Merge pull request #522 from chewing/0.8.0-rc.3-bug-fixes

0.8.0-rc.3 bug fixes
chewing · May 6, 2024 · 0b26573 · 0b26573
2 parents fff9f1b + b5a8588
commit 0b26573
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 6 deletions.
diff --git a/NEWS b/NEWS
@@ -28,6 +28,8 @@ What's New in libchewing 0.8.0-rc.2 (UNRELEASED)
     (introduced in v0.6.0)
   - Special symbol selection missed a couple symbols that was in C version.
     (introduced in v0.7.0)
+  - Panics when a new selection replaces more than one existing selections.
+    (introduced in v0.7.0)
 
 * Removed
   - HashMap implemented Dictionary was removed.

diff --git a/src/conversion/mod.rs b/src/conversion/mod.rs
@@ -228,7 +228,7 @@ impl Composition {
                     to_remove.push(i);
                 }
             }
-            for i in to_remove {
+            for i in to_remove.into_iter().rev() {
                 self.selections.swap_remove(i);
             }
         }
@@ -249,7 +249,7 @@ impl Composition {
                 selection.end += 1;
             }
         }
-        for i in to_remove {
+        for i in to_remove.into_iter().rev() {
             self.selections.swap_remove(i);
         }
         self.symbols.insert(index, sym);
@@ -272,7 +272,7 @@ impl Composition {
                 to_remove.push(i);
             }
         }
-        for i in to_remove {
+        for i in to_remove.into_iter().rev() {
             self.selections.swap_remove(i);
         }
         for i in (interval.start..interval.end).skip(1) {
@@ -291,7 +291,7 @@ impl Composition {
                 selection.end -= n;
             }
         }
-        for i in to_remove {
+        for i in to_remove.into_iter().rev() {
             self.selections.swap_remove(i);
         }
         self.symbols.drain(0..n);
@@ -313,7 +313,7 @@ impl Composition {
                 selection.end -= 1;
             }
         }
-        for i in to_remove {
+        for i in to_remove.into_iter().rev() {
             self.selections.swap_remove(i);
         }
         self.symbols.remove(index);

diff --git a/src/editor/composition_editor.rs b/src/editor/composition_editor.rs
@@ -83,7 +83,7 @@ impl CompositionEditor {
     }
     pub(crate) fn remove_front(&mut self, n: usize) {
         self.inner.remove_front(n);
-        self.cursor -= n;
+        self.cursor = self.cursor.saturating_sub(n);
     }
     pub(crate) fn remove_after_cursor(&mut self) {
         self.inner.remove(self.cursor);

diff --git a/tests/test-regression.c b/tests/test-regression.c
@@ -251,6 +251,21 @@ void test_empty_preedit_ignore_arrow_key()
     chewing_delete(ctx);
 }
 
+void test_crash_found_by_fuzzing_20240505_0()
+{
+    ChewingContext *ctx;
+
+    clean_userphrase();
+
+    ctx = chewing_new();
+    start_testcase(ctx, fd);
+
+    type_keystroke_by_string(ctx, "93<D>093<D>0<H><D>2");
+    ok_preedit_buffer(ctx, "靄靄");
+
+    chewing_delete(ctx);
+}
+
 int main(int argc, char *argv[])
 {
     char *logname;
@@ -277,6 +292,7 @@ int main(int argc, char *argv[])
     test_insert_symbol_between_selection();
     test_empty_prefix_in_conversion_search();
     test_empty_preedit_ignore_arrow_key();
+    test_crash_found_by_fuzzing_20240505_0();
 
     fclose(fd);