Fix IndexOutOfRangeException when an added/removed attribute spans a buffer size boundary (#50110)

**NOTE: I'm not actually proposing this for servicing right now, because it doesn't look like there would be a major benefit from including it in RC1, and including it in RC2 would be perfectly sufficient. However I'm writing up the ask mode template anyway just in case people disagree.**

Extremely rarely, component rendering could cause IndexOutOfRangeException.

## Description

If a component rendered a very specific number of frames, and then updated to render exactly one more frame, and that new frame was an attribute, and it was the last frame in the component, the diffing system would throw `IndexOutOfRangeException`. This was due to a bug in checking whether there are more attributes to process.

Fixes #49192

## Customer Impact

Fairly low, because it's really hard to reproduce this, even if you're doing so on purpose. However, total correctness of the Blazor renderer is a high priority for us, and we do not want any edge cases where it can fail.

In the event that the issue does occur, it would behave like an unhandled exception from application code:

 * For Blazor WebAssembly, the yellow error bar would appear, but the app would continue running
 * For Blazor Server, the current user's circuit would be terminated, but other server activity would be unaffected
 * For Blazor WebView, the unhandled exception callback would run

## Regression?

- [ ] Yes
- [x] No

[If yes, specify the version the behavior has regressed from]

## Risk

- [ ] High
- [ ] Medium
- [x] Low

Low because the code change is small enough (4 lines) to reason clearly that it only makes a difference in the case where it would have failed before. The updated boundary condition is simple to understand.

## Verification

- [x] Manual (required)
- [x] Automated

## Packaging changes reviewed?

- [ ] Yes
- [ ] No
- [x] N/A

Author: SteveSandersonMS

src/Components/Components/src/RenderTree/RenderTreeDiffBuilder.cs

@@ -429,10 +429,12 @@ private static void AppendAttributeDiffEntriesForRange(
 
         while (hasMoreOld || hasMoreNew)
         {
-            var oldSeq = hasMoreOld ? oldTree[oldStartIndex].SequenceField : int.MaxValue;
-            var newSeq = hasMoreNew ? newTree[newStartIndex].SequenceField : int.MaxValue;
-            var oldAttributeName = oldTree[oldStartIndex].AttributeNameField;
-            var newAttributeName = newTree[newStartIndex].AttributeNameField;
+            var (oldSeq, oldAttributeName) = hasMoreOld
+                ? (oldTree[oldStartIndex].SequenceField, oldTree[oldStartIndex].AttributeNameField)
+                : (int.MaxValue, null);
+            var (newSeq, newAttributeName) = hasMoreNew
+                ? (newTree[newStartIndex].SequenceField, newTree[newStartIndex].AttributeNameField)
+                : (int.MaxValue, null);
 
             if (oldSeq == newSeq &&
                 string.Equals(oldAttributeName, newAttributeName, StringComparison.Ordinal))

src/Components/Components/test/RenderTreeDiffBuilderTest.cs

@@ -2319,6 +2319,73 @@ public void RecognizesNamedEventChangingAssignedName()
             entry => AssertNamedEventChange(entry, NamedEventChangeType.Added, 123, 1, "eventname1", "changed name"));
     }
 
+    [Fact]
+    public void CanAddNewAttributeAtArrayBuilderSizeBoundary()
+    {
+        // Represents https://github.com/dotnet/aspnetcore/issues/49192
+
+        // Arrange: old and new trees go exactly up to the array builder capacity
+        oldTree.OpenElement(0, "elem");
+        for (var i = 0; oldTree.GetFrames().Count < oldTree.GetFrames().Array.Length; i++)
+        {
+            oldTree.AddAttribute(1, $"myattribute_{i}", "value");
+        }
+        newTree.OpenElement(0, "elem");
+        for (var i = 0; newTree.GetFrames().Count < newTree.GetFrames().Array.Length; i++)
+        {
+            newTree.AddAttribute(1, $"myattribute_{i}", "value");
+        }
+
+        // ... then the new tree gets one more attribute that crosses the builder size boundary, forcing buffer expansion
+        newTree.AddAttribute(1, $"myattribute_final", "value");
+
+        // Act
+        oldTree.CloseElement();
+        newTree.CloseElement();
+        var (result, referenceFrames) = GetSingleUpdatedComponent();
+
+        // Assert
+        Assert.Collection(result.Edits,
+            entry =>
+            {
+                AssertEdit(entry, RenderTreeEditType.SetAttribute, 0);
+                Assert.Equal(0, entry.ReferenceFrameIndex);
+                AssertFrame.Attribute(referenceFrames[0], "myattribute_final", "value", 1);
+            });
+    }
+
+    [Fact]
+    public void CanRemoveOldAttributeAtArrayBuilderSizeBoundary()
+    {
+        // Arrange: old and new trees go exactly up to the array builder capacity
+        oldTree.OpenElement(0, "elem");
+        for (var i = 0; oldTree.GetFrames().Count < oldTree.GetFrames().Array.Length; i++)
+        {
+            oldTree.AddAttribute(1, $"myattribute_{i}", "value");
+        }
+        newTree.OpenElement(0, "elem");
+        for (var i = 0; newTree.GetFrames().Count < newTree.GetFrames().Array.Length; i++)
+        {
+            newTree.AddAttribute(1, $"myattribute_{i}", "value");
+        }
+
+        // ... then the old tree gets one more attribute that crosses the builder size boundary, forcing buffer expansion
+        oldTree.AddAttribute(1, $"myattribute_final", "value");
+
+        // Act
+        oldTree.CloseElement();
+        newTree.CloseElement();
+        var (result, referenceFrames) = GetSingleUpdatedComponent();
+
+        // Assert
+        Assert.Collection(result.Edits,
+            entry =>
+            {
+                AssertEdit(entry, RenderTreeEditType.RemoveAttribute, 0);
+                Assert.Equal("myattribute_final", entry.RemovedAttributeName);
+            });
+    }
+
     private (RenderTreeDiff, RenderTreeFrame[]) GetSingleUpdatedComponent(bool initializeFromFrames = false)
     {
         var result = GetSingleUpdatedComponentWithBatch(initializeFromFrames);