Merge "Fix issue 3022800." into gingerbread
diff --git a/core/java/android/view/inputmethod/BaseInputConnection.java b/core/java/android/view/inputmethod/BaseInputConnection.java
index 3801948..f7c869b 100644
--- a/core/java/android/view/inputmethod/BaseInputConnection.java
+++ b/core/java/android/view/inputmethod/BaseInputConnection.java
@@ -428,8 +428,12 @@
                 a = b;
                 b = tmp;
             }
+            // Clip the end points to be within the content bounds.
+            final int length = content.length();
             if (a < 0) a = 0;
-            if (b > content.length()) b = content.length();
+            if (b < 0) b = 0;
+            if (a > length) a = length;
+            if (b > length) b = length;
 
             ensureDefaultComposingSpans();
             if (mDefaultComposingSpans != null) {