[omnibox] Avoid access past end of classification

Although unlikely, it's possible that AutocompleteMatch::
InlineTailPrefix() could access past the end of its classification.
Check for this and avoid it. Also adds unit test.

Bug: 1013103
Change-Id: Iccb23643c06ca952567a99bfa7cbe7cdeb335d3d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1869117Reviewed-by: Tommy Li <tommycli@chromium.org>
Commit-Queue: Kevin Bailey <krb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#707554}

components/omnibox/browser/autocomplete_match.cc

@@ -1078,8 +1078,9 @@ void AutocompleteMatch::InlineTailPrefix(const base::string16& common_prefix) {
     contents = ellipsis + contents;
     // If the first class is not already NONE, prepend a NONE class for the new
     // ellipsis.
-    if (contents_class[0].offset == 0 &&
-        contents_class[0].style != ACMatchClassification::NONE) {
+    if (contents_class.empty() ||
+        (contents_class[0].offset == 0 &&
+         contents_class[0].style != ACMatchClassification::NONE)) {
       contents_class.insert(contents_class.begin(),
                             {0, ACMatchClassification::NONE});
     }

components/omnibox/browser/autocomplete_match_unittest.cc

@@ -137,6 +137,11 @@ TEST(AutocompleteMatchTest, InlineTailPrefix) {
        // should prepend ellipsis, and offset remainder
        {{0, ACMatchClassification::NONE}, {2, ACMatchClassification::MATCH}},
        {{0, ACMatchClassification::NONE}, {6, ACMatchClassification::MATCH}}},
+      {"90123456",
+       "... 90123456",
+       // should prepend ellipsis
+       {},
+       {{0, ACMatchClassification::NONE}}},
   };
   for (const auto& test_case : cases) {
     AutocompleteMatch match;