Prevent infinite loop about itemizing text in RenderTextHarfBuzz.

ui/gfx/render_text_harfbuzz.cc

Index: ui/gfx/render_text_harfbuzz.cc
diff --git a/ui/gfx/render_text_harfbuzz.cc b/ui/gfx/render_text_harfbuzz.cc
index a2610f3787288305adb7f9d3c7b07044d8391511..d6c26c0ab1446b53ec9d6afb7322b76cc39b7d37 100644
--- a/ui/gfx/render_text_harfbuzz.cc
+++ b/ui/gfx/render_text_harfbuzz.cc
@@ -1165,6 +1165,7 @@ void RenderTextHarfBuzz::ItemizeTextToRuns(
     run->underline = style.style(UNDERLINE);
     int32 script_item_break = 0;
     bidi_iterator.GetLogicalRun(run_break, &script_item_break, &run->level);
+
     // Odd BiDi embedding levels correspond to RTL runs.
     run->is_rtl = (run->level % 2) == 1;
     // Find the length and script of this script run.
@@ -1183,6 +1184,9 @@ void RenderTextHarfBuzz::ItemizeTextToRuns(
     if (run_break > run->range.start())
       run_break = FindRunBreakingCharacter(text, run->range.start(), run_break);
 
+    if (run_break <= run->range.start())

[msw, 2015/03/18 16:21:36]

Why does this ever happen? Can we fix the actual defect, presumably with line
1178: TextIndexToGivenTextIndex(text, style.GetRange().end())?

[Jun Mukai, 2015/03/23 23:14:06]

It's still unclear why it happens on the reported environment.
For the new test case I've added, this could happen because |text| is different
from |this->text()|. In the test case, render_text is obscured. Therefore,
|text| is like "**" while this->text() holds 3 code points (1 surrogate pair + 1
character), and TextIndexToGivenTextIndex("**", 2) returns to 1.

This happens because of a confusion; the style ranges are usually specified to
this->text(), but the style's max is capped by text.length(), which is shorter
than this->text().

That said, I can fix this by changing the max of style, uploaded the patchset 3.


However, I don't think this is the case we're seeing in the bug reports, this
would happen only on obscured render text. I can't think of other cases which
run_break cannot proceed, but the crash indicates sometimes it goes into such
case.

+      run_break = std::max(script_item_break, run_break + 1);
+
     DCHECK(IsValidCodePointIndex(text, run_break));
     style.UpdatePosition(DisplayIndexToTextIndex(run_break));
     run->range.set_end(run_break);