diff --git a/mozilla/xpcom/string/src/nsTSubstring.cpp b/mozilla/xpcom/string/src/nsTSubstring.cpp
index 6c840cfbbab..378863e0824 100644
--- a/mozilla/xpcom/string/src/nsTSubstring.cpp
+++ b/mozilla/xpcom/string/src/nsTSubstring.cpp
@@ -426,6 +426,8 @@ nsTSubstring_CharT::Replace( index_type cutStart, size_type cutLength, const cha
           }
       }
 
+    cutStart = PR_MIN(cutStart, Length());
+
     ReplacePrep(cutStart, cutLength, length);
 
     if (length > 0)
@@ -449,6 +451,8 @@ nsTSubstring_CharT::ReplaceASCII( index_type cutStart, size_type cutLength, cons
       }
 #endif
 
+    cutStart = PR_MIN(cutStart, Length());
+
     ReplacePrep(cutStart, cutLength, length);
 
     if (length > 0)
@@ -467,6 +471,8 @@ nsTSubstring_CharT::Replace( index_type cutStart, size_type cutLength, const sub
 
     size_type length = tuple.Length();
 
+    cutStart = PR_MIN(cutStart, Length());
+
     ReplacePrep(cutStart, cutLength, length);
 
     if (length > 0)