Fix rare aborts in bidi.c.

 src/bidi.c (bidi_resolve_neutral): After finding the next
 non-neutral character, accept NEUTRAL_ON type as well, because
 directional control characters, such as LRE and RLE, have their
 type converted to that by bidi_resolve_weak.  This avoids aborts
 when LRE/RLE follows a run of neutrals.
 (bidi_move_to_visually_next): Assert that return value of
 bidi_peek_at_next_level is non-negative.  Negative values will
 cause an infloop.

2 files changed, 16 insertions, 0 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index e33d2fa5870..b5a1e0d5cb5 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,14 @@
+2013-02-11  Eli Zaretskii  <eliz@gnu.org>
+
+        * bidi.c (bidi_resolve_neutral): After finding the next
+        non-neutral character, accept NEUTRAL_ON type as well, because
+        directional control characters, such as LRE and RLE, have their
+        type converted to that by bidi_resolve_weak.  This avoids aborts
+        when LRE/RLE follows a run of neutrals.
+        (bidi_move_to_visually_next): Assert that return value of
+        bidi_peek_at_next_level is non-negative.  Negative values will
+        cause an infloop.
+
 2013-02-05  Daniel Colascione  <dancol@dancol.org>
 
         * emacs.c: Use execvp, not execv, when DAEMON_MUST_EXEC, so that
diff --git a/src/bidi.c b/src/bidi.c
index b067c8134e3..db2e48a2ca7 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -1973,6 +1973,7 @@ bidi_resolve_neutral (struct bidi_it *bidi_it)
                 next_type = STRONG_R;
                 break;
               case WEAK_BN:
+              case NEUTRAL_ON:  /* W6/Retaining */
                 if (!bidi_explicit_dir_char (bidi_it->ch))
                   emacs_abort (); /* can't happen: BNs are skipped */
                 /* FALLTHROUGH */
@@ -2391,6 +2392,10 @@ bidi_move_to_visually_next (struct bidi_it *bidi_it)
       next_level = bidi_peek_at_next_level (bidi_it);
       while (next_level != expected_next_level)
         {
+          /* If next_level is -1, it means we have an unresolved level
+             in the cache, which at this point should not happen.  If
+             it does, we will infloop.  */
+          eassert (next_level >= 0);
           expected_next_level += incr;
           level_to_search += incr;
           bidi_find_other_level_edge (bidi_it, level_to_search, !ascending);