From 85ff2fa093330449ede7f6075cf83b86e13f5f81 Mon Sep 17 00:00:00 2001 From: Takaranoao Date: Sun, 1 Mar 2026 04:55:06 -0800 Subject: [PATCH] fix(macOS): clamp IME selected_range to prevent substringToIndex crash macOS native Pinyin IME can send a selected_range that exceeds the marked text string length (e.g. index 8 for a 6-character string). This caused an NSRangeException in substringToIndex:, crashing the application with SIGABRT. Clamp both location and end to the string's UTF-16 length before calling substringToIndex. --- winit-appkit/src/view.rs | 10 ++++++++-- winit/src/changelog/unreleased.md | 1 + 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/winit-appkit/src/view.rs b/winit-appkit/src/view.rs index 6fce2bdbf..1b0c3ec9b 100644 --- a/winit-appkit/src/view.rs +++ b/winit-appkit/src/view.rs @@ -304,9 +304,15 @@ define_class!( // sending a `None` cursor range. None } else { + // Clamp to string length to avoid NSRangeException from out-of-bounds + // indices sent by macOS IME (e.g. native Pinyin, see + // https://github.com/alacritty/alacritty/issues/8791). + let len = string.length(); + let location = selected_range.location.min(len); + let end = selected_range.end().min(len); // Convert the selected range from UTF-16 indices to UTF-8 indices. - let sub_string_a = string.substringToIndex(selected_range.location); - let sub_string_b = string.substringToIndex(selected_range.end()); + let sub_string_a = string.substringToIndex(location); + let sub_string_b = string.substringToIndex(end); let lowerbound_utf8 = sub_string_a.len(); let upperbound_utf8 = sub_string_b.len(); Some((lowerbound_utf8, upperbound_utf8)) diff --git a/winit/src/changelog/unreleased.md b/winit/src/changelog/unreleased.md index 638dad488..ceab7e091 100644 --- a/winit/src/changelog/unreleased.md +++ b/winit/src/changelog/unreleased.md @@ -55,4 +55,5 @@ changelog entry. - On Redox, handle `EINTR` when reading from `event_socket` instead of panicking. - On Wayland, switch from using the `ahash` hashing algorithm to `foldhash`. - On macOS, fix borderless game presentation options not sticking after switching spaces. +- On macOS, fix crash in `set_marked_text` when native Pinyin IME sends out-of-bounds `selected_range`. - On X11, fix debug mode overflow panic in `set_timestamp`.