diff --git a/layout/generic/nsTextFrame.cpp b/layout/generic/nsTextFrame.cpp
index 70155e1bb70..512984de544 100644
--- a/layout/generic/nsTextFrame.cpp
+++ b/layout/generic/nsTextFrame.cpp
@@ -827,6 +827,8 @@ TextFrame::PaintUnicodeText(nsIPresContext& aPresContext,
       }
       if (selectionEnd > textLength)
         selectionEnd = textLength;
+      if (selectionOffset > textLength)
+        selectionOffset = textLength;
       if (selectionOffset == selectionEnd){
         aRenderingContext.DrawString(text, textLength, dx, dy, width);
         PaintTextDecorations(aRenderingContext, aStyleContext,
@@ -1263,7 +1265,7 @@ TextFrame::PaintAsciiText(nsIPresContext& aPresContext,
 
   char* text = paintBuf;
   if (0 != textLength) {
-    if (!displaySelection || !mSelected) {
+    if (!displaySelection || !mSelected || mSelectionOffset > mContentLength) { 
       // When there is no selection showing, use the fastest and
       // simplest rendering approach
       aRenderingContext.DrawString(text, textLength, dx, dy, width);
@@ -1288,6 +1290,10 @@ TextFrame::PaintAsciiText(nsIPresContext& aPresContext,
         selectionEnd = mSelectionOffset;
         selectionOffset = mSelectionEnd;
       }
+      if (selectionEnd > textLength)
+        selectionEnd = textLength;
+      if (selectionOffset > textLength)
+        selectionOffset = textLength;
 
       if (selectionOffset == selectionEnd){
         aRenderingContext.DrawString(text, textLength, dx, dy, width);
diff --git a/layout/html/base/src/nsTextFrame.cpp b/layout/html/base/src/nsTextFrame.cpp
index 70155e1bb70..512984de544 100644
--- a/layout/html/base/src/nsTextFrame.cpp
+++ b/layout/html/base/src/nsTextFrame.cpp
@@ -827,6 +827,8 @@ TextFrame::PaintUnicodeText(nsIPresContext& aPresContext,
       }
       if (selectionEnd > textLength)
         selectionEnd = textLength;
+      if (selectionOffset > textLength)
+        selectionOffset = textLength;
       if (selectionOffset == selectionEnd){
         aRenderingContext.DrawString(text, textLength, dx, dy, width);
         PaintTextDecorations(aRenderingContext, aStyleContext,
@@ -1263,7 +1265,7 @@ TextFrame::PaintAsciiText(nsIPresContext& aPresContext,
 
   char* text = paintBuf;
   if (0 != textLength) {
-    if (!displaySelection || !mSelected) {
+    if (!displaySelection || !mSelected || mSelectionOffset > mContentLength) { 
       // When there is no selection showing, use the fastest and
       // simplest rendering approach
       aRenderingContext.DrawString(text, textLength, dx, dy, width);
@@ -1288,6 +1290,10 @@ TextFrame::PaintAsciiText(nsIPresContext& aPresContext,
         selectionEnd = mSelectionOffset;
         selectionOffset = mSelectionEnd;
       }
+      if (selectionEnd > textLength)
+        selectionEnd = textLength;
+      if (selectionOffset > textLength)
+        selectionOffset = textLength;
 
       if (selectionOffset == selectionEnd){
         aRenderingContext.DrawString(text, textLength, dx, dy, width);