Make sure that the offsets in a textframe are up-to-date before creating a bidi continuation. Bug 406675, r=uriber, sr=roc, blocking1.9=schrep

layout/base/nsBidiPresUtils.cpp

@@ -411,6 +411,7 @@ nsBidiPresUtils::Resolve(nsBlockFrame*   aBlockFrame,
         // IBMBIDI - Egypt - End
 
         if ( (runLength > 0) && (runLength < fragmentLength) ) {
+          frame->AdjustOffsetsForBidi(contentOffset, contentOffset + runLength);
           if (!EnsureBidiContinuation(frame, &nextBidi, frameIndex) ) {
             break;
           }
@@ -421,7 +422,6 @@ nsBidiPresUtils::Resolve(nsBlockFrame*   aBlockFrame,
             }
           }
           line->MarkDirty();
-          frame->AdjustOffsetsForBidi(contentOffset, contentOffset + runLength);
           frame = nextBidi;
           contentOffset += runLength;
         } // if (runLength < fragmentLength)

layout/generic/nsTextFrameThebes.cpp

@@ -3161,6 +3161,8 @@ nsContinuingTextFrame::Init(nsIContent* aContent,
   aPrevInFlow->SetNextInFlow(this);
   nsTextFrame* prev = static_cast<nsTextFrame*>(aPrevInFlow);
   mContentOffset = prev->GetContentOffset() + prev->GetContentLengthHint();
+  NS_ASSERTION(mContentOffset < aContent->GetText()->GetLength(),
+               "Creating ContinuingTextFrame, but there is no more content");
   if (prev->GetStyleContext() != GetStyleContext()) {
     // We're taking part of prev's text, and its style may be different
     // so clear its textrun which may no longer be valid (and don't set ours)