Fix an issue in CorvusSKK IME when using TSF on Windows.

Usually IMEs use InsertTextAtSelection() API to insert new composition
text. However, some third-party IMEs like CorvusSKK uses SetText() API
to insert new composition text. We should allow IMEs to use both
SetText() API and InsertTextAtSelection() API to insert new text.

Bug: 944452
Change-Id: I9e32c07b91a4695e11e806abe0ef40601da95ad0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1542174
Reviewed-by: Yohei Yukawa <yukawa@chromium.org>
Commit-Queue: Siye Liu <siliu@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#645545}

ui/base/ime/win/tsf_text_store.cc

@@ -1176,7 +1176,8 @@ void TSFTextStore::CommitTextAndEndCompositionIfAny(size_t old_size,
       !text_input_client_->HasCompositionText()) {
     // This is a special case to handle text replacement scenarios during
     // English typing when we are trying to replace an existing text with some
-    // new text.
+    // new text. Some third-party IMEs also use SetText() API instead of
+    // InsertTextAtSelection() API to insert new text.
     size_t new_text_size;
     if (new_size == replace_text_range_.start()) {
       // This usually happens when TSF is trying to replace a part of a string
@@ -1187,16 +1188,21 @@ void TSFTextStore::CommitTextAndEndCompositionIfAny(size_t old_size,
     }
     const base::string16& new_committed_string = string_buffer_document_.substr(
         replace_text_range_.start(), new_text_size);
-    text_input_client_->ExtendSelectionAndDelete(
-        replace_text_range_.end() - replace_text_range_.start(), 0);
+    // if the |replace_text_range_| start is greater than |old_size|, then we
+    // don't need to delete anything because the replacement text hasn't been
+    // inserted into blink yet.
+    if (old_size > replace_text_range_.start()) {
+      text_input_client_->ExtendSelectionAndDelete(
+          old_size - replace_text_range_.start(), 0);
+    }
     text_input_client_->InsertText(new_committed_string);
   } else {
     // Construct string to be committed.
     size_t new_committed_string_offset = old_size;
     size_t new_committed_string_size = new_size - old_size;
-    // This is a special case. if we are replacing existing text, then
-    // commit the new text.
-    if (new_text_inserted_ &&
+    // This is a special case. We should only replace existing text and commit
+    // the new text if replacement text has already been inserted into Blink.
+    if (new_text_inserted_ && (old_size > replace_text_range_.start()) &&
         (replace_text_range_.start() != replace_text_range_.end())) {
       new_committed_string_offset = replace_text_range_.start();
       new_committed_string_size = replace_text_size_;