Fix LayoutTreeBuilderTraversal limit checks when recursing.

third_party/WebKit/Source/core/dom/LayoutTreeBuilderTraversal.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 232 matching lines @@
 #if DCHECK_IS_ON()
     if (hasDisplayContentsStyle(*sibling))
       DCHECK(!layoutObject);
 #endif
 
     if (!layoutObject && hasDisplayContentsStyle(*sibling)) {
       layoutObject = nextSiblingLayoutObjectInternal(
           pseudoAwareFirstChild(*sibling), limit);
       if (layoutObject)
         return layoutObject;
-      if (!limit)
+      if (limit == -1)
         return nullptr;
     }
 
     if (layoutObject && !isLayoutObjectReparented(layoutObject))
       return layoutObject;
   }
 
   return nullptr;
 }
 
 LayoutObject* LayoutTreeBuilderTraversal::nextSiblingLayoutObject(
     const Node& node,
     int32_t limit) {
   DCHECK(limit == kTraverseAllSiblings || limit >= 0) << limit;
   if (LayoutObject* sibling =
           nextSiblingLayoutObjectInternal(nextSibling(node), limit))
     return sibling;
 
   Node* parent = LayoutTreeBuilderTraversal::parent(node);
-  while (limit && parent && hasDisplayContentsStyle(*parent)) {
+  while (limit != -1 && parent && hasDisplayContentsStyle(*parent)) {
     if (LayoutObject* sibling =
             nextSiblingLayoutObjectInternal(nextSibling(*parent), limit))
       return sibling;
     parent = LayoutTreeBuilderTraversal::parent(*parent);
   }
 
   return nullptr;
 }
 
 static LayoutObject* previousSiblingLayoutObjectInternal(Node* node,
                                                          int32_t& limit) {
   for (Node* sibling = node; sibling && limit-- != 0;
        sibling = LayoutTreeBuilderTraversal::previousSibling(*sibling)) {
     LayoutObject* layoutObject = sibling->layoutObject();
 
 #if DCHECK_IS_ON()
     if (hasDisplayContentsStyle(*sibling))
       DCHECK(!layoutObject);
 #endif
 
     if (!layoutObject && hasDisplayContentsStyle(*sibling)) {
       layoutObject = previousSiblingLayoutObjectInternal(
           pseudoAwareLastChild(*sibling), limit);
       if (layoutObject)
         return layoutObject;
-      if (!limit)
+      if (limit == -1)
         return nullptr;
     }
 
     if (layoutObject && !isLayoutObjectReparented(layoutObject))
       return layoutObject;
   }
 
   return nullptr;
 }
 
 LayoutObject* LayoutTreeBuilderTraversal::previousSiblingLayoutObject(
     const Node& node,
     int32_t limit) {
   DCHECK(limit == kTraverseAllSiblings || limit >= 0) << limit;
   if (LayoutObject* sibling =
           previousSiblingLayoutObjectInternal(previousSibling(node), limit))
     return sibling;
 
   Node* parent = LayoutTreeBuilderTraversal::parent(node);
-  while (limit && parent && hasDisplayContentsStyle(*parent)) {
+  while (limit != -1 && parent && hasDisplayContentsStyle(*parent)) {
     if (LayoutObject* sibling = previousSiblingLayoutObjectInternal(
             previousSibling(*parent), limit))
       return sibling;
     parent = LayoutTreeBuilderTraversal::parent(*parent);
   }
 
   return nullptr;
 }
 
 LayoutObject* LayoutTreeBuilderTraversal::nextInTopLayer(
     const Element& element) {
   if (!element.isInTopLayer())
     return 0;
   const HeapVector<Member<Element>>& topLayerElements =
       element.document().topLayerElements();
   size_t position = topLayerElements.find(&element);
   DCHECK_NE(position, kNotFound);
   for (size_t i = position + 1; i < topLayerElements.size(); ++i) {
     if (LayoutObject* layoutObject = topLayerElements[i]->layoutObject())
       return layoutObject;
   }
   return 0;
 }
 
 }  // namespace blink