Don't overflow in LayoutText::width() on a huge length.

third_party/WebKit/Source/core/layout/LayoutText.cpp

 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  * Copyright (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 1557 matching lines @@
     }
 
     m_containsReversedText |= !s->isLeftToRightDirection();
 }
 
 float LayoutText::width(unsigned from, unsigned len, LayoutUnit xPos, TextDirection textDirection, bool firstLine, HashSet<const SimpleFontData*>* fallbackFonts, FloatRect* glyphBounds) const
 {
     if (from >= textLength())
         return 0;
 
-    if (from + len > textLength())
+    if (len > textLength() || from + len > textLength())
         len = textLength() - from;
 
     return width(from, len, style(firstLine)->font(), xPos, textDirection, fallbackFonts, glyphBounds);
 }
 
 float LayoutText::width(unsigned from, unsigned len, const Font& f, LayoutUnit xPos, TextDirection textDirection, HashSet<const SimpleFontData*>* fallbackFonts, FloatRect* glyphBounds) const
 {
     ASSERT(from + len <= textLength());
     if (!textLength())
         return 0;
 
+    // TODO(wkorman): Incorporate constraints around |from| and |len| in the preceding variant of width() here.

[wkorman, 2016/09/17 00:17:22]

Seeking feedback on this. AFAICT this method variant is also public, and is
exposed in api/LineLayoutText.h, and callsites could conceivably pass in the
same invalid data we guard against in the preceding method variant.

So we could move the shared logic used here and above into a widthInternal()
method and have them both enact the constraints, but wanted to hear your
thoughts and can do in separate change in any case.

[eae, 2016/09/17 08:35:51]

The other method calls this one with style(firstLine)->font()) as the Font so
you only need the check here.

[wkorman, 2016/09/17 21:16:42]

That's true, but this method is exposed and can be called directly from other
sources (and there are a couple already though they are in line layout code).

So IMO we should guard here as well and just structure so that we don't guard
2x, but we can discuss in separate change.

+
     float w;
     if (&f == &style()->font()) {
         if (!style()->preserveNewline() && !from && len == textLength()) {
             if (fallbackFonts) {
                 ASSERT(glyphBounds);
                 if (preferredLogicalWidthsDirty() || !m_knownToHaveNoOverflowAndNoFallbackFonts)
                     const_cast<LayoutText*>(this)->computePreferredLogicalWidths(0, *fallbackFonts, *glyphBounds);
                 else
                     *glyphBounds = FloatRect(0, -f.getFontMetrics().floatAscent(), m_maxWidth, f.getFontMetrics().floatHeight());
                 w = m_maxWidth;
@@ skipping 209 matching lines @@
     LayoutRect rect =
         LayoutRect(IntRect(firstRunX(), firstRunY(), linesBox.width(), linesBox.height()));
     LayoutBlock* block = containingBlock();
     if (block && hasTextBoxes())
         block->adjustChildDebugRect(rect);
 
     return rect;
 }
 
 } // namespace blink