Fix a buffer overflow in blink::HarfBuzzShaper::resolveCandidateRuns()

Fix a buffer overflow in blink::HarfBuzzShaper::resolveCandidateRuns()

The capacity value passed to uscript_getScriptExtensions() is
incorrectly calculated as sizeof(scriptExtensions). This results in a
buffer overflow when ICU returns more than 8 script codes.

Fix the above issue by correctly passing the number of elements the
scriptExtensions array can hold as the capacity parameter.

Additionally, expand the scriptExtensions array to USCRIPT_CODE_LIMIT
elements, to account for extra script codes returned by ICU 54.1.

Note: USCRIPT_CODE_LIMIT is probably much larger than the maximum number
      of scripts that ICU will return. For example, ICU 54.1 specifies
      USCRIPT_CODE_LIMIT to be 167, while the maximum value returned by
      uscript_getScriptExtensions() is 17 (for code points in 0..0x10ffff).

      We could use a much smaller array, but in the case it becomes
      insufficient in the future, the U_BUFFER_OVERFLOW_ERROR error
      returned by ICU would be silently ignored.

BUG=445075
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=188995

[Evangelos Foutras, 2015-01-25 09:03:11]

evangelos@foutrelis.com changed reviewers:
+ behdad@chromium.org, dglazkov@chromium.org

[Evangelos Foutras, 2015-01-25 09:03:12]

Sorry if I have added wrong reviewers and/or CC recipients. (I took the
reviewers from CR#134983003.)

[eae, 2015-01-26 18:28:01]

eae@chromium.org changed reviewers:
+ eae@chromium.org

[eae, 2015-01-26 18:28:02]

LGTM

[eae, 2015-01-26 18:29:09]

167 seems a bit excessive but I suppose it is better than hard coding a value.

[Evangelos Foutras, 2015-01-26 18:30:55]

On 2015/01/26 18:29:09, eae wrote:
> 167 seems a bit excessive but I suppose it is better than hard coding a value.

That was my thinking too. It's hard to come up with a smaller value that still
remains safe to use.

[Evangelos Foutras, 2015-01-26 20:05:03]

The CQ bit was checked by evangelos@foutrelis.com

[commit-bot: I haz the power, 2015-01-26 20:05:59]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/868393002/1

[commit-bot: I haz the power, 2015-01-26 21:55:24]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-01-26 21:55:25]

Try jobs failed on following builders:
  win_blink_rel on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/win_blink_rel/builds/47812)

[Evangelos Foutras, 2015-01-26 22:20:08]

The CQ bit was checked by evangelos@foutrelis.com

[commit-bot: I haz the power, 2015-01-26 22:20:56]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/868393002/1

[commit-bot: I haz the power, 2015-01-26 23:01:10]

Committed patchset #1 (id:1) as
https://src.chromium.org/viewvc/blink?view=rev&revision=188995