Prevent copyTextTo() from Breaking Code Points

third_party/WebKit/Source/core/editing/iterators/TextIterator.h

Index: third_party/WebKit/Source/core/editing/iterators/TextIterator.h
diff --git a/third_party/WebKit/Source/core/editing/iterators/TextIterator.h b/third_party/WebKit/Source/core/editing/iterators/TextIterator.h
index 7e3ca291926f92910076dd51bc14845b1cc87789..8bd09c39469c403d60846e96eb837ca11d69174c 100644
--- a/third_party/WebKit/Source/core/editing/iterators/TextIterator.h
+++ b/third_party/WebKit/Source/core/editing/iterators/TextIterator.h
@@ -79,13 +79,19 @@ public:
 
     bool breaksAtReplacedElement() { return !(m_behavior & TextIteratorDoesNotBreakAtReplacedElement); }
 
-    // Append characters with offset range [position, position + copyLength)
-    // to the output buffer.
+    // Calculate the minimum |actualLength >= minLength| such that code units
+    // with offset range [position, position + actualLength) are whole code
+    // points. Append these code points to |output| and return |actualLength|.
     template<typename BufferType>
-    void copyTextTo(BufferType& output, int position, int copyLength) const { m_textState.appendTextTo(output, position, copyLength); }
+    int copyTextTo(BufferType& output, int position, int minLength) const
+    {
+        int copiedLength = isBetweenSurrogatePair(position + minLength) ? minLength + 1 : minLength;
+        copyCodeUnitsTo(output, position, copiedLength);
+        return copiedLength;
+    }
 
     template<typename BufferType>
-    void copyTextTo(BufferType& output, int position = 0) const { copyTextTo(output, position, length() - position); }
+    int copyTextTo(BufferType& output, int position = 0) const { return copyTextTo(output, position, length() - position); }
 
     // Computes the length of the given range using a text iterator. The default
     // iteration behavior is to always emit object replacement characters for
@@ -149,6 +155,13 @@ private:
 
     bool excludesAutofilledValue() const { return m_behavior & TextIteratorExcludeAutofilledValue; }
 
+    bool isBetweenSurrogatePair(int position) const;
+
+    // Append code units with offset range [position, position + copyLength)
+    // to the output buffer.
+    template<typename BufferType>
+    void copyCodeUnitsTo(BufferType& output, int position, int copyLength) const { m_textState.appendTextTo(output, position, copyLength); }
+
     // Current position, not necessarily of the text being returned, but position
     // as we walk through the DOM tree.
     RawPtrWillBeMember<Node> m_node;