Fix infloop in bidi buffers with vertical cursor motion at ZV.

 bidi.c (bidi_resolve_explicit, bidi_level_of_next_char): Check
 bidi_it->bytepos against ZV_BYTE instead of bidi_it->ch against
 BIDI_EOB.

2 files changed, 6 insertions, 2 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 50e12560b91..6629a29ed9e 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,9 @@
 2010-04-03  Eli Zaretskii  <eliz@gnu.org>
 
+        * bidi.c (bidi_resolve_explicit, bidi_level_of_next_char): Check
+        bidi_it->bytepos against ZV_BYTE instead of bidi_it->ch against
+        BIDI_EOB.  Fixes infloop with vertical cursor motion at ZV.
+
         * w32fns.c (x_create_tip_frame): Copy `parms' before we modify it
         in this function.  (Bug#5703)
 
diff --git a/src/bidi.c b/src/bidi.c
index ea47cd33fec..7da8cd4a88c 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -1242,7 +1242,7 @@ bidi_resolve_explicit (struct bidi_it *bidi_it)
   if (prev_level < new_level
       && bidi_it->type == WEAK_BN
       && bidi_it->ignore_bn_limit == 0 /* only if not already known */
-      && bidi_it->ch != BIDI_EOB       /* not already at EOB */
+      && bidi_it->bytepos < ZV_BYTE    /* not already at EOB */
       && bidi_explicit_dir_char (FETCH_CHAR (bidi_it->bytepos
                                              + bidi_it->ch_len)))
     {
@@ -1648,7 +1648,7 @@ bidi_level_of_next_char (struct bidi_it *bidi_it)
   if (bidi_it->scan_dir == 1)
     {
       /* There's no sense in trying to advance if we hit end of text.  */
-      if (bidi_it->ch == BIDI_EOB)
+      if (bidi_it->bytepos >= ZV_BYTE)
         return bidi_it->resolved_level;
 
       /* Record the info about the previous character.  */