Not sure if the two are related (I only bumped into the crash today
while creating the recipe for this bug-report), but here it goes.
Create the file foo.ll attached (see below) and then

   % emacs -Q ~/tmp/foo.ll
   [ accept the file-local settings ]
   M->
   C-p C-p C-p

I notice 3 problems:
- After the first C-p the cursor is drawn on the second "\n" of the
  "¶\n\n" display property.  In Emacs-23, the cursor was drawn on the
  "¶".  Not sure if it's longlines-mode which should add a `cursor'
  property, but at least that's a change in behavior w.r.t Emacs-23.
- On the second (and third) C-p, the cursor fails to move.
  AFAICT this bug was already present in Emacs-23.
- If I then hit C-n, I get a crash with the backtrace appended after
  my sig.  I.e. bidi_cache_start is zero upon entry to bidi_pop_it.


        Stefan


#0  abort () at emacs.c:380
#1  0x0817c35a in bidi_pop_it (bidi_it=0xbfffd598) at bidi.c:605
#2  0x08094f82 in pop_it (it=0xbfffcfe0) at xdisp.c:5425
#3  0x080997f6 in set_iterator_to_next (it=0xbfffcfe0, reseat_p=1)
    at xdisp.c:6796
#4  0x0809da7d in move_it_to (it=0xbfffcfe0, to_charpos=-1, to_x=-1, to_y=-1, 
    to_vpos=1, op=4) at xdisp.c:8315
#5  0x0809e475 in move_it_by_lines (it=0xbfffcfe0, dvpos=1) at xdisp.c:8610
#6  0x082e76af in Fvertical_motion (lines=..., window=...) at indent.c:2095
#7  0x083422c0 in Ffuncall (nargs=2, args=0xbfffd9a0) at eval.c:3012
#8  0x083bb78f in exec_byte_code (bytestr=..., vector=..., maxdepth=..., 
    args_template=..., nargs=0, args=0x0) at bytecode.c:785
#9  0x08343545 in funcall_lambda (fun=..., nargs=2, arg_vector=0x5)
    at eval.c:3240
#10 0x08342708 in Ffuncall (nargs=3, args=0xbfffdd40) at eval.c:3058
#11 0x083bb78f in exec_byte_code (bytestr=..., vector=..., maxdepth=..., 
    args_template=..., nargs=0, args=0x0) at bytecode.c:785
#12 0x08343545 in funcall_lambda (fun=..., nargs=4, arg_vector=0x4)
    at eval.c:3240
#13 0x08342708 in Ffuncall (nargs=5, args=0xbfffe0d0) at eval.c:3058
#14 0x083bb78f in exec_byte_code (bytestr=..., vector=..., maxdepth=..., 
    args_template=..., nargs=0, args=0x0) at bytecode.c:785
#15 0x083ba9d6 in Fbyte_code (bytestr=..., vector=..., maxdepth=...)
    at bytecode.c:423
#16 0x0833fd0b in eval_sub (form=...) at eval.c:2363
#17 0x0833cef1 in internal_lisp_condition_case (var=..., bodyform=..., 
    handlers=...) at eval.c:1440
#18 0x083bc489 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., 
    args_template=..., nargs=0, args=0x0) at bytecode.c:981
#19 0x08343545 in funcall_lambda (fun=..., nargs=2, arg_vector=0x6)
    at eval.c:3240
#20 0x08342708 in Ffuncall (nargs=3, args=0xbfffe980) at eval.c:3058
#21 0x083385c4 in Fcall_interactively (function=..., record_flag=..., 
    keys=...) at callint.c:857
#22 0x08342347 in Ffuncall (nargs=4, args=0xbfffec74) at eval.c:3016
#23 0x083415a5 in call3 (fn=..., arg1=..., arg2=..., arg3=...) at eval.c:2809
#24 0x0827cc0d in Fcommand_execute (cmd=..., record_flag=..., keys=..., 
    special=...) at keyboard.c:10274
#25 0x0825c2a5 in command_loop_1 () at keyboard.c:1572
#26 0x0833d028 in internal_condition_case (bfun=0x825b048 <command_loop_1>, 
    handlers=..., hfun=0x825a690 <cmd_error>) at eval.c:1493
#27 0x0825abdf in command_loop_2 (ignore=...) at keyboard.c:1156
#28 0x0833c826 in internal_catch (tag=..., func=0x825abb3 <command_loop_2>, 
    arg=...) at eval.c:1247
#29 0x0825ab88 in command_loop () at keyboard.c:1135
#30 0x08259f82 in recursive_edit_1 () at keyboard.c:756
#31 0x0825a322 in Frecursive_edit () at keyboard.c:820
#32 0x08257a6e in main (argc=3, argv=0xbffff554) at emacs.c:1705

Lisp Backtrace:
"vertical-motion" (0xbfffd9a4)
"line-move-visual" (0xbfffdd44)
"line-move" (0xbfffe0d4)
"byte-code" (0xbfffe388)
"next-line" (0xbfffe984)
"call-interactively" (0xbfffec78)