ASSERT hit in surrogatePairAwareIndex and surrogatePairAwareStart lam…

…bdas for text with unpaired surrogates https://bugs.webkit.org/show_bug.cgi?id=231606 Patch by Gabriel Nava Marino <gnavamarino@apple.com> on 2021-10-12 Reviewed by Myles C. Maxfield. Source/WebCore: Tests: fast/text/word-break-column-gap-display-flex-utf16-surrogates.html fast/text/word-break-letter-spacing-utf16-surrogates.html fast/text/word-break-max-width-utf16-surrogates.html * layout/formattingContexts/inline/text/TextUtil.cpp: (WebCore::Layout::TextUtil::midWordBreak): Account for unpaired surrogates in surrogatePairAwareIndex and surrogatePairAwareStart lambdas in TextUtil::MidWordBreak TextUtil::midWordBreak LayoutTests: * fast/text/word-break-column-gap-display-flex-utf16-surrogates-expected.txt: Added. * fast/text/word-break-column-gap-display-flex-utf16-surrogates.html: Added. * fast/text/word-break-letter-spacing-utf16-surrogates-expected.txt: Added. * fast/text/word-break-letter-spacing-utf16-surrogates.html: Added. * fast/text/word-break-max-width-utf16-surrogates-expected.txt: Added. * fast/text/word-break-max-width-utf16-surrogates.html: Added. Canonical link: https://commits.webkit.org/242879@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284050 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Oct 12, 2021 · fd51b4f290365fe44e338167b1c94a9bec950776 · fd51b4f
1 parent b831a5d
commit fd51b4f290365fe44e338167b1c94a9bec950776
Showing 9 changed files with 287 additions and 5 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2021-10-12  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        ASSERT hit in surrogatePairAwareIndex and surrogatePairAwareStart lambdas for text with unpaired surrogates
+        https://bugs.webkit.org/show_bug.cgi?id=231606
+
+        Reviewed by Myles C. Maxfield.
+
+        * fast/text/word-break-column-gap-display-flex-utf16-surrogates-expected.txt: Added.
+        * fast/text/word-break-column-gap-display-flex-utf16-surrogates.html: Added.
+        * fast/text/word-break-letter-spacing-utf16-surrogates-expected.txt: Added.
+        * fast/text/word-break-letter-spacing-utf16-surrogates.html: Added.
+        * fast/text/word-break-max-width-utf16-surrogates-expected.txt: Added.
+        * fast/text/word-break-max-width-utf16-surrogates.html: Added.
+
 2021-10-12  Eric Hutchison  <ehutchison@apple.com>
 
         Update expectations for webgl/1.0.3/conformance/uniforms/uniform-default-values.html.

diff --git a/LayoutTests/fast/text/word-break-column-gap-display-flex-utf16-surrogates-expected.txt b/LayoutTests/fast/text/word-break-column-gap-display-flex-utf16-surrogates-expected.txt
@@ -0,0 +1,15 @@
+�
+�
+�r
+�r
+r�
+�
+𐀀
+r�r
+r�r
+��
+�r�
+�r�
+�𐀀
+𐀀�
+PASS
diff --git a/LayoutTests/fast/text/word-break-column-gap-display-flex-utf16-surrogates.html b/LayoutTests/fast/text/word-break-column-gap-display-flex-utf16-surrogates.html
@@ -0,0 +1,70 @@
+<style>
+  div {
+    word-break: break-word;
+    column-gap: 1000px;
+    display: flex;
+  }
+</style>
+<script>
+  onload = () => {
+    // only surrogate lead
+    document.getElementById("div1").append("\ud800");
+
+    // only surrogate trail
+    document.getElementById("div2").append("\udc00");
+
+    // surrogate lead + single
+    document.getElementById("div3").append("\ud800r");
+
+    // surrogate trail + single
+    document.getElementById("div4").append("\udc00r");
+
+    // single + surrogate lead
+    document.getElementById("div5").append("r\ud800");
+
+    // single + surrogate trail
+    document.getElementById("div6").append("\udc00");
+
+    // surrogate lead + surrogate trail
+    document.getElementById("div7").append("\ud800\udc00");
+
+    // single + surrogate lead + single
+    document.getElementById("div8").append("r\ud800r");
+
+    // single + surrogate trail + single
+    document.getElementById("div9").append("r\udc00r");
+
+    // surrogate trail + surrogate lead
+    document.getElementById("div10").append("\udc00\ud800");
+
+    // surrogate lead + single + surrogate trail
+    document.getElementById("div11").append("\ud800r\udc00");
+
+    // surrogate trail + single + surrogate lead
+    document.getElementById("div12").append("\udc00r\ud800");
+
+    // surrogate trail + surrogate lead + surrogate trail 
+    document.getElementById("div13").append("\udc00\ud800\udc00");
+
+    // surrogate lead + surrogate trail + surrogate lead
+    document.getElementById("div14").append("\ud800\udc00\ud800");
+
+    if (window.testRunner)
+        testRunner.dumpAsText();
+  };
+</script>
+<div id="div1"></div>
+<div id="div2"></div>
+<div id="div3"></div>
+<div id="div4"></div>
+<div id="div5"></div>
+<div id="div6"></div>
+<div id="div7"></div>
+<div id="div8"></div>
+<div id="div9"></div>
+<div id="div10"></div>
+<div id="div11"></div>
+<div id="div12"></div>
+<div id="div13"></div>
+<div id="div14"></div>
+PASS
diff --git a/LayoutTests/fast/text/word-break-letter-spacing-utf16-surrogates-expected.txt b/LayoutTests/fast/text/word-break-letter-spacing-utf16-surrogates-expected.txt
@@ -0,0 +1,15 @@
+�
+�
+�r
+�r
+r�
+�
+𐀀
+r�r
+r�r
+��
+�r�
+�r�
+�𐀀
+𐀀�
+PASS
diff --git a/LayoutTests/fast/text/word-break-letter-spacing-utf16-surrogates.html b/LayoutTests/fast/text/word-break-letter-spacing-utf16-surrogates.html
@@ -0,0 +1,69 @@
+<style>
+  div {
+    word-break: break-word;
+    letter-spacing: 1000px;
+  }
+</style>
+<script>
+  onload = () => {
+    // only surrogate lead
+    document.getElementById("div1").append("\ud800");
+
+    // only surrogate trail
+    document.getElementById("div2").append("\udc00");
+
+    // surrogate lead + single
+    document.getElementById("div3").append("\ud800r");
+
+    // surrogate trail + single
+    document.getElementById("div4").append("\udc00r");
+
+    // single + surrogate lead
+    document.getElementById("div5").append("r\ud800");
+
+    // single + surrogate trail
+    document.getElementById("div6").append("\udc00");
+
+    // surrogate lead + surrogate trail
+    document.getElementById("div7").append("\ud800\udc00");
+
+    // single + surrogate lead + single
+    document.getElementById("div8").append("r\ud800r");
+
+    // single + surrogate trail + single
+    document.getElementById("div9").append("r\udc00r");
+
+    // surrogate trail + surrogate lead
+    document.getElementById("div10").append("\udc00\ud800");
+
+    // surrogate lead + single + surrogate trail
+    document.getElementById("div11").append("\ud800r\udc00");
+
+    // surrogate trail + single + surrogate lead
+    document.getElementById("div12").append("\udc00r\ud800");
+
+    // surrogate trail + surrogate lead + surrogate trail 
+    document.getElementById("div13").append("\udc00\ud800\udc00");
+
+    // surrogate lead + surrogate trail + surrogate lead
+    document.getElementById("div14").append("\ud800\udc00\ud800");
+
+    if (window.testRunner)
+        testRunner.dumpAsText();
+  };
+</script>
+<div id="div1"></div>
+<div id="div2"></div>
+<div id="div3"></div>
+<div id="div4"></div>
+<div id="div5"></div>
+<div id="div6"></div>
+<div id="div7"></div>
+<div id="div8"></div>
+<div id="div9"></div>
+<div id="div10"></div>
+<div id="div11"></div>
+<div id="div12"></div>
+<div id="div13"></div>
+<div id="div14"></div>
+PASS
diff --git a/LayoutTests/fast/text/word-break-max-width-utf16-surrogates-expected.txt b/LayoutTests/fast/text/word-break-max-width-utf16-surrogates-expected.txt
@@ -0,0 +1,15 @@
+�
+�
+�r
+�r
+r�
+�
+𐀀
+r�r
+r�r
+��
+�r�
+�r�
+�𐀀
+𐀀�
+PASS
diff --git a/LayoutTests/fast/text/word-break-max-width-utf16-surrogates.html b/LayoutTests/fast/text/word-break-max-width-utf16-surrogates.html
@@ -0,0 +1,69 @@
+<style>
+  div {
+    word-break: break-word;
+    max-width: 1px;
+  }
+</style>
+<script>
+  onload = () => {
+    // only surrogate lead
+    document.getElementById("div1").append("\ud800");
+
+    // only surrogate trail
+    document.getElementById("div2").append("\udc00");
+
+    // surrogate lead + single
+    document.getElementById("div3").append("\ud800r");
+
+    // surrogate trail + single
+    document.getElementById("div4").append("\udc00r");
+
+    // single + surrogate lead
+    document.getElementById("div5").append("r\ud800");
+
+    // single + surrogate trail
+    document.getElementById("div6").append("\udc00");
+
+    // surrogate lead + surrogate trail
+    document.getElementById("div7").append("\ud800\udc00");
+
+    // single + surrogate lead + single
+    document.getElementById("div8").append("r\ud800r");
+
+    // single + surrogate trail + single
+    document.getElementById("div9").append("r\udc00r");
+
+    // surrogate trail + surrogate lead
+    document.getElementById("div10").append("\udc00\ud800");
+
+    // surrogate lead + single + surrogate trail
+    document.getElementById("div11").append("\ud800r\udc00");
+
+    // surrogate trail + single + surrogate lead
+    document.getElementById("div12").append("\udc00r\ud800");
+
+    // surrogate trail + surrogate lead + surrogate trail 
+    document.getElementById("div13").append("\udc00\ud800\udc00");
+
+    // surrogate lead + surrogate trail + surrogate lead
+    document.getElementById("div14").append("\ud800\udc00\ud800");
+
+    if (window.testRunner)
+        testRunner.dumpAsText();
+  };
+</script>
+<div id="div1"></div>
+<div id="div2"></div>
+<div id="div3"></div>
+<div id="div4"></div>
+<div id="div5"></div>
+<div id="div6"></div>
+<div id="div7"></div>
+<div id="div8"></div>
+<div id="div9"></div>
+<div id="div10"></div>
+<div id="div11"></div>
+<div id="div12"></div>
+<div id="div13"></div>
+<div id="div14"></div>
+PASS
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2021-10-12  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        ASSERT hit in surrogatePairAwareIndex and surrogatePairAwareStart lambdas for text with unpaired surrogates
+        https://bugs.webkit.org/show_bug.cgi?id=231606
+
+        Reviewed by Myles C. Maxfield.
+
+        Tests: fast/text/word-break-column-gap-display-flex-utf16-surrogates.html
+               fast/text/word-break-letter-spacing-utf16-surrogates.html
+               fast/text/word-break-max-width-utf16-surrogates.html
+
+        * layout/formattingContexts/inline/text/TextUtil.cpp:
+        (WebCore::Layout::TextUtil::midWordBreak):
+        Account for unpaired surrogates in surrogatePairAwareIndex and surrogatePairAwareStart lambdas
+        in TextUtil::MidWordBreak TextUtil::midWordBreak 
+
 2021-10-12  Ryan Haddad  <ryanhaddad@apple.com>
 
         Unreviewed, reverting r284022.

diff --git a/Source/WebCore/layout/formattingContexts/inline/text/TextUtil.cpp b/Source/WebCore/layout/formattingContexts/inline/text/TextUtil.cpp
@@ -147,10 +147,9 @@ TextUtil::MidWordBreak TextUtil::midWordBreak(const InlineTextItem& inlineTextIt
     auto surrogatePairAwareIndex = [&] (auto index) {
         // We should never break in the middle of a surrogate pair. They are considered one joint entity.
         RELEASE_ASSERT(index < text.length());
-        if (!U16_IS_LEAD(text[index]))
+        bool isLead = U16_IS_LEAD(text[index]) && (index + 1) < text.length() && U16_IS_TRAIL(text[index + 1]);
+        if (!isLead)
             return index;
-        RELEASE_ASSERT(index + 1 < text.length());
-        ASSERT(U16_IS_TRAIL(text[index + 1]));
         return ++index;
     };
 
@@ -170,10 +169,10 @@ TextUtil::MidWordBreak TextUtil::midWordBreak(const InlineTextItem& inlineTextIt
             leftSideWidth = width;
         } else if (width > availableWidth) {
             auto surrogatePairAwareStart = [&] (auto index) {
-                if (!U16_IS_TRAIL(text[middle]))
+                bool isTrail = index && U16_IS_LEAD(text[index - 1]) && index < text.length() && U16_IS_TRAIL(text[index]);
+                if (!isTrail)
                     return index;
                 RELEASE_ASSERT(index);
-                ASSERT(U16_IS_LEAD(text[index - 1]));
                 return --index;
             };
             // When the substring does not fit, the right side is supposed to be the start of the surrogate pair if applicable.