--- a/dom/events/ContentEventHandler.cpp
+++ b/dom/events/ContentEventHandler.cpp
@@ -1419,20 +1419,21 @@ ContentEventHandler::OnQueryTextRectArra
 {
   nsresult rv = Init(aEvent);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
 
   LineBreakType lineBreakType = GetLineBreakType(aEvent);
   RefPtr<nsRange> range = new nsRange(mRootContent);
-  uint32_t offset = aEvent->mInput.mOffset;
 
   LayoutDeviceIntRect rect;
-  while (aEvent->mInput.mLength > aEvent->mReply.mRectArray.Length()) {
+  uint32_t offset = aEvent->mInput.mOffset;
+  const uint32_t kEndOffset = offset + aEvent->mInput.mLength;
+  while (offset < kEndOffset) {
     rv = SetRangeFromFlatTextOffset(range, offset, 1, lineBreakType, true,
                                     nullptr);
     if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
     }
 
     // get the starting frame
     nsIFrame* firstFrame = GetFirstFrameInRange(range);
@@ -1444,39 +1445,37 @@ ContentEventHandler::OnQueryTextRectArra
     nsRect frameRect(nsPoint(0, 0), firstFrame->GetRect().Size());
     rv = ConvertToRootRelativeOffset(firstFrame, frameRect);
     if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
     }
 
     int32_t nodeOffset = range->StartOffset();
     AutoTArray<nsRect, 16> charRects;
-    rv = firstFrame->GetCharacterRectsInRange(
-           nodeOffset,
-           aEvent->mInput.mLength - aEvent->mReply.mRectArray.Length(),
-           charRects);
-    if (NS_WARN_IF(NS_FAILED(rv))) {
+    rv = firstFrame->GetCharacterRectsInRange(nodeOffset, kEndOffset - offset,
+                                              charRects);
+    if (NS_WARN_IF(NS_FAILED(rv)) || NS_WARN_IF(charRects.IsEmpty())) {
       return rv;
     }
 
     for (size_t i = 0; i < charRects.Length(); i++) {
       nsRect charRect = charRects[i];
       charRect.x += frameRect.x;
       charRect.y += frameRect.y;
 
       rect = LayoutDeviceIntRect::FromUnknownRect(
                charRect.ToOutsidePixels(mPresContext->AppUnitsPerDevPixel()));
 
       // Ensure at least 1px width and height for avoiding empty rect.
       rect.height = std::max(1, rect.height);
       rect.width = std::max(1, rect.width);
 
       aEvent->mReply.mRectArray.AppendElement(rect);
+      offset++;
     }
-    offset += charRects.Length();
   }
   aEvent->mSucceeded = true;
   return NS_OK;
 }
 
 nsresult
 ContentEventHandler::OnQueryTextRect(WidgetQueryContentEvent* aEvent)
 {