This bug causes LayoutTests/fast/text/find-kana.html to assert in the following way: When a find is *successful* on a string with U+0300 character, chromium updates the selection and Font::selectionRectForComplexText(run, point, height, from, to) is called with run={length: 3, ...}, from=0, to=3, but the TextRunWalker walker(run) gets normalized so that walker={length: 2}, from=0, to=3, and we essentially hit an out-of-bounds problem when working with the walker. I think the correct fix is to not normalize in this case; I will submit a patch for this.
Created attachment 46326 [details] Patch
Created attachment 46327 [details] Patch
CC+ hbono
The normalization was added by Yusuke with my review (in r47922). (bug 28742). The patch looks ok, but I'm not sure.
LayoutTest failures for Chromium are being marked WontFix. The Bug is still accessible and referenced from TestExpectations.