Fix nested 'unicode-bidi: isolate' can cause infinite loop

Source/core/layout/BidiRunForLine.cpp

Index: Source/core/layout/BidiRunForLine.cpp
diff --git a/Source/core/layout/BidiRunForLine.cpp b/Source/core/layout/BidiRunForLine.cpp
index 9944f663c43c817410c7e32f0ed5392b0e0d2687..8369f8514066bb661c24332127c516cd12c8c8cd 100644
--- a/Source/core/layout/BidiRunForLine.cpp
+++ b/Source/core/layout/BidiRunForLine.cpp
@@ -140,8 +140,22 @@ void constructBidiRunsForLine(InlineBidiResolver& topResolver,
     LayoutObject* currentRoot = topResolver.position().root();
     topResolver.createBidiRunsForLine(endOfLine, override,
         previousLineBrokeCleanly);
+    struct BidiRunsWithRoot {
+        LayoutObject* root;

[eae, 2015/09/04 18:31:56]

Could you mark this const?

+        Vector<BidiRun*> isolatedRuns;
+    };
+    Vector<BidiRunsWithRoot> isolatedRunsStack;
+
+    while (true) {
+        if (topResolver.isolatedRuns().isEmpty()) {
+            if (isolatedRunsStack.isEmpty())
+                break;
+            topResolver.isolatedRuns().appendVector(isolatedRunsStack.last().isolatedRuns);
+            ASSERT(!topResolver.isolatedRuns().isEmpty());
+            currentRoot = isolatedRunsStack.last().root;
+            isolatedRunsStack.removeLast();
+        }
 
-    while (!topResolver.isolatedRuns().isEmpty()) {
         // It does not matter which order we resolve the runs as long as we
         // resolve them all.
         BidiRun* isolatedRun = topResolver.isolatedRuns().last();
@@ -199,12 +213,13 @@ void constructBidiRunsForLine(InlineBidiResolver& topResolver,
         if (isolatedResolver.runs().runCount())
             bidiRuns.replaceRunWithRuns(isolatedRun, isolatedResolver.runs());
 
-        // If we encountered any nested isolate runs, just move them
-        // to the top resolver's list for later processing.
+        // If we encountered any nested isolate runs, save them for later
+        // processing.
         if (!isolatedResolver.isolatedRuns().isEmpty()) {
-            topResolver.isolatedRuns().appendVector(
+            isolatedRunsStack.resize(isolatedRunsStack.size() + 1);
+            isolatedRunsStack.last().isolatedRuns.appendVector(
                 isolatedResolver.isolatedRuns());
-            currentRoot = isolatedInline;
+            isolatedRunsStack.last().root = isolatedInline;
             restoreIsolatedMidpointStates(topResolver, isolatedResolver);
         }
     }