chore: cherry-pick ecdec1fb0f42 from chromium

[ppontes]

Fix text eliding for single-codepoint text with BiDi

This CL is fixing a corner case where RenderText::Elide(...) may
produce a text with more codepoints than the original one. This is
an issue since the breaklists are not resized and the overflow
will lead the render_text code to perfoarm an out-of-bound memory
access by deferencing breaks_.end() while rendering the text. This
is causing chrome to crash.

See crbug/1142020 for details.

The bug was happening when:

1. The text to elide was a single codepoint
2. The width of the glyph of the codepoint is larger than the width
   of the ellipsis glyph
3. Eliding is set to ELIDING_TAIL
4. The display_rect width will trigger eliding
   (smaller than codepoint width, but larger than ellipsis width)
5. The render text is set to RTL

A possible solution is to adjust the breaklist but this required
larger refactoring and cannot be a minimal patch to be merge on
other channels.

TBR=msw@chromium.org
(cherry picked from commit e54920751871321474e0b953329c8aedcc8702c3)

Bug: 1142020
Change-Id: I9854651175562ec5f0d0bf7083a8da99fede0e29
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2522892
Commit-Queue: Etienne Bergeron etienneb@chromium.org
Reviewed-by: Michael Wasserman msw@chromium.org
Cr-Original-Commit-Position: refs/heads/master@{#824878}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2537931
Reviewed-by: Etienne Bergeron etienneb@chromium.org
Cr-Commit-Position: refs/branch-heads/4240@{#1450}
Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}

Notes: Security: backported the fix to heap-buffer-overflow in gfx::internal::StyleIterator::GetTextBreakingRange.

[release-clerk]

Release Notes Persisted

Security: backported the fix for https://crbug.com/1142020.

[nornagon]

Nit: it's best if we include the crbug ID in the release notes