Fix rare aborts in bidi.c.

src/bidi.c (bidi_resolve_neutral): After finding the next
 non-neutral character, accept NEUTRAL_ON type as well, because
 directional control characters, such as LRE and RLE, have their
 type converted to that by bidi_resolve_weak.  This avoids aborts
 when LRE/RLE follows a run of neutrals.
 (bidi_move_to_visually_next): Assert that return value of
 bidi_peek_at_next_level is non-negative.  Negative values will
 cause an infloop.

src/ChangeLog

@@ -1,3 +1,14 @@
+2013-02-11  Eli Zaretskii  <eliz@gnu.org>
+
+	* bidi.c (bidi_resolve_neutral): After finding the next
+	non-neutral character, accept NEUTRAL_ON type as well, because
+	directional control characters, such as LRE and RLE, have their
+	type converted to that by bidi_resolve_weak.  This avoids aborts
+	when LRE/RLE follows a run of neutrals.
+	(bidi_move_to_visually_next): Assert that return value of
+	bidi_peek_at_next_level is non-negative.  Negative values will
+	cause an infloop.
+
 2013-02-05  Daniel Colascione  <dancol@dancol.org>
 
 	* emacs.c: Use execvp, not execv, when DAEMON_MUST_EXEC, so that

src/bidi.c

@@ -1973,6 +1973,7 @@ bidi_resolve_neutral (struct bidi_it *bidi_it)
 		next_type = STRONG_R;
 		break;
 	      case WEAK_BN:
+	      case NEUTRAL_ON:	/* W6/Retaining */
 		if (!bidi_explicit_dir_char (bidi_it->ch))
 		  emacs_abort (); /* can't happen: BNs are skipped */
 		/* FALLTHROUGH */
@@ -2391,6 +2392,10 @@ bidi_move_to_visually_next (struct bidi_it *bidi_it)
       next_level = bidi_peek_at_next_level (bidi_it);
       while (next_level != expected_next_level)
 	{
+	  /* If next_level is -1, it means we have an unresolved level
+	     in the cache, which at this point should not happen.  If
+	     it does, we will infloop.  */
+	  eassert (next_level >= 0);
 	  expected_next_level += incr;
 	  level_to_search += incr;
 	  bidi_find_other_level_edge (bidi_it, level_to_search, !ascending);