[Webkit-unassigned] [Bug 232053] Negative length returned by TextUtil::midWordBreak with surrogate pair

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=232053

--- Comment #3 from Gabriel Nava Marino <gnavamarino at apple.com> ---
Comment on attachment 441951
  --> https://bugs.webkit.org/attachment.cgi?id=441951
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=441951&action=review

>> Source/WebCore/layout/formattingContexts/inline/text/TextUtil.cpp:181
>> +    return { startPosition, std::max<unsigned>(right, startPosition) - startPosition, leftSideWidth };
> 
> Do you have any more detail about the circumstances leading to this being negative? I'm not sure this is the right fix.

Per this comment in the line above, "right" is computed to point to the start of the surrogate pair.
> // When the substring does not fit, the right side is supposed to be the start of the surrogate pair if applicable.

If our text is 'a\ud800\udc00a' then "right" gets value 1 per the logic in U16_SET_CP_START since this is where the surrogate starts. Since startPosition is 2, we end up computing a length = right - startPosition = 1 - 2 = -1.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20211021/ff2be745/attachment.htm>