bug#40000: 27.0.60; next-single-char-property-change hangs on bad argument

[Federico Tedin <federicotedin@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 255 bytes --]

> Then we'd need to clearly document the behavior in each case, I guess.

Ok, I've taken another shot at it. I updated the function's
documentation to reflect what happens with LIMIT when working on a
string and on a buffer, hopefully it's clear enough.


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-Prevent-hanging-in-next-single-char-property-change.patch --]
[-- Type: text/x-diff, Size: 2166 bytes --]

From 972c1d0f2b479ba9f1ad5643ee9ce5d268077ace Mon Sep 17 00:00:00 2001
From: Federico Tedin <federicotedin@gmail.com>
Date: Tue, 14 Apr 2020 23:02:44 +0200
Subject: [PATCH] Prevent hanging in next-single-char-property-change

* src/textprop.c (Fnext_single_char_property_change): Prevent Emacs
from hanging when the value of LIMIT is greater than the buffer's end
position. (Bug#40000)
---
 src/textprop.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/src/textprop.c b/src/textprop.c
index 960dba3f8d..378c158875 100644
--- a/src/textprop.c
+++ b/src/textprop.c
@@ -765,15 +765,15 @@ DEFUN ("next-single-char-property-change", Fnext_single_char_property_change,
 the current buffer), POSITION is a buffer position (integer or marker).
 If OBJECT is a string, POSITION is a 0-based index into it.
 
-In a string, scan runs to the end of the string, unless LIMIT is non-nil.
-In a buffer, if LIMIT is nil or omitted, it runs to (point-max), and the
-value cannot exceed that.
-If the optional fourth argument LIMIT is non-nil, don't search
-past position LIMIT; return LIMIT if nothing is found before LIMIT.
+In a string, scan runs to the end of the string, unless LIMIT is
+non-nil, in which case its value is returned if nothing is found
+before it.
 
-The property values are compared with `eq'.
-If the property is constant all the way to the end of OBJECT, return the
-last valid position in OBJECT.  */)
+In a buffer, if LIMIT is nil or omitted, it runs to (point-max).  If
+LIMIT is non-nil, scan does not go past it, and the smallest of
+(point-max) and LIMIT is returned.
+
+The property values are compared with `eq'.  */)
   (Lisp_Object position, Lisp_Object prop, Lisp_Object object, Lisp_Object limit)
 {
   if (STRINGP (object))
@@ -832,6 +832,12 @@ DEFUN ("next-single-char-property-change", Fnext_single_char_property_change,
 	    value = Fget_char_property (position, prop, object);
 	    if (!EQ (value, initial_value))
 	      break;
+
+	    if (XFIXNAT (position) >= ZV)
+	      {
+		XSETFASTINT (position, ZV);
+		break;
+	      }
 	  }
 
       position = unbind_to (count, position);
-- 
2.17.1