Don't overflow in LayoutText::width() on a huge length.

third_party/WebKit/Source/core/layout/LayoutText.cpp

Index: third_party/WebKit/Source/core/layout/LayoutText.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutText.cpp b/third_party/WebKit/Source/core/layout/LayoutText.cpp
index 2dbaf857cf174032c1a2b13fbfcf7879d8ff693e..b431130e8a97f12c518bd2a29eae4af6847ac5f7 100644
--- a/third_party/WebKit/Source/core/layout/LayoutText.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutText.cpp
@@ -1575,7 +1575,7 @@ float LayoutText::width(unsigned from, unsigned len, LayoutUnit xPos, TextDirect
     if (from >= textLength())
         return 0;
 
-    if (from + len > textLength())
+    if (len > textLength() || from + len > textLength())
         len = textLength() - from;
 
     return width(from, len, style(firstLine)->font(), xPos, textDirection, fallbackFonts, glyphBounds);
@@ -1587,6 +1587,8 @@ float LayoutText::width(unsigned from, unsigned len, const Font& f, LayoutUnit x
     if (!textLength())
         return 0;
 
+    // TODO(wkorman): Incorporate constraints around |from| and |len| in the preceding variant of width() here.

[wkorman, 2016/09/17 00:17:22]

Seeking feedback on this. AFAICT this method variant is also public, and is
exposed in api/LineLayoutText.h, and callsites could conceivably pass in the
same invalid data we guard against in the preceding method variant.

So we could move the shared logic used here and above into a widthInternal()
method and have them both enact the constraints, but wanted to hear your
thoughts and can do in separate change in any case.

[eae, 2016/09/17 08:35:51]

The other method calls this one with style(firstLine)->font()) as the Font so
you only need the check here.

[wkorman, 2016/09/17 21:16:42]

That's true, but this method is exposed and can be called directly from other
sources (and there are a couple already though they are in line layout code).

So IMO we should guard here as well and just structure so that we don't guard
2x, but we can discuss in separate change.

+
     float w;
     if (&f == &style()->font()) {
         if (!style()->preserveNewline() && !from && len == textLength()) {