Fix bug #9624 with crashes in Muse mode.

 src/xdisp.c (compute_display_string_end): If there's no display
 string at CHARPOS, return -1.
 src/bidi.c (bidi_fetch_char): When compute_display_string_end
 returns a negative value, treat the character as a normal
 character not covered by a display string.

1 files changed, 10 insertions, 0 deletions

diff --git a/src/bidi.c b/src/bidi.c
index 599c00449b5..e3fc03f4a9b 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -974,6 +974,15 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
           ch = 0xFFFC;
         }
       disp_end_pos = compute_display_string_end (*disp_pos, string);
+      if (disp_end_pos < 0)
+        {
+          /* Somebody removed the display string from the buffer
+             behind our back.  Recover by processing this buffer
+             position as if no display property were present there to
+             begin with.  */
+          *disp_prop = 0;
+          goto normal_char;
+        }
       *nchars = disp_end_pos - *disp_pos;
       if (*nchars <= 0)
         abort ();
@@ -988,6 +997,7 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
     }
   else
     {
+    normal_char:
       if (string->s)
         {
           int len;