Fix nested 'unicode-bidi: isolate' can cause infinite loop

Source/core/layout/BidiRunForLine.cpp

 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2003, 2004, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc.
  * All right reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 122 matching lines @@
     VisualDirectionOverride override, bool previousLineBrokeCleanly,
     bool isNewUBAParagraph)
 {
     // FIXME: We should pass a BidiRunList into createBidiRunsForLine instead
     // of the resolver owning the runs.
     ASSERT(&topResolver.runs() == &bidiRuns);
     ASSERT(topResolver.position() != endOfLine);
     LayoutObject* currentRoot = topResolver.position().root();
     topResolver.createBidiRunsForLine(endOfLine, override,
         previousLineBrokeCleanly);
+    struct BidiRunsWithRoot {
+        LayoutObject* root;

[eae, 2015/09/04 18:31:56]

Could you mark this const?

+        Vector<BidiRun*> isolatedRuns;
+    };
+    Vector<BidiRunsWithRoot> isolatedRunsStack;
 
-    while (!topResolver.isolatedRuns().isEmpty()) {
+    while (true) {
+        if (topResolver.isolatedRuns().isEmpty()) {
+            if (isolatedRunsStack.isEmpty())
+                break;
+            topResolver.isolatedRuns().appendVector(isolatedRunsStack.last().isolatedRuns);
+            ASSERT(!topResolver.isolatedRuns().isEmpty());
+            currentRoot = isolatedRunsStack.last().root;
+            isolatedRunsStack.removeLast();
+        }
+
         // It does not matter which order we resolve the runs as long as we
         // resolve them all.
         BidiRun* isolatedRun = topResolver.isolatedRuns().last();
         topResolver.isolatedRuns().removeLast();
 
         LayoutObject* startObj = isolatedRun->object();
 
         // Only inlines make sense with unicode-bidi: isolate (blocks are
         // already isolated).
         // FIXME: Because enterIsolate is not passed a LayoutObject, we have to
@@ skipping 37 matching lines @@
         // FIXME: What should end and previousLineBrokeCleanly be?
         // rniwa says previousLineBrokeCleanly is just a WinIE hack and could
         // always be false here?
         isolatedResolver.createBidiRunsForLine(endOfLine, NoVisualOverride,
             previousLineBrokeCleanly);
 
         ASSERT(isolatedResolver.runs().runCount());
         if (isolatedResolver.runs().runCount())
             bidiRuns.replaceRunWithRuns(isolatedRun, isolatedResolver.runs());
 
-        // If we encountered any nested isolate runs, just move them
-        // to the top resolver's list for later processing.
+        // If we encountered any nested isolate runs, save them for later
+        // processing.
         if (!isolatedResolver.isolatedRuns().isEmpty()) {
-            topResolver.isolatedRuns().appendVector(
+            isolatedRunsStack.resize(isolatedRunsStack.size() + 1);
+            isolatedRunsStack.last().isolatedRuns.appendVector(
                 isolatedResolver.isolatedRuns());
-            currentRoot = isolatedInline;
+            isolatedRunsStack.last().root = isolatedInline;
             restoreIsolatedMidpointStates(topResolver, isolatedResolver);
         }
     }
 }
 
 } // namespace blink
 
 #endif // BidiRunForLine_h