Fix handling of malformed surrogate pairs for break-all

third_party/WebKit/Source/core/layout/LayoutText.cpp

 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  * Copyright (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  *
  */
 
 #include "core/layout/LayoutText.h"
 
+#include <algorithm>
 #include "core/dom/AXObjectCache.h"
 #include "core/dom/Text.h"
 #include "core/editing/VisiblePosition.h"
 #include "core/editing/iterators/TextIterator.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutBlock.h"
 #include "core/layout/LayoutTableCell.h"
 #include "core/layout/LayoutTextCombine.h"
 #include "core/layout/LayoutView.h"
@@ skipping 969 matching lines @@
   float min = std::numeric_limits<float>::max();
   int end = start + length;
   for (int i = start; i < end;) {
     int fragmentLength;
     if (breakAllOrBreakWord == EWordBreak::BreakAllWordBreak) {
       breakIterator.isBreakable(i + 1, nextBreakable, LineBreakType::BreakAll);
       fragmentLength = (nextBreakable > i ? nextBreakable : length) - i;
     } else {
       fragmentLength = U16_LENGTH(layoutText->codepointAt(i));
     }
+
+    // Ensure that malformed surrogate pairs don't cause us to read
+    // past the end of the string.
+    int textLength = layoutText->textLength();
+    if (i + fragmentLength > textLength)
+      fragmentLength = std::max(textLength - i, 0);
+
     // The correct behavior is to measure width without re-shaping, but we
     // reshape each fragment here because a) the current line breaker does not
     // support it, b) getCharacterRange() can reshape if the text is too long
     // to fit in the cache, and c) each fragment here is almost 1 char and thus
     // reshape is fast.
     TextRun run = constructTextRun(font, layoutText, i, fragmentLength, style,
                                    textDirection);
     float fragmentWidth = font.width(run);
     min = std::min(min, fragmentWidth);
     i += fragmentLength;
@@ skipping 993 matching lines @@
   LayoutRect rect = LayoutRect(
       IntRect(firstRunX(), firstRunY(), linesBox.width(), linesBox.height()));
   LayoutBlock* block = containingBlock();
   if (block && hasTextBoxes())
     block->adjustChildDebugRect(rect);
 
   return rect;
 }
 
 }  // namespace blink