Fix various UTF8 parsing bugs.

In particular, parse bad UTF8 by replacing the broken bits with U+FFFD
and resychronise correctly after broken sequences.

jv_unicode.c

@@ -3,35 +3,56 @@
 #include "jv_unicode.h"
 #include "jv_utf8_tables.h"
 
-const char* jvp_utf8_next(const char* in, const char* end, int* codepoint) {
+const char* jvp_utf8_next(const char* in, const char* end, int* codepoint_ret) {
+  assert(in <= end);
   if (in == end) {
-    codepoint = 0;
     return 0;
   }
+  int codepoint = -1;
   unsigned char first = (unsigned char)in[0];
   int length = utf8_coding_length[first];
-  if (length == 0 || length == UTF8_CONTINUATION_BYTE || in + length > end) {
-    *codepoint = -1;
-    return 0;
-  }
-  *codepoint = ((unsigned)in[0]) & utf8_coding_bits[first];
-  for (int i=1; i<length; i++) {
-    int ch = (unsigned char)in[i];
-    if (utf8_coding_length[(unsigned char)in[i]] != UTF8_CONTINUATION_BYTE){
-      *codepoint = -1;
-      return 0;
+  if ((first & 0x80) == 0) {
+    /* Fast-path for ASCII */
+    codepoint = first;
+    length = 1;
+  } else if (length == 0 || length == UTF8_CONTINUATION_BYTE) {
+    /* Bad single byte - either an invalid byte or an out-of-place continuation byte */
+    length = 1;
+  } else if (in + length > end) {
+    /* String ends before UTF8 sequence ends */
+    length = end - in;
+  } else {
+    codepoint = ((unsigned)in[0]) & utf8_coding_bits[first];
+    for (int i=1; i<length; i++) {
+      unsigned ch = (unsigned char)in[i];
+      if (utf8_coding_length[ch] != UTF8_CONTINUATION_BYTE){
+        /* Invalid UTF8 sequence - not followed by the right number of continuation bytes */
+        codepoint = -1;
+        length = i;
+        break;
+      }
+      codepoint = (codepoint << 6) | (ch & 0x3f);
+    }
+    if (0xD800 <= codepoint && codepoint <= 0xDFFF) {
+      /* Surrogate codepoints can't be encoded in UTF8 */
+      codepoint = -1;
+    }
+    if (codepoint > 0x10FFFF) {
+      /* Outside Unicode range */
+      codepoint = -1;
     }
-    *codepoint = (*codepoint << 6) | (ch & 0x3f);
   }
+  assert(length > 0);
+  *codepoint_ret = codepoint;
   return in + length;
 }
 
-int jvp_utf8_verify(const char* in, const char* end) {
-  int codepoint = 0;
+int jvp_utf8_is_valid(const char* in, const char* end) {
+  int codepoint;
   while ((in = jvp_utf8_next(in, end, &codepoint))) {
     if (codepoint == -1) return 0;
   }
-  return codepoint != -1;
+  return 1;
 }
 
 int jvp_utf8_encode_length(int codepoint) {