On Tue, 27 Sep 2022 11:16:36 GMT, Prasanta Sadhukhan <psadhuk...@openjdk.org> wrote:
> javax.swing.text.AbstractDocument$BranchElement.replace(...) method throws an > `ArrayIndexOutOfBoundsException: arraycopy: length -1 is negative` when using > an UndoManager on the default document of a JTextArea and you try to undo the > insertion of a LEFT-TO-RIGHT language (e.g. Arabic) that is immediately > followed by setting the component orientation on the JTextArea. > > This is because System.arrayCopy() is called with -ve length because of the > calculation done in AbstractDocment.replace where `src` is of 2bytes because > of unicode text causing `nmove` to become -ve if `nchildren` is 1 (an unicode > character is inserted) > > System.arrayCopy throws `IndexOutOfBoundsException if: > > The srcPos argument is negative. > The destPos argument is negative. > The length argument is negative > > > so the fix is made to make nmove, src, dest +ve > Also, Element.getElement() can return null which is not checked, causing NPE, > if deletion of text is done which results in no element, which is also fixed > in the PR > > All jtreg testsuite tests are run without any regression. Fix is tested and validated. Looks fine to me. ------------- Marked as reviewed by tr (Author). PR: https://git.openjdk.org/jdk/pull/10446
