--- a/intl/uconv/src/nsConverterInputStream.cpp
+++ b/intl/uconv/src/nsConverterInputStream.cpp
@@ -249,17 +249,18 @@ nsConverterInputStream::Fill(nsresult * 
       // XXX this is needed to make sure we don't underrun our buffer;
       // bug 160784 again
       srcConsumed = PR_MAX(srcConsumed, 0);
       mConverter->Reset();
     }
     NS_ASSERTION(srcConsumed <= mByteData->GetLength(),
                  "Whoa.  The converter should have returned NS_OK_UDEC_MOREINPUT before this point!");
   } while (mReplacementChar &&
-           NS_FAILED(*aErrorCode));
+           NS_FAILED(*aErrorCode) &&
+           mUnicharData->GetBufferSize() > mUnicharDataLength);
 
   mLeftOverBytes = mByteData->GetLength() - srcConsumed;
 
   return mUnicharDataLength;
 }
 
 NS_IMETHODIMP
 nsConverterInputStream::ReadLine(nsAString& aLine, PRBool* aResult)