Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/8bfaa27698ca
Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1146335

# HG changeset patch
# User Seth Fowler <mark.seth.fowler@gmail.com>
# Date 1428627143 25200
# Node ID 8bfaa27698ca0720d5c9f3910ab7148b38db0625
# Parent  9d14787bd10e6f3013263a2cae0bcc78bebde1db
Bug 1146335 (Part 2) - Fix an off-by-one error in image::Downscaler. r=tn a=lizzard

diff --git a/image/src/Downscaler.cpp b/image/src/Downscaler.cpp
--- a/image/src/Downscaler.cpp
+++ b/image/src/Downscaler.cpp
@@ -160,20 +160,26 @@ Downscaler::CommitRow()
   int32_t inLineToRead = filterOffset + mLinesInBuffer;
   MOZ_ASSERT(mCurrentInLine <= inLineToRead, "Reading past end of input");
   if (mCurrentInLine == inLineToRead) {
     skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
                                mWindow[mLinesInBuffer++], mHasAlpha,
                                /* use_sse2 = */ true);
   }
 
-  while (mLinesInBuffer == filterLength &&
-         mCurrentOutLine < mTargetSize.height) {
+  MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
+             "Writing past end of output");
+
+  while (mLinesInBuffer == filterLength) {
     DownscaleInputLine();
 
+    if (mCurrentOutLine == mTargetSize.height) {
+      break;  // We're done.
+    }
+
     GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
                              &filterOffset, &filterLength);
   }
 
   mCurrentInLine += 1;
 }
 
 bool