diff --git a/dom/xul/nsXULContentSink.cpp b/dom/xul/nsXULContentSink.cpp
--- a/dom/xul/nsXULContentSink.cpp
+++ b/dom/xul/nsXULContentSink.cpp
@@ -1019,17 +1019,23 @@ XULContentSinkImpl::AddText(const char16
     }
     if (0 == amount) {
       if (mConstrainSize) {
         nsresult rv = FlushText();
         if (NS_OK != rv) {
             return rv;
         }
       } else {
-        mTextSize += aLength;
+        CheckedInt32 size = mTextSize;
+        size += aLength;
+        if (!size.isValid()) {
+          return NS_ERROR_OUT_OF_MEMORY;
+        }
+        mTextSize = size.value();
+
         mText = (char16_t *) realloc(mText, sizeof(char16_t) * mTextSize);
         if (nullptr == mText) {
             return NS_ERROR_OUT_OF_MEMORY;
         }
       }
     }
     memcpy(&mText[mTextLength],aText + offset, sizeof(char16_t) * amount);
 
