Fix loop condition in BidiRunList::replaceRunWithRuns

Source/platform/text/BidiRunList.h

 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2003, 2004, 2006, 2007, 2008 Apple Inc.  All right reserved.
  * Copyright (C) 2011 Google, Inc.  All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 135 matching lines @@
 {
     ASSERT(newRuns.runCount());
     ASSERT(m_firstRun);
     ASSERT(toReplace);
 
     if (m_firstRun == toReplace) {
         m_firstRun = newRuns.firstRun();
     } else {
         // Find the run just before "toReplace" in the list of runs.
         Run* previousRun = m_firstRun;
-        while (previousRun->next() != toReplace)
+        while (previousRun->next() && previousRun->next() != toReplace)
             previousRun = previousRun->next();
         ASSERT(previousRun);
         previousRun->setNext(newRuns.firstRun());
     }
 
     newRuns.lastRun()->setNext(toReplace->next());
 
     // Fix up any of other pointers which may now be stale.
     if (m_lastRun == toReplace)
         m_lastRun = newRuns.lastRun();
@@ skipping 77 matching lines @@
         m_firstRun = endRun;
 
     startRun->m_next = afterEnd;
     if (!afterEnd)
         m_lastRun = startRun;
 }
 
 } // namespace blink
 
 #endif // BidiRunList