Fix handling of malformed surrogate pairs for break-all

third_party/WebKit/Source/core/layout/TextRunConstructor.cpp

Index: third_party/WebKit/Source/core/layout/TextRunConstructor.cpp
diff --git a/third_party/WebKit/Source/core/layout/TextRunConstructor.cpp b/third_party/WebKit/Source/core/layout/TextRunConstructor.cpp
index f7707d47ed336329970b7ac4571fe6444006ddcd..c0ed240d27668c448e241241bedbadf20d6ad1d6 100644
--- a/third_party/WebKit/Source/core/layout/TextRunConstructor.cpp
+++ b/third_party/WebKit/Source/core/layout/TextRunConstructor.cpp
@@ -139,7 +139,7 @@ TextRun constructTextRun(const Font& font,
                          unsigned offset,
                          unsigned length,
                          const ComputedStyle& style) {
-  ASSERT(offset + length <= text.textLength());
+  SECURITY_DCHECK(offset + length <= text.textLength());
   if (text.hasEmptyText()) {
     return constructTextRunInternal(font, static_cast<const LChar*>(nullptr), 0,
                                     style, TextDirection::kLtr);