Add a bounds check in do_BreakGetTextDimensions. May or may not be related to the crashes reported in bug 196484. Author=roland.mainz@informatik.med.uni-giessen.de, r=smontagu, sr=rbs.

gfx/src/gtk/nsFontMetricsGTK.cpp

@@ -4166,7 +4166,8 @@ do_BreakGetTextDimensions(const nsFontSwitchGTK *aFontSwitch,
       // Find the nearest place to break that is less than or equal to
       // the estimated break offset
       breakIndex = data->mPrevBreakState_BreakIndex;
-      while (data->mBreaks[breakIndex + 1] <= estimatedBreakOffset) {
+      while (breakIndex + 1 < data->mNumBreaks &&
+             data->mBreaks[breakIndex + 1] <= estimatedBreakOffset) {
         ++breakIndex;
       }
 

gfx/src/os2/nsRenderingContextOS2.cpp

@@ -1647,7 +1647,8 @@ do_BreakGetTextDimensions(const nsFontSwitch* aFontSwitch,
       // Find the nearest place to break that is less than or equal to
       // the estimated break offset
       breakIndex = data->mPrevBreakState_BreakIndex;
-      while (data->mBreaks[breakIndex + 1] <= estimatedBreakOffset) {
+      while (breakIndex + 1 < data->mNumBreaks &&
+             data->mBreaks[breakIndex + 1] <= estimatedBreakOffset) {
         ++breakIndex;
       }
 

gfx/src/windows/nsRenderingContextWin.cpp

@@ -1814,7 +1814,8 @@ do_BreakGetTextDimensions(const nsFontSwitch* aFontSwitch,
       // Find the nearest place to break that is less than or equal to
       // the estimated break offset
       breakIndex = data->mPrevBreakState_BreakIndex;
-      while (data->mBreaks[breakIndex + 1] <= estimatedBreakOffset) {
+      while (breakIndex + 1 < data->mNumBreaks &&
+             data->mBreaks[breakIndex + 1] <= estimatedBreakOffset) {
         ++breakIndex;
       }
 

gfx/src/xlib/nsRenderingContextXlib.cpp

@@ -1679,7 +1679,8 @@ do_BreakGetTextDimensions(const nsFontSwitchXlib *aFontSwitch,
       // Find the nearest place to break that is less than or equal to
       // the estimated break offset
       breakIndex = data->mPrevBreakState_BreakIndex;
-      while (data->mBreaks[breakIndex + 1] <= estimatedBreakOffset) {
+      while (breakIndex + 1 < data->mNumBreaks &&
+             data->mBreaks[breakIndex + 1] <= estimatedBreakOffset) {
         ++breakIndex;
       }