Fix ShapeResult::offsetForPosition for RTL scripts

Source/platform/fonts/shaping/HarfBuzzShaper.cpp

 /*
  * Copyright (c) 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013 BlackBerry Limited. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 434 matching lines @@
         return FloatRect(point.x() + fromX, point.y(), toX - fromX, height);
     return FloatRect(point.x() + toX, point.y(), fromX - toX, height);
 }
 
 int ShapeResult::offsetForPosition(Vector<RefPtr<ShapeResult>>& results,
     const TextRun& run, float targetX)
 {
     unsigned totalOffset;
     if (run.rtl()) {
         totalOffset = run.length();
-        for (auto& wordResult : results) {
+        for (unsigned i = results.size(); i; --i) {
+            const RefPtr<ShapeResult>& wordResult = results[i - 1];
             if (!wordResult)
                 continue;
             totalOffset -= wordResult->numCharacters();
             if (targetX >= 0 && targetX <= wordResult->width()) {
                 int offsetForWord = wordResult->offsetForPosition(targetX);
                 return totalOffset + offsetForWord;
             }
             targetX -= wordResult->width();
         }
     } else {
@@ skipping 748 matching lines @@
             return spacing;
     }
 
     // Don't need to check m_textRun.allowsTrailingExpansion() since it's covered by !m_expansionOpportunityCount above
     spacing += nextExpansionPerOpportunity();
     m_isAfterExpansion = true;
     return spacing;
 }
 
 } // namespace blink