The adjusted_start must be computed based on the part_start

In order to create a new ShapeResultView, we use segments of a previous
instance, analyzing its runs based on a new index range for the new
instance. Since the start/end of the RunInfo structure may be different
than the start index of the ShapeResultView, we use an adjusted_start
to adapt the logic to the different data structures.

We assume that if the passed start_index for the new range is greater
than the current run's part start being processed, we should define the
new run's start as the difference of these two values. However, we must
also ensure that start_index is at least equal to the the part_start
value for such run.

The problem described in the issue 1130153 comes from the fact that
we use the start_index on cases where it's smaller than the run's
part_start. This leads to an incorrect (longer than expected) run.

Bug: 1130153
Change-Id: Id5dd505baf1f990d2fe7a9406e191979cbd6b9f6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2431523Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#811105}

third_party/blink/renderer/platform/fonts/shaping/shape_result_view.cc

@@ -202,8 +202,14 @@ void ShapeResultView::CreateViewsForResult(const ShapeResultType* other,
       // of |RunInfo| could be different from |part_start| for ShapeResultView.
       DCHECK_GE(part_start, run->OffsetToRunStartIndex());
       unsigned run_start = part_start - run->OffsetToRunStartIndex();
+      // TODO(jfernandez): Give a first part of 1 char (offset=2), a
+      // second part, with part_start=3 (1 + 2), this run_start will
+      // be 0. Hence, the way we are computing the adjusted_start
+      // seems incorrect.
       unsigned adjusted_start =
-          start_index > run_start ? start_index - run_start : 0;
+          start_index > run_start
+              ? std::max(start_index, part_start) - run_start
+              : 0;
       unsigned adjusted_end = std::min(end_index, run_end) - run_start;
       DCHECK(adjusted_end > adjusted_start);
       unsigned part_characters = adjusted_end - adjusted_start;

third_party/blink/web_tests/external/wpt/css/css-text/ellisize-rtl-text-crash.html

+<title>CSS Text Test: Ellipsize overflowing text in RTL cause Chrome to crash</title>
+<link rel="help" href="https://crbug.com/1130153">
+<style>
+    .CLASS2 {
+        text-overflow: ellipsis;
+        overflow: hidden;
+        direction: rtl;
+    }
+    .CLASS13 {
+        font-size: 32768em;
+    }
+</style>
+<div class="CLASS2">
+    <abbr class="CLASS13">x AxBxC </abbr>C
+</div>

third_party/blink/web_tests/external/wpt/lint.ignore

@@ -85,6 +85,7 @@ CR AT EOL: html/semantics/forms/the-textarea-element/multiline-placeholder-crlf.
 CR AT EOL: html/semantics/forms/the-input-element/multiline-placeholder-cr.html
 CR AT EOL: html/semantics/forms/the-input-element/multiline-placeholder-crlf.html
 CR AT EOL: webvtt/parsing/file-parsing/tests/support/newlines.vtt
+CR AT EOL: css/css-text/ellisize-rtl-text-crash.html
 
 # Intentional use of tabs
 INDENT TABS: html/semantics/embedded-content/the-canvas-element/size.attributes.parse.whitespace.html