[Webkit-unassigned] [Bug 127424] Crashes in setTextForIterator

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=127424





--- Comment #9 from Brent Fulgham <bfulgham at webkit.org>  2014-01-22 10:39:17 PST ---
Thank you for tracking down the cause of this problem. After talking your patch over with a couple of the other people on the team, I *think* the correct solution is to remove the "+1" from the various places where UTextWithBufferInlineCapacity is used.

Note also that this method:
static UText* uTextLatin1Clone(UText* destination, const UText* source, UBool deep, UErrorCode* status)

calls utext_setup with a +1, unlike all other uses of utext_setup in the code base.

Looks like you found a nasty little off-by-one we've been living with for some time!

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.