Fix a crash when a display string is continued to the next line.

 xdisp.c (set_cursor_from_row): When looping over a display string,
 don't overstep the end of the glyph row.

2 files changed, 9 insertions, 3 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 9cabe8de38b..a6a89a4ea3b 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2010-04-27  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (set_cursor_from_row): Fix a crash when a display string
+        is continued to the next line.
+
 2010-04-25  Eli Zaretskii  <eliz@gnu.org>
 
         * xdisp.c (set_cursor_from_row): Don't return zero if cursor was
diff --git a/src/xdisp.c b/src/xdisp.c
index d491d5a9aeb..9e14f7879a2 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -13015,7 +13015,8 @@ set_cursor_from_row (w, row, matrix, delta, delta_bytes, dy, dvpos)
 
                           cursor = glyph;
                           for (glyph += incr;
-                               EQ (glyph->object, str);
+                               (row->reversed_p ? glyph > stop : glyph < stop)
+                                 && EQ (glyph->object, str);
                                glyph += incr)
                             {
                               Lisp_Object cprop;
@@ -13056,8 +13057,8 @@ set_cursor_from_row (w, row, matrix, delta, delta_bytes, dy, dvpos)
           /* If we reached the end of the line, and END was from a string,
              the cursor is not on this line.  */
           if (cursor == NULL
-              && glyph == end
-              && STRINGP ((glyph - incr)->object)
+              && (row->reversed_p ? glyph <= end : glyph >= end)
+              && STRINGP (end->object)
               && row->continued_p)
             return 0;
         }