diff --git a/layout/generic/nsBulletFrame.cpp b/layout/generic/nsBulletFrame.cpp
index a11a35d7ed7c..51108eab1f8f 100644
--- a/layout/generic/nsBulletFrame.cpp
+++ b/layout/generic/nsBulletFrame.cpp
@@ -459,8 +459,12 @@ static bool DecimalLeadingZeroToText(int32_t ordinal, nsString& result)
static bool OtherDecimalToText(int32_t ordinal, PRUnichar zeroChar, nsString& result)
{
PRUnichar diff = zeroChar - PRUnichar('0');
+ // We're going to be appending to whatever is in "result" already, so make
+ // sure to only munge the new bits. Note that we can't just grab the pointer
+ // to the new stuff here, since appending to the string can realloc.
+ size_t offset = result.Length();
DecimalToText(ordinal, result);
- PRUnichar* p = result.BeginWriting();
+ PRUnichar* p = result.BeginWriting() + offset;
if (ordinal < 0) {
// skip the leading '-'
++p;
@@ -472,12 +476,16 @@ static bool OtherDecimalToText(int32_t ordinal, PRUnichar zeroChar, nsString& re
static bool TamilToText(int32_t ordinal, nsString& result)
{
PRUnichar diff = 0x0BE6 - PRUnichar('0');
+ // We're going to be appending to whatever is in "result" already, so make
+ // sure to only munge the new bits. Note that we can't just grab the pointer
+ // to the new stuff here, since appending to the string can realloc.
+ size_t offset = result.Length();
DecimalToText(ordinal, result);
if (ordinal < 1 || ordinal > 9999) {
// Can't do those in this system.
return false;
}
- PRUnichar* p = result.BeginWriting();
+ PRUnichar* p = result.BeginWriting() + offset;
for(; '\0' != *p ; p++)
if(*p != PRUnichar('0'))
*p += diff;
diff --git a/layout/reftests/counters/multiple-thai-counters-ref.html b/layout/reftests/counters/multiple-thai-counters-ref.html
new file mode 100644
index 000000000000..cb2e921c1f63
--- /dev/null
+++ b/layout/reftests/counters/multiple-thai-counters-ref.html
@@ -0,0 +1,9 @@
+
+
+
diff --git a/layout/reftests/counters/multiple-thai-counters.html b/layout/reftests/counters/multiple-thai-counters.html
new file mode 100644
index 000000000000..0e37af4d0b18
--- /dev/null
+++ b/layout/reftests/counters/multiple-thai-counters.html
@@ -0,0 +1,12 @@
+
+
+
diff --git a/layout/reftests/counters/reftest.list b/layout/reftests/counters/reftest.list
index 966ff4359c58..dac56d880d29 100644
--- a/layout/reftests/counters/reftest.list
+++ b/layout/reftests/counters/reftest.list
@@ -67,3 +67,4 @@
== counter-ua-limits-03.html counter-ua-limits-03-ref.html
== counter-ua-limits-list-00.html counter-ua-limits-list-00-ref.html
== counter-ua-limits-list-01.html counter-ua-limits-list-01-ref.html
+== multiple-thai-counters.html multiple-thai-counters-ref.html