bug#8915: 23.3; Repeatable segmentation fault, all platforms, in character composition code

[YAMAMOTO Mitsuharu <mituharu@math.s.chiba-u.ac.jp>]

>>>>> On Tue, 21 Jun 2011 17:04:57 +0100, David Aspinall <David.Aspinall@ed.ac.uk> said:

> There is a segfault which arises reproducibly when compose-character is
> used near the end of a buffer.  I'm afraid I don't have a raw test case
> but here is a recipe to reproduce it that loads the Emacs application
> Proof General:
  
>  wget http://proofgeneral.inf.ed.ac.uk/releases/ProofGeneral-4.0.tgz
>  tar -xpzf ProofGeneral-4.0.tgz
>  (cd ProofGeneral; make clean)
>  emacs -q -l ProofGeneral/generic/proof-site.el
>  C-x C-f Test.thy

> Then type

>  \<forall>

> and Emacs segfaults.  If instead you type

>  M-x 1 0 SPACE C-a \<forall>

> it behaves as expected: looks like the code is running off the end of
> the buffer.

At least, the following change seems to avoid the crash.  But I'm not
sure if this is a right fix at all.

Handa-san, could you take a look at this issue?  The problematic case
is that the addition of the `composite' property via fontification
occurs during redisplay and the composition is found in the middle of
the composed region.  That happens if the first part of the region had
a non-nil `fontified' property and the second part did not, and then
fontification-functions added the `composite' property to the whole
region.

				     YAMAMOTO Mitsuharu
				mituharu@math.s.chiba-u.ac.jp

=== modified file 'src/composite.c'
*** src/composite.c	2011-05-09 09:59:23 +0000
--- src/composite.c	2011-06-28 09:10:01 +0000
***************
*** 1136,1142 ****
  				       prop, string);
        if (cmp_it->id < 0)
  	goto no_composition;
!       cmp_it->nchars = end - start;
        cmp_it->nglyphs = composition_table[cmp_it->id]->glyph_len;
      }
    else if (w)
--- 1136,1142 ----
  				       prop, string);
        if (cmp_it->id < 0)
  	goto no_composition;
!       cmp_it->nchars = end - charpos;
        cmp_it->nglyphs = composition_table[cmp_it->id]->glyph_len;
      }
    else if (w)

=== modified file 'src/xdisp.c'
*** src/xdisp.c	2011-05-25 03:06:05 +0000
--- src/xdisp.c	2011-06-28 09:10:57 +0000
***************
*** 4654,4660 ****
        if (it->cmp_it.id >= 0)
  	{
  	  it->cmp_it.ch = -1;
! 	  it->cmp_it.nchars = COMPOSITION_LENGTH (prop);
  	  it->cmp_it.nglyphs = -1;
  	}
      }
--- 4654,4660 ----
        if (it->cmp_it.id >= 0)
  	{
  	  it->cmp_it.ch = -1;
! 	  it->cmp_it.nchars = end - pos;
  	  it->cmp_it.nglyphs = -1;
  	}
      }