317083 2026-06-13 19:28:23 -0700 REGRESSION (311049@main): Clamp the word-boundary search index to the context buffer length in isWordStartMatch() 2026-06-15 13:43:08 -0700 1 1 1 Unclassified WebKit HTML Editing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 309323 1 ddkilzer ddkilzer webkit-bug-importer wenson_hsieh oldest_to_newest 2220653 0 ddkilzer 2026-06-13 19:28:23 -0700 Find-in-page and Scroll-to-Text-Fragment word-boundary matching can read out of bounds. When a find match with the `AtWordStarts` option begins within a complex-context script run (for example Thai) but extends past that run into characters that do not require dictionary context, the word-boundary context window is trimmed to the complex-context run while the match length is not re-clamped to the trimmed window. This regressed in 311049@main (Bug 309323, "Improve find in page performance by using a cached flat buffer"), which introduced the cached flat buffer that is trimmed to a context window. Stack trace: ``` 0 libsystem_platform.dylib: _platform_memmove 1 WebCore: WebCore::findNextWordFromIndex 2 WebCore: WebCore::isWordStartMatch 3 WebCore: WebCore::CachedMatchFinder::performSearch 4 WebCore: WebCore::CachedMatchFinder::findMatchFrom 5 WebCore: WebCore::Editor::findString 6 WebCore: WebCore::Page::findString 7 WebKit: WebKit::FindController::findString [...] ``` 2220654 1 ddkilzer 2026-06-13 19:28:26 -0700 <rdar://problem/179591659> 2220660 2 ddkilzer 2026-06-13 19:59:38 -0700 Pull request: https://github.com/WebKit/WebKit/pull/67146 2220926 3 ews-feeder 2026-06-15 13:43:06 -0700 Committed 315233@main (03015890a6a2): <https://commits.webkit.org/315233@main> Reviewed commits have been landed. Closing PR #67146 and removing active labels.