Prevent hanging in next-single-char-property-change

* src/textprop.c (Fnext_single_char_property_change): Clarify in
the doc string the behavior when LIMIT is past the end of OBJECT.
Stop the search when position gets to end of buffer, for when LIMIT
is beyond that.  (Bug#40000)

diff --git a/src/textprop.c b/src/textprop.c
index 960dba3f8dc7f11f25a25bddabdd9cd1b0d481ac..0876badc87347d2d691ff621e32fa73b067e1a14 100644 (file)
--- a/src/textprop.c
+++ b/src/textprop.c
@@ -766,14 +766,13 @@ the current buffer), POSITION is a buffer position (integer or marker).
 If OBJECT is a string, POSITION is a 0-based index into it.
 
 In a string, scan runs to the end of the string, unless LIMIT is non-nil.
-In a buffer, if LIMIT is nil or omitted, it runs to (point-max), and the
-value cannot exceed that.
+In a buffer, scan runs to end of buffer, unless LIMIT is non-nil.
 If the optional fourth argument LIMIT is non-nil, don't search
 past position LIMIT; return LIMIT if nothing is found before LIMIT.
+However, if OBJECT is a buffer and LIMIT is beyond the end of the
+buffer, this function returns `point-max', not LIMIT.
 
-The property values are compared with `eq'.
-If the property is constant all the way to the end of OBJECT, return the
-last valid position in OBJECT.  */)
+The property values are compared with `eq'.  */)
   (Lisp_Object position, Lisp_Object prop, Lisp_Object object, Lisp_Object limit)
 {
   if (STRINGP (object))
@@ -832,6 +831,9 @@ last valid position in OBJECT.  */)
            value = Fget_char_property (position, prop, object);
            if (!EQ (value, initial_value))
              break;
+
+           if (XFIXNAT (position) >= ZV)
+             break;
          }
 
       position = unbind_to (count, position);