diff --git a/layout/base/nsBidiPresUtils.cpp b/layout/base/nsBidiPresUtils.cpp
--- a/layout/base/nsBidiPresUtils.cpp
+++ b/layout/base/nsBidiPresUtils.cpp
@@ -426,19 +426,21 @@ nsBidiPresUtils::Resolve(nsBlockFrame*  
           propTable->SetProperty(frame, nsGkAtoms::embeddingLevel,
                                  NS_INT32_TO_PTR(embeddingLevel),
                                  nsnull, nsnull);
           propTable->SetProperty(frame, nsGkAtoms::baseLevel,
                                  NS_INT32_TO_PTR(paraLevel), nsnull, nsnull);
           continue;
         }
         PRInt32 start, end;
         frame->GetOffsets(start, end);
-        fragmentLength = end - start;
+        NS_ASSERTION(!(contentTextLength < end - start),
+                     "Frame offsets don't fit in content");
+        fragmentLength = NS_MIN(contentTextLength, end - start);
         contentOffset = start;
         isTextFrame = PR_TRUE;
       }
       else {
         /*
          * Any non-text frame corresponds to a single character in the text buffer
          * (a bidi control character, LINE SEPARATOR, or OBJECT SUBSTITUTE)
          */
         isTextFrame = PR_FALSE;
