Don't overflow in LayoutText::width() on a huge length.

third_party/WebKit/Source/core/layout/LayoutText.cpp

 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  * Copyright (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 1557 matching lines @@
     }
 
     m_containsReversedText |= !s->isLeftToRightDirection();
 }
 
 float LayoutText::width(unsigned from, unsigned len, LayoutUnit xPos, TextDirection textDirection, bool firstLine, HashSet<const SimpleFontData*>* fallbackFonts, FloatRect* glyphBounds) const
 {
     if (from >= textLength())
         return 0;
 
-    if (from + len > textLength())
+    if (len > textLength() || from + len > textLength())
         len = textLength() - from;
 
     return width(from, len, style(firstLine)->font(), xPos, textDirection, fallbackFonts, glyphBounds);
 }
 
 float LayoutText::width(unsigned from, unsigned len, const Font& f, LayoutUnit xPos, TextDirection textDirection, HashSet<const SimpleFontData*>* fallbackFonts, FloatRect* glyphBounds) const
 {
     ASSERT(from + len <= textLength());
     if (!textLength())
         return 0;
@@ skipping 220 matching lines @@
     LayoutRect rect =
         LayoutRect(IntRect(firstRunX(), firstRunY(), linesBox.width(), linesBox.height()));
     LayoutBlock* block = containingBlock();
     if (block && hasTextBoxes())
         block->adjustChildDebugRect(rect);
 
     return rect;
 }
 
 } // namespace blink