Add check for ime text span offset bounds in ExtractCompositionText.

Seems like the start and end offsets for ime text spans are being
incorrectly computed for Japanese special characters, causing a crash
when trying to access char16_offsets[end].

Need to investigate further, but in the meantime, add a check for valid
start and end offsets and ignore the composition text span if the
offsets are out of bounds.

CQ_INCLUDE_TRYBOTS=luci.chrome.try:chromeos-betty-pi-arc-chrome

Bug: b/270390666
Change-Id: I47d531c1f2155a8b01394d4d455c474afadc7046
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4289048
Commit-Queue: Michelle Chen <michellegc@google.com>
Reviewed-by: Darren Shen <shend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1109496}

ui/base/ime/ash/input_method_ash.cc

@@ -990,8 +990,10 @@ CompositionText InputMethodAsh::ExtractCompositionText(
     for (const auto& text_ime_text_span : text_ime_text_spans) {
       const uint32_t start = text_ime_text_span.start_offset;
       const uint32_t end = text_ime_text_span.end_offset;
-      if (start >= end)
+      if (start >= end || end >= char16_offsets.size()) {
+        LOG(ERROR) << "IME composition invalid bounds.";
         continue;
+      }
       ui::ImeTextSpan ime_text_span(ui::ImeTextSpan::Type::kComposition,
                                     char16_offsets[start], char16_offsets[end],
                                     text_ime_text_span.thickness,