Bug 842630 - Fix out of bounds in nsSVGTextFrame2::ResolvePositions. r=heycam

layout/svg/crashtests/842630-1.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><text dy="20 20">A<tspan style="display: none;">B</tspan></text></svg>

layout/svg/crashtests/crashtests.list

@@ -154,6 +154,7 @@ load 813420-1.svg
 load 841163-1.svg
 load 841812-1.svg
 load 842009-1.svg
+load 842630-1.svg
 load 842909-1.svg
 load 843072-1.svg
 load 847139-1.svg

layout/svg/nsSVGTextFrame2.cpp

@@ -4079,10 +4079,7 @@ nsSVGTextFrame2::ResolvePositions(nsTArray<gfxPoint>& aDeltas)
 
   // Fill in unspecified positions for all remaining characters, noting
   // them as unaddressable if they are.
-  uint32_t index = it.TextElementCharIndex();
-  for (uint32_t i = 0; i < index; i++) {
-    mPositions.AppendElement(CharPosition::Unspecified(false));
-  }
+  uint32_t index = 0;
   while (it.Next()) {
     while (++index < it.TextElementCharIndex()) {
       mPositions.AppendElement(CharPosition::Unspecified(false));
@@ -4090,6 +4087,9 @@ nsSVGTextFrame2::ResolvePositions(nsTArray<gfxPoint>& aDeltas)
     mPositions.AppendElement(CharPosition::Unspecified(
                                              it.IsOriginalCharUnaddressable()));
   }
+  while (++index < it.TextElementCharIndex()) {
+    mPositions.AppendElement(CharPosition::Unspecified(false));
+  }
 
   // Recurse over the content and fill in character positions as we go.
   bool forceStartOfChunk = false;