fix(macOS): clamp IME selected_range to prevent substringToIndex crash

macOS native Pinyin IME can send a selected_range that exceeds the
marked text string length (e.g. index 8 for a 6-character string).
This caused an NSRangeException in substringToIndex:, crashing the
application with SIGABRT.

Clamp both location and end to the string's UTF-16 length before
calling substringToIndex.

src/changelog/unreleased.md

@@ -45,3 +45,4 @@ changelog entry.
 - On macOS, fixed crash when dragging non-file content onto window.
 - On X11, fix `set_hittest` not working on some window managers.
 - On X11, fix debug mode overflow panic in `set_timestamp`.
+- On macOS, fix crash in `set_marked_text` when native Pinyin IME sends out-of-bounds `selected_range`.

src/platform_impl/macos/view.rs

@@ -316,9 +316,15 @@ declare_class!(
                 // sending a `None` cursor range.
                 None
             } else {
+                // Clamp to string length to avoid NSRangeException from out-of-bounds
+                // indices sent by macOS IME (e.g. native Pinyin, see
+                // https://github.com/alacritty/alacritty/issues/8791).
+                let len = string.length();
+                let location = selected_range.location.min(len);
+                let end = selected_range.end().min(len);
                 // Convert the selected range from UTF-16 indices to UTF-8 indices.
-                let sub_string_a = unsafe { string.substringToIndex(selected_range.location) };
-                let sub_string_b = unsafe { string.substringToIndex(selected_range.end()) };
+                let sub_string_a = unsafe { string.substringToIndex(location) };
+                let sub_string_b = unsafe { string.substringToIndex(end) };
                 let lowerbound_utf8 = sub_string_a.len();
                 let upperbound_utf8 = sub_string_b.len();
                 Some((lowerbound_utf8, upperbound_utf8))