Index: Source/platform/text/BidiResolver.h |
diff --git a/Source/platform/text/BidiResolver.h b/Source/platform/text/BidiResolver.h |
index 356f89488517ce6c997c074e375deb1df0867f32..9c83f72d0c86b323e9b0424dd388e1179f41b7df 100644 |
--- a/Source/platform/text/BidiResolver.h |
+++ b/Source/platform/text/BidiResolver.h |
@@ -336,8 +336,20 @@ void BidiResolver<Iterator, Run>::appendRun(BidiRunList<Run>& runs) |
endOffset = m_endOfRunAtEndOfLine.offset(); |
} |
- if (endOffset >= startOffset) |
- runs.addRun(new Run(startOffset, endOffset + 1, context(), m_direction)); |
+ // m_eor and m_endOfRunAtEndOfLine are inclusive while BidiRun's stop is |
+ // exclusive so offset needs to be increased by one. |
+ endOffset += 1; |
+ |
+ // Append BidiRun objects, at most 64K chars at a time, until all |
+ // text between |startOffset| and |endOffset| is represented. |
+ while (startOffset < endOffset) { |
+ unsigned end = endOffset; |
+ const int limit = USHRT_MAX; // InlineTextBox stores text length as unsigned short. |
+ if (end - startOffset > limit) |
+ end = startOffset + limit; |
+ runs.addRun(new Run(startOffset, end, context(), m_direction)); |
+ startOffset = end; |
+ } |
m_eor.increment(); |
m_sor = m_eor; |