Bug 317083 – REGRESSION (311049@main): Clamp the word-boundary search index to the context buffer length in isWordStartMatch()

• Status: RESOLVED
• Resolution: FIXED
• Component: HTML Editing

[David Kilzer (:ddkilzer)]

Find-in-page and Scroll-to-Text-Fragment word-boundary matching can read out of bounds.

When a find match with the `AtWordStarts` option begins within a complex-context script run (for example Thai) but extends past that run into characters that do not require dictionary context, the word-boundary context window is trimmed to the complex-context run while the match length is not re-clamped to the trimmed window.

This regressed in 311049@main (Bug 309323, "Improve find in page performance by using a cached flat buffer"), which introduced the cached flat buffer that is trimmed to a context window.

Stack trace:
```
0   libsystem_platform.dylib:  _platform_memmove
1   WebCore:  WebCore::findNextWordFromIndex
2   WebCore:  WebCore::isWordStartMatch
3   WebCore:  WebCore::CachedMatchFinder::performSearch
4   WebCore:  WebCore::CachedMatchFinder::findMatchFrom
5   WebCore:  WebCore::Editor::findString
6   WebCore:  WebCore::Page::findString
7   WebKit:  WebKit::FindController::findString
[...]
```

[David Kilzer (:ddkilzer)]

<rdar://problem/179591659>

[David Kilzer (:ddkilzer)]

Pull request: https://github.com/WebKit/WebKit/pull/67146

[EWS]

Committed 315233@main (03015890a6a2): <https://commits.webkit.org/315233@main>

Reviewed commits have been landed. Closing PR #67146 and removing active labels.