Ref T13339. If a search pattern matches more than once on a line, we currently render the line incorreclty, duplicating some of the text.
substr() is being called as though the third parameter was end_offset, but it's actually length. Correct the parameter.