--- a/layout/svg/base/src/nsSVGTextContainerFrame.cpp
+++ b/layout/svg/base/src/nsSVGTextContainerFrame.cpp
@@ -213,17 +213,17 @@ float
 nsSVGTextContainerFrame::GetSubStringLength(PRUint32 charnum, PRUint32 nchars)
 {
   float length = 0.0f;
   nsISVGGlyphFragmentNode *node = GetFirstGlyphFragmentChildNode();
 
   while (node) {
     PRUint32 count = node->GetNumberOfChars();
     if (count > charnum) {
-      PRUint32 fragmentChars = NS_MIN(nchars, count);
+      PRUint32 fragmentChars = NS_MIN(nchars, count - charnum);
       float fragmentLength = node->GetSubStringLength(charnum, fragmentChars);
       length += fragmentLength;
       nchars -= fragmentChars;
       if (nchars == 0) break;
     }
     charnum -= NS_MIN(charnum, count);
     node = GetNextGlyphFragmentChildNode(node);
   }