Fix bug #11653 with a crash when more than 16 overlay strings are loaded.

 src/xdisp.c (handle_face_prop): Use chunk-relative overlay string index when
 indexing into it->string_overlays array.

2 files changed, 7 insertions, 3 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 3138bea28fa..3f73b1ad702 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -3,7 +3,9 @@
         * xdisp.c (set_cursor_from_row): Don't dereference glyphs_end.  If
         all the glyphs of the glyph row came from strings, and we have no
         cursor positioning clues, put the cursor on the first glyph of the
-        row.  (Bug#11653)
+        row.
+        (handle_face_prop): Use chunk-relative overlay string index when
+        indexing into it->string_overlays array.  (Bug#11653)
 
 2012-06-16  Andreas Schwab  <schwab@linux-m68k.org>
 
diff --git a/src/xdisp.c b/src/xdisp.c
index e09116fe0ca..aa130c5d50a 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -3691,7 +3691,8 @@ handle_face_prop (struct it *it)
       int i;
       Lisp_Object from_overlay
         = (it->current.overlay_string_index >= 0
-           ? it->string_overlays[it->current.overlay_string_index]
+           ? it->string_overlays[it->current.overlay_string_index
+                                 % OVERLAY_STRING_CHUNK_SIZE]
            : Qnil);
 
       /* See if we got to this string directly or indirectly from
@@ -3705,7 +3706,8 @@ handle_face_prop (struct it *it)
           {
             if (it->stack[i].current.overlay_string_index >= 0)
               from_overlay
-                = it->string_overlays[it->stack[i].current.overlay_string_index];
+                = it->string_overlays[it->stack[i].current.overlay_string_index
+                                      % OVERLAY_STRING_CHUNK_SIZE];
             else if (! NILP (it->stack[i].from_overlay))
               from_overlay = it->stack[i].from_overlay;