--- a/gfx/thebes/gfxUserFontSet.cpp
+++ b/gfx/thebes/gfxUserFontSet.cpp
@@ -188,27 +188,32 @@ gfxUserFontSet::FindFontEntry(const nsAS
         aWaitForUserFont =
             (proxyEntry->mLoadingState < gfxProxyFontEntry::LOADING_SLOWLY);
         return nsnull;
     }
 
     // hasn't been loaded yet, start the load process
     LoadStatus status;
 
+    // NOTE that if all sources in the entry fail, this will delete proxyEntry,
+    // so we cannot use it again if status==STATUS_END_OF_LIST
     status = LoadNext(proxyEntry);
 
     // if the load succeeded immediately, the font entry was replaced so
     // search again
     if (status == STATUS_LOADED) {
         return family->FindFontForStyle(aFontStyle, aNeedsBold);
     }
 
+    // check whether we should wait for load to complete before painting
+    // a fallback font -- but not if all sources failed (bug 633500)
+    aWaitForUserFont = (status != STATUS_END_OF_LIST) &&
+        (proxyEntry->mLoadingState < gfxProxyFontEntry::LOADING_SLOWLY);
+
     // if either loading or an error occurred, return null
-    aWaitForUserFont =
-        (proxyEntry->mLoadingState < gfxProxyFontEntry::LOADING_SLOWLY);
     return nsnull;
 }
 
 // Given a buffer of downloaded font data, do any necessary preparation
 // to make it into usable OpenType.
 // May return the original pointer unchanged, or a newly-allocated
 // block (in which case the passed-in block is NS_Free'd).
 // aLength is updated if necessary to the new length of the data.