Fix: Cursor can be at an invalid offset in EditText.

"getLineEnd(line) - 1" is used as the return value when the
"horiz" is beyond the line end for multiple line text.
In this case, the returned value can point an invalid
offset like the middle point of a surrogate pair.

Bug: 23069901
Change-Id: I1afef7205a15079a42bb0018df73f70fe9ada862
(cherry picked from commit 00ad16d1cd24b788262ab4f62935e720a392da6d)

1 files changed, 10 insertions, 5 deletions

diff --git a/core/java/android/text/Layout.java b/core/java/android/text/Layout.java
index fa347b9..706d989 100644
--- a/core/java/android/text/Layout.java
+++ b/core/java/android/text/Layout.java
@@ -1130,13 +1130,18 @@ public abstract class Layout {
      */
     public int getOffsetForHorizontal(int line, float horiz) {
         // TODO: use Paint.getOffsetForAdvance to avoid binary search
-        int max = getLineEnd(line) - 1;
-        int min = getLineStart(line);
+        final int lineEndOffset = getLineEnd(line);
+        final int max;
+        if (line == getLineCount() - 1) {
+            max = lineEndOffset;
+        } else {
+            max = mPaint.getTextRunCursor(mText, 0, mText.length(),
+                    isRtlCharAt(lineEndOffset) ? Paint.DIRECTION_RTL : Paint.DIRECTION_LTR,
+                    lineEndOffset, Paint.CURSOR_BEFORE);
+        }
+        final int min = getLineStart(line);
         Directions dirs = getLineDirections(line);
 
-        if (line == getLineCount() - 1)
-            max++;
-
         int best = min;
         float bestdist = Math.abs(getPrimaryHorizontal(best) - horiz);