Steps to reproduce:

I expect you'll need the 4.9MB file I was using.  I uploaded it here
for debugging purposes:
http://streetgreek.com/files/bhs.txt
I tried the following with non-bidi-Hebrew containing file and
couldn't reproduce the bug.

  using an emacs bzr pull from today:
-------------
$ emacs -Q /path/to/file/bhs.txt
-------------
at this point I already get this error in the Gnome Terminal window
 from which I called Emacs (this comes even if I only run 'emacs -Q')ema:

** (emacs:22720): CRITICAL **: murrine_style_draw_box: assertion
`height >= -1' failed

[now I move around file using PgUp/PgDn, M-S->/< and point moving
commands Sample dribble log attached to this message]

 Emacs crashes with either:
Fatal error (11)Segmentation fault
  or:
Fatal error (6)Aborted

The actual moment of the crash comes with various commands.  Once it was
C-x 3, once it was M-<, once it was a PgUp.  It was always after dozens
of movement commands.  Never right away.  (Hence the length of the
attached dribble log)

The file is a 4.9MB text file in UTF-8 with both Hebrew and English
text.  Note that the final lines of the file set the buffer local variable
'bidi-display-reordering' to 't', since I was testing bidi display.

This is the output of 'locale' on my system:

LANG=en_GB.utf8
LC_CTYPE="en_GB.utf8"
LC_NUMERIC="en_GB.utf8"
LC_TIME="en_GB.utf8"
LC_COLLATE="en_GB.utf8"
LC_MONETARY="en_GB.utf8"
LC_MESSAGES="en_GB.utf8"
LC_PAPER="en_GB.utf8"
LC_NAME="en_GB.utf8"
LC_ADDRESS="en_GB.utf8"
LC_TELEPHONE="en_GB.utf8"
LC_MEASUREMENT="en_GB.utf8"
LC_IDENTIFICATION="en_GB.utf8"
LC_ALL=

The system is Ubuntu 10.4 running Gnome.

I'll give more info if required.

Scot


In GNU Emacs 24.0.50.1 (i686-pc-linux-gnu, GTK+ Version 2.20.0)
 of 2010-05-18 on mayim
Windowing system distributor `The X.Org Foundation', version 11.0.10706000
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_GB.utf8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x b u g <tab> <backspace> <backspace> <backspace>
<backspace> <backspace> <backspace> <backspace> <backspace>
<backspace> <backspace> <backspace> <backspace> <backspace>
<backspace> r e p o r t SPC e m <tab> <return>

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr message sendmail regexp-opt rfc822 mml
easymenu mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231
rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mailabbrev mail-utils
gmm-utils mailheader emacsbug tooltip ediff-hook vc-hooks
lisp-float-type mwheel x-win x-dnd tool-bar dnd fontset image fringe
lisp-mode register page menu-bar rfn-eshadow timer select scroll-bar
mldrag mouse jit-lock font-lock syntax facemenu font-core frame cham
georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese hebrew greek romanian slovak czech european ethiopic
indian cyrillic chinese case-table epa-hook jka-cmpr-hook help simple
abbrev loaddefs button minibuffer faces cus-face files text-properties
overlay md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote make-network-process dbusbind
dynamic-setting font-render-setting gtk x-toolkit x multi-tty emacs)