bug#16457: 24.3.50; crash rendering Arabic Uthmani script

[Dmitry Antipov]

I'm not familiar with composition sequences in detail, but there is a hint.

For the uthmani-test.txt, the following code in set_iterator_to_next:

  7127                /* Composition created while scanning forward.  */
  7128                /* Update IT's char/byte positions to point to the first
  7129                   character of the next grapheme cluster, or to the
  7130                   character visually after the current composition.  */
  7131                for (i = 0; i < it->cmp_it.nchars; i++)
  7132                  bidi_move_to_visually_next (&it->bidi_it);
  7133                IT_BYTEPOS (*it) = it->bidi_it.bytepos;
  7134                IT_CHARPOS (*it) = it->bidi_it.charpos;

advances IT from charpos:bytepos 11:21 to 13:25.  But the following fragment
from scan_for_column:

   586        /* Check composition sequence.  */
   587        if (cmp_it.id >= 0
   588            || (scan == cmp_it.stop_pos
   589                && composition_reseat_it (&cmp_it, scan, scan_byte, end,
   590                                          w, NULL, Qnil)))
   591          composition_update_it (&cmp_it, scan, scan_byte, Qnil);
   592        if (cmp_it.id >= 0)
   593          {
   594            scan += cmp_it.nchars;
   595            scan_byte += cmp_it.nbytes;

advances SCAN:SCAN_BYTE from 11:21 to 13:24.  So the byte position becomes 
invalid
and FETCH_CHAR_ADVANCE decodes invalid byte sequence to invalid character C.
Finally, CHAR_TABLE_REF (Vcomposition_function_table, C) goes out of bounds.

Dmitry