bug 280387: Fix a potential crash by passing PR_TRUE for the aReverse paramter to nsScanner::SetPosition(). r+sr=bzbarsky

git-svn-id: svn://10.0.0.236/trunk@168538 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/parser/htmlparser/src/nsHTMLTokens.cpp

@@ -879,7 +879,12 @@ nsresult CTextToken::ConsumeParsedCharacterData(PRUnichar aChar,
                               *end == '\r' || *end == '\b')) {
           aFound = PR_TRUE;
           mTextValue.Rebind(theContent.str());
-          aScanner.SetPosition(currPos);
+
+          // Note: This SetPosition() is actually going backwards from the
+          // scanner's mCurrentPosition (so we pass aReverse == PR_TRUE). This
+          // is because we call GetChar() above after we get the current
+          // position.
+          aScanner.SetPosition(currPos, PR_FALSE, PR_TRUE);
           break;
         }
       }