Bug 1116714 part 0 - Iterate forward instead, to avoid depending on undefined integer behavior. r=roc

dom/base/nsDocument.cpp

@@ -5300,8 +5300,8 @@ nsIDocument::RemoveAnonymousContent(AnonymousContent& aContent,
     return;
   }
 
-  // Iterate over know customContents to get and remove the right one
-  for (int32_t i = mAnonymousContents.Length() - 1; i >= 0; --i) {
+  // Iterate over mAnonymousContents to find and remove the given node.
+  for (size_t i = 0, len = mAnonymousContents.Length(); i < len; ++i) {
     if (mAnonymousContents[i] == &aContent) {
       // Get the node from the customContent
       nsCOMPtr<Element> node = aContent.GetContentNode();

layout/generic/nsCanvasFrame.cpp

@@ -120,8 +120,8 @@ nsCanvasFrame::CreateAnonymousContent(nsTArray<ContentInfo>& aElements)
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Append all existing AnonymousContent nodes stored at document level if any.
-  int32_t anonymousContentCount = doc->GetAnonymousContents().Length();
-  for (int32_t i = 0; i < anonymousContentCount; ++i) {
+  size_t len = doc->GetAnonymousContents().Length();
+  for (size_t i = 0; i < len; ++i) {
     nsCOMPtr<Element> node = doc->GetAnonymousContents()[i]->GetContentNode();
     mCustomContentContainer->AppendChildTo(node->AsContent(), true);
   }
@@ -167,8 +167,10 @@ nsCanvasFrame::DestroyFrom(nsIFrame* aDestructRoot)
     nsCOMPtr<nsIDocument> doc = mContent->OwnerDoc();
     ErrorResult rv;
 
-    for (int32_t i = doc->GetAnonymousContents().Length() - 1; i >= 0; --i) {
-      AnonymousContent* content = doc->GetAnonymousContents()[i];
+    nsTArray<nsRefPtr<mozilla::dom::AnonymousContent>>& docAnonContents =
+      doc->GetAnonymousContents();
+    for (size_t i = 0, len = docAnonContents.Length(); i < len; ++i) {
+      AnonymousContent* content = docAnonContents[i];
       nsCOMPtr<nsINode> clonedElement = content->GetContentNode()->CloneNode(true, rv);
       content->SetContentNode(clonedElement->AsElement());
     }