Summary: In the rare case that CG gets to draw an RTL run, it applies order-swapping to all but the last glyph in the run. To reproduce: make sure "Use ATSUI For All Text" is off and open the testcase. Expected: to see ?!* on the second line. (To get expected behavior, switch on Use ATSUI and reload, or open in Firefox). Actual: see !*? on the second line. Analysis: the order-swapping loops in _CG_drawRun:style:geometry start with the next-to-last glyph instead of the last one, so the last glyph doesn't move to the beginning as it should.
Created attachment 2499 [details] testcase
Created attachment 2500 [details] Proposed fix Just changed (actually restored) the initial value of end in those three loops.
Comment on attachment 2500 [details] Proposed fix r=me