Overshooting when measuring the text caused things to go out-of-sync and to hang, b=142206, r=shanjian, sr=dbaron, a=asa

gfx/src/gtk/nsRenderingContextGTK.cpp

@@ -1672,7 +1672,7 @@ do_BreakGetTextDimensions(const nsFontSwitchGTK *aFontSwitch,
         // and the end of the text
         if ((breakIndex < (data->mNumBreaks - 1)) && (data->mBreaks[breakIndex] < i)) {
           ++breakIndex;
-          numChars = data->mBreaks[breakIndex] - start;
+          numChars = PR_MIN(data->mBreaks[breakIndex] - start, (PRInt32)aSubstringLength);
         }
         else {
           NS_ASSERTION(i != data->mBreaks[breakIndex], "don't expect to be at segment boundary");

gfx/src/os2/nsRenderingContextOS2.cpp

@@ -1702,7 +1702,7 @@ do_BreakGetTextDimensions(const nsFontSwitch* aFontSwitch,
         // and the end of the text
         if ((breakIndex < (data->mNumBreaks - 1)) && (data->mBreaks[breakIndex] < i)) {
           ++breakIndex;
-          numChars = data->mBreaks[breakIndex] - start;
+          numChars = PR_MIN(data->mBreaks[breakIndex] - start, (PRInt32)aSubstringLength);
         }
         else {
           NS_ASSERTION(i != data->mBreaks[breakIndex], "don't expect to be at segment boundary");

gfx/src/windows/nsRenderingContextWin.cpp

@@ -1847,7 +1847,7 @@ do_BreakGetTextDimensions(const nsFontSwitch* aFontSwitch,
         // and the end of the text
         if ((breakIndex < (data->mNumBreaks - 1)) && (data->mBreaks[breakIndex] < i)) {
           ++breakIndex;
-          numChars = data->mBreaks[breakIndex] - start;
+          numChars = PR_MIN(data->mBreaks[breakIndex] - start, (PRInt32)aSubstringLength);
         }
         else {
           NS_ASSERTION(i != data->mBreaks[breakIndex], "don't expect to be at segment boundary");

gfx/src/xlib/nsRenderingContextXlib.cpp

@@ -1674,7 +1674,7 @@ do_BreakGetTextDimensions(const nsFontSwitchXlib *aFontSwitch,
         // and the end of the text
         if ((breakIndex < (data->mNumBreaks - 1)) && (data->mBreaks[breakIndex] < i)) {
           ++breakIndex;
-          numChars = data->mBreaks[breakIndex] - start;
+          numChars = PR_MIN(data->mBreaks[breakIndex] - start, (PRInt32)aSubstringLength);
         }
         else {
           NS_ASSERTION(i != data->mBreaks[breakIndex], "don't expect to be at segment boundary");

layout/generic/nsTextFrame.cpp

@@ -4915,7 +4915,8 @@ nsTextFrame::MeasureText(nsIPresContext*          aPresContext,
 
     // Find the index of the last segment that fit
     PRInt32 lastSegment;
-    if (numCharsFit == textRun.mTotalNumChars) { // fast path, normal case
+    if (numCharsFit >= textRun.mTotalNumChars) { // fast path, normal case
+      NS_ASSERTION(numCharsFit == textRun.mTotalNumChars, "shouldn't overshoot");
       lastSegment = textRun.mNumSegments - 1;
     } else {
       for (lastSegment = 0; textRun.mBreaks[lastSegment] < numCharsFit; lastSegment++) ;

layout/html/base/src/nsTextFrame.cpp

@@ -4915,7 +4915,8 @@ nsTextFrame::MeasureText(nsIPresContext*          aPresContext,
 
     // Find the index of the last segment that fit
     PRInt32 lastSegment;
-    if (numCharsFit == textRun.mTotalNumChars) { // fast path, normal case
+    if (numCharsFit >= textRun.mTotalNumChars) { // fast path, normal case
+      NS_ASSERTION(numCharsFit == textRun.mTotalNumChars, "shouldn't overshoot");
       lastSegment = textRun.mNumSegments - 1;
     } else {
       for (lastSegment = 0; textRun.mBreaks[lastSegment] < numCharsFit; lastSegment++) ;