Include the surrogate character count when updating text state

third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp

Index: third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp
diff --git a/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp b/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp
index 355c8eb90c0356a5efdc739edce709a3c0a964b0..8be2a13b5aa724e2dddbc679dab2c801b563340e 100644
--- a/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/SVGTextMetricsBuilder.cpp
@@ -283,7 +283,8 @@ void walkInlineText(LayoutSVGInlineText* text, TreeWalkTextState& textState, Upd
         }
 
         if (attributesToUpdate) {
-            attributesToUpdate->updateCharacterDataMap(textState.valueListPosition - skippedWhitespace - surrogatePairCharacters + calculator.currentPosition() + 1, calculator.currentPosition() + 1);
+            unsigned currentTextValueListPosition = calculator.currentPosition() - skippedWhitespace - surrogatePairCharacters;
+            attributesToUpdate->updateCharacterDataMap(textState.valueListPosition + currentTextValueListPosition + 1, calculator.currentPosition() + 1);
             attributesToUpdate->addMetrics(calculator.currentCharacterMetrics());
         }
 
@@ -292,7 +293,8 @@ void walkInlineText(LayoutSVGInlineText* text, TreeWalkTextState& textState, Upd
         textState.lastCharacterWasWhiteSpace = currentCharacterIsWhiteSpace;
     } while (calculator.advancePosition());
 
-    textState.valueListPosition += calculator.currentPosition() - skippedWhitespace;
+    unsigned currentTextValueListPosition = calculator.currentPosition() - skippedWhitespace - surrogatePairCharacters;
+    textState.valueListPosition += currentTextValueListPosition;
 }
 
 void walkTree(LayoutSVGText* start, LayoutSVGInlineText* stopAtText, SVGCharacterDataMap* allCharactersMap = nullptr)