Skip to content

Bad UTF16 character crashes in RenderText.cpp #12772

@jklint-g

Description

@jklint-g

Steps to Reproduce

If I try to display an invalid UTF16 character in a Text(), it causes a hard crash due to assertion failure in the engine's RenderText.cpp. The code is trying to display text which it shouldn't, but I wouldn't expect it to crash in the rendering engine.

This can easily happen if you take a substring which happens to slice an SMP UTF32 character in half, as shown below. It's especially dangerous if the app deals with arbitrary user text input.

Test case:

testWidgets('Bad string is bad', (WidgetTester tester) async {
  // First half of this UTF32 code point is not a valid UTF16 code point.
  String invalidString = '💩'.substring(0, 1);  // or codeUnitAt(0)
  print('Invalid String: $invalidString');

  Text text = new Text(invalidString);
  print('Invalid Text: $text');

  // This crashes during rendering.
  await tester.pumpWidget(
      new Directionality(child: text, textDirection: TextDirection.ltr));
});

Logs

Test output:

Running Flutter tests.
00:01 +0: widget tests - Bad string is bad                                               
Invalid String: ???
Invalid Text: Text("???")
Shell: ASSERTION FAILED: m_text
Shell: ../../flutter/sky/engine/core/rendering/RenderText.cpp(71) : blink::RenderText::RenderText(PassRefPtr<WTF::StringImpl>)

In contrast, a null string in Text fails at the Dart level:

Running Flutter tests.
00:01 +0: widget tests - Bad string is bad                                               
Invalid String: null
══╡ EXCEPTION CAUGHT BY FLUTTER TEST FRAMEWORK ╞════════════════════════════════════════════════════
The following assertion was thrown running a test:
'package:flutter/src/widgets/text.dart': Failed assertion: line 208 pos 15: 'data != null': is not
true.

Flutter Doctor

Paste the output of running flutter doctor here.

For more information about diagnosing and reporting Flutter bugs, please see https://flutter.io/bug-reports/.

Metadata

Metadata

Assignees

No one assigned

    Labels

    c: crashStack traces logged to the consoleengineflutter/engine related. See also e: labels.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions