Fix nested 'unicode-bidi: isolate' can cause infinite loop

Source/core/layout/BidiRunForLine.cpp

 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2003, 2004, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc.
  * All right reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 119 matching lines @@
 
 void constructBidiRunsForLine(InlineBidiResolver& topResolver,
     BidiRunList<BidiRun>& bidiRuns, const InlineIterator& endOfLine,
     VisualDirectionOverride override, bool previousLineBrokeCleanly,
     bool isNewUBAParagraph)
 {
     // FIXME: We should pass a BidiRunList into createBidiRunsForLine instead
     // of the resolver owning the runs.
     ASSERT(&topResolver.runs() == &bidiRuns);
     ASSERT(topResolver.position() != endOfLine);
-    LayoutObject* currentRoot = topResolver.position().root();
+    const LayoutObject* currentRoot = topResolver.position().root();
     topResolver.createBidiRunsForLine(endOfLine, override,
         previousLineBrokeCleanly);
+    struct BidiRunsWithRoot {
+        const LayoutObject* root;
+        Vector<BidiRun*> isolatedRuns;
+    };
+    Vector<BidiRunsWithRoot> isolatedRunsStack;
 
-    while (!topResolver.isolatedRuns().isEmpty()) {
+    while (true) {
+        if (topResolver.isolatedRuns().isEmpty()) {
+            if (isolatedRunsStack.isEmpty())
+                break;
+            topResolver.isolatedRuns().appendVector(isolatedRunsStack.last().isolatedRuns);
+            ASSERT(!topResolver.isolatedRuns().isEmpty());
+            currentRoot = isolatedRunsStack.last().root;
+            isolatedRunsStack.removeLast();
+        }
+
         // It does not matter which order we resolve the runs as long as we
         // resolve them all.
         BidiRun* isolatedRun = topResolver.isolatedRuns().last();
         topResolver.isolatedRuns().removeLast();
 
         LayoutObject* startObj = isolatedRun->object();
 
         // Only inlines make sense with unicode-bidi: isolate (blocks are
         // already isolated).
         // FIXME: Because enterIsolate is not passed a LayoutObject, we have to
         // crawl up the tree to see which parent inline is the isolate. We could
         // change enterIsolate to take a LayoutObject and do this logic there,
         // but that would be a layering violation for BidiResolver (which knows
         // nothing about LayoutObject).
         LayoutInline* isolatedInline = toLayoutInline(
-            highestContainingIsolateWithinRoot(LineLayoutItem(startObj), LineLayoutItem(currentRoot)));
+            highestContainingIsolateWithinRoot(LineLayoutItem(startObj),
+                LineLayoutItem(const_cast<LayoutObject*>(currentRoot))));
         ASSERT(isolatedInline);
 
         InlineBidiResolver isolatedResolver;
         LineMidpointState& isolatedLineMidpointState =
             isolatedResolver.midpointState();
         isolatedLineMidpointState = topResolver.midpointStateForIsolatedRun(
             isolatedRun);
         EUnicodeBidi unicodeBidi = isolatedInline->style()->unicodeBidi();
         TextDirection direction;
         if (unicodeBidi == Plaintext) {
@@ skipping 21 matching lines @@
         // FIXME: What should end and previousLineBrokeCleanly be?
         // rniwa says previousLineBrokeCleanly is just a WinIE hack and could
         // always be false here?
         isolatedResolver.createBidiRunsForLine(endOfLine, NoVisualOverride,
             previousLineBrokeCleanly);
 
         ASSERT(isolatedResolver.runs().runCount());
         if (isolatedResolver.runs().runCount())
             bidiRuns.replaceRunWithRuns(isolatedRun, isolatedResolver.runs());
 
-        // If we encountered any nested isolate runs, just move them
-        // to the top resolver's list for later processing.
+        // If we encountered any nested isolate runs, save them for later
+        // processing.
         if (!isolatedResolver.isolatedRuns().isEmpty()) {
-            topResolver.isolatedRuns().appendVector(
+            isolatedRunsStack.resize(isolatedRunsStack.size() + 1);
+            isolatedRunsStack.last().isolatedRuns.appendVector(
                 isolatedResolver.isolatedRuns());
-            currentRoot = isolatedInline;
+            isolatedRunsStack.last().root = isolatedInline;
             restoreIsolatedMidpointStates(topResolver, isolatedResolver);
         }
     }
 }
 
 } // namespace blink
 
 #endif // BidiRunForLine_h