Fix handling of malformed surrogate pairs for break-all

third_party/WebKit/Source/core/layout/TextRunConstructor.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 121 matching lines @@
                               ? TextDirection::kLtr
                               : determineDirectionality(string),
                           flags);
 }
 
 TextRun constructTextRun(const Font& font,
                          const LineLayoutText text,
                          unsigned offset,
                          unsigned length,
                          const ComputedStyle& style) {
-  ASSERT(offset + length <= text.textLength());
+  SECURITY_DCHECK(offset + length <= text.textLength());
   if (text.hasEmptyText()) {
     return constructTextRunInternal(font, static_cast<const LChar*>(nullptr), 0,
                                     style, TextDirection::kLtr);
   }
   if (text.is8Bit()) {
     return constructTextRunInternal(font, text.characters8() + offset, length,
                                     style, TextDirection::kLtr);
   }
 
   TextRun run = constructTextRunInternal(font, text.characters16() + offset,
                                          length, style, TextDirection::kLtr);
   run.setDirection(directionForRun(run));
   return run;
 }
 
 }  // namespace blink