Async Clipboard: Fix off-by-one renderer crash

Patchset 1: Tests only (fails without patchset 2)
Patchset 2: Fix (tests from patchset 1 succeeds)

Bug: 981006
Change-Id: I3e9ba336793334ecc1dab77521189f7695d625fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1693733
Commit-Queue: Darwin Huang <huangdarwin@chromium.org>
Reviewed-by: Darwin Huang <huangdarwin@chromium.org>
Reviewed-by: Victor Costan <pwnall@chromium.org>
Auto-Submit: Darwin Huang <huangdarwin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#676195}

third_party/blink/renderer/modules/clipboard/clipboard_promise.cc

@@ -113,10 +113,12 @@ void ClipboardPromise::WriteNextRepresentation() {
 
 void ClipboardPromise::RejectFromReadOrDecodeFailure() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK_GE(clipboard_representation_index_, static_cast<wtf_size_t>(1));
   script_promise_resolver_->Reject(MakeGarbageCollected<DOMException>(
       DOMExceptionCode::kDataError,
       "Failed to read or decode Blob for clipboard item type " +
-          clipboard_item_data_[clipboard_representation_index_].first + "."));
+          clipboard_item_data_[clipboard_representation_index_ - 1].first +
+          "."));
 }
 
 void ClipboardPromise::HandleRead() {

third_party/blink/web_tests/external/wpt/clipboard-apis/async-write-image-read-image-manual.https.html

@@ -61,6 +61,14 @@ promise_test(async t => {
 
   assert_equals(comparableOutput, comparableInput);
 }, 'Verify write and read clipboard [image/png Blob]');
+
+promise_test(async t => {
+  const invalidPngBlob = new Blob(['this text is not a valid png image'],
+      {type: "image/png"});
+  const clipboardItemInput = new ClipboardItem({'image/png' : invalidPngBlob});
+  await promise_rejects(t, "DataError",
+      navigator.clipboard.write([clipboardItemInput]));
+}, 'Verify write error on malformed data [image/png ClipboardItem]');
 </script>
 <p>
   Note: This is a manual test because it writes/reads to the shared system

third_party/blink/web_tests/http/tests/clipboard/async-write-image-read-image.html

@@ -65,4 +65,15 @@ promise_test(async t => {
 
   assert_equals(comparableOutput, comparableInput);
 }, 'Verify write and read clipboard [image/png ClipboardItem]');
+
+promise_test(async t => {
+  await PermissionsHelper.setPermission('clipboard-read', 'granted');
+  await PermissionsHelper.setPermission('clipboard-write', 'granted');
+
+  const invalidPngBlob = new Blob(['this text is not a valid png image'],
+      {type: "image/png"});
+  const clipboardItemInput = new ClipboardItem({'image/png' : invalidPngBlob});
+  await promise_rejects(t, "DataError",
+      navigator.clipboard.write([clipboardItemInput]));
+}, 'Verify write error on malformed data [image/png ClipboardItem]');
 </script>