be carefull with row indices when deleting cells bug=364318, patch by bz, r=me sr=roc

layout/tables/nsCellMap.cpp

@@ -2050,12 +2050,19 @@ void nsCellMap::ShrinkWithoutCell(nsTableCellMap&   aMap,
   // remove the deleted cell and cellData entries for it
   for (rowX = aRowIndex; rowX <= endRowIndex; rowX++) {
     CellDataArray& row = mRows[rowX];
-    // Shift things by 1 so the aColIndex == 0 case works right with
-    // our unsigned int colX.
-    for (colX = endColIndex + 1; colX > PRUint32(aColIndex); colX--) {
-      DestroyCellData(row[colX-1]);
+
+    // endIndexForRow points at the first slot we don't want to clean up.  This
+    // makes the aColIndex == 0 case work right with our unsigned int colX.
+    NS_ASSERTION(endColIndex + 1 <= row.Length(), "span beyond the row size!");
+    PRUint32 endIndexForRow = PR_MIN(endColIndex + 1, row.Length());
+
+    // Since endIndexForRow <= row.Length(), enough to compare aColIndex to it.
+    if (PRUint32(aColIndex) < endIndexForRow) {
+      for (colX = endIndexForRow; colX > PRUint32(aColIndex); colX--) {
+        DestroyCellData(row[colX-1]);
+      }
+      row.RemoveElementsAt(aColIndex, endIndexForRow - aColIndex);
     }
-    row.RemoveElementsAt(aColIndex, endColIndex - aColIndex + 1);
   }
 
   numCols = aMap.GetColCount();

xpcom/glue/nsTArray.h

@@ -545,6 +545,8 @@ class nsTArray : public nsTArray_base {
     // @param start  The starting index of the elements to remove.
     // @param count  The number of elements to remove.
     void RemoveElementsAt(index_type start, size_type count) {
+      NS_ASSERTION(count == 0 || start < Length(), "Invalid start index");
+      NS_ASSERTION(start + count <= Length(), "Invalid length");
       DestructRange(start, count);
       ShiftData(start, count, 0, sizeof(elem_type));
     }