fix(macOS): clamp IME selected_range to prevent substringToIndex crash

macOS native Pinyin IME can send a selected_range that exceeds the
marked text string length (e.g. index 8 for a 6-character string).
This caused an NSRangeException in substringToIndex:, crashing the
application with SIGABRT.

Clamp both location and end to the string's UTF-16 length before
calling substringToIndex.

winit-appkit/src/view.rs

@@ -304,9 +304,15 @@ define_class!(
                 // sending a `None` cursor range.
                 None
             } else {
+                // Clamp to string length to avoid NSRangeException from out-of-bounds
+                // indices sent by macOS IME (e.g. native Pinyin, see
+                // https://github.com/alacritty/alacritty/issues/8791).
+                let len = string.length();
+                let location = selected_range.location.min(len);
+                let end = selected_range.end().min(len);
                 // Convert the selected range from UTF-16 indices to UTF-8 indices.
-                let sub_string_a = string.substringToIndex(selected_range.location);
-                let sub_string_b = string.substringToIndex(selected_range.end());
+                let sub_string_a = string.substringToIndex(location);
+                let sub_string_b = string.substringToIndex(end);
                 let lowerbound_utf8 = sub_string_a.len();
                 let upperbound_utf8 = sub_string_b.len();
                 Some((lowerbound_utf8, upperbound_utf8))

winit/src/changelog/unreleased.md

@@ -55,4 +55,5 @@ changelog entry.
 - On Redox, handle `EINTR` when reading from `event_socket` instead of panicking.
 - On Wayland, switch from using the `ahash` hashing algorithm to `foldhash`.
 - On macOS, fix borderless game presentation options not sticking after switching spaces.
+- On macOS, fix crash in `set_marked_text` when native Pinyin IME sends out-of-bounds `selected_range`.
 - On X11, fix debug mode overflow panic in `set_timestamp`.