From: Eli Zaretskii <eliz@gnu.org>
Date: Mon, 11 Feb 2013 17:27:48 +0000 (+0200)
Subject: Fix rare aborts in bidi.c.
X-Git-Tag: emacs-24.3-rc1~72
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=713bfeaab314f4ae943a19205d7db71cb3e70745;p=emacs.git

Fix rare aborts in bidi.c.

 src/bidi.c (bidi_resolve_neutral): After finding the next
 non-neutral character, accept NEUTRAL_ON type as well, because
 directional control characters, such as LRE and RLE, have their
 type converted to that by bidi_resolve_weak.  This avoids aborts
 when LRE/RLE follows a run of neutrals.
 (bidi_move_to_visually_next): Assert that return value of
 bidi_peek_at_next_level is non-negative.  Negative values will
 cause an infloop.
---

diff --git a/src/ChangeLog b/src/ChangeLog
index e33d2fa5870..b5a1e0d5cb5 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,14 @@
+2013-02-11  Eli Zaretskii  <eliz@gnu.org>
+
+	* bidi.c (bidi_resolve_neutral): After finding the next
+	non-neutral character, accept NEUTRAL_ON type as well, because
+	directional control characters, such as LRE and RLE, have their
+	type converted to that by bidi_resolve_weak.  This avoids aborts
+	when LRE/RLE follows a run of neutrals.
+	(bidi_move_to_visually_next): Assert that return value of
+	bidi_peek_at_next_level is non-negative.  Negative values will
+	cause an infloop.
+
 2013-02-05  Daniel Colascione  <dancol@dancol.org>
 
 	* emacs.c: Use execvp, not execv, when DAEMON_MUST_EXEC, so that
diff --git a/src/bidi.c b/src/bidi.c
index b067c8134e3..db2e48a2ca7 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -1973,6 +1973,7 @@ bidi_resolve_neutral (struct bidi_it *bidi_it)
 		next_type = STRONG_R;
 		break;
 	      case WEAK_BN:
+	      case NEUTRAL_ON:	/* W6/Retaining */
 		if (!bidi_explicit_dir_char (bidi_it->ch))
 		  emacs_abort (); /* can't happen: BNs are skipped */
 		/* FALLTHROUGH */
@@ -2391,6 +2392,10 @@ bidi_move_to_visually_next (struct bidi_it *bidi_it)
       next_level = bidi_peek_at_next_level (bidi_it);
       while (next_level != expected_next_level)
 	{
+	  /* If next_level is -1, it means we have an unresolved level
+	     in the cache, which at this point should not happen.  If
+	     it does, we will infloop.  */
+	  eassert (next_level >= 0);
 	  expected_next_level += incr;
 	  level_to_search += incr;
 	  bidi_find_other_level_edge (bidi_it, level_to_search, !ascending);