Created attachment 77021 [details] demo This is a variant of the bug 49111. Open the attachment and WebKit hangs inside VisiblePosition::rightVisuallyDistinctCandidate: box = nextBox; renderer = box->renderer(); offset = box->caretLeftmostOffset(); if (box->bidiLevel() > level) { do { nextBox = box->nextLeafChild(); } while (nextBox && nextBox->bidiLevel() > level); // we get stuck in this while loop. if (!nextBox || nextBox->bidiLevel() < level) continue; }
Created attachment 77076 [details] patch w/ layout test
Committed r74385: <http://trac.webkit.org/changeset/74385>