fix: validate semantic token edit delete count before allocation (fixes #322571)

src/vs/editor/common/services/semanticTokensProviderStyling.ts

@@ -22,6 +22,7 @@ export class SemanticTokensProviderStyling {
 	private _hasWarnedOverlappingTokens = false;
 	private _hasWarnedInvalidLengthTokens = false;
 	private _hasWarnedInvalidEditStart = false;
+	private _hasWarnedInvalidEditDeleteCount = false;
 
 	constructor(
 		private readonly _legend: SemanticTokensLegend,
@@ -125,6 +126,13 @@ export class SemanticTokensProviderStyling {
 		}
 	}
 
+	public warnInvalidEditDeleteCount(previousResultId: string | undefined, resultId: string | undefined, srcLength: number, deltaLength: number): void {
+		if (!this._hasWarnedInvalidEditDeleteCount) {
+			this._hasWarnedInvalidEditDeleteCount = true;
+			this._logService.warn(`Invalid semantic tokens edit detected (previousResultId: ${previousResultId}, resultId: ${resultId}): The edits delete more tokens than the previous data contains (previous length ${srcLength}, computed length ${srcLength + deltaLength}).`);
+		}
+	}
+
 }
 
 const enum SemanticColoringConstants {

src/vs/editor/contrib/semanticTokens/browser/documentSemanticTokens.ts

@@ -341,7 +341,14 @@ class ModelSemanticColoring extends Disposable {
 				}
 
 				const srcData = currentResponse.data;
-				const destData = new Uint32Array(srcData.length + deltaLength);
+				const destDataLength = srcData.length + deltaLength;
+				if (destDataLength < 0) {
+					styling.warnInvalidEditDeleteCount(currentResponse.resultId, tokens.resultId, srcData.length, deltaLength);
+					// The edits delete more tokens than the previous result contains and there's no way to recover
+					this._model.tokenization.setSemanticTokens(null, true);
+					return;
+				}
+				const destData = new Uint32Array(destDataLength);
 
 				let srcLastStart = srcData.length;
 				let destLastStart = destData.length;