The problem was not actually introduced in r222090, but revelaed by that change. The bug was added in r222086, when adding the support for shaping a range of characters. We are not correctly filtering the characters in case of rtl in some cases.
Created attachment 321002 [details] Patch
Committed r222132: <http://trac.webkit.org/changeset/222132>
<rdar://problem/34693370>