Fix for 7281523 android.text.cts.SelectionTest#testMoveRight failures

The failures were caused by the implementation of doTextRunCursor
passing a too-small value for contextCount into the underlying
getTextRunAdvances call (it wasn't accounting for the start offset).
Thus, when getTextRunAdvances made a copy of the text for its cache key,
it was getting a partial copy.

This patch fixes the size so the cache key always has a full copy of the
text.

Change-Id: I57e3ac6de7aef0e1f1c7000dc3d653f9b0d623d2

core/jni/android/graphics/Paint.cpp

@@ -629,7 +629,7 @@ public:
             jint count, jint flags, jint offset, jint opt) {
         jfloat scalarArray[count];
 
-        TextLayout::getTextRunAdvances(paint, text, start, count, count, flags,
+        TextLayout::getTextRunAdvances(paint, text, start, count, start + count, flags,
                 scalarArray, NULL /* dont need totalAdvance */);
 
         jint pos = offset - start;