Adding range checking to setSelection and setComposingRegion.

content/public/android/java/src/org/chromium/content/browser/input/AdapterInputConnection.java

Index: content/public/android/java/src/org/chromium/content/browser/input/AdapterInputConnection.java
diff --git a/content/public/android/java/src/org/chromium/content/browser/input/AdapterInputConnection.java b/content/public/android/java/src/org/chromium/content/browser/input/AdapterInputConnection.java
index 4929c6afcbc6beae479ef4da034333dea676291f..7d39b7fba1618f997f188a46dfc819aedd247b83 100644
--- a/content/public/android/java/src/org/chromium/content/browser/input/AdapterInputConnection.java
+++ b/content/public/android/java/src/org/chromium/content/browser/input/AdapterInputConnection.java
@@ -372,8 +372,9 @@ public class AdapterInputConnection extends BaseInputConnection {
      */
     @Override
     public boolean setSelection(int start, int end) {
-        if (DEBUG) Log.w(TAG, "setSelection");
-        if (start < 0 || end < 0) return true;
+        if (DEBUG) Log.w(TAG, "setSelection [" + start + " " + end + "]");
+        int textLength = getEditable().length();
+        if (start < 0 || end < 0 || start > textLength || end > textLength) return true;
         super.setSelection(start, end);
         return mImeAdapter.setEditableSelectionOffsets(start, end);
     }
@@ -395,10 +396,13 @@ public class AdapterInputConnection extends BaseInputConnection {
     @Override
     public boolean setComposingRegion(int start, int end) {
         if (DEBUG) Log.w(TAG, "setComposingRegion [" + start + " " + end + "]");
+        int textLength = getEditable().length();
         int a = Math.min(start, end);
         int b = Math.max(start, end);
         if (a < 0) a = 0;
         if (b < 0) b = 0;
+        if (a > textLength) a = textLength;
+        if (b > textLength) b = textLength;
 
         if (a == b) {
             removeComposingSpans(getEditable());