Repository navigation
macOS: Fix crash on out-of-bounds text input ranges - #191780
Conversation
There was a problem hiding this comment.
Code Review
This pull request introduces bounds clamping for text selection and composing ranges in TextInputModel and FlutterTextInputPlugin to prevent out-of-bounds indexing and crashes, accompanied by new unit tests. The review feedback suggests adding defensive type validation for the state dictionary in setEditingState: and refactoring the UTF-16 string conversion in setMarkedText: to avoid potential crashes and encoding issues.
`TextInputModel` assumes its selection and composing range fall within its text, but nothing in the text input plugin enforced that. When they don't, we index past the end of `text_` which triggers an abort due to out of range access. ``` out_of_range was thrown in -fno-exceptions mode with message "basic_string" ``` Previously, `setMarkedText:selectedRange:replacementRange:` passed `selectedRange` unvalidated. IMEs report `NSNotFound` to indicate no selection within the mark text. That maps to `NSIntegerMax` rather than an offset, and we incorrectly stored that as the selection. Clearing the marked text collapses the composing range, so the next update replaces the selection instead and calls `replace` with a position `NSIntegerMax`. Clear and re-mark is what an input method emits when the input source is switched mid-composition. `SetText` was also unsafe: it assigned `text_` before validating the ranges, so a rejected update left us with the new text but the old (now out-of-bounds) ranges still pointing into it. This fixes that by clamping both ranges before any operation that indexes the text, applying either all of `SetText`'s fields or none, and clamping `selectedRange` and `replacementRange` in the plugin. `setMarkedText:` also null-checks the UTF-16 buffer, which `cStringUsingEncoding:` can return as nullptr. Fixes: flutter#190704
b6213fc to
4e7ae1e
Compare
LongCatIsLooong
left a comment
There was a problem hiding this comment.
The code changes LGTM. But I'm not sure why we need to clamp the ranges in the first place (l remember the iOS text input plugin does that too but I suspect that is not needed). If the IME sends us an OOB range I think it's either our implementation is doing something wrong (like not informing the IME of text changes when the framework makes changes to the model), or it is an IME bug?
|
In this case, it's almost certainly an async issue/race. We should resolve the underlying issue too by implementing some form of serialisation. |
Roll Flutter from 15d8908addf6 to e8dca90ec9e0 (58 revisions) flutter/flutter@15d8908...e8dca90 2026-08-27 15619084+vashworth@users.noreply.github.com Terminate existing process before launching with devicectl (flutter/flutter#191885) 2026-08-27 engine-flutter-autoroll@skia.org Roll Fuchsia Linux SDK from qjOQi-zAgu_tADorh... to dDxH8G5cDBP602eyG... (flutter/flutter#191889) 2026-08-27 bkonyi@google.com [flutter_tools] Verify native assets tree-shaking during linking (flutter/flutter#191637) 2026-08-27 30870216+gaaclarke@users.noreply.github.com Denylists b-series powervr from vulkan (flutter/flutter#191808) 2026-08-27 97480502+b-luk@users.noreply.github.com Handle linear and radial gradients in UberSDF (flutter/flutter#190874) 2026-08-27 engine-flutter-autoroll@skia.org Roll Packages from 740f093 to bd3cbc1 (7 revisions) (flutter/flutter#191886) 2026-08-27 jason-simmons@users.noreply.github.com Disable more Windows tests that have been causing CI flakes (flutter/flutter#191822) 2026-08-27 engine-flutter-autoroll@skia.org Roll Skia from d32721369bd8 to 82e972ea84b1 (2 revisions) (flutter/flutter#191880) 2026-08-27 engine-flutter-autoroll@skia.org Roll Skia from 3640b8edd16c to d32721369bd8 (10 revisions) (flutter/flutter#191858) 2026-08-27 154381524+flutteractionsbot@users.noreply.github.com Revert: [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191863) 2026-08-27 engine-flutter-autoroll@skia.org Roll Fuchsia Test Scripts from 0iCv10IlKfiilEBOU... to 6SXRz6wsA2Zm_rAqP... (flutter/flutter#191852) 2026-08-27 137456488+flutter-pub-roller-bot@users.noreply.github.com Roll pub packages (flutter/flutter#191851) 2026-08-27 46920873+gabrimatic@users.noreply.github.com Refactor FormField build wrappers (flutter/flutter#185795) 2026-08-27 50643541+Mairramer@users.noreply.github.com Make ScrollPhysics reactive by introducing shouldUpdate (flutter/flutter#189664) 2026-08-27 chris@bracken.jp macOS: Fix crash on out-of-bounds text input ranges (flutter/flutter#191780) 2026-08-27 34871572+gmackall@users.noreply.github.com Add HCPP feature flag, and turn it on by default in beta/master (flutter/flutter#190623) 2026-08-27 bkonyi@google.com [tool] Migrate CleanCommand to modular dependency injection (flutter/flutter#190742) 2026-08-26 katelovett@google.com Update triage docs for ecosystem and codelab changes (flutter/flutter#191809) 2026-08-26 jesswon@google.com [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191824) 2026-08-26 louisehsu@google.com [UIScene] Migrate dev/benchmarks/complex_layout to UIScene lifecycle (flutter/flutter#191619) 2026-08-26 57765714+Vi-debug@users.noreply.github.com Add SliverAppBar showOnScreen semantics test coverage (flutter/flutter#190410) 2026-08-26 95318996+shawnridgeway-google@users.noreply.github.com Add prompt_suggestion icon to list of RTL mirroring icons. (flutter/flutter#191741) 2026-08-26 okorohelijah@google.com Remove bringup for batch 3 (flutter/flutter#191750) 2026-08-26 engine-flutter-autoroll@skia.org Roll Skia from b5465d7b0b77 to 3640b8edd16c (6 revisions) (flutter/flutter#191835) 2026-08-26 louisehsu@google.com Uiscene migrate custom channels views (flutter/flutter#191817) 2026-08-26 matt.boetger@gmail.com Support --[no-]adb-log-filtering CLI option (flutter/flutter#187252) 2026-08-26 engine-flutter-autoroll@skia.org Roll Dart SDK from cb8a4e1a0fbb to cb4c39d067f3 (2 revisions) (flutter/flutter#191825) 2026-08-26 nate.w5687@gmail.com Fix `Navigator.pushNamed<T>()` type checking (flutter/flutter#188148) 2026-08-26 robert.ancell@canonical.com Handle the case where a window doesn't have a title set (flutter/flutter#191767) 2026-08-26 github@alexv525.com [Android] Remove old `InputType` constructor from embedding (flutter/flutter#191244) 2026-08-26 engine-flutter-autoroll@skia.org Roll Skia from 244a6a0f8f92 to b5465d7b0b77 (19 revisions) (flutter/flutter#191810) 2026-08-26 46920873+gabrimatic@users.noreply.github.com Tolerate floating-point rounding in paintImage centerSlice assertion (flutter/flutter#185789) 2026-08-26 30870216+gaaclarke@users.noreply.github.com Fixes translated bounded blurs (flutter/flutter#191615) 2026-08-26 engine-flutter-autoroll@skia.org Roll Fuchsia Linux SDK from MstTWE1RDOT-RnrtH... to qjOQi-zAgu_tADorh... (flutter/flutter#191769) 2026-08-26 136096126+glitchfl@users.noreply.github.com Lerp HSVColor and HSLColor hue along the shortest arc (flutter/flutter#191186) 2026-08-26 116356835+AbdeMohlbi@users.noreply.github.com Fix enum instances comparison to use `equality ==` since dart has the correct behavior now (flutter/flutter#191537) 2026-08-26 30870216+gaaclarke@users.noreply.github.com Switches windows to opengles 3 (flutter/flutter#191516) 2026-08-26 engine-flutter-autoroll@skia.org Roll Dart SDK from 7739e8602bc1 to cb8a4e1a0fbb (1 revision) (flutter/flutter#191784) 2026-08-26 chris@bracken.jp iOS,macOS: Check viewType before creating a platform view (flutter/flutter#191777) 2026-08-26 154381524+flutteractionsbot@users.noreply.github.com Revert: [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191793) 2026-08-26 kevmoo@users.noreply.github.com refactor(flutter_tools): clean up dead unreferenced declarations (flutter/flutter#191163) 2026-08-26 engine-flutter-autoroll@skia.org Roll Fuchsia GN SDK from a87CbQSWEjkPUK1ZY... to ZsxUUK2SfA-TrNvb8... (flutter/flutter#191763) 2026-08-26 bkonyi@google.com [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191732) 2026-08-25 36861262+QuncCccccc@users.noreply.github.com Remove legacy gen_defaults analyze checks (flutter/flutter#191629) 2026-08-25 52160996+FMorschel@users.noreply.github.com Refactors `try` to avoid `unawaited_return_in_try_block` case (flutter/flutter#191129) 2026-08-25 engine-flutter-autoroll@skia.org Roll Dart SDK from 8996935d3d0a to 7739e8602bc1 (1 revision) (flutter/flutter#191754) ...
…r#12660) Roll Flutter from 15d8908addf6 to e8dca90ec9e0 (58 revisions) flutter/flutter@15d8908...e8dca90 2026-08-27 15619084+vashworth@users.noreply.github.com Terminate existing process before launching with devicectl (flutter/flutter#191885) 2026-08-27 engine-flutter-autoroll@skia.org Roll Fuchsia Linux SDK from qjOQi-zAgu_tADorh... to dDxH8G5cDBP602eyG... (flutter/flutter#191889) 2026-08-27 bkonyi@google.com [flutter_tools] Verify native assets tree-shaking during linking (flutter/flutter#191637) 2026-08-27 30870216+gaaclarke@users.noreply.github.com Denylists b-series powervr from vulkan (flutter/flutter#191808) 2026-08-27 97480502+b-luk@users.noreply.github.com Handle linear and radial gradients in UberSDF (flutter/flutter#190874) 2026-08-27 engine-flutter-autoroll@skia.org Roll Packages from 740f093 to bd3cbc1 (7 revisions) (flutter/flutter#191886) 2026-08-27 jason-simmons@users.noreply.github.com Disable more Windows tests that have been causing CI flakes (flutter/flutter#191822) 2026-08-27 engine-flutter-autoroll@skia.org Roll Skia from d32721369bd8 to 82e972ea84b1 (2 revisions) (flutter/flutter#191880) 2026-08-27 engine-flutter-autoroll@skia.org Roll Skia from 3640b8edd16c to d32721369bd8 (10 revisions) (flutter/flutter#191858) 2026-08-27 154381524+flutteractionsbot@users.noreply.github.com Revert: [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191863) 2026-08-27 engine-flutter-autoroll@skia.org Roll Fuchsia Test Scripts from 0iCv10IlKfiilEBOU... to 6SXRz6wsA2Zm_rAqP... (flutter/flutter#191852) 2026-08-27 137456488+flutter-pub-roller-bot@users.noreply.github.com Roll pub packages (flutter/flutter#191851) 2026-08-27 46920873+gabrimatic@users.noreply.github.com Refactor FormField build wrappers (flutter/flutter#185795) 2026-08-27 50643541+Mairramer@users.noreply.github.com Make ScrollPhysics reactive by introducing shouldUpdate (flutter/flutter#189664) 2026-08-27 chris@bracken.jp macOS: Fix crash on out-of-bounds text input ranges (flutter/flutter#191780) 2026-08-27 34871572+gmackall@users.noreply.github.com Add HCPP feature flag, and turn it on by default in beta/master (flutter/flutter#190623) 2026-08-27 bkonyi@google.com [tool] Migrate CleanCommand to modular dependency injection (flutter/flutter#190742) 2026-08-26 katelovett@google.com Update triage docs for ecosystem and codelab changes (flutter/flutter#191809) 2026-08-26 jesswon@google.com [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191824) 2026-08-26 louisehsu@google.com [UIScene] Migrate dev/benchmarks/complex_layout to UIScene lifecycle (flutter/flutter#191619) 2026-08-26 57765714+Vi-debug@users.noreply.github.com Add SliverAppBar showOnScreen semantics test coverage (flutter/flutter#190410) 2026-08-26 95318996+shawnridgeway-google@users.noreply.github.com Add prompt_suggestion icon to list of RTL mirroring icons. (flutter/flutter#191741) 2026-08-26 okorohelijah@google.com Remove bringup for batch 3 (flutter/flutter#191750) 2026-08-26 engine-flutter-autoroll@skia.org Roll Skia from b5465d7b0b77 to 3640b8edd16c (6 revisions) (flutter/flutter#191835) 2026-08-26 louisehsu@google.com Uiscene migrate custom channels views (flutter/flutter#191817) 2026-08-26 matt.boetger@gmail.com Support --[no-]adb-log-filtering CLI option (flutter/flutter#187252) 2026-08-26 engine-flutter-autoroll@skia.org Roll Dart SDK from cb8a4e1a0fbb to cb4c39d067f3 (2 revisions) (flutter/flutter#191825) 2026-08-26 nate.w5687@gmail.com Fix `Navigator.pushNamed<T>()` type checking (flutter/flutter#188148) 2026-08-26 robert.ancell@canonical.com Handle the case where a window doesn't have a title set (flutter/flutter#191767) 2026-08-26 github@alexv525.com [Android] Remove old `InputType` constructor from embedding (flutter/flutter#191244) 2026-08-26 engine-flutter-autoroll@skia.org Roll Skia from 244a6a0f8f92 to b5465d7b0b77 (19 revisions) (flutter/flutter#191810) 2026-08-26 46920873+gabrimatic@users.noreply.github.com Tolerate floating-point rounding in paintImage centerSlice assertion (flutter/flutter#185789) 2026-08-26 30870216+gaaclarke@users.noreply.github.com Fixes translated bounded blurs (flutter/flutter#191615) 2026-08-26 engine-flutter-autoroll@skia.org Roll Fuchsia Linux SDK from MstTWE1RDOT-RnrtH... to qjOQi-zAgu_tADorh... (flutter/flutter#191769) 2026-08-26 136096126+glitchfl@users.noreply.github.com Lerp HSVColor and HSLColor hue along the shortest arc (flutter/flutter#191186) 2026-08-26 116356835+AbdeMohlbi@users.noreply.github.com Fix enum instances comparison to use `equality ==` since dart has the correct behavior now (flutter/flutter#191537) 2026-08-26 30870216+gaaclarke@users.noreply.github.com Switches windows to opengles 3 (flutter/flutter#191516) 2026-08-26 engine-flutter-autoroll@skia.org Roll Dart SDK from 7739e8602bc1 to cb8a4e1a0fbb (1 revision) (flutter/flutter#191784) 2026-08-26 chris@bracken.jp iOS,macOS: Check viewType before creating a platform view (flutter/flutter#191777) 2026-08-26 154381524+flutteractionsbot@users.noreply.github.com Revert: [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191793) 2026-08-26 kevmoo@users.noreply.github.com refactor(flutter_tools): clean up dead unreferenced declarations (flutter/flutter#191163) 2026-08-26 engine-flutter-autoroll@skia.org Roll Fuchsia GN SDK from a87CbQSWEjkPUK1ZY... to ZsxUUK2SfA-TrNvb8... (flutter/flutter#191763) 2026-08-26 bkonyi@google.com [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191732) 2026-08-25 36861262+QuncCccccc@users.noreply.github.com Remove legacy gen_defaults analyze checks (flutter/flutter#191629) 2026-08-25 52160996+FMorschel@users.noreply.github.com Refactors `try` to avoid `unawaited_return_in_try_block` case (flutter/flutter#191129) 2026-08-25 engine-flutter-autoroll@skia.org Roll Dart SDK from 8996935d3d0a to 7739e8602bc1 (1 revision) (flutter/flutter#191754) ...
…r#12660) Roll Flutter from 15d8908addf6 to e8dca90ec9e0 (58 revisions) flutter/flutter@15d8908...e8dca90 2026-08-27 15619084+vashworth@users.noreply.github.com Terminate existing process before launching with devicectl (flutter/flutter#191885) 2026-08-27 engine-flutter-autoroll@skia.org Roll Fuchsia Linux SDK from qjOQi-zAgu_tADorh... to dDxH8G5cDBP602eyG... (flutter/flutter#191889) 2026-08-27 bkonyi@google.com [flutter_tools] Verify native assets tree-shaking during linking (flutter/flutter#191637) 2026-08-27 30870216+gaaclarke@users.noreply.github.com Denylists b-series powervr from vulkan (flutter/flutter#191808) 2026-08-27 97480502+b-luk@users.noreply.github.com Handle linear and radial gradients in UberSDF (flutter/flutter#190874) 2026-08-27 engine-flutter-autoroll@skia.org Roll Packages from 740f093 to bd3cbc1 (7 revisions) (flutter/flutter#191886) 2026-08-27 jason-simmons@users.noreply.github.com Disable more Windows tests that have been causing CI flakes (flutter/flutter#191822) 2026-08-27 engine-flutter-autoroll@skia.org Roll Skia from d32721369bd8 to 82e972ea84b1 (2 revisions) (flutter/flutter#191880) 2026-08-27 engine-flutter-autoroll@skia.org Roll Skia from 3640b8edd16c to d32721369bd8 (10 revisions) (flutter/flutter#191858) 2026-08-27 154381524+flutteractionsbot@users.noreply.github.com Revert: [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191863) 2026-08-27 engine-flutter-autoroll@skia.org Roll Fuchsia Test Scripts from 0iCv10IlKfiilEBOU... to 6SXRz6wsA2Zm_rAqP... (flutter/flutter#191852) 2026-08-27 137456488+flutter-pub-roller-bot@users.noreply.github.com Roll pub packages (flutter/flutter#191851) 2026-08-27 46920873+gabrimatic@users.noreply.github.com Refactor FormField build wrappers (flutter/flutter#185795) 2026-08-27 50643541+Mairramer@users.noreply.github.com Make ScrollPhysics reactive by introducing shouldUpdate (flutter/flutter#189664) 2026-08-27 chris@bracken.jp macOS: Fix crash on out-of-bounds text input ranges (flutter/flutter#191780) 2026-08-27 34871572+gmackall@users.noreply.github.com Add HCPP feature flag, and turn it on by default in beta/master (flutter/flutter#190623) 2026-08-27 bkonyi@google.com [tool] Migrate CleanCommand to modular dependency injection (flutter/flutter#190742) 2026-08-26 katelovett@google.com Update triage docs for ecosystem and codelab changes (flutter/flutter#191809) 2026-08-26 jesswon@google.com [AGP 9] Update remaining tests to AGP 9 (flutter/flutter#191824) 2026-08-26 louisehsu@google.com [UIScene] Migrate dev/benchmarks/complex_layout to UIScene lifecycle (flutter/flutter#191619) 2026-08-26 57765714+Vi-debug@users.noreply.github.com Add SliverAppBar showOnScreen semantics test coverage (flutter/flutter#190410) 2026-08-26 95318996+shawnridgeway-google@users.noreply.github.com Add prompt_suggestion icon to list of RTL mirroring icons. (flutter/flutter#191741) 2026-08-26 okorohelijah@google.com Remove bringup for batch 3 (flutter/flutter#191750) 2026-08-26 engine-flutter-autoroll@skia.org Roll Skia from b5465d7b0b77 to 3640b8edd16c (6 revisions) (flutter/flutter#191835) 2026-08-26 louisehsu@google.com Uiscene migrate custom channels views (flutter/flutter#191817) 2026-08-26 matt.boetger@gmail.com Support --[no-]adb-log-filtering CLI option (flutter/flutter#187252) 2026-08-26 engine-flutter-autoroll@skia.org Roll Dart SDK from cb8a4e1a0fbb to cb4c39d067f3 (2 revisions) (flutter/flutter#191825) 2026-08-26 nate.w5687@gmail.com Fix `Navigator.pushNamed<T>()` type checking (flutter/flutter#188148) 2026-08-26 robert.ancell@canonical.com Handle the case where a window doesn't have a title set (flutter/flutter#191767) 2026-08-26 github@alexv525.com [Android] Remove old `InputType` constructor from embedding (flutter/flutter#191244) 2026-08-26 engine-flutter-autoroll@skia.org Roll Skia from 244a6a0f8f92 to b5465d7b0b77 (19 revisions) (flutter/flutter#191810) 2026-08-26 46920873+gabrimatic@users.noreply.github.com Tolerate floating-point rounding in paintImage centerSlice assertion (flutter/flutter#185789) 2026-08-26 30870216+gaaclarke@users.noreply.github.com Fixes translated bounded blurs (flutter/flutter#191615) 2026-08-26 engine-flutter-autoroll@skia.org Roll Fuchsia Linux SDK from MstTWE1RDOT-RnrtH... to qjOQi-zAgu_tADorh... (flutter/flutter#191769) 2026-08-26 136096126+glitchfl@users.noreply.github.com Lerp HSVColor and HSLColor hue along the shortest arc (flutter/flutter#191186) 2026-08-26 116356835+AbdeMohlbi@users.noreply.github.com Fix enum instances comparison to use `equality ==` since dart has the correct behavior now (flutter/flutter#191537) 2026-08-26 30870216+gaaclarke@users.noreply.github.com Switches windows to opengles 3 (flutter/flutter#191516) 2026-08-26 engine-flutter-autoroll@skia.org Roll Dart SDK from 7739e8602bc1 to cb8a4e1a0fbb (1 revision) (flutter/flutter#191784) 2026-08-26 chris@bracken.jp iOS,macOS: Check viewType before creating a platform view (flutter/flutter#191777) 2026-08-26 154381524+flutteractionsbot@users.noreply.github.com Revert: [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191793) 2026-08-26 kevmoo@users.noreply.github.com refactor(flutter_tools): clean up dead unreferenced declarations (flutter/flutter#191163) 2026-08-26 engine-flutter-autoroll@skia.org Roll Fuchsia GN SDK from a87CbQSWEjkPUK1ZY... to ZsxUUK2SfA-TrNvb8... (flutter/flutter#191763) 2026-08-26 bkonyi@google.com [tool_tests] Remove bringup from Windows tool_tests_commands_2_2 (flutter/flutter#191732) 2026-08-25 36861262+QuncCccccc@users.noreply.github.com Remove legacy gen_defaults analyze checks (flutter/flutter#191629) 2026-08-25 52160996+FMorschel@users.noreply.github.com Refactors `try` to avoid `unawaited_return_in_try_block` case (flutter/flutter#191129) 2026-08-25 engine-flutter-autoroll@skia.org Roll Dart SDK from 8996935d3d0a to 7739e8602bc1 (1 revision) (flutter/flutter#191754) ...
TextInputModelassumes its selection and composing range fall within its text, but nothing in the text input plugin enforced that. When they don't, we index past the end oftext_which triggers an abort due to out of range access.Previously,
setMarkedText:selectedRange:replacementRange:passedselectedRangeunvalidated. IMEs reportNSNotFoundto indicate no selection within the mark text. That maps toNSIntegerMaxrather than an offset, and we incorrectly stored that as the selection. Clearing the marked text collapses the composing range, so the next update replaces the selection instead and callsreplacewith a positionNSIntegerMax. Clear and re-mark is what an input method emits when the input source is switched mid-composition.SetTextwas also unsafe: it assignedtext_before validating the ranges, so a rejected update left us with the new text but the old (now out-of-bounds) ranges still pointing into it.This fixes that by clamping both ranges before any operation that indexes the text, applying either all of
SetText's fields or none, and clampingselectedRangeandreplacementRangein the plugin.setMarkedText:also null-checks the UTF-16 buffer, whichcStringUsingEncoding:can return as nullptr.Fixes: #190704
Pre-launch Checklist
///).If you need help, consider asking for advice on the #hackers-new channel on Discord.
If this change needs to override an active code freeze, provide a comment explaining why. The code freeze workflow can be overridden by code reviewers. See pinned issues for any active code freezes with guidance.
Note: The Flutter team is currently trialing the use of Gemini Code Assist for GitHub. Comments from the
gemini-code-assistbot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed.