From d370191df36d3a4a738109a647c6873f531540cf Mon Sep 17 00:00:00 2001
From: "jfrancis%netscape.com"
 <jfrancis%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Thu, 23 May 2002 22:05:35 +0000
Subject: [PATCH] fixing 136165: crash after deleting styled text.  r=cmanske
 sr=dveditz

git-svn-id: svn://10.0.0.236/trunk@122099 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../editor/libeditor/html/nsWSRunObject.cpp   | 28 +++++++++++++++++--
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/mozilla/editor/libeditor/html/nsWSRunObject.cpp b/mozilla/editor/libeditor/html/nsWSRunObject.cpp
index ded507a1bd4..bdad36b2e21 100644
--- a/mozilla/editor/libeditor/html/nsWSRunObject.cpp
+++ b/mozilla/editor/libeditor/html/nsWSRunObject.cpp
@@ -738,6 +738,12 @@ nsWSRunObject::GetWSNodes()
       PRInt32 pos;
       for (pos=mOffset-1; pos>=0; pos--)
       {
+        // sanity bounds check the char position.  bug 136165
+        if (pos >= textFrag->GetLength())
+        {
+          NS_NOTREACHED("looking beyond end of text fragment");
+          continue;
+        }
         PRUnichar theChar = textFrag->CharAt(pos);
         if (!nsCRT::IsAsciiSpace(theChar))
         {
@@ -801,6 +807,12 @@ nsWSRunObject::GetWSNodes()
           PRInt32 pos;
           for (pos=len-1; pos>=0; pos--)
           {
+            // sanity bounds check the char position.  bug 136165
+            if (pos >= textFrag->GetLength())
+            {
+              NS_NOTREACHED("looking beyond end of text fragment");
+              continue;
+            }
             PRUnichar theChar = textFrag->CharAt(pos);
             if (!nsCRT::IsAsciiSpace(theChar))
             {
@@ -862,6 +874,12 @@ nsWSRunObject::GetWSNodes()
       PRInt32 pos;
       for (pos=mOffset; pos<len; pos++)
       {
+        // sanity bounds check the char position.  bug 136165
+        if ((pos<0) || (pos>=textFrag->GetLength()))
+        {
+          NS_NOTREACHED("looking beyond end of text fragment");
+          continue;
+        }
         PRUnichar theChar = textFrag->CharAt(pos);
         if (!nsCRT::IsAsciiSpace(theChar))
         {
@@ -927,6 +945,12 @@ nsWSRunObject::GetWSNodes()
           PRInt32 pos;
           for (pos=0; pos<len; pos++)
           {
+            // sanity bounds check the char position.  bug 136165
+            if (pos >= textFrag->GetLength())
+            {
+              NS_NOTREACHED("looking beyond end of text fragment");
+              continue;
+            }
             PRUnichar theChar = textFrag->CharAt(pos);
             if (!nsCRT::IsAsciiSpace(theChar))
             {
@@ -1891,9 +1915,7 @@ nsWSRunObject::GetCharAt(nsITextContent *aTextNode, PRInt32 aOffset)
   nsresult res = aTextNode->GetText(&textFrag);
   NS_ENSURE_SUCCESS(res, 0);
   
-  PRInt32 len;
-  res = aTextNode->GetTextLength(&len);
-  NS_ENSURE_SUCCESS(res, 0);
+  PRInt32 len = textFrag->GetLength();
   if (!len) 
     return 0;
   if (aOffset>=len)