bug#16457: 24.3.50; crash rendering Arabic Uthmani script

[Eli Zaretskii <eliz@gnu.org>]

> Date: Fri, 17 Jan 2014 11:34:11 +0400
> From: Dmitry Antipov <dmantipov@yandex.ru>
> CC: 16457@debbugs.gnu.org
> 
> On 01/16/2014 09:33 PM, Eli Zaretskii wrote:
> 
> > This is really strange.  First, I cannot reproduce the crash on
> > MS-Windows, so the problem might be related to the shaping engine
> > being used (I presume yours is libotf and libm17n).  (I tried on both
> > Windows XP and on Windows 7, which have very different versions of
> > Uniscribe, and they both work fine.)
> 
> Yes, with ' --without-m17n-flt' it doesn't crash.

Can you show the same results of debugging printouts in a
"--without-m17n-flt" build?

> ;; BAD
> composition_update_it: from 7, nchars 2, header 0x100c958 is:
> [#<font-object "-unknown-PakType Naqsh-normal-normal-normal-*-13-*-*-*-*-0-iso10646-1"> 1648 1583 1616 1593 1615 1608 1606 1614]
>   at 8: char 2, 1 bytes
>   at 7: char 1614, 2 bytes
> 
> IIUC 2 is the garbage at (presumably invalid) position 8.

What I see on my system that the CHARACTERs part of the header is 12
characters long:

 1610 1615 1582 1614 1648 1583 1616 1593 1615 1608 1606 1614

and the value of cmp_it->from + i never goes beyond 11, which is OK.

Also, note that the indices into the header seem to be off-by-one in
your case: the characters to compose for buffer position 11 are 1606
and 1614, whereas in your case 1606 is used for the previous buffer
position.  Also, the index 1 is nowhere to be seen.

So what does that mean? that cmp_it->nchars here

      cmp_it->nchars = LGLYPH_TO (glyph) + 1 - from;

is incorrect in your case?  Or that the gstring header becomes
corrupted somehow?

> > And the characters in the LGSTRING object are simply copied from the
> > buffer in fill_gstring_header, when LGSTRING is created:
> >
> >    for (i = 0; i < len; i++)
> >      {
> >        int c;
> >
> >        if (NILP (string))
> > 	FETCH_CHAR_ADVANCE_NO_CHECK (c, from, from_byte);
> >        else
> > 	FETCH_STRING_CHAR_ADVANCE_NO_CHECK (c, string, from, from_byte);
> >        ASET (header, i + 1, make_number (c));
> >      }
> 
> AFAICS gstring header is correct here.

Can you show the gstring header at that point in the build that
crashes?

Also, if you manually move point to buffer position 11, what column
number do you see there?