RFR: 5080391: ArrayIndexOutOfBounds during "undo" of Right-to-Left text insert

Prasanta Sadhukhan psadhukhan at openjdk.org
Tue Sep 27 11:23:56 UTC 2022


javax.swing.text.AbstractDocument$BranchElement.replace(...) method throws an `ArrayIndexOutOfBoundsException: arraycopy: length -1 is negative` when using an UndoManager on the default document of a JTextArea and you try to undo the insertion of a LEFT-TO-RIGHT language (e.g. Arabic) that is immediately followed by setting the component orientation on the JTextArea.

This is because System.arrayCopy() is called with -ve length because of the calculation done in AbstractDocment.replace where `src` is of 2bytes because of unicode text causing `nmove` to become -ve if `nchildren` is 1 (an unicode character is inserted)

System.arrayCopy throws `IndexOutOfBoundsException if:

    The srcPos argument is negative.
    The destPos argument is negative.
    The length argument is negative


so the fix is made to make  nmove, src, dest +ve
Also, Element.getElement() can return null which is not checked, causing NPE, if deletion of text is done which results in no element, which is also fixed in the PR

All jtreg testsuite tests are run without any regression.

-------------

Commit messages:
 - Test fix
 - 5080391: ArrayIndexOutOfBounds during undo of Left-to-Right text insert

Changes: https://git.openjdk.org/jdk/pull/10446/files
 Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=10446&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-5080391
  Stats: 88 lines in 2 files changed: 84 ins; 0 del; 4 mod
  Patch: https://git.openjdk.org/jdk/pull/10446.diff
  Fetch: git fetch https://git.openjdk.org/jdk pull/10446/head:pull/10446

PR: https://git.openjdk.org/jdk/pull/10446



More information about the client-libs-dev mailing list