Add workaround for invalid non-bmp character measurements in SVG

third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp

 /*
  * Copyright (C) Research In Motion Limited 2010-2012. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 144 matching lines @@
                     unsigned distributeIndex = rangeIndex + distribute;
                     float newStartPosition = m_subrunRanges[distributeIndex - 1].end;
                     m_subrunRanges[distributeIndex].start = newStartPosition;
                     m_subrunRanges[distributeIndex].end = newStartPosition + newWidth;
                 }
                 distributeCount = 0;
             }
         }
     }
 
+    // TODO(pdr): m_subrunRanges can be too short in the presence of invalid
+    // unicode characters (see: crbug.com/595960). This is a temporary
+    // workaround to ensure the returned index is valid for m_subrunRages.
+    if (positionInRun >= m_subrunRanges.size())
+        return 0;
+
     return positionInRun;
 }
 
 SVGTextMetrics SVGTextMetricsCalculator::currentCharacterMetrics()
 {
     unsigned currentSubrunPosition = updateSubrunRangesForCurrentPosition();
     unsigned length = currentCharacterStartsSurrogatePair() ? 2 : 1;
     float width = m_subrunRanges[currentSubrunPosition].width();
     return SVGTextMetrics(m_text, length, width);
 }
@@ skipping 99 matching lines @@
 }
 
 void SVGTextMetricsBuilder::buildMetricsAndLayoutAttributes(LayoutSVGText* textRoot, LayoutSVGInlineText* stopAtLeaf, SVGCharacterDataMap& allCharactersMap)
 {
     ASSERT(textRoot);
     MeasureTextData data(&allCharactersMap);
     walkTree(textRoot, stopAtLeaf, &data);
 }
 
 } // namespace blink