The source of the problem are several assignments like this:

    static void subtractShapeIntervals(const ShapeIntervals& a, const ShapeIntervals& b, ShapeIntervals& result)
    {
        ... 

        const_iterator aNext = a.begin();
        const_iterator bNext = b.begin();
        ShapeInterval<T> aValue = *aNext;
        ShapeInterval<T> bValue = *bNext;

        while (aNext != a.end() && bNext != b.end()) {
            if (bValue.contains(aValue)) {
                aValue = *++aNext;   // BAD
            } 
        ....
    }

Although the LHS of the assignments aren't used when the corresponding iterator has reached its end, the expression still dereferences an invalid address (a.end() in this case).

The loop has been rewritten; we do not dereference the aNext or bNext iterators without checking the end condition.

BUG=285788

Review URL: https://chromiumcodereview.appspot.com/23454011

git-svn-id: svn://svn.chromium.org/blink/trunk@157329 bbb929c8-8fbe-4397-9dbb-9b2b20218538