Make copyTextTo() of text iterators check the length parameter

third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp

Index: third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp
diff --git a/third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp b/third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp
index 57b892e70f62bfee14061809fc1071a3eb280158..2867b57a22c7a5eaba3aa3fd514105236782417a 100644
--- a/third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp
+++ b/third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp
@@ -1115,7 +1115,10 @@ bool TextIteratorAlgorithm<Strategy>::isBetweenSurrogatePair(int position) const
 template <typename Strategy>
 int TextIteratorAlgorithm<Strategy>::copyTextTo(ForwardsTextBuffer* output, int position, int minLength) const
 {
-    int copiedLength = isBetweenSurrogatePair(position + minLength) ? minLength + 1 : minLength;
+    int end = std::min(length(), position + minLength);
+    if (isBetweenSurrogatePair(end))
+        ++end;
+    int copiedLength = end - position;
     copyCodeUnitsTo(output, position, copiedLength);
     return copiedLength;
 }