Crash

[castroteam]

snippet.txt

The attached HTML snippet causes a crash

within MarkupNSAttributedStringVisitor#reduceBreaklineInResultNSAttributedString

NSMutableRLEArray replaceObjectsInRange:withObject:length:: Out of bounds

Probably the HTML is malformed, but ZMarkupParser should fail more gracefully.

Thanks!

[zhgchgli0718]

will fix asap, thanks for your feedback

[James-chok]

snippet.txt

The attached HTML snippet causes a crash

within MarkupNSAttributedStringVisitor#reduceBreaklineInResultNSAttributedString

NSMutableRLEArray replaceObjectsInRange:withObject:length:: Out of bounds

Probably the HTML is malformed, but ZMarkupParser should fail more gracefully.

Thanks!

Did it happen on iOS18?

[James-chok]

I found the parser works weirdly on iOS18. 🤔

[castroteam]

Yes I think so.

[zhgchgli0718]

Thank you all for your feedback and assistance.

---

private extension NSAttributedString.Key {
    static let breaklinePlaceholder: NSAttributedString.Key = .init("breaklinePlaceholder")
    struct BreaklinePlaceholder: OptionSet {
        let rawValue: Int

        static let tagBoundaryPrefix = BreaklinePlaceholder(rawValue: 1)
        static let tagBoundarySuffix = BreaklinePlaceholder(rawValue: 2)
        static let breaklineTag = BreaklinePlaceholder(rawValue: 3)
    }
}

The root cause is that the custom NSAttributedString.Key requires an extension from Hashable. Otherwise, on iOS 18 and above, it will throw the following error:

Obj-C `-hash` invoked on a Swift value of type `(extension in ZMarkupParser):__C.NSAttributedStringKey.(unknown context at $10380bcc0).BreaklinePlaceholder` that is Equatable but not Hashable; this can lead to severe performance problems.

This leads to a subsequent crash:

*** Terminating app due to uncaught exception 'NSRangeException', reason: 'NSMutableRLEArray replaceObjectsInRange:withObject:length:: Out of bounds'
*** First throw call stack:

However, the expected behavior is to record each breakline position and merge them according to the rules.

If we simply extend the struct with BreaklinePlaceholder: OptionSet, Hashable, the system will automatically merge repeated BreaklinePlaceholder, which is not what we want.

Therefore, I changed it to use a class declaration for the placeholder to maintain the original merging logic.

I also adjusted the crash point in mutableAttributedString.enumerateAttribute(.breaklinePlaceholder, in: NSMakeRange(0, totalLength)), implementing a safer approach by first collecting the ranges and then performing the deletions.

For more details, please refer to this PR. #78

[James-chok]

Thank you for fixing this crash!

[zhgchgli0718]

the full story: https://en.zhgchg.li/posts/9e43897d99fc/