From c19cfc94846dbb67aaaa9903a6be07a77afd20b7 Mon Sep 17 00:00:00 2001
From: "mrbkap%gmail.com"
 <mrbkap%gmail.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 31 Jan 2005 00:54:53 +0000
Subject: [PATCH] bug 280387: Fix a potential crash by passing PR_TRUE for the
 aReverse paramter to nsScanner::SetPosition(). r+sr=bzbarsky

git-svn-id: svn://10.0.0.236/trunk@168538 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/parser/htmlparser/src/nsHTMLTokens.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp b/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp
index d9d351bdc32..b528ed644c8 100644
--- a/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp
+++ b/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp
@@ -879,7 +879,12 @@ nsresult CTextToken::ConsumeParsedCharacterData(PRUnichar aChar,
                               *end == '\r' || *end == '\b')) {
           aFound = PR_TRUE;
           mTextValue.Rebind(theContent.str());
-          aScanner.SetPosition(currPos);
+
+          // Note: This SetPosition() is actually going backwards from the
+          // scanner's mCurrentPosition (so we pass aReverse == PR_TRUE). This
+          // is because we call GetChar() above after we get the current
+          // position.
+          aScanner.SetPosition(currPos, PR_FALSE, PR_TRUE);
           break;
         }
       }