From ff9c87f68acb36dcf2ad5075b3e18eec82ec7deb Mon Sep 17 00:00:00 2001
From: "shanjian%netscape.com"
 <shanjian%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 10 Jul 2000 22:32:54 +0000
Subject: [PATCH] #42422 Fix the crash, contentLen should not be extended
 futher than the text fragment's length.

git-svn-id: svn://10.0.0.236/trunk@73957 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/layout/generic/nsTextFrame.cpp       | 7 +++++--
 mozilla/layout/html/base/src/nsTextFrame.cpp | 7 +++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/mozilla/layout/generic/nsTextFrame.cpp b/mozilla/layout/generic/nsTextFrame.cpp
index 4660dba95f9..394febc5455 100644
--- a/mozilla/layout/generic/nsTextFrame.cpp
+++ b/mozilla/layout/generic/nsTextFrame.cpp
@@ -3685,8 +3685,11 @@ nsTextFrame::MeasureText(nsIPresContext*          aPresContext,
         // XXX need a lookup function here; plus look ahead using the
         // text-runs
         if ((firstChar == '\'') || (firstChar == '\"')) {
-          wordLen = 2;
-          contentLen = 2;
+          if (contentLen > 1)
+          {
+            wordLen = 2;
+            contentLen = 2;
+          }
         }
         else {
           wordLen = 1;
diff --git a/mozilla/layout/html/base/src/nsTextFrame.cpp b/mozilla/layout/html/base/src/nsTextFrame.cpp
index 4660dba95f9..394febc5455 100644
--- a/mozilla/layout/html/base/src/nsTextFrame.cpp
+++ b/mozilla/layout/html/base/src/nsTextFrame.cpp
@@ -3685,8 +3685,11 @@ nsTextFrame::MeasureText(nsIPresContext*          aPresContext,
         // XXX need a lookup function here; plus look ahead using the
         // text-runs
         if ((firstChar == '\'') || (firstChar == '\"')) {
-          wordLen = 2;
-          contentLen = 2;
+          if (contentLen > 1)
+          {
+            wordLen = 2;
+            contentLen = 2;
+          }
         }
         else {
           wordLen = 1;