nsRect bounds(mRect);  bounds.MoveBy(origin.x, origin.y); if (aPoint.y < bounds.y)
if (aPoint.y < origin.y)
nsTextFrame::GetPositionSlowly(nsIPresContext* aPresContext,                               nsIRenderingContext* aRendContext,                               const nsPoint& aPoint,                               nsIContent** aNewContent,                               PRInt32& aOffset){  // pre-condition tests  NS_PRECONDITION(aPresContext && aRendContext && aNewContent, "null arg");  if (!aPresContext || !aRendContext || !aNewContent) {    return NS_ERROR_NULL_POINTER;  }  // initialize out param  *aNewContent = nsnull;  TextStyle ts(aPresContext, *aRendContext, mStyleContext);  if (!ts.mSmallCaps && !ts.mWordSpacing && !ts.mLetterSpacing && !ts.mJustifying) {    return NS_ERROR_INVALID_ARG;  }  nsIView * view;  nsPoint origin;  GetOffsetFromView(aPresContext, origin, &view);  /* This if clause is the cause of much pain.  If aNewContent is set, then any   * code path that returns an error must set aNewContent to null before returning,   * or risk the caller unknowingly decrementing aNewContent inappropriately.   * Here's what Robert O'Callahan has to say on the matter:        If I'm not mistaken, in GetPositionSlowly, the values of aNewContent and        aOffset set in the conditional "if (aPoint.x - origin.x < 0)" are        overwritten on all successful return paths. Since they should never be        used by the caller if the function fails, that entire "if" statement is        --- or should be --- a no-op. Come to think of it, it doesn't make sense        either; setting aOffset to zero is nonsense.        I recommend you just delete that "if" statement.   *    * If this clause is removed, then some of the bullet-proofing code   * prefaced with "bug 56704" comments can be removed as well.   */  if (aPoint.x - origin.x < 0)  {      *aNewContent = mContent;      aOffset =0;  }  nsCOMPtr<nsIDocument> doc(getter_AddRefs(GetDocument(aPresContext)));  // Make enough space to transform  nsAutoTextBuffer paintBuffer;  nsAutoIndexBuffer indexBuffer;  nsresult rv = indexBuffer.GrowTo(mContentLength + 1);  if (NS_FAILED(rv)) {    // If we've already assigned aNewContent, make sure to 0 it out here.    // See bug 56704.    *aNewContent = nsnull;    return rv;  }  // Transform text from content into renderable form  nsCOMPtr<nsILineBreaker> lb;  doc->GetLineBreaker(getter_AddRefs(lb));  nsTextTransformer tx(lb, nsnull, aPresContext);  PRInt32 textLength;  PRInt32 numSpaces;  numSpaces = PrepareUnicodeText(tx, &indexBuffer, &paintBuffer, &textLength);  if (textLength <= 0) {    // If we've already assigned aNewContent, make sure to 0 it out here.    // aNewContent is undefined in the case that we return a failure,    // If we were to return a valid pointer,  we risk decrementing that node's     // ref count an extra time by the caller.      // See bug 56704 for more details.    *aNewContent = nsnull;    return NS_ERROR_FAILURE;  }#ifdef IBMBIDI // Simon -- reverse RTL text here  PRUint8 level;  GetBidiProperty(aPresContext, nsLayoutAtoms::embeddingLevel, (void**)&level,sizeof(level));  PRBool isOddLevel = (level & 1);  if (isOddLevel) {    PRUnichar *tStart, *tEnd;    PRUnichar tSwap;    for (tStart = paintBuffer.mBuffer, tEnd = tStart + textLength - 1; tEnd > tStart; tStart++, tEnd--) {      tSwap = *tStart;      *tStart = *tEnd;      *tEnd = tSwap;    }  }#endif // IBMBIDI  ComputeExtraJustificationSpacing(*aRendContext, ts, paintBuffer.mBuffer, textLength, numSpaces);//IF STYLE SAYS TO SELECT TO END OF FRAME HERE...  nsCOMPtr<nsIPref> prefs( do_GetService(kPrefCID, &rv) );  PRInt32 prefInt = 0;  PRBool outofstylehandled = PR_FALSE;  if (NS_SUCCEEDED(rv) && prefs)   {     if (NS_SUCCEEDED(prefs->GetIntPref("browser.drag_out_of_frame_style", &prefInt)) && prefInt)    {      nsRect bounds(mRect);            bounds.MoveBy(origin.x, origin.y);      if (aPoint.y < bounds.y)//above rectangle      {        aOffset = mContentOffset;        outofstylehandled = PR_TRUE;      }      else if (aPoint.y > (bounds.y + bounds.height))      {        aOffset = mContentOffset + mContentLength;        outofstylehandled = PR_TRUE;      }    }  }  if (!outofstylehandled) //then we drag to closest X point and dont worry about the 'Y'//END STYLE RULE  {    //the following will first get the index into the PAINTBUFFER then the actual content    nscoord adjustedX = PR_MAX(0,aPoint.x-origin.x);#ifdef IBMBIDI    if (isOddLevel)      aOffset = mContentOffset+textLength-GetLengthSlowly(*aRendContext, ts,paintBuffer.mBuffer,textLength,adjustedX);    else#endif    aOffset = mContentOffset+GetLengthSlowly(*aRendContext, ts,paintBuffer.mBuffer,textLength,adjustedX);    PRInt32 i;    PRInt32* ip = indexBuffer.mBuffer;    for (i = 0;i <= mContentLength; i ++){      if ((ip[i] >= aOffset) && //reverse mapping          (! IS_LOW_SURROGATE(paintBuffer.mBuffer[ip[i]-mContentOffset]))) {          aOffset = i + mContentOffset;          break;      }    }  }  *aNewContent = mContent;  if (*aNewContent)    (*aNewContent)->AddRef();  return NS_OK;}