bug#5984: Crash displaying composed characters

[Andreas Schwab]

Juanma Barranquero <lekktu@gmail.com> writes:

>> Please try this patch.
>
> With it, I don't get a crash, but an error:
>
>   Wrong type argument: bufferp, 12846208

Here's an updated patch.

Andreas.

=== modified file 'src/composite.c'
--- src/composite.c     2010-01-14 03:54:04 +0000
+++ src/composite.c     2010-04-21 12:10:13 +0000
@@ -986,20 +986,31 @@ autocmp_chars (cft_element, charpos, byt
            font_object = win->frame;
          gstring = Fcomposition_get_gstring (pos, make_number (to),
                                              font_object, string);
-         if (NILP (LGSTRING_ID (gstring)))
+         if (!NILP (LGSTRING_ID (gstring)))
            {
-             Lisp_Object args[6];
-
-             args[0] = Vauto_composition_function;
-             args[1] = AREF (elt, 2);
-             args[2] = pos;
-             args[3] = make_number (to);
-             args[4] = font_object;
-             args[5] = string;
-             gstring = safe_call (6, args);
+             if (NILP (string))
+               TEMP_SET_PT_BOTH (pt, pt_byte);
+             return unbind_to (count, gstring);
            }
+
+         /* Save point as marker before calling out to lisp.  */
          if (NILP (string))
-           TEMP_SET_PT_BOTH (pt, pt_byte);
+           {
+             Lisp_Object m = Fmake_marker ();
+             set_marker_both (m, Qnil, pt, pt_byte);
+             record_unwind_protect (restore_point_unwind, m);
+           }
+         {
+           Lisp_Object args[6];
+
+           args[0] = Vauto_composition_function;
+           args[1] = AREF (elt, 2);
+           args[2] = pos;
+           args[3] = make_number (to);
+           args[4] = font_object;
+           args[5] = string;
+           gstring = safe_call (6, args);
+         }
          return unbind_to (count, gstring);
        }
     }

=== modified file 'src/fileio.c'
--- src/fileio.c        2010-04-21 03:02:58 +0000
+++ src/fileio.c        2010-04-21 09:22:01 +0000
@@ -299,7 +299,7 @@ close_file_unwind (fd)
 
 /* Restore point, having saved it as a marker.  */
 
-static Lisp_Object
+Lisp_Object
 restore_point_unwind (location)
      Lisp_Object location;
 {

=== modified file 'src/lisp.h'
--- src/lisp.h  2010-04-21 03:02:58 +0000
+++ src/lisp.h  2010-04-21 09:22:01 +0000
@@ -3061,6 +3061,7 @@ EXFUN (Ffile_readable_p, 1);
 EXFUN (Ffile_executable_p, 1);
 EXFUN (Fread_file_name, 6);
 extern Lisp_Object close_file_unwind P_ ((Lisp_Object));
+extern Lisp_Object restore_point_unwind P_ ((Lisp_Object));
 extern void report_file_error P_ ((const char *, Lisp_Object)) NO_RETURN;
 extern int internal_delete_file P_ ((Lisp_Object));
 extern void syms_of_fileio P_ ((void));



-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."