diff -pruN -x '.moz*' -x .deps -x 'thunderbird*' -x '*.mk' -x 'config*' -x dist -x build -x toolkit -x '*o' -x '*a' -x '*html' -x 'firefox*' mozilla.orig/layout/generic/nsTextFrame.cpp mozilla/layout/generic/nsTextFrame.cpp
--- mozilla.orig/layout/generic/nsTextFrame.cpp	2006-12-20 12:15:38.000000000 +0900
+++ mozilla/layout/generic/nsTextFrame.cpp	2006-12-20 21:29:39.000000000 +0900
@@ -2973,15 +2973,16 @@ nsTextFrame::RenderString(nsIRenderingCo
 
   nsIFontMetrics* lastFont = aTextStyle.mLastFont;
   PRInt32 pendingCount;
-  PRUnichar* runStart = bp;
+  PRUnichar* runStart = bp, *top = aBuffer;
   nscoord charWidth, width = 0;
   PRInt32 countSoFar = 0;
+  PRUint32 offset;
   // Save the color we want to use for the text, since calls to
   // PaintTextDecorations in this method will call SetColor() on the rendering
   // context.
   nscolor textColor;
   aRenderingContext.GetColor(textColor);
-  for (; --aLength >= 0; aBuffer++) {
+  for (offset = 0; offset < aLength; aBuffer++, offset++) {
     nsIFontMetrics* nextFont;
     nscoord glyphWidth = 0;
     PRUnichar ch = *aBuffer;
@@ -3038,7 +3039,7 @@ nsTextFrame::RenderString(nsIRenderingCo
     else if (ch == ' ') {
       glyphWidth += aTextStyle.mSpaceWidth + aTextStyle.mWordSpacing + aTextStyle.mLetterSpacing;
     }
-    else if (IS_HIGH_SURROGATE(ch) && aLength > 0 &&
+    else if (IS_HIGH_SURROGATE(ch) && (offset + 1) < aLength &&
            IS_LOW_SURROGATE(*(aBuffer+1))) {
       
       // special handling for surrogate pair
@@ -3046,7 +3047,7 @@ nsTextFrame::RenderString(nsIRenderingCo
       glyphWidth += charWidth + aTextStyle.mLetterSpacing;
       // copy the surrogate low
       *bp++ = ch;
-      --aLength;
+      offset++;
       aBuffer++;
       ch = *aBuffer;
       // put the width into the space buffer
@@ -3058,10 +3059,10 @@ nsTextFrame::RenderString(nsIRenderingCo
       glyphWidth = 0;
     }
     else {
-      aRenderingContext.GetWidth(ch, charWidth);
+      aRenderingContext.GetRangeWidth(top, aLength, offset, offset + 1, (PRUint32&)charWidth);
       glyphWidth += charWidth + aTextStyle.mLetterSpacing;
     }
-    if (justifying && (!isEndOfLine || aLength > 0)
+    if (justifying && (!isEndOfLine || (offset + 1) < aLength)
         && IsJustifiableCharacter(ch, isCJ)) {
       glyphWidth += aTextStyle.mExtraSpacePerJustifiableCharacter;
       if ((PRUint32)--aTextStyle.mNumJustifiableCharacterToRender