Don't iterate past the end of the metrics list

Source/core/layout/svg/SVGTextLayoutEngine.cpp

 /*
  * Copyright (C) Research In Motion Limited 2010-2012. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 339 matching lines @@
 
     bool didStartTextFragment = false;
     bool applySpacingToNextCharacter = false;
 
     float lastAngle = 0;
     float baselineShift = baselineLayout.calculateBaselineShift(style);
     baselineShift -= baselineLayout.calculateAlignmentBaselineShift(m_isVerticalText, &text);
 
     // Main layout algorithm.
     const unsigned boxEndOffset = textBox->start() + textBox->len();
-    while (m_visualMetricsIterator.characterOffset() < boxEndOffset) {
+    while (!m_visualMetricsIterator.isAtEnd() && m_visualMetricsIterator.characterOffset() < boxEndOffset) {
         const SVGTextMetrics& visualMetrics = m_visualMetricsIterator.metrics();
         if (visualMetrics.isEmpty()) {
             m_visualMetricsIterator.next();
             continue;
         }
 
         SVGTextLayoutAttributes* logicalAttributes = 0;
         if (!currentLogicalCharacterAttributes(logicalAttributes))
             break;
 
@@ skipping 165 matching lines @@
     }
 
     if (!didStartTextFragment)
         return;
 
     // Close last open fragment, if needed.
     recordTextFragment(textBox);
 }
 
 }