io_lib:format/3 can fall into an infinite loop when chars_limit is set

io_lib:format/3 can fall into an infinite loop when we have nested data structures (probably only with binaries)
and particular value for chars_limit.

The infinite loop appears in io_lib_pretty:find_upper/9 when io_lib_pretty:expand/3 starts to return
same values. Len returned by io_lib_pretty:expand/3 is equal to T which leads to a re-call of io_lib_pretty:find_upper/9.

I'm not sure that condition Len =< T is wrong. Probably io_lib_pretty:expand/3 or some function inside of has a mistake.

Example to reproduce error:

io_lib:format("~tp", [[{0, [<<"00">>]}]], [{chars_limit, 18}]).