Fix cursor drawing in hscrolled R2L screen lines.

 src/xdisp.c (get_glyph_string_clip_rects): Don't let the width of a
 clipping rectangle become negative (i.e. large positive, since
 it's an unsigned data type).  This can happen in R2L hscrolled
 glyph rows, and caused us to draw the cursor glyph on the fringe.
 For the details, see
 http://lists.gnu.org/archive/html/emacs-devel/2014-08/msg00543.html.

src/ChangeLog

+2014-08-31  Eli Zaretskii  <eliz@gnu.org>
+
+	* xdisp.c (get_glyph_string_clip_rects): Don't let the width of a
+	clipping rectangle become negative (i.e. large positive, since
+	it's an unsigned data type).  This can happen in R2L hscrolled
+	glyph rows, and caused us to draw the cursor glyph on the fringe.
+	For the details, see
+	http://lists.gnu.org/archive/html/emacs-devel/2014-08/msg00543.html.
+
 2014-08-31  Ken Brown  <kbrown@cornell.edu>
 	* gmalloc.c: Don't include <stdlib.h>.  Declare system malloc and

src/xdisp.c

@@ -2174,7 +2174,10 @@ get_glyph_string_clip_rects (struct glyph_string *s, NativeRectangle *rects, int
       if (s->x > r.x)
 	{
-	  r.width -= s->x - r.x;
+	  if (r.width >= s->x - r.x)
+	    r.width -= s->x - r.x;
+	  else	/* R2L hscrolled row with cursor outside text area */
+	    r.width = 0;
 	  r.x = s->x;
 	}
       r.width = min (r.width, glyph->pixel_width);