Enforce consistent sizes for arrays in SpannableStringInternal

The grow logic in SpannableStringInternal#setSpan assumes that the
size of mSpanData is consistent with that of mSpans, in particular
that if the latter doesn't need to grow, neither does the former.
The copySpans() method didn't enforce this, creating an mSpanData
array only big enough to hold the data.

This patch documents the invariant in a comment and enforces it.

Bug: 30359314
Change-Id: Ie25db70a76836e97af8476a7f5c10cb4b976c1cf

core/java/android/text/SpannableStringInternal.java

@@ -33,6 +33,7 @@ import java.lang.reflect.Array;
             mText = source.toString().substring(start, end);
 
         mSpans = EmptyArray.OBJECT;
+        // Invariant: mSpanData.length = mSpans.length * COLUMNS
         mSpanData = EmptyArray.INT;
 
         if (source instanceof Spanned) {
@@ -99,7 +100,7 @@ import java.lang.reflect.Array;
             Object[] srcSpans = src.mSpans;
             mSpanCount = count;
             mSpans = ArrayUtils.newUnpaddedObjectArray(mSpanCount);
-            mSpanData = new int[mSpanCount * COLUMNS];
+            mSpanData = new int[mSpans.length * COLUMNS];
             for (int i = 0, j = 0; i < limit; i++) {
                 int spanStart = srcData[i * COLUMNS + START];
                 int spanEnd = srcData[i * COLUMNS + END];