Preflight crash fix for bug 9796....

third_party/WebKit/WebCore/platform/graphics/chromium/FontChromiumWin.cpp

 /*
  * Copyright (C) 2006, 2007 Apple Computer, Inc.
  * Copyright (c) 2006, 2007, 2008, 2009, Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  * 
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 305 matching lines @@
     // This case really really sucks. There is no convenient way to estimate
     // the bounding box. So we run Uniscribe twice. If we find this happens a
     // lot, the way to fix it is to make the extra layer after the
     // UniscribeHelper has measured the text.
     IntPoint intPoint(lroundf(m_point.x()),
                       lroundf(m_point.y()));
 
     UniscribeHelperTextRun state(m_run, *m_font);
     int left = lroundf(m_point.x()) + state.characterToX(m_from);
     int right = lroundf(m_point.x()) + state.characterToX(m_to);
+    
+    // Adjust for RTL script since we just want to know the text bounds.
+    if (left > right)
+        std::swap(left, right);
 
     // This algorithm for estimating how much extra space we need (the text may
     // go outside the selection rect) is based roughly on
     // TransparencyAwareGlyphPainter::estimateTextBounds above.
     return IntRect(left - (m_font->ascent() + m_font->descent()) / 2,
                    m_point.y() - m_font->ascent() - m_font->lineGap(),
                    (right - left) + m_font->ascent() + m_font->descent(),
                    m_font->lineSpacing());
 }
 
@@ skipping 135 matching lines @@
     int charIndex = state.xToCharacter(x);
 
     // XToCharacter will return -1 if the position is before the first
     // character (we get called like this sometimes).
     if (charIndex < 0)
         charIndex = 0;
     return charIndex;
 }
 
 } // namespace WebCore