t\n\r");
 
-    PRUnichar ch = publicId.First();
+    PRUnichar ch = publicId.Length() ? publicId.First() : '\0';
 
     if (ch == '"' || ch == '\'') {
       publicId.Cut(0, 1);
diff --git a/mozilla/parser/htmlparser/src/nsViewSourceHTML.cpp b/mozilla/parser/htmlparser/src/nsViewSourceHTML.cpp
index 3260646a401..b9623e88301 100644
--- a/mozilla/parser/htmlparser/src/nsViewSourceHTML.cpp
+++ b/mozilla/parser/htmlparser/src/nsViewSourceHTML.cpp
@@ -665,11 +665,11 @@ nsresult WriteText(const nsString& aTextString,nsIContentSink& aSink,PRBool aPre
   PRUnichar theNextChar=0;
 
   while(++theOffset<theEnd){
-    theNextChar=aTextString[theOffset-1];
+    //theNextChar=aTextString[theOffset-1];
     theChar=aTextString[theOffset];
     switch(theChar){
       case kSpace:
-        theNextChar=aTextString[theOffset+1];
+        theNextChar=(theOffset+1 != theEnd) ? aTextString[theOffset+1] : '\0';
         if((!aPlainText) && aPreserveSpace) { //&& ((kSpace==theNextChar) || (0==theNextChar)))
           if(theTextOffset<theOffset) {
             if(kSpace==theNextChar) {
@@ -705,7 +705,7 @@ nsresult WriteText(const nsString& aTextString,nsIContentSink& aSink,PRBool aPre
           theTextOffset=theOffset--;  //back up one on purpose...
         }
         else {
-          theNextChar=aTextString.CharAt(theOffset+1);
+          theNextChar=(theOffset+1 != theEnd) ? aTextString.CharAt(theOffset+1) : '\0';
           if((kCR==theChar) && (kLF==theNextChar)) {
             theOffset++;
           }