Fix a buffer overflow in blink::HarfBuzzShaper::resolveCandidateRuns()

Source/platform/fonts/shaping/HarfBuzzShaper.cpp

 /*
  * Copyright (c) 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013 BlackBerry Limited. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 684 matching lines @@
         if (runs[j].script != USCRIPT_COMMON
             && runs[j].script != USCRIPT_INHERITED) {
             nextResolvedRun = j;
             break;
         }
     }
 }
 
 static inline bool resolveCandidateRuns(Vector<CandidateRun>& runs)
 {
-    UScriptCode scriptExtensions[8];
+    UScriptCode scriptExtensions[USCRIPT_CODE_LIMIT];
     UErrorCode errorCode = U_ZERO_ERROR;
     size_t length = runs.size();
     size_t nextResolvedRun = 0;
     for (size_t i = 0; i < length; i++) {
         CandidateRun& run = runs[i];
         nextResolvedRun = 0;
 
         if (run.script == USCRIPT_INHERITED)
             run.script = i > 0 ? runs[i - 1].script : USCRIPT_COMMON;
 
         int extensionsLength = uscript_getScriptExtensions(run.character,
-            scriptExtensions, sizeof(scriptExtensions), &errorCode);
+            scriptExtensions, sizeof(scriptExtensions) / sizeof(scriptExtensions[0]),
+            &errorCode);
         if (U_FAILURE(errorCode))
             return false;
 
         resolveRunBasedOnScriptExtensions(runs, run, i, length,
             scriptExtensions, extensionsLength, nextResolvedRun);
         resolveRunBasedOnScriptValue(runs, run, i, length,
             nextResolvedRun);
         for (size_t j = i; j < nextResolvedRun; j++)
             runs[j].script = runs[nextResolvedRun].script;
 
@@ skipping 471 matching lines @@
     // possibly invalid from, to arguments.
     if (!foundToX && !foundFromX)
         fromX = toX = 0;
 
     if (fromX < toX)
         return FloatRect(point.x() + fromX, point.y(), toX - fromX, height);
     return FloatRect(point.x() + toX, point.y(), fromX - toX, height);
 }
 
 } // namespace blink