Merge branch 'ported-upstream'

4 files changed, 15 insertions, 10 deletions

diff --git a/layout/base/nsDocumentViewer.cpp b/layout/base/nsDocumentViewer.cpp
index 782ac332c..137efb3cd 100644
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -1617,7 +1617,6 @@ nsDocumentViewer::Destroy()
   // We also keep the viewer from being cached in session history, since
   // we require all documents there to be sanitized.
   if (mDestroyRefCount != 0) {
-    --mDestroyRefCount;
     return NS_OK;
   }
 
@@ -4426,6 +4425,12 @@ nsDocumentViewer::IncrementDestroyRefCount()
   ++mDestroyRefCount;
 }
 
+void
+nsDocumentViewer::DecrementDestroyRefCount()
+{
+  --mDestroyRefCount;
+}
+
 //------------------------------------------------------------
 
 #if defined(NS_PRINTING) && defined(NS_PRINT_PREVIEW)
diff --git a/layout/base/nsIDocumentViewerPrint.h b/layout/base/nsIDocumentViewerPrint.h
index 8bc2465a1..e3c397f3a 100644
--- a/layout/base/nsIDocumentViewerPrint.h
+++ b/layout/base/nsIDocumentViewerPrint.h
@@ -41,6 +41,7 @@ public:
   virtual mozilla::StyleSetHandle CreateStyleSet(nsIDocument* aDocument) = 0;
 
   virtual void IncrementDestroyRefCount() = 0;
+  virtual void DecrementDestroyRefCount() = 0;
 
   virtual void ReturnToGalleyPresentation() = 0;
 
@@ -75,6 +76,7 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIDocumentViewerPrint,
   bool GetIsPrintPreview() override; \
   mozilla::StyleSetHandle CreateStyleSet(nsIDocument* aDocument) override; \
   void IncrementDestroyRefCount() override; \
+  void DecrementDestroyRefCount() override; \
   void ReturnToGalleyPresentation() override; \
   void OnDonePrinting() override; \
   bool IsInitializedForPrintPreview() override; \
diff --git a/layout/generic/nsTextFrame.cpp b/layout/generic/nsTextFrame.cpp
index b9848bcf1..00c0016fd 100644
--- a/layout/generic/nsTextFrame.cpp
+++ b/layout/generic/nsTextFrame.cpp
@@ -9751,9 +9751,13 @@ nsTextFrame::GetRenderedText(uint32_t aStartOffset,
       startOffset = aStartOffset;
       endOffset = std::min<uint32_t>(INT32_MAX, aEndOffset);
     }
+
+    // If startOffset and/or endOffset are inside of trimmedOffsets' range,
+    // then clamp the edges of trimmedOffsets accordingly.
+    int32_t origTrimmedOffsetsEnd = trimmedOffsets.GetEnd();
     trimmedOffsets.mStart = std::max<uint32_t>(trimmedOffsets.mStart,
         startOffset);
-    trimmedOffsets.mLength = std::min<uint32_t>(trimmedOffsets.GetEnd(),
+    trimmedOffsets.mLength = std::min<uint32_t>(origTrimmedOffsetsEnd,
         endOffset) - trimmedOffsets.mStart;
     if (trimmedOffsets.mLength <= 0) {
       offsetInRenderedString = nextOffsetInRenderedString;
diff --git a/layout/printing/nsPagePrintTimer.cpp b/layout/printing/nsPagePrintTimer.cpp
index b56569a9a..164b0469a 100644
--- a/layout/printing/nsPagePrintTimer.cpp
+++ b/layout/printing/nsPagePrintTimer.cpp
@@ -14,14 +14,8 @@ NS_IMPL_ISUPPORTS_INHERITED(nsPagePrintTimer, mozilla::Runnable, nsITimerCallbac
 
 nsPagePrintTimer::~nsPagePrintTimer()
 {
-  // "Destroy" the document viewer; this normally doesn't actually
-  // destroy it because of the IncrementDestroyRefCount call below
-  // XXX This is messy; the document viewer should use a single approach
-  // to keep itself alive during printing
-  nsCOMPtr<nsIContentViewer> cv(do_QueryInterface(mDocViewerPrint));
-  if (cv) {
-    cv->Destroy();
-  }
+  // This matches the IncrementDestroyRefCount call in the constructor.
+  mDocViewerPrint->DecrementDestroyRefCount();
 }
 
 nsresult