Fix vector resize logic when encoding non-BMP chars to x-user-defined

third_party/WebKit/Source/wtf/text/TextCodecUserDefined.cpp

 /*
  * Copyright (C) 2007, 2008 Apple, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 51 matching lines @@
     result.append(static_cast<UChar>(c & 0xF7FF));
   }
 
   return result.toString();
 }
 
 template <typename CharType>
 static CString encodeComplexUserDefined(const CharType* characters,
                                         size_t length,
                                         UnencodableHandling handling) {
-  Vector<char> result(length);
+  size_t targetLength = length;
+  Vector<char> result(targetLength);
   char* bytes = result.data();
 
   size_t resultLength = 0;
   for (size_t i = 0; i < length;) {
     UChar32 c;
+    // TODO(jsbell): Will the input for x-user-defined ever be LChars?
     U16_NEXT(characters, i, length, c);
+    // If the input was a surrogate pair (non-BMP character) then we
+    // overestimated the length.
+    if (c > 0xffff)
+      --targetLength;
     signed char signedByte = static_cast<signed char>(c);
     if ((signedByte & 0xF7FF) == c) {
       bytes[resultLength++] = signedByte;
     } else {
       // No way to encode this character with x-user-defined.
       UnencodableReplacementArray replacement;
       int replacementLength =
           TextCodec::getUnencodableReplacement(c, handling, replacement);
-      result.grow(resultLength + replacementLength + length - i);
-      bytes = result.data();
+      DCHECK_GT(replacementLength, 0);
+      // Only one char was initially reserved per input character, so grow if
+      // necessary. Note that in the case of surrogate pairs and
+      // QuestionMarksForUnencodables the result length may be shorter than
+      // the input length.
+      targetLength += replacementLength - 1;
+      if (targetLength > result.size()) {
+        result.grow(targetLength);
+        bytes = result.data();
+      }
       memcpy(bytes + resultLength, replacement, replacementLength);
       resultLength += replacementLength;
     }
   }
 
   return CString(bytes, resultLength);
 }
 
 template <typename CharType>
 CString TextCodecUserDefined::encodeCommon(const CharType* characters,
@@ skipping 24 matching lines @@
   return encodeCommon(characters, length, handling);
 }
 
 CString TextCodecUserDefined::encode(const LChar* characters,
                                      size_t length,
                                      UnencodableHandling handling) {
   return encodeCommon(characters, length, handling);
 }
 
 }  // namespace WTF