Fix setComposingText when newCursorPosition != 1

third_party/WebKit/Source/core/editing/InputMethodController.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 213 matching lines @@
     if (!selection.isNone() && !m_compositionRange->collapsed()) {
         if (selection.start().compareTo(m_compositionRange->startPosition()) >= 0
             && selection.end().compareTo(m_compositionRange->endPosition()) <= 0)
             return;
     }
 
     cancelComposition();
     frame().chromeClient().didCancelCompositionOnSelectionChange();
 }
 
-void InputMethodController::setComposition(const String& text, const Vector<CompositionUnderline>& underlines, unsigned selectionStart, unsigned selectionEnd)
+void InputMethodController::setComposition(const String& text, const Vector<CompositionUnderline>& underlines, int selectionStart, int selectionEnd)
 {
     Editor::RevealSelectionScope revealSelectionScope(&editor());
 
     // Updates styles before setting selection for composition to prevent
     // inserting the previous composition text into text nodes oddly.
     // See https://bugs.webkit.org/show_bug.cgi?id=46868
     frame().document()->updateLayoutTree();
 
     selectComposition();
 
@@ skipping 67 matching lines @@
     m_isDirty = true;
     m_hasComposition = true;
     if (!m_compositionRange)
         m_compositionRange = Range::create(baseNode->document());
     m_compositionRange->setStart(baseNode, baseOffset);
     m_compositionRange->setEnd(baseNode, extentOffset);
 
     if (baseNode->layoutObject())
         baseNode->layoutObject()->setShouldDoFullPaintInvalidation();
 
-    unsigned start = std::min(baseOffset + selectionStart, extentOffset);
-    unsigned end = std::min(std::max(start, baseOffset + selectionEnd), extentOffset);
+    int start = std::min(std::max((int)baseOffset + selectionStart, 0), (int)extentOffset);

[Changwan Ryu, 2016/04/01 00:37:26]

baseOffset >= 0 so you just need to make sure selectionStart >= 0. I believe
that should happen in some other place.

[yabinh, 2016/04/01 04:14:17]

selectionStart can be negative, because it is the relative position of the
cursor.
If newCursorPosition < 1, selectionStart = newCursorPosition; If
newCursorPosition >= 1, selectionStart = newCursorPosition + text.length() - 1.

[Changwan Ryu, 2016/04/01 05:36:15]

I see. Thanks for clarification.
By the way, we prefer using static casting to c-style casting. So it should be
static_cast<int>(baseOffset). Also you'll need unit tests around the changed
behavior in Blink.

I was a bit worried that there would be a slight chance of overflow converting
from unsigned to int, but there are so many other places 
which does it incorrectly. I'll punt unsigned-int conversion issues to aelias@.

+    int end = std::min(std::max((int)baseOffset + selectionEnd, start), (int)extentOffset);
     RefPtrWillBeRawPtr<Range> selectedRange = Range::create(baseNode->document(), baseNode, start, baseNode, end);
     frame().selection().setSelectedRange(selectedRange.get(), TextAffinity::Downstream, SelectionDirectionalMode::NonDirectional, NotUserTriggered);
 
     if (underlines.isEmpty()) {
         frame().document()->markers().addCompositionMarker(m_compositionRange->startPosition(), m_compositionRange->endPosition(), Color::black, false, LayoutTheme::theme().platformDefaultCompositionBackgroundColor());
         return;
     }
     for (const auto& underline : underlines) {
         unsigned underlineStart = baseOffset + underline.startOffset;
         unsigned underlineEnd = baseOffset + underline.endOffset;
@@ skipping 119 matching lines @@
     TypingCommand::deleteSelection(*frame().document());
 }
 
 DEFINE_TRACE(InputMethodController)
 {
     visitor->trace(m_frame);
     visitor->trace(m_compositionRange);
 }
 
 } // namespace blink