From 02c72c47b59ca96dca254376b224cd23b247650c Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Fri, 8 Apr 2011 14:29:34 -0700
Subject: [PATCH] Bug 645572 - Don't let the frame constructor's update count
 to become negative. r=sicking

--HG--
extra : rebase_source : 78cbdf15ff2d9bdd706db66176f65a3e4dc84c14
---
 layout/base/nsCSSFrameConstructor.cpp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index dd4e597e39f..2e15227cdac 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -8304,7 +8304,10 @@ nsCSSFrameConstructor::EndUpdate()
     RecalcQuotesAndCounters();
     NS_ASSERTION(mUpdateCount == 1, "Odd update count");
   }
-  --mUpdateCount;
+  // Negative update counts don't make sense
+  if (mUpdateCount > 0) {
+    --mUpdateCount;
+  }
 }
 
 void