Fixed (with a real fix this time) bug [06c1433906] - Text widget crash during delete (cherrypicked [48cf3656d9])

1 files changed, 41 insertions, 16 deletions

diff --git a/generic/tkTextDisp.c b/generic/tkTextDisp.c
index 559fbf7..68c09fc 100644
--- a/generic/tkTextDisp.c
+++ b/generic/tkTextDisp.c
@@ -4683,9 +4683,6 @@ TextChanged(
          */
 
         lastPtr = FindDLine(textPtr, dInfoPtr->dLinePtr, &rounded);
-        while ((lastPtr != NULL) && (TkTextIndexCmp(&lastPtr->index, &rounded) < 0)) {
-            lastPtr = lastPtr->nextPtr;
-        }
 
         /*
          * At least one display line is supposed to change. This makes the
@@ -4806,16 +4803,9 @@ TextRedrawTag(
 
     /*
      * Round up the starting position if it's before the first line visible on
-     * the screen (we only care about what's on the screen). Beware that the
-     * display info structure might need update, for instance if we arrived
-     * here from an 'after idle' script removing tags in a range whose
-     * display lines (and dInfo) were partially invalidated by a previous
-     * delete operation in the text widget.
+     * the screen (we only care about what's on the screen).
      */
 
-    if (dInfoPtr->flags & DINFO_OUT_OF_DATE) {
-	UpdateDisplayInfo(textPtr);
-    }
     dlPtr = dInfoPtr->dLinePtr;
     if (dlPtr == NULL) {
 	return;
@@ -6600,6 +6590,7 @@ FindDLine(
     CONST TkTextIndex *indexPtr)/* Index of desired character. */
 {
     DLine *dlPtrPrev;
+    TkTextIndex indexPtr2;
 
     if (dlPtr == NULL) {
 	return NULL;
@@ -6624,24 +6615,58 @@ FindDLine(
         dlPtrPrev = dlPtr;
         dlPtr = dlPtr->nextPtr;
         if (dlPtr == NULL) {
-            TkTextIndex indexPtr2;
             /*
              * We're past the last display line, either because the desired
              * index lies past the visible text, or because the desired index
-             * is on the last display line showing the last logical line.
+             * is on the last display line.
              */
             indexPtr2 = dlPtrPrev->index;
             TkTextIndexForwBytes(textPtr, &indexPtr2, dlPtrPrev->byteCount,
                     &indexPtr2);
             if (TkTextIndexCmp(&indexPtr2,indexPtr) > 0) {
+                /*
+                 * The desired index is on the last display line.
+                 * --> return this display line.
+                 */
                 dlPtr = dlPtrPrev;
-                break;
             } else {
-                return NULL;
+                /*
+                 * The desired index is past the visible text. There is no
+                 * display line displaying something at the desired index.
+                 * --> return NULL.
+                 */
             }
+            break;
         }
         if (TkTextIndexCmp(&dlPtr->index,indexPtr) > 0) {
-            dlPtr = dlPtrPrev;
+            /*
+             * If we're here then we would normally expect that:
+             *   dlPtrPrev->index  <=  indexPtr  <  dlPtr->index
+             * i.e. we have found the searched display line being dlPtr.
+             * However it is possible that some DLines were unlinked
+             * previously, leading to a situation where going through
+             * the list of display lines skips display lines that did
+             * exist just a moment ago.
+             */
+            indexPtr2 = dlPtrPrev->index;
+            TkTextIndexForwBytes(textPtr, &indexPtr2, dlPtrPrev->byteCount,
+                    &indexPtr2);
+            if (TkTextIndexCmp(&indexPtr2,indexPtr) > 0) {
+                /*
+                 * Confirmed:
+                 *   dlPtrPrev->index  <=  indexPtr  <  dlPtr->index
+                 * --> return dlPtrPrev.
+                 */
+                dlPtr = dlPtrPrev;
+            } else {
+                /*
+                 * The last (rightmost) index shown by dlPtrPrev is still
+                 * before the desired index. This may be because there was
+                 * previously a display line between dlPtrPrev and dlPtr
+                 * and this display line has been unlinked.
+                 * --> return dlPtr.
+                 */
+            }
             break;
         }
     }