Crash in WebCore::translateIntersectionPointsToSkipInkBoundaries

Crash in WebCore::translateIntersectionPointsToSkipInkBoundaries
https://bugs.webkit.org/show_bug.cgi?id=126252

Reviewed by Alexey Proskuryakov.

Source/WebCore:

lastIntermediate was a iterator pointing into a Vector, which was being re-used
even while appending to the Vector. If any of the append operators triggered
a realloc, the iterator would point to the old free'ed memory.

Test: fast/css3-text/css3-text-decoration/text-decoration-skip/text-decoration-skip-ink-crash-many-gaps.html

* rendering/InlineTextBox.cpp:
(WebCore::translateIntersectionPointsToSkipInkBoundaries):

LayoutTests:

This test causes intermediateTuples, a Vector of tuples of floats, to have enough
entries to cause a realloc. In my tests, the realloc seems to always allocate the
next area of memory (without unmapping any old pages), so this test only crashes
if guardMalloc is used.

* fast/css3-text/css3-text-decoration/text-decoration-skip/text-decoration-skip-ink-crash-many-gaps-expected.txt: Added.
* fast/css3-text/css3-text-decoration/text-decoration-skip/text-decoration-skip-ink-crash-many-gaps.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@161244 268f45cc-cd09-0410-ab3c-d52691b4dbfc