Fix 139196 selection OOB (#140300)

Fixes #139196

packages/flutter/lib/src/widgets/editable_text.dart

@@ -4742,6 +4742,15 @@ class EditableTextState extends State<EditableText> with AutomaticKeepAliveClien
   }
 
   void _updateSelection(UpdateSelectionIntent intent) {
+    assert(
+      intent.newSelection.start <= intent.currentTextEditingValue.text.length,
+      'invalid selection: ${intent.newSelection}: it must not exceed the current text length ${intent.currentTextEditingValue.text.length}',
+    );
+    assert(
+      intent.newSelection.end <= intent.currentTextEditingValue.text.length,
+      'invalid selection: ${intent.newSelection}: it must not exceed the current text length ${intent.currentTextEditingValue.text.length}',
+    );
+
     bringIntoView(intent.newSelection.extent);
     userUpdateTextEditingValue(
       intent.currentTextEditingValue.copyWith(selection: intent.newSelection),
@@ -5645,7 +5654,7 @@ class _UpdateTextSelectionVerticallyAction<T extends DirectionalCaretMovementInt
       : intent.forward ? currentRun.moveNext() : currentRun.movePrevious();
     final TextPosition newExtent = shouldMove
       ? currentRun.current
-      : intent.forward ? TextPosition(offset: state._value.text.length) : const TextPosition(offset: 0);
+      : intent.forward ? TextPosition(offset: value.text.length) : const TextPosition(offset: 0);
     final TextSelection newSelection = collapseSelection
       ? TextSelection.fromPosition(newExtent)
       : value.selection.extendTo(newExtent);

packages/flutter/test/widgets/editable_text_shortcuts_test.dart

@@ -1660,6 +1660,14 @@ void main() {
               );
             }
           }, variant: TargetPlatformVariant.all());
+
+          // Regression test for https://github.com/flutter/flutter/issues/139196.
+          testWidgets('does not create invalid selection', (WidgetTester tester) async {
+            controller.value = const TextEditingValue(text: 'A', selection: TextSelection.collapsed(offset: 1));
+            await tester.pumpWidget(buildEditableText());
+            controller.value = const TextEditingValue(text: 'AA', selection: TextSelection.collapsed(offset: 2));
+            await sendKeyCombination(tester, const SingleActivator(LogicalKeyboardKey.arrowDown));
+          }, variant: TargetPlatformVariant.all());
         });
       });
     },