(Fprimitive_undo): Check veracity of delta,start,end.

2 files changed, 40 insertions, 22 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index a2fed2f37c0..4c628e025aa 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,7 @@
+2005-02-08  Stefan Monnier  <monnier@iro.umontreal.ca>
+
+        * undo.c (Fprimitive_undo): Check veracity of delta,start,end.
+
 2005-02-07  Jan Dj,Ad(Brv  <jan.h.d@swipnet.se>
 
         * xfns.c (Fx_change_window_property): Use long array when format is 32.
@@ -20,7 +24,7 @@
         (Fx_send_client_event): Undo change from 2005-02-05,
         x_fill_property_data now handles that case.
 
-        * xfns.c (Fx_backspace_delete_keys_p): Added comment about the
+        * xfns.c (Fx_backspace_delete_keys_p): Add comment about the
         reason for the approach in the code.
 
 2005-02-07  Kim F. Storm  <storm@cua.dk>
@@ -35,8 +39,7 @@
 
 2005-02-05  Andreas Schwab  <schwab@suse.de>
 
-        * sysdep.c (sys_subshell): Properly terminate execlp argument
-        list.
+        * sysdep.c (sys_subshell): Properly terminate execlp argument list.
 
 2005-02-05  Jan Dj,Ad(Brv  <jan.h.d@swipnet.se>
 
@@ -76,8 +79,7 @@
 
         * macfns.c (x_create_tip_frame): Likewise.
 
-        * macterm.c (mac_draw_string_common, x_make_frame_visible):
-        Likewise.
+        * macterm.c (mac_draw_string_common, x_make_frame_visible): Likewise.
 
 2005-02-03  Richard M. Stallman  <rms@gnu.org>
 
@@ -9955,7 +9957,7 @@
         * search.c (Fmatch_data): Doc fix.  Explicitly state that
         match-data is undefined if last search failed.
 
-        * keymap.c (Fcommand_remapping): Renamed from Fremap_command.
+        * keymap.c (Fcommand_remapping): Rename from Fremap_command.
         All uses changed.
 
 2003-02-12  Juanma Barranquero  <lektu@terra.es>
@@ -10662,7 +10664,7 @@
         selected frame.
 
         * keymap.c (apropos_predicate, apropos_accumulate): Make them static.
-        (syms_of_keymap): staticpro them.
+        (syms_of_keymap): Staticpro them.
         (Fapropos_internal): Initialize them and clear them out.
         Don't GCPRO them.
 
@@ -12764,9 +12766,9 @@
         * fns.c (concat): Likewise.
         * lread.c (read_vector): Likewise.
 
-        * lisp.h (SMBP): Deleted.  All uses changed to STRING_MULTIBYTE.
+        * lisp.h (SMBP): Delete.  All uses changed to STRING_MULTIBYTE.
         (STRING_SET_UNIBYTE): New macro.
-        (SET_STRING_BYTES): Deleted.  Callers (all of which supplied a
+        (SET_STRING_BYTES): Delete.  Callers (all of which supplied a
         length of -1) changed to use STRING_SET_UNIBYTE.
         * abbrev.c, alloc.c, buffer.c, bytecode.c, callint.c, callproc.c,
         casefiddle.c, category.c, ccl.c, charset.c, charset.h, coding.c,
@@ -12809,7 +12811,7 @@
 2002-07-11  Richard M. Stallman  <rms@gnu.org>
 
         * alloc.c (Vmemory_full): New variable.
-        (Vmemory_signal_data): Renamed from memory_signal_data.
+        (Vmemory_signal_data): Rename from memory_signal_data.
         Uses changed.
         (syms_of_alloc): Defvar them.
         (memory_full, buffer_memory_full): Set Vmemory_full.
@@ -12827,7 +12829,7 @@
         (reseat_at_next_visible_line_start, next_element_from_buffer):
         Use `double', not `float', when calling indented_beyond_p.
 
-        * s/hpux11.h (BROKEN_SA_RESTART): Defined.
+        * s/hpux11.h (BROKEN_SA_RESTART): Define.
 
         * sysdep.c (sys_signal): Test BROKEN_SA_RESTART.
 
@@ -13585,7 +13587,7 @@
 
 2002-05-11  Kim F. Storm  <storm@cua.dk>
 
-        * keymap.c (current_minor_maps): Fixed resizing of cmm_maps;
+        * keymap.c (current_minor_maps): Fix resizing of cmm_maps;
         only update cmm_size if realloc actually succeeds.
         Testing with initial size of 2 elements revealed that using
         realloc on GNU/Linux would cause a random trap in xmalloc
@@ -14824,7 +14826,7 @@
 
 2002-02-24  Kim F. Storm  <storm@cua.dk>
 
-        * keymap.c (Flookup_key): Fixed problem in 2001-12-28 patch:
+        * keymap.c (Flookup_key): Fix problem in 2001-12-28 patch:
         The validation of the event type was too strict as it didn't
         allow string events; buffer names are used in bindings for
         menu-bar-select-buffer (see `menu-bar-update-buffers').
@@ -14837,7 +14839,7 @@
         prefix in the keymaps, i.e. [remap COMMAND].
 
         * keymap.c (Qremap, remap_command_vector): New variables.
-        (is_command_symbol): Removed function.
+        (is_command_symbol): Remove function.
         (Fdefine_key): No longer accept a symbol for KEY.
         Added validation of [remap COMMAND] argument for KEY.
         The DEF is no longer required to be a symbol when remapping a command.
@@ -15195,7 +15197,7 @@
         Doc updated.  Callers changed.  Pass arg to where_is_internal.
 
         * keymap.h (Fkey_binding, Fwhere_is_internal): Update prototype.
-        (is_command_symbol): Added prototype.
+        (is_command_symbol): Add prototype.
 
         * keyboard.c (Vthis_original_command): New variable.
         (syms_of_keyboard): DEFVAR_LISP it.
@@ -15612,7 +15614,7 @@
 
 2002-01-03  Kim F. Storm  <storm@cua.dk>
 
-        * keyboard.c (read_key_sequence): Fixed cast of submaps arg to bcopy.
+        * keyboard.c (read_key_sequence): Fix cast of submaps arg to bcopy.
 
 2002-01-02  Richard M. Stallman  <rms@gnu.org>
 
diff --git a/src/undo.c b/src/undo.c
index 5483060eb48..86237e2c59a 100644
--- a/src/undo.c
+++ b/src/undo.c
@@ -556,16 +556,32 @@ Return what remains of the list.  */)
                 }
               else if (EQ (car, Qapply))
                 {
-                  /* Element (apply FUNNAME . ARGS) means call FUNNAME to undo.  */
+                  /* Element (apply FUN . ARGS) means call FUN to undo.  */
                   car = Fcar (cdr);
+                  cdr = Fcdr (cdr);
                   if (INTEGERP (car))
                     {
-                      /* Long format: (apply DELTA START END FUNNAME . ARGS).  */
-                      cdr = Fcdr (Fcdr (Fcdr (cdr)));
-                      car = Fcar (cdr);
+                      /* Long format: (apply DELTA START END FUN . ARGS).  */
+                      Lisp_Object delta = car;
+                      Lisp_Object start = Fcar (cdr);
+                      Lisp_Object end   = Fcar (Fcdr (cdr));
+                      Lisp_Object start_mark = Fcopy_marker (start, Qnil);
+                      Lisp_Object end_mark   = Fcopy_marker (end, Qt);
+
+                      cdr = Fcdr (Fcdr (cdr));
+                      apply1 (Fcar (cdr), Fcdr (cdr));
+
+                      /* Check that the function did what the entry said it
+                         would do.  */
+                      if (!EQ (start, Fmarker_position (start_mark))
+                          || (XINT (delta) + XINT (end)
+                              != marker_position (end_mark)))
+                        error ("Changes to be undone by function different than announced");
+                      Fset_marker (start_mark, Qnil, Qnil);
+                      Fset_marker (end_mark, Qnil, Qnil);
                     }
-                  cdr = Fcdr (cdr);
-                  apply1 (car, cdr);
+                  else
+                    apply1 (car, cdr);
                   did_apply = 1;
                 }
               else if (STRINGP (car) && INTEGERP (cdr))