AK+Tests: Avoid creating invalid code points from malformed UTF-8

Instead of doing anything reasonable, Utf8CodePointIterator returned
invalid code points, for example U+123456. However, many callers of this
iterator assume that a code point is always at most 0x10FFFF.

In fact, this is one of two reasons for the following OSS Fuzz issue:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49184
This is probably a very old bug.

In the particular case of URLParser, AK::is_url_code_point got confused:
    return /* ... */ || code_point >= 0xA0;
If code_point is a "code point" beyond 0x10FFFF, this violates the
condition given in the preceding comment, but satisfies the given
condition, which eventually causes URLParser to crash.

This commit fixes *only* the erroneous UTF-8 decoding, and does not
fully resolve OSS-Fuzz#49184.

AK/Utf8View.cpp

@@ -274,6 +274,10 @@ u32 Utf8CodePointIterator::operator*() const
         code_point_value_so_far |= m_ptr[offset] & 63;
     }
 
+    if (code_point_value_so_far > 0x10FFFF) {
+        dbgln_if(UTF8_DEBUG, "Multi-byte sequence is otherwise valid, but code point {:#x} is not permissible.", code_point_value_so_far);
+        return 0xFFFD;
+    }
     return code_point_value_so_far;
 }
 

Tests/AK/TestUtf8.cpp

@@ -191,6 +191,33 @@ TEST_CASE(decode_invalid_ut8)
         }
         VERIFY(i == expected_size);
     }
+
+    // Test case 5 : Oversized four-byte sequence (e.g. U+123456)
+    {
+        // Want to encode: (000)1 0010 0011 0100 0101 0110
+        // Into mask: 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
+        // Shifted:        100   100011   010001   010110
+        // Result:    11110100 10100011 10010001 10010110
+        char raw_data[] = { 'a', (char)0xF4, (char)0xA3, (char)0x91, (char)0x96, 'b' };
+        Utf8View view { StringView { raw_data, 6 } };
+        // This definition seems to suggest that we should instead output multiple replacement characters:
+        // https://encoding.spec.whatwg.org/#ref-for-concept-stream-prepend②
+        // This is supported by the plaintext description and example collection, which annoyingly does not give an example of how to deal with this:
+        // https://www.unicode.org/versions/Unicode14.0.0/ch03.pdf , section "U+FFFD Substitution of Maximal Subparts"
+        // However, that would go against how we deal with several other kinds of errors, so we stick to emitting only one U+FFFD.
+        u32 expected_characters[] = { 'a', 0xFFFD, 'b' };
+        String expected_underlying_bytes[] = { "a", "\xF4\xA3\x91\x96", "b" };
+        size_t expected_size = sizeof(expected_characters) / sizeof(expected_characters[0]);
+        size_t i = 0;
+        for (auto it = view.begin(); it != view.end(); ++it) {
+            u32 code_point = *it;
+            VERIFY(i < expected_size);
+            EXPECT_EQ(code_point, expected_characters[i]);
+            EXPECT_EQ(it.underlying_code_point_bytes(), expected_underlying_bytes[i].bytes());
+            i++;
+        }
+        VERIFY(i == expected_size);
+    }
 }
 
 TEST_CASE(trim)