2 files changed, 8 insertions, 4 deletions
diff --git a/core/fxcrt/cfx_char.h b/core/fxcrt/cfx_char.h
index fb625ee038..268aa99c39 100644
--- a/core/fxcrt/cfx_char.h
+++ b/core/fxcrt/cfx_char.h
@@ -35,9 +35,9 @@ class CFX_Char {
   uint32_t m_dwCharStyles;
   int32_t m_iCharWidth;
   int16_t m_iBidiClass;
-  int16_t m_iBidiLevel;
-  int16_t m_iBidiPos;
-  int16_t m_iBidiOrder;
+  uint16_t m_iBidiLevel;
+  uint16_t m_iBidiPos;
+  uint16_t m_iBidiOrder;
   int32_t m_iFontSize;
   uint32_t m_dwIdentity;
   RetainPtr<Retainable> m_pUserData;
diff --git a/core/fxcrt/fx_bidi.cpp b/core/fxcrt/fx_bidi.cpp
index 7261d80af3..669fc5bd88 100644
--- a/core/fxcrt/fx_bidi.cpp
+++ b/core/fxcrt/fx_bidi.cpp
@@ -531,8 +531,12 @@ class CFX_BidiLine {
   }
 
   void Position(std::vector<CFX_Char>* chars, size_t iCount) {
-    for (size_t i = 0; i < iCount; ++i)
+    for (size_t i = 0; i < iCount; ++i) {
+      if ((*chars)[i].m_iBidiPos > iCount)
+        continue;
+
       (*chars)[(*chars)[i].m_iBidiPos].m_iBidiOrder = i;
+    }
   }
 };