Fix bug #9624 with crashes in Muse mode.

 src/xdisp.c (compute_display_string_end): If there's no display
 string at CHARPOS, return -1.
 src/bidi.c (bidi_fetch_char): When compute_display_string_end
 returns a negative value, treat the character as a normal
 character not covered by a display string.

1 files changed, 10 insertions, 0 deletions

diff --git a/src/bidi.c b/src/bidi.c
index 599c00449b5..e3fc03f4a9b 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -974,6 +974,15 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
 	  ch = 0xFFFC;
 	}
       disp_end_pos = compute_display_string_end (*disp_pos, string);
+      if (disp_end_pos < 0)
+	{
+	  /* Somebody removed the display string from the buffer
+	     behind our back.  Recover by processing this buffer
+	     position as if no display property were present there to
+	     begin with.  */
+	  *disp_prop = 0;
+	  goto normal_char;
+	}
       *nchars = disp_end_pos - *disp_pos;
       if (*nchars <= 0)
 	abort ();
@@ -988,6 +997,7 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
     }
   else
     {
+    normal_char:
       if (string->s)
 	{
 	  int len;