From bb7893155b02f75953c137ab275e5dd70c90782c Mon Sep 17 00:00:00 2001
From: Federico Mena Quintero <federico@gnome.org>
Date: Mon, 12 Sep 2016 11:54:27 -0500
Subject: [PATCH 1/4] Don't pass -1 for the string length to a function that
 takes guints...

---
 gtkhtml/gtkhtml.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gtkhtml/gtkhtml.c b/gtkhtml/gtkhtml.c
index 541e942..ef6ee36 100644
--- a/gtkhtml/gtkhtml.c
+++ b/gtkhtml/gtkhtml.c
@@ -3339,7 +3339,7 @@ gtk_html_im_commit_cb (GtkIMContext *context,
 		pos = html->engine->mark->position;
 
 	D_IM (printf ("IM commit %s\n", str);)
-	html_engine_paste_text (html->engine, str, -1);
+	html_engine_paste_text (html->engine, str, g_utf8_strlen (str, -1));
 	html->priv->im_block_reset = state;
 
 	D_IM (printf ("IM commit pos: %d pre_pos: %d\n", pos, html->priv->im_pre_pos);)
-- 
2.1.4


From 7fa894650fee4c4c54eca4fbc8b79ff51f277b4d Mon Sep 17 00:00:00 2001
From: Federico Mena Quintero <federico@gnome.org>
Date: Tue, 13 Sep 2016 12:52:21 -0500
Subject: [PATCH 2/4] Error out if the cursor position becomes negative.

---
 gtkhtml/htmlcursor.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/gtkhtml/htmlcursor.c b/gtkhtml/htmlcursor.c
index c981563..b432b6d 100644
--- a/gtkhtml/htmlcursor.c
+++ b/gtkhtml/htmlcursor.c
@@ -70,6 +70,10 @@ debug_location (const HTMLCursor *cursor)
 	g_print ("Cursor in %s (%p), offset %d, position %d\n",
 		 html_type_name (HTML_OBJECT_TYPE (object)),
 		 (gpointer) object, cursor->offset, cursor->position);
+
+	if (cursor->position < 0) {
+		g_error ("error! cursor->position < 0");
+	}
 }
 #else
 #define debug_location(cursor)
-- 
2.1.4


From b0a0f955ec384d0b7a6d3cc79aaef6d20b2d9c7a Mon Sep 17 00:00:00 2001
From: Federico Mena Quintero <federico@gnome.org>
Date: Thu, 15 Sep 2016 17:40:50 -0500
Subject: [PATCH 3/4] htmlobject: handle containers with non-cursor-able
 children

If the cursor is right at the beginning of a table like

    <table>
      <tr>
	<td>
	  <a name="">
	  </a>
	</td>
	<td>
	  foo
	</td>
      </tr>
    </table>
    bar

then move_object_cursor() would find the first TableCell (the first
<td>), and its Anchor.  The anchor contains nothing, so it can't take
the cursor.

However, move_object_cursor() would jump to the step where it does,
"find me the next object within the current object's parent", but for
the entire Table, not for the TableCell.  Thus it would miss the second
<td> that actually contains a "foo" string, and it would skip past the
Table to its next cursor-able sibling, the "bar" string.
---
 gtkhtml/htmlobject.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/gtkhtml/htmlobject.c b/gtkhtml/htmlobject.c
index 1768733..d2a679b 100644
--- a/gtkhtml/htmlobject.c
+++ b/gtkhtml/htmlobject.c
@@ -1911,13 +1911,19 @@ move_object_cursor (HTMLObject *obj,
 		gboolean found = FALSE;
 		if (((*offset == 0 && forward) || (*offset && !forward)) && html_object_is_container (obj))
 			if ((down = (*down_fn) (obj))) {
-				down = move_object_downtree_cursor (down, down_fn, next_fn);
-				if (down) {
-					if (html_object_is_container (down))
+				HTMLObject *down_child;
+
+				down_child = move_object_downtree_cursor (down, down_fn, next_fn);
+				if (down_child) {
+					if (html_object_is_container (down_child))
 						*offset = forward ? 0 : 1;
-					return down;
+
+					return down_child;
+				} else {
+					obj = down;
 				}
 			}
+		}
 
 		before = obj;
 		do {
-- 
2.1.4


From ceb72319b613007a00f07d5bc533592e2646e96d Mon Sep 17 00:00:00 2001
From: Federico Mena Quintero <federico@gnome.org>
Date: Thu, 15 Sep 2016 18:25:15 -0500
Subject: [PATCH 4/4] Oops, add missing brace

---
 gtkhtml/htmlobject.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gtkhtml/htmlobject.c b/gtkhtml/htmlobject.c
index d2a679b..dbf0ff3 100644
--- a/gtkhtml/htmlobject.c
+++ b/gtkhtml/htmlobject.c
@@ -1909,7 +1909,7 @@ move_object_cursor (HTMLObject *obj,
 
 	do {
 		gboolean found = FALSE;
-		if (((*offset == 0 && forward) || (*offset && !forward)) && html_object_is_container (obj))
+		if (((*offset == 0 && forward) || (*offset && !forward)) && html_object_is_container (obj)) {
 			if ((down = (*down_fn) (obj))) {
 				HTMLObject *down_child;
 
-- 
2.1.4

