Bug 1291082 part.3 ContentCache::TextRectArray::GetUnionRectAsFarAsPossible() should avoid crash by itself r=m_kato

ContentCache::TextRectArray::GetUnionRectAsFarAsPossible() should avoid crash by itself even if it's caller's bug. This makes parent process more stable, that is what one of the purpose of e10s is.

MozReview-Commit-ID: qKAfvm6eZw

widget/ContentCache.cpp

@@ -1311,10 +1311,9 @@ ContentCache::TextRectArray::GetUnionRectAsFarAsPossible(
                                uint32_t aLength,
                                bool aRoundToExistingOffset) const
 {
-  MOZ_ASSERT(HasRects());
-
   LayoutDeviceIntRect rect;
-  if (!aRoundToExistingOffset && !IsOverlappingWith(aOffset, aLength)) {
+  if (!HasRects() ||
+      (!aRoundToExistingOffset && !IsOverlappingWith(aOffset, aLength))) {
     return rect;
   }
   uint32_t startOffset = std::max(aOffset, mStart);
@@ -1325,6 +1324,9 @@ ContentCache::TextRectArray::GetUnionRectAsFarAsPossible(
   if (aRoundToExistingOffset && endOffset < mStart + 1) {
     endOffset = mStart + 1;
   }
+  if (NS_WARN_IF(endOffset < startOffset)) {
+    return rect;
+  }
   for (uint32_t i = 0; i < endOffset - startOffset; i++) {
     rect = rect.Union(mRects[startOffset - mStart + i]);
   }