Avoid endless loop when computing line boundaries in contentEditable.

third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp

 /*
 * Copyright (C) 2008 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 2147 matching lines @@
 
     VisiblePosition visiblePos = visiblePositionForIndex(0);
     VisiblePosition prevVisiblePos = visiblePos;
     visiblePos = nextLinePosition(visiblePos, 0, HasEditableAXRole);
     // nextLinePosition moves to the end of the current line when there are
     // no more lines.
     while (visiblePos.isNotNull() && !inSameLine(prevVisiblePos, visiblePos)) {
         lineBreaks.append(indexForVisiblePosition(visiblePos));
         prevVisiblePos = visiblePos;
         visiblePos = nextLinePosition(visiblePos, 0, HasEditableAXRole);
+
+        // Make sure we always make forward progress.
+        if (visiblePos.deepEquivalent().compareTo(prevVisiblePos.deepEquivalent()) < 0)
+            break;
     }
 }
 
 //
 // Private.
 //
 
 AXObject* AXLayoutObject::treeAncestorDisallowingChild() const
 {
     // Determine if this is in a tree. If so, we apply special behavior to make it work like an AXOutline.
@@ skipping 349 matching lines @@
         if (label && label->layoutObject()) {
             LayoutRect labelRect = axObjectCache().getOrCreate(label)->elementRect();
             result.unite(labelRect);
         }
     }
 
     return result;
 }
 
 } // namespace blink