Add GetSubstringBounds and GetCursorSpan API

This CL is adding to the RenderText API fuzzer the calls to
  * GetSubstringBounds(...)
  * GetCursorSpan(...)

These calls were missing to trigger the following bug:
  http://crbug.com/1146674

R=gab@chromium.org,msw@chromium.org

Bug: 1146674, 1146674
Change-Id: I2867262bcc8cba97f666bbc084656dd4e1ac7362
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2530369Reviewed-by: Michael Wasserman <msw@chromium.org>
Commit-Queue: Etienne Bergeron <etienneb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#825960}

ui/gfx/render_text_api_fuzzer.cc

@@ -86,7 +86,9 @@ enum class RenderTextAPI {
   kIndexOfAdjacentGrapheme,
   kSetObscuredGlyphSpacing,
   kSetDisplayRect,
-  kMaxValue = kSetDisplayRect
+  kGetSubstringBounds,
+  kGetCursorSpan,
+  kMaxValue = kGetCursorSpan
 };
 
 gfx::DirectionalityMode ConsumeDirectionalityMode(FuzzedDataProvider* fdp) {
@@ -353,6 +355,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
                       fdp.ConsumeIntegralInRange<int>(0, 200),
                       fdp.ConsumeIntegralInRange<int>(0, 30)));
         break;
+      case RenderTextAPI::kGetSubstringBounds:
+        render_text->GetSubstringBounds(
+            ConsumeRange(&fdp, render_text->text().length()));
+        break;
+      case RenderTextAPI::kGetCursorSpan:
+        render_text->GetCursorSpan(
+            ConsumeRange(&fdp, render_text->text().length()));
+        break;
     }
   }