Add CharacterData.deleteData()/replaceData() overflow handling.

Add CharacterData.deleteData()/replaceData() overflow handling.

If the offset and count exceed the underlying length, the spec tells us

  http://dom.spec.whatwg.org/#concept-cd-replace (step 3)

to use a count that is equal to length minus the offset. Perform that
check in an overflow-sensitive manner.

(Change based on https://codereview.chromium.org/188693007/ )

R=
BUG=349898
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=171165

[sof, 2014-04-09 09:34:33]

When you have a moment, please take a look.

Continuing (and hopefully completing) https://codereview.chromium.org/188693007/

[eseidel, 2014-04-09 17:48:39]

lgtm

[commit-bot: I haz the power, 2014-04-09 17:48:46]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/sigbjornf@opera.com/229793004/1

[commit-bot: I haz the power, 2014-04-09 19:00:35]

Change committed as 171165

[tapted, 2014-04-10 03:16:18]

+gardeners

https://codereview.chromium.org/229793004/diff/1/Source/core/dom/CharacterDat...
File Source/core/dom/CharacterData.cpp (right):

https://codereview.chromium.org/229793004/diff/1/Source/core/dom/CharacterDat...
Source/core/dom/CharacterData.cpp:146: newStr.remove(offset, realCount);
[sheriff] hi there! gcc is generating a warning here: CharacterData.cpp:146:36:
error: 'realCount' may be used uninitialized in this function
[-Werror=maybe-uninitialized]
chromeos-chrome-36.0.1933.0_alpha-r1:      newStr.remove(offset, realCount);

It's coming up in the chrome tree, so I think we need to revert that blink roll.

[sof, 2014-04-10 06:58:54]

https://codereview.chromium.org/229793004/diff/1/Source/core/dom/CharacterDat...
File Source/core/dom/CharacterData.cpp (right):

https://codereview.chromium.org/229793004/diff/1/Source/core/dom/CharacterDat...
Source/core/dom/CharacterData.cpp:146: newStr.remove(offset, realCount);
On 2014/04/10 03:16:18, tapted wrote:
> [sheriff] hi there! gcc is generating a warning here:
CharacterData.cpp:146:36:
> error: 'realCount' may be used uninitialized in this function
> [-Werror=maybe-uninitialized]
> chromeos-chrome-36.0.1933.0_alpha-r1:      newStr.remove(offset, realCount);
> 
> It's coming up in the chrome tree, so I think we need to revert that blink
roll.

Thanks (what gcc version?)

https://codereview.chromium.org/232603002/ to address. Or if it results in fewer
bumps to revert this CL & combine the two, that can alternatively be done.