Fix bug #9254 with crash and cursor positioning under longlines-mode.

 src/xdisp.c (set_cursor_from_row): Fix cursor positioning when a
 display property strides EOL and includes a newline, as in
 longlines-mode.
 src/bidi.c (bidi_unshelve_cache): Don't reset the cache if JUST_FREE
 is non-zero, even if the data buffer is NULL.  Fixes a crash in
 vertical-motion with longlines-mode.

3 files changed, 46 insertions, 9 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 60c835cb100..efe542e37d0 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,13 @@
+2011-08-06  Eli Zaretskii  <eliz@gnu.org>
+
+	* xdisp.c (set_cursor_from_row): Fix cursor positioning when a
+	display property strides EOL and includes a newline, as in
+	longlines-mode.  (Bug#9254)
+
+	* bidi.c (bidi_unshelve_cache): Don't reset the cache if JUST_FREE
+	is non-zero, even if the data buffer is NULL.  Fixes a crash in
+	vertical-motion with longlines-mode.  (Bug#9254)
+
 2011-08-05  Eli Zaretskii  <eliz@gnu.org>
 
 	* bidi.c <bidi_cache_total_alloc>: Now static.
diff --git a/src/bidi.c b/src/bidi.c
index 0db144bea6c..2879198ce31 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -666,7 +666,11 @@ bidi_shelve_cache (void)
   return databuf;
 }
 
-/* Restore the cache state from a copy stashed away by bidi_shelve_cache.  */
+/* Restore the cache state from a copy stashed away by
+   bidi_shelve_cache, and free the buffer used to stash that copy.
+   JUST_FREE non-zero means free the buffer, but don't restore the
+   cache; used when the corresponding iterator is discarded instead of
+   being restored.  */
 void
 bidi_unshelve_cache (void *databuf, int just_free)
 {
@@ -674,10 +678,13 @@ bidi_unshelve_cache (void *databuf, int just_free)
 
   if (!p)
     {
-      /* A NULL pointer means an empty cache.  */
-      bidi_cache_start = 0;
-      bidi_cache_sp = 0;
-      bidi_cache_reset ();
+      if (!just_free)
+	{
+	  /* A NULL pointer means an empty cache.  */
+	  bidi_cache_start = 0;
+	  bidi_cache_sp = 0;
+	  bidi_cache_reset ();
+	}
     }
   else
     {
diff --git a/src/xdisp.c b/src/xdisp.c
index 69baea95b9c..9c281c6736b 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -13285,6 +13285,9 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
   /* Last buffer position covered by an overlay string with an integer
      `cursor' property.  */
   EMACS_INT bpos_covered = 0;
+  /* Non-zero means the display string on which to display the cursor
+     comes from a text property, not from an overlay.  */
+  int string_from_text_prop = 0;
 
   /* Skip over glyphs not having an object at the start and the end of
      the row.  These are special glyphs like truncation marks on
@@ -13603,9 +13606,14 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
 		{
 		  Lisp_Object str;
 		  EMACS_INT tem;
+		  /* If the display property covers the newline, we
+		     need to search for it one position farther.  */
+		  EMACS_INT lim = pos_after
+		    + (pos_after == MATRIX_ROW_END_CHARPOS (row) + delta);
 
+		  string_from_text_prop = 0;
 		  str = glyph->object;
-		  tem = string_buffer_position_lim (str, pos, pos_after, 0);
+		  tem = string_buffer_position_lim (str, pos, lim, 0);
 		  if (tem == 0	/* from overlay */
 		      || pos <= tem)
 		    {
@@ -13629,7 +13637,10 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
 			  EMACS_INT strpos = glyph->charpos;
 
 			  if (tem)
-			    cursor = glyph;
+			    {
+			      cursor = glyph;
+			      string_from_text_prop = 1;
+			    }
 			  for ( ;
 			       (row->reversed_p ? glyph > stop : glyph < stop)
 				 && EQ (glyph->object, str);
@@ -13730,8 +13741,17 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
 	      /* previous candidate is a glyph from a string that has
 		 a non-nil `cursor' property */
 	      || (STRINGP (g1->object)
-		  && !NILP (Fget_char_property (make_number (g1->charpos),
-						Qcursor, g1->object)))))
+		  && (!NILP (Fget_char_property (make_number (g1->charpos),
+						Qcursor, g1->object))
+		      /* pevious candidate is from the same display
+			 string as this one, and the display string
+			 came from a text property */
+		      || (EQ (g1->object, glyph->object)
+			  && string_from_text_prop)
+		      /* this candidate is from newline and its
+			 position is not an exact match */
+		      || (INTEGERP (glyph->object)
+			  && glyph->charpos != pt_old)))))
 	return 0;
       /* If this candidate gives an exact match, use that.  */
       if (!(BUFFERP (glyph->object) && glyph->charpos == pt_old)