Add out-of-bound range handling for SetCompositionFromExistingText.

We need to reject out-of-bound ranges. Currently setting range that is
outside the bounds of the text buffer in views::Textfield crashes, as
Textfield uses RenderText to store the text buffer and RenderText will
crash if the range is outside of the cached text buffer.

Hence, we change views::Textfield::SetCompositionFromExistingText to
clear the composition when the provided range is out-of-bound.

Bug: 966484
Change-Id: I770457a1290ca4466b21779264e967789cbb80f6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1754498
Commit-Queue: Siye Liu <siliu@microsoft.com>
Reviewed-by: Michael Wasserman <msw@chromium.org>
Cr-Commit-Position: refs/heads/master@{#688216}

ui/views/controls/textfield/textfield_model.cc

@@ -669,7 +669,7 @@ void TextfieldModel::SetCompositionText(
 }
 
 void TextfieldModel::SetCompositionFromExistingText(const gfx::Range& range) {
-  if (range.is_empty()) {
+  if (range.is_empty() || !gfx::Range(0, text().length()).Contains(range)) {
     ClearComposition();
     return;
   }

ui/views/controls/textfield/textfield_model.h

@@ -224,6 +224,8 @@ class VIEWS_EXPORT TextfieldModel {
 
   // Puts the text in the specified range into composition mode.
   // This method should not be called with composition text or an invalid range.
+  // The provided range is checked against the string's length, if |range| is
+  // out of bounds, the composition will be cleared.
   void SetCompositionFromExistingText(const gfx::Range& range);
 
   // Converts current composition text into final content.

ui/views/controls/textfield/textfield_model_unittest.cc

@@ -1978,4 +1978,16 @@ TEST_F(TextfieldModelTest, SetCompositionFromExistingText_Empty) {
   EXPECT_STR_EQ("abc", model.text());
 }
 
+TEST_F(TextfieldModelTest, SetCompositionFromExistingText_OutOfBounds) {
+  TextfieldModel model(nullptr);
+  model.SetText(base::string16());
+
+  model.SetCompositionFromExistingText(gfx::Range(0, 2));
+  EXPECT_FALSE(model.HasCompositionText());
+
+  model.SetText(base::ASCIIToUTF16("abc"));
+  model.SetCompositionFromExistingText(gfx::Range(1, 4));
+  EXPECT_FALSE(model.HasCompositionText());
+}
+
 }  // namespace views