Fix bugs 1827027, 1808979, 1820700.

These are all variations of needing to validate ranges on editing operations
coming from the IME, to account for the underlying text changing (usually being
deleted) asynchronously with the IME.
diff --git a/core/java/android/view/inputmethod/BaseInputConnection.java b/core/java/android/view/inputmethod/BaseInputConnection.java
index 11de3e2..9a0f467 100644
--- a/core/java/android/view/inputmethod/BaseInputConnection.java
+++ b/core/java/android/view/inputmethod/BaseInputConnection.java
@@ -297,6 +297,10 @@
             b = tmp;
         }
 
+        if (a <= 0) {
+            return "";
+        }
+        
         if (length > a) {
             length = a;
         }
@@ -488,12 +492,12 @@
         } else {
             a = Selection.getSelectionStart(content);
             b = Selection.getSelectionEnd(content);
-            if (a >=0 && b>= 0 && a != b) {
-                if (b < a) {
-                    int tmp = a;
-                    a = b;
-                    b = tmp;
-                }
+            if (a < 0) a = 0;
+            if (b < 0) b = 0;
+            if (b < a) {
+                int tmp = a;
+                a = b;
+                b = tmp;
             }
         }
 
diff --git a/core/java/android/widget/TextView.java b/core/java/android/widget/TextView.java
index 1678f9a..9479f9e 100644
--- a/core/java/android/widget/TextView.java
+++ b/core/java/android/widget/TextView.java
@@ -6469,6 +6469,13 @@
         
         protected void onReceiveResult(int resultCode, Bundle resultData) {
             if (resultCode != InputMethodManager.RESULT_SHOWN) {
+                final int len = mText.length();
+                if (mNewStart > len) {
+                    mNewStart = len;
+                }
+                if (mNewEnd > len) {
+                    mNewEnd = len;
+                }
                 Selection.setSelection((Spannable)mText, mNewStart, mNewEnd);
             }
         }