Fixing the bounds check in cancelCompositionIfSelectionIsInvalid.

Source/core/editing/InputMethodController.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 154 matching lines @@
 void InputMethodController::cancelCompositionIfSelectionIsInvalid()
 {
     if (!hasComposition() || editor().preventRevealSelection())
         return;
 
     // Check if selection start and selection end are valid.
     Position start = m_frame->selection().start();
     Position end = m_frame->selection().end();
     if (start.containerNode() == m_compositionNode
         && end.containerNode() == m_compositionNode
-        && static_cast<unsigned>(start.computeOffsetInContainerNode()) > m_compositionStart
-        && static_cast<unsigned>(end.computeOffsetInContainerNode()) < m_compositionEnd)
+        && static_cast<unsigned>(start.computeOffsetInContainerNode()) >= m_compositionStart
+        && static_cast<unsigned>(end.computeOffsetInContainerNode()) <= m_compositionEnd)
         return;
 
     cancelComposition();
     editorClient().didCancelCompositionOnSelectionChange();
 }
 
 void InputMethodController::finishComposition(const String& text, FinishCompositionMode mode)
 {
     ASSERT(mode == ConfirmComposition || mode == CancelComposition);
     UserTypingGestureIndicator typingGestureIndicator(m_frame);
@@ skipping 188 matching lines @@
 
 bool InputMethodController::setSelectionOffsets(const PlainTextOffsets& selectionOffsets)
 {
     if (selectionOffsets.isNull())
         return false;
     // FIXME: We should move Editor::setSelectionOffsets() into InputMethodController class.
     return editor().setSelectionOffsets(selectionOffsets.start(), selectionOffsets.end());
 }
 
 } // namespace WebCore