RenderCounter::updateCounter should trigger a relayout.

Source/core/paint/InlineTextBoxPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/paint/InlineTextBoxPainter.h"
 
 #include "core/dom/DocumentMarkerController.h"
 #include "core/dom/RenderedDocumentMarker.h"
 #include "core/editing/CompositionUnderline.h"
@@ skipping 131 matching lines @@
         if (haveSelection && !useCustomUnderlines)
             paintSelection(context, boxOrigin, styleToUse, font, selectionStyle.fillColor);
     }
 
     // 2. Now paint the foreground, including text and decorations like underline/overline (in quirks mode only).
     int length = m_inlineTextBox.len();
     int maximumLength;
     StringView string;
     if (!combinedText) {
         string = m_inlineTextBox.renderer().text().createView();
+        ASSERT(m_inlineTextBox.start() + length <= string.length());
         if (static_cast<unsigned>(length) != string.length() || m_inlineTextBox.start())
             string.narrow(m_inlineTextBox.start(), length);
         maximumLength = m_inlineTextBox.renderer().textLength() - m_inlineTextBox.start();
     } else {
         combinedText->getStringToRender(m_inlineTextBox.start(), string, length);
         maximumLength = length;
     }
 
     StringBuilder charactersWithHyphen;
     TextRun textRun = m_inlineTextBox.constructTextRun(styleToUse, font, string, maximumLength, m_inlineTextBox.hasHyphen() ? &charactersWithHyphen : 0);
@@ skipping 633 matching lines @@
             RenderTheme::theme().platformActiveTextSearchHighlightColor() :
             RenderTheme::theme().platformInactiveTextSearchHighlightColor();
         GraphicsContextStateSaver stateSaver(*pt);
         pt->clip(FloatRect(boxOrigin.x(), boxOrigin.y() - deltaY, m_inlineTextBox.logicalWidth(), selHeight));
         pt->drawHighlightForText(font, run, FloatPoint(boxOrigin.x(), boxOrigin.y() - deltaY), selHeight, color, sPos, ePos);
     }
 }
 
 
 } // namespace blink