diff --git a/netwerk/base/src/nsUnicharStreamLoader.cpp b/netwerk/base/src/nsUnicharStreamLoader.cpp
--- a/netwerk/base/src/nsUnicharStreamLoader.cpp
+++ b/netwerk/base/src/nsUnicharStreamLoader.cpp
@@ -215,19 +215,22 @@ nsUnicharStreamLoader::WriteSegmentFun(n
                                  self->mBuffer.BeginWriting() + haveRead,
                                  &dstLen);
     haveRead += dstLen;
     // XXX if srcLen is negative, we want to drop the _first_ byte in
     // the erroneous byte sequence and try again.  This is not quite
     // possible right now -- see bug 160784
     consumed += srcLen;
     if (NS_FAILED(rv)) {
-      NS_ASSERTION(0 < capacity - haveRead,
-                   "Decoder returned an error but filled the output buffer! "
-                   "Should not happen.");
+      if (haveRead >= capacity) {
+        // Make room for writing the 0xFFFD below (bug 785753).
+        if (!self->mBuffer.SetCapacity(haveRead + 1, fallible_t())) {
+          return NS_ERROR_OUT_OF_MEMORY;
+        }
+      }
       self->mBuffer.BeginWriting()[haveRead++] = 0xFFFD;
       ++consumed;
       // XXX this is needed to make sure we don't underrun our buffer;
       // bug 160784 again
       consumed = NS_MAX<uint32_t>(consumed, 0);
       self->mDecoder->Reset();
     }
   } while (consumed < aCount);