* composite.c (fill_gstring_header): Pass positions as C integers

and move parameters checking to...
* composite.c (Fcomposition_get_gstring): ...this function.  Handle
case when buffer positions are in reversed order and avoid crash
(Bug#16739).  Adjust docstring.
* buffer.c (validate_region): Mention current buffer in error message.

3 files changed, 41 insertions, 34 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index a8bc522939c..5ea85516c71 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,12 @@
+2014-02-13  Dmitry Antipov  <dmantipov@yandex.ru>
+
+        * composite.c (fill_gstring_header): Pass positions as C integers
+        and move parameters checking to...
+        * composite.c (Fcomposition_get_gstring): ...this function.  Handle
+        case when buffer positions are in reversed order and avoid crash
+        (Bug#16739).  Adjust docstring.
+        * buffer.c (validate_region): Mention current buffer in error message.
+
 2014-02-12  Marcus Karlsson  <mk@acc.umu.se>  (tiny change)
 
         * image.c (pbm_load): Set to NO_PIXMAP on error (Bug#16683).
diff --git a/src/buffer.c b/src/buffer.c
index 42c4c1306a9..90c15420d1d 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -2261,7 +2261,7 @@ validate_region (register Lisp_Object *b, register Lisp_Object *e)
     }
 
   if (! (BEGV <= XINT (*b) && XINT (*e) <= ZV))
-    args_out_of_range (*b, *e);
+    args_out_of_range_3 (Fcurrent_buffer (), *b, *e);
 }
 
 /* Advance BYTE_POS up to a character boundary
diff --git a/src/composite.c b/src/composite.c
index 04cfe5efee0..fa882141908 100644
--- a/src/composite.c
+++ b/src/composite.c
@@ -780,35 +780,11 @@ static Lisp_Object gstring_work;
 static Lisp_Object gstring_work_headers;
 
 static Lisp_Object
-fill_gstring_header (Lisp_Object header, Lisp_Object start, Lisp_Object end,
-                     Lisp_Object font_object, Lisp_Object string)
+fill_gstring_header (Lisp_Object header, ptrdiff_t from, ptrdiff_t from_byte,
+                     ptrdiff_t to, Lisp_Object font_object, Lisp_Object string)
 {
-  ptrdiff_t from, to, from_byte;
-  ptrdiff_t len, i;
+  ptrdiff_t len = to - from, i;
 
-  if (NILP (string))
-    {
-      if (NILP (BVAR (current_buffer, enable_multibyte_characters)))
-        error ("Attempt to shape unibyte text");
-      validate_region (&start, &end);
-      from = XFASTINT (start);
-      to = XFASTINT (end);
-      from_byte = CHAR_TO_BYTE (from);
-    }
-  else
-    {
-      CHECK_STRING (string);
-      if (! STRING_MULTIBYTE (string))
-        error ("Attempt to shape unibyte text");
-      /* The caller checks that START and END are nonnegative integers.  */
-      if (! (XINT (start) <= XINT (end) && XINT (end) <= SCHARS (string)))
-        args_out_of_range_3 (string, start, end);
-      from = XINT (start);
-      to = XINT (end);
-      from_byte = string_char_to_byte (string, from);
-    }
-
-  len = to - from;
   if (len == 0)
     error ("Attempt to shape zero-length text");
   if (VECTORP (header))
@@ -1708,6 +1684,8 @@ frame, or nil for the selected frame's terminal device.
 
 If the optional 4th argument STRING is not nil, it is a string
 containing the target characters between indices FROM and TO.
+Otherwise FROM and TO are character positions in current buffer;
+they can be in either order, and can be integers or markers.
 
 A glyph-string is a vector containing information about how to display
 a specific character sequence.  The format is:
@@ -1739,10 +1717,8 @@ should be ignored.  */)
   (Lisp_Object from, Lisp_Object to, Lisp_Object font_object, Lisp_Object string)
 {
   Lisp_Object gstring, header;
-  ptrdiff_t frompos, topos;
+  ptrdiff_t frompos, frombyte, topos;
 
-  CHECK_NATNUM (from);
-  CHECK_NATNUM (to);
   if (! FONT_OBJECT_P (font_object))
     {
       struct coding_system *coding;
@@ -1754,13 +1730,35 @@ should be ignored.  */)
       font_object = CODING_ID_NAME (coding->id);
     }
 
-  header = fill_gstring_header (Qnil, from, to, font_object, string);
+  if (NILP (string))
+    {
+      if (NILP (BVAR (current_buffer, enable_multibyte_characters)))
+        error ("Attempt to shape unibyte text");
+      validate_region (&from, &to);
+      frompos = XFASTINT (from);
+      topos = XFASTINT (to);
+      frombyte = CHAR_TO_BYTE (frompos);
+    }
+  else
+    {
+      CHECK_NATNUM (from);
+      CHECK_NATNUM (to);
+      CHECK_STRING (string);
+      if (! STRING_MULTIBYTE (string))
+        error ("Attempt to shape unibyte text");
+      if (! (XINT (from) <= XINT (to) && XINT (to) <= SCHARS (string)))
+        args_out_of_range_3 (string, from, to);
+      frompos = XFASTINT (from);
+      topos = XFASTINT (to);
+      frombyte = string_char_to_byte (string, frompos);
+    }
+
+  header = fill_gstring_header (Qnil, frompos, frombyte,
+                                topos, font_object, string);
   gstring = gstring_lookup_cache (header);
   if (! NILP (gstring))
     return gstring;
 
-  frompos = XINT (from);
-  topos = XINT (to);
   if (LGSTRING_GLYPH_LEN (gstring_work) < topos - frompos)
     gstring_work = Fmake_vector (make_number (topos - frompos + 2), Qnil);
   LGSTRING_SET_HEADER (gstring_work, header);