Bug 1678756 - Check we don't run off the end of the textPath while skipping characters r=emilio

The textcase and reference differ by a single space.
We should check that we've not run off the end of the path while we're skipping characters
Also removes a redundant check presumably left over from some earlier refactoring.

Differential Revision: https://phabricator.services.mozilla.com/D97828

layout/reftests/svg/text/reftest.list

@@ -114,6 +114,7 @@ random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) fuzzy-if(skiaContent,0-1,0-
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-a.svg textpath-a-ref.svg # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-anchor-middle.svg textpath-anchor-middle-ref.svg # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-anchor-end.svg textpath-anchor-end-ref.svg # Bug 1392106
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-cluster.svg textpath-cluster-ref.svg # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-invalid-parent.svg textpath-invalid-parent-ref.svg # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-multiline.svg textpath-multiline-ref.svg # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-multiline-2.svg textpath-multiline-2-ref.svg # Bug 1392106

layout/reftests/svg/text/textpath-cluster-ref.svg

@@ -0,0 +1,12 @@
+<svg width="500" height="500" xmlns="http://www.w3.org/2000/svg" >
+  <defs>
+    <path id="path" d="M 100 200 C 200 100 300 0 400 100" />
+    <style>
+      text {
+        font: 40px monospace;
+      }
+    </style>
+  </defs>
+
+  <text transform="translate(0, 40)">a <textPath href="#path">b </textPath>c</text>
+</svg>

layout/reftests/svg/text/textpath-cluster.svg

@@ -0,0 +1,12 @@
+<svg width="500" height="500" xmlns="http://www.w3.org/2000/svg" >
+  <defs>
+    <path id="path" d="M 100 200 C 200 100 300 0 400 100" />
+    <style>
+      text {
+        font: 40px monospace;
+      }
+    </style>
+  </defs>
+
+  <text transform="translate(0, 40)">a <textPath href="#path">b </textPath> c</text>
+</svg>

layout/svg/SVGTextFrame.cpp

@@ -4660,9 +4660,10 @@ void SVGTextFrame::DoTextPathLayout() {
       it.Next();
     }
 
+    bool skippedEndOfTextPath = false;
+
     // Loop for each character in the text path.
-    while (!it.AtEnd() && it.TextPathFrame() &&
-           it.TextPathFrame()->GetContent() == textPath) {
+    while (!it.AtEnd() && it.TextPathFrame()) {
       // The index of the cluster or ligature group's first character.
       uint32_t i = it.TextElementCharIndex();
 
@@ -4695,6 +4696,10 @@ void SVGTextFrame::DoTextPathLayout() {
         // group that begins inside the text path as being affected
         // by it.
         if (it.IsOriginalCharSkipped()) {
+          if (!it.TextPathFrame()) {
+            skippedEndOfTextPath = true;
+            break;
+          }
           // Leave partialAdvance unchanged.
         } else if (it.IsClusterAndLigatureGroupStart()) {
           break;
@@ -4703,6 +4708,9 @@ void SVGTextFrame::DoTextPathLayout() {
         }
         partialAdvances.AppendElement(partialAdvance);
       }
+      if (skippedEndOfTextPath) {
+        break;
+      }
 
       // Any final undisplayed characters the CharIterator skipped over.
       MOZ_ASSERT(j <= it.TextElementCharIndex());