Fix bug #15064 with assertion violation due to mouse face.

 src/xdisp.c (draw_glyphs): Don't compare row pointers, compare row
 vertical positions instead.  This avoids calling MATRIX_ROW with
 row numbers that are possibly beyond valid limits.

2 files changed, 11 insertions, 7 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index bd8aae80d5d..642b6b32231 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2013-08-09  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (draw_glyphs): Don't compare row pointers, compare row
+        vertical positions instead.  This avoids calling MATRIX_ROW with
+        row numbers that are possibly beyond valid limits.  (Bug#15064)
+
 2013-08-09  Dmitry Antipov  <dmantipov@yandex.ru>
 
         Use xstrdup and build_unibyte_string where applicable.
diff --git a/src/xdisp.c b/src/xdisp.c
index aee24e27d52..35abf71e5bf 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -23826,17 +23826,15 @@ draw_glyphs (struct window *w, int x, struct glyph_row *row,
           && hlinfo->mouse_face_beg_row >= 0
           && hlinfo->mouse_face_end_row >= 0)
         {
-          struct glyph_row *mouse_beg_row, *mouse_end_row;
+          ptrdiff_t row_vpos = MATRIX_ROW_VPOS (row, w->current_matrix);
 
-          mouse_beg_row = MATRIX_ROW (w->current_matrix, hlinfo->mouse_face_beg_row);
-          mouse_end_row = MATRIX_ROW (w->current_matrix, hlinfo->mouse_face_end_row);
-
-          if (row >= mouse_beg_row && row <= mouse_end_row)
+          if (row_vpos >= hlinfo->mouse_face_beg_row
+              && row_vpos <= hlinfo->mouse_face_end_row)
             {
               check_mouse_face = 1;
-              mouse_beg_col = (row == mouse_beg_row)
+              mouse_beg_col = (row_vpos == hlinfo->mouse_face_beg_row)
                 ? hlinfo->mouse_face_beg_col : 0;
-              mouse_end_col = (row == mouse_end_row)
+              mouse_end_col = (row_vpos == hlinfo->mouse_face_end_row)
                 ? hlinfo->mouse_face_end_col
                 : row->used[TEXT_AREA];
             }