redisplay goes horribly wrong when a before-string contains multiple display properties

[Joe Wells <jbw@macs.hw.ac.uk>]

Redisplay goes horribly wrong when a before-string contains multiple
display properties.

Reproduce by evaluating this expression:

  (let ((buf (get-buffer-create "foo")))
    (with-current-buffer buf
      (display-buffer buf)
      (erase-buffer)
      (dolist (o (overlays-in (point-min) (point-max)))
        (delete-overlay o))
      (insert "ABC")
      (let ((o (make-overlay 2 3))
            (s (make-string 5 ?X)))
        (put-text-property 0 1 'display "1" s)
        (put-text-property 1 2 'display "2" s)
        (put-text-property 2 3 'display "3" s)
        (put-text-property 3 4 'display "4" s)
        (put-text-property 4 5 'display "5" s)
        (overlay-put o 'display "Y")
        (overlay-put o 'before-string s))))

The correct behavior would be to see the buffer “foo” pop up
displaying the characters “A12345YC”.  The horribly wrong behavior
that actually happens is that redisplay of the buffer stops completely
after “A1” is shown.  Strangely, the “XXXXX” (which should not be
displayed anywhere) will be displayed in the echo area.  Scary errors
start occurring if one tries to do work in the buffer after this.

By the way, it would be really nice if this worked, because it would
be an easy way to display a number of display specifications for a
single overlay, which would make it much easier to get the features of
AUCTeX's tex-fold.el to work together with the features of
latex-preview.  (What is needed is being able to display strings
interleaved with images.)

Joe

======================================================================
In GNU Emacs 22.1.1 (i686-pc-linux-gnu, GTK+ Version 2.8.20)
 of 2007-06-27 on artemis
Windowing system distributor `The X.Org Foundation', version 11.0.70000000
configured using `configure  '--prefix=/home/jbw/local2' '--enable-debug' '--disable-nls' '--with-x-toolkit=gtk' 'CFLAGS=-O0 -g3 -ggdb''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: en_US.UTF-8
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: jbw
  value of $LANG: nil
  locale-coding-system: utf-8
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  TeX-source-specials-mode: t
  auto-fill-function: do-auto-fill
  shell-dirtrack-mode: t
  outline-minor-mode: t
  desktop-save-mode: t
  url-handler-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  auto-compression-mode: t
  temp-buffer-resize-mode: t
  size-indication-mode: t
  line-number-mode: t
  transient-mark-mode: t