commit 720edf95db6c908f87dbbb33c6bde67aedb36899
author Keisuke Kuroyanagi <ksk@google.com> Thu Aug 27 18:15:48 2015 +0900
committer Raph Levien <raph@google.com> Mon Jan 11 22:29:12 2016 +0000
tree 341d86c7d250aeb15e15f8e8b04bfe1b2680d842
parent d3b2826a1a3ff128db1e89a081124192ac70c509

Fix: Cursor can be at an invalid offset in EditText.

"getLineEnd(line) - 1" is used as the return value when the
"horiz" is beyond the line end for multiple line text.
In this case, the returned value can point an invalid
offset like the middle point of a surrogate pair.

Bug: 23069901
Change-Id: I1afef7205a15079a42bb0018df73f70fe9ada862
(cherry picked from commit 00ad16d1cd24b788262ab4f62935e720a392da6d)

core/java/android/text/Layout.java

diff --git a/core/java/android/text/Layout.java b/core/java/android/text/Layout.java
index fa347b9..706d989 100644
--- a/core/java/android/text/Layout.java
+++ b/core/java/android/text/Layout.java
@@ -1130,13 +1130,18 @@
      */
     public int getOffsetForHorizontal(int line, float horiz) {
         // TODO: use Paint.getOffsetForAdvance to avoid binary search
-        int max = getLineEnd(line) - 1;
-        int min = getLineStart(line);
+        final int lineEndOffset = getLineEnd(line);
+        final int max;
+        if (line == getLineCount() - 1) {
+            max = lineEndOffset;
+        } else {
+            max = mPaint.getTextRunCursor(mText, 0, mText.length(),
+                    isRtlCharAt(lineEndOffset) ? Paint.DIRECTION_RTL : Paint.DIRECTION_LTR,
+                    lineEndOffset, Paint.CURSOR_BEFORE);
+        }
+        final int min = getLineStart(line);
         Directions dirs = getLineDirections(line);
 
-        if (line == getLineCount() - 1)
-            max++;
-
         int best = min;
         float bestdist = Math.abs(getPrimaryHorizontal(best) - horiz);