diff --git a/mozilla/content/base/src/nsContentIterator.cpp b/mozilla/content/base/src/nsContentIterator.cpp
index 3419154efe8..77c2ed1ab2c 100644
--- a/mozilla/content/base/src/nsContentIterator.cpp
+++ b/mozilla/content/base/src/nsContentIterator.cpp
@@ -232,7 +232,7 @@ nsresult nsContentIterator::Init(nsIContent* aRoot)
 {
   if (!aRoot) 
     return NS_ERROR_NULL_POINTER; 
-
+  mIsDone = PR_FALSE;
   nsCOMPtr<nsIContent> root( do_QueryInterface(aRoot) );
   mFirst = GetDeepFirstChild(root); 
   mLast = root;
diff --git a/mozilla/layout/base/src/nsContentIterator.cpp b/mozilla/layout/base/src/nsContentIterator.cpp
index 3419154efe8..77c2ed1ab2c 100644
--- a/mozilla/layout/base/src/nsContentIterator.cpp
+++ b/mozilla/layout/base/src/nsContentIterator.cpp
@@ -232,7 +232,7 @@ nsresult nsContentIterator::Init(nsIContent* aRoot)
 {
   if (!aRoot) 
     return NS_ERROR_NULL_POINTER; 
-
+  mIsDone = PR_FALSE;
   nsCOMPtr<nsIContent> root( do_QueryInterface(aRoot) );
   mFirst = GetDeepFirstChild(root); 
   mLast = root;
diff --git a/mozilla/layout/base/src/nsRangeList.cpp b/mozilla/layout/base/src/nsRangeList.cpp
index 06f8d350e3d..b3255b7b618 100644
--- a/mozilla/layout/base/src/nsRangeList.cpp
+++ b/mozilla/layout/base/src/nsRangeList.cpp
@@ -485,6 +485,7 @@ nsRangeList::nsRangeList()
     sCellAtom = NS_NewAtom("td");
     sTbodyAtom = NS_NewAtom("tbody");
   }
+  mHint = HINTLEFT;
   sInstanceCount ++;
 }
 
@@ -1648,10 +1649,16 @@ nsDOMSelection::selectFrames(nsIDOMRange *aRange, PRBool aFlags)
   if (!aRange) 
     return NS_ERROR_NULL_POINTER;
   nsCOMPtr<nsIContentIterator> iter;
+  nsCOMPtr<nsIContentIterator> inneriter;
   nsresult result = nsComponentManager::CreateInstance(kCSubtreeIteratorCID, nsnull,
                                               nsIContentIterator::GetIID(), 
                                               getter_AddRefs(iter));
-  if ((NS_SUCCEEDED(result)) && iter)
+  if (NS_FAILED(result))
+    return result;
+  result = nsComponentManager::CreateInstance(kCContentIteratorCID, nsnull,
+                                              nsIContentIterator::GetIID(), 
+                                              getter_AddRefs(inneriter));
+  if ((NS_SUCCEEDED(result)) && iter && inneriter)
   {
     iter->Init(aRange);
     // loop through the content iterator for each content node
@@ -1681,12 +1688,24 @@ nsDOMSelection::selectFrames(nsIDOMRange *aRange, PRBool aFlags)
         result = iter->CurrentNode(getter_AddRefs(content));
         if (NS_FAILED(result) || !content)
           return result;
-        result = mRangeList->GetTracker()->GetPrimaryFrameFor(content, &frame);
-        if (NS_SUCCEEDED(result) && frame)
-           frame->SetSelected(aRange,aFlags,eSpreadDown);//spread from here to hit all frames in flow
+        result = inneriter->Init(content);
+        if (NS_SUCCEEDED(result))
+        {
+          nsCOMPtr<nsIContent> innercontent;
+          while (NS_COMFALSE == inneriter->IsDone())
+          {
+            result = iter->CurrentNode(getter_AddRefs(innercontent));
+            if (NS_FAILED(result) || !innercontent)
+              continue;
+            result = mRangeList->GetTracker()->GetPrimaryFrameFor(innercontent, &frame);
+            if (NS_SUCCEEDED(result) && frame)
+              frame->SetSelected(aRange,aFlags,eSpreadDown);//spread from here to hit all frames in flow
+            result = inneriter->Next();
+            if (NS_FAILED(result))
+        	    return result;
+          }
+        }
         result = iter->Next();
-        if (NS_FAILED(result))
-      	  return result;
       }
     }
 //we must now do the last one  if it is not the same as the first
diff --git a/mozilla/layout/generic/nsTextFrame.cpp b/mozilla/layout/generic/nsTextFrame.cpp
index 31fcad6ad82..a2c44aaa057 100644
--- a/mozilla/layout/generic/nsTextFrame.cpp
+++ b/mozilla/layout/generic/nsTextFrame.cpp
@@ -1033,7 +1033,16 @@ nsTextFrame::GetPositionSlowly(nsIPresContext& aPresContext,
   if (!ts.mSmallCaps && !ts.mWordSpacing && !ts.mLetterSpacing) {
     return NS_ERROR_INVALID_ARG;
   }
+  nsIView * view;
+  nsPoint origin;
+  GetView(&view);
+  GetOffsetFromView(origin, &view);
 
+  if (aXCoord - origin.x <0)
+  {
+      *aNewContent = mContent;
+      aOffset =0;
+  }
   nsCOMPtr<nsIDocument> doc(getter_AddRefs(GetDocument(&aPresContext)));
 
   // Make enough space to transform
@@ -1047,6 +1056,7 @@ nsTextFrame::GetPositionSlowly(nsIPresContext& aPresContext,
     paintBuf = new PRUnichar[mContentLength];
   }
   PRInt32 textLength;
+  PRInt32 actualLength;
 
   // Transform text from content into renderable form
   nsCOMPtr<nsILineBreaker> lb;
@@ -1057,17 +1067,13 @@ nsTextFrame::GetPositionSlowly(nsIPresContext& aPresContext,
   PrepareUnicodeText(tx, ip, paintBuf, &textLength);
   if (textLength <= 0)
     return NS_ERROR_FAILURE;
-  nsPoint origin;
-  nsIView * view;
-  GetView(&view);
-  GetOffsetFromView(origin, &view);
+  actualLength = textLength;
 
   nscoord charWidth,widthsofar = 0;
   PRInt32 indx = 0;
   PRBool found = PR_FALSE;
   PRUnichar* startBuf = paintBuf;
   nsIFontMetrics* lastFont = ts.mLastFont;
-
   for (; --textLength >= 0; paintBuf++,indx++) {
     nsIFontMetrics* nextFont;
     nscoord glyphWidth;
@@ -1120,6 +1126,8 @@ nsTextFrame::GetPositionSlowly(nsIPresContext& aPresContext,
   paintBuf = startBuf;
   if (!found){
     aOffset = textLength;
+    if (aOffset <0)
+      aOffset = actualLength;//max length before textlength was reduced
   }
   aOffset += mContentOffset;//offset;//((nsTextFrame *)aNewFrame)->mContentOffset;
   PRInt32 i;
@@ -1945,7 +1953,7 @@ nsTextFrame::GetChildFrameContainingOffset(PRInt32 inContentOffset,
   if (inContentOffset < mContentOffset) //could happen with floaters!
   {
     result = GetPrevInFlow(outChildFrame);
-    if (NS_SUCCEEDED(result))
+    if (NS_SUCCEEDED(result) && outChildFrame)
       return (*outChildFrame)->GetChildFrameContainingOffset(inContentOffset, inHint,
         outFrameContentOffset,outChildFrame);
     else
diff --git a/mozilla/layout/html/base/src/nsTextFrame.cpp b/mozilla/layout/html/base/src/nsTextFrame.cpp
index 31fcad6ad82..a2c44aaa057 100644
--- a/mozilla/layout/html/base/src/nsTextFrame.cpp
+++ b/mozilla/layout/html/base/src/nsTextFrame.cpp
@@ -1033,7 +1033,16 @@ nsTextFrame::GetPositionSlowly(nsIPresContext& aPresContext,
   if (!ts.mSmallCaps && !ts.mWordSpacing && !ts.mLetterSpacing) {
     return NS_ERROR_INVALID_ARG;
   }
+  nsIView * view;
+  nsPoint origin;
+  GetView(&view);
+  GetOffsetFromView(origin, &view);
 
+  if (aXCoord - origin.x <0)
+  {
+      *aNewContent = mContent;
+      aOffset =0;
+  }
   nsCOMPtr<nsIDocument> doc(getter_AddRefs(GetDocument(&aPresContext)));
 
   // Make enough space to transform
@@ -1047,6 +1056,7 @@ nsTextFrame::GetPositionSlowly(nsIPresContext& aPresContext,
     paintBuf = new PRUnichar[mContentLength];
   }
   PRInt32 textLength;
+  PRInt32 actualLength;
 
   // Transform text from content into renderable form
   nsCOMPtr<nsILineBreaker> lb;
@@ -1057,17 +1067,13 @@ nsTextFrame::GetPositionSlowly(nsIPresContext& aPresContext,
   PrepareUnicodeText(tx, ip, paintBuf, &textLength);
   if (textLength <= 0)
     return NS_ERROR_FAILURE;
-  nsPoint origin;
-  nsIView * view;
-  GetView(&view);
-  GetOffsetFromView(origin, &view);
+  actualLength = textLength;
 
   nscoord charWidth,widthsofar = 0;
   PRInt32 indx = 0;
   PRBool found = PR_FALSE;
   PRUnichar* startBuf = paintBuf;
   nsIFontMetrics* lastFont = ts.mLastFont;
-
   for (; --textLength >= 0; paintBuf++,indx++) {
     nsIFontMetrics* nextFont;
     nscoord glyphWidth;
@@ -1120,6 +1126,8 @@ nsTextFrame::GetPositionSlowly(nsIPresContext& aPresContext,
   paintBuf = startBuf;
   if (!found){
     aOffset = textLength;
+    if (aOffset <0)
+      aOffset = actualLength;//max length before textlength was reduced
   }
   aOffset += mContentOffset;//offset;//((nsTextFrame *)aNewFrame)->mContentOffset;
   PRInt32 i;
@@ -1945,7 +1953,7 @@ nsTextFrame::GetChildFrameContainingOffset(PRInt32 inContentOffset,
   if (inContentOffset < mContentOffset) //could happen with floaters!
   {
     result = GetPrevInFlow(outChildFrame);
-    if (NS_SUCCEEDED(result))
+    if (NS_SUCCEEDED(result) && outChildFrame)
       return (*outChildFrame)->GetChildFrameContainingOffset(inContentOffset, inHint,
         outFrameContentOffset,outChildFrame);
     else