From 8850d8599815032390d508a0585f8ac05e27991c Mon Sep 17 00:00:00 2001
From: Kalle Olavi Niemitalo <kon@iki.fi>
Date: Sun, 27 Aug 2006 11:45:11 +0300
Subject: [PATCH] ECMAScript: If accessKey is a surrogate, throw an error when
 reading it.

Surrogates are now treated the same way as out-of-range characters
like U+110000; if a link has such an access key, then the ECMAScript
accessKey property cannot be read.  It seems currently impossible to
set such an access key though, because accesskey_string_to_unicode()
doesn't support multibyte characters yet.
---
 src/document/document.h            |  4 +++-
 src/ecmascript/see/input.c         |  8 +++++---
 src/ecmascript/spidermonkey/form.c | 11 +++++++----
 3 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/src/document/document.h b/src/document/document.h
index 466a92409..dd7b9685c 100644
--- a/src/document/document.h
+++ b/src/document/document.h
@@ -231,7 +231,9 @@ void shrink_format_cache(int);
 extern struct module document_module;
 
 /* FIXME: support for entities and all Unicode characters.
- * For now, we only support simple printable character. */
+ * (Unpaired surrogates should be rejected, so that the ECMAScript
+ * interface can convert the access key to UTF-16.)
+ * For now, we only support simple printable character.  */
 #define accesskey_string_to_unicode(s) (((s)[0] && !(s)[1] && isprint((s)[0])) ? (s)[0] : 0)
 
 #endif
diff --git a/src/ecmascript/see/input.c b/src/ecmascript/see/input.c
index cba243551..59c6d909d 100644
--- a/src/ecmascript/see/input.c
+++ b/src/ecmascript/see/input.c
@@ -107,9 +107,11 @@ append_unicode_to_SEE_string(struct SEE_interpreter *interp,
 			     struct SEE_string *str,
 			     unicode_val_T u)
 {
-	if (u <= 0xFFFF) {
-		/* TODO: Should this reject code points in the
-		 * surrogate range? */
+	/* This is supposed to make a string from which
+	 * SEE_string_to_unicode() can get the original @u back.
+	 * If @u is a surrogate, then that is not possible, so
+	 * throw an error instead.  */
+	if (u <= 0xFFFF && !is_utf16_surrogate(u)) {
 		SEE_string_addch(str, u);
 	} else if (needs_utf16_surrogates(u)) {
 		SEE_string_addch(str, get_utf16_high_surrogate(u));
diff --git a/src/ecmascript/spidermonkey/form.c b/src/ecmascript/spidermonkey/form.c
index 6da9b49c2..5e5eababd 100644
--- a/src/ecmascript/spidermonkey/form.c
+++ b/src/ecmascript/spidermonkey/form.c
@@ -989,13 +989,16 @@ unicode_to_jsstring(JSContext *ctx, unicode_val_T u)
 {
 	jschar buf[2];
 
-	/* If JS_NewUCStringCopyN hits a null character, it truncates
+	/* This is supposed to make a string from which
+	 * jsval_to_accesskey() can get the original @u back.
+	 * If @u is a surrogate, then that is not possible, so
+	 * return NULL to indicate an error instead.
+	 *
+	 * If JS_NewUCStringCopyN hits a null character, it truncates
 	 * the string there and pads it with more nulls.  However,
 	 * that is not a problem here, because if there is a null
 	 * character in buf[], then it must be the only character.  */
-	if (u <= 0xFFFF) {
-		/* TODO: Should this reject code points in the
-		 * surrogate range? */
+	if (u <= 0xFFFF && !is_utf16_surrogate(u)) {
 		buf[0] = u;
 		return JS_NewUCStringCopyN(ctx, buf, 1);
 	} else if (needs_utf16_surrogates(u)) {