Merge 129144 - Prevent reading stale data from InlineTextBoxes

Source/WebCore/rendering/InlineTextBox.h

Index: Source/WebCore/rendering/InlineTextBox.h
===================================================================
--- Source/WebCore/rendering/InlineTextBox.h	(revision 129145)
+++ Source/WebCore/rendering/InlineTextBox.h	(working copy)
@@ -64,17 +64,19 @@
     void setNextTextBox(InlineTextBox* n) { m_nextTextBox = n; }
     void setPreviousTextBox(InlineTextBox* p) { m_prevTextBox = p; }
 
-    unsigned start() const { return m_start; }
-    unsigned end() const { return m_len ? m_start + m_len - 1 : m_start; }
-    unsigned len() const { return m_len; }
+    unsigned start() const { ASSERT(!isDirty()); return m_start; }
+    unsigned end() const { ASSERT(!isDirty()); return m_len ? m_start + m_len - 1 : m_start; }
+    unsigned len() const { ASSERT(!isDirty()); return m_len; }
 
     void setStart(unsigned start) { m_start = start; }
     void setLen(unsigned len) { m_len = len; }
 
-    void offsetRun(int d) { m_start += d; }
+    void offsetRun(int d) { ASSERT(!isDirty()); m_start += d; }
 
     unsigned short truncation() { return m_truncation; }
 
+    virtual void markDirty(bool dirty = true) OVERRIDE;
+
     using InlineBox::hasHyphen;
     using InlineBox::setHasHyphen;
     using InlineBox::canHaveLeadingExpansion;