Fix crash in PDF accessibility when PDF engine reports -1 as char count.

pdf/out_of_process_instance.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "pdf/out_of_process_instance.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>  // for min/max()
@@ skipping 729 matching lines @@
   pp::Module::Get()->core()->CallOnMainThread(kAccessibilityPageDelayMs,
                                               callback, 0);
 }
 
 void OutOfProcessInstance::SendNextAccessibilityPage(int32_t page_index) {
   int page_count = engine_->GetNumberOfPages();
   if (page_index < 0 || page_index >= page_count)
     return;
 
   int char_count = engine_->GetCharCount(page_index);
+
+  // Treat a char count of -1 (error) as 0 (an empty page), since
+  // other pages might have valid content.
+  if (char_count < 0)
+    char_count = 0;
+
   PP_PrivateAccessibilityPageInfo page_info;
   page_info.page_index = page_index;
   page_info.bounds = engine_->GetPageBoundsRect(page_index);
   page_info.char_count = char_count;
 
   std::vector<PP_PrivateAccessibilityCharInfo> chars(page_info.char_count);
   for (uint32_t i = 0; i < page_info.char_count; ++i) {
     chars[i].unicode_character = engine_->GetCharUnicode(page_index, i);
   }
 
@@ skipping 884 matching lines @@
     const pp::FloatPoint& scroll_offset) {
   float max_x = document_size_.width() * zoom_ - plugin_dip_size_.width();
   float x = std::max(std::min(scroll_offset.x(), max_x), 0.0f);
   float min_y = -top_toolbar_height_;
   float max_y = document_size_.height() * zoom_ - plugin_dip_size_.height();
   float y = std::max(std::min(scroll_offset.y(), max_y), min_y);
   return pp::FloatPoint(x, y);
 }
 
 }  // namespace chrome_pdf