2 files changed, 81 insertions, 5 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 9245e81a536..7352d8e0081 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,20 @@
+2012-05-13  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (handle_stop): Don't call get_overlay_strings_1 if we
+        already have overlays loaded.
+        (handle_single_display_spec): Before returning without displaying
+        fringe bitmap, synchronize the bidi iterator with the main display
+        iterator, by calling iterate_out_of_display_property.
+        (iterate_out_of_display_property): Detect buffer iteration by
+        testing that it->string is a Lisp string.
+        (get_next_display_element): When the current object is exhausted,
+        and there's something on it->stack, call set_iterator_to_next to
+        proceed with what's on the stack, instead of returning zero.
+        (set_iterator_to_next): If called at the end of a Lisp string,
+        proceed to consider_string_end without incrementing string
+        position.  Don't increment display vector index past the end of
+        the display vector.  (Bug#11417)
+
 2012-05-11  Eli Zaretskii  <eliz@gnu.org>
 
         * xdisp.c (handle_single_display_spec): Return 1 for left-margin
diff --git a/src/xdisp.c b/src/xdisp.c
index fd26853e09b..b1e2a925bce 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -839,6 +839,7 @@ static int try_cursor_movement (Lisp_Object, struct text_pos, int *);
 static int trailing_whitespace_p (EMACS_INT);
 static intmax_t message_log_check_duplicate (EMACS_INT, EMACS_INT);
 static void push_it (struct it *, struct text_pos *);
+static void iterate_out_of_display_property (struct it *);
 static void pop_it (struct it *);
 static void sync_frame_with_window_matrix_rows (struct window *);
 static void select_frame_for_redisplay (Lisp_Object);
@@ -3125,7 +3126,15 @@ handle_stop (struct it *it)
                  overlays even if the actual buffer text is replaced.  */
               if (!handle_overlay_change_p
                   || it->sp > 1
-                  || !get_overlay_strings_1 (it, 0, 0))
+                  /* Don't call get_overlay_strings_1 if we already
+                     have overlay strings loaded, because doing so
+                     will load them again and push the iterator state
+                     onto the stack one more time, which is not
+                     expected by the rest of the code that processes
+                     overlay strings.  */
+                  || (it->n_overlay_strings <= 0
+                      ? !get_overlay_strings_1 (it, 0, 0)
+                      : 0))
                 {
                   if (it->ellipsis_p)
                     setup_for_ellipsis (it, 0);
@@ -4681,7 +4690,19 @@ handle_single_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
           if (!FRAME_WINDOW_P (it->f))
             /* If we return here, POSITION has been advanced
                across the text with this property.  */
-            return 1;
+            {
+              /* Synchronize the bidi iterator with POSITION.  This is
+                 needed because we are not going to push the iterator
+                 on behalf of this display property, so there will be
+                 no pop_it call to do this synchronization for us.  */
+              if (it->bidi_p)
+                {
+                  it->position = *position;
+                  iterate_out_of_display_property (it);
+                  *position = it->position;
+                }
+              return 1;
+            }
         }
       else if (!frame_window_p)
         return 1;
@@ -4692,7 +4713,15 @@ handle_single_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
           || !(fringe_bitmap = lookup_fringe_bitmap (value)))
         /* If we return here, POSITION has been advanced
            across the text with this property.  */
-        return 1;
+        {
+          if (it && it->bidi_p)
+            {
+              it->position = *position;
+              iterate_out_of_display_property (it);
+              *position = it->position;
+            }
+          return 1;
+        }
 
       if (it)
         {
@@ -5611,7 +5640,7 @@ push_it (struct it *it, struct text_pos *position)
 static void
 iterate_out_of_display_property (struct it *it)
 {
-  int buffer_p = BUFFERP (it->object);
+  int buffer_p = !STRINGP (it->string);
   EMACS_INT eob = (buffer_p ? ZV : it->end_charpos);
   EMACS_INT bob = (buffer_p ? BEGV : 0);
 
@@ -6780,6 +6809,16 @@ get_next_display_element (struct it *it)
                && FACE_FROM_ID (it->f, face_id)->box == FACE_NO_BOX);
         }
     }
+  /* If we reached the end of the object we've been iterating (e.g., a
+     display string or an overlay string), and there's something on
+     IT->stack, proceed with what's on the stack.  It doesn't make
+     sense to return zero if there's unprocessed stuff on the stack,
+     because otherwise that stuff will never be displayed.  */
+  if (!success_p && it->sp > 0)
+    {
+      set_iterator_to_next (it, 0);
+      success_p = get_next_display_element (it);
+    }
 
   /* Value is 0 if end of buffer or string reached.  */
   return success_p;
@@ -6961,7 +7000,7 @@ set_iterator_to_next (struct it *it, int reseat_p)
          display vector entry (these entries may contain faces).  */
       it->face_id = it->saved_face_id;
 
-      if (it->dpvec + it->current.dpvec_index == it->dpend)
+      if (it->dpvec + it->current.dpvec_index >= it->dpend)
         {
           int recheck_faces = it->ellipsis_p;
 
@@ -6999,6 +7038,26 @@ set_iterator_to_next (struct it *it, int reseat_p)
     case GET_FROM_STRING:
       /* Current display element is a character from a Lisp string.  */
       xassert (it->s == NULL && STRINGP (it->string));
+      /* Don't advance past string end.  These conditions are true
+         when set_iterator_to_next is called at the end of
+         get_next_display_element, in which case the Lisp string is
+         already exhausted, and all we want is pop the iterator
+         stack.  */
+      if (it->current.overlay_string_index >= 0)
+        {
+          /* This is an overlay string, so there's no padding with
+             spaces, and the number of characters in the string is
+             where the string ends.  */
+          if (IT_STRING_CHARPOS (*it) >= SCHARS (it->string))
+            goto consider_string_end;
+        }
+      else
+        {
+          /* Not an overlay string.  There could be padding, so test
+             against it->end_charpos . */
+          if (IT_STRING_CHARPOS (*it) >= it->end_charpos)
+            goto consider_string_end;
+        }
       if (it->cmp_it.id >= 0)
         {
           int i;