Update composition underline start/end constraints.

Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Committed: https://crrev.com/7c023bffa5e0367f60d6aac94ac5b38af8802c2f
Cr-Commit-Position: refs/heads/master@{#418947}

[wkorman, 2016-09-14 01:49:13]

Description was changed from

==========
Update composition underline start/end constraints.

- Constrain paint start/end to be bounded by text size.
- Include start() in paintLength for RTL in paintCompositionUnderline(), as it's
  included in paintEnd.
- Early-out when painting SVG inline text if text length is zero.
- Add basic composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

BUG=641261
==========

to

==========
Update composition underline start/end constraints.

- Constrain paint start/end to be bounded by text size.
- Include start() in paintLength for RTL in paintCompositionUnderline(), as it's
  included in paintEnd.
- Early-out when painting SVG inline text if text length is zero.
- Add basic composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

[wkorman, 2016-09-14 02:01:47]

Description was changed from

==========
Update composition underline start/end constraints.

- Constrain paint start/end to be bounded by text size.
- Include start() in paintLength for RTL in paintCompositionUnderline(), as it's
  included in paintEnd.
- Early-out when painting SVG inline text if text length is zero.
- Add basic composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

to

==========
Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

Test notes:
- RTL underline painting (but not background painting) looks partially
  broken (see included expectation image), but it was broken before
  this patch, and now we've a test to document behavior and I'll fix it
  subsequently.
- Similarly, the 'split' test case doesn't look like it does what we intend,
  I think there's an off-by-one with the start offset, but I'm going to
  validate that further subsequently (and left note in the test case).
- I have another test case with a 'huge' 70K ITB aiming to use variations
  of it to validate edge cases re: overflow/underflow, but it exhibits
  unusual behavior as:
    // Below will create ITBs as:
    // 1: x{65535}, start=0, len=65535
    // 2: x, start=65535, len=1
    // 3: x{4464}, start=0, len=4464
    // However, in JS console, there are only two childNodes
    // and the first is 65536 long (?).
  and so requires further investigation.
- We could add an SVG test in future, as well as further RTL where the
  text itself is RTL, where currently the test case just has an RTL flow.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

[wkorman, 2016-09-14 02:04:02]

Description was changed from

==========
Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

Test notes:
- RTL underline painting (but not background painting) looks partially
  broken (see included expectation image), but it was broken before
  this patch, and now we've a test to document behavior and I'll fix it
  subsequently.
- Similarly, the 'split' test case doesn't look like it does what we intend,
  I think there's an off-by-one with the start offset, but I'm going to
  validate that further subsequently (and left note in the test case).
- I have another test case with a 'huge' 70K ITB aiming to use variations
  of it to validate edge cases re: overflow/underflow, but it exhibits
  unusual behavior as:
    // Below will create ITBs as:
    // 1: x{65535}, start=0, len=65535
    // 2: x, start=65535, len=1
    // 3: x{4464}, start=0, len=4464
    // However, in JS console, there are only two childNodes
    // and the first is 65536 long (?).
  and so requires further investigation.
- We could add an SVG test in future, as well as further RTL where the
  text itself is RTL, where currently the test case just has an RTL flow.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

to

==========
Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

Test notes, I could continue working on these but I have gained
sufficient confidence around the existing set of fixes to believe it's
worth submitting those while we pursue further test work down the road
as warranted:
- RTL underline painting (but not background painting) looks partially
  broken (see included expectation image), but it was broken before
  this patch, and now we've a test to document behavior and I'll fix it
  subsequently.
- Similarly, the 'split' test case doesn't look like it does what we intend,
  I think there's an off-by-one with the start offset, but I'm going to
  validate that further subsequently (and left note in the test case).
- I have another test case with a 'huge' 70K ITB aiming to use variations
  of it to validate edge cases re: overflow/underflow, but it exhibits
  unusual behavior as:
    // Below will create ITBs as:
    // 1: x{65535}, start=0, len=65535
    // 2: x, start=65535, len=1
    // 3: x{4464}, start=0, len=4464
    // However, in JS console, there are only two childNodes
    // and the first is 65536 long (?).
  and so requires further investigation. It's also incredibly slow in
  debug builds, I think due to under-invalidation pixel checking, at
  least in part.
- We could add an SVG test in future, as well as further RTL where the
  text itself is RTL, where currently the test case just has an RTL flow.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

[wkorman, 2016-09-14 02:09:16]

Description was changed from

==========
Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

Test notes, I could continue working on these but I have gained
sufficient confidence around the existing set of fixes to believe it's
worth submitting those while we pursue further test work down the road
as warranted:
- RTL underline painting (but not background painting) looks partially
  broken (see included expectation image), but it was broken before
  this patch, and now we've a test to document behavior and I'll fix it
  subsequently.
- Similarly, the 'split' test case doesn't look like it does what we intend,
  I think there's an off-by-one with the start offset, but I'm going to
  validate that further subsequently (and left note in the test case).
- I have another test case with a 'huge' 70K ITB aiming to use variations
  of it to validate edge cases re: overflow/underflow, but it exhibits
  unusual behavior as:
    // Below will create ITBs as:
    // 1: x{65535}, start=0, len=65535
    // 2: x, start=65535, len=1
    // 3: x{4464}, start=0, len=4464
    // However, in JS console, there are only two childNodes
    // and the first is 65536 long (?).
  and so requires further investigation. It's also incredibly slow in
  debug builds, I think due to under-invalidation pixel checking, at
  least in part.
- We could add an SVG test in future, as well as further RTL where the
  text itself is RTL, where currently the test case just has an RTL flow.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

to

==========
Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

Test notes, I could continue working on these but I have gained
sufficient confidence around the existing set of fixes to believe it's
worth submitting those while we pursue further test work down the road
as prioritized:
- RTL underline painting (but not background painting) looks partially
  broken (see included expectation image), but it was broken before
  this patch, and now we've a test to document behavior and can fix it
  subsequently.
- Similarly, the 'split' test case doesn't look like it does what we intend,
  I think there's an off-by-one with the start offset, but I'm going to
  validate that further subsequently (and left note in the test case).
- I have another test case with a 'huge' 70K ITB aiming to use variations
  of it to validate edge cases re: overflow/underflow, but it exhibits
  unusual behavior as:
    // Below will create ITBs as:
    // 1: x{65535}, start=0, len=65535
    // 2: x, start=65535, len=1
    // 3: x{4464}, start=0, len=4464
    // However, in JS console, there are only two childNodes
    // and the first is 65536 long (?).
  and so requires further investigation. It's also incredibly slow in
  debug builds, I think due to under-invalidation pixel checking, at
  least in part.
- For future test additions:
  + more basic truncation ellipsis cases
  + RTL where text itself is RTL (current case just has RTL flow)
  + SVG text

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

[wkorman, 2016-09-14 02:18:16]

Description was changed from

==========
Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

Test notes, I could continue working on these but I have gained
sufficient confidence around the existing set of fixes to believe it's
worth submitting those while we pursue further test work down the road
as prioritized:
- RTL underline painting (but not background painting) looks partially
  broken (see included expectation image), but it was broken before
  this patch, and now we've a test to document behavior and can fix it
  subsequently.
- Similarly, the 'split' test case doesn't look like it does what we intend,
  I think there's an off-by-one with the start offset, but I'm going to
  validate that further subsequently (and left note in the test case).
- I have another test case with a 'huge' 70K ITB aiming to use variations
  of it to validate edge cases re: overflow/underflow, but it exhibits
  unusual behavior as:
    // Below will create ITBs as:
    // 1: x{65535}, start=0, len=65535
    // 2: x, start=65535, len=1
    // 3: x{4464}, start=0, len=4464
    // However, in JS console, there are only two childNodes
    // and the first is 65536 long (?).
  and so requires further investigation. It's also incredibly slow in
  debug builds, I think due to under-invalidation pixel checking, at
  least in part.
- For future test additions:
  + more basic truncation ellipsis cases
  + RTL where text itself is RTL (current case just has RTL flow)
  + SVG text

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

to

==========
Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

[wkorman, 2016-09-14 02:23:22]

wkorman@chromium.org changed reviewers:
+ kojii@chromium.org, wangxianzhu@chromium.org

[wkorman, 2016-09-14 02:23:23]

Test notes, I could continue working on these but I have gained
sufficient confidence around the existing set of fixes to believe it's
worth submitting those while we pursue further test work down the road
as prioritized:

- I do not have a failing test case that this fixes (see note
  on 'huge' test case below), but it is believable that cause
  could be one or both of the constraints around paint start,
  or the RTL bug missing inclusion of start() before subtracting
  paintEnd. Also note http://crrev.com/2320853003 previously
  submitted. We do have two ClusterFuzz issues duped to this
  bug that would show as no longer repro'ing if we fix them.
  I will try running those with this patch tomorrow. I have
  not yet as they are Android and require gestures and so
  some setup.

- RTL underline painting (but not background painting) looks partially
  broken (see included expectation image), but it was broken before
  this patch, and now we've a test to document behavior and can fix it
  subsequently.

- Similarly, the 'split' test case doesn't look like it does what we intend,
  I think there's an off-by-one with the start offset, but I'm going to
  validate that further subsequently (and left note in the test case).

- I have another test case with a 'huge' 70K ITB aiming to use variations
  of it to validate edge cases re: overflow/underflow, but it exhibits
  unusual behavior as:
    // Below will create ITBs as:
    // 1: x{65535}, start=0, len=65535
    // 2: x, start=65535, len=1
    // 3: x{4464}, start=0, len=4464
    // However, in JS console, there are only two childNodes
    // and the first is 65536 long (?).
  and so requires further investigation. It's also incredibly slow in
  debug builds, I think due to under-invalidation pixel checking, at
  least in part.

- For future test additions:
  + more basic truncation ellipsis cases
  + RTL where text itself is RTL (current case just has RTL flow)
  + SVG text

[kojii, 2016-09-14 05:21:31]

Non-owner lgtm, thank you for working on this thoroughly.

https://codereview.chromium.org/2337373002/diff/40001/third_party/WebKit/Sour...
File third_party/WebKit/Source/core/paint/InlineTextBoxPainter.cpp (right):

https://codereview.chromium.org/2337373002/diff/40001/third_party/WebKit/Sour...
third_party/WebKit/Source/core/paint/InlineTextBoxPainter.cpp:277:
m_inlineTextBox.end() : m_inlineTextBox.start() + m_inlineTextBox.truncation() -
1);
Is this safe when truncation() is 0? Maybe it'd never occur as far as I searched
for setTruncation()?

[wkorman, 2016-09-14 19:34:47]

https://codereview.chromium.org/2337373002/diff/40001/third_party/WebKit/Sour...
File third_party/WebKit/Source/core/paint/InlineTextBoxPainter.cpp (right):

https://codereview.chromium.org/2337373002/diff/40001/third_party/WebKit/Sour...
third_party/WebKit/Source/core/paint/InlineTextBoxPainter.cpp:277:
m_inlineTextBox.end() : m_inlineTextBox.start() + m_inlineTextBox.truncation() -
1);
On 2016/09/14 05:21:31, kojii wrote:
> Is this safe when truncation() is 0? Maybe it'd never occur as far as I
searched
> for setTruncation()?

It should not occur, let's see:
- m_truncation is initialized to cNoTruncation (USHRT_MAX).
- it is only ever mutated via setTruncation() and clearTruncation(); the latter
resets it to cNoTruncation.
- of the four remaining calls to setTruncation() in the code base, in
InlineTextBox::placeEllipsisBox(), three set it to cFullTruncation and one sets
it to 'offset'. That one has an early-out ahead of it explicitly for the case
where offset == 0:

https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/layout/li...

so truncation should always be > 0, I think we're ok.

[wkorman, 2016-09-15 03:36:46]

wkorman@chromium.org changed reviewers:
+ schenney@chromium.org
- wangxianzhu@chromium.org

[wkorman, 2016-09-15 03:36:46]

+schenney for add'l review and OWNERS

[Stephen Chennney, 2016-09-15 17:47:05]

Nice stuff. lgtm.

[wkorman, 2016-09-15 17:57:03]

The CQ bit was checked by wkorman@chromium.org

[commit-bot: I haz the power, 2016-09-15 17:57:56]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-15 18:02:42]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-15 18:02:43]

Try jobs failed on following builders:
  android_arm64_dbg_recipe on master.tryserver.chromium.android (JOB_FAILED,
https://build.chromium.org/p/tryserver.chromium.android/builders/android_arm6...)
  android_clang_dbg_recipe on master.tryserver.chromium.android (JOB_FAILED,
https://build.chromium.org/p/tryserver.chromium.android/builders/android_clan...)
  android_compile_dbg on master.tryserver.chromium.android (JOB_FAILED,
https://build.chromium.org/p/tryserver.chromium.android/builders/android_comp...)
  android_n5x_swarming_rel on master.tryserver.chromium.android (JOB_FAILED,
https://build.chromium.org/p/tryserver.chromium.android/builders/android_n5x_...)
  cast_shell_android on master.tryserver.chromium.android (JOB_FAILED,
https://build.chromium.org/p/tryserver.chromium.android/builders/cast_shell_a...)
  linux_android_rel_ng on master.tryserver.chromium.android (JOB_FAILED,
https://build.chromium.org/p/tryserver.chromium.android/builders/linux_androi...)
  cast_shell_linux on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/cast_shell_linu...)
  chromeos_amd64-generic_chromium_compile_only_ng on
master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/chromeos_amd64-...)
  chromeos_daisy_chromium_compile_only_ng on master.tryserver.chromium.linux
(JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/chromeos_daisy_...)
  chromeos_x86-generic_chromium_compile_only_ng on
master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/chromeos_x86-ge...)
  chromium_presubmit on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/chromium_presub...)
  linux_chromium_chromeos_compile_dbg_ng on master.tryserver.chromium.linux
(JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_chromeos_ozone_rel_ng on master.tryserver.chromium.linux
(JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_chromeos_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_clobber_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_compile_dbg_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  linux_chromium_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)
  ios-device on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/ios-device/builds...)
  ios-simulator on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/ios-simulator/bui...)
  mac_chromium_compile_dbg_ng on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_comp...)
  mac_chromium_rel_ng on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)

[wkorman, 2016-09-15 18:29:32]

The CQ bit was checked by wkorman@chromium.org

[wkorman, 2016-09-15 18:29:33]

The patchset sent to the CQ was uploaded after l-g-t-m from
schenney@chromium.org, kojii@chromium.org
Link to the patchset: https://codereview.chromium.org/2337373002/#ps60001
(title: "Sync to head.")

[commit-bot: I haz the power, 2016-09-15 18:30:27]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-15 20:10:47]

Description was changed from

==========
Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

to

==========
Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

[commit-bot: I haz the power, 2016-09-15 20:10:48]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2016-09-15 20:12:37]

Description was changed from

==========
Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

to

==========
Update composition underline start/end constraints and add tests.

- Constrain paint start/end to be bounded by actual text size
  and leave space for at least one character.
- Include start() in paintLength for RTL in paintCompositionUnderline().
  It's included in paintEnd, and I believe its absence was a bug.
- Early-out when painting SVG inline text if text length is zero,
  as we do in for non-SVG inline text.
- Add some DCHECKs to reflect my understanding of key preconditions.
- Add basic LTR/RTL composition underline layout tests.
- Add a 'split' test case wherein InlineTextBox has start = 1.

BUG=641261
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Committed: https://crrev.com/7c023bffa5e0367f60d6aac94ac5b38af8802c2f
Cr-Commit-Position: refs/heads/master@{#418947}
==========

[commit-bot: I haz the power, 2016-09-15 20:12:38]

Patchset 4 (id:??) landed as
https://crrev.com/7c023bffa5e0367f60d6aac94ac5b38af8802c2f
Cr-Commit-Position: refs/heads/master@{#418947}