Bug 842630 - Fix out of bounds in nsSVGTextFrame2::ResolvePositions. r=heycam