src: fix two encodeInto() bugs that reject input that fits

TextEncoder.encodeInto() could report that a code point does not fit
in the destination Uint8Array even when it does.

1. simpleUtfEncodingLength() used 0x400 as the boundary between 2-byte
   and 3-byte UTF-8 encodings, but the correct boundary is 0x800: code
   points in [0x80, 0x800) need 2 bytes in UTF-8, and only code points
   >= 0x800 need 3.

2. The same function is called with a raw `char` from the Latin1
   (one-byte string) code path. `char` is signed on some platforms, so
   a byte >= 0x80 gets sign-extended to a large uint16_t value instead
   of the intended code point, which also made encodeInto() behave
   differently for the same prefix depending on whether the rest of
   the source string forced V8 to represent it as one-byte (Latin1) or
   two-byte (UTF-16) internally.

Also make the character-by-character fallback in findBestFit() consume
a UTF-16 surrogate pair as one atomic 4-byte unit instead of scoring
each half separately and patching up the boundary afterwards, which is
more straightforward to reason about than the previous post-hoc
adjustment.

Fixes: #65994

Signed-off-by: agape1225 <49804691+agape1225@users.noreply.github.com>

Author: agape1225

src/encoding_binding.cc

@@ -10,6 +10,7 @@
 
 #include <algorithm>
 #include <cstdint>
+#include <type_traits>
 
 namespace node {
 namespace encoding_binding {
@@ -88,7 +89,7 @@ constexpr bool isSurrogatePair(uint16_t lead, uint16_t trail) {
 
 constexpr size_t simpleUtfEncodingLength(uint16_t c) {
   if (c < 0x80) return 1;
-  if (c < 0x400) return 2;
+  if (c < 0x800) return 2;
   return 3;
 }
 
@@ -162,19 +163,30 @@ size_t findBestFit(const Char* data, size_t length, size_t bufferSize) {
   }
 
   while (pos < length && utf8Accumulated < bufferSize) {
-    size_t extra = simpleUtfEncodingLength(data[pos]);
-    if (utf8Accumulated + extra > bufferSize) break;
-    pos++;
-    utf8Accumulated += extra;
-  }
-
-  if (UTF16 && pos != 0 && pos != length &&
-      isSurrogatePair(data[pos - 1], data[pos])) {
-    if (utf8Accumulated < bufferSize) {
-      pos++;
+    size_t codeUnits = 1;
+    size_t extra;
+    if constexpr (UTF16) {
+      // A valid surrogate pair must be consumed together: it encodes to 4
+      // UTF-8 bytes total, not 3 for each half measured separately (which
+      // is also what an isolated, unpaired surrogate encodes to).
+      if (pos + 1 < length && isSurrogatePair(data[pos], data[pos + 1])) {
+        codeUnits = 2;
+        extra = 4;
+      } else {
+        extra = simpleUtfEncodingLength(static_cast<uint16_t>(data[pos]));
+      }
     } else {
-      pos--;
+      // `char` is signed on some platforms/ABIs, so widening a byte >= 0x80
+      // straight to uint16_t would sign-extend it into a bogus code point.
+      // Go through the Char type's unsigned counterpart first to get the
+      // right code unit.
+      using UnsignedChar = std::make_unsigned_t<Char>;
+      extra = simpleUtfEncodingLength(
+          static_cast<uint16_t>(static_cast<UnsignedChar>(data[pos])));
     }
+    if (utf8Accumulated + extra > bufferSize) break;
+    pos += codeUnits;
+    utf8Accumulated += extra;
   }
   return pos;
 }

test/parallel/test-whatwg-encoding-custom-textencoder-encodeinto.js

@@ -0,0 +1,52 @@
+'use strict';
+
+// This tests that TextEncoder.encodeInto() does not underestimate how many
+// bytes a code point needs when computing how much of the source string fits
+// into the destination.
+
+require('../common');
+const assert = require('assert');
+
+// Long enough to bypass the small-string fast path (kSmallStringThreshold = 32
+// in src/encoding_binding.cc) and exercise the chunked encoding logic.
+const encoder = new TextEncoder();
+
+{
+  // Code points in [0x80, 0x800) are 2 bytes in UTF-8; treating them as 3
+  // bytes causes encodeInto() to reject input that would actually fit.
+  const text = 'Ѐ'.repeat(33);
+  const result = encoder.encodeInto(text, new Uint8Array(2));
+  assert.strictEqual(result.read, 1);
+  assert.strictEqual(result.written, 2);
+}
+
+{
+  // A one-byte (Latin1) source string takes a different internal path than
+  // a two-byte (UTF-16) one. Bytes >= 0x80 must be treated as unsigned there
+  // too, or they get sign-extended into a bogus, oversized code point.
+  const text = 'é'.repeat(33);
+  const result = encoder.encodeInto(text, new Uint8Array(2));
+  assert.strictEqual(result.read, 1);
+  assert.strictEqual(result.written, 2);
+
+  // Appending a two-byte character forces the whole string to be stored as
+  // UTF-16 internally, which must not change how the Latin1-only prefix
+  // encodes.
+  const withTrailingChar = encoder.encodeInto(
+    text + '☺', new Uint8Array(2));
+  assert.strictEqual(withTrailingChar.read, result.read);
+  assert.strictEqual(withTrailingChar.written, result.written);
+}
+
+{
+  // A surrogate pair (U+1F600 here) is 2 UTF-16 code units that must be
+  // read together: it encodes to 4 UTF-8 bytes, not 3 bytes per code unit.
+  const text = '\u{1F600}'.repeat(17); // 34 UTF-16 code units.
+  for (let n = 0; n <= 8; n++) {
+    const { read, written } = encoder.encodeInto(text, new Uint8Array(n));
+    // `read` must land on a whole number of surrogate pairs, and the byte
+    // count for that many pairs must be exactly 4 per pair.
+    assert.strictEqual(read % 2, 0);
+    assert.strictEqual(written, (read / 2) * 4);
+  }
+}