Attempt to fix crashes per bug #15575.

 src/xdisp.c (deep_copy_glyph_row): Assert that the 'used' counts of
 FROM and TO are identical.  Copy only the glyphs of TEXT_AREA.
 src/term.c (save_and_enable_current_matrix): Don't allocate and
 don't save margin areas.
 (restore_desired_matrix): Don't restore margin areas.
 (free_saved_screen): Don't free margin areas.

src/ChangeLog

@@ -1,3 +1,14 @@
+2013-10-10  Eli Zaretskii  <eliz@gnu.org>
+
+	* xdisp.c (deep_copy_glyph_row): Assert that the 'used' counts of
+	FROM and TO are identical.  Copy only the glyphs of TEXT_AREA.
+	(Bug#15575)
+
+	* term.c (save_and_enable_current_matrix): Don't allocate and
+	don't save margin areas.
+	(restore_desired_matrix): Don't restore margin areas.
+	(free_saved_screen): Don't free margin areas.
+
 2013-10-10  Paul Eggert  <eggert@cs.ucla.edu>
 
 	* image.c: Pacify --enable-gcc-warnings.

src/term.c

@@ -3066,22 +3066,6 @@ save_and_enable_current_matrix (struct frame *f)
 	 screen will not be redrawn anyway.)  */
       to->enabled_p = 1;
       to->hash = from->hash;
-      if (from->used[LEFT_MARGIN_AREA])
-	{
-	  nbytes = from->used[LEFT_MARGIN_AREA] * sizeof (struct glyph);
-	  to->glyphs[LEFT_MARGIN_AREA] = xmalloc (nbytes);
-	  memcpy (to->glyphs[LEFT_MARGIN_AREA],
-		  from->glyphs[LEFT_MARGIN_AREA], nbytes);
-	  to->used[LEFT_MARGIN_AREA] = from->used[LEFT_MARGIN_AREA];
-	}
-      if (from->used[RIGHT_MARGIN_AREA])
-	{
-	  nbytes = from->used[RIGHT_MARGIN_AREA] * sizeof (struct glyph);
-	  to->glyphs[RIGHT_MARGIN_AREA] = xmalloc (nbytes);
-	  memcpy (to->glyphs[RIGHT_MARGIN_AREA],
-		  from->glyphs[RIGHT_MARGIN_AREA], nbytes);
-	  to->used[RIGHT_MARGIN_AREA] = from->used[RIGHT_MARGIN_AREA];
-	}
     }
 
   return saved;
@@ -3106,26 +3090,6 @@ restore_desired_matrix (struct frame *f, struct glyph_matrix *saved)
       to->used[TEXT_AREA] = from->used[TEXT_AREA];
       to->enabled_p = from->enabled_p;
       to->hash = from->hash;
-      nbytes = from->used[LEFT_MARGIN_AREA] * sizeof (struct glyph);
-      if (nbytes)
-	{
-	  eassert (to->glyphs[LEFT_MARGIN_AREA] != from->glyphs[LEFT_MARGIN_AREA]);
-	  memcpy (to->glyphs[LEFT_MARGIN_AREA],
-		  from->glyphs[LEFT_MARGIN_AREA], nbytes);
-	  to->used[LEFT_MARGIN_AREA] = from->used[LEFT_MARGIN_AREA];
-	}
-      else
-	to->used[LEFT_MARGIN_AREA] = 0;
-      nbytes = from->used[RIGHT_MARGIN_AREA] * sizeof (struct glyph);
-      if (nbytes)
-	{
-	  eassert (to->glyphs[RIGHT_MARGIN_AREA] != from->glyphs[RIGHT_MARGIN_AREA]);
-	  memcpy (to->glyphs[RIGHT_MARGIN_AREA],
-		  from->glyphs[RIGHT_MARGIN_AREA], nbytes);
-	  to->used[RIGHT_MARGIN_AREA] = from->used[RIGHT_MARGIN_AREA];
-	}
-      else
-	to->used[RIGHT_MARGIN_AREA] = 0;
     }
 }
 
@@ -3142,10 +3106,6 @@ free_saved_screen (struct glyph_matrix *saved)
       struct glyph_row *from = saved->rows + i;
 
       xfree (from->glyphs[TEXT_AREA]);
-      if (from->used[LEFT_MARGIN_AREA])
-	xfree (from->glyphs[LEFT_MARGIN_AREA]);
-      if (from->used[RIGHT_MARGIN_AREA])
-	xfree (from->glyphs[RIGHT_MARGIN_AREA]);
     }
 
   xfree (saved->rows);

src/xdisp.c

@@ -20589,34 +20589,22 @@ display_menu_bar (struct window *w)
 static void
 deep_copy_glyph_row (struct glyph_row *to, struct glyph_row *from)
 {
-  int area, i, sum_used = 0;
+  int area, i;
   struct glyph *pointers[1 + LAST_AREA];
 
   /* Save glyph pointers of TO.  */
   memcpy (pointers, to->glyphs, sizeof to->glyphs);
+  eassert (to->used[TEXT_AREA] == from->used[TEXT_AREA]);
 
   /* Do a structure assignment.  */
   *to = *from;
 
-  /* Restore original pointers of TO.  */
+  /* Restore original glyph pointers of TO.  */
   memcpy (to->glyphs, pointers, sizeof to->glyphs);
 
-  /* Count how many glyphs to copy and update glyph pointers.  */
-  for (area = LEFT_MARGIN_AREA; area < LAST_AREA; ++area)
-    {
-      if (area > LEFT_MARGIN_AREA)
-	{
-	  eassert (from->glyphs[area] - from->glyphs[area - 1]
-		   == from->used[area - 1]);
-	  to->glyphs[area] = to->glyphs[area - 1] + to->used[area - 1];
-	}
-      sum_used += from->used[area];
-    }
-
   /* Copy the glyphs.  */
-  eassert (sum_used <= to->glyphs[LAST_AREA] - to->glyphs[LEFT_MARGIN_AREA]);
-  for (i = 0; i < sum_used; i++)
-    to->glyphs[LEFT_MARGIN_AREA][i] = from->glyphs[LEFT_MARGIN_AREA][i];
+  memcpy (to->glyphs[TEXT_AREA], from->glyphs[TEXT_AREA],
+	  from->used[TEXT_AREA] * sizeof (struct glyph));
 }
 
 /* Display one menu item on a TTY, by overwriting the glyphs in the