Don't overshoot the last sibling when iterating frames.
Bug 66329, r=roc
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/663295.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html><html style="font-size-adjust: 193373343913878; white-space: pre-line;"><body onload="document.documentElement.style.MozColumnGap='1px';"><span>A B C
+ت</span></body></html>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -326,8 +326,9 @@ load 616495-single-side-composite-color-
load 629035-1.html
load 629908-1.html
load 635329.html
== 640272.html 640272-ref.html
load 645193.html
load 650475.xhtml
load 650489.xhtml
load 653133-1.html
+load 663295.html
--- a/layout/base/nsBidiPresUtils.cpp
+++ b/layout/base/nsBidiPresUtils.cpp
@@ -770,17 +770,17 @@ nsBidiPresUtils::TraverseFrames(nsBlockF
* element.
*/
++endLine;
/*
* If the frame ends before the new line, save the text and move
* into the next continuation
*/
- while (end < endLine) {
+ while (end < endLine && nextSibling) {
mBuffer.Append(Substring(text, start, end - start));
frame = frame->GetNextContinuation();
NS_ASSERTION(frame, "Premature end of continuation chain");
frame->GetOffsets(start, end);
mLogicalFrames.AppendElement(frame);
AdvanceLineIteratorToFrame(frame, aLineIter, mPrevFrame);
mLinePerFrame.AppendElement(aLineIter->GetLine().get());
