Infinite loop in countColumn with tab indentation

[personalizedrefrigerator]

Describe the issue

Summary

An infinite loop occurs in some cases during list completion in a Markdown editor with tab indentation.

Reproduction steps

To reproduce:

1. Create a Markdown editor with tab indentation and * * * * * a as the first line (try-it link):

   import {basicSetup, EditorView} from "codemirror"
   import {markdown} from "@codemirror/lang-markdown"
   import {indentUnit} from "@codemirror/language"
   
   let view = new EditorView({
     doc: "* * * * * a",
     extensions: [
       basicSetup,
       indentUnit.of('\t'),
       markdown()
     ],
     parent: document.body
   })

2. Move the cursor to the end of the first line.
3. Press enter.
4. Try to press enter again.

At this point, an infinite loop occurs.

Debugging

Pausing script execution soon after the start of the loop, Chrome's developer tools suggest that the issue is in @codemirror/state's countColumn:

Above, countColumn has the following input:

• string is "\t\t* ".
• tabSize is 4.
• to is 6.

Browser and platform

Chromium Version 131.0.6778.139 (Official Build) snap (64-bit) on Ubuntu 24.04

Reproduction link

https://codemirror.net/try/#c=aW1wb3J0IHtiYXNpY1NldHVwLCBFZGl0b3JWaWV3fSBmcm9tICJjb2RlbWlycm9yIgppbXBvcnQge21hcmtkb3dufSBmcm9tICJAY29kZW1pcnJvci9sYW5nLW1hcmtkb3duIgppbXBvcnQge2luZGVudFVuaXR9IGZyb20gIkBjb2RlbWlycm9yL2xhbmd1YWdlIgoKbGV0IHZpZXcgPSBuZXcgRWRpdG9yVmlldyh7CiAgZG9jOiAiKiAqICogKiAqIGEiLAogIGV4dGVuc2lvbnM6IFsKICAgIGJhc2ljU2V0dXAsCiAgICBpbmRlbnRVbml0Lm9mKCdcdCcpLAogICAgbWFya2Rvd24oKQogIF0sCiAgcGFyZW50OiBkb2N1bWVudC5ib2R5Cn0pCg==

[marijnh]

Attached patch should solve this.

[personalizedrefrigerator]

Thank you for looking into this!

With a slightly modified document, the infinite loop still happens:

• Try-it link
• New initial document:

  * * * * * a
   	* b

• Reproduction steps:
  1. Open the above try-it demo.
  2. Move the cursor to the end of the second line (just after the "b").
  3. Press enter.

As before, the infinite loop occurs in countColumn:

In the above screenshot, the input string has length 5 and to is 6. In this case, countColumn is called directly from insertNewlineContinueMarkup.

[marijnh]

Indeed, there are multiple call like the one I fixed. I've gone ahead and made countColumn in @codemirror/state handle out-of-bounds to arguments in attached patch.