Handle inserting negative values without a selection

When handling the AFNumber_Keystroke callback, if the changed value is
negative and there is no selection, we'd incorrectly error out thinking
we were inserting before the negative sign.

This CL checks if the selection string is empty before erroring out.

Bug: chromium:817433
Change-Id: I0ca08e121e9a8c207e9c7793f5b8a4e795c135e6
Reviewed-on: https://pdfium-review.googlesource.com/28110
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>

2 files changed, 46 insertions, 2 deletions

diff --git a/fxjs/cjs_publicmethods.cpp b/fxjs/cjs_publicmethods.cpp
index d613f4888a..28df0a305b 100644
--- a/fxjs/cjs_publicmethods.cpp
+++ b/fxjs/cjs_publicmethods.cpp
@@ -1009,8 +1009,8 @@ CJS_Return CJS_PublicMethods::AFNumber_Keystroke(
 
   bool bHasSign = wstrValue.Contains(L'-') && !wstrSelected.Contains(L'-');
   if (bHasSign) {
-    // can't insert "change" in front to sign postion.
-    if (pEvent->SelStart() == 0) {
+    // can't insert "change" in front of sign position.
+    if (!wstrSelected.IsEmpty() && pEvent->SelStart() == 0) {
       pEvent->Rc() = false;
       return CJS_Return(true);
     }
diff --git a/fxjs/cjs_publicmethods_embeddertest.cpp b/fxjs/cjs_publicmethods_embeddertest.cpp
index 874f59f5ae..90efee9078 100644
--- a/fxjs/cjs_publicmethods_embeddertest.cpp
+++ b/fxjs/cjs_publicmethods_embeddertest.cpp
@@ -196,3 +196,47 @@ TEST_F(CJS_PublicMethodsEmbedderTest, AFSimple_CalculateSum) {
   ASSERT_TRUE(!ret.HasReturn());
   ASSERT_EQ(L"7", result);
 }
+
+TEST_F(CJS_PublicMethodsEmbedderTest, AFNumber_Keystroke) {
+  v8::Isolate::Scope isolate_scope(isolate());
+  v8::HandleScope handle_scope(isolate());
+  v8::Context::Scope context_scope(GetV8Context());
+
+  EXPECT_TRUE(OpenDocument("calculate.pdf"));
+  auto* page = LoadPage(0);
+  ASSERT_TRUE(page);
+
+  CJS_Runtime runtime(static_cast<CPDFSDK_FormFillEnvironment*>(form_handle()));
+  runtime.NewEventContext();
+
+  auto* handler = runtime.GetCurrentEventContext()->GetEventHandler();
+
+  bool valid = true;
+  WideString result = L"-10";
+  WideString change = L"";
+
+  handler->m_pValue = &result;
+  handler->m_pbRc = &valid;
+  handler->m_pWideStrChange = &change;
+
+  handler->m_bWillCommit = 0;
+  handler->SetSelStart(0);
+  handler->SetSelEnd(0);
+
+  std::vector<v8::Local<v8::Value>> params;
+  params.push_back(runtime.NewString(L"-10"));
+  params.push_back(runtime.NewString(L""));
+
+  CJS_Return ret = CJS_PublicMethods::AFNumber_Keystroke(&runtime, params);
+  EXPECT_TRUE(valid);
+  EXPECT_TRUE(!ret.HasError());
+  EXPECT_TRUE(!ret.HasReturn());
+
+  UnloadPage(page);
+
+  // Keep the *SAN bots happy. One of these is an UnownedPtr, another seems to
+  // used during destruction. Clear them all to be safe and consistent.
+  handler->m_pValue = nullptr;
+  handler->m_pbRc = nullptr;
+  handler->m_pWideStrChange = nullptr;
+}