--- a/dom/base/nsHTMLContentSerializer.cpp
+++ b/dom/base/nsHTMLContentSerializer.cpp
@@ -526,17 +526,17 @@ nsHTMLContentSerializer::AppendAndTransl
     nsReadingIterator<char16_t> iter;
 
     const uint8_t* entityTable = mInAttribute ? kAttrEntities : kEntities;
     nsAutoCString entityReplacement;
 
     for (aStr.BeginReading(iter);
          iter != done_reading;
          iter.advance(int32_t(advanceLength))) {
-      uint32_t fragmentLength = iter.size_forward();
+      uint32_t fragmentLength = done_reading - iter;
       uint32_t lengthReplaced = 0; // the number of UTF-16 codepoints
                                     //  replaced by a particular entity
       const char16_t* c = iter.get();
       const char16_t* fragmentStart = c;
       const char16_t* fragmentEnd = c + fragmentLength;
       const char* entityText = nullptr;
       const char* fullConstEntityText = nullptr;
       char* fullEntityText = nullptr;