bug#81567: 31.0.90; overlay freeze

> From: Romain Ouabdelkader <[email protected]>
> Date: Thu, 6 Aug 2026 17:51:24 +0200
> 
> The minimal reproducer I could get:
> - two line overlays with empty 'display
> - an overlay with 'before-string & 'display with multiple lines

Quite crazy, IMNSHO.

> When you scroll up to the beginning of the buffer, Emacs hangs. C-g does
> nothing, neither does kill -SIGUSR2.
> 
> Attached is a minimal reproducer:
> 
> 1. emacs -Q -l overlay-scroll-freeze.el -f overlay-scroll-freeze
> 2. hold C-p to move point to the start of the buffer
> 3. Emacs hangs when reaching the beginning of the buffer

Thanks.

(Actually, you must make sure you type C-p twice in quick succession
at BOB, otherwise there's no hang.)

Please try the patch below and see if it solves the problem without
introducing regressions elsewhere.

> I am pretty sure that the issue started on emacs31; although I didn't
> reinstall emacs30 to verify the reproducer.

Emacs 30.2 indeed doesn't hang, but it produces garbled display in
this case.

diff --git a/src/xdisp.c b/src/xdisp.c
index 5377d5e..b3227ce 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -11298,10 +11298,18 @@ move_it_vertically_backward (struct it *it, int dy)
      y-distance.  */
   SAVE_IT (it2, *it, it2data);
   it2.max_ascent = it2.max_descent = 0;
+  ptrdiff_t to_pos = start_pos;
   do
     {
+      /* Avoid inflooping of there's a large display string with several
+         embedded newlines, which makes move_it_to stop after START_POS
+         but still inside a display or overlay string.  */
+      if (IT_CHARPOS (it2) >= start_pos)
+	to_pos = -1;
       move_it_to (&it2, start_pos, -1, -1, it2.vpos + 1,
-		  MOVE_TO_POS | MOVE_TO_VPOS);
+		  (to_pos > 0
+		    ? (MOVE_TO_POS | MOVE_TO_VPOS)
+		   : MOVE_TO_VPOS));
     }
   while (!(IT_POS_VALID_AFTER_MOVE_P (&it2)
 	   /* If we are in a display string which starts at START_POS,