upstream

102 files changed, 3790 insertions, 2807 deletions

diff --git a/ChangeLog b/ChangeLog
index 55deca05751..dd803790093 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2011-08-26  Jan Djärv  <jan.h.d@swipnet.se>
+
+        * configure.in: Add -MP to DEPFLAGS (Bug#9372).
+
 2011-08-13  Jan Djärv  <jan.h.d@swipnet.se>
 
         * configure.in: Add header check: sys/socket.h (Bug#8477),
diff --git a/autogen/configure b/autogen/configure
index e0de2f2dc33..6a96c3885d0 100755
--- a/autogen/configure
+++ b/autogen/configure
@@ -8974,7 +8974,7 @@ $as_echo "$HAVE_GNU_MAKE" >&6; }
       { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether gcc understands -MMD -MF" >&5
 $as_echo_n "checking whether gcc understands -MMD -MF... " >&6; }
       SAVE_CFLAGS="$CFLAGS"
-      CFLAGS="$CFLAGS -MMD -MF deps.d"
+      CFLAGS="$CFLAGS -MMD -MF deps.d -MP"
       cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
@@ -8999,7 +8999,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 $as_echo "$ac_enable_autodepend" >&6; }
    fi
    if test $ac_enable_autodepend = yes; then
-      DEPFLAGS='-MMD -MF ${DEPDIR}/$*.d'
+      DEPFLAGS='-MMD -MF ${DEPDIR}/$*.d -MP'
       ## In parallel builds, another make might create depdir between
       ## the first test and mkdir, so stick another test on the end.
       ## Or use install-sh -d?  mkdir -p is not portable.
diff --git a/configure.in b/configure.in
index 332c50a01d5..41608f25d19 100644
--- a/configure.in
+++ b/configure.in
@@ -1392,7 +1392,7 @@ if test "$GCC" = yes && test "$ac_enable_autodepend" = yes; then
    if test $HAVE_GNU_MAKE = yes; then
       AC_MSG_CHECKING([whether gcc understands -MMD -MF])
       SAVE_CFLAGS="$CFLAGS"
-      CFLAGS="$CFLAGS -MMD -MF deps.d"
+      CFLAGS="$CFLAGS -MMD -MF deps.d -MP"
       AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[]])], , ac_enable_autodepend=no)
       CFLAGS="$SAVE_CFLAGS"
       test -f deps.d || ac_enable_autodepend=no
@@ -1400,7 +1400,7 @@ if test "$GCC" = yes && test "$ac_enable_autodepend" = yes; then
       AC_MSG_RESULT([$ac_enable_autodepend])
    fi
    if test $ac_enable_autodepend = yes; then
-      DEPFLAGS='-MMD -MF ${DEPDIR}/$*.d'
+      DEPFLAGS='-MMD -MF ${DEPDIR}/$*.d -MP'
       ## In parallel builds, another make might create depdir between
       ## the first test and mkdir, so stick another test on the end.
       ## Or use install-sh -d?  mkdir -p is not portable.
diff --git a/doc/emacs/ChangeLog b/doc/emacs/ChangeLog
index 6874ef75ef8..50eb89fe488 100644
--- a/doc/emacs/ChangeLog
+++ b/doc/emacs/ChangeLog
@@ -1,3 +1,33 @@
+2011-08-27  Eli Zaretskii  <eliz@gnu.org>
+
+        * frames.texi (Frame Commands): Advise setting focus-follows-mouse
+        even on MS-Windows.  Fix a typo.
+
+2011-08-26  Chong Yidong  <cyd@stupidchicken.com>
+
+        * package.texi: New file, documenting the package manager.
+
+        * emacs.texi: Include it.
+
+        * help.texi (Help Summary): Add describe-package.
+
+2011-08-25  Chong Yidong  <cyd@stupidchicken.com>
+
+        * misc.texi (Printing): Convert subnodes into subsections.
+
+        * text.texi (Two-Column): Move into Text chapter.
+
+        * picture-xtra.texi (Picture Mode): Group with Editing Binary
+        Files section.  Convert from chapter into section.
+
+        * display.texi (Narrowing): Move into display chapter.
+
+        * sending.texi (Sending Mail):
+        * rmail.texi (Rmail):
+        * misc.texi (Gnus, Document View):
+        * dired.texi (Dired):
+        * emacs.texi: Group the mail, rmail, and gnus chapters together.
+
 2011-08-07  Juri Linkov  <juri@jurta.org>
 
         * dired.texi (Operating on Files): Rewrite according to the fact
diff --git a/doc/emacs/Makefile.in b/doc/emacs/Makefile.in
index 9465c726eba..66cd7f1d92e 100644
--- a/doc/emacs/Makefile.in
+++ b/doc/emacs/Makefile.in
@@ -96,6 +96,7 @@ EMACSSOURCES= \
         ${srcdir}/dired.texi \
         ${srcdir}/calendar.texi \
         ${srcdir}/misc.texi \
+        ${srcdir}/package.texi \
         ${srcdir}/custom.texi \
         ${srcdir}/trouble.texi \
         ${srcdir}/cmdargs.texi \
diff --git a/doc/emacs/calendar.texi b/doc/emacs/calendar.texi
index 9de223854c1..71a2dba7d08 100644
--- a/doc/emacs/calendar.texi
+++ b/doc/emacs/calendar.texi
@@ -2,7 +2,7 @@
 @c Copyright (C) 1985-1987, 1993-1995, 1997, 2000-2011
 @c   Free Software Foundation, Inc.
 @c See file emacs.texi for copying conditions.
-@node Calendar/Diary, Document View, Dired, Top
+@node Calendar/Diary
 @chapter The Calendar and the Diary
 @cindex calendar
 @findex calendar
diff --git a/doc/emacs/custom.texi b/doc/emacs/custom.texi
index 6a6d465438d..a22d6c1f5dd 100644
--- a/doc/emacs/custom.texi
+++ b/doc/emacs/custom.texi
@@ -2,7 +2,7 @@
 @c Copyright (C) 1985-1987, 1993-1995, 1997, 2000-2011
 @c   Free Software Foundation, Inc.
 @c See file emacs.texi for copying conditions.
-@node Customization, Quitting, Amusements, Top
+@node Customization
 @chapter Customization
 @cindex customization
 
diff --git a/doc/emacs/dired.texi b/doc/emacs/dired.texi
index 80ccd1d10f9..d536547e293 100644
--- a/doc/emacs/dired.texi
+++ b/doc/emacs/dired.texi
@@ -2,7 +2,7 @@
 @c Copyright (C) 1985-1987, 1993-1995, 1997, 2000-2011
 @c   Free Software Foundation, Inc.
 @c See file emacs.texi for copying conditions.
-@node Dired, Calendar/Diary, Rmail, Top
+@node Dired
 @chapter Dired, the Directory Editor
 @c This node is referenced in the tutorial.  When renaming or deleting
 @c it, the tutorial needs to be adjusted.
diff --git a/doc/emacs/display.texi b/doc/emacs/display.texi
index bfbfb355c9c..cc7f70cf574 100644
--- a/doc/emacs/display.texi
+++ b/doc/emacs/display.texi
@@ -15,6 +15,8 @@ want to see, and how to display it.
 * Scrolling::              Commands to move text up and down in a window.
 * Auto Scrolling::         Redisplay scrolls text automatically when needed.
 * Horizontal Scrolling::   Moving text left and right in a window.
+* Narrowing::              Restricting display and editing to a portion
+                             of the buffer.
 * Follow Mode::            Follow mode lets two windows scroll as one.
 * Faces::                  How to change the display style using faces.
 * Standard Faces::         Emacs' predefined faces.
@@ -300,6 +302,72 @@ a lower bound for automatic horizontal scrolling.  Automatic scrolling
 will continue to scroll the window, but never farther to the right
 than the amount you previously set by @code{scroll-left}.
 
+@node Narrowing
+@section Narrowing
+@cindex widening
+@cindex restriction
+@cindex narrowing
+@cindex accessible portion
+
+  @dfn{Narrowing} means focusing in on some portion of the buffer,
+making the rest temporarily inaccessible.  The portion which you can
+still get to is called the @dfn{accessible portion}.  Canceling the
+narrowing, which makes the entire buffer once again accessible, is
+called @dfn{widening}.  The bounds of narrowing in effect in a buffer
+are called the buffer's @dfn{restriction}.
+
+  Narrowing can make it easier to concentrate on a single subroutine or
+paragraph by eliminating clutter.  It can also be used to limit the
+range of operation of a replace command or repeating keyboard macro.
+
+@table @kbd
+@item C-x n n
+Narrow down to between point and mark (@code{narrow-to-region}).
+@item C-x n w
+Widen to make the entire buffer accessible again (@code{widen}).
+@item C-x n p
+Narrow down to the current page (@code{narrow-to-page}).
+@item C-x n d
+Narrow down to the current defun (@code{narrow-to-defun}).
+@end table
+
+  When you have narrowed down to a part of the buffer, that part appears
+to be all there is.  You can't see the rest, you can't move into it
+(motion commands won't go outside the accessible part), you can't change
+it in any way.  However, it is not gone, and if you save the file all
+the inaccessible text will be saved.  The word @samp{Narrow} appears in
+the mode line whenever narrowing is in effect.
+
+@kindex C-x n n
+@findex narrow-to-region
+  The primary narrowing command is @kbd{C-x n n} (@code{narrow-to-region}).
+It sets the current buffer's restrictions so that the text in the current
+region remains accessible, but all text before the region or after the
+region is inaccessible.  Point and mark do not change.
+
+@kindex C-x n p
+@findex narrow-to-page
+@kindex C-x n d
+@findex narrow-to-defun
+  Alternatively, use @kbd{C-x n p} (@code{narrow-to-page}) to narrow
+down to the current page.  @xref{Pages}, for the definition of a page.
+@kbd{C-x n d} (@code{narrow-to-defun}) narrows down to the defun
+containing point (@pxref{Defuns}).
+
+@kindex C-x n w
+@findex widen
+  The way to cancel narrowing is to widen with @kbd{C-x n w}
+(@code{widen}).  This makes all text in the buffer accessible again.
+
+  You can get information on what part of the buffer you are narrowed down
+to using the @kbd{C-x =} command.  @xref{Position Info}.
+
+  Because narrowing can easily confuse users who do not understand it,
+@code{narrow-to-region} is normally a disabled command.  Attempting to use
+this command asks for confirmation and gives you the option of enabling it;
+if you enable the command, confirmation will no longer be required for
+it.  @xref{Disabling}.
+
 @node Follow Mode
 @section Follow Mode
 @cindex Follow mode
diff --git a/doc/emacs/emacs.texi b/doc/emacs/emacs.texi
index e8fb42db0bb..060f939fa7a 100644
--- a/doc/emacs/emacs.texi
+++ b/doc/emacs/emacs.texi
@@ -187,39 +187,32 @@ Major Structures of Emacs
 Advanced Features
 * Modes::               Major and minor modes alter Emacs' basic behavior.
 * Indentation::         Editing the white space at the beginnings of lines.
-* Text::                Commands and modes for editing English.
+* Text::                Commands and modes for editing human languages.
 * Programs::            Commands and modes for editing programs.
 * Building::            Compiling, running and debugging programs.
 * Maintaining::         Features for maintaining large programs.
 * Abbrevs::             Defining text abbreviations to reduce
                           the number of characters you must type.
-@c AFAICS, the tex stuff generates its own index and does not use this one.
-@ifnottex
-* Picture Mode::        Editing pictures made up of characters using
-                          the quarter-plane screen model.
-@end ifnottex
+* Dired::               Directory and file manager.
+* Calendar/Diary::      Calendar and diary facilities.
 * Sending Mail::        Sending mail in Emacs.
 * Rmail::               Reading mail in Emacs.
-* Dired::               You can "edit" a directory to manage files in it.
-* Calendar/Diary::      The calendar and diary facilities.
-* Document View::       Viewing PDF, PS and DVI files.
 * Gnus::                A flexible mail and news reader.
+* Document View::       Viewing PDF, PS and DVI files.
 * Shell::               Executing shell commands from Emacs.
 * Emacs Server::        Using Emacs as an editing server.
 * Printing::            Printing hardcopies of buffers or regions.
 * Sorting::             Sorting lines, paragraphs or pages within Emacs.
-* Narrowing::           Restricting display and editing to a portion
-                          of the buffer.
-* Two-Column::          Splitting apart columns to edit them
-                          in side-by-side windows.
-* Editing Binary Files::Using Hexl mode to edit binary files.
+@ifnottex
+* Picture Mode::        Editing pictures made up of text characters.
+@end ifnottex
+* Editing Binary Files:: Editing binary files with Hexl mode.
 * Saving Emacs Sessions:: Saving Emacs state from one session to the next.
-* Recursive Edit::      A command can allow you to do editing
-                          "within the command".  This is called a
-                          "recursive editing level".
+* Recursive Edit::      Performing edits while "within another command".
 * Emulation::           Emulating some other editors with Emacs.
 * Hyperlinking::        Following links in buffers.
 * Amusements::          Various games and hacks.
+* Packages::            Installing additional features.
 * Customization::       Modifying the behavior of Emacs.
 
 Recovery from Problems
@@ -350,6 +343,8 @@ Controlling the Display
 * Scrolling::              Commands to move text up and down in a window.
 * Auto Scrolling::         Redisplay scrolls text automatically when needed.
 * Horizontal Scrolling::   Moving text left and right in a window.
+* Narrowing::              Restricting display and editing to a portion
+                             of the buffer.
 * Follow Mode::            Follow mode lets two windows scroll as one.
 * Faces::                  How to change the display style using faces.
 * Standard Faces::         Emacs' predefined faces.
@@ -577,6 +572,7 @@ Commands for Human Languages
 * Nroff Mode::          Editing input to the formatter nroff.
 * Formatted Text::      Editing formatted text directly in WYSIWYG fashion.
 * Text Based Tables::   Editing text-based tables in WYSIWYG fashion.
+* Two-Column::          Splitting text columns into separate windows.
 
 Filling Text
 
@@ -885,52 +881,6 @@ Editing Pictures
 * Rectangles in Picture:: Clearing and superimposing rectangles.
 @end ifnottex
 
-Sending Mail
-
-* Mail Format::         Format of the mail being composed.
-* Mail Headers::        Details of some standard mail header fields.
-* Mail Aliases::        Abbreviating and grouping mail addresses.
-* Mail Commands::       Special commands for editing mail being composed.
-* Mail Signature::      Adding a signature to every message.
-* Mail Amusements::     Distracting the NSA; adding fortune messages.
-* Mail Methods::        Using alternative mail-composition methods.
-
-Mail Commands
-
-* Mail Sending::        Commands to send the message.
-* Header Editing::      Commands to move to header fields and edit them.
-* Citing Mail::         Quoting a message you are replying to.
-* Mail Misc::           Attachments, spell checking, etc.
-
-Reading Mail with Rmail
-
-* Rmail Basics::        Basic concepts of Rmail, and simple use.
-* Rmail Scrolling::     Scrolling through a message.
-* Rmail Motion::        Moving to another message.
-* Rmail Deletion::      Deleting and expunging messages.
-* Rmail Inbox::         How mail gets into the Rmail file.
-* Rmail Files::         Using multiple Rmail files.
-* Rmail Output::        Copying message out to files.
-* Rmail Labels::        Classifying messages by labeling them.
-* Rmail Attributes::    Certain standard labels, called attributes.
-* Rmail Reply::         Sending replies to messages you are viewing.
-* Rmail Summary::       Summaries show brief info on many messages.
-* Rmail Sorting::       Sorting messages in Rmail.
-* Rmail Display::       How Rmail displays a message; customization.
-* Rmail Coding::        How Rmail handles decoding character sets.
-* Rmail Editing::       Editing message text and headers in Rmail.
-* Rmail Digest::        Extracting the messages from a digest message.
-* Rmail Rot13::         Reading messages encoded in the rot13 code.
-* Movemail::            More details of fetching new mail.
-* Remote Mailboxes::    Retrieving mail from remote mailboxes.
-* Other Mailbox Formats:: Retrieving mail from local mailboxes in
-                          various formats.
-
-Summaries
-
-* Rmail Make Summary::       Making various sorts of summaries.
-* Rmail Summary Edit::       Manipulating messages from the summary.
-
 Dired, the Directory Editor
 
 * Dired Enter::              How to invoke Dired.
@@ -1014,6 +964,52 @@ Document Viewing
 * Slicing::     Specifying which part of pages should be displayed.
 * Conversion::  Influencing and triggering conversion.
 
+Sending Mail
+
+* Mail Format::         Format of the mail being composed.
+* Mail Headers::        Details of some standard mail header fields.
+* Mail Aliases::        Abbreviating and grouping mail addresses.
+* Mail Commands::       Special commands for editing mail being composed.
+* Mail Signature::      Adding a signature to every message.
+* Mail Amusements::     Distracting the NSA; adding fortune messages.
+* Mail Methods::        Using alternative mail-composition methods.
+
+Mail Commands
+
+* Mail Sending::        Commands to send the message.
+* Header Editing::      Commands to move to header fields and edit them.
+* Citing Mail::         Quoting a message you are replying to.
+* Mail Misc::           Attachments, spell checking, etc.
+
+Reading Mail with Rmail
+
+* Rmail Basics::        Basic concepts of Rmail, and simple use.
+* Rmail Scrolling::     Scrolling through a message.
+* Rmail Motion::        Moving to another message.
+* Rmail Deletion::      Deleting and expunging messages.
+* Rmail Inbox::         How mail gets into the Rmail file.
+* Rmail Files::         Using multiple Rmail files.
+* Rmail Output::        Copying message out to files.
+* Rmail Labels::        Classifying messages by labeling them.
+* Rmail Attributes::    Certain standard labels, called attributes.
+* Rmail Reply::         Sending replies to messages you are viewing.
+* Rmail Summary::       Summaries show brief info on many messages.
+* Rmail Sorting::       Sorting messages in Rmail.
+* Rmail Display::       How Rmail displays a message; customization.
+* Rmail Coding::        How Rmail handles decoding character sets.
+* Rmail Editing::       Editing message text and headers in Rmail.
+* Rmail Digest::        Extracting the messages from a digest message.
+* Rmail Rot13::         Reading messages encoded in the rot13 code.
+* Movemail::            More details of fetching new mail.
+* Remote Mailboxes::    Retrieving mail from remote mailboxes.
+* Other Mailbox Formats:: Retrieving mail from local mailboxes in
+                          various formats.
+
+Rmail Summaries
+
+* Rmail Make Summary::       Making various sorts of summaries.
+* Rmail Summary Edit::       Manipulating messages from the summary.
+
 Gnus
 
 * Buffers of Gnus::     The group, summary, and article buffers.
@@ -1494,16 +1490,15 @@ Lisp programming.
 @c Includes vc1-xtra, emerge-xtra.
 @include maintaining.texi
 @include abbrevs.texi
-@ifnottex
-@include picture-xtra.texi
-@end ifnottex
-@include sending.texi
-@include rmail.texi
 @c Includes dired-xtra.
 @include dired.texi
 @c Includes cal-xtra.
 @include calendar.texi
+@include sending.texi
+@include rmail.texi
+@c Includes picture-xtra.texi
 @include misc.texi
+@include package.texi
 @include custom.texi
 @include trouble.texi
 
diff --git a/doc/emacs/frames.texi b/doc/emacs/frames.texi
index b9b56670988..328deaec357 100644
--- a/doc/emacs/frames.texi
+++ b/doc/emacs/frames.texi
@@ -467,12 +467,14 @@ for Emacs to detect this automatically, so you should set the variable
 @code{focus-follows-mouse}.  The default is @code{nil}, meaning you
 have to click on the window to select it (the default for most modern
 window managers).  You should change it to @code{t} if your window
-manager selects and window and gives it focus anytime you move the
-mouse onto the window.
+manager selects a window and gives it focus anytime you move the mouse
+onto the window.
 
   The window manager that is part of MS-Windows always gives focus to
 a frame that raises, so this variable has no effect in the native
-MS-Windows build of Emacs.
+MS-Windows build of Emacs.  However, you may still wish to set this
+variable to @code{t} to have Emacs automatically move the mouse
+pointer to the raised frame.
 
 @node Fonts
 @section Fonts
diff --git a/doc/emacs/help.texi b/doc/emacs/help.texi
index 9a75bfb1887..bf93892c0db 100644
--- a/doc/emacs/help.texi
+++ b/doc/emacs/help.texi
@@ -126,16 +126,20 @@ The complete Emacs manual is available on-line in Info.
 Display the name and documentation of the command that @var{key} runs
 (@code{describe-key}).
 @item C-h l
-Display a description of your last 300 keystrokes 
+Display a description of your last 300 keystrokes
 (@code{view-lossage}).
 @item C-h m
 Display documentation of the current major mode (@code{describe-mode}).
 @item C-h n
 Display news of recent Emacs changes (@code{view-emacs-news}).
 @item C-h p
-Find packages by topic keyword (@code{finder-by-keyword}).  For an
-alternative interface to the same information, try the @code{info-finder}
-command.
+Find packages by topic keyword (@code{finder-by-keyword}).  This lists
+packages using a package menu buffer (@pxref{Package Menu}); for an
+alternative interface to the same information, try the
+@code{info-finder} command.
+@item C-h P @var{package} @key{RET}
+Display documentation about the package named @var{package}
+(@code{describe-package}; @pxref{Packages}).
 @item C-h r
 Display the Emacs manual in Info (@code{info-emacs-manual}).
 @item C-h s
diff --git a/doc/emacs/makefile.w32-in b/doc/emacs/makefile.w32-in
index 4064f4ef6a3..e128a50ebd3 100644
--- a/doc/emacs/makefile.w32-in
+++ b/doc/emacs/makefile.w32-in
@@ -88,6 +88,7 @@ EMACSSOURCES= \
         $(srcdir)/dired.texi \
         $(srcdir)/calendar.texi \
         $(srcdir)/misc.texi \
+        $(srcdir)/package.texi \
         $(srcdir)/custom.texi \
         $(srcdir)/trouble.texi \
         $(srcdir)/cmdargs.texi \
diff --git a/doc/emacs/misc.texi b/doc/emacs/misc.texi
index 426610e65b9..2dab70c512a 100644
--- a/doc/emacs/misc.texi
+++ b/doc/emacs/misc.texi
@@ -10,9 +10,9 @@ else: viewing ``document files'', reading netnews, running shell
 commands and shell subprocesses, using a single shared Emacs for
 utilities that expect to run an editor as a subprocess, printing
 hardcopy, sorting text, narrowing display to part of the buffer,
-editing double-column files and binary files, saving an Emacs session
-for later resumption, following hyperlinks, browsing images, emulating
-other editors, and various diversions and amusements.
+editing binary files, saving an Emacs session for later resumption,
+following hyperlinks, browsing images, emulating other editors, and
+various diversions and amusements.
 
 @end iftex
 
@@ -20,187 +20,7 @@ other editors, and various diversions and amusements.
 @raisesections
 @end ifnottex
 
-@node Document View, Gnus, Calendar/Diary, Top
-@section Document Viewing
-@cindex DVI file
-@cindex PDF file
-@cindex PS file
-@cindex Postscript file
-@cindex OpenDocument file
-@cindex Microsoft Office file
-@cindex DocView mode
-@cindex mode, DocView
-@cindex document viewer (DocView)
-@findex doc-view-mode
-
-DocView mode (@code{doc-view-mode}) is a viewer for DVI, Postscript
-(PS), PDF, OpenDocument, and Microsoft Office documents.  It provides
-features such as slicing, zooming, and searching inside documents.  It
-works by converting the document to a set of images using the
-@command{gs} (GhostScript) command and other external tools
-@footnote{@code{gs} is a hard requirement.  For DVI files,
-@code{dvipdf} or @code{dvipdfm} is needed.  For OpenDocument and
-Microsoft Office documents, the @code{unoconv} tool is needed.}, and
-displaying those images.
-
-@findex doc-view-toggle-display
-@findex doc-view-toggle-display
-@cindex doc-view-minor-mode
-  When you visit a document file with the exception of Postscript
-files, Emacs automatically switches to DocView mode if possible
-@footnote{The needed external tools for this document type have to be
-available, emacs needs to run in a graphical frame, and PNG image
-support has to be compiled into emacs.  If any of these requirements
-is not fulfilled, DocView falls back to an appropriate mode.}.  When
-you visit a Postscript file, Emacs switches to PS mode, a major mode
-for editing Postscript files as text; however, it also enables DocView
-minor mode, so you can type @kbd{C-c C-c} to view the document with
-DocView.  (PDF and DVI files, unlike Postscript files, are not usually
-human-editable.)  In either case, repeating @kbd{C-c C-c}
-(@code{doc-view-toggle-display}) toggles between DocView and the file
-text.
-
-  You can explicitly toggle DocView mode with the command @code{M-x
-doc-view-mode}, and DocView minor mode with the command @code{M-x
-doc-view-minor-mode}.
-
-  When DocView mode starts, it displays a welcome screen and begins
-formatting the file, page by page.  It displays the first page once
-that has been formatted.
-
-@findex doc-view-enlarge
-@findex doc-view-shrink
-@vindex doc-view-resolution
-  When in DocView mode, you can enlarge or shrink the document with
-@kbd{+} (@code{doc-view-enlarge}) and @kbd{-}
-(@code{doc-view-shrink}).  To specify the default size for DocView,
-set or customize the variable @code{doc-view-resolution}.
-
-  To kill the DocView buffer, type @kbd{k}
-(@code{doc-view-kill-proc-and-buffer}).  To bury it, type @kbd{q}
-(@code{quit-window}).
-
-@menu
-* Navigation::  Navigation inside DocView buffers.
-* Searching::   Searching inside documents.
-* Slicing::     Specifying which part of pages should be displayed.
-* Conversion::  Influencing and triggering conversion.
-@end menu
-
-@node Navigation
-@subsection Navigation
-
-When in DocView mode, you can scroll the current page using the usual
-Emacs movement keys: @kbd{C-p}, @kbd{C-n}, @kbd{C-b}, @kbd{C-f}, and
-the arrow keys.
-
-@vindex doc-view-continuous
-  By default, the line-motion keys @kbd{C-p} and @kbd{C-n} stop
-scrolling at the beginning and end of the current page, respectively.
-However, if you change the variable @code{doc-view-continuous} to a
-non-@code{nil} value, then @kbd{C-p} displays the previous page if you
-are already at the beginning of the current page, and @kbd{C-n}
-displays the next page if you are at the end of the current page.
-
-@findex doc-view-next-page
-@findex doc-view-previous-page
-  You can also display the next page by typing @kbd{n}, @key{next} or
-@kbd{C-x ]} (@code{doc-view-next-page}).  To display the previous
-page, type @kbd{p}, @key{prior} or @kbd{C-x [}
-(@code{doc-view-previous-page}).
-
-@findex doc-view-scroll-up-or-next-page
-@findex doc-view-scroll-down-or-previous-page
-  The @key{SPC} (@code{doc-view-scroll-up-or-next-page}) key is a
-convenient way to advance through the document.  It scrolls within the
-current page or advances to the next.  @key{DEL} moves backwards in a
-similar way (@code{doc-view-scroll-down-or-previous-page}).
-
-@findex doc-view-first-page
-@findex doc-view-last-page
-@findex doc-view-goto-page
-  To go to the first page, type @kbd{M-<}
-(@code{doc-view-first-page}); to go to the last one, type @kbd{M->}
-(@code{doc-view-last-page}).  To jump to a page by its number, type
-@kbd{M-g M-g} or @kbd{M-g g} (@code{doc-view-goto-page}).
-
-@node Searching
-@subsection Searching
-
-While in DocView mode, you can search the file's text for a regular
-expression (@pxref{Regexps}).  The interface for searching is inspired
-by @code{isearch} (@pxref{Incremental Search}).
-
-@findex doc-view-search
-@findex doc-view-search-backward
-@findex doc-view-show-tooltip
-  To begin a search, type @kbd{C-s} (@code{doc-view-search}) or
-@kbd{C-r} (@code{doc-view-search-backward}).  This reads a regular
-expression using a minibuffer, then echoes the number of matches found
-within the document.  You can move forward and back among the matches
-by typing @kbd{C-s} and @kbd{C-r}.  DocView mode has no way to show
-the match inside the page image; instead, it displays a tooltip (at
-the mouse position) listing all matching lines in the current page.
-To force display of this tooltip, type @kbd{C-t}
-(@code{doc-view-show-tooltip}).
-
-  To start a new search, use the search command with a prefix
-argument; i.e., @kbd{C-u C-s} for a forward search or @kbd{C-u C-r}
-for a backward search.
-
-@node Slicing
-@subsection Slicing
-
-Documents often have wide margins for printing.  They are annoying
-when reading the document on the screen, because they use up screen
-space and can cause inconvenient scrolling.
-
-@findex doc-view-set-slice
-@findex doc-view-set-slice-using-mouse
-  With DocView you can hide these margins by selecting a @dfn{slice}
-of pages to display.  A slice is a rectangle within the page area;
-once you specify a slice in DocView, it applies to whichever page you
-look at.
-
-  To specify the slice numerically, type @kbd{s s}
-(@code{doc-view-set-slice}); then enter the top left pixel position
-and the slice's width and height.
-@c ??? how does this work?
-                
-  A more convenient graphical way to specify the slice is with @kbd{s
-m} (@code{doc-view-set-slice-using-mouse}), where you use the mouse to
-select the slice.
-@c ??? How does this work?
-
-@findex doc-view-reset-slice
-  To cancel the selected slice, type @kbd{s r}
-(@code{doc-view-reset-slice}).  Then DocView shows the entire page
-including its entire margins.
-
-@node Conversion
-@subsection Conversion
-
-@vindex doc-view-cache-directory
-@findex doc-view-clear-cache
-For efficiency, DocView caches the images produced by @command{gs}.
-The name of this directory is given by the variable
-@code{doc-view-cache-directory}.  You can clear the cache directory by
-typing @code{M-x doc-view-clear-cache}.
-
-@findex doc-view-kill-proc
-@findex doc-view-kill-proc-and-buffer
-  To force a reconversion of the currently viewed document, type
-@kbd{r} or @kbd{g} (@code{revert-buffer}).  To kill the converter
-process associated with the current buffer, type @kbd{K}
-(@code{doc-view-kill-proc}).  The command @kbd{k}
-(@code{doc-view-kill-proc-and-buffer}) kills the converter process and
-the DocView buffer.
-
-  The zoom commands @kbd{+} (@code{doc-view-enlarge}) and @kbd{-}
-(@code{doc-view-shrink}) need to reconvert the document at the new
-size.  The current page is converted first.
-
-@node Gnus, Shell, Document View, Top
+@node Gnus
 @section Gnus
 @cindex Gnus
 @cindex reading netnews
@@ -411,82 +231,187 @@ for @var{regexp}.
 
 @end table
 
-@ignore
-@node Where to Look
-@subsection Where to Look Further
+@node Document View
+@section Document Viewing
+@cindex DVI file
+@cindex PDF file
+@cindex PS file
+@cindex Postscript file
+@cindex OpenDocument file
+@cindex Microsoft Office file
+@cindex DocView mode
+@cindex mode, DocView
+@cindex document viewer (DocView)
+@findex doc-view-mode
 
-@c Too many references to the name of the manual if done with xref in TeX!
-Gnus is powerful and customizable.  Here are references to a few
-@ifnottex
-additional topics:
+DocView mode (@code{doc-view-mode}) is a viewer for DVI, Postscript
+(PS), PDF, OpenDocument, and Microsoft Office documents.  It provides
+features such as slicing, zooming, and searching inside documents.  It
+works by converting the document to a set of images using the
+@command{gs} (GhostScript) command and other external tools
+@footnote{@code{gs} is a hard requirement.  For DVI files,
+@code{dvipdf} or @code{dvipdfm} is needed.  For OpenDocument and
+Microsoft Office documents, the @code{unoconv} tool is needed.}, and
+displaying those images.
 
-@end ifnottex
-@iftex
-additional topics in @cite{The Gnus Manual}:
+@findex doc-view-toggle-display
+@findex doc-view-toggle-display
+@cindex doc-view-minor-mode
+  When you visit a document file with the exception of Postscript
+files, Emacs automatically switches to DocView mode if possible
+@footnote{The needed external tools for this document type have to be
+available, emacs needs to run in a graphical frame, and PNG image
+support has to be compiled into emacs.  If any of these requirements
+is not fulfilled, DocView falls back to an appropriate mode.}.  When
+you visit a Postscript file, Emacs switches to PS mode, a major mode
+for editing Postscript files as text; however, it also enables DocView
+minor mode, so you can type @kbd{C-c C-c} to view the document with
+DocView.  (PDF and DVI files, unlike Postscript files, are not usually
+human-editable.)  In either case, repeating @kbd{C-c C-c}
+(@code{doc-view-toggle-display}) toggles between DocView and the file
+text.
 
-@itemize @bullet
-@item
-Follow discussions on specific topics.@*
-See section ``Threading.''
+  You can explicitly toggle DocView mode with the command @code{M-x
+doc-view-mode}, and DocView minor mode with the command @code{M-x
+doc-view-minor-mode}.
 
-@item
-Read digests.  See section ``Document Groups.''
+  When DocView mode starts, it displays a welcome screen and begins
+formatting the file, page by page.  It displays the first page once
+that has been formatted.
 
-@item
-Refer to and jump to the parent of the current article.@*
-See section ``Finding the Parent.''
+@findex doc-view-enlarge
+@findex doc-view-shrink
+@vindex doc-view-resolution
+  When in DocView mode, you can enlarge or shrink the document with
+@kbd{+} (@code{doc-view-enlarge}) and @kbd{-}
+(@code{doc-view-shrink}).  To specify the default size for DocView,
+set or customize the variable @code{doc-view-resolution}.
 
-@item
-Refer to articles by using Message-IDs included in the messages.@*
-See section ``Article Keymap.''
+  To kill the DocView buffer, type @kbd{k}
+(@code{doc-view-kill-proc-and-buffer}).  To bury it, type @kbd{q}
+(@code{quit-window}).
 
-@item
-Save articles.  See section ``Saving Articles.''
+@menu
+* Navigation::  Navigation inside DocView buffers.
+* Searching::   Searching inside documents.
+* Slicing::     Specifying which part of pages should be displayed.
+* Conversion::  Influencing and triggering conversion.
+@end menu
 
-@item
-Have Gnus score articles according to various criteria, like author
-name, subject, or string in the body of the articles.@*
-See section ``Scoring.''
+@node Navigation
+@subsection Navigation
 
-@item
-Send an article to a newsgroup.@*
-See section ``Composing Messages.''
-@end itemize
-@end iftex
-@ifnottex
-@itemize @bullet
-@item
-Follow discussions on specific topics.@*
-@xref{Threading, , Reading Based on Conversation Threads,
-gnus, The Gnus Manual}.
+When in DocView mode, you can scroll the current page using the usual
+Emacs movement keys: @kbd{C-p}, @kbd{C-n}, @kbd{C-b}, @kbd{C-f}, and
+the arrow keys.
 
-@item
-Read digests. @xref{Document Groups, , , gnus, The Gnus Manual}.
+@vindex doc-view-continuous
+  By default, the line-motion keys @kbd{C-p} and @kbd{C-n} stop
+scrolling at the beginning and end of the current page, respectively.
+However, if you change the variable @code{doc-view-continuous} to a
+non-@code{nil} value, then @kbd{C-p} displays the previous page if you
+are already at the beginning of the current page, and @kbd{C-n}
+displays the next page if you are at the end of the current page.
 
-@item
-Refer to and jump to the parent of the current article.@*
-@xref{Finding the Parent, , , gnus, The Gnus Manual}.
+@findex doc-view-next-page
+@findex doc-view-previous-page
+  You can also display the next page by typing @kbd{n}, @key{next} or
+@kbd{C-x ]} (@code{doc-view-next-page}).  To display the previous
+page, type @kbd{p}, @key{prior} or @kbd{C-x [}
+(@code{doc-view-previous-page}).
 
-@item
-Refer to articles by using Message-IDs included in the messages.@*
-@xref{Article Keymap, , , gnus, The Gnus Manual}.
+@findex doc-view-scroll-up-or-next-page
+@findex doc-view-scroll-down-or-previous-page
+  The @key{SPC} (@code{doc-view-scroll-up-or-next-page}) key is a
+convenient way to advance through the document.  It scrolls within the
+current page or advances to the next.  @key{DEL} moves backwards in a
+similar way (@code{doc-view-scroll-down-or-previous-page}).
 
-@item
-Save articles. @xref{Saving Articles, , , gnus, The Gnus Manual}.
+@findex doc-view-first-page
+@findex doc-view-last-page
+@findex doc-view-goto-page
+  To go to the first page, type @kbd{M-<}
+(@code{doc-view-first-page}); to go to the last one, type @kbd{M->}
+(@code{doc-view-last-page}).  To jump to a page by its number, type
+@kbd{M-g M-g} or @kbd{M-g g} (@code{doc-view-goto-page}).
 
-@item
-Have Gnus score articles according to various criteria, like author
-name, subject, or string in the body of the articles.@*
-@xref{Scoring, , , gnus, The Gnus Manual}.
+@node Searching
+@subsection Searching
 
-@item
-Send an article to a newsgroup.@*
-@xref{Composing Messages, , , gnus, The Gnus Manual}.
-@end itemize
-@end ifnottex
-@end ignore
+While in DocView mode, you can search the file's text for a regular
+expression (@pxref{Regexps}).  The interface for searching is inspired
+by @code{isearch} (@pxref{Incremental Search}).
+
+@findex doc-view-search
+@findex doc-view-search-backward
+@findex doc-view-show-tooltip
+  To begin a search, type @kbd{C-s} (@code{doc-view-search}) or
+@kbd{C-r} (@code{doc-view-search-backward}).  This reads a regular
+expression using a minibuffer, then echoes the number of matches found
+within the document.  You can move forward and back among the matches
+by typing @kbd{C-s} and @kbd{C-r}.  DocView mode has no way to show
+the match inside the page image; instead, it displays a tooltip (at
+the mouse position) listing all matching lines in the current page.
+To force display of this tooltip, type @kbd{C-t}
+(@code{doc-view-show-tooltip}).
+
+  To start a new search, use the search command with a prefix
+argument; i.e., @kbd{C-u C-s} for a forward search or @kbd{C-u C-r}
+for a backward search.
+
+@node Slicing
+@subsection Slicing
+
+Documents often have wide margins for printing.  They are annoying
+when reading the document on the screen, because they use up screen
+space and can cause inconvenient scrolling.
+
+@findex doc-view-set-slice
+@findex doc-view-set-slice-using-mouse
+  With DocView you can hide these margins by selecting a @dfn{slice}
+of pages to display.  A slice is a rectangle within the page area;
+once you specify a slice in DocView, it applies to whichever page you
+look at.
+
+  To specify the slice numerically, type @kbd{s s}
+(@code{doc-view-set-slice}); then enter the top left pixel position
+and the slice's width and height.
+@c ??? how does this work?
+
+  A more convenient graphical way to specify the slice is with @kbd{s
+m} (@code{doc-view-set-slice-using-mouse}), where you use the mouse to
+select the slice.
+@c ??? How does this work?
+
+@findex doc-view-reset-slice
+  To cancel the selected slice, type @kbd{s r}
+(@code{doc-view-reset-slice}).  Then DocView shows the entire page
+including its entire margins.
+
+@node Conversion
+@subsection Conversion
+
+@vindex doc-view-cache-directory
+@findex doc-view-clear-cache
+For efficiency, DocView caches the images produced by @command{gs}.
+The name of this directory is given by the variable
+@code{doc-view-cache-directory}.  You can clear the cache directory by
+typing @code{M-x doc-view-clear-cache}.
 
-@node Shell, Emacs Server, Gnus, Top
+@findex doc-view-kill-proc
+@findex doc-view-kill-proc-and-buffer
+  To force a reconversion of the currently viewed document, type
+@kbd{r} or @kbd{g} (@code{revert-buffer}).  To kill the converter
+process associated with the current buffer, type @kbd{K}
+(@code{doc-view-kill-proc}).  The command @kbd{k}
+(@code{doc-view-kill-proc-and-buffer}) kills the converter process and
+the DocView buffer.
+
+  The zoom commands @kbd{+} (@code{doc-view-enlarge}) and @kbd{-}
+(@code{doc-view-shrink}) need to reconvert the document at the new
+size.  The current page is converted first.
+
+@node Shell
 @section Running Shell Commands from Emacs
 @cindex subshell
 @cindex shell commands
@@ -1788,7 +1713,7 @@ not compatible with @code{lpr}.
 @end menu
 
 @node PostScript, PostScript Variables,, Printing
-@section PostScript Hardcopy
+@subsection PostScript Hardcopy
 
   These commands convert buffer contents to PostScript,
 either printing it or leaving it in another Emacs buffer.
@@ -1878,7 +1803,7 @@ supports ISO 8859-1 characters.
 @end ifnottex
 
 @node PostScript Variables, Printing Package, PostScript, Printing
-@section Variables for PostScript Hardcopy
+@subsection Variables for PostScript Hardcopy
 
 @vindex ps-lpr-command
 @vindex ps-lpr-switches
@@ -1973,7 +1898,7 @@ includes a single directory @file{/usr/local/share/emacs/fonts/bdf}.
 described in the Lisp files @file{ps-print.el} and @file{ps-mule.el}.
 
 @node Printing Package,, PostScript Variables, Printing
-@section Printing Package
+@subsection Printing Package
 @cindex Printing package
 
   The basic Emacs facilities for printing hardcopy can be extended
@@ -1999,7 +1924,7 @@ to print, you start the print job using the @samp{Print} button (click
 further information on the various options, use the @samp{Interface
 Help} button.
 
-@node Sorting, Narrowing, Printing, Top
+@node Sorting
 @section Sorting Text
 @cindex sorting
 
@@ -2134,163 +2059,13 @@ rectangle moves along with the text inside the rectangle.
   Many of the sort commands ignore case differences when comparing, if
 @code{sort-fold-case} is non-@code{nil}.
 
-@node Narrowing, Two-Column, Sorting, Top
-@section Narrowing
-@cindex widening
-@cindex restriction
-@cindex narrowing
-@cindex accessible portion
-
-  @dfn{Narrowing} means focusing in on some portion of the buffer,
-making the rest temporarily inaccessible.  The portion which you can
-still get to is called the @dfn{accessible portion}.  Canceling the
-narrowing, which makes the entire buffer once again accessible, is
-called @dfn{widening}.  The bounds of narrowing in effect in a buffer
-are called the buffer's @dfn{restriction}.
-
-  Narrowing can make it easier to concentrate on a single subroutine or
-paragraph by eliminating clutter.  It can also be used to limit the
-range of operation of a replace command or repeating keyboard macro.
-
-@table @kbd
-@item C-x n n
-Narrow down to between point and mark (@code{narrow-to-region}).
-@item C-x n w
-Widen to make the entire buffer accessible again (@code{widen}).
-@item C-x n p
-Narrow down to the current page (@code{narrow-to-page}).
-@item C-x n d
-Narrow down to the current defun (@code{narrow-to-defun}).
-@end table
-
-  When you have narrowed down to a part of the buffer, that part appears
-to be all there is.  You can't see the rest, you can't move into it
-(motion commands won't go outside the accessible part), you can't change
-it in any way.  However, it is not gone, and if you save the file all
-the inaccessible text will be saved.  The word @samp{Narrow} appears in
-the mode line whenever narrowing is in effect.
-
-@kindex C-x n n
-@findex narrow-to-region
-  The primary narrowing command is @kbd{C-x n n} (@code{narrow-to-region}).
-It sets the current buffer's restrictions so that the text in the current
-region remains accessible, but all text before the region or after the
-region is inaccessible.  Point and mark do not change.
-
-@kindex C-x n p
-@findex narrow-to-page
-@kindex C-x n d
-@findex narrow-to-defun
-  Alternatively, use @kbd{C-x n p} (@code{narrow-to-page}) to narrow
-down to the current page.  @xref{Pages}, for the definition of a page.
-@kbd{C-x n d} (@code{narrow-to-defun}) narrows down to the defun
-containing point (@pxref{Defuns}).
-
-@kindex C-x n w
-@findex widen
-  The way to cancel narrowing is to widen with @kbd{C-x n w}
-(@code{widen}).  This makes all text in the buffer accessible again.
-
-  You can get information on what part of the buffer you are narrowed down
-to using the @kbd{C-x =} command.  @xref{Position Info}.
-
-  Because narrowing can easily confuse users who do not understand it,
-@code{narrow-to-region} is normally a disabled command.  Attempting to use
-this command asks for confirmation and gives you the option of enabling it;
-if you enable the command, confirmation will no longer be required for
-it.  @xref{Disabling}.
-
-@node Two-Column, Editing Binary Files, Narrowing, Top
-@section Two-Column Editing
-@cindex two-column editing
-@cindex splitting columns
-@cindex columns, splitting
-
-  Two-column mode lets you conveniently edit two side-by-side columns of
-text.  It uses two side-by-side windows, each showing its own
-buffer.
-
-  There are three ways to enter two-column mode:
+@c Picture Mode documentation
+@ifnottex
+@include picture-xtra.texi
+@end ifnottex
 
-@table @asis
-@item @kbd{@key{F2} 2} or @kbd{C-x 6 2}
-@kindex F2 2
-@kindex C-x 6 2
-@findex 2C-two-columns
-Enter two-column mode with the current buffer on the left, and on the
-right, a buffer whose name is based on the current buffer's name
-(@code{2C-two-columns}).  If the right-hand buffer doesn't already
-exist, it starts out empty; the current buffer's contents are not
-changed.
-
-This command is appropriate when the current buffer is empty or contains
-just one column and you want to add another column.
-
-@item @kbd{@key{F2} s} or @kbd{C-x 6 s}
-@kindex F2 s
-@kindex C-x 6 s
-@findex 2C-split
-Split the current buffer, which contains two-column text, into two
-buffers, and display them side by side (@code{2C-split}).  The current
-buffer becomes the left-hand buffer, but the text in the right-hand
-column is moved into the right-hand buffer.  The current column
-specifies the split point.  Splitting starts with the current line and
-continues to the end of the buffer.
-
-This command is appropriate when you have a buffer that already contains
-two-column text, and you wish to separate the columns temporarily.
-
-@item @kbd{@key{F2} b @var{buffer} @key{RET}}
-@itemx @kbd{C-x 6 b @var{buffer} @key{RET}}
-@kindex F2 b
-@kindex C-x 6 b
-@findex 2C-associate-buffer
-Enter two-column mode using the current buffer as the left-hand buffer,
-and using buffer @var{buffer} as the right-hand buffer
-(@code{2C-associate-buffer}).
-@end table
 
-  @kbd{@key{F2} s} or @kbd{C-x 6 s} looks for a column separator, which
-is a string that appears on each line between the two columns.  You can
-specify the width of the separator with a numeric argument to
-@kbd{@key{F2} s}; that many characters, before point, constitute the
-separator string.  By default, the width is 1, so the column separator
-is the character before point.
-
-  When a line has the separator at the proper place, @kbd{@key{F2} s}
-puts the text after the separator into the right-hand buffer, and
-deletes the separator.  Lines that don't have the column separator at
-the proper place remain unsplit; they stay in the left-hand buffer, and
-the right-hand buffer gets an empty line to correspond.  (This is the
-way to write a line that ``spans both columns while in two-column
-mode'': write it in the left-hand buffer, and put an empty line in the
-right-hand buffer.)
-
-@kindex F2 RET
-@kindex C-x 6 RET
-@findex 2C-newline
-  The command @kbd{C-x 6 @key{RET}} or @kbd{@key{F2} @key{RET}}
-(@code{2C-newline}) inserts a newline in each of the two buffers at
-corresponding positions.  This is the easiest way to add a new line to
-the two-column text while editing it in split buffers.
-
-@kindex F2 1
-@kindex C-x 6 1
-@findex 2C-merge
-  When you have edited both buffers as you wish, merge them with
-@kbd{@key{F2} 1} or @kbd{C-x 6 1} (@code{2C-merge}).  This copies the
-text from the right-hand buffer as a second column in the other buffer.
-To go back to two-column editing, use @kbd{@key{F2} s}.
-
-@kindex F2 d
-@kindex C-x 6 d
-@findex 2C-dissociate
-  Use @kbd{@key{F2} d} or @kbd{C-x 6 d} to dissociate the two buffers,
-leaving each as it stands (@code{2C-dissociate}).  If the other buffer,
-the one not current when you type @kbd{@key{F2} d}, is empty,
-@kbd{@key{F2} d} kills it.
-
-@node Editing Binary Files, Saving Emacs Sessions, Two-Column, Top
+@node Editing Binary Files
 @section Editing Binary Files
 
 @cindex Hexl mode
@@ -2738,7 +2513,7 @@ Display a menu of files and URLs mentioned in current buffer, then
 find the one you select (@code{ffap-menu}).
 @end table
 
-@node Amusements, Customization, Hyperlinking, Top
+@node Amusements, Packages, Hyperlinking, Top
 @section Other Amusements
 @cindex boredom
 
diff --git a/doc/emacs/package.texi b/doc/emacs/package.texi
new file mode 100644
index 00000000000..739a8ce6c65
--- /dev/null
+++ b/doc/emacs/package.texi
@@ -0,0 +1,230 @@
+@c This is part of the Emacs manual.
+@c Copyright (C) 1985-1987, 1993-1995, 1997, 2000-2011
+@c   Free Software Foundation, Inc.
+@c See file emacs.texi for copying conditions.
+@node Packages
+@chapter Emacs Lisp Packages
+@cindex Package
+@cindex Emacs Lisp package archive
+@cindex Package archive
+@cindex Emacs Lisp package
+
+Emacs includes a facility that lets you easily download and install
+@dfn{packages} that implement additional features.  Each package is a
+separate Emacs Lisp program, sometimes including other components such
+as an Info manual.
+
+  @kbd{M-x list-packages} brings up a buffer named @samp{*Packages*}
+with a list of all packages.  You can install or uninstall packages
+via this buffer.  @xref{Package Menu}.
+
+@findex describe-package
+  The command @kbd{C-h P} (@code{describe-package}) prompts for the
+name of a package, and displays a help buffer describing that
+attributes of the package and the features that it implements.
+
+  By default, Emacs downloads packages from a @dfn{package archive}
+maintained by the Emacs developers and hosted by the GNU project.
+Optionally, you can also download packages from archives maintained by
+third parties.  @xref{Package Installation}.
+
+  For information about turning an Emacs Lisp program into an
+installable package, @xref{Packaging,,,elisp, The Emacs Lisp Reference
+Manual}.  For information about finding third-party packages and other
+Emacs Lisp extensions, @xref{Packages that do not come with
+Emacs,,,efaq, GNU Emacs FAQ}.
+
+@menu
+* Package Menu::         Buffer for viewing and managing packages.
+* Package Installation:: Options for package installation.
+* Package Files::        Where packages are installed.
+@end menu
+
+@node Package Menu
+@section The Package Menu Buffer
+@cindex package menu
+@cindex built-in package
+@findex list-packages
+
+The command @kbd{M-x list-packages} brings up the @dfn{package menu}.
+This is a buffer listing all the packages that Emacs knows about, one
+on each line, with the following information:
+
+@itemize @bullet
+@item
+The package name (e.g. @samp{auctex}).
+
+@item
+The package's version number (e.g. @samp{11.86}).
+
+@item
+The package's status---normally one of @samp{available} (can be
+downloaded from the package archive), @samp{installed}, or
+@samp{built-in} (included in Emacs by default).
+
+In some instances, the status can be @samp{held}, @samp{disabled}, or
+@samp{obsolete}.  @xref{Package Installation}.
+
+@item
+A short description of the package.
+@end itemize
+
+@noindent
+The @code{list-packages} command accesses the network, to retrieve the
+list of available packages from the package archive server.  If the
+network is unavailable, it falls back on the most recently retrieved
+list.
+
+The following commands are available in the package menu:
+
+@table @kbd
+@item h
+Print a short message summarizing how to use the package menu
+(@code{package-menu-quick-help}).
+
+@item ?
+@itemx @key{RET}
+Display a help buffer for the package on the current line
+(@code{package-menu-describe-package}), similar to the help window
+displayed by the @kbd{C-h P} command (@pxref{Packages}).
+
+@item i
+Mark the package on the current line for installation
+(@code{package-menu-mark-install}).  If the package status is
+@samp{available}, this adds an @samp{I} character to the start of the
+line; typing @kbd{x} (see below) will download and install the
+package.
+
+@item d
+Mark the package on the current line for deletion
+(@code{package-menu-mark-delete}).  If the package status is
+@samp{installed}, this adds a @samp{D} character to the start of the
+line; typing @kbd{x} (see below) will delete the package.
+@xref{Package Files}, for information about what package deletion
+entails.
+
+@item u
+Remove any installation or deletion mark previously added to the
+current line by an @kbd{i} or @kbd{d} command.
+
+@item x
+Download and install all packages marked with @kbd{i}, and their
+dependencies; also, delete all packages marked with @kbd{d}
+(@code{package-menu-execute}).  This also removes the marks.
+
+@item r
+Refresh the package list (@code{package-menu-refresh}).  This also
+retrieves the list of available packages from the package archive
+again.
+@end table
+
+@noindent
+For example, you can install a package by typing @kbd{i} on the line
+listing that package, followed by @kbd{x}.
+
+@node Package Installation
+@section Package Installation
+
+@findex package-install
+  Packages are most conveniently installed using the package menu
+(@pxref{Package Menu}), but you can also use the command @kbd{M-x
+package-install}.  This prompts for the name of a package with the
+@samp{available} status, then downloads and installs it.
+
+@cindex package requirements
+  A package may @dfn{require} certain other packages to be installed,
+because it relies on functionality provided by them.  When Emacs
+installs such a package, it also automatically downloads and installs
+any required package that is not already installed.  (If a required
+package is somehow unavailable, Emacs signals an error and stops
+installation.)  A package's requirements list is shown in its help
+buffer.
+
+@vindex package-archives
+  By default, packages are downloaded from a single package archive
+maintained by the Emacs developers.  This is controlled by the
+variable @code{package-archives}, whose value is a list of package
+archives known to Emacs.  Each list element must have the form
+@code{(@var{id} . @var{location})}, where @var{id} is the name of a
+package archive and @var{location} is the @acronym{HTTP} address or
+directory name of the package archive.  You can alter this list if you
+wish to use third party package archives---but do so at your own risk,
+and use only third parties that you think you can trust!
+
+  Once a package is downloaded and installed, it takes effect in the
+current Emacs session.  What ``taking effect'' means depends on the
+package; most packages just make some new commands available, while
+others have more wide-ranging effects on the Emacs session.  For such
+information, consult the package's help buffer.
+
+  By default, Emacs also automatically loads all installed packages
+(causing them to ``take effect'') in subsequent Emacs sessions.  This
+happens at startup, after processing the init file (@pxref{Init
+File}).  As an exception, Emacs does not load packages at startup if
+invoked with the @samp{-q} or @samp{--no-init-file} options
+(@pxref{Initial Options}).
+
+@vindex package-enable-at-startup
+@findex package-initialize
+  To disable automatic package loading, change the variable
+@code{package-enable-at-startup} to @code{nil}.  If you do this, you
+can use the command @kbd{M-x package-initialize} to load your
+packages.
+
+@vindex package-load-list
+  For finer control over package loading, you can use the variable
+@code{package-load-list}.  Its value should be a list.  A list element
+of the form @code{(@var{name} @var{version})} tells Emacs to load
+version @var{version} of the package named @var{name}.  Here,
+@var{version} should be a version string (corresponding to a specific
+version of the package), or @code{t} (which means to load any
+installed version), or @code{nil} (which means no version; this
+``disables'' the package, preventing it from being loaded).  A list
+element can also be the symbol @code{all}, which means to load the
+latest installed version of any package not named by the other list
+elements.  The default value is just @code{'(all)}.
+
+  For example, if you set @code{package-load-list} to @code{'((muse
+"3.20") all)}, then Emacs only loads version 3.20 of the @samp{muse}
+package, plus any installed version of packages other than
+@samp{muse}.  Any other version of @samp{muse} that happens to be
+installed will be ignored.  The @samp{muse} package will be listed in
+the package menu with the @samp{held} status.
+
+@node Package Files
+@section Package Files and Directory Layout
+@cindex package directory
+
+@cindex package file
+@findex package-install-file
+  Each package is downloaded from the package archive in the form of a
+single @dfn{package file}---either an Emacs Lisp source file, or a tar
+file containing multiple Emacs Lisp source and other files.  Package
+files are automatically retrieved, processed, and disposed of by the
+Emacs commands that install packages.  Normally, you will not need to
+deal directly with them, unless you are making a package
+(@pxref{Packaging,,,elisp, The Emacs Lisp Reference Manual}).  Should
+you ever need to install a package directly from a package file, use
+the command @kbd{M-x package-install-file}.
+
+@vindex package-user-dir
+  Once installed, the contents of a package are placed in a
+subdirectory of @file{~/.emacs.d/elpa/} (you can change the name of
+that directory by changing the variable @code{package-user-dir}).  The
+package subdirectory is named @file{@var{name}-@var{version}}, where
+@var{name} is the package name and @var{version} is its version
+string.
+
+@cindex system-wide packages
+@vindex package-directory-list
+  In addition to @code{package-user-dir}, Emacs looks for installed
+packages in the directories listed in @code{package-directory-list}.
+These directories are meant for system administrators to make Emacs
+packages available system-wide; Emacs itself never installs packages
+there.  The package subdirectories for @code{package-directory-list}
+are laid out in the same way as in @code{package-user-dir}.
+
+  Deleting a package (@pxref{Package Menu}) involves deleting the
+corresponding package subdirectory.  This only works for packages
+installed in @code{package-user-dir}; if told to act on a package in a
+system-wide package directory, the deletion command signals an error.
diff --git a/doc/emacs/picture-xtra.texi b/doc/emacs/picture-xtra.texi
index 0dcfc7a9627..43a2dbc4704 100644
--- a/doc/emacs/picture-xtra.texi
+++ b/doc/emacs/picture-xtra.texi
@@ -5,7 +5,7 @@
 @c This file is included either in emacs-xtra.texi (when producing the
 @c printed version) or in the main Emacs manual (for the on-line version).
 @node Picture Mode
-@chapter Editing Pictures
+@section Editing Pictures
 @cindex pictures
 @cindex making pictures out of text characters
 @findex picture-mode
@@ -59,7 +59,7 @@ Additional extensions to Picture mode can be found in
 @end menu
 
 @node Basic Picture
-@section Basic Editing in Picture Mode
+@subsection Basic Editing in Picture Mode
 
 @findex picture-forward-column
 @findex picture-backward-column
@@ -124,7 +124,7 @@ modes), or one of the picture rectangle commands (@pxref{Rectangles in
 Picture}).
 
 @node Insert in Picture
-@section Controlling Motion after Insert
+@subsection Controlling Motion after Insert
 
 @findex picture-movement-up
 @findex picture-movement-down
@@ -188,7 +188,7 @@ same direction as motion after ``insertion'' currently does, while @kbd{C-c
 C-b} (@code{picture-motion-reverse}) moves in the opposite direction.
 
 @node Tabs in Picture
-@section Picture Mode Tabs
+@subsection Picture Mode Tabs
 
 @kindex M-TAB @r{(Picture mode)}
 @findex picture-tab-search
@@ -228,7 +228,7 @@ up the picture.  You can do this by setting the variable
 @code{indent-tabs-mode} to @code{nil}.
 
 @node Rectangles in Picture
-@section Picture Mode Rectangle Commands
+@subsection Picture Mode Rectangle Commands
 @cindex rectangles and Picture mode
 @cindex Picture mode and rectangles
 
diff --git a/doc/emacs/rmail.texi b/doc/emacs/rmail.texi
index ad22ae921e0..0a9594d3798 100644
--- a/doc/emacs/rmail.texi
+++ b/doc/emacs/rmail.texi
@@ -2,7 +2,7 @@
 @c Copyright (C) 1985-1987, 1993-1995, 1997, 2001-2011
 @c   Free Software Foundation, Inc.
 @c See file emacs.texi for copying conditions.
-@node Rmail, Dired, Sending Mail, Top
+@node Rmail
 @chapter Reading Mail with Rmail
 @cindex Rmail
 @cindex reading mail
diff --git a/doc/emacs/text.texi b/doc/emacs/text.texi
index e3f5c05d8da..0b0e4867ae5 100644
--- a/doc/emacs/text.texi
+++ b/doc/emacs/text.texi
@@ -70,6 +70,7 @@ for editing such pictures.
 * Nroff Mode::          Editing input to the formatter nroff.
 * Formatted Text::      Editing formatted text directly in WYSIWYG fashion.
 * Text Based Tables::   Editing text-based tables in WYSIWYG fashion.
+* Two-Column::          Splitting text columns into separate windows.
 @end menu
 
 @node Words
@@ -2837,3 +2838,93 @@ then inserts the generated table in the proper syntax into the
 destination buffer.  The default destination buffer is
 @code{table.@var{lang}}, where @var{lang} is the language you
 specified.
+
+@node Two-Column
+@section Two-Column Editing
+@cindex two-column editing
+@cindex splitting columns
+@cindex columns, splitting
+
+  Two-column mode lets you conveniently edit two side-by-side columns of
+text.  It uses two side-by-side windows, each showing its own
+buffer.
+
+  There are three ways to enter two-column mode:
+
+@table @asis
+@item @kbd{@key{F2} 2} or @kbd{C-x 6 2}
+@kindex F2 2
+@kindex C-x 6 2
+@findex 2C-two-columns
+Enter two-column mode with the current buffer on the left, and on the
+right, a buffer whose name is based on the current buffer's name
+(@code{2C-two-columns}).  If the right-hand buffer doesn't already
+exist, it starts out empty; the current buffer's contents are not
+changed.
+
+This command is appropriate when the current buffer is empty or contains
+just one column and you want to add another column.
+
+@item @kbd{@key{F2} s} or @kbd{C-x 6 s}
+@kindex F2 s
+@kindex C-x 6 s
+@findex 2C-split
+Split the current buffer, which contains two-column text, into two
+buffers, and display them side by side (@code{2C-split}).  The current
+buffer becomes the left-hand buffer, but the text in the right-hand
+column is moved into the right-hand buffer.  The current column
+specifies the split point.  Splitting starts with the current line and
+continues to the end of the buffer.
+
+This command is appropriate when you have a buffer that already contains
+two-column text, and you wish to separate the columns temporarily.
+
+@item @kbd{@key{F2} b @var{buffer} @key{RET}}
+@itemx @kbd{C-x 6 b @var{buffer} @key{RET}}
+@kindex F2 b
+@kindex C-x 6 b
+@findex 2C-associate-buffer
+Enter two-column mode using the current buffer as the left-hand buffer,
+and using buffer @var{buffer} as the right-hand buffer
+(@code{2C-associate-buffer}).
+@end table
+
+  @kbd{@key{F2} s} or @kbd{C-x 6 s} looks for a column separator, which
+is a string that appears on each line between the two columns.  You can
+specify the width of the separator with a numeric argument to
+@kbd{@key{F2} s}; that many characters, before point, constitute the
+separator string.  By default, the width is 1, so the column separator
+is the character before point.
+
+  When a line has the separator at the proper place, @kbd{@key{F2} s}
+puts the text after the separator into the right-hand buffer, and
+deletes the separator.  Lines that don't have the column separator at
+the proper place remain unsplit; they stay in the left-hand buffer, and
+the right-hand buffer gets an empty line to correspond.  (This is the
+way to write a line that ``spans both columns while in two-column
+mode'': write it in the left-hand buffer, and put an empty line in the
+right-hand buffer.)
+
+@kindex F2 RET
+@kindex C-x 6 RET
+@findex 2C-newline
+  The command @kbd{C-x 6 @key{RET}} or @kbd{@key{F2} @key{RET}}
+(@code{2C-newline}) inserts a newline in each of the two buffers at
+corresponding positions.  This is the easiest way to add a new line to
+the two-column text while editing it in split buffers.
+
+@kindex F2 1
+@kindex C-x 6 1
+@findex 2C-merge
+  When you have edited both buffers as you wish, merge them with
+@kbd{@key{F2} 1} or @kbd{C-x 6 1} (@code{2C-merge}).  This copies the
+text from the right-hand buffer as a second column in the other buffer.
+To go back to two-column editing, use @kbd{@key{F2} s}.
+
+@kindex F2 d
+@kindex C-x 6 d
+@findex 2C-dissociate
+  Use @kbd{@key{F2} d} or @kbd{C-x 6 d} to dissociate the two buffers,
+leaving each as it stands (@code{2C-dissociate}).  If the other buffer,
+the one not current when you type @kbd{@key{F2} d}, is empty,
+@kbd{@key{F2} d} kills it.
diff --git a/doc/emacs/trouble.texi b/doc/emacs/trouble.texi
index 4be892639fc..fd06dde5174 100644
--- a/doc/emacs/trouble.texi
+++ b/doc/emacs/trouble.texi
@@ -15,7 +15,7 @@ also considered.
 @raisesections
 @end ifnottex
 
-@node Quitting, Lossage, Customization, Top
+@node Quitting
 @section Quitting and Aborting
 @cindex quitting
 
diff --git a/doc/lispref/ChangeLog b/doc/lispref/ChangeLog
index 4bf615328b1..ca9c93b563d 100644
--- a/doc/lispref/ChangeLog
+++ b/doc/lispref/ChangeLog
@@ -1,3 +1,10 @@
+2011-08-25  Eli Zaretskii  <eliz@gnu.org>
+
+        * display.texi (Specified Space): Mention that `space' specs
+        influence bidi reordering.
+        (Bidirectional Display): Explain how to use `(space . PROPS)' for
+        separating fields with bidirectional content.
+
 2011-08-24  Eli Zaretskii  <eliz@gnu.org>
 
         * display.texi (Bidirectional Display): Document return value in
diff --git a/doc/lispref/display.texi b/doc/lispref/display.texi
index 0593eba8f05..bf7cd126a26 100644
--- a/doc/lispref/display.texi
+++ b/doc/lispref/display.texi
@@ -3794,6 +3794,10 @@ with a @dfn{pixel ascent} specification (@pxref{Pixel Specification}).
 non-graphic terminals, but the other space properties in this section
 are not.
 
+  Note that space properties are treated as paragraph separators for
+the purposes of reordering bidirectional text for display.
+@xref{Bidirectional Display}, for the details.
+
 @node Pixel Specification
 @subsection Pixel Specification for Spaces
 @cindex spaces, pixel specification
@@ -6126,8 +6130,8 @@ with bidirectional content can be displayed @emph{to the left} of the
 preceding field, producing a jumbled display and messing up the
 expected layout.
 
-  To countermand this, you can use one of the following techniques for
-forcing correct order of fields on display:
+  To countermand this, we recommend that you use one of the following
+techniques for forcing correct order of fields on display:
 
 @itemize @minus
 @item
@@ -6146,6 +6150,15 @@ Include the tab character in the field separator.  The tab character
 plays the role of @dfn{segment separator} in the @acronym{UBA}
 reordering, whose effect is to make each field a separate segment, and
 thus reorder them separately.
+
+@cindex @code{space} display spec, and bidirectional text
+@item
+Separate fields with a @code{display} property or overlay with the
+property value of the form @code{(space . PROPS)} (@pxref{Specified
+Space}).  This display specification is treated by Emacs as a
+@dfn{paragraph separator}; the text before and after the separator is
+reordered separately, which avoids the influence of any field on its
+neighboring fields.
 @end itemize
 
 @defun bidi-string-mark-left-to-right string
diff --git a/etc/NEWS b/etc/NEWS
index cec19d0c0a2..4d5d19c2eb7 100644
--- a/etc/NEWS
+++ b/etc/NEWS
@@ -55,6 +55,18 @@ With it, Emacs integers typically have 62 bits, even on 32-bit machines.
 Type `C-u C-h t' to choose it in case your language setup doesn't
 automatically select it.
 
+** Emacs can be compiled with support for the ImageMagick library.
+Emacs links to ImageMagick if version 6.2.8 or newer of the library is
+present at build time.  To disable ImageMagick support, use the
+`--without-imagemagick' configure option.
+
+** The standalone programs digest-doc and sorted-doc are removed.
+Emacs now uses Lisp commands `doc-file-to-man' and `doc-file-to-info'.
+
+---
+** The standalone program `fakemail' is removed.
+If you need it, feedmail.el provides a superset of the functionality.
+
 
 * Startup Changes in Emacs 24.1
 
@@ -74,27 +86,7 @@ and also when HOME is set to C:\ by default.
 
 * Changes in Emacs 24.1
 
-** The inactive minibuffer has its own major mode `minibuffer-inactive-mode'.
-This is handy for minibuffer-only frames, and is also used for the "mouse-1
-pops up *Messages*" feature, which can now easily be changed.
-
-** emacsclient changes
-
-+++
-*** New emacsclient argument --parent-id ID can be used to open a
-client frame in parent X window ID, via XEmbed.  This works like the
---parent-id argument to Emacs.
-
-+++
-*** New emacsclient argument -q/--quiet suppresses some status messages.
-
-+++
-*** New emacsclient argument --frame-parameters can be used to set the
-frame parameters of a newly-created graphical frame.
-
-+++
-*** If emacsclient shuts down as a result of Emacs signalling an
-error, its exit status is 1.
+** auto-mode-case-fold is now enabled by default.
 
 ** Completion
 
@@ -121,128 +113,130 @@ and pops down the *Completions* buffer accordingly.
 Instead, the bindings in minibuffer-local-filename-completion-map are combined
 with minibuffer-local-must-match-map.
 
-** auto-mode-case-fold is now enabled by default.
-
 ** Mail changes
 
-The default of `send-mail-function' has changed from
-`sendmail-send-it' (on GNU/Linux and other Unix-like systems) or
-`mailclient-send-it' (on Windows) to `sendmail-query-once'.  This new
-default will ask the user (once) whether to use the internal smtpmail
-package to send email, or to use the old, external defaults.
+The default of `send-mail-function' is now `sendmail-query-once',
+which asks the user (once) whether to use the smtpmail package to send
+email, or to use the old defaults that rely on external mail
+facilities (`sendmail-send-it' on GNU/Linux and other Unix-like
+systems, and `mailclient-send-it' on Windows).
 
-** smtpmail changes
+*** smtpmail changes
 
-*** smtpmail has been largely rewritten to upgrade to STARTTLS if
-possible, and uses the auth-source framework for getting credentials.
-The rewrite should be largely compatible with previous versions of
-smtpmail, but there are two major incompatibilities:
+**** smtpmail now uses encrypted connections (via STARTTLS) if the
+mail server supports them.  It also uses the auth-source framework for
+getting credentials.
 
-*** `smtpmail-auth-credentials' no longer exists.  That variable used
-to be be either ~/.authinfo (in which case you won't see any
-difference), but if it were a direct list of user names and passwords,
-it will be ignored, and you will be prompted for the user name and the
-password instead.  They will then be saved to ~/.authinfo.
+**** The variable `smtpmail-auth-credentials' has been removed.
+That variable used to have the default value "~/.authinfo", in which
+case you won't see any difference.  But if you changed it to be a list
+of user names and passwords, that setting is now ignored; you will be
+prompted for the user name and the password, which will then be saved
+to ~/.authinfo.
 
-If you wish to copy over all the credentials from
-`smtpmail-auth-credentials' to your ~/.authinfo file manually, instead
-of letting smtpmail prompt you for these values, that's also possible.
+You can also manually copy the credentials to your ~/.authinfo file.
+For example, if you had
 
-If you had, for instance,
-
-(setq smtpmail-auth-credentials
-      '(("mail.example.org" 25 "jim" "s!cret")))
+  (setq smtpmail-auth-credentials
+        '(("mail.example.org" 25 "jim" "s!cret")))
 
 then the equivalent line in ~/.authinfo would be
 
-machine mail.example.org port 25 login jim password s!cret
+  machine mail.example.org port 25 login jim password s!cret
+
+**** The variable `smtpmail-starttls-credentials' has been removed.
 
-*** Similarly, `smtpmail-starttls-credentials' no longer exists.  If
-you had that set, then then you need to put
+If you had that set, then then you need to put
 
-machine smtp.whatever.foo port 25 key "~/.my_smtp_tls.key" cert
-"~/.my_smtp_tls.cert"
+  machine smtp.whatever.foo port 25 key "~/.my_smtp_tls.key" cert "~/.my_smtp_tls.cert"
 
 in your ~/.authinfo file instead.
 
+** Emacs server and client changes
+
+*** New option `server-port' specifies the port on which the Emacs
+server should listen.
++++
+*** New emacsclient argument -q/--quiet suppresses some status messages.
++++
+*** New emacsclient argument --frame-parameters can be used to set the
+frame parameters of a newly-created graphical frame.
++++
+*** If emacsclient shuts down as a result of Emacs signalling an
+error, its exit status is 1.
++++
+*** New emacsclient argument --parent-id ID.
+This opens a client frame in parent X window ID, via XEmbed, similar
+to the --parent-id argument to Emacs.
+
 ** Internationalization changes
 
 +++
 *** Emacs now supports display and editing of bidirectional text.
 
-See the node "Bidirectional Editing" in the Emacs Manual for some
-additional documentation.
-
-To turn this off in any given buffer, set the buffer-local variable
-`bidi-display-reordering' to a nil value.  The default is t.  For text
-that includes no right-to-left characters, the result of reordering
-looks exactly as it did in previous versions, i.e. there's no
-reordering at all.
+Text that includes characters from right-to-left (RTL) scripts, such
+as Arabic, Farsi, or Hebrew, is displayed in the correct visual order
+as expected by users of those scripts.  This display reordering is a
+"Full bidirectionality" class implementation of the Unicode
+Bidirectional Algorithm.  Buffers RTL text should look exactly the
+same as before.
 
-The buffer-local variable `bidi-paragraph-direction', if non-nil,
-forces each paragraph in the buffer to have its base direction
-according to the value of this variable.  Possible values are
-`right-to-left' and `left-to-right'.  If the value is nil (the
-default), Emacs determines the base direction of each paragraph from
-its text, as specified by the Unicode Bidirectional Algorithm.
+For more information, see the node "Bidirectional Editing" in the
+Emacs Manual.
 
-The function `current-bidi-paragraph-direction' returns the actual
-value of paragraph base direction at point.
++++
+**** New buffer-local variable `bidi-display-reordering'.
+To disable display reordering in any given buffer, change this to nil.
 
-Reordering of bidirectional text for display in Emacs is a "Full
-bidirectionality" class implementation of the Unicode Bidirectional
++++
+**** New buffer-local variable `bidi-paragraph-direction'.
+If nil (the default), Emacs determines the base direction of each
+paragraph from its text, as specified by the Unicode Bidirectional
 Algorithm.
 
+Setting this to `right-to-left' or `left-to-right' forces a particular
+base direction on each paragraph in the buffer.
+
+Paragraphs whose base direction is right-to-left are displayed
+starting at the right margin of the window.
+
 +++
-*** Enhanced support for characters that have no glyphs in available fonts.
-If a character has no glyphs in any of the available fonts, Emacs by
-default will display it either as a hexadecimal code in a box or as a
+*** Enhanced support for characters with no glyphs in available fonts.
+If a character has no glyphs in any of the available fonts, Emacs
+normally displays it either as a hexadecimal code in a box or as a
 thin 1-pixel space.  In addition to these two methods, Emacs can
 display these characters as empty box, as an acronym, or not display
 them at all.  To change how these characters are displayed, customize
 the variable `glyphless-char-display-control'.
 
-On character terminals these methods are used for characters that
+On character terminals, these methods are used for characters that
 cannot be encoded by the `terminal-coding-system'.
 
-*** There are two new input methods for Persian/Farsi: farsi and farsi-translit.
+*** New input methods for Farsi: farsi and farsi-translit.
+
+** Improved GTK integration
 
-** GTK scroll-bars are now placed on the right by default.
+*** GTK scroll-bars are now placed on the right by default.
 Use `set-scroll-bar-mode' to change this.
 
-** GTK tool bars can have just text, just images or images and text.
+*** GTK tool bars can have just text, just images or images and text.
 Customize `tool-bar-style' to choose style.  On a Gnome desktop, the default
 is taken from the desktop settings.
 
-** GTK tool bars can be placed on the left/right or top/bottom of the frame.
+*** GTK tool bars can be placed on the left/right or top/bottom of the frame.
 The frame-parameter tool-bar-position controls this.  It takes the values
 top, left, right or bottom.  The Options => Show/Hide menu has entries
 for this.
 
-** ImageMagick support.
-It is now possible to use the ImageMagick library to load many new
-image formats in Emacs.  By default, Emacs links with the ImageMagick
-libraries if they are present at build time.  This needs ImageMagick
-6.2.8 or newer (versions newer than 6.0.7 _may_ work but have not been
-tested).  To disable ImageMagick support, use the configure option
-`--without-imagemagick'.
-
-The new function `imagemagick-types' returns a list of image file
-extensions that your installation of ImageMagick supports.  The
-function `imagemagick-register-types' enables ImageMagick support for
-these image types, minus those listed in `imagemagick-types-inhibit'.
+*** The colors for selected text (the region face) are taken from the GTK
+theme when Emacs is built with GTK.
 
-See the Emacs Lisp Reference Manual for more information.
+*** Emacs uses GTK tooltips by default if built with GTK.  You can turn that
+off by customizing x-gtk-use-system-tooltips.
 
 ** New basic faces `error', `warning', `success' are available to
 highlight strings that indicate failure, caution or successful operation.
 
-** The colors for selected text (the region face) are taken from the GTK
-theme when Emacs is built with GTK.
-
-** Emacs uses GTK tooltips by default if built with GTK.  You can turn that
-off by customizing x-gtk-use-system-tooltips.
-
 ** Lucid menus and dialogs can display antialiased fonts if Emacs is built
 with Xft.  To change font, use the X resource font, for example:
 Emacs.pane.menubar.font:  Courier-12
@@ -272,33 +266,37 @@ for remote machines which support SELinux.
 ** The function format-time-string now supports the %N directive, for
 higher-resolution time stamps.
 
-** The function kill-emacs is now run upon receipt of the signals SIGTERM
-and SIGHUP, and upon SIGINT in batch mode.
+** Changes for exiting Emacs
+
+*** The function kill-emacs is now run upon receipt of the signals
+SIGTERM and SIGHUP, and upon SIGINT in batch mode.
 
-** kill-emacs-hook is now also run in batch mode.
+*** kill-emacs-hook is now also run in batch mode.
 If you have code that adds something to kill-emacs-hook, you should
 consider if it is still appropriate to add it in the noninteractive case.
 
-** New scrolling commands `scroll-up-command' and `scroll-down-command'
+** Scrolling changes
+
+*** New scrolling commands `scroll-up-command' and `scroll-down-command'
 (bound to C-v/[next] and M-v/[prior]) do not signal errors at top/bottom
 of buffer at first key-press (instead move to top/bottom of buffer)
 when a new variable `scroll-error-top-bottom' is non-nil.
 
-** New scrolling commands `scroll-up-line' and `scroll-down-line'
+*** New scrolling commands `scroll-up-line' and `scroll-down-line'
 scroll a line instead of full screen.
 
-** New property `scroll-command' should be set on a command's symbol to
+*** New property `scroll-command' should be set on a command's symbol to
 define it as a scroll command affected by `scroll-preserve-screen-position'.
 
 +++
-** If you customize `scroll-conservatively' to a value greater than 100,
+*** If you customize `scroll-conservatively' to a value greater than 100,
 Emacs will never recenter point in the window when it scrolls due to
 cursor motion commands or commands that move point (e.f., `M-g M-g').
 Previously, you needed to use `most-positive-fixnum' as the value of
 `scroll-conservatively' to achieve the same effect.
 
 ---
-** ``Aggressive'' scrolling now honors the scroll margins.
+*** ``Aggressive'' scrolling now honors the scroll margins.
 If you customize `scroll-up-aggressively' or
 `scroll-down-aggressively' and move point off the window, Emacs now
 scrolls the window so as to avoid positioning point inside the scroll
@@ -319,20 +317,19 @@ for `list-colors-display'.
 This is a convenient way to download and install additional packages,
 from a package repository at elpa.gnu.org.
 
++++
 *** `M-x list-packages' shows a list of packages, which can be
 selected for installation.
 
++++
 *** New command `describe-package', bound to `C-h P'.
 
++++
 *** By default, all installed packages are loaded and activated
 automatically when Emacs starts up.  To disable this, set
 `package-enable-at-startup' to nil.  To change which packages are
 loaded, customize `package-load-list'.
 
-** An Emacs Lisp testing tool is now included.
-Emacs Lisp developers can use this tool to write automated tests for
-their code.  See the ERT info manual for details.
-
 ** Custom Themes
 
 *** `M-x customize-themes' lists Custom themes which can be enabled.
@@ -350,16 +347,22 @@ default, all themes included in Emacs are treated as safe.
 ** The user option `remote-file-name-inhibit-cache' controls whether
 the remote file-name cache is used for read access.
 
+** File- and directory-local variable changes
 +++
-** The use of a "mode: minor" specification in a file local variables section
-to enable a minor-mode is deprecated.  Instead, use "eval: (minor-mode 1)".
+*** You can stop directory local vars from applying to subdirectories.
+Add an element (subdirs . nil) to the alist portion of any variables
+settings to indicate that the section should not apply to
+subdirectories.
 
-** The standalone programs lib-src/digest-doc and sorted-doc have been
-replaced with Lisp commands `doc-file-to-man' and `doc-file-to-info'.
+*** Directory local variables can apply to some file-less buffers.
+Affected modes include dired, vc-dir, and log-edit.  For example,
+adding "(diff-mode . ((mode . whitespace)))" to .dir-locals.el will
+turn on `whitespace-mode' for *vc-diff* buffers.  Modes should call
+`hack-dir-local-variables-non-file-buffer' to support this.
 
----
-** The standalone program `fakemail' has been removed.
-If you need it, feedmail.el ought to provide a superset of the functionality.
++++
+*** Using "mode: MINOR-MODE" to enable a minor mode is deprecated.
+Instead, use "eval: (minor-mode 1)".
 
 +++
 ** The variable `focus-follows-mouse' now always defaults to nil.
@@ -374,6 +377,10 @@ by default.
 *** `menu-bar-select-buffer-function' lets you choose another operation
 instead of `switch-to-buffer' when selecting an item in the Buffers menu.
 
+** The inactive minibuffer has its own major mode `minibuffer-inactive-mode'.
+This is handy for minibuffer-only frames, and is also used for the "mouse-1
+pops up *Messages*" feature, which can now easily be changed.
+
 
 * Editing Changes in Emacs 24.1
 
@@ -391,7 +398,7 @@ isearch-yank-kill.
 *** M-s C-e in Isearch is now bound to isearch-yank-line.
 
 +++
-** There is a new command `count-words-region', which does what you expect.
+** New command `count-words-region'.  This does what you expect.
 
 ** completion-at-point now handles tags and semantic completion.
 
@@ -492,37 +499,16 @@ $ESHELL nor variable `explicit-shell-file-name' is set.
 
 * Changes in Specialized Modes and Packages in Emacs 24.1
 
-** MH-E
-
-*** Upgraded to MH-E version 8.2.93.  See MH-E-NEWS for details.
-
-** comint and modes derived from it use the generic completion code.
-
-** Compilation mode
-
-*** Compilation mode can be used without font-lock-mode.
-`compilation-parse-errors-function' is now obsolete.
-
-*** `compilation-filter-start' is let-bound to the start of the text
-inserted by the compilation filter function, when calling
-compilation-filter-hook.
-
-** The Landmark game is now invoked with `landmark', not `lm'.
+** Archive Mode has basic support for browsing and updating 7z archives.
 
-** Prolog mode has been completely revamped, with lots of additional
-functionality such as more intelligent indentation, electricity, support for
-more variants, including Mercury, and a lot more.
-
-** shell-mode can track your cwd by reading it from your prompt.
-Just set shell-dir-cookie-re to an appropriate regexp.
-
-** Modula-2 mode provides auto-indentation.
+** browse-url has a new variable `browse-url-mailto-function'
+specifies how mailto: URLs are handled.  The default is `browse-url-mail'.
 
 ** BibTeX mode
 
 *** BibTeX mode now supports biblatex.
-Use the variable bibtex-dialect to select support for different BibTeX dialects.
-bibtex-entry-field-alist is now an obsolete alias for
+Use the variable bibtex-dialect to select support for different BibTeX
+dialects.  bibtex-entry-field-alist is now an obsolete alias for
 bibtex-BibTeX-entry-alist.
 
 *** New command `bibtex-search-entries' bound to C-c C-a.
@@ -531,60 +517,6 @@ bibtex-BibTeX-entry-alist.
 
 *** New variable `bibtex-search-entry-globally'.
 
-** latex-electric-env-pair-mode keeps \begin..\end matched on the fly.
-
-** FIXME: xdg-open for browse-url and reportbug, 2010/08.
-
-** Archive Mode has basic support to browse and update 7z archives.
-
-** browse-url has gotten a new variable that is used for mailto: URLs,
-`browse-url-mailto-function', which defaults to `browse-url-mail'.
-
-** `url-queue-retrieve' downloads web pages asynchronously, but allow
-controlling the degree of parallelism.
-
-** Directory local variables can apply to file-less buffers, in certain modes
-(eg dired, vc-dir, log-edit).  For example, adding
-"(diff-mode . ((mode . whitespace)))" to your .dir-locals.el file,
-will turn on `whitespace-mode' for *vc-diff* buffers.  Modes should
-call `hack-dir-local-variables-non-file-buffer' to support this.
-
-+++
-** You can prevent directory local variables from applying to subdirectories.
-Add an element (subdirs . nil) to the alist portion of any variables
-settings to indicate said section should not be applied to subdirectories.
-
-** ERC changes
-
-*** New vars `erc-autojoin-timing' and `erc-autojoin-delay'.
-If the value of `erc-autojoin-timing' is 'ident, ERC autojoins after a
-successful NickServ identification, or after `erc-autojoin-delay'
-seconds.  The default value, 'ident, means to autojoin immediately
-after connecting.
-
-*** New variable `erc-coding-system-precedence': If we use `undecided'
-as the server coding system, this variable will then be consulted.
-The default is to decode strings that can be decoded as utf-8 as
-utf-8, and do the normal `undecided' decoding for the rest.
-
-** Eshell changes
-
-*** The default value of eshell-directory-name is a directory named
-"eshell" in `user-emacs-directory'.  If the old "~/.eshell/" directory
-exists, that is used instead.
-
-** In ido-mode, C-v is no longer bound to ido-toggle-vc.
-The reason is that this interferes with cua-mode.
-
-** partial-completion-mode is now obsolete.
-You can get a comparable behavior with:
-(setq completion-styles '(partial-completion initials))
-(setq completion-pcm-complete-word-inserts-delimiters t)
-
-** mpc.el: Can use pseudo tags of the form tag1|tag2 as a union of two tags.
-
-** server can listen on a specific port using the server-port option.
-
 ** Calendar, Diary, and Appt
 
 +++
@@ -620,6 +552,21 @@ appt-visible/appt-msg-window (use the variable appt-display-format)
 *** Some diary function aliases (obsolete since Emacs 22.1) have been removed:
 view-diary-entries, list-diary-entries, show-all-diary-entries
 
+** CC Mode (C, C++, etc.)
+
+*** New feature to "guess" the style in an existing buffer.
+
+** comint and modes derived from it use the generic completion code.
+
+** Compilation mode
+
+*** Compilation mode can be used without font-lock-mode.
+`compilation-parse-errors-function' is now obsolete.
+
+*** `compilation-filter-start' is let-bound to the start of the text
+inserted by the compilation filter function, when calling
+compilation-filter-hook.
+
 ** Customize
 
 *** Customize buffers now contain a search field.
@@ -634,6 +581,18 @@ Use the arrow to the left of the option name to toggle visibility.
 *** The color widget now has a "Choose" button, which allows you to
 choose a color via list-colors-display.
 
+** D-Bus
+
+*** It is possible now, to access alternative buses than the default
+system or session bus.
+
+*** dbus-register-{service,method,property}
+The -method and -property functions do not automatically register
+names anymore.
+
+The new function dbus-register-service registers a service known name
+on a D-Bus without simultaneously registering a property or a method.
+
 ** Dired-x
 
 *** dired-jump and dired-jump-other-window called with a prefix argument
@@ -643,144 +602,33 @@ read a file name from the minibuffer instead of using buffer-file-name.
 *** The `dired local variables' feature provided by Dired-x is obsolete.
 The standard directory local variables feature replaces it.
 
-** SQL Mode enhancements.
+** ERC changes
 
-*** `sql-dialect' is a synonym for `sql-product'.
-
-*** Added ability to login with a port on MySQL and Postgres.
-The custom variable `sql-port' can be specified for connection to
-MySQL or Postgres servers.  By default, the port is not listed in
-either login parameter, but will be added to the command line if set
-to a non-zero value.
-
-*** Dynamic selection of product in an SQL interactive session.
-If you use `sql-product-interactive' to start an SQL interactive
-session it uses the current value of `sql-product'.  Preceding the
-invocation with C-u will force it to ask for the product before
-creating the session.
-
-*** Renaming a SQL interactive buffer when it is created.
-Prefixing the SQL interactive commands (`sql-sqlite', `sql-postgres',
-`sql-mysql', etc.) with C-u will force a new interactive session to be
-started and will prompt for the new name.  This will reduce the need
-for `sql-rename-buffer' is most common use cases.
-
-*** Command continuation prompts in SQL interactive mode are suppressed.
-Multiple line commands in SQL interactive mode, generate command
-continuation prompts which needlessly confuse the output.  These
-prompts are now filtered out from the output.  This change impacts
-multiple line SQL statements entered with C-j between each line,
-statements yanked into the buffer and statements sent with
-`sql-send-*' functions.
-
-*** Custom variables control prompting for login parameters.
-Each supported product has a custom variable `sql-*-login-params'
-which is a list of the parameters to be prompted for before a
-connection is established.
+*** New vars `erc-autojoin-timing' and `erc-autojoin-delay'.
+If the value of `erc-autojoin-timing' is 'ident, ERC autojoins after a
+successful NickServ identification, or after `erc-autojoin-delay'
+seconds.  The default value, 'ident, means to autojoin immediately
+after connecting.
 
-The lists consist of the following five tokens: `user', `password',
-`database', `server', and `port'.  The order in which they appear is
-the order in which they are prompted.  The tokens symbols can be
-replaced by a sublist starting with the token and followed by a plist
-which control the prompting for values.  The tokens `user',
-`database', and `server' each can take a property of :default which
-specifies the value to be used if no value is entered.  The
-`database', `server', and `port' tokens handle the :completion
-property which restricts the entry to either one of the values in the
-list or to one of the values returned by the function provided as the
-property value.  The `database' and `server' tokens also accept the
-:file property whose value is a regexp to identify useful file names.
-
-  (user :default DEF)
-  (database :default DEF
-            :file FILEPAT
-            :completion COMPLETE)
-  (server :default DEF
-          :file FILEPAT
-          :completion COMPLETE)
-
-The FILEPAT when :file is specified is a regexp that will match valid
-file names (without the directory portion).  Generally these strings
-will be of the form ".+\.SUF" where SUF is the desired file suffix.
-
-When :completion is specified, the COMPLETE corresponds to the
-PREDICATE argument to the `completing-read' function (a list of
-possible values or a function returning such a list).
-
-*** Added `sql-connection-alist' to record login parameter values.
-An alist for recording different username, database and server
-values.  If there are multiple databases that you connect to the
-parameters needed can be stored in this alist.
-
-For example, the following might be set in the user's init.el:
-
-  (setq sql-connection-alist
-        '((dev (sql-product 'sqlite)
-               (sql-database "/home/mmaug/dev.db"))
-          (prd (sql-product 'oracle)
-               (sql-user "mmaug")
-               (sql-database "iprd2a"))))
-
-This defines two connections named "dev" and "prd".
-
-*** Added `sql-connect' to use predefined connections.
-Sets the login parameters based on the values in the
-`sql-connection-alist' and start a SQL interactive session.  Any
-values specified in the connection will not be prompted for.
-
-In the example above, if the user were to invoke M-x sql-connect, they
-would be prompted for the connection.  The user can respond with
-either "dev" or "prd".  The "dev" connection would connect to the
-SQLite database without prompting; the "prd" connection would prompt
-for the users password and then connect to the Oracle database.
-
-**** Added SQL->Start... submenu when connections are defined.
-When connections have been defined, there is a submenu available that
-allows the user to select one to start a SQLi session.  The "Start
-SQLi Session" item moves to the "Start..." submenu when cnnections
-have been defined.
-
-**** Added "Save Connection" menu item in SQLi buffers.
-When a SQLi session is not started by a connection then
-`sql-save-connection' will gather the login params specified for the
-session and save them as a new connection.
-
-*** List database objects and details.
-Once a SQL interactive session has been started, you can get a list of
-the objects in the database and see details of those objects.  The
-objects shown and the details available are product specific.
-
-**** List all objects.
-Using `M-x sql-list-all', `C-c C-l a' or selecting "SQL->List all
-objects" will list all the objects in the database.  At a minimum it
-lists the tables and views in the database.  Preceding the command by
-universal argument may provide additional details or extend the
-listing to include other schemas objects.  The list will appear in a
-separate window in view-mode.
-
-**** List Table details.
-Using `M-x sql-list-table', `C-c C-l t' or selecting "SQL->List Table
-details" will ask for the name of a database table or view and display
-the list of columns in the relation.  Preceding the command with the
-universal argument may provide additional details about each column.
-The list will appear in a separate window in view-mode.
-
-*** Added option `sql-send-terminator'.
-When set makes sure that each command sent with `sql-send-*' commands
-are properly terminated and submitted to the SQL processor.
-
-*** Added option `sql-oracle-scan-on'.
-When set commands sent to Oracle's SQL*Plus are scanned for strings
-starting with an ampersand and the user is asked for replacement text.
-In general, the SQL*Plus option SCAN should always be set OFF under
-SQL interactive mode and this option used in its place.
-
-*** SQL interactive mode will replace tabs with spaces.
-This prevents the command interpreter for MySQL and Postgres from
-listing object name completions when being sent text via
-`sql-send-*' functions.
+*** New variable `erc-coding-system-precedence': If we use `undecided'
+as the server coding system, this variable will then be consulted.
+The default is to decode strings that can be decoded as utf-8 as
+utf-8, and do the normal `undecided' decoding for the rest.
 
-*** An API for manipulating SQL product definitions has been added.
+** Eshell changes
+
+*** The default value of eshell-directory-name is a directory named
+"eshell" in `user-emacs-directory'.  If the old "~/.eshell/" directory
+exists, that is used instead.
+
+** gdb-mi
+
+*** GDB User Interface migrated to GDB Machine Interface and now
+supports multithread non-stop debugging and debugging of several
+threads simultaneously.
+
+** In ido-mode, C-v is no longer bound to ido-toggle-vc.
+The reason is that this interferes with cua-mode.
 
 ** Image mode
 
@@ -790,28 +638,99 @@ image can be animated.
 *** Option `image-animate-loop', if non-nil, loops the animation.
 If nil, `image-toggle-animation' plays the animation once.
 
-** sregex.el is now obsolete, since rx.el is a strict superset.
+** Info
 
-** s-region.el and pc-select are now declared obsolete,
-superseded by shift-select-mode enabled by default in 23.1.
-** pc-mode.el is also declared obsolete.
-** gdb-mi
+*** New command `info-display-manual' displays an Info manual
+specified by its name.  If that manual is already visited in some Info
+buffer within the current session, the command will display that
+buffer.  Otherwise, it will load the manual and display it.  This is
+handy if you have many manuals in many Info buffers, and don't
+remember the name of the buffer visiting the manual you want to
+consult.
 
-*** GDB User Interface migrated to GDB Machine Interface and now
-supports multithread non-stop debugging and debugging of several
-threads simultaneously.
+** The Landmark game is now invoked with `landmark', not `lm'.
 
-** D-Bus
+** MH-E has been upgraded to MH-E version 8.2.93.
+See MH-E-NEWS for details.
 
-*** It is possible now, to access alternative buses than the default
-system or session bus.
+** Modula-2 mode provides auto-indentation.
 
-*** dbus-register-{service,method,property}
-The -method and -property functions do not automatically register
-names anymore.
+** mpc.el: Can use pseudo tags of the form tag1|tag2 as a union of two tags.
 
-The new function dbus-register-service registers a service known name
-on a D-Bus without simultaneously registering a property or a method.
+** Prolog mode has been completely revamped, with lots of additional
+functionality such as more intelligent indentation, electricity, support for
+more variants, including Mercury, and a lot more.
+
+** Rmail
+
+*** The command `rmail-epa-decrypt' decrypts OpenPGP data
+in the Rmail incoming message.
+
+** shell-mode can track your cwd by reading it from your prompt.
+Just set shell-dir-cookie-re to an appropriate regexp.
+
+** SQL Mode enhancements.
+
+*** `sql-dialect' is an alias for `sql-product'.
+
+*** New variable `sql-port' specifies the port number for connecting
+to a MySQL or Postgres server.
+
+*** The command `sql-product-interactive' now takes a prefix argument,
+which causes it to prompt for an SQL product instead of the current
+value of `sql-product'.
+
+*** Product-specific SQL interactive commands now take prefix args.
+These commands (`sql-sqlite', `sql-postgres', `sql-mysql', etc.),
+given a prefix argument, prompt for a name for the SQL interactive
+buffer.  This reduces the need for calling `sql-rename-buffer'.
+
+*** SQL interactive modes suppress command continuation prompts, and
+replace tabs with spaces.  The first change impacts multiple line SQL
+statements entered with C-j between each line, statements yanked into
+the buffer and statements sent with `sql-send-*' functions.  The
+second change prevents the MySQL and Postgres interpreters from
+listing object name completions when sent text via `sql-send-*'
+functions.
+
+*** New custom variables control prompting for login parameters.
+Each supported product has a custom variable `sql-*-login-params',
+which is a list of the parameters to be prompted for before a
+connection is established.
+
+*** New variable `sql-connection-alist' for login parameter values.
+This can be used to store different username, database and server
+values.  Connections defined in this variable appear in the submenu
+SQL->Start... for making new SQLi sessions.
+
+*** New command `sql-connect' starts a predefined SQLi session,
+using the login parameters from `sql-connection-alist'.
+
+*** New "Save Connection" menu item in SQLi buffers.
+This gathers the login params specified for the SQLi session, if it
+was not started by a connection, and saves them as a new connection.
+
+*** Commands for listing database objects and details.
+In an SQLi session, you can get a list of objects in the database.
+The contents of these lists are product specific.
+
+**** `C-c C-l a' or the "SQL->List all objects" menu item
+lists all the objects in the database.  With a prefix argument, it
+displays additional details or extend the listing to include other
+schemas objects.
+
+**** `C-c C-l t' or the "SQL->List Table details" menu item
+prompts for the name of a database table or view and displays the list
+of columns in the relation.  With a prefix argument, it displays
+additional details about each column.
+
+*** New options `sql-send-terminator' and `sql-oracle-scan-on'.
+
+*** An API for manipulating SQL product definitions has been added.
+
+** TeX modes
+
+*** latex-electric-env-pair-mode keeps \begin..\end matched on the fly.
 
 ** Tramp
 
@@ -823,10 +742,8 @@ on a D-Bus without simultaneously registering a property or a method.
 *** The option `ange-ftp-binary-file-name-regexp' has changed its
 default value to "".
 
-** Rmail
-
-*** The command `rmail-epa-decrypt' decrypts OpenPGP data
-in the Rmail incoming message.
+** `url-queue-retrieve' downloads web pages asynchronously, but allow
+controlling the degree of parallelism.
 
 ** VC and related modes
 
@@ -862,9 +779,21 @@ binding `log-view-expanded-log-entry-function' to a suitable function.
 *** New command `vc-ediff' allows visual comparison of two revisions
 of a file similar to `vc-diff', but using ediff backend.
 
-** CC Mode (C, C++, etc.)
+** FIXME: xdg-open for browse-url and reportbug, 2010/08.
 
-*** New feature to "guess" the style in an existing buffer.
+** Obsolete modes
+
+*** partial-completion-mode is obsolete.
+You can get a comparable behavior with:
+(setq completion-styles '(partial-completion initials))
+(setq completion-pcm-complete-word-inserts-delimiters t)
+
+*** pc-mode.el is obsolete.
+
+*** sregex.el is obsolete, since rx.el is a strict superset.
+
+*** s-region.el and pc-select are obsolete.
+They are superseded by shift-select-mode enabled by default in 23.1.
 
 ** Miscellaneous
 
@@ -876,14 +805,6 @@ of a file similar to `vc-diff', but using ediff backend.
 
 *** New command `nato-region' converts text to NATO phonetic alphabet.
 
-*** The new command `info-display-manual' will display an Info manual
-specified by its name.  If that manual is already visited in some Info
-buffer within the current session, the command will display that
-buffer.  Otherwise, it will load the manual and display it.  This is
-handy if you have many manuals in many Info buffers, and don't
-remember the name of the buffer visiting the manual you want to
-consult.
-
 
 * New Modes and Packages in Emacs 24.1
 
@@ -969,8 +890,7 @@ has now been removed.
 
 ** cl.el no longer provides `cl-19'.
 
-** The following functions and aliases, obsolete since at least Emacs 21.1,
-have been removed:
+** The following obsolete functions and aliases were removed:
 comint-kill-output, decompose-composite-char, outline-visible,
 internal-find-face, internal-get-face, frame-update-faces,
 frame-update-face-colors, x-frob-font-weight, x-frob-font-slant,
@@ -980,12 +900,11 @@ x-make-font-bold-italic, mldrag-drag-mode-line, mldrag-drag-vertical-line,
 iswitchb-default-keybindings, char-bytes, isearch-return-char,
 make-local-hook
 
-** The following variables and aliases, obsolete since at least Emacs 21.1,
-have been removed:
-checkdoc-minor-keymap, vc-header-alist, directory-sep-char,
-font-lock-defaults-alist
+** The following obsolete variables and varaliases were removed:
+checkdoc-minor-keymap, vc-header-alist, directory-sep-char, and
+font-lock-defaults-alist.
 
-** The following files, obsolete since at least Emacs 21.1, have been removed:
+** The following obsolete files were removed:
 sc.el, x-menu.el, rnews.el, rnewspost.el
 
 ** FIXME finder-inf.el changes.
@@ -993,6 +912,46 @@ sc.el, x-menu.el, rnews.el, rnewspost.el
 
 * Lisp changes in Emacs 24.1
 
+** Code can now use lexical scoping by default instead of dynamic scoping.
+The `lexical-binding' variable lets code use lexical scoping for local
+variables.  It is typically set via file-local variables, in which case it
+applies to all the code in that file.
+
+*** `eval' takes a new optional argument `lexical' to choose the new lexical
+binding instead of the old dynamic binding mode.
+
+*** Lexically scoped interpreted functions are represented with a new form
+of function value which looks like (closure ENV ARGS &rest BODY).
+
+*** New macro `letrec' to define recursive local functions.
+
+*** New function `special-variable-p' to check whether a variable is
+declared as dynamically bound.
+
+** An Emacs Lisp testing tool is now included.
+Emacs Lisp developers can use this tool to write automated tests for
+their code.  See the ERT info manual for details.
+
+** Changes for bidirectional display and editing
+
++++
+*** New function `current-bidi-paragraph-direction'.
+This returns the actual value of base direction of the paragraph at
+point.
+
++++
+*** New function `bidi-string-mark-left-to-right'.
+Given a string containing characters from right-to-left (RTL) scripts,
+this function returns another string which can be safely inserted into
+a buffer, such that any following text will be always displayed to the
+right of that string.  (This works by appending the Unicode
+"LEFT-TO-RIGHT MARK" character when the argument string might need that.)
+
+This is useful when the buffer has overall left-to-right (LTR)
+paragraph direction and you need to insert a string whose contents and
+directionality are not known in advance, without disrupting the layout
+of the line.
+
 ** Window changes
 
 *** `switch-to-buffer' has a new optional argument FORCE-SAME-WINDOW,
@@ -1003,6 +962,7 @@ can be used, e.g. if the selected one is strongly dedicated.
 *** FIXME: buffer-display-alist changes
 
 ** Completion
+
 *** New variable completion-extra-properties used to specify extra properties
 of the current completion:
 - :annotate-function, same as the old completion-annotate-function.
@@ -1030,34 +990,6 @@ connection, directly or via STARTTLS.  To do STARTTLS, additional
 parameters (`:end-of-command', `:success', `:capabilities-command')
 must also be supplied.
 
-** Code can now use lexical scoping by default instead of dynamic scoping.
-The `lexical-binding' variable lets code use lexical scoping for local
-variables.  It is typically set via file-local variables, in which case it
-applies to all the code in that file.
-
-*** `eval' takes a new optional argument `lexical' to choose the new lexical
-binding instead of the old dynamic binding mode.
-
-*** Lexically scoped interpreted functions are represented with a new form
-of function value which looks like (closure ENV ARGS &rest BODY).
-
-*** New macro `letrec' to define recursive local functions.
-
-*** New function `special-variable-p' to check whether a variable is
-declared as dynamically bound.
-
-+++
-** New function `bidi-string-mark-left-to-right'.
-Given a string containing right-to-left (RTL) script, this function
-returns another string which can be safely inserted into a buffer as a
-distinct RTL "segment", without causing any following text to be
-displayed as RTL.  (This is done by appending a Unicode "left-to-right
-mark" character.)
-
-This is useful when the buffer has overall left-to-right (LTR)
-paragraph direction and you need to insert a string whose contents and
-directionality are not known in advance.
-
 ** pre/post-command-hook are not reset to nil upon error.
 Instead, the offending function is removed.
 
@@ -1069,8 +1001,6 @@ Emacs server instances.
 ** `call-process' allows a `(:file "file")' spec to redirect STDOUT to
 a file.
 
-** byte-compile-disable-print-circle is obsolete.
-** deferred-action-list and deferred-action-function are obsolete.
 ** Removed the stack-trace-on-error variable.
 Also the debugger can now "continue" from an error, which means it will jump
 to the error handler as if the debugger had not been invoked instead of
@@ -1098,13 +1028,16 @@ syntactic rules.
 
 +++
 ** Syntax tables support a new "comment style c" additionally to style b.
+
 ** frame-local variables cannot be let-bound any more.
+
 ** prog-mode is a new major-mode meant to be the parent of programming mode.
 The prog-mode-hook it defines can be used to enable features for
 programming modes.  For example:
 (add-hook 'prog-mode-hook 'flyspell-prog-mode)
 enables on the fly spell checking for comments and strings for
 programming modes.
+
 ** define-minor-mode accepts a new keyword :variable.
 
 ** `delete-file' and `delete-directory' now accept optional arg TRASH.
@@ -1112,8 +1045,6 @@ Trashing is performed if TRASH and `delete-by-moving-to-trash' are
 both non-nil.  Interactively, TRASH defaults to t, unless a prefix
 argument is supplied (see Trash changes, above).
 
-** buffer-substring-filters is obsoleted by filter-buffer-substring-functions.
-
 ** `facemenu-read-color' is now an alias for `read-color'.
 The command `read-color' now requires a match for a color name or RGB
 triplet, instead of signalling an error if the user provides a invalid
@@ -1136,6 +1067,14 @@ is being animated.
 
 *** `image-extension-data' is renamed to `image-metadata'.
 
+*** If Emacs is compiled with ImageMagick support (see Startup
+Changes), the function `imagemagick-types' returns a list of image
+file extensions that your installation of ImageMagick supports.  The
+function `imagemagick-register-types' enables ImageMagick support for
+these image types, minus those listed in `imagemagick-types-inhibit'.
+
+See the Emacs Lisp Reference Manual for more information.
+
 ** XML and HTML parsing
 
 *** If Emacs is compiled with libxml2 support (which is the default),
@@ -1192,6 +1131,16 @@ as well as those in the -*- line.
 This means that the empty symbol can now be read back.  Also, #: by itself
 (when not immediately followed by a possible symbol character) stands for
 an empty uninterned symbol.
+
+** Obsolete functions and variables
+
+*** buffer-substring-filters is obsolete.
+Use `filter-buffer-substring-functions' instead.
+
+*** `byte-compile-disable-print-circle' is obsolete.
+
+*** `deferred-action-list' and `deferred-action-function' are obsolete.
+
 
 * Changes in Emacs 24.1 on non-free operating systems
 
diff --git a/etc/tutorials/TUTORIAL.he b/etc/tutorials/TUTORIAL.he
index 529c42a1c40..92d94a0da87 100644
--- a/etc/tutorials/TUTORIAL.he
+++ b/etc/tutorials/TUTORIAL.he
@@ -25,7 +25,7 @@
 
 דבר ר�שון שעליכ� ללמוד הו� כיצד לנוע ממקו� �חד למשנהו בתוך הטקסט. �ת�
 כבר יודעי� כיצד להתקד� לעמוד הב�, ע� C-v. לחזרה לעמוד הקוד� הקישו M-v
-(החזיקו מקש META והקישו v �ו הקישו ‭<ESC>v‬ �� �ין במקלדת מקש META
+(החזיקו מקש META והקישו v �ו הקישו ‪<ESC>v‬ �� �ין במקלדת מקש META
 �ו EDIT �ו ALT).
 
 >>  נסו עתה כמה פעמי� להקיש M-v ו�חר־כך C-v.
@@ -151,17 +151,17 @@ M-f עובר �ת המילה הב�ה ונעצר בסופה. M-b פועל ב�ו
 >> נסו �ת כל הפקודות הללו מספר פעמי�, לש� תרגול.
    �לו הן הפקודות הנפוצות ביותר.
 
-שתי פקודות תנועה חשובות �חרת הן ‭M-<‬ �(META פחות), �שר נעה לתחילת
-הטקסט, ו־‭M->‬ �(META יותר), �שר נעה לסוף הטקסט.
+שתי פקודות תנועה חשובות �חרת הן ‪M-<‬ �(META פחות), �שר נעה לתחילת
+הטקסט, ו־‪M->‬ �(META יותר), �שר נעה לסוף הטקסט.
 
 ברוב המקלדות המקש ">" נמצ� מעל הפסיק, לכן כדי להקישו יש צורך ללחוץ
-ולהחזיק מקש Shift. ב�ופן דומה יש ללחוץ על Shift כדי להקיש ‭M-<‬כי
+ולהחזיק מקש Shift. ב�ופן דומה יש ללחוץ על Shift כדי להקיש ‪M-<‬ כי
 �חרת היה יוצ� M-פסיק.
 
->> נסו עתה ‭M-<‬ כדי להגיע לתחילת השיעור.
+>> נסו עתה ‪M-<‬ כדי להגיע לתחילת השיעור.
    �חר־כך הקישו C-v מספר פעמי�, עד שתגיעו לכ�ן.
 
->> עכשיו נסו ‭M->‬ כדי להגיע לסוף השיעור.
+>> עכשיו נסו ‪M->‬ כדי להגיע לסוף השיעור.
    ל�חר מכן הקישו M-v כמה פעמי� כדי לחזור לכ�ן.
 
 ניתן להזיז �ת הסמן ג� בעזרת מקשי החצי�, �� ה� קיימי� במקלדת שלכ�.
@@ -320,7 +320,7 @@ argument) משו×� מקישי×� ×�ותו לפני הפקודה ×�ליה הו×� ×
         �<Delback>    מחק תו שלפני הסמן
         �C-d          מחק תו מתחת �ו �חרי הסמן
 
-        �‭M-<Delback>‬  גזור מילה שלפני הסמן
+        �‪M-<Delback>‬     גזור מילה שלפני הסמן
         �M-d          גזור מילה ש�חרי הסמן
 
         �C-k          גזור טקסט מהסמן ועד סוף השורה
@@ -583,7 +583,7 @@ C-x C-s. לכן קיימת פקודה
 יותר ולהמשיך מ�ותה נקודה. כ�שר Emacs רץ על תצוגת טקסט, C-z "משעה" �ת
 Emacs: הו� מחזיר �תכ� לשורת הפקודות הבסיסית של מערכת ההפעלה ("shell"),
 �בל �ינו מסיי� �ת Emacs. ברוב המערכות, כדי להמשיך בעבודתכ� ב־Emacs,
-תצטרכו להקיש �ת הפקודה "fg" �ו ‭"%emacs"‬.
+תצטרכו להקיש �ת הפקודה "fg" �ו ‪"%emacs"‬.
 
 הרגע הנכון להשתמש ב־C-x C-c הו� כ�שר �ת� עומדי� להתנתק (log out).
 כמו־כן, תצטרכו להשתמש בו כדי לצ�ת מ־Emacs שהופעל ע"י תוכניות �חרות
@@ -1020,7 +1020,7 @@ Software Foundation, �� בגרס� 3 של הרשיון, ו�� (כ�ופציה
 �נ� עיינו ב־GNU General Public License.
 
 �GNU Emacs �מור להיות מלווה בעותק של GNU General Public License; �� ל�
-קיבלת� �ותו, תוכלו למצו� �ותו ב־‭<http://www.gnu.org/licenses/>‬.
+קיבלת� �ותו, תוכלו למצו� �ותו ב־‪<http://www.gnu.org/licenses/>‬.
 
 הנכ� מוזמני� לקרו� �ת הקובץ COPYING ו�ז �כן לחלק עותקי� של GNU Emacs
 לחבריכ�. עזרו לנו לחסל �ת "הבעלות" על תוכנה ש�ינה �ל� חבלה בתוכנה,
diff --git a/lisp/ChangeLog b/lisp/ChangeLog
index a42711dccc4..8a57fe75405 100644
--- a/lisp/ChangeLog
+++ b/lisp/ChangeLog
@@ -1,3 +1,59 @@
+2011-08-27  Alan Mackenzie  <acm@muc.de>
+
+        * progmodes/cc-menus.el (cc-imenu-c++-generic-expression): Make it
+        handle function pointer parameters properly.
+
+2011-08-27  Martin Rudalics  <rudalics@gmx.at>
+
+        * window.el (display-buffer-reuse-window): Fix case where
+        selected window was reused with non-nil OTHER-WINDOW argument.
+        (Bug#9381)
+
+2011-08-27  Deniz Dogan  <deniz@dogan.se>
+
+        * net/rcirc.el (rcirc-check-auth-status): Adding support for
+        oftc's NickServ messages.
+
+2011-08-27  Glenn Morris  <rgm@gnu.org>
+
+        * saveplace.el (save-place-limit): Make it finite.  (Bug#9352)
+
+2011-08-26  Chong Yidong  <cyd@stupidchicken.com>
+
+        * emacs-lisp/package.el (package-install): Call package-initialize
+        if called interactively.
+
+2011-08-26  Leo Liu  <sdl.web@gmail.com>
+
+        * emacs-lisp/cl-macs.el (defstruct): Fix format.  (Bug#9357)
+
+2011-08-25  Juri Linkov  <juri@jurta.org>
+
+        * isearch.el (isearch-occur): Let-bind `search-spaces-regexp' to
+        `search-whitespace-regexp' (bug#9364).
+
+2011-08-25  Juri Linkov  <juri@jurta.org>
+
+        * isearch.el (isearch-edit-string): Let-bind `search-ring' and
+        `regexp-search-ring' to their global values to protect from
+        updating by `read-from-minibuffer' (bug#9185).
+
+2011-08-25  Juri Linkov  <juri@jurta.org>
+
+        * textmodes/ispell.el (ispell-command-loop): Add newline
+        at the end of the "Use option `i'..." line.
+
+2011-08-25  Juri Linkov  <juri@jurta.org>
+
+        * battery.el (display-battery-mode): If `battery-status-function'
+        or `battery-mode-line-format' is nil, display the message and set
+        `display-battery-mode' to nil (bug#9363).
+
+2011-08-25  Eli Zaretskii  <eliz@gnu.org>
+
+        * buff-menu.el (Buffer-menu-buffer+size): Remove calls to
+        bidi-string-mark-left-to-right; they are unnecessary now.
+
 2011-08-25  Deniz Dogan  <deniz@dogan.se>
 
         * net/quickurl.el: Documentation typo fixes.
diff --git a/lisp/battery.el b/lisp/battery.el
index e0bba96b655..f5c01fbef58 100644
--- a/lisp/battery.el
+++ b/lisp/battery.el
@@ -173,13 +173,16 @@ seconds."
   (setq battery-mode-line-string "")
   (or global-mode-string (setq global-mode-string '("")))
   (and battery-update-timer (cancel-timer battery-update-timer))
-  (if (not display-battery-mode)
-      (setq global-mode-string
-            (delq 'battery-mode-line-string global-mode-string))
-    (add-to-list 'global-mode-string 'battery-mode-line-string t)
-    (setq battery-update-timer (run-at-time nil battery-update-interval
-                                            'battery-update-handler))
-    (battery-update)))
+  (if (and battery-status-function battery-mode-line-format)
+      (if (not display-battery-mode)
+          (setq global-mode-string
+                (delq 'battery-mode-line-string global-mode-string))
+        (add-to-list 'global-mode-string 'battery-mode-line-string t)
+        (setq battery-update-timer (run-at-time nil battery-update-interval
+                                                'battery-update-handler))
+        (battery-update))
+    (message "Battery status not available")
+    (setq display-battery-mode nil)))
 
 (defun battery-update-handler ()
   (battery-update)
diff --git a/lisp/buff-menu.el b/lisp/buff-menu.el
index 2eac33d8157..2be74cf5efb 100644
--- a/lisp/buff-menu.el
+++ b/lisp/buff-menu.el
@@ -681,9 +681,9 @@ For more information, see the function `buffer-menu'."
                           (string-width tail)
                           2))
                       Buffer-menu-short-ellipsis
-                      (bidi-string-mark-left-to-right tail))))
+                      tail)))
     ;; Don't put properties on (buffer-name).
-    (setq name (bidi-string-mark-left-to-right name)))
+    (setq name (copy-sequence name)))
   (add-text-properties 0 (length name) name-props name)
   (add-text-properties 0 (length size) size-props size)
   (let ((name+space-width (- Buffer-menu-buffer+size-width
diff --git a/lisp/emacs-lisp/cl-loaddefs.el b/lisp/emacs-lisp/cl-loaddefs.el
index 7beb4d4b4cc..d6512306ad1 100644
--- a/lisp/emacs-lisp/cl-loaddefs.el
+++ b/lisp/emacs-lisp/cl-loaddefs.el
@@ -282,7 +282,7 @@ Not documented
 ;;;;;;  flet progv psetq do-all-symbols do-symbols dotimes dolist
 ;;;;;;  do* do loop return-from return block etypecase typecase ecase
 ;;;;;;  case load-time-value eval-when destructuring-bind function*
-;;;;;;  defmacro* defun* gentemp gensym) "cl-macs" "cl-macs.el" "0907093f7720996444ededb4edfe8072")
+;;;;;;  defmacro* defun* gentemp gensym) "cl-macs" "cl-macs.el" "cc8cbd8c86e2facbe61986e992e6c508")
 ;;; Generated autoloads from cl-macs.el
 
 (autoload 'gensym "cl-macs" "\
diff --git a/lisp/emacs-lisp/cl-macs.el b/lisp/emacs-lisp/cl-macs.el
index fb19115287c..d9531cc5261 100644
--- a/lisp/emacs-lisp/cl-macs.el
+++ b/lisp/emacs-lisp/cl-macs.el
@@ -2416,9 +2416,8 @@ value, that slot cannot be set via `setf'.
                         (append
                          (and pred-check
                               (list (list 'or pred-check
-                                          (list 'error
-                                                (format "%s accessing a non-%s"
-                                                        accessor name)))))
+                                          `(error "%s accessing a non-%s"
+                                                  ',accessor ',name))))
                          (list (if (eq type 'vector) (list 'aref 'cl-x pos)
                                  (if (= pos 0) '(car cl-x)
                                    (list 'nth pos 'cl-x)))))) forms)
@@ -2426,9 +2425,8 @@ value, that slot cannot be set via `setf'.
               (push (list 'define-setf-method accessor '(cl-x)
                              (if (cadr (memq :read-only (cddr desc)))
                                  (list 'progn '(ignore cl-x)
-                                       (list 'error
-                                             (format "%s is a read-only slot"
-                                                     'accessor)))
+                                       `(error "%s is a read-only slot"
+                                               ',accessor))
                                ;; If cl is loaded only for compilation,
                                ;; the call to cl-struct-setf-expander would
                                ;; cause a warning because it may not be
diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
index 19e8375966b..88282606aa8 100644
--- a/lisp/emacs-lisp/package.el
+++ b/lisp/emacs-lisp/package.el
@@ -852,18 +852,26 @@ using `package-compute-transaction'."
        (t
         (error "Unknown package kind: %s" (symbol-name kind)))))))
 
+(defvar package--initialized nil)
+
 ;;;###autoload
 (defun package-install (name)
   "Install the package named NAME.
-Interactively, prompt for the package name.
-The package is found on one of the archives in `package-archives'."
+NAME should be the name of one of the available packages in an
+archive in `package-archives'.  Interactively, prompt for NAME."
   (interactive
-   (list (intern (completing-read "Install package: "
-                                  (mapcar (lambda (elt)
-                                            (cons (symbol-name (car elt))
-                                                  nil))
-                                          package-archive-contents)
-                                  nil t))))
+   (progn
+     ;; Initialize the package system to get the list of package
+     ;; symbols for completion.
+     (unless package--initialized
+       (package-initialize t))
+     (list (intern (completing-read
+                    "Install package: "
+                    (mapcar (lambda (elt)
+                              (cons (symbol-name (car elt))
+                                    nil))
+                            package-archive-contents)
+                    nil t)))))
   (let ((pkg-desc (assq name package-archive-contents)))
     (unless pkg-desc
       (error "Package `%s' is not available for installation"
@@ -1076,8 +1084,6 @@ makes them available for download."
                       (car archive)))))
   (package-read-all-archive-contents))
 
-(defvar package--initialized nil)
-
 ;;;###autoload
 (defun package-initialize (&optional no-activate)
   "Load Emacs Lisp packages, and activate them.
diff --git a/lisp/gnus/ChangeLog b/lisp/gnus/ChangeLog
index ad3e26f0f51..5c8b4333332 100644
--- a/lisp/gnus/ChangeLog
+++ b/lisp/gnus/ChangeLog
@@ -1,3 +1,9 @@
+2011-08-26  Katsumi Yamaoka  <yamaoka@jpl.org>
+
+        * mailcap.el (mailcap-mime-data): Regexp-quote MIME subtype.
+
+        * gnus-msg.el (gnus-setup-message): Remove extra apostrophe.
+
 2011-08-21  Lars Magne Ingebrigtsen  <larsi@gnus.org>
 
         * nnmail.el (nnmail-get-new-mail-1): If one mail source bugs out,
diff --git a/lisp/gnus/gnus-msg.el b/lisp/gnus/gnus-msg.el
index 9d3ec25c03a..d60c7165abd 100644
--- a/lisp/gnus/gnus-msg.el
+++ b/lisp/gnus/gnus-msg.el
@@ -435,7 +435,7 @@ Thank you for your help in stamping out bugs.
            (progn
              ,@forms)
          (gnus-inews-add-send-actions ,winconf ,buffer ,article ,config
-                                      ,yanked ',winconf-name)
+                                      ,yanked ,winconf-name)
          (setq gnus-message-buffer (current-buffer))
          (set (make-local-variable 'gnus-message-group-art)
               (cons ,group ,article))
diff --git a/lisp/gnus/mailcap.el b/lisp/gnus/mailcap.el
index dffb279daba..7959104d646 100644
--- a/lisp/gnus/mailcap.el
+++ b/lisp/gnus/mailcap.el
@@ -90,7 +90,7 @@ This is a compatibility function for different Emacsen."
 ;; files for the rest?  -- fx
 (defvar mailcap-mime-data
   `(("application"
-     ("vnd.ms-excel"
+     ("vnd\\.ms-excel"
       (viewer . "gnumeric %s")
       (test   . (getenv "DISPLAY"))
       (type . "application/vnd.ms-excel"))
diff --git a/lisp/isearch.el b/lisp/isearch.el
index 7fcc31f188f..8764952dbf5 100644
--- a/lisp/isearch.el
+++ b/lisp/isearch.el
@@ -1132,6 +1132,14 @@ If first char entered is \\[isearch-yank-word-or-char], then do word search inst
               ;; Save current configuration so we can restore it here.
               (isearch-window-configuration (current-window-configuration))
 
+              ;; This could protect the index of the search rings,
+              ;; but we can't reliably count the number of typed M-p
+              ;; in `read-from-minibuffer' to adjust the index accordingly.
+              ;; So when the following is commented out, `isearch-mode'
+              ;; below resets the index to the predictable value nil.
+              ;; (search-ring-yank-pointer search-ring-yank-pointer)
+              ;; (regexp-search-ring-yank-pointer regexp-search-ring-yank-pointer)
+
               ;; Temporarily restore `minibuffer-message-timeout'.
               (minibuffer-message-timeout
                isearch-original-minibuffer-message-timeout)
@@ -1152,13 +1160,18 @@ If first char entered is \\[isearch-yank-word-or-char], then do word search inst
 
           (unwind-protect
               (let* ((message-log-max nil)
+                     ;; Protect global value of search rings from updating
+                     ;; by `read-from-minibuffer'.  It should be updated only
+                     ;; by `isearch-update-ring' in `isearch-done', not here.
+                     (search-ring search-ring)
+                     (regexp-search-ring regexp-search-ring)
                      ;; Binding minibuffer-history-symbol to nil is a work-around
                      ;; for some incompatibility with gmhist.
                      (minibuffer-history-symbol))
                 (setq isearch-new-string
                       (read-from-minibuffer
                        (isearch-message-prefix nil nil isearch-nonincremental)
-                        (cons isearch-string (1+ (isearch-fail-pos)))
+                       (cons isearch-string (1+ (isearch-fail-pos)))
                        minibuffer-local-isearch-map nil
                        (if isearch-regexp
                            (cons 'regexp-search-ring
@@ -1432,9 +1445,10 @@ string.  NLINES has the same meaning as in `occur'."
      (t (regexp-quote isearch-string)))
     (if current-prefix-arg (prefix-numeric-value current-prefix-arg))))
   (let ((case-fold-search isearch-case-fold-search)
-        ;; set `search-upper-case' to nil to not call
-        ;; `isearch-no-upper-case-p' in `occur-1'
-        (search-upper-case nil))
+        ;; Set `search-upper-case' to nil to not call
+        ;; `isearch-no-upper-case-p' in `occur-1'.
+        (search-upper-case nil)
+        (search-spaces-regexp search-whitespace-regexp))
     (occur regexp nlines)))
 
 (declare-function hi-lock-read-face-name "hi-lock" ())
diff --git a/lisp/net/rcirc.el b/lisp/net/rcirc.el
index 7d43c4f7547..de2c3adba95 100644
--- a/lisp/net/rcirc.el
+++ b/lisp/net/rcirc.el
@@ -2514,6 +2514,7 @@ the only argument."
                 (member message
                         (list
                          (format "You are now identified for \C-b%s\C-b." rcirc-nick)
+                         (format "You are successfully identified as \C-b%s\C-b." rcirc-nick)
                          "Password accepted - you are now recognized."
                          )))
                (and ;; quakenet
diff --git a/lisp/org/ChangeLog b/lisp/org/ChangeLog
index fe05fa685ed..9c0c62ccdf6 100644
--- a/lisp/org/ChangeLog
+++ b/lisp/org/ChangeLog
@@ -31,15 +31,14 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-publish.el (org-publish-find-title): bugfix: kill buffers
+        * org-publish.el (org-publish-find-title): Bugfix: kill buffers
         unless they were already visited.
         (org-sitemap-sort-files, org-sitemap-sort-folders)
         (org-sitemap-ignore-case, org-sitemap-requested)
-        (org-sitemap-date-format, org-sitemap-file-entry-format): use
+        (org-sitemap-date-format, org-sitemap-file-entry-format): Use
         a correct prefix.
         (org-publish-projects): Make sure to delete .orgx files.
-        (org-publish-index-generate-theindex.inc): Small docstring
-        fix.
+        (org-publish-index-generate-theindex.inc): Small docstring fix.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -52,15 +51,15 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el: search blank lines down to the end of the item
+        * org-list.el: Search blank lines down to the end of the item
         instead of stopping at the item, in order to possibly match such
         lines within the item.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-latex.el (org-export-latex-href-format): docstring fix to
+        * org-latex.el (org-export-latex-href-format): Docstring fix to
         reflect the fact that you can use only one "%s".
-        (org-export-latex-links): allow `org-export-latex-href-format' to
+        (org-export-latex-links): Allow `org-export-latex-href-format' to
         have only one "%s".
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
@@ -73,7 +72,7 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-capture.el (org-capture-templates): docstring fix.
+        * org-capture.el (org-capture-templates): Docstring fix.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -81,7 +80,7 @@
         code blocks.
 
         * ob-keys.el (org-babel-key-bindings): Key bindings for
-        org-babel-view-src-block-info.
+        `org-babel-view-src-block-info'.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -98,7 +97,7 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-footnote.el (org-footnote-create-definition): when skipping
+        * org-footnote.el (org-footnote-create-definition): When skipping
         already written footnotes definition, the algorithme would assume
         each one was only one-line long.
 
@@ -106,22 +105,22 @@
 
         * org-table.el (org-table-eval-formula): Fix bug when a formula
         "range" is just one cell.
-        (org-table-time-string-to-seconds): don't check whether
-        we manipulate a string.
+        (org-table-time-string-to-seconds): Don't check whether we
+        manipulate a string.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org-exp.el (org-export-mark-list-end)
-        (org-export-mark-list-properties): don't remove the ending regexp
+        (org-export-mark-list-properties): Don't remove the ending regexp
         when it consists in blank lines.
 
-        * org-list.el (org-list-parse-list): ditto, but remove it
+        * org-list.el (org-list-parse-list): Ditto, but remove it
         completely when it isn't made of blank lines (i.e. during export
         process).
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-table.el (org-table-time-string-to-seconds): match either
+        * org-table.el (org-table-time-string-to-seconds): Match either
         HH:MM:SS or HH:MM (instead of MM:SS).
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
@@ -137,12 +136,12 @@
         variables as of Org version 7.7 as you can already export the
         timestamp from the preamble or the postamble.
         (org-export-html-before-content-div): Delete variable.
-        (org-export-html-content-div): obsolete variable as of 7.7.
+        (org-export-html-content-div): Obsolete variable as of 7.7.
         (org-export-html-divs): New variable to define divs used in
         HTML export.
         (org-export-as-html): Now the preamble and the postamble are
-        surrounded by a <div ...>.  The name of the div is defined
-        through `org-export-html-divs'.
+        surrounded by a <div ...>.  The name of the div is defined through
+        `org-export-html-divs'.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -151,22 +150,21 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-macs.el (org-with-limited-levels): some functions, like
+        * org-macs.el (org-with-limited-levels): Some functions, like
         `org-back-to-heading', being deeply based on outline-mode, still
         refer to `outline-regexp' instead of `org-outline-regexp'.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org.el (org-refile-get-targets): new optional argument
+        * org.el (org-refile-get-targets): New optional argument
         `excluded-entries' to exclude entries from the targets.
         (org-refile-get-location): From an org-mode buffer, exclude
         current heading and subheadings from the list of targets when
-        org-refile-use-cache is nil.
+        `org-refile-use-cache' is nil.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-imenu-get-tree): note to self: headlines start at
-        bol.
+        * org.el (org-imenu-get-tree): Headlines start at bol.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -174,37 +172,38 @@
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
-        * ob.el (org-babel-sha1-hash): Only call copy-seq on proper lists.
+        * ob.el (org-babel-sha1-hash): Only call `copy-seq' on proper
+        lists.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-kill-is-subtree-p): matched string needs to start at
+        * org.el (org-kill-is-subtree-p): Matched string needs to start at
         bol.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org.el (org-paste-subtree, org-kill-is-subtree-p)
-        (org-yank-folding-would-swallow-text, org-yank-generic): use
+        (org-yank-folding-would-swallow-text, org-yank-generic): Use
         `org-with-limited-levels' macro.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-macs.el (org-with-limited-levels): also modify, when
+        * org-macs.el (org-with-limited-levels): Also modify, when
         appropriate, `org-outline-regexp-at-bol'.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-timestamp-change): some locales don't use the same
-        length for date abbreviations. Set a marker at origin in case
+        * org.el (org-timestamp-change): Some locales don't use the same
+        length for date abbreviations.  Set a marker at origin in case
         length of new timestamp is different.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-imenu-get-tree): browse only true headlines.
+        * org.el (org-imenu-get-tree): Browse only true headlines.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-archive.el (org-archive-subtree): while it might be possible
+        * org-archive.el (org-archive-subtree): While it might be possible
         to archive an headline of a temporary buffer (i.e. not visiting a
         file), it wouldn't be really sensical.
 
@@ -212,13 +211,13 @@
 
         * org-archive.el (org-extract-archive-file)
         (org-extract-archive-heading, org-archive-subtree):
-        buffer-file-name is nil in an indirect buffer.  Thus, use
-        (buffer-file-name (buffer-base-buffer)), which will, in any case,
-        return the file-name.
+        `buffer-file-name' is nil in an indirect buffer.  Thus, use
+        `(buffer-file-name (buffer-base-buffer))', which will, in any
+        case, return the file name.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-capture.el (org-capture): if dired isn't loaded,
+        * org-capture.el (org-capture): If dired isn't loaded,
         `dired-buffers' isn't defined, and %F will fail.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
@@ -232,19 +231,19 @@
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
-        * ob.el (org-babel-execute-src-block): Replaced call to defunct
+        * ob.el (org-babel-execute-src-block): Replace call to defunct
         function `org-babel-result-hash'.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-footnote.el (org-footnote-in-valid-context-p): avoid cited
-        lines and headers in message-mode.
-        (org-footnote-at-reference-p): remove check for cited lines, this
+        * org-footnote.el (org-footnote-in-valid-context-p): Avoid cited
+        lines and headers in `message-mode'.
+        (org-footnote-at-reference-p): Remove check for cited lines, this
         is now handled by the previous function.  Refactor.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-capture.el (org-capture): if no file is associated to
+        * org-capture.el (org-capture): If no file is associated to
         current buffer, check dired buffer and try to retreive a possibly
         directory associated.
 
@@ -258,16 +257,16 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org.el (org-refile-get-location): exclude current heading from
+        * org.el (org-refile-get-location): Exclude current heading from
         the refile table.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-footnote.el (org-footnote-at-reference-p): test if match is
+        * org-footnote.el (org-footnote-at-reference-p): Test if match is
         in cited text, when replying to a message.
-        (org-footnote-new): do not create a new footnote at bol, as it might
-        be seen as a definition.
-        (org-footnote-at-definition-p): ignore definitions in forbidden
+        (org-footnote-new): Do not create a new footnote at bol, as it
+        might be seen as a definition.
+        (org-footnote-at-definition-p): Ignore definitions in forbidden
         blocks, as it is already the case for references.
 
 2011-07-28  Matt Lundin  <mdl@imapmail.org>
@@ -283,11 +282,11 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-insert-item): actualize code comments.
-        (org-insert-item): for consistency, point cannot be moved at
-        a surprising place when the user is being asked to choose a new
-        description term to insert in the list. Point should stay where the
-        user called the command.
+        * org-list.el (org-list-insert-item): Actualize code comments.
+        (org-insert-item): For consistency, point cannot be moved at a
+        surprising place when the user is being asked to choose a new
+        description term to insert in the list.  Point should stay where
+        the user called the command.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -318,20 +317,20 @@
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org.el (org-update-parent-todo-statistics): COOKIE_DATA should
-        be checked for parent, not current headline. Also, this function
+        be checked for parent, not current headline.  Also, this function
         doesn't need to be interactive.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org-list.el (org-list-send-item, org-list-struct-apply-struct)
-        (org-apply-on-list, org-toggle-checkbox): make markers point
+        (org-apply-on-list, org-toggle-checkbox): Make markers point
         nowhere when they have become useless.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-insert-item): when insertion point is in
+        * org-list.el (org-list-insert-item): When insertion point is in
         some white line after the end of the list, remove all unnecessary
-        white lines there before proceeding. Also refactor a snippet of
+        white lines there before proceeding.  Also refactor a snippet of
         code.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
@@ -341,15 +340,15 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-fontify-meta-lines-and-blocks-1): blocks cannot be
+        * org.el (org-fontify-meta-lines-and-blocks-1): Blocks cannot be
         correctly fontified when the buffer is missing a final newline.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
         * ob.el (org-babel-strip-protective-commas): Return `nil' instead
         of an error if no argument is given.
-        (org-babel-parse-src-block-match): Make sure body is defined
-        in the let construct.
+        (org-babel-parse-src-block-match): Make sure body is defined in
+        the let construct.
 
 2011-07-28  Jon Anders Skorpen  <jonas@ifi.uio.no>  (tiny change)
 
@@ -358,13 +357,13 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-footnote.el (org-footnote-normalize): footnote section
+        * org-footnote.el (org-footnote-normalize): Footnote section
         should be inserted only if there are footnotes to insert.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org-footnote.el (org-footnote-at-definition-p)
-        (org-footnote-normalize): do not grab signature in the definition
+        (org-footnote-normalize): Do not grab signature in the definition
         of the last footnote.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
@@ -376,55 +375,55 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-exp.el (org-export-preprocess-string): add the possibility
-        to call recursively the function. Also change order of some
-        function calls. Comment export process for footnotes.
+        * org-exp.el (org-export-preprocess-string): Add the possibility
+        to call recursively the function.  Also change order of some
+        function calls.  Comment export process for footnotes.
 
-        * org-footnote.el (org-footnote-normalize): change the export
-        specific parameter to hold properties of export. Thus, the
+        * org-footnote.el (org-footnote-normalize): Change the export
+        specific parameter to hold properties of export.  Thus, the
         function can send every footnote definition in the buffer through
         `org-export-process-string'.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-latex.el (org-export-latex-preprocess): first insert
+        * org-latex.el (org-export-latex-preprocess): First insert
         footnotes in the temporary buffer so their contents can properly
         be protected from further transformations if required.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-indent-offset): new variable.
-        (org-list-struct-fix-ind): make use of the new variable.
+        * org-list.el (org-list-indent-offset): New variable.
+        (org-list-struct-fix-ind): Make use of the new variable.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-latex.el (org-export-latex-list-parameters): complete
+        * org-latex.el (org-export-latex-list-parameters): Complete
         default value with cbtrans option.
 
-        * org-list.el (org-list-to-latex): set a more consistent default
+        * org-list.el (org-list-to-latex): Set a more consistent default
         value.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-swap-items): move it to a meaningful
+        * org-list.el (org-list-swap-items): Move it to a meaningful
         position in source code (i.e. before any function using it), and
         rename it to an easier name.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-separating-blank-lines-number): if there
+        * org-list.el (org-list-separating-blank-lines-number): If there
         are blank lines already in the whole list, add a blank line.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-use-circular-move): new variable.
-        (org-previous-item, org-next-item): make use of the new variable.
-        (org-move-item-down, org-move-item-up): make use of the new
-        variable. Simplify code.
+        * org-list.el (org-list-use-circular-move): New variable.
+        (org-previous-item, org-next-item): Make use of the new variable.
+        (org-move-item-down, org-move-item-up): Make use of the new
+        variable.  Simplify code.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-delete-item, org-list-send-item): new
+        * org-list.el (org-list-delete-item, org-list-send-item): New
         functions.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
@@ -440,7 +439,7 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-capture.el (org-capture-finalize): bugfix about inserted
+        * org-capture.el (org-capture-finalize): Bugfix about inserted
         blank line when killing the capture buffer and
         `org-blank-before-new-entry' tells to not insert anything before a
         heading.
@@ -459,8 +458,8 @@
 
         * org.el (org-last-set-property): New variable.
         (org-read-property-name): Use the new variable: the prompt
-        defaults to the last property set, unless there is a property
-        in the line at point.
+        defaults to the last property set, unless there is a property in
+        the line at point.
 
 2011-07-28  David Maus  <dmaus@ictsoc.de>
 
@@ -505,15 +504,15 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-plain-list-ordered-item-terminator): remove
+        * org-list.el (org-plain-list-ordered-item-terminator): Remove
         incorrect assumption.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-footnote.el (org-footnote-forbidden-blocks): add missing
+        * org-footnote.el (org-footnote-forbidden-blocks): Add missing
         exporter specific blocks.
 
-        * org-list.el (org-list-forbidden-blocks): ditto.
+        * org-list.el (org-list-forbidden-blocks): Ditto.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -527,7 +526,7 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org.el (org-timestamp-up, org-timestamp-down): mention time
+        * org.el (org-timestamp-up, org-timestamp-down): Mention time
         changes in the docstring.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
@@ -538,15 +537,15 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-in-valid-context-p): use `org-in-block-p'.
+        * org-list.el (org-list-in-valid-context-p): Use `org-in-block-p'.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org.el (org-in-block-p): new function.
 
-        * org-footnote.el (org-footnote-forbidden-blocks): new variable.
-        (org-footnote-in-valid-context-p): new function.
-        (org-footnote-at-reference-p): use new function. Allow inline
+        * org-footnote.el (org-footnote-forbidden-blocks): New variable.
+        (org-footnote-in-valid-context-p): New function.
+        (org-footnote-at-reference-p): Use new function.  Allow inline
         footnotes to start at bol.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
@@ -556,7 +555,7 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-ascii.el (org-export-as-utf8): fix call to
+        * org-ascii.el (org-export-as-utf8): Fix call to
         `org-called-interactively-p': it requires an argument.  Also fix
         the docstring.
 
@@ -575,13 +574,13 @@
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
         * org-publish.el
-        (org-publish-cache-file-needs-publishing): only check against .org
+        (org-publish-cache-file-needs-publishing): Only check against .org
         files.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org.el (org-mode): Use org-default as
-        the default face in org-mode.
+        * org.el (org-mode): Use `org-default' as the default face in
+        org-mode.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -592,16 +591,16 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-exp.el (org-export-preprocess-string): if the last subtree
-        is a task, footnotes may be removed along with the subtree. This
+        * org-exp.el (org-export-preprocess-string): If the last subtree
+        is a task, footnotes may be removed along with the subtree.  This
         patch ensures footnotes are put at the end of the buffer after the
         subtree has been removed.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-footnote.el (org-footnote-at-reference-p): verify that what
+        * org-footnote.el (org-footnote-at-reference-p): Verify that what
         looks like a footnote doesn't belong to a link.
-        (org-footnote-next-reference-or-definition): check more strictly
+        (org-footnote-next-reference-or-definition): Check more strictly
         footnote definitions.
 
 2011-07-28  Deech  <deech@deech-ThinkPad-X200.(none)>  (tiny change)
@@ -628,9 +627,8 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-table.el
-        (org-table-time-seconds-to-string): use `org-format-seconds'
-        instead of `format-seconds'.
+        * org-table.el (org-table-time-seconds-to-string): Use
+        `org-format-seconds' instead of `format-seconds'.
 
 2011-07-28  David Maus  <dmaus@ictsoc.de>
 
@@ -647,7 +645,7 @@
         * org-freemind.el (org-freemind-convert-links-helper)
         (org-freemind-convert-text-p, org-freemind-write-mm-buffer)
         (org-freemind-get-node-style): Use org-string-match-p for backward
-        compatibility with Emacs22.
+        compatibility with Emacs 22.
 
 2011-07-28  David Maus  <dmaus@ictsoc.de>
 
@@ -657,7 +655,7 @@
 2011-07-28  David Maus  <dmaus@ictsoc.de>
 
         * ob-haskell.el (org-babel-haskell-export-to-lhs): Call
-        kill-buffer with argument indiciating to kill current
+        `kill-buffer' with argument indiciating to kill current
         buffer. Emacs 22 compatibility.
 
 2011-07-28  David Maus  <dmaus@ictsoc.de>
@@ -667,13 +665,12 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org.el (org-add-planning-info): fix
-        issues with timestamps not being inserted at the same position.
+        * org.el (org-add-planning-info): Fix issues with timestamps not
+        being inserted at the same position.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-table.el
-        (org-table-time-string-to-seconds)
+        * org-table.el (org-table-time-string-to-seconds)
         (org-table-time-seconds-to-string): New functions.
         (org-table-eval-formula): Implement the "T" (time) flag for
         computing durations.
@@ -687,8 +684,8 @@
 
         * org.el (org-fontify-meta-lines-and-blocks-1): Include header
         lines.
-        (org-additional-option-like-keywords): Include data as a synonym for
-        results.
+        (org-additional-option-like-keywords): Include data as a synonym
+        for results.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -697,18 +694,18 @@
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
-        * ob-ref.el (org-babel-ref-goto-headline-id): Don't let org-id
+        * ob-ref.el (org-babel-ref-goto-headline-id): Don't let `org-id'
         rescan all IDs when trying to resolve a reference.
 
 2011-07-28  Julien Barnier  <julien@nozav.org>
 
         * org.el (org-fontify-meta-lines-and-blocks-1): Fix test for src
-        blocks lang attribute
+        blocks lang attribute.
 
 2011-07-28  Eric S Fraga  <e.fraga@ucl.ac.uk>
 
-        * org-latex.el (org-export-latex-timestamp-inactive-markup):
-        New option to allow different markup for inactive timestamps.
+        * org-latex.el (org-export-latex-timestamp-inactive-markup): New
+        option to allow different markup for inactive timestamps.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -718,31 +715,31 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-full-item-re): allow counter and check-box
+        * org-list.el (org-list-full-item-re): Allow counter and check-box
         to be separated by white spaces.
-        (org-list-struct-apply-struct): reflect changes made to
+        (org-list-struct-apply-struct): Reflect changes made to
         `org-list-full-item-re'.
 
-        * org-html.el (org-html-export-list-line): recognize spaces
+        * org-html.el (org-html-export-list-line): Recognize spaces
         between counter and check-boxes as valid.
 
-        * org-docbook.el (org-export-docbook-list-line): ditto.
+        * org-docbook.el (org-export-docbook-list-line): Ditto.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-insert-item): make sure point is moved to
+        * org-list.el (org-list-insert-item): Make sure point is moved to
         the specified POS before starting the function.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-activate-footnote-links): properly fontify inline
+        * org.el (org-activate-footnote-links): Properly fontify inline
         footnotes.
-        (org-set-font-lock-defaults): apply changes to previous function.
+        (org-set-font-lock-defaults): Apply changes to previous function.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-footnote.el (org-footnote-at-reference-p): first check if
-        point is at the beginning of a footnote. Indeed `org-in-regexp'
+        * org-footnote.el (org-footnote-at-reference-p): First check if
+        point is at the beginning of a footnote.  Indeed `org-in-regexp'
         first checks backwards and might find an incorrect footnote if
         they are side-by-side.
 
@@ -751,7 +748,7 @@
         * org-agenda.el (org-agenda-compact-blocks): Improve docstring.
         (org-agenda-block-separator): Add nil to docstring and customization.
         (org-prepare-agenda): Skip agenda block separator additionally if
-        org-agenda-block-separator is nil.
+        `org-agenda-block-separator' is nil.
         (org-agenda-overriding-header): Improve docstring.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
@@ -776,65 +773,65 @@
 2011-07-28  Michael Markert  <markert.michael@googlemail.com>
 
         * ob.el (org-babel-sha1-hash): Adding optional argument KIND to
-        all org-called-interactively-p function invocations.
+        all `org-called-interactively-p' function invocations.
 
         * org-agenda.el (org-agenda-redo): Adding optional argument KIND
-        to all org-called-interactively-p function invocations.
+        to all `org-called-interactively-p' function invocations.
         (org-agenda-show-1): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (org-agenda-set-tags): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
 
         * org-ascii.el (org-export-as-latin1): Adding optional argument
-        KIND to all org-called-interactively-p function invocations.
+        KIND to all `org-called-interactively-p' function invocations.
         (org-export-as-latin1-to-buffer): Adding optional argument KIND to
-        all org-called-interactively-p function invocations.
+        all `org-called-interactively-p' function invocations.
         (org-export-as-utf8-to-buffer): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (org-export-region-as-ascii): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
 
         * org-docbook.el (org-export-region-as-docbook): Adding optional
-        argument KIND to all org-called-interactively-p function
+        argument KIND to all `org-called-interactively-p' function
         invocations.
 
         * org-html.el (org-export-region-as-html): Adding optional
-        argument KIND to all org-called-interactively-p function
+        argument KIND to all `org-called-interactively-p' function
         invocations.
 
         * org-latex.el (org-export-region-as-latex): Adding optional
-        argument KIND to all org-called-interactively-p function
+        argument KIND to all `org-called-interactively-p' function
         invocations.
 
         * org-table.el (org-table-blank-field): Adding optional argument
-        KIND to all org-called-interactively-p function invocations.
+        KIND to all `org-called-interactively-p' function invocations.
         (org-table-current-column): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (org-table-current-dline): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (org-table-sort-lines): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (org-table-sum): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (org-table-rotate-recalc-marks): Adding optional argument KIND to
-        all org-called-interactively-p function invocations.
+        all `org-called-interactively-p' function invocations.
         (org-table-eval-formula): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (orgtbl-send-table): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
 
         * org.el (org-mode): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (org-copy-subtree): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (org-paste-subtree): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (org-store-link): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (org-todo): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
         (org-occur): Adding optional argument KIND to all
-        org-called-interactively-p function invocations.
+        `org-called-interactively-p' function invocations.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
@@ -1171,7 +1168,7 @@
 2011-07-28  Jambunathan K  <kjambunathan@gmail.com>
 
         * org-exp.el (org-export-format-source-code-or-example):
-        Simplify. Also add `org-native-text' as a text property to the
+        Simplify.  Also add `org-native-text' as a text property to the
         formatted text and throw error for unknown backends.
 
 2011-07-28  Jambunathan K  <kjambunathan@gmail.com>
@@ -1185,16 +1182,15 @@
         * org-exp.el (org-export-backends): New variable.
         (org-export-select-backend-specific-text): Use above
         variable. Also mark text between #+BACKEND and
-        #+BEGIN_BACKEND...#+END_BACKEND with org-native-text
-        property. This text property is currently used only by the new
-        line-oriented generic exporter (which is not yet part of the
-        repo).
+        #+BEGIN_BACKEND...#+END_BACKEND with org-native-text property.
+        This text property is currently used only by the new line-oriented
+        generic exporter (which is not yet part of the repo).
 
 2011-07-28  Jambunathan K  <kjambunathan@gmail.com>
 
         * org-exp.el (org-export): Reserve keys 'o' and 'O' for
-        OpenDocumentText export and bind them to org-export-as-odt and
-        org-export-as-odt-and-open.
+        OpenDocumentText export and bind them to `org-export-as-odt' and
+        `org-export-as-odt-and-open'.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -1208,29 +1204,29 @@
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
-        * ob-C.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-C.el (ob-tangle): initialize variable from `ob-tangle'.
 
-        * ob-asymptote.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-asymptote.el (ob-tangle): initialize variable from `ob-tangle'.
 
-        * ob-awk.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-awk.el (ob-tangle): initialize variable from `ob-tangle'.
 
-        * ob-clojure.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-clojure.el (ob-tangle): initialize variable from `ob-tangle'.
 
-        * ob-haskell.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-haskell.el (ob-tangle): initialize variable from `ob-tangle'.
 
-        * ob-latex.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-latex.el (ob-tangle): initialize variable from `ob-tangle'.
 
-        * ob-lisp.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-lisp.el (ob-tangle): initialize variable from `ob-tangle'.
 
-        * ob-ocaml.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-ocaml.el (ob-tangle): initialize variable from `ob-tangle'.
 
-        * ob-perl.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-perl.el (ob-tangle): initialize variable from `ob-tangle'.
 
-        * ob-python.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-python.el (ob-tangle): initialize variable from `ob-tangle'.
 
-        * ob-ruby.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-ruby.el (ob-tangle): initialize variable from `ob-tangle'.
 
-        * ob-tangle.el (ob-tangle): initialize variable from ob-tangle.
+        * ob-tangle.el (ob-tangle): initialize variable from `ob-tangle'.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -1310,9 +1306,8 @@
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>  (tiny change)
 
-        * org.el (org-find-dblock):
-        (org-clocktable-try-shift): Make regexp work also when #+begin
-        line is indentex.
+        * org.el (org-find-dblock, org-clocktable-try-shift): Make regexp
+        work also when #+begin line is indentex.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -1398,28 +1393,33 @@
         `interactive-p'.
         (org-export-as-utf8-to-buffer): Replacing call to now-defunct function
         `interactive-p'.
-        (org-export-region-as-ascii): Replacing call to now-defunct function
-        `interactive-p'.Replacing call to now-defunct function `interactive-p'.
+        (org-export-region-as-ascii): Replacing call to now-defunct
+        function `interactive-p'.Replacing call to now-defunct function
+        `interactive-p'.
 
         * org-docbook.el: Replacing call to now-defunct function
         `interactive-p'.
-        (org-export-region-as-docbook): Replacing call to now-defunct function
-        `interactive-p'.Replacing call to now-defunct function `interactive-p'.
+        (org-export-region-as-docbook): Replacing call to now-defunct
+        function `interactive-p'.Replacing call to now-defunct function
+        `interactive-p'.
 
         * org-html.el: Replacing call to now-defunct function
         `interactive-p'.
-        (org-export-region-as-html): Replacing call to now-defunct function
-        `interactive-p'.Replacing call to now-defunct function `interactive-p'.
+        (org-export-region-as-html): Replacing call to now-defunct
+        function `interactive-p'.Replacing call to now-defunct function
+        `interactive-p'.
 
         * org-latex.el: Replacing call to now-defunct function
         `interactive-p'.
-        (org-export-region-as-latex): Replacing call to now-defunct function
-        `interactive-p'.Replacing call to now-defunct function `interactive-p'.
+        (org-export-region-as-latex): Replacing call to now-defunct
+        function `interactive-p'.Replacing call to now-defunct function
+        `interactive-p'.
 
         * org-macs.el: Replacing call to now-defunct function
         `interactive-p'.
-        (org-called-interactively-p): Replacing call to now-defunct function
-        `interactive-p'.Replacing call to now-defunct function `interactive-p'.
+        (org-called-interactively-p): Replacing call to now-defunct
+        function `interactive-p'.Replacing call to now-defunct function
+        `interactive-p'.
 
         * org-table.el: Replacing call to now-defunct function
         `interactive-p'.
@@ -1442,7 +1442,8 @@
         (orgtbl-send-table): Replacing call to now-defunct function `interactive-p'.
 
         * org.el: Replacing call to now-defunct function `interactive-p'.
-        (org-mode): Replacing call to now-defunct function `interactive-p'.
+        (org-mode): Replacing call to now-defunct function
+        `interactive-p'.
         (org-copy-subtree): Replacing call to now-defunct function
         `interactive-p'.
         (org-paste-subtree): Replacing call to now-defunct function
@@ -1476,8 +1477,8 @@
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
-        * org-html.el (org-export-as-html):
-        (org-html-level-start): Only convert section number underscores to dashes.
+        * org-html.el (org-export-as-html, org-html-level-start): Only
+        convert section number underscores to dashes.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -1527,8 +1528,8 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>  (tiny change)
 
-        * org-list.el (org-list-to-latex): the enumerate environment in
-        latex increments the counter before using it. Therefore, org-mode
+        * org-list.el (org-list-to-latex): The enumerate environment in
+        latex increments the counter before using it.  Therefore, org-mode
         should set the enumeration counter to the desired value minus one.
 
 2011-07-28  Michael Brand  <michael.ch.brand@gmail.com>  (tiny change)
@@ -1538,17 +1539,17 @@
 
 2011-07-28  Christian Egli  <christian.egli@sbszh.ch>
 
-        * org-taskjuggler.el (org-taskjuggler-clean-effort): handle any
+        * org-taskjuggler.el (org-taskjuggler-clean-effort): Handle any
         effort that is accepted by `org-duration-string-to-minutes´.
 
 2011-07-28  Julien Barnier  <julien@nozav.org>
 
-        * ob-sh.el (org-babel-sh-evaluate) : when sending input to comint,
-        wait until previous line execution is finished
+        * ob-sh.el (org-babel-sh-evaluate): When sending input to comint,
+        wait until previous line execution is finished.
 
-        * ob-comint.el (org-babel-comint-with-output) : when looking for
+        * ob-comint.el (org-babel-comint-with-output): When looking for
         end-of-evaluation indicator, search forward for the indicator
-        before searching forward for the prompt
+        before searching forward for the prompt.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -1556,11 +1557,11 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-auto-align-tags): change docstring.
-        (org-update-parent-todo-statistics): keep tags aligned even when
+        * org.el (org-auto-align-tags): Change docstring.
+        (org-update-parent-todo-statistics): Keep tags aligned even when
         statistics cookies are shifting them.
 
-        * org-list.el (org-update-checkbox-count): keep tags aligned even
+        * org-list.el (org-update-checkbox-count): Keep tags aligned even
         when statistics cookies are shifting them.
 
 2011-07-28  Lawrence Mitchell  <wence@gmx.li>
@@ -1571,7 +1572,7 @@
 2011-07-28  Lawrence Mitchell  <wence@gmx.li>
 
         * ob.el (org-babel-result-regexp): Use non-shy group around
-        org-babel-data-names.
+        `org-babel-data-names'.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -1608,7 +1609,7 @@
         `org-activate-mark'.
 
         * org-compat.el (org-activate-mark): New function. Provide
-        `activate-mark' if not present (e.g. Emacs22).
+        `activate-mark' if not present (e.g. Emacs 22).
 
 2011-07-28  David Maus  <dmaus@ictsoc.de>
 
@@ -1640,7 +1641,7 @@
         * org.el (org-self-insert-command): Use `delete-char' instead of
         `delete-backward-char'.
 
-        * org-table.el (orgtbl-self-insert-command): Dto.
+        * org-table.el (orgtbl-self-insert-command): Ditto.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -1653,7 +1654,7 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-latex.el (org-export-latex-preprocess): add
+        * org-latex.el (org-export-latex-preprocess): Add
         `original-indentation' property to footnotes so they cannot
         possibly end a list by being less indented than the item they
         belong to.
@@ -1683,33 +1684,33 @@
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org.el (org-self-insert-command): Catch the case of
-        buffer-undo-list eq t.
+        `buffer-undo-list' eq t.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-toggle-heading): region should be considered as made
+        * org.el (org-toggle-heading): Region should be considered as made
         of full lines, without the last one if region-end is at bol.
-        Removed unused variables. Refactored and commented code.
+        Removed unused variables.  Refactored and commented code.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-toggle-item): when region includes an headline less
+        * org.el (org-toggle-item): When region includes an headline less
         indented than first one, set it as the new reference.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-to-subtree): if the list is before first
+        * org-list.el (org-list-to-subtree): If the list is before first
         heading and `org-odd-levels-only' is non-nil, the first item gets
         two stars instead of one.
 
-        * org.el (org-reduced-level): a level of 0 was reduced to 1 with
+        * org.el (org-reduced-level): A level of 0 was reduced to 1 with
         `org-odd-levels-only' non-nil.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-toggle-item): converting an heading to an item would
+        * org.el (org-toggle-item): Converting an heading to an item would
         sometimes insert unnecessary spaces before it, and unwanted space
-        with `org-indent-mode' on. Changing some text into an item
+        with `org-indent-mode' on.  Changing some text into an item
         wouldn't always preserve indentation.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
@@ -1717,21 +1718,21 @@
         * org-capture.el (org-capture-current-plist): Improve docstring.
         (org-capture-put): Add docstring.
         (org-capture-get): Add docstring.
-        (org-capture-member): Add LOCAL argument. Add docstring.
-        (org-capture-set-target-location): Store the time received from a date
-        prompt into the :prompt-time property.
+        (org-capture-member): Add LOCAL argument.  Add docstring.
+        (org-capture-set-target-location): Store the time received from a
+        date prompt into the :prompt-time property.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-exp.el (org-export-mark-list-properties): even if context is
+        * org-exp.el (org-export-mark-list-properties): Even if context is
         invalid, mark list item with `list-context' property.
 
-        * org-list.el (org-list-forbidden-blocks): add exporters specific
+        * org-list.el (org-list-forbidden-blocks): Add exporters specific
         blocks to the list of forbidden blocks.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-sort-list): function tries to intern
+        * org-list.el (org-sort-list): Function tries to intern
         getkey-func before it is defined, so it's always nil.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
@@ -1750,7 +1751,7 @@
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
-        * ob-sh.el (ob-ref): Uses ob-ref to resolve the value of the
+        * ob-sh.el (ob-ref): Uses `ob-ref' to resolve the value of the
         :stdin header argument.
         (org-babel-execute:sh): Use the :stdin header argument.
         (org-babel-sh-var-to-sh): Split the bulk of this function off into a
@@ -1827,11 +1828,11 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-separating-blank-lines-number): fix
-        confusion between point and item beginning. Now, if no information
-        is avalaible, truly follow user preference when it inserts blank
-        lines manually.
-        (org-list-insert-item): send correct argument to the preceding
+        * org-list.el (org-list-separating-blank-lines-number): Fix
+        confusion between point and item beginning.  Now, if no
+        information is avalaible, truly follow user preference when it
+        inserts blank lines manually.
+        (org-list-insert-item): Send correct argument to the preceding
         function.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
@@ -1845,7 +1846,7 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-indent-line-function): don't include #+include
+        * org.el (org-indent-line-function): Don't include #+include
         lines.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
@@ -1854,7 +1855,8 @@
         org-babel-check-src-block.
 
         * ob.el (org-babel-expand-src-block): Fit within 80 cols.
-        (org-babel-edit-distance): Returns the edit distance of two strings.
+        (org-babel-edit-distance): Returns the edit distance of two
+        strings.
         (org-babel-check-src-block): Check a code block for errors.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>  (tiny change)
@@ -1866,9 +1868,9 @@
 
         * org-table.el
         (org-table-exit-follow-field-mode-when-leaving-table): New option.
-        (org-table-check-inside-data-field): New optional argument `noerror'.
-        When set, the function will only return nil instead of throwing an
-        error.
+        (org-table-check-inside-data-field): New optional argument
+        `noerror'.  When set, the function will only return nil instead of
+        throwing an error.
         (org-table-edit-field): Interpret double prefix argument, and improve
         the properties of the editing window.
         (org-table-follow-field-mode): New minor mode.
@@ -1884,12 +1886,12 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-full-item-re): allow description term to
+        * org-list.el (org-list-full-item-re): Allow description term to
         have a newline character after the colons.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-sort-list): no longer ignore with-case
+        * org-list.el (org-sort-list): No longer ignore with-case
         argument: the function sorted case-sensitively, regardless of
         argument.
 
@@ -1927,12 +1929,12 @@
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org-latex.el (org-export-latex-preprocess): Pipe index entries
-        through org-export-latex-fontify-headline.
+        through `org-export-latex-fontify-headline'.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org-exp.el (org-export-add-options-to-plist): Fix the option
-        parser
+        parser.
 
 2011-07-28  Robert P. Goldman  <rpgoldman@real-time.com>  (tiny change)
 
@@ -1947,7 +1949,7 @@
 2011-07-28  Matt Lundin  <mdl@imapmail.org>
 
         * org-agenda.el (org-agenda-open-link): Pass entire text of agenda
-        line to org-offer-links-in-entry.
+        line to `org-offer-links-in-entry'.
 
 2011-07-28  Michael Markert  <markert.michael@googlemail.com>
 
@@ -1963,8 +1965,8 @@
         existing headline.
         (org-bibtex-export-arbitrary-fields)
         (org-bibtex-treat-headline-as-title): Fix typos
-        (org-bibtex-fleshout): Don't upcase optional field; remove ":" from
-        type completion.
+        (org-bibtex-fleshout): Don't upcase optional field; remove ":"
+        from type completion.
 
 2011-07-28  Matt Lundin  <mdl@imapmail.org>
 
@@ -1977,11 +1979,11 @@
 
 2011-07-28  Tom Dye  <tsd@tsdye.com>
 
-        * org-bibtex.el: Added crossref field to other fields
+        * org-bibtex.el: Added crossref field to other fields.
 
 2011-07-28  Tom Dye  <tsd@tsdye.com>
 
-        * org-bibtex.el: Add crossref option to incollection
+        * org-bibtex.el: Add crossref option to incollection.
 
 2011-07-28  Matt Lundin  <mdl@imapmail.org>
 
@@ -1995,15 +1997,16 @@
 
 2011-07-28  Matt Lundin  <mdl@imapmail.org>
 
-        * org-bibtex.el (org-bibtex-tags): New variable
-        (org-bibtex-tags-are-keywords): New variable
-        (org-bibtex-no-export-tags): New variable
-        (org-bibtex-headline): Export tags as comma-separated bibtex keywords
-        (org-bibtex-read): Import bibtex keywords field as tags
+        * org-bibtex.el (org-bibtex-tags): New variable.
+        (org-bibtex-tags-are-keywords): New variable.
+        (org-bibtex-no-export-tags): New variable.
+        (org-bibtex-headline): Export tags as comma-separated bibtex
+        keywords.
+        (org-bibtex-read): Import bibtex keywords field as tags.
 
 2011-07-28  Manuel Giraud  <manuel.giraud@univ-nantes.fr>
 
-        * org-publish.el (org-publish-find-date): optimization
+        * org-publish.el (org-publish-find-date): Optimization.
 
 2011-07-28  Tassilo Horn  <tassilo@member.fsf.org>
 
@@ -2014,12 +2017,13 @@
 
         * org-publish.el (org-publish-project-alist): Document new
         :sitemap-sans-extension property.
-        (org-publish-org-sitemap): Use new sitemap-sans-extension setting.
+        (org-publish-org-sitemap): Use new `sitemap-sans-extension'
+        setting.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org.el (org-remove-uninherited-tags): Renamed from
-        org-remove-iniherited-tags.
+        `org-remove-iniherited-tags'.
         (org-scan-tags): Fix typo in function call.
         (org-get-tags-at): Fix typo in function call.
 
@@ -2069,8 +2073,9 @@
 
         * org-bibtex.el (org-bibtex-export-arbitrary-fields): New option.
         (org-bibtex-key-property): New option.
-        (org-bibtex-put): Make use of new `org-bibtex-key-property' variable.
-        (org-bibtex-headline):  Make use of new
+        (org-bibtex-put): Make use of new `org-bibtex-key-property'
+        variable.
+        (org-bibtex-headline): Make use of new
         `org-bibtex-export-arbitrary-fields' and `org-bibtex-key-property'
         variables.
         (org-bibtex-autokey):  Make use of new `org-bibtex-key-property'
@@ -2133,20 +2138,20 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-exp.el (org-export-preprocess-string): mark list end before
-        expanding macros. Thus, a macro inside a list and containing blank
-        lines cannot break the list structure.
-        (org-export-preprocess-apply-macros): multi-lines macros get
-        indented with the same indentation as the first line. Thus, we are
-        sure that every line belongs to the same list as the first line, if
-        such list exists. Also add comments in code.
+        * org-exp.el (org-export-preprocess-string): Mark list end before
+        expanding macros.  Thus, a macro inside a list and containing
+        blank lines cannot break the list structure.
+        (org-export-preprocess-apply-macros): Multi-lines macros get
+        indented with the same indentation as the first line.  Thus, we
+        are sure that every line belongs to the same list as the first
+        line, if such list exists.  Also add comments in code.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org-agenda.el (org-agenda-clock-consistency-checks): New option.
         (org-agenda-list): Handle display change to clock check.
-        (org-agenda-get-progress): Show only clock entries if we are doing the
-        consistency check.
+        (org-agenda-get-progress): Show only clock entries if we are doing
+        the consistency check.
         (org-agenda-show-clocking-issues): New function.
         (org-agenda-check-clock-gap): New function.
         (org-agenda-view-mode-dispatch): Offer consistency check.
@@ -2158,7 +2163,7 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-struct): when walking down the list, the
+        * org-list.el (org-list-struct): When walking down the list, the
         function would not pay attention to drawers or blocks indentation.
         Thus, such constructs couldn't consistently end an item or a list.
         This patch ensures line indentation is stored (if applicable)
@@ -2167,7 +2172,7 @@
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org-exp.el (org-export): Add EXPORT_FILE_NAME to the enclosing
-        tree properties
+        tree properties.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -2178,36 +2183,35 @@
 
         * org-exp.el (org-export): Go to next heading before searching
         backward, so make this also work if we are on the headline of the
-        entry with the property...
+        entry with the property.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org.el (org-promote):
         (org-demote): Soften the previous change, by only removing the
-        flyspell function from after-change functions, because that was the
-        one causing the slowdown - at least much of it.
+        flyspell function from after-change functions, because that was
+        the one causing the slowdown - at least much of it.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
-        * org.el (org-promote):
-        (org-demote): Turn off after-change-functions to speed up the
-        reindentation of text.
+        * org.el (org-promote, org-demote): Turn off
+        after-change-functions to speed up the reindentation of text.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
-        * ob-ocaml.el (org-babel-ocaml-read-list): Using
+        * ob-ocaml.el (org-babel-ocaml-read-list): Use
         `org-babel-script-escape'.
-        (org-babel-ocaml-read-array): Using `org-babel-script-escape'.
+        (org-babel-ocaml-read-array): Use `org-babel-script-escape'.
 
 2011-07-28  Manuel Giraud  <manuel.giraud@univ-nantes.fr>
 
-        * org-html.el (org-html-handle-links): add an alternate for inline
+        * org-html.el (org-html-handle-links): Add an alternate for inline
         images
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org-agenda.el (org-agenda-bulk-action): Do not use the entries
-        variable before it is defined
+        variable before it is defined.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -2221,16 +2225,17 @@
 
 2011-07-28  Manuel Giraud  <manuel.giraud@univ-nantes.fr>
 
-        * org-html.el (org-html-make-link): correct a bug in coderef link.
+        * org-html.el (org-html-make-link): Correct a bug in coderef link.
 
 2011-07-28  Bernt Hansen  <bernt@norang.ca>
 
-        * org-agenda.el (org-agenda-filter-by-tag): Fix variable name typo
+        * org-agenda.el (org-agenda-filter-by-tag): Fix variable name
+        typo.
 
 2011-07-28  Bernt Hansen  <bernt@norang.ca>
 
         * org-agenda.el (org-agenda-get-timestamps): Fix agenda display
-        when headlines are missing
+        when headlines are missing.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -2263,13 +2268,11 @@
 
 2011-07-28  Julien Danjou  <julien@danjou.info>
 
-        * org.el (org-entry-get):
-        (org-entry-delete):
-        (org-entry-put):
-        (org-property-values):
-        (org-delete-property-globally): Use org-re-property.
-        (org-re-property): New function allowing to build a regexp to match a
-        property.
+        * org.el (org-entry-get, org-entry-delete, org-entry-put)
+        (org-property-values, org-delete-property-globally): Use
+        `org-re-property'.
+        (org-re-property): New function allowing to build a regexp to
+        match a property.
 
 2011-07-28  Julien Danjou  <julien@danjou.info>
 
@@ -2291,9 +2294,9 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-in-valid-context-p): renamed from
-        org-list-in-valid-block-p.
-        (org-at-item-p,org-list-search-generic): use renamed function.
+        * org-list.el (org-list-in-valid-context-p): Renamed from
+        `org-list-in-valid-block-p'.
+        (org-at-item-p,org-list-search-generic): Use renamed function.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
@@ -2303,21 +2306,21 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-latex.el: pay attention to end of footnote.  Before closing
+        * org-latex.el: Pay attention to end of footnote.  Before closing
         the command, ensure that list is properly closed or that last link
         is separated from the curly brace.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-indent-line-function): footnote definition must stay
-        at column 0 to be recognized as such. Body below can have normal
+        * org.el (org-indent-line-function): Footnote definition must stay
+        at column 0 to be recognized as such.  Body below can have normal
         indentation, so it should ignore its definition when computing
         indentation.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-protocol.el (org-protocol-remember)
-        (org-protocol-capture): More appropriate message.
+        * org-protocol.el (org-protocol-remember, org-protocol-capture):
+        More appropriate message.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -2333,7 +2336,7 @@
 2011-07-28  Bernt Hansen  <bernt@norang.ca>
 
         * org-agenda.el: Remove obsolete code for adding todo list in
-        front of the agenda
+        front of the agenda.
 
 2011-07-28  Lawrence Mitchell  <wence@gmx.li>
 
@@ -2357,7 +2360,7 @@
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
         * ob-lisp.el (org-babel-execute:lisp): Turn vectors into lists
-        before reading by elisp
+        before reading by elisp.
         (org-bable-lisp-vector-to-list): Stub of a vector->list function,
         should be replaced with a cl-vector->el-vector function.
 
@@ -2376,7 +2379,7 @@
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
-        * org-beamer.el (org-beamer-environments-extra): Fix docstring
+        * org-beamer.el (org-beamer-environments-extra): Fix docstring.
 
 2011-07-28  Lawrence Mitchell  <wence@gmx.li>
 
@@ -2385,7 +2388,7 @@
 
 2011-07-28  Lawrence Mitchell  <wence@gmx.li>
 
-        * org-html.el (org-export-as-html) (org-html-level-start): Fix
+        * org-html.el (org-export-as-html, org-html-level-start): Fix
         logic for section number printing when NUM is an integer.
 
 2011-07-28  Lawrence Mitchell  <wence@gmx.li>
@@ -2396,7 +2399,7 @@
 2011-07-28  Lawrence Mitchell  <wence@gmx.li>
 
         * org.el (org-point-at-end-of-empty-headline): Bind
-        case-fold-search to nil.
+        `case-fold-search' to nil.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -2413,10 +2416,10 @@
 
         * org.el (org-ts-regexp-both): Add "]" to class of characters that
         should not be matched.
-        (org-ts-regexp0):
-        (org-ts-regexp1): Do not start a class with "^]-+", because that tries
-        to (not) match characters between "]" and "+".  Instead, move the "-"
-        to the end of the class where it causes no harm.
+        (org-ts-regexp0, org-ts-regexp1): Do not start a class with
+        "^]-+", because that tries to (not) match characters between "]"
+        and "+".  Instead, move the "-" to the end of the class where it
+        causes no harm.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -2427,7 +2430,7 @@
 
         * ob-tangle.el (org-babel-tangle-collect-blocks): Brought the link
         extraction code into line with a newer version of the
-        org-store-link function.
+        `org-store-link' function.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -2439,8 +2442,8 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el: move org-update-checkbox-count-maybe call outside
-        of save-excursion to get back to original position.
+        * org-list.el: Move `org-update-checkbox-count-maybe' call outside
+        of ̀save-excursion' to get back to original position.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -2455,11 +2458,14 @@
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
-        * org-ascii.el (org-export-as-ascii):
+        * org-ascii.el (org-export-as-ascii): Pass the :done-tasks
+        property to the export preprocessor.
 
-        * org-docbook.el (org-export-as-docbook):
+        * org-docbook.el (org-export-as-docbook): Pass the :done-tasks
+        property to the export preprocessor.
 
-        * org-html.el (org-export-as-html):
+        * org-html.el (org-export-as-html): Pass the :done-tasks property
+        to the export preprocessor.
 
         * org-latex.el (org-export-as-latex): Pass the :done-tasks
         property to the export preprocessor.
@@ -2481,14 +2487,14 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-toggle-checkbox): build value of
+        * org-list.el (org-toggle-checkbox): Build value of
         org-keyword-time-regexp instead of using it directly, as it's
         buffer-local, and function might be called outside Org.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-struct,org-in-item-p): don't assume end of
-        blocks or drawers necessarily start somewhere. It it isn't the
+        * org-list.el (org-list-struct,org-in-item-p): Don't assume end of
+        blocks or drawers necessarily start somewhere.  It it isn't the
         case, treat them as normal text.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
@@ -2504,14 +2510,14 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-checkbox): when called from an headline,
+        * org-list.el (org-list-checkbox): When called from an headline,
         function would normally skip drawers, but not if a SCHEDULED or
-        DEADLINE keyword is standing before the drawer. Also avoid
+        DEADLINE keyword is standing before the drawer.  Also avoid
         problems if function is called in buffers not is Org mode.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-clock.el (org-clock-report): change the scope of the
+        * org-clock.el (org-clock-report): Change the scope of the
         inserted clock report depending on whether the point is within a
         subtree (:scope subtree) or not (:scope file).
 
@@ -2541,7 +2547,7 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-protocol.el (org-protocol-do-capture): allow template keys
+        * org-protocol.el (org-protocol-do-capture): Allow template keys
         of two characters.
         (org-protocol-default-template-key): Update the docstring to
         reflect the change in `org-protocol-do-capture'.
@@ -2582,21 +2588,21 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-in-item-p): re-build org-drawer-regexp,
+        * org-list.el (org-in-item-p): Re-build `org-drawer-regexp',
         whatever the major mode is.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-inlinetask.el (org-inlinetask-export-templates): fix default
+        * org-inlinetask.el (org-inlinetask-export-templates): Fix default
         templates.
-        (org-inlinetask-export-handler): Ensure contents of inline task, if
-        any, starts and ends with a newline character. Refactor and comment
-        code.
+        (org-inlinetask-export-handler): Ensure contents of inline task,
+        if any, starts and ends with a newline character.  Refactor and
+        comment code.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org-capture.el (org-datetree-find-date-create): Lower-case for
-        variable names in define-function form.
+        variable names in `define-function' form.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -2610,7 +2616,7 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-latex.el (org-export-latex-preprocess): last brace shouldn't
+        * org-latex.el (org-export-latex-preprocess): Last brace shouldn't
         be on the same line as a list end marker.
 
 2011-07-28  Julien Danjou  <julien@danjou.info>
@@ -2633,10 +2639,10 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-to-generic): set a default term for
-        ill-formed description lists. Do not insert newline characters
+        * org-list.el (org-list-to-generic): Set a default term for
+        ill-formed description lists.  Do not insert newline characters
         unless told to.
-        (org-list-to-texinfo,org-list-to-html): apply changes to
+        (org-list-to-texinfo,org-list-to-html): Apply changes to
         `org-list-parse-liste'.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
@@ -2661,16 +2667,16 @@
 
         * org-taskjuggler.el (org-taskjuggler-compute-task-leafiness):
         Compute the leafiness of a node.
-        (org-taskjuggler-open-task, org-export-as-taskjuggler): Mark a node as
-        a milestone if it is a leaf and has no effort.
+        (org-taskjuggler-open-task, org-export-as-taskjuggler): Mark a
+        node as a milestone if it is a leaf and has no effort.
 
 2011-07-28  Christian Egli  <christian.egli@alumni.ethz.ch>
 
         * org-taskjuggler.el (org-export-taskjuggler-target-version):
-        (org-taskjuggler-targeting-tj3-p): Add some minimal infrastructure to
-        handle export to both tj2 and tj3.
-        (org-taskjuggler-open-task): Use a different way to purge allocations
-        for tj2 and tj3.
+        (org-taskjuggler-targeting-tj3-p): Add some minimal infrastructure
+        to handle export to both tj2 and tj3.
+        (org-taskjuggler-open-task): Use a different way to purge
+        allocations for tj2 and tj3.
 
 2011-07-28  Matt Lundin  <mdl@imapmail.org>
 
@@ -2799,7 +2805,7 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-parse-list): fixed regexp.
+        * org-list.el (org-list-parse-list): Fixed regexp.
 
 2011-07-28  David Maus  <dmaus@ictsoc.de>
 
@@ -2832,8 +2838,8 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-fill-paragraph): fill-forward-paragraph function has
-        been introduced with emacs 23.1.
+        * org.el (org-fill-paragraph): `fill-forward-paragraph' function
+        has been introduced with emacs 23.1.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -2856,18 +2862,18 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-adaptive-fill-function): when a region is specified
+        * org.el (org-adaptive-fill-function): When a region is specified
         first line of paragraph isn't skipped, so fill-paragraph have to
         be computed even if point is at an item.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-in-valid-block-p): new function.
-        (org-at-item-p,org-list-search-generic): use new function.
+        * org-list.el (org-list-in-valid-block-p): New function.
+        (org-at-item-p,org-list-search-generic): Use new function.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-indent-line-function): text in both a list and a
+        * org.el (org-indent-line-function): Text in both a list and a
         valid block is indented with regards to current item, not to block
         boundaries.
 
@@ -2905,7 +2911,7 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-timer.el (org-timer-item): save-excursion prevents
+        * org-timer.el (org-timer-item): `save-excursion' prevents
         `org-list-struct' to get the list structure when point isn't on
         the first line of the item.
 
@@ -2918,7 +2924,7 @@
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org-list.el (org-update-checkbox-count): Ensure cookies on an
-        heading are correctly updated when checkboxes are hidden. It
+        heading are correctly updated when checkboxes are hidden.  It
         allows, for example, to use C-c C-x C-b on a collapsed tree and
         still get the update.
 
@@ -2974,19 +2980,19 @@
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org-inlinetask.el (org-inlinetask-promote)
-        (org-inlinetask-demote): new functions.
+        (org-inlinetask-demote): New functions.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-demote-subtree,org-promote-subtree): wrap
-        org-map-tree into org-with-limited-levels macro, so it avoids
+        * org.el (org-demote-subtree,org-promote-subtree): Wrap
+        `org-map-tree' into `org-with-limited-levels' macro, so it avoids
         operating on inline tasks.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org.el (org-narrow-to-subtree): ensure `org-back-to-heading'
         will move point to a real heading and not an inline task by
-        wraping function into a org-with-limited-levels macro.
+        wraping function into a `org-with-limited-levels' macro.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -3211,17 +3217,17 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-exp.el (org-export-mark-list-end): change end marker
+        * org-exp.el (org-export-mark-list-end): Change end marker.
 
-        * org-docbook.el (org-export-docbook-list-line): use new marker.
+        * org-docbook.el (org-export-docbook-list-line): Use new marker.
 
-        * org-html.el (org-html-export-list-line): use new marker
+        * org-html.el (org-html-export-list-line): Use new marker.
 
-        * org-latex.el (org-export-latex-lists): use new marker
+        * org-latex.el (org-export-latex-lists): Use new marker.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-latex.el (org-export-latex-lists): make sure markers used
+        * org-latex.el (org-export-latex-lists): Make sure markers used
         for export are taken into account by temporarily setting an
         appropriate value for `org-list-ending-method'.
 
@@ -3270,14 +3276,14 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-open-at-point): if a link to a radio target is the
+        * org.el (org-open-at-point): If a link to a radio target is the
         first, (resp. the last), element of a buffer, function cannot find
         the property change required to get its boundaries, and
         `buffer-substring' is called with an invalid nil argument.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-table.el (org-table-copy-down): fix docstring.
+        * org-table.el (org-table-copy-down): Fix docstring.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -3304,19 +3310,19 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-insert-item): when computing size of item
+        * org-list.el (org-list-insert-item): When computing size of item
         being inserted, function has to take into account that indentation
         may not only be made of spaces.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-clock.el (org-clock-find-position): if a list was adjacent
+        * org-clock.el (org-clock-find-position): If a list was adjacent
         to some clocks and a drawer was going to be created, only the
         first element of the list would make it into the drawer.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-toggle-checkbox): fix bug where top item in
+        * org-list.el (org-toggle-checkbox): Fix bug where top item in
         list was omitted when checking boxes.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
@@ -3353,8 +3359,8 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-cycle-item-indentation): do not break an
-        indentation cycle because visibility cycling is requested. This
+        * org-list.el (org-cycle-item-indentation): Do not break an
+        indentation cycle because visibility cycling is requested.  This
         happens when an item becomes a parent, due to indentation change.
         Not considered empty anymore, the function cannot change its
         indentation again.
@@ -3378,11 +3384,11 @@
         (org-babel-insert-result): Writing code block results to lists has
         been updated to reflect the new list structure.
         (org-babel-result-end): Remove a previous change to end-of-list
-        marker detection
+        marker detection.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-cycle-item-indentation): each time the function
+        * org-list.el (org-cycle-item-indentation): Each time the function
         moves item back to child position, a white space is added to the
         line.
 
@@ -3398,9 +3404,9 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-ctrl-c-ctrl-c): call `org-list-send-list' only when
+        * org.el (org-ctrl-c-ctrl-c): Call `org-list-send-list' only when
         cursor it at very first item of the list, as specified in the
-        manual. Also refactored the list part of the function a bit.
+        manual.  Also refactored the list part of the function a bit.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -3418,606 +3424,609 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-toggle-checkbox, org-update-checkbox-count): no
-        need to wrap org-entry-get in ignore-errors since commit
-        7dd425cc5d42fb297f547f713edfdc936f9271f0
+        * org-list.el (org-toggle-checkbox, org-update-checkbox-count): No
+        need to wrap `org-entry-get' in `ignore-errors'.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-toggle-item, org-toggle-heading): make sure every
+        * org.el (org-toggle-item, org-toggle-heading): Make sure every
         sub-item in a list is changed into a sub-heading and sub-headings
-        are translated into sub-items. Also ignore inline tasks in the
+        are translated into sub-items.  Also ignore inline tasks in the
         process.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-exp.el (org-export-select-backend-specific-text): add
+        * org-exp.el (org-export-select-backend-specific-text): Add
         `original-indentation' property when replacing #+begin_backend and
-        #+backend blocks with their content. This is needed for lists, as
+        #+backend blocks with their content.  This is needed for lists, as
         they must know if the block belonged to them.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-html.el (org-html-export-list-line): insert a newline
+        * org-html.el (org-html-export-list-line): Insert a newline
         character before ending an item, as anchor could be on a line
         going to be deleted, like a drawer ending string.
 
-        * org-list.el (org-list-to-html): same.
+        * org-list.el (org-list-to-html): Same.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-set-autofill-regexps): use `org-item-re' in
+        * org.el (org-set-autofill-regexps): Use `org-item-re' in
         `paragraph-start' to recognize alphabetical lists.
-        (org-fill-paragraph): enforce a pre-computed fill-prefix before
-        calling fill-paragraph when point in in an item. Also prevent
+        (org-fill-paragraph): Enforce a pre-computed fill-prefix before
+        calling `fill-paragraph' when point in in an item.  Also prevent
         paragraphs getting merged into an adjacent list upon filling.
-        (org-adaptive-fill-function): make sure to determine real fill-prefix
-        for auto-fill.
-        (org-auto-fill-function): use a pre-computed fill-prefix before
-        calling do-auto-fill.
+        (org-adaptive-fill-function): Make sure to determine real
+        fill-prefix for auto-fill.
+        (org-auto-fill-function): Use a pre-computed fill-prefix before
+        calling `do-auto-fill'.
 
-        * org-list.el (org-list-item-body-column): new function
+        * org-list.el (org-list-item-body-column): New function.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org-inlinetask.el (org-inlinetask-at-task-p)
-        (org-inlinetask-toggle-visibility): new functions.
+        (org-inlinetask-toggle-visibility): New functions.
 
-        * org-list.el (org-list-set-item-visibility): new function.
+        * org-list.el (org-list-set-item-visibility): New function.
 
-        * org.el (org-cycle, org-cycle-internal-local): separate lists and
+        * org.el (org-cycle, org-cycle-internal-local): Separate lists and
         inline tasks from headlines.
-        (org-outline-level): do not consider lists as headlines.
-        Cycling visibility is using different tools.
+        (org-outline-level): Do not consider lists as headlines.  Cycling
+        visibility is using different tools.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-struct): mark items less indented than top
+        * org-list.el (org-list-struct): Mark items less indented than top
         item of the list, so that they will be modified.
-        (org-list-struct-apply-struct): compare struct's indentation with
-        line's indentation instead of old-struct's. This is needed because
-        `org-list-struct' automatically fixes indentation so changes might not
-        be seen otherwise.
+        (org-list-struct-apply-struct): Compare struct's indentation with
+        line's indentation instead of old-struct's.  This is needed
+        because `org-list-struct' automatically fixes indentation so
+        changes might not be seen otherwise.
 
-        * org.el (org-ctrl-c-ctrl-c): small refactoring.
+        * org.el (org-ctrl-c-ctrl-c): Small refactoring.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-update-checkbox-count): when a part of the
+        * org-list.el (org-update-checkbox-count): When a part of the
         buffer is processed to count checkboxes, lists are read from top
         to bottom, but inside lists (in drawers, blocks, or inline tasks)
-        are skipped. Thus, cookies cannot be updated. This patch enforces
-        reading of such lists if counter is itself in a special context.
+        are skipped.  Thus, cookies cannot be updated.  This patch
+        enforces reading of such lists if counter is itself in a special
+        context.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-struct-apply-struct): inline tasks along
+        * org-list.el (org-list-struct-apply-struct): Inline tasks along
         with their content must stay at column 0 even if the item is
-        gaining indentation. Moreover, fix indentation of text in an
+        gaining indentation.  Moreover, fix indentation of text in an
         inline task, now it can be in such a task within a list.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-at-item-p): also verify context is valid.
-        Otherwise it would recognize valid items where org-in-item-p
+        * org-list.el (org-at-item-p): Also verify context is valid.
+        Otherwise it would recognize valid items where `org-in-item-p'
         wouldn't.
-        (org-in-item-p, org-list-struct-apply-struct): use shorter version of
-        org-at-item-p.
-        (org-cycle-list-bullet): fix typo.
-        (org-list-parse-list): avoid calling org-at-item-p two times by using
-        an appropriate regexp
+        (org-in-item-p, org-list-struct-apply-struct): Use shorter version
+        of org-at-item-p.
+        (org-cycle-list-bullet): Fix typo.
+        (org-list-parse-list): Avoid calling `org-at-item-p' two times by
+        using an appropriate regexp.
 
-        * org.el (org-indent-line-function): use an appropriate regexp
-        instead of calling org-at-item-p two times.
+        * org.el (org-indent-line-function): Use an appropriate regexp
+        instead of calling `org-at-item-p' two times.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org-list.el (org-in-item-p): When point was just after
-        org-list-end-re, check wouldn't be done for starting line. So, if
+        org-list-end-re, check wouldn't be done for starting line.  So, if
         the first line was an item, it wouln't be noticed and function
-        would return nil. Simplify and comment code.
+        would return nil.  Simplify and comment code.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-toggle-item): when used on normal text, ensure every
+        * org.el (org-toggle-item): When used on normal text, ensure every
         line in region is included in the new item, regardless of its
         original indentation.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-struct-apply-struct): if end of list was
+        * org-list.el (org-list-struct-apply-struct): If end of list was
         at eol, for example, with list inside a block, the last list
-        wouldn't be shifted. Thus, the patch ensures no blank lines is
+        wouldn't be shifted.  Thus, the patch ensures no blank lines is
         skipped.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org.el (org-toggle-item): Now accepts a prefix argument. When
         used without argument on normal text, it will make the whole
-        region one item. With an argument, it defaults to old behavior:
+        region one item.  With an argument, it defaults to old behavior:
         change each line in region into an item.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-return): when called from inside an item with the
-        indent flag, function should keep text moved inside the item. This
-        allows to use C-j to separate lines in an item: cursor won't go
-        back to column 0.
+        * org.el (org-return): When called from inside an item with the
+        indent flag, function should keep text moved inside the item.
+        This allows to use C-j to separate lines in an item: cursor won't
+        go back to column 0.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org-list.el (org-list-struct): when a line has org-example
-        property, skip the entire block. This is needed during export, for
-        example when src blocks in org markup contain lists, and are
+        property, skip the entire block.  This is needed during export,
+        for example when src blocks in org markup contain lists, and are
         returned verbatim because org isn't in the list of interpreted
         languages.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-in-item-p): handle special cases when function
+        * org-list.el (org-in-item-p): Handle special cases when function
         is called with cursor amidst `org-list-end-re' or at an inline
         task.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * ob.el (org-babel-result-end): apply renaming.
+        * ob.el (org-babel-result-end): Apply renaming.
 
-        * org-exp.el (org-export-mark-list-properties): apply renaming.
+        * org-exp.el (org-export-mark-list-properties): Apply renaming.
 
-        * org-list.el (org-list-prevs-alist): renamed from
-        org-list-struct-prev-alist.
-        (org-list-parents-alist): renamed from org-list-struct-parent-alist.
-        (org-list-write-struct): renamed from org-list-struct-fix-struct.
-        (org-list-parse-list, org-sort-list, org-list-indent-item-generic,
-        org-toggle-checkbox, org-update-checkbox-count, org-cycle-list-bullet,
-        org-list-repair, org-insert-item, org-move-item-up, org-move-item-up,
-        org-move-item-down, org-next-item, org-previous-item,
-        org-end-of-item-list, org-beginning-of-item-list, org-apply-on-list):
-        apply renaming.
-        (org-get-bullet): removed function, as it is not needed anymore.
+        * org-list.el (org-list-prevs-alist): Renamed from
+        `org-list-struct-prev-alist'.
+        (org-list-parents-alist): Renamed from `org-list-struct-parent-alist'.
+        (org-list-write-struct): Renamed from `org-list-struct-fix-struct'.
+        (org-list-parse-list, org-sort-list, org-list-indent-item-generic)
+        (org-toggle-checkbox, org-update-checkbox-count)
+        (org-cycle-list-bullet, org-list-repair, org-insert-item)
+        (org-move-item-up, org-move-item-up, org-move-item-down)
+        (org-next-item, org-previous-item, org-end-of-item-list)
+        (org-beginning-of-item-list, org-apply-on-list): Apply renaming.
+        (org-get-bullet): Removed function, as it is not needed anymore.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-insert-item-generic): change arguments.
-        The function now accepts structure and previous items alist. This
-        allow to insert an item programmatically more easily.
-        (org-insert-item): Apply changes to org-list-insert-item-generic. The
-        function now takes care about repairing structure and updating
-        checkboxes.
+        * org-list.el (org-list-insert-item-generic): Change arguments.
+        The function now accepts structure and previous items alist.  This
+        allows to insert an item programmatically more easily.
+        (org-insert-item): Apply changes to
+        `org-list-insert-item-generic'.  The function now takes care about
+        repairing structure and updating checkboxes.
 
         * org-timer.el (org-timer-item): Apply changes to
-        org-list-insert-item-generic. The function now takes care about
+        `org-list-insert-item-generic'.  The function now takes care about
         repairing structure.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-make-subtree): function now uses
-        org-list-parse-list mechanism.
-        (org-list-make-subtrees): removed function.
-        (org-list-to-generic): added a parameter and every parameter can be a
-        sexp returning a string, for finer control.
-        (org-list-to-html, org-list-to-latex, org-list-to-texinfo): slight
-        modifications to apply changes to org-list-to-generic.
-        (org-list-to-subtree): new function.
+        * org-list.el (org-list-make-subtree): Function now uses
+        `org-list-parse-list mechanism'.
+        (org-list-make-subtrees): Removed function.
+        (org-list-to-generic): Added a parameter and every parameter can
+        be a sexp returning a string, for finer control.
+        (org-list-to-html, org-list-to-latex, org-list-to-texinfo): Slight
+        modifications to apply changes to `org-list-to-generic'.
+        (org-list-to-subtree): New function.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-beginning-of-line): apply changes to
+        * org.el (org-beginning-of-line): Apply changes to
         `org-item-beginning-re' to correct sub-expression reference.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-docbook.el (org-export-docbook-list-line): even with
+        * org-docbook.el (org-export-docbook-list-line): Even with
         alphabetical lists, Org shouldn't enforce a particular list type
-        to exporters. This is a job for style files.
+        to exporters.  This is a job for style files.
 
-        * org-html.el (org-html-export-list-line): ib idem.
+        * org-html.el (org-html-export-list-line): Ib idem.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-at-item-counter-p): new function.
-        (org-list-parse-list): handle counters and list depth.
-        (org-list-to-generic): a special string is used when an item has a
+        * org-list.el (org-at-item-counter-p): New function.
+        (org-list-parse-list): Handle counters and list depth.
+        (org-list-to-generic): A special string is used when an item has a
         counter.
-        (org-list-to-latex): use new special string for counters. This fixes
-        the counter bug in LaTeX export, as the enumi counter was the only one
-        modified.
+        (org-list-to-latex): Use new special string for counters.  This
+        fixes the counter bug in LaTeX export, as the enumi counter was
+        the only one modified.
 
-        * org-latex.el (org-export-latex-lists): use new
+        * org-latex.el (org-export-latex-lists): Use new
         `org-list-parse-list' output.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-get-list-type): new function.
-        (org-list-parse-list): use new function.
+        * org-list.el (org-list-get-list-type): New function.
+        (org-list-parse-list): Use new function.
 
-        * org-html.el (org-html-export-list-line): use new function.
+        * org-html.el (org-html-export-list-line): Use new function.
 
-        * org-docbook.el (org-export-docbook-list-line): use new function.
+        * org-docbook.el (org-export-docbook-list-line): Use new function.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-alphabetical-lists): new variable
-        (org-item-re, org-list-full-item, org-cycle-list-bullet,
-        org-list-struct-fix-bul, org-list-inc-bullet-maybe): reflect
+        * org-list.el (org-alphabetical-lists): New variable
+        (org-item-re, org-list-full-item, org-cycle-list-bullet)
+        (org-list-struct-fix-bul, org-list-inc-bullet-maybe): Reflect
         introduction of the new variable.
-        (org-item-beginning-re): changed into a function, so any modification
-        of `org-alphabetical-lists' will not require reloading Org.
-        (org-at-item-p, org-toggle-checkbox, org-update-checkbox-count,
-        org-list-parse-list, org-list-send-list): reflect changes to
+        (org-item-beginning-re): Changed into a function, so any
+        modification of `org-alphabetical-lists' will not require
+        reloading Org.
+        (org-at-item-p, org-toggle-checkbox, org-update-checkbox-count)
+        (org-list-parse-list, org-list-send-list): Reflect changes to
         `org-item-beginning-re'.
-        (org-list-use-alpha-bul-p): new function.
+        (org-list-use-alpha-bul-p): New function.
 
-        * org.el (org-check-for-hidden): reflect changes to
+        * org.el (org-check-for-hidden): Reflect changes to
         `org-item-beginning-re'.
 
-        * org-capture.el (org-capture-place-item): reflect changes to
+        * org-capture.el (org-capture-place-item): Reflect changes to
         `org-item-beginning-re'.
 
-        * org-docbook.el (org-export-docbook-list-line): handle new type
+        * org-docbook.el (org-export-docbook-list-line): handle New type
         of items.
 
         * org-exp.el (org-export-mark-list-end)
-        (org-export-mark-list-properties): reflect changes to
+        (org-export-mark-list-properties): Reflect changes to
         `org-item-beginning-re'.
 
-        * org-html.el (org-html-export-list-line): handle new type of
+        * org-html.el (org-html-export-list-line): Handle new type of
         items.
 
-        * org-latex.el (org-export-latex-lists): handle new type of items
+        * org-latex.el (org-export-latex-lists): Handle new type of items
         and reflect changes to `org-item-beginning-re'.
 
-        * org-ascii.el (org-export-ascii-preprocess): handle new counters.
+        * org-ascii.el (org-export-ascii-preprocess): Handle new counters.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-end-re): removed function and made it a
-        variable. There's no need for the overhead of calling the function
-        every at every line in a list. User will have to reload Org if he
-        change value of either `org-list-end-regexp' or
+        * org-list.el (org-list-end-re): Removed function and made it a
+        variable.  There's no need for the overhead of calling the
+        function every at every line in a list.  User will have to reload
+        Org if he change value of either `org-list-end-regexp' or
         `org-empty-line-terminates-plain-lists'.
-        (org-in-item-p,org-list-struct,org-list-parse-list): apply change.
+        (org-in-item-p,org-list-struct,org-list-parse-list): Apply change.
 
         * org-exp.el (org-export-mark-list-end)
-        (org-export-mark-list-properties): apply change
+        (org-export-mark-list-properties): Apply change
 
-        * org-latex.el (org-export-latex-lists): apply change. Also
+        * org-latex.el (org-export-latex-lists): Apply change.  Also
         prevent items with org-example property to be considered as real
         items.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-inlinetask.el (org-inlinetask-export-templates): slightly
+        * org-inlinetask.el (org-inlinetask-export-templates): Slightly
         modify templates so environment boundaries don't interfere with
-        content of task. Unprotect content of task so it might benefit
+        content of task.  Unprotect content of task so it might benefit
         from further transformations. Set original-indentation property to
         a high value to ensure that task is always in the last item of the
         list.  Also, apply templates later in export process.
 
-        * org-list.el (org-list-struct): fix inline task skipping.
+        * org-list.el (org-list-struct): Fix inline task skipping.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org-latex.el (org-export-latex-lists): Search for unprotected
-        items only, and redefine `org-at-item'. This change is required
+        items only, and redefine `org-at-item'.  This change is required
         when verbatim lists are inserted during export, usually by Babel.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * ob.el (org-babel-result-end): end position is end of current
+        * ob.el (org-babel-result-end): End position is end of current
         sublist instead of bottom point, as results might be inserted in a
         list themselves.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-automatic-rules): removed insert rule.
-        (org-list-insert-item-generic): removed code preventing user to insert
-        another item in a block within a list. It is because new list context
-        make it impossible to see if a point in a block is also in a list.
+        * org-list.el (org-list-automatic-rules): Removed insert rule.
+        (org-list-insert-item-generic): Removed code preventing user to
+        insert another item in a block within a list.  It is because new
+        list context make it impossible to see if a point in a block is
+        also in a list.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-exp.el (org-export-preprocess-string): mark list endings
+        * org-exp.el (org-export-preprocess-string): Mark list endings
         before babel blocks preprocessing starts, so blank lines that may
-        be inserted do not break list's structure. Then, mark list with
+        be inserted do not break list's structure.  Then, mark list with
         special properties required by exporters. Thus output from babel
         can easily be included in lists.
-        (org-export-mark-list-end): new function
-        (org-export-mark-list-properties): new function
-        (org-export-mark-lists): removed function. It was split into the two
-        preceding functions.
+        (org-export-mark-list-end): New function.
+        (org-export-mark-list-properties): New function.
+        (org-export-mark-lists): Removed function.  It was split into the
+        two preceding functions.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-update-checkbox-count): do not recompute every
+        * org-list.el (org-update-checkbox-count): Do not recompute every
         list before next heading when there are more than one cookie in an
-        headline. Moreover, ignore the case where cookie is inserted
+        headline.  Moreover, ignore the case where cookie is inserted
         neither at an heading nor at an item.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-sort-list): fix number of arguments to
-        `org-list-repair', plus make end-record go to end of item before
+        * org-list.el (org-sort-list): Fix number of arguments to
+        `org-list-repair', plus make `end-record' go to end of item before
         any blank line to keep them from being swallowed in the sorting.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-forbidden-blocks): variable renamed from
-        org-list-blocks.
-        (org-list-export-context): new variable
+        * org-list.el (org-list-forbidden-blocks): Renamed from
+        `org-list-blocks'.
+        (org-list-export-context): New variable.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-search-generic): renamed form
-        org-search-unenclosed-generic to reflect now behavior. Now, match
-        can only be in a valid context for lists, as determined by
+        * org-list.el (org-list-search-generic): Renamed form
+        `org-search-unenclosed-generic' to reflect the new behavior.  Now,
+        match can only be in a valid context for lists, as determined by
         `org-list-context'.
-        (org-list-search-backward): renamed from
-        org-search-backward-unenclosed.
-        (org-list-search-forward): renamed from org-search-forward-unenclosed.
-        (org-toggle-checkbox,org-update-checkbox-count): use new functions.
-        (org-sort-list): using default regexp search functions as context is
-        not required in this case.
+        (org-list-search-backward): Renamed from
+        `org-search-backward-unenclosed'.
+        (org-list-search-forward): Renamed from
+        `org-search-forward-unenclosed'.
+        (org-toggle-checkbox,org-update-checkbox-count): Use new
+        functions.
+        (org-sort-list): Using default regexp search functions as context
+        is not required in this case.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-exp.el (org-export-mark-lists): new function, replacing
-        org-export-mark-list-ending. It adds information as text
+        * org-exp.el (org-export-mark-lists): New function, replacing
+        org-export-mark-list-ending.  It adds information as text
         properties to every list, before changes done by exporter destruct
         them.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-get-first-item): new alias for
-        org-list-get-list-begin
-        (org-list-get-last-item): new function
-        (org-list-get-list-end): use org-list-get-last-item
+        * org-list.el (org-list-get-first-item): New alias for
+        `org-list-get-list-begin'.
+        (org-list-get-last-item): New function.
+        (org-list-get-list-end): Use `org-list-get-last-item'.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-get-string-indentation): moved in generally useful
+        * org.el (org-get-string-indentation): Moved in generally useful
         functions section, as it wasn't specific to plain lists and that
         no code was using it in org-list.el.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-skip-over-state-notes,org-store-log-note): use new
+        * org.el (org-skip-over-state-notes,org-store-log-note): Use new
         accessors.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-indent-item-generic): remove error
-        messages happening before process. This belongs to interactive
+        * org-list.el (org-list-indent-item-generic): Remove error
+        messages happening before process.  This belongs to interactive
         functions.
         (org-indent-item,org-indent-item-tree)
-        (org-outdent-item,org-outdent-item-tree): ensure point or region
-        is correct before computing list structure. Return an error
+        (org-outdent-item,org-outdent-item-tree): Ensure point or region
+        is correct before computing list structure.  Return an error
         message otherwise.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-apply-on-list): use new structures. Function is
-        now applied in reverse order so modifications do not change
+        * org-list.el (org-apply-on-list): Use new structures.  Function
+        is now applied in reverse order so modifications do not change
         positions of items in buffer.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-parse-list): rewrite of function to allow
-        text following a sub-list in the same item. See docstring for an
+        * org-list.el (org-list-parse-list): Rewrite of function to allow
+        text following a sub-list in the same item.  See docstring for an
         example of output.
-        (org-list-to-generic): use new parsing function.
-        (org-list-to-latex,org-list-to-html): minor change for clearer
+        (org-list-to-generic): Use new parsing function.
+        (org-list-to-latex,org-list-to-html): Minor change for clearer
         export.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-has-child-p): renamed from
-        org-list-get-child.  Returning first child is only useful as a
-        predicate, as we're allowing an item to have more than one
+        * org-list.el (org-list-has-child-p): Renamed from
+        `org-list-get-child'.  Returning first child is only useful as a
+        predicate, as we are allowing an item to have more than one
         sub-list.
-        (org-list-indent-item-generic): use `org-list-has-child-p' instead of
-        org-list-get-child.
-        (org-in-item-p): also return item beginning when list starts at
+        (org-list-indent-item-generic): Use `org-list-has-child-p' instead
+        of org-list-get-child.
+        (org-in-item-p): Also return item beginning when list starts at
         context beginning.
-        (org-list-get-parent): use of `org-list-struct-parent-alist' helper
-        function is not optional anymore.
-        (org-list-get-all-items): shorten code with the help of cl.el.
-        (org-list-get-children): now returns all children of item, even if
+        (org-list-get-parent): Use of `org-list-struct-parent-alist'
+        helper function is not optional anymore.
+        (org-list-get-all-items): Shorten code with the help of cl.el.
+        (org-list-get-children): Now returns all children of item, even if
         they do not belong to the same list. Renamed from
-        org-list-get-all-children.
-        (org-list-get-list-begin): function wasn't return value when item was
-        already the first item of the list at point.
-        (org-list-get-list-end): function wasn't return value when item was
-        already the last item of the list at point.
-        (org-list-struct-fix-box,org-update-checkbox-count): now uses
+        `org-list-get-all-children'.
+        (org-list-get-list-begin): Function wasn't return value when item
+        was already the first item of the list at point.
+        (org-list-get-list-end): Function wasn't return value when item
+        was already the last item of the list at point.
+        (org-list-struct-fix-box,org-update-checkbox-count): Now uses
         `org-list-get-children'.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
         * org.el (org-indent-line-function): Indentation of item's body
-        starts just after the bullet, not after a checkbox. Moreover, As
+        starts just after the bullet, not after a checkbox.  Moreover, As
         `org-in-item-p' also returns item beginning position when point is
         in a list, do not compute it a second time.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-ctrl-c-ctrl-c): when called at a list item, replace
+        * org.el (org-ctrl-c-ctrl-c): When called at a list item, replace
         usage `org-repair-list', forcing another reading of the list, with
         only needed subroutines.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-separating-blank-lines-number): use new
+        * org-list.el (org-list-separating-blank-lines-number): Use new
         accessors.
-        (org-list-insert-item-generic): use list structures to insert a new
-        item.
-        (org-list-exchange-items): refactor and comment code. Now return new
-        struct instead of modifying it, as list sorting would sometimes eat
-        first item.
-        (org-move-item-down,org-move-item-up): reflect changes to
+        (org-list-insert-item-generic): Use list structures to insert a
+        new item.
+        (org-list-exchange-items): Refactor and comment code.  Now return
+        new struct instead of modifying it, as list sorting would
+        sometimes eat first item.
+        (org-move-item-down,org-move-item-up): Reflect changes to
         `org-list-exchange-items'.
-        (org-insert-item): as `org-in-item-p' also computes item beginning
+        (org-insert-item): As `org-in-item-p' also computes item beginning
         when applicable, reuse the result.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-in-item-p): unify methods for this
+        * org-list.el (org-list-in-item-p): Unify methods for this
         predicate.
-        (org-list-in-item-p-with-indent): removed function
-        (org-list-ending-between): removed function
-        (org-list-maybe-skip-block): removed function
-        (org-list-in-item-p-with-regexp): removed function
-        (org-list-top-point-with-regexp): removed function
-        (org-list-top-point-with-indent): removed function
-        (org-list-bottom-point-with-indent): removed function
-        (org-list-bottom-point-with-regexp): removed function
-        (org-list-get-item-same-level): removed function
-        (org-list-top-point): removed function
-        (org-list-bottom-point): removed function
-        (org-get-item-beginning): renamed to org-list-get-item-begin to be
-        consistent with naming policy of non-interactive functions.
-        (org-get-beginning-of-list): removed function
-        (org-beginning-of-item-list): use new accessors
-        (org-get-end-of-list): removed function
-        (org-end-of-list): use new accessors
-        (org-get-end-of-item): removed function
-        (org-end-of-item): use new accessors
-        (org-get-previous-item): removed function
-        (org-previous-item): use new accessors
-        (org-get-next-item): removed function
-        (org-next-item): use new accessors
-        (org-end-of-item-before-blank): renamed to
+        (org-list-in-item-p-with-indent): Removed function.
+        (org-list-ending-between): Removed function.
+        (org-list-maybe-skip-block): Removed function.
+        (org-list-in-item-p-with-regexp): Removed function.
+        (org-list-top-point-with-regexp): Removed function.
+        (org-list-top-point-with-indent): Removed function.
+        (org-list-bottom-point-with-indent): Removed function.
+        (org-list-bottom-point-with-regexp): Removed function.
+        (org-list-get-item-same-level): Removed function.
+        (org-list-top-point): Removed function.
+        (org-list-bottom-point): Removed function.
+        (org-get-item-beginning): Renamed to `org-list-get-item-begin' to
+        be consistent with naming policy of non-interactive functions.
+        (org-get-beginning-of-list): Removed function.
+        (org-beginning-of-item-list): Use new accessors.
+        (org-get-end-of-list): Removed function.
+        (org-end-of-list): Use new accessors.
+        (org-get-end-of-item): Removed function.
+        (org-end-of-item): Use new accessors.
+        (org-get-previous-item): Removed function.
+        (org-previous-item): Use new accessors.
+        (org-get-next-item): Removed function.
+        (org-next-item): Use new accessors.
         (org-list-get-item-end-before-blank): Use new accessors.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-repair): removed optional argument
-        FORCE-BULLET. The job of this interactive function is to
-        completely fix a list at point. Changing bullets is a separate
-        task. Also removed others optional arguments TOP and BOTTOM to
+        * org-list.el (org-list-repair): Removed optional argument
+        FORCE-BULLET.  The job of this interactive function is to
+        completely fix a list at point.  Changing bullets is a separate
+        task.  Also removed others optional arguments TOP and BOTTOM to
         follow the new structures.
-        (org-list-indent-item-generic): remove need for TOP and BOTTOM. STRUCT
-        is a new required argument. This avoids computing a list structure
-        many times when function is called more than once in a row, for
-        example in org-cycle-item-indentation. Use new accessors. Now, also
-        call `org-update-checkbox-count-maybe'.
-        (org-outdent-item,org-indent-item,org-outdent-item-tree,org-indent-item-tree):
-        remove need for TOP and BOTTOM.
-        (org-list-insert-item-generic): reflect changes to `org-list-repair'.
-        (org-list-exchange-items): use new accessors. Now modify struct to
-        avoid re-reading it later.
-        (org-move-item-down): reflect changes to `org-list-repair'. Use new
+        (org-list-indent-item-generic): Remove need for TOP and BOTTOM.
+        STRUCT is a new required argument.  This avoids computing a list
+        structure many times when function is called more than once in a
+        row, for example in `org-cycle-item-indentation'.  Use new
+        accessors.  Now, also call `org-update-checkbox-count-maybe'.
+        (org-outdent-item, org-indent-item, org-outdent-item-tree)
+        (org-indent-item-tree): Remove need for TOP and BOTTOM.
+        (org-list-insert-item-generic): Reflect changes to `org-list-repair'.
+        (org-list-exchange-items): Use new accessors.  Now modify struct
+        to avoid re-reading it later.
+        (org-move-item-down): Reflect changes to `org-list-repair'.  Use
+        new accessors.
+        (org-move-item-up): Reflect changes to `org-list-repair'.  Use new
         accessors.
-        (org-move-item-up): reflect changes to `org-list-repair'. Use new
-        accessors.
-        (org-cycle-list-bullet): use new structures. Also use a shortcut to
-        `org-list-struct-fix-struct' in order to avoid unnecessary fixes, like
-        `org-list-struct-fix-box'
-        (org-sort-list): use of new structures. Renamed an internal function
-        for a little more clarity.
-        (org-cycle-item-indentation): remove dependency on org-list-repair.
-        Use new accessors.
-        (org-list-get-child): correct bug when asking for the child of the
-        last item
-        (org-list-exchange-items): use new accessors.
+        (org-cycle-list-bullet): Use new structures.  Also use a shortcut
+        to `org-list-struct-fix-struct' in order to avoid unnecessary
+        fixes, like `org-list-struct-fix-box'
+        (org-sort-list): Use of new structures.  Renamed an internal
+        function for a little more clarity.
+        (org-cycle-item-indentation): Remove dependency on
+        `org-list-repair'.  Use new accessors.
+        (org-list-get-child): Correct bug when asking for the child of the
+        last item.
+        (org-list-exchange-items): Use new accessors.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-blocks): new variable
-        (org-list-context): new function
-        (org-list-full-item-re): new variable
-        (org-list-struct-assoc-at-point): use new varible
-        (org-list-struct): rewrite of function. Now, list data is collected by
-        looking at the list line after line. It reads the whole list each time
-        because reading only a subtree was not enough for some operations,
-        like fixing checkboxes. It also removes the need to get
-        `org-list-top-point' and `org-list-bottom-point' first. An added data
-        is the position of item ending. This aims to be able to have list
-        followed by text inside an item.
-        (org-list-struct-assoc-end): new function
-        (org-list-struct-parent-alist): new function
-        (org-list-get-parent): new function
-        (org-list-get-child): new function
-        (org-list-get-next-item): new function
-        (org-list-get-prev-item): new function
-        (org-list-get-subtree): use helper function `org-list-struct-prev-alist'.
-        (org-list-get-all-items): new function
-        (org-list-get-all-children): new function
-        (org-list-get-top-point): new function
-        (org-list-get-bottom-point): new function
-        (org-list-get-counter): new function
-        (org-list-get-item-end): new function
-        (org-list-struct-fix-bul): rewrite for cleaner code. Make use of new
-        accessors.
-        (org-list-struct-fix-ind): make use of new accessors.
-        (org-list-struct-fix-box): new function
-        (org-list-struct-fix-checkboxes): removed function
-        (org-list-struct-outdent): use new accessors. Use the fact that there
-        is no longer a virtual item at beginning of structure.
-        (org-list-struct-indent): use helper functions
-        `org-list-struct-prev-alist' and `org-list-struct-parent-alist'. Also
-        use new accessors.
-        (org-list-struct-fix-struct): comment function. Call directly
+        * org-list.el (org-list-blocks): New variable.
+        (org-list-context): New function.
+        (org-list-full-item-re): New variable.
+        (org-list-struct-assoc-at-point): Use new varible.
+        (org-list-struct): Rewrite of function.  Now, list data is
+        collected by looking at the list line after line.  It reads the
+        whole list each time because reading only a subtree was not enough
+        for some operations, like fixing checkboxes.  It also removes the
+        need to get `org-list-top-point' and `org-list-bottom-point'
+        first.  An added data is the position of item ending.  This aims
+        to be able to have list followed by text inside an item.
+        (org-list-struct-assoc-end): New function.
+        (org-list-struct-parent-alist): New function.
+        (org-list-get-parent): New function.
+        (org-list-get-child): New function.
+        (org-list-get-next-item): New function.
+        (org-list-get-prev-item): New function.
+        (org-list-get-subtree): Use helper function `org-list-struct-prev-alist'.
+        (org-list-get-all-items): New function.
+        (org-list-get-all-children): New function.
+        (org-list-get-top-point): New function.
+        (org-list-get-bottom-point): New function.
+        (org-list-get-counter): New function.
+        (org-list-get-item-end): New function.
+        (org-list-struct-fix-bul): Rewrite for cleaner code.  Make use of
+        new accessors.
+        (org-list-struct-fix-ind): Make use of new accessors.
+        (org-list-struct-fix-box): New function.
+        (org-list-struct-fix-checkboxes): Removed function.
+        (org-list-struct-outdent): Use new accessors.  Use the fact that
+        there is no longer a virtual item at beginning of structure.
+        (org-list-struct-indent): Use helper functions
+        `org-list-struct-prev-alist' and `org-list-struct-parent-alist'.
+        Also use new accessors.
+        (org-list-struct-fix-struct): Comment function.  Call directly
         `org-list-struct-apply-struct', without removing unchanged items
         first.
-        (org-list-struct-apply-struct): comment function. Rewrite using new
-        accessors. Use new variable `org-list-full-item-re'.
-        (org-list-shift-item-indentation): removed function, now included in
-        `org-list-struct-apply-struct' because it is too specific.
+        (org-list-struct-apply-struct): Comment function.  Rewrite using
+        new accessors.  Use new variable `org-list-full-item-re'.
+        (org-list-shift-item-indentation): Removed function, now included
+        in `org-list-struct-apply-struct' because it is too specific.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-toggle-checkbox): use structures to fix
-        checkboxes of a list
-        (org-update-checkbox-count): use structures to update cookies
+        * org-list.el (org-toggle-checkbox): Use structures to fix
+        checkboxes of a list.
+        (org-update-checkbox-count): Use structures to update cookies.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-struct-fix-checkboxes): new function
-        (org-checkbox-blocked-p): removed function
+        * org-list.el (org-list-struct-fix-checkboxes): New function.
+        (org-checkbox-blocked-p): Removed function.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-get-all-items): new function
-        (org-list-get-all-children): new function
-        (org-list-get-nth): new function
-        (org-list-set-nth): new function
-        (org-list-get-ind): new function
-        (org-list-set-ind): new function
-        (org-list-get-bullet): new function
-        (org-list-set-bullet): new function
-        (org-list-get-checkbox): new function
-        (org-list-set-checkbox): new function
-        (org-list-struct-fix-bul): use new accessors
-        (org-list-repair): use new accessors
-        (org-list-indent-item-generic): make use of accessors
-        (org-list-get-parent): renamed from org-list-struct-get-parent
-        (org-list-get-child): renamed from org-list-struct-get-child
-        (org-list-struct-fix-ind): make use of accessors
-        (org-list-get-next-item): new function
-        (org-list-get-subtree): new function
+        * org-list.el (org-list-get-all-items): New function.
+        (org-list-get-all-children): New function.
+        (org-list-get-nth): New function.
+        (org-list-set-nth): New function.
+        (org-list-get-ind): New function.
+        (org-list-set-ind): New function.
+        (org-list-get-bullet): New function.
+        (org-list-set-bullet): New function.
+        (org-list-get-checkbox): New function.
+        (org-list-set-checkbox): New function.
+        (org-list-struct-fix-bul): Use new accessors.
+        (org-list-repair): Use new accessors.
+        (org-list-indent-item-generic): Make use of accessors.
+        (org-list-get-parent): Renamed from `org-list-struct-get-parent'.
+        (org-list-get-child): Renamed from `org-list-struct-get-child'.
+        (org-list-struct-fix-ind): Make use of accessors.
+        (org-list-get-next-item): New function.
+        (org-list-get-subtree): New function.
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-list.el (org-list-struct-assoc-at-point): add checkbox to
-        list structure
+        * org-list.el (org-list-struct-assoc-at-point): Add checkbox to
+        list structure.
 
-        * org-list.el (org-list-struct-assoc-at-point): add checkbox as
-        value in structure
+        * org-list.el (org-list-struct-assoc-at-point): Add checkbox as
+        value in structure.
 
-        * org-list.el (org-list-struct-apply-struct): also apply
-        checkboxes
+        * org-list.el (org-list-struct-apply-struct): Also apply
+        checkboxes.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-latex.el (org-export-latex-content): bind local variables
+        * org-latex.el (org-export-latex-content): Bind local variables
         for export in the temporary export buffer.
 
 2011-07-28  David Maus  <dmaus@ictsoc.de>
 
         * org-protocol.el (org-protocol-unhex-single-byte-sequence)
-        (org-protocol-unhex-string, org-protocol-unhex-compound): Change date
-        of obsolete declaration to 2011-02-17.
+        (org-protocol-unhex-string, org-protocol-unhex-compound): Change
+        date of obsolete declaration to 2011-02-17.
 
 2011-07-28  David Maus  <dmaus@ictsoc.de>
 
@@ -4115,10 +4124,10 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-publish.el (org-publish-cache-ctime-of-src): improve
+        * org-publish.el (org-publish-cache-ctime-of-src): Improve
         docstring.
-        (org-publish-find-title): New option to explicitly reset the
-        title in the cache.
+        (org-publish-find-title): New option to explicitly reset the title
+        in the cache.
         (org-publish-format-file-entry): Use this new option.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
@@ -4130,19 +4139,20 @@
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
         * org-exp.el (org-export-format-source-code-or-example): Allow
-        empty string as second element in minted/listings options
+        empty string as second element in minted/listings options.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
         * org-exp.el (org-export-format-source-code-or-example): Support
-        new user-customizable options
-        (org-export-latex-custom-lang-environments): Ensure new variable is defined
-        (org-export-latex-listings-options): Ensure new variable is defined
-        (org-export-latex-minted-options): Ensure new variable is defined
+        new user-customizable options.
+        (org-export-latex-custom-lang-environments): Ensure new variable
+        is defined.
+        (org-export-latex-listings-options): Ensure new variable is defined.
+        (org-export-latex-minted-options): Ensure new variable is defined.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-html.el (org-export-as-html): handle the case when
+        * org-html.el (org-export-as-html): Handle the case when
         `org-export-html-validation-link' is nil to keep backward
         compatible with the old default value of this variable.
 
@@ -4154,19 +4164,19 @@
 2011-07-28  Christian Moe  <mail@christianmoe.com>  (tiny change)
 
         * org-bbdb.el (org-bbdb-export): When a link description has been
-        added by org-export-normalize-links, use path instead (remove the
-        `bbdb:' prefix).
+        added by `org-export-normalize-links', use path instead (remove
+        the `bbdb:' prefix).
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
         * org-ascii.el (org-export-ascii-underline): Put the level's
         characters in the right order, as documented by the docstring.
-        (org-ascii-level-start): select the right char for underlining
+        (org-ascii-level-start): Select the right char for underlining
         headlines.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-src.el (org-edit-src-code): allow to edit source code from
+        * org-src.el (org-edit-src-code): Allow to edit source code from
         modes derived from Org.
 
 2011-07-28  Niels Giesen  <niels.giesen@gmail.com>
@@ -4187,8 +4197,7 @@
         Send a message when no entry is marked.
         (org-agenda-bulk-action): Fix bug about scattering deadlines.
         Send an error when trying to scatter outside an agenda or a
-        timeline view.  Silently fail when trying to scatter sexp
-        entries.
+        timeline view.  Silently fail when trying to scatter sexp entries.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -4219,11 +4228,12 @@
 
         * org-src.el (org-edit-src-code): When generating the code edit
         buffer, it is necessary for several variables to inherit their
-        values from the parent org buffer. These changes collect all such
+        values from the parent org buffer.  These changes collect all such
         variables together into a single association list of
-        (variable-name value) pairs. In addition, a new variable is added
-        to the list: `org-edit-src-content-indentation'. This has the
-        effect that a buffer local value can be used for that variable.
+        `(variable-name value)' pairs.  In addition, a new variable is
+        added to the list: `org-edit-src-content-indentation'.  This has
+        the effect that a buffer local value can be used for that
+        variable.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
@@ -4246,12 +4256,12 @@
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
         * org.el (org-open-at-point): Fix bug when using prefix arg to
-        construct `org-link-search' call. Rename prefix arg with a more
+        construct `org-link-search' call.  Rename prefix arg with a more
         generic name, to reflect its diverse uses in this function.
 
 2011-07-28  Rémi Vanicat  <vanicat@debian.org>
 
-        * org-icalendar.el (org-icalendar-use-UTC-date-time): remove.
+        * org-icalendar.el (org-icalendar-use-UTC-date-time): Remove.
         (org-icalendar-date-time-format): New custom variable.
         (org-icalendar-use-UTC-date-timep): New function.
         (org-ical-ts-to-string): Use the new variable.
@@ -4268,25 +4278,25 @@
 
 2011-07-28  Bastien  <bastien.guerry@wikimedia.fr>
 
-        * org-capture.el (org-capture-templates): document currentfile for
-        capture template.
+        * org-capture.el (org-capture-templates): Document "currentfile"
+        for capture template.
         (org-capture-templates): Allow to use currentfile for capture
         templates.
-        (org-capture-set-target-location): Handle currentfile as a way
-        to setting the capture buffer.
+        (org-capture-set-target-location): Handle currentfile as a way to
+        setting the capture buffer.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * ob.el (org-babel-params-from-properties): don't wrap
-        org-entry-get into condition-case.
+        * ob.el (org-babel-params-from-properties): Don't wrap
+        `org-entry-get' into `condition-case'.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
         * org.el (org-entry-get): Don't look for a property drawer if we
         are before the first heading in the file.
-        (org-entry-get-with-inheritance): Don't attempt to move up the tree if
-        we are before the first heading in the file. Also, enclose less of the
-        function in the save-excursion.
+        (org-entry-get-with-inheritance): Don't attempt to move up the
+        tree if we are before the first heading in the file.  Also,
+        enclose less of the function in the `save-excursion'.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
@@ -4306,37 +4316,37 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-info.el (org-info-store-link): use "#" to separate the info
+        * org-info.el (org-info-store-link): Use "#" to separate the info
         file and the node.
-        (org-info-follow-link): use both "#" to separate the info file
-        and the node.  Continue to use ":" for backward compatibility.
+        (org-info-follow-link): Use both "#" to separate the info file and
+        the node.  Continue to use ":" for backward compatibility.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
         * org-icalendar.el (org-icalendar-honor-noexport-tag): New custom
         variable.
-        (org-print-icalendar-entries): Use this new variable to
-        prevent export of entries with a :noexport: tag.
+        (org-print-icalendar-entries): Use this new variable to prevent
+        export of entries with a :noexport: tag.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-exp.el (org-export-initial-scope): new custom variable.
+        * org-exp.el (org-export-initial-scope): New custom variable.
         (org-export): Use this new variable.  If there is an active
         region, tell it when prompting the user for an export command.
-        Also change the way the function handles selection of buffer
-        and subtree export.
+        Also change the way the function handles selection of buffer and
+        subtree export.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
         * org-html.el (org-export-html-auto-preamble)
         (org-export-html-auto-postamble): Remove.
-        (org-export-html-preamble, org-export-html-postamble): Turn
-        into custom variables.  Update the docstrings.
+        (org-export-html-preamble, org-export-html-postamble): Turn into
+        custom variables.  Update the docstrings.
         (org-export-html-preamble-format)
         (org-export-html-postamble-format): New custom variables.
-        (org-export-as-html): Use org-export-html-postamble-format and
-        org-export-html-preamble-format.
-        (org-export-html-title-format): delete.
+        (org-export-as-html): Use `org-export-html-postamble-format' and
+        `org-export-html-preamble-format'.
+        (org-export-html-title-format): Delete.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -4353,14 +4363,14 @@
 2011-07-28  Manuel Giraud  <manuel.giraud@univ-nantes.fr>
 
         * org-publish.el (org-publish-sitemap-date-format)
-        (org-publish-sitemap-file-entry-format): new custom variables.
-        (org-publish-projects): use these variables to format the sitemap
+        (org-publish-sitemap-file-entry-format): New custom variables.
+        (org-publish-projects): Use these variables to format the sitemap
         entries.
 
 2011-07-28  Ulf Stegemann  <ulf-news@zeitform.de>
 
-        * org-gnus.el (org-gnus-store-link): Allow org-link creation from
-        message-mode.
+        * org-gnus.el (org-gnus-store-link): Allow `org-link' creation
+        from `message-mode'.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -4370,21 +4380,21 @@
 
 2011-07-28  Julien Danjou  <julien@danjou.info>
 
-        * org-agenda.el (org-agenda): Kill all local variables. This
+        * org-agenda.el (org-agenda): Kill all local variables.  This
         assures we are not keeping buffer variable from an old agenda view
         when switching to a new custom agenda.
 
 2011-07-28  Julien Danjou  <julien@danjou.info>
 
         * org-crypt.el (org-encrypt-string): New function.
-        (org-encrypt-entry): Use org-encrypt-string to encrypt, so we use cached
-        crypted values.
+        (org-encrypt-entry): Use org-encrypt-string to encrypt, so we use
+        cached crypted values.
         (org-decrypt-entry): Store crypted text in decrypted text.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
         * ob-exp.el (org-babel-exp-lob-one-liners): Only replace the match
-        if a non-nil result is returned
+        if a non-nil result is returned.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -4393,7 +4403,7 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org.el (org-update-parent-todo-statistics): fix bug when
+        * org.el (org-update-parent-todo-statistics): Fix bug when
         updating statistics from the column view.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
@@ -4412,11 +4422,12 @@
 2011-07-28  Julien Danjou  <julien@danjou.info>
 
         * org-faces.el (org-special-keyword): Make it inherited from
-        font-lock-keyword-face.
+        `font-lock-keyword-face'.
 
 2011-07-28  Julien Danjou  <julien@danjou.info>
 
-        * org-faces.el (org-link): Make org-link inherits from link face.
+        * org-faces.el (org-link): Make `org-link' inherits from `link'
+        face.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
@@ -4445,7 +4456,7 @@
 
 2011-07-28  Jason Dunsmore  <emacs-orgmode@dunsmor.com>  (tiny change)
 
-        * org-html.el (org-html-handle-time-stamps): fix bug when
+        * org-html.el (org-html-handle-time-stamps): Fix bug when
         exporting inactive timestamps.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
@@ -4459,8 +4470,7 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-archive.el (org-archive-save-context-info): Fix docstring
-        typo.
+        * org-archive.el (org-archive-save-context-info): Fix docstring.
 
 2011-07-28  Julien Danjou  <julien@danjou.info>
 
@@ -4471,8 +4481,8 @@
 
 2011-07-28  Julien Danjou  <julien@danjou.info>
 
-        * org-agenda.el (org-agenda-list): Use org-agenda-current-span as
-        a possible default span if it is set.
+        * org-agenda.el (org-agenda-list): Use `org-agenda-current-span'
+        as a possible default span if it is set.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
@@ -4480,15 +4490,15 @@
         (org-edit-src-code): Get rid of help message in echo area.
 
         * ob.el (org-babel-do-in-edit-buffer): Do not pass 'quietly
-        argument to org-edit-src-code as this has been removed
+        argument to org-edit-src-code as this has been removed.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-latex.el (org-export-latex-emphasis-alist): use
+        * org-latex.el (org-export-latex-emphasis-alist): Use
         \protectedtexttt for the =...= emphasis and \verb for the ~...~
         emphasis.
-        (org-export-latex-use-verb): now defaults to t.
-        (org-export-latex-emph-format): distinguish between =...= and
+        (org-export-latex-use-verb): Now defaults to t.
+        (org-export-latex-emph-format): Distinguish between =...= and
         ~...~ emphasis.
 
 2011-07-28  Julien Danjou  <julien@danjou.info>
@@ -4502,12 +4512,12 @@
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
-        * ob-ref.el (org-babel-ref-resolve): save-window-excursion when
+        * ob-ref.el (org-babel-ref-resolve): `save-window-excursion' when
         resolving references.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org-html.el (org-export-html-html-helper-timestamp): use <hr/>
+        * org-html.el (org-export-html-html-helper-timestamp): Use <hr/>
         instead of <hr> to keep w3c validator happy.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
@@ -4523,8 +4533,8 @@
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
-        * ob.el (org-babel-result-end): Replace call to org-in-item-p to
-        the more specific org-at-item-p.
+        * ob.el (org-babel-result-end): Replace call to `org-in-item-p' to
+        the more specific `org-at-item-p'.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -4576,17 +4586,18 @@
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
         * org-latex.el (org-export-as-latex): Process export property list
-        with `org-export-process-option-filters' early in latex export
+        with `org-export-process-option-filters' early in latex export.
 
 2011-07-28  Julien Danjou  <julien@danjou.info>
 
-        * org.el: Remove org-invisible-p: outline-invisible-p is available
-        in Emacs 22 and in recent XEmacs 21. Replace in various files.
+        * org.el: Remove `org-invisible-p': `outline-invisible-p' is
+        available in Emacs 22 and in recent XEmacs 21.  Replace in various
+        files.
 
 2011-07-28  Julien Danjou  <julien@danjou.info>
 
         * org-agenda.el (org-agenda-get-progress): Fix regexp for statep:
-        it must has \\ at the end of the line. This avoid matching the
+        it must has \\ at the end of the line.  This avoid matching the
         following heading when there's no newline between the logged state
         and the next heading.
 
@@ -4596,9 +4607,8 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org.el (org-current-level):
-        (org-store-link):
-        (org-mark-subtree): Use `org-with-limited-levels'.
+        * org.el (org-current-level, org-store-link, org-mark-subtree):
+        Use `org-with-limited-levels'.
 
 2011-07-28  Jan Seeger  <jan.seeger@thenybble.de>  (tiny change)
 
@@ -4638,7 +4648,7 @@
 2011-07-28  Julien Danjou  <julien@danjou.info>
 
         * org-agenda.el (org-agenda-get-blocks): Fix time of start/end of
-        events with range. This display things like: <2011-01-22 Sat
+        events with range.  This display things like: <2011-01-22 Sat
         14:00>--<2011-01-23 Sun 20:00> correctly, with the event starting
         at 14:00 and ending at 20:00.
 
@@ -4650,7 +4660,7 @@
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
-        * ob.el (org-babel-merge-params): docstring typo.
+        * ob.el (org-babel-merge-params): Docstring typo.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
@@ -4660,11 +4670,11 @@
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
         * ob.el (org-babel-get-src-block-info): Alter order of merge
-        arguments
+        arguments.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
-        * ob-python.el: Test whether non-nil buffer is #<killed buffer>
+        * ob-python.el: Test whether non-nil buffer is #<killed buffer>.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -4696,12 +4706,12 @@
 
         * org-exp.el (org-export-handle-include-files): Support :lines
         property.
-        (org-get-file-contents): New argument lines to include specify a range
-        of lines to include.
+        (org-get-file-contents): New argument lines to include specify a
+        range of lines to include.
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org.el (org-fast-tag-selection): Fix bug when assigning keys
+        * org.el (org-fast-tag-selection): Fix bug when assigning keys.
 
 2011-07-28  Lawrence Mitchell  <wence@gmx.li>
 
@@ -4714,9 +4724,9 @@
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
-        * org-complete.el (pcomplete/org-mode/link):
-        (pcomplete/org-mode/todo):
-        (pcomplete/org-mode/prop): Copy list before uniquifying.
+        * org-complete.el (pcomplete/org-mode/link)
+        (pcomplete/org-mode/todo, pcomplete/org-mode/prop): Copy list
+        before uniquifying.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -4727,15 +4737,15 @@
 
 2011-07-28  Bastien Guerry  <bzg@gnu.org>
 
-        * org.el (org-refile-check-position): send a more explicit message
+        * org.el (org-refile-check-position): Send a more explicit message
         on how to clear the cache before refiling again.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org-agenda.el (org-agenda-skip-function-global): New option.
         (org-agenda-skip-eval): New function.
-        (org-agenda-skip): Use `org-agenda-skip-eval' and also check for the
-        global skipping condition.
+        (org-agenda-skip): Use `org-agenda-skip-eval' and also check for
+        the global skipping condition.
 
 2011-07-28  David Maus  <dmaus@ictsoc.de>
 
@@ -4753,10 +4763,6 @@
         * ob.el (org-babel-update-block-body): Literal argument to
         `replace-match' to allow insertion of text containing '\'.
 
-2011-07-28  Tassilo Horn  <tassilo@member.fsf.org>
-
-        * org-gnus.el (org-gnus-store-link):
-
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
         * ob-ref.el (org-babel-ref-parse): Allow passing empty strings
@@ -4776,7 +4782,7 @@
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org.el (org-sort-entries): Fix sorting with a bold emphasis at
-        bol
+        bol.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -4791,8 +4797,8 @@
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
         * ob.el (org-babel-temp-file): Ensure that
-        org-babel-temporary-directory is bound before using.
-        (org-babel-remove-temporary-directory):  Safer error throwing.
+        `org-babel-temporary-directory' is bound before using.
+        (org-babel-remove-temporary-directory): Safer error throwing.
 
 2011-07-28  niels giesen  <niels.giesen@gmail.com>
 
@@ -4819,11 +4825,12 @@
 
         * org.el (org-occur-next-match): New function.
         (org-mode): Set the variable `next-error-function'.
-        (org-highlight-new-match): Add an `org-type' property to the overlays.
+        (org-highlight-new-match): Add an `org-type' property to the
+        overlays.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
-        * ob-calc.el: No longer require `calc-trail' on XEmacs
+        * ob-calc.el: No longer require `calc-trail' on XEmacs.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -4831,11 +4838,10 @@
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
-        * org-special-blocks.el (htmlp):
-        (latexp):
-        (line): Add defvars for dynamically scoped variables.
+        * org-special-blocks.el (htmlp, latexp, line): Add defvars for
+        dynamically scoped variables.
 
-        * org.el (org-modules): Move org-special-blocks into the core
+        * org.el (org-modules): Move `org-special-blocks' into the core
         modules section.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
@@ -4848,10 +4854,10 @@
 
 2011-07-28  Bernt Hansen  <bernt@norang.ca>
 
-        * org-agenda.el (org-agenda-goto): Display invisible entry text
+        * org-agenda.el (org-agenda-goto): Display invisible entry text.
 
         * org-agenda.el (org-agenda-switch-to): Display invisible entry
-        text
+        text.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -4965,8 +4971,8 @@
         send graphical output to file by means of the ":results graphics"
         directive.
         (org-babel-expand-body:R): Use `org-babel-R-graphical-output-file'
-        when constructing the R code to evaluate, which may be augmented with
-        code implementing the writing of graohical output to file.
+        when constructing the R code to evaluate, which may be augmented
+        with code implementing the writing of graohical output to file.
         (org-babel-execute:R): Use `org-babel-R-graphical-output-file' to
         determine whether R is taking responsibility for writing output to
         file; if so, this is signalled to ob.el by returning a nil result.
@@ -4977,8 +4983,9 @@
         of src block execution.
         (org-babel-execute-src-block): Use `org-babel-format-result' when
         writing to file.
-        (org-babel-open-src-block-result): Use `org-babel-format-result' when
-        displaying results in a buffer; name results buffer differently.
+        (org-babel-open-src-block-result): Use `org-babel-format-result'
+        when displaying results in a buffer.  Name results buffer
+        differently.
 
 2011-07-28  Dan Davison  <dandavison7@gmail.com>
 
@@ -4999,10 +5006,12 @@
 
 2011-07-28  Nicolas Goaziou  <n.goaziou@gmail.com>
 
-        * org-inlinetask.el (org-inlinetask-in-task-p): small refactoring,
+        * org-inlinetask.el (org-inlinetask-in-task-p): Small refactoring,
         do not modify match data either.
-        (org-inlinetask-goto-end): small refactoring, remove case-sensitivity.
-        (org-inlinetask-goto-beginning): small refactoring, remove case-sensitivity.
+        (org-inlinetask-goto-end): Small refactoring, remove
+        case-sensitivity.
+        (org-inlinetask-goto-beginning): Small refactoring, remove
+        case-sensitivity.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -5085,8 +5094,8 @@
 
 2011-07-28  Lawrence Mitchell  <wence@gmx.li>
 
-        * org.el (org-make-target-link-regexp): regexp-quote target before
-        replacing whitespace.
+        * org.el (org-make-target-link-regexp): `regexp-quote' target
+        before replacing whitespace.
 
 2011-07-28  Eric Schulte  <schulte.eric@gmail.com>
 
@@ -5101,7 +5110,7 @@
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
         * org-latex.el (org-export-latex-first-lines): Anchor outline
-        regexp during LaTeX tree export
+        regexp during LaTeX tree export.
 
 2011-07-28  Konrad Hinsen  <konrad.hinsen@fastmail.net>
 
@@ -5123,7 +5132,7 @@
 
         * org.el (org-entry-properties): Stop scanning for timestamps if a
         specific timestamp property (e.g., DEADLINE, SCHEDULED, etc.) is
-        requested and a match is found. Also, if a specific timestamp
+        requested and a match is found.  Also, if a specific timestamp
         property is requested, do not push non-relevant timestamps onto
         property list.
 
@@ -5140,9 +5149,9 @@
 
 2011-07-28  Achim Gratz  <Stromeko@nexgo.de>
 
-        * org.el: remove spurious linebreak introduced by earlier patch.
+        * org.el: Remove spurious linebreak introduced by earlier patch.
 
-        * ob.el, ob-ref.el: remove double fix of the same problem.
+        * ob.el, ob-ref.el: Remove double fix of the same problem.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
 
@@ -5150,7 +5159,7 @@
 
 2011-07-28  �ukasz Stelmach  <lukasz.stelmach@iem.pw.edu.pl>
 
-        * org-html.el (org-export-html-mathjax-template): displaymath
+        * org-html.el (org-export-html-mathjax-template): Displaymath
         environment and MathJax.
 
 2011-07-28  Carsten Dominik  <carsten.dominik@gmail.com>
diff --git a/lisp/progmodes/cc-menus.el b/lisp/progmodes/cc-menus.el
index f53a7da5186..4e9350de425 100644
--- a/lisp/progmodes/cc-menus.el
+++ b/lisp/progmodes/cc-menus.el
@@ -108,8 +108,11 @@ A sample value might look like: `\\(_P\\|_PROTO\\)'.")
        "[^" c-alnum "_:<>~]"                  ; match any non-identifier char
        "\\([" c-alpha "_][" c-alnum "_:<>~]*\\)" ; match function name
        "\\([ \t\n]\\|\\\\\n\\)*("             ; see above, BUT the arg list
-       "\\([ \t\n]\\|\\\\\n\\)*\\([^ \t\n(*][^)]*\\)?)" ; must not start
-       "\\([ \t\n]\\|\\\\\n\\)*[^ \t\n;(]"    ; with an asterisk or parentheses
+       "\\([ \t\n]\\|\\\\\n\\)*"              ; must not start
+       "\\([^ \t\n(*]"                        ; with an asterisk or parentheses
+       "[^()]*\\(([^()]*)[^()]*\\)*"          ; Maybe function pointer arguments
+       "\\)?)"
+       "\\([ \t\n]\\|\\\\\n\\)*[^ \t\n;(]"
        ) 1)
     ;; Special case for definitions using phony prototype macros like:
     ;; `int main _PROTO( (int argc,char *argv[]) )'.
diff --git a/lisp/saveplace.el b/lisp/saveplace.el
index 2d1586d895a..9d776877ca6 100644
--- a/lisp/saveplace.el
+++ b/lisp/saveplace.el
@@ -89,8 +89,9 @@ value of `version-control'."
 (defvar save-place-loaded nil
   "Non-nil means that the `save-place-file' has been loaded.")
 
-(defcustom save-place-limit nil
+(defcustom save-place-limit 400
   "Maximum number of entries to retain in the list; nil means no limit."
+  :version "24.1"                       ; nil -> 400
   :type '(choice (integer :tag "Entries" :value 1)
                  (const :tag "No Limit" nil))
   :group 'save-place)
diff --git a/lisp/textmodes/ispell.el b/lisp/textmodes/ispell.el
index c196218feec..5521cfd3de8 100644
--- a/lisp/textmodes/ispell.el
+++ b/lisp/textmodes/ispell.el
@@ -1914,7 +1914,7 @@ Global `ispell-quit' set to start location to continue spell session."
                     (setq line (1+ line))))
               (insert (car guess) "    ")
               (setq guess (cdr guess)))
-            (insert "\nUse option `i' to accept this spelling and put it in your private dictionary.")
+            (insert "\nUse option `i' to accept this spelling and put it in your private dictionary.\n")
             (setq line (+ line (if choices 3 2)))))
       (while (and choices
                   (< (if (> (+ 7 (current-column) (length (car choices))
diff --git a/lisp/window.el b/lisp/window.el
index e68af18ab8e..651e78bb419 100644
--- a/lisp/window.el
+++ b/lisp/window.el
@@ -4761,7 +4761,9 @@ BUFFER, nil if none was found."
                    (or (memq (window-parameter window 'window-side)
                              '(nil none))
                        (eq window-buffer buffer))
-                   (or (not method-window)
+                   (or (and (not method-window)
+                            (or (not other-window)
+                                (not (eq window (selected-window)))))
                        (and (eq method-window 'same)
                             (not other-window)
                             (eq window (selected-window)))
diff --git a/src/ChangeLog b/src/ChangeLog
index 431a515def5..7eb18593993 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,466 @@
+2011-08-27  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * ccl.c: Improve and simplify overflow checking (Bug#9196).
+        (ccl_driver): Do not generate an out-of-range pointer.
+        (Fccl_execute_on_string): Remove unnecessary check for
+        integer overflow, noted by Stefan Monnier in
+        <http://lists.gnu.org/archive/html/emacs-devel/2011-08/msg00979.html>.
+        Remove a FIXME that didn't need fixing.
+        Simplify the newly-introduced buffer reallocation code.
+
+2011-08-27  Juanma Barranquero  <lekktu@gmail.com>
+
+        * makefile.w32-in ($(BLD)/alloc.$(O)): Depend on lib/verify.h.
+
+2011-08-26  Paul Eggert  <eggert@cs.ucla.edu>
+
+        Integer and memory overflow issues (Bug#9196).
+
+        * doc.c (get_doc_string): Rework so that
+        get_doc_string_buffer_size is the actual buffer size, rather than
+        being 1 less than the actual buffer size; this makes xpalloc more
+        convenient.
+
+        * image.c (x_allocate_bitmap_record, cache_image):
+        * xselect.c (Fx_register_dnd_atom):
+        Simplify previous changes by using xpalloc.
+
+        * buffer.c (overlay_str_len): Now ptrdiff_t, not EMACS_INT,
+        since either will do and ptrdiff_t is convenient with xpalloc.
+
+        * charset.c (charset_table_size)
+        (struct charset_sort_data.priority): Now ptrdiff_t.
+        (charset_compare): Don't overflow if priorities differ greatly.
+        (Fsort_charsets): Don't assume list length fits in int.
+        Check for size-calculation overflow when allocating sort data.
+        (syms_of_charset): Allocate an initial charset table that is
+        just under 64 KiB, to avoid problems with glibc malloc and mmap.
+
+        * cmds.c (internal_self_insert): Check for size-calculation overflow.
+
+        * composite.h (struct composition.glyph_len): Now int, not unsigned.
+        The actual value is always <= INT_MAX, and leaving it unsigned made
+        overflow checking harder.
+
+        * dispextern.h (struct glyph_matrix.rows_allocated)
+        (struct face_cache.size): Now ptrdiff_t, for convenience in use
+        with xpalloc.  The values are still always <= INT_MAX.
+
+        * indent.c (compute_motion): Adjust to region_cache_forward sig change.
+
+        * lisp.h (xnmalloc, xnrealloc, xpalloc): New decls.
+        (SAFE_NALLOCA): New macro.
+
+        * region-cache.c (struct boundary.pos, find_cache_boundary)
+        (move_cache_gap, insert_cache_boundary, delete_cache_boundaries)
+        (set_cache_region, invalidate_region_cache)
+        (revalidate_region_cache, know_region_cache, region_cache_forward)
+        (region_cache_backward, pp_cache):
+        Use ptrdiff_t, not EMACS_INT, since either will do.  This is needed
+        so that ptrdiff_t * can be passed to xpalloc.
+        (struct region_cache): Similarly, for gap_start, gap_len, cache_len,
+        beg_unchanged, end_unchanged, buffer_beg, buffer_end members.
+        (pp_cache): Don't assume cache_len fits in int.
+        * region-cache.h: Adjust extern decls to match.
+
+        * search.c (scan_buffer, Freplace_match): Use ptrdiff_t, not
+        EMACS_INT, since either will do, for xpalloc.
+
+        * alloc.c: Include verify.h, and check that int fits in ptrdiff_t.
+        (xnmalloc, xnrealloc, xpalloc): New functions.
+
+        * bidi.c (bidi_shelve_header_size): New constant.
+        (bidi_cache_ensure_space, bidi_shelve_cache): Use it.
+        (bidi_cache_ensure_space): Avoid integer overflow when allocating.
+
+        * bidi.c (bidi_cache_shrink):
+        * buffer.c (overlays_at, overlays_in, record_overlay_string)
+        (overlay_strings):
+        Don't update size of array until after memory allocation succeeds,
+        because xmalloc/xrealloc may not return.
+        (struct sortstrlist.bytes): Now ptrdiff_t, as EMACS_INT doesn't help
+        now that we have proper integer overflow checking.
+        (record_overlay_string, overlay_strings): Catch overflows when
+        calculating size of overlay_str_buf.
+
+        * callproc.c (Fcall_process): Check for size overflow when
+        calculating size of args2.
+        (child_setup): Avoid overflow by using size_t rather than ptrdiff_t.
+        Normally we prefer signed values, but sticking with ptrdiff_t would
+        require adding more-complicated checks.
+
+        * ccl.c (Fccl_execute_on_string): Check for memory overflow.
+        Use ptrdiff_t rather than EMACS_INT where ptrdiff_t will do.
+        Redo buffer-overflow calculations to avoid integer overflow.
+        Add a FIXME comment where memory seems to be over-allocated.
+
+        * character.c (Fstring): Check for size-calculation overflow.
+
+        * coding.c (produce_chars): Redo buffer-overflow calculations to avoid
+        unnecessary integer overflow.  Check for size overflow.
+        (encode_coding_object): Don't update size until xmalloc succeeds.
+
+        * composite.c (get_composition_id): Check for overflow in glyph
+        length calculations.
+
+        Integer and memory overflow fixes for display code.
+        * dispextern.h (struct glyph_pool.nglyphs): Now ptrdiff_t, not int.
+        * dispnew.c (adjust_glyph_matrix, realloc_glyph_pool)
+        (scrolling_window): Check for overflow in size calculations.
+        (line_draw_cost, realloc_glyph_pool, add_row_entry):
+        Don't assume glyph table len fits in int.
+        (struct row_entry.bucket, row_entry_pool_size, row_entry_idx)
+        (row_table_size): Now ptrdiff_t, not int.
+        (scrolling_window): Avoid overflow in size calculations.
+        Don't update size until allocation succeeds.
+        * fns.c (concat): Check for overflow in size calculations.
+        (next_almost_prime): Verify NEXT_ALMOST_PRIME_LIMIT.
+        * lisp.h (RANGED_INTEGERP, TYPE_RANGED_INTEGERP): New macros.
+        (NEXT_ALMOST_PRIME_LIMIT): New constant.
+
+        * doc.c (get_doc_string_buffer_size): Now ptrdiff_t, not int.
+        (get_doc_string): Check for size calculation overflow.
+        Don't update size until allocation succeeds.
+        (get_doc_string, Fsubstitute_command_keys): Use ptrdiff_t, not
+        EMACS_INT, where ptrdiff_t will do.
+        (Fsubstitute_command_keys): Check for string overflow.
+
+        * editfns.c (set_time_zone_rule): Don't assume environment length
+        fits in int.
+        (message_length): Now ptrdiff_t, not int.
+        (Fmessage_box): Don't update size until allocation succeeds.
+        Don't assume message length fits in int.
+        (Fformat): Use ptrdiff_t, not EMACS_INT, where ptrdiff_t will do.
+
+        * emacs.c (main): Do not reallocate argv, since there is a null at
+        the end that can be overwritten, and this way there's no need to
+        worry about size-calculation overflow.
+        (sort_args): Check for size-calculation overflow.
+
+        * eval.c (init_eval_once, grow_specpdl): Don't update size until
+        alloc succeeds.
+        (call_debugger, grow_specpdl): Redo calculations to avoid overflow.
+
+        * frame.c (set_menu_bar_lines, x_set_frame_parameters)
+        (x_set_scroll_bar_width, x_figure_window_size):
+        Check for integer overflow.
+        (x_set_alpha): Do not assume XINT fits in int.
+
+        * frame.h (struct frame): Use int, not EMACS_INT, where int works.
+        This is for the members text_lines, text_cols, total_lines, total_cols,
+        where the system imposes an 'int' limit.
+
+        * fringe.c (Fdefine_fringe_bitmap):
+        Don't update size until alloc works.
+
+        * ftfont.c (ftfont_get_open_type_spec, setup_otf_gstring)
+        (ftfont_shape_by_flt): Check for integer overflow in size calculations.
+
+        * gtkutil.c (get_utf8_string, xg_store_widget_in_map):
+        Check for size-calculation overflow.
+        (get_utf8_string): Use ptrdiff_t, not size_t, where either will
+        do, as we prefer signed integers.
+        (id_to_widget.max_size, id_to_widget.used)
+        (xg_store_widget_in_map, xg_remove_widget_from_map)
+        (xg_get_widget_from_map, xg_get_scroll_id_for_window)
+        (xg_remove_scroll_bar, xg_update_scrollbar_pos):
+        Use and return ptrdiff_t, not int.
+        (xg_gtk_scroll_destroy): Don't assume ptrdiff_t fits in int.
+        * gtkutil.h: Change prototypes to match the above.
+
+        * image.c (RANGED_INTEGERP, TYPE_RANGED_INTEGERP): Remove; these
+        are duplicate now that they've been promoted to lisp.h.
+        (x_allocate_bitmap_record, x_alloc_image_color)
+        (make_image_cache, cache_image, xpm_load):
+        Don't update size until alloc is done.
+        (xpm_load, lookup_rgb_color, lookup_pixel_color, x_to_xcolors)
+        (x_detect_edges):
+        Check for size calculation overflow.
+        (ct_colors_allocated_max): New constant.
+        (x_to_xcolors, x_detect_edges): Reorder multiplicands to avoid
+        overflow.
+
+        * keyboard.c (read_char, menu_bar_items, tool_bar_items)
+        (read_char_x_menu_prompt, read_char_minibuf_menu_width)
+        (read_char_minibuf_menu_prompt, follow_key, read_key_sequence):
+        Use ptrdiff_t, not int, to count maps.
+        (read_char_minibuf_menu_prompt): Check for overflow in size
+        calculations.  Don't update size until allocation succeeds.  Redo
+        calculations to avoid overflow.
+        * keyboard.h: Change prototypes to match the above.
+
+        * keymap.c (cmm_size, current_minor_maps): Use ptrdiff_t, not int,
+        to count maps.
+        (current_minor_maps): Check for size calculation overflow.
+        * keymap.h: Change prototypes to match the above.
+
+        * lread.c (read1, init_obarray): Don't update size until alloc done.
+
+        * macros.c (Fstart_kbd_macro): Don't update size until alloc done.
+        (store_kbd_macro_char): Reorder multiplicands to avoid overflow.
+
+        * nsterm.h (struct ns_color_table.size, struct ns_color_table.avail):
+        Now ptrdiff_t, not int.
+        * nsterm.m (ns_index_color): Use ptrdiff_t, not int, for table indexes.
+        (ns_draw_fringe_bitmap): Rewrite to avoid overflow.
+
+        * process.c (Fnetwork_interface_list): Check for overflow
+        in size calculation.
+
+        * region-cache.c (move_cache_gap): Check for size calculation overflow.
+
+        * scroll.c (do_line_insertion_deletion_costs): Check for size calc
+        overflow.  Don't bother calling xmalloc when xrealloc will do.
+
+        * search.c (Freplace_match): Check for size calculation overflow.
+        (Fset_match_data): Don't assume list lengths fit in 'int'.
+
+        * sysdep.c (system_process_attributes): Use ptrdiff_t, not int,
+        for command line length.  Do not attempt to address one before the
+        beginning of an array, as that's not portable.
+
+        * term.c (max_frame_lines): Remove; unused.
+        (encode_terminal_src_size, encode_terminal_dst_size): Now ptrdiff_t,
+        not int.
+        (encode_terminal_code, calculate_costs): Check for size
+        calculation overflow.
+        (encode_terminal_code): Use ptrdiff_t, not int, to record glyph
+        table lengths and related sizes.  Don't update size until alloc
+        done.  Redo calculations to avoid overflow.
+        (calculate_costs): Don't bother calling xmalloc when xrealloc will do.
+
+        * termcap.c (tgetent): Use ptrdiff_t, not int, to record results of
+        subtracting pointers.
+        (gobble_line): Check for overflow more carefully.  Don't update size
+        until alloc done.
+
+        * tparam.c (tparam1): Use ptrdiff_t, not int, for sizes.
+        Don't update size until alloc done.
+        Redo size calculations to avoid overflow.
+        Check for size calculation overflow.
+        (main) [DEBUG]: Fix typo in invoking tparam1.
+
+        * xdisp.c (store_mode_line_noprop_char, x_consider_frame_title):
+        Use ptrdiff_t, not int, for sizes.
+        (store_mode_line_noprop_char): Don't update size until alloc done.
+
+        * xfaces.c (lface_id_to_name_size, Finternal_make_lisp_face):
+        Use ptrdiff_t, not int, for sizes.
+        (Finternal_make_lisp_face, cache_face):
+        Check for size calculation overflow.
+        (cache_face): Treat size calculation overflows as if they were
+        memory exhaustion (the usual treatment), rather than aborting.
+
+        * xfns.c (x_encode_text, x_set_name_internal)
+        (Fx_change_window_property): Use ptrdiff_t, not int, to count
+        sizes, since they can exceed INT_MAX in size.  Check for size
+        calculation overflow.
+
+        * xgselect.c (gfds_size): Now ptrdiff_t, for convenience with xpalloc.
+        (xg_select): Check for size calculation overflow.
+        Don't update size until alloc done.
+
+        * xrdb.c (get_environ_db): Don't assume path length fits in int,
+        as sprintf is limited to int lengths.
+
+        * xselect.c (X_LONG_SIZE, X_SHRT_MAX, X_SHRT_MIN, X_LONG_MAX)
+        (X_LONG_MIN): New macros.
+        Use them to make the following changes clearer.
+        (MAX_SELECTION_QUANTUM): Make the other bounds on this value clearer.
+        This change doesn't affect the value now, but it may help remind
+        future maintainers not to raise the value too much later.
+        (SELECTION_QUANTUM): Remove, replacing with ...
+        (selection_quantum): ... new function, which avoids overflow.
+        All uses changed.
+        (struct selection_data.size): Now ptrdiff_t, not int, to avoid
+        assumption that selection length fits in 'int'.
+        (x_reply_selection_request, x_handle_selection_request)
+        (x_get_window_property, receive_incremental_selection)
+        (x_get_window_property_as_lisp_data, selection_data_to_lisp_data)
+        (lisp_data_to_selection_data, clean_local_selection_data):
+        Use ptrdiff_t, not int, to record length of selection.
+        (x_reply_selection_request, x_get_window_property)
+        (receive_incremental_selection, x_property_data_to_lisp):
+        Redo calculations to avoid overflow.
+        (x_reply_selection_request): When sending hint, ceiling it at
+        X_LONG_MAX rather than relying on wraparound overflow to send
+        something.
+        (x_get_window_property, receive_incremental_selection)
+        (lisp_data_to_selection_data, x_property_data_to_lisp):
+        Check for size-calculation overflow.
+        (x_get_window_property, receive_incremental_selection)
+        (lisp_data_to_selection_data, Fx_register_dnd_atom):
+        Don't store size until memory allocation succeeds.
+        (x_get_window_property): Plug memory leak on memory exhaustion.
+        Don't double-block input; malloc is safe here.  Don't assume 2**34
+        - 4 fits in unsigned long.  Add an xassert to check
+        XGetWindowProperty overflow.  Be more careful about overflow
+        calculations, and distinguish size from memory overflow better.
+        (receive_incremental_selection): When tracing, don't assume
+        unsigned int is less than INT_MAX.
+        (x_selection_data_to_lisp_data): Remove unnecessary (and in theory
+        harmful) conversions of unsigned short to int.
+        (lisp_data_to_selection_data): Don't assume that integers
+        in the range -65535 through -1 fit in an X unsigned short.
+        Don't assume that ULONG_MAX == X_ULONG_MAX.  Don't store into
+        result parameters unless successful.  Rely on cons_to_unsigned
+        to report problems with elements; the old code wasn't right anyway.
+        (x_check_property_data): Check for int overflow; we cannot use
+        a wider type due to X limits.
+        (x_handle_dnd_message): Use unsigned int, to avoid int overflow.
+
+        * xsmfns.c (smc_save_yourself_CB): Check for size calc overflow.
+
+        * xterm.c (x_color_cells, x_send_scrollbar_event, handle_one_xevent)
+        (x_term_init): Check for size calculation overflow.
+        (x_color_cells): Don't store size until memory allocation succeeds.
+        (handle_one_xevent): Use ptrdiff_t, not int, for byte counts.
+        Don't assume alloca size is less than MAX_ALLOCA.
+        (x_term_init): Don't assume length fits in int (sprintf is limited
+        to int size).
+
+        Use ptrdiff_t for composition IDs.
+        * character.c (lisp_string_width):
+        * composite.c (composition_table_size, n_compositions)
+        (get_composition_id, composition_gstring_from_id):
+        * dispextern.h (struct glyph_string.cmp_id, struct composition_it.id):
+        * xdisp.c (BUILD_COMPOSITE_GLYPH_STRING):
+        * window.c (Frecenter):
+        Use ptrdiff_t, not int, for composition IDs.
+        * composite.c (get_composition_id): Check for integer overflow.
+        * composite.h: Adjust prototypes to match the above changes.
+
+        Use ptrdiff_t for hash table indexes.
+        * category.c (hash_get_category_set):
+        * ccl.c (ccl_driver):
+        * charset.h (struct charset.hash_index, CHECK_CHARSET_GET_ID):
+        * coding.c (coding_system_charset_list, detect_coding_system):
+        * coding.h (struct coding_system.id):
+        * composite.c (get_composition_id, gstring_lookup_cache):
+        * fns.c (hash_lookup, hash_put, Fgethash, Fputhash):
+        * image.c (xpm_get_color_table_h):
+        * lisp.h (hash_lookup, hash_put):
+        * minibuf.c (Ftest_completion):
+        Use ptrdiff_t for hash table indexes, not int (which is too
+        narrow, on 64-bit hosts) or EMACS_INT (which is too wide, on
+        32-bit --with-wide-int hosts).
+
+        * charset.c (Fdefine_charset_internal): Check for integer overflow.
+        Add a FIXME comment about memory leaks.
+        (syms_of_charset): Don't assume xmalloc returns.
+
+        Don't assume that stated character widths fit in int.
+        * character.c (Fchar_width, c_string_width, lisp_string_width):
+        * character.h (CHAR_WIDTH):
+        * indent.c (MULTIBYTE_BYTES_WIDTH):
+        Use sanitize_char_width to avoid undefined and/or bad behavior
+        with outlandish widths.
+        * character.h (sanitize_tab_width): Renamed from sanitize_width,
+        now that we have two such functions.  All uses changed.
+        (sanitize_char_width): New inline function.
+
+        Don't assume that tab-width fits in int.
+        * character.h (sanitize_width): New inline function.
+        (SANE_TAB_WIDTH): New macro.
+        (ASCII_CHAR_WIDTH): Use it.
+        * indent.c (sane_tab_width): Remove.  All uses replaced by
+        SANE_TAB_WIDTH (current_buffer).
+        * xdisp.c (init_iterator): Use SANE_TAB_WIDTH.
+
+        * fileio.c: Integer overflow issues with file modes.
+        (Fset_file_modes, auto_save_1): Don't assume EMACS_INT fits in int.
+
+        * charset.c (read_hex): New arg OVERFLOW.  All uses changed.
+        Remove unreachable code.
+        (read_hex, load_charset_map_from_file): Check for integer overflow.
+
+        * xterm.c: don't go over XClientMessageEvent limit
+        (scroll_bar_windows_size): Now ptrdiff_t, as we prefer signed.
+        (x_send_scroll_bar_event): Likewise.  Check that the size does not
+        exceed limits imposed by XClientMessageEvent, as well as the usual
+        ptrdiff_t and size_t limits.
+
+        * keyboard.c: Overflow, signedness and related fixes.
+        (make_lispy_movement): Use same integer type in forward decl
+        that is used in the definition.
+        (read_key_sequence, keyremap_step):
+        Change bufsize argument back to int, undoing my 2011-03-30 change.
+        We prefer signed types, and int is wide enough here.
+        (parse_tool_bar_item): Don't assume tool_bar_max_label_size is less
+        than TYPE_MAXIMUM (EMACS_INT) / 2.  Don't let the label size grow
+        larger than STRING_BYTES_BOUND.  Use ptrdiff_t for Emacs string
+        length, not size_t.  Use ptrdiff_t for index, not int.
+        (keyremap_step, read_key_sequence): Redo bufsize check to avoid
+        possibility of integer overflow.
+
+        Overflow, signedness and related fixes for images.
+
+        * dispextern.h (struct it.stack[0].u.image.image_id)
+        (struct_it.image_id, struct image.id, struct image_cache.size)
+        (struct image_cache.used, struct image_cache.ref_count):
+        * gtkutil.c (update_frame_tool_bar):
+        * image.c (x_reference_bitmap, Fimage_size, Fimage_mask_p)
+        (Fimage_metadata, free_image_cache, clear_image_cache, lookup_image)
+        (cache_image, mark_image_cache, x_kill_gs_process, Flookup_image):
+        * nsmenu.m (update_frame_tool_bar):
+        * xdisp.c (calc_pixel_width_or_height):
+        * xfns.c (image_cache_refcount):
+        Image IDs are now ptrdiff_t, not int, to avoid arbitrary limits
+        on typical 64-bit hosts.
+
+        * image.c (RANGED_INTEGERP, TYPE_RANGED_INTEGERP): New macros.
+        (x_bitmap_pixmap, x_create_x_image_and_pixmap):
+        Omit unnecessary casts to int.
+        (parse_image_spec): Check that integers fall into 'int' range
+        when the callers expect that.
+        (image_ascent): Redo ascent calculation to avoid int overflow.
+        (clear_image_cache): Avoid overflow when sqrt (INT_MAX) < nimages.
+        (lookup_image): Remove unnecessary tests.
+        (xbm_image_p): Locals are now of int, not EMACS_INT,
+        since parse_image_check makes sure they fit into int.
+        (png_load, gif_load, svg_load_image):
+        Prefer int to unsigned where either will do.
+        (tiff_handler): New function, combining the cores of the
+        old tiff_error_handler and tiff_warning_handler.  This
+        function is rewritten to use vsnprintf and thereby avoid
+        stack buffer overflows.  It uses only the features of vsnprintf
+        that are common to both POSIX and native Microsoft.
+        (tiff_error_handler, tiff_warning_handler): Use it.
+        (tiff_load, gif_load, imagemagick_load_image):
+        Don't assume :index value fits in 'int'.
+        (gif_load): Omit unnecessary cast to double, and avoid double-rounding.
+        (imagemagick_load_image): Check that crop parameters fit into
+        the integer types that MagickCropImage accepts.  Don't assume
+        Vimagemagick_render_type has a nonnegative value.  Don't assume
+        size_t fits in 'long'.
+        (gs_load): Use printmax_t to print the widest integers possible.
+        Check for integer overflow when computing image height and width.
+
+2011-08-26  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (redisplay_window): Don't force window start if point
+        will be invisible in the resulting window.  (Bug#9324)
+
+2011-08-25  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (compute_display_string_pos): Return 2 in DISP_PROP when
+        the display spec is of the form `(space ...)'.
+        (handle_display_spec): Return the value returned by
+        handle_single_display_spec, not just 1 or zero.
+        (handle_single_display_spec): If the display spec is of the form
+        `(space ...)', and specifies display in the text area, return 2
+        rather than 1.
+        (try_cursor_movement): Check for the need to scroll more
+        accurately, and prefer exact match for point under bidi.  Don't
+        advance `row' beyond the last row of the window.
+
+        * dispextern.h (struct bidi_it): Rename the disp_prop_p member
+        into disp_prop; all users changed.
+
+        * bidi.c (bidi_fetch_char): If compute_display_string_pos returns
+        DISP_PROP = 2, substitute the u+2029 PARAGRAPH SEPARATOR character
+        for the text covered by the display property.
+
 2011-08-25  Chong Yidong  <cyd@stupidchicken.com>
 
         * buffer.c (Fbury_buffer_internal): Rename from Funrecord_buffer.
diff --git a/src/alloc.c b/src/alloc.c
index 36ad645612d..2d256800466 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -46,6 +46,7 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #include "syssignal.h"
 #include "termhooks.h"          /* For struct terminal.  */
 #include <setjmp.h>
+#include <verify.h>
 
 /* GC_MALLOC_CHECK defined means perform validity checks of malloc'd
    memory.  Can do this only if using gmalloc.c.  */
@@ -733,6 +734,93 @@ xfree (POINTER_TYPE *block)
 }
 
 
+/* Other parts of Emacs pass large int values to allocator functions
+   expecting ptrdiff_t.  This is portable in practice, but check it to
+   be safe.  */
+verify (INT_MAX <= PTRDIFF_MAX);
+
+
+/* Allocate an array of NITEMS items, each of size ITEM_SIZE.
+   Signal an error on memory exhaustion, and block interrupt input.  */
+
+void *
+xnmalloc (ptrdiff_t nitems, ptrdiff_t item_size)
+{
+  xassert (0 <= nitems && 0 < item_size);
+  if (min (PTRDIFF_MAX, SIZE_MAX) / item_size < nitems)
+    memory_full (SIZE_MAX);
+  return xmalloc (nitems * item_size);
+}
+
+
+/* Reallocate an array PA to make it of NITEMS items, each of size ITEM_SIZE.
+   Signal an error on memory exhaustion, and block interrupt input.  */
+
+void *
+xnrealloc (void *pa, ptrdiff_t nitems, ptrdiff_t item_size)
+{
+  xassert (0 <= nitems && 0 < item_size);
+  if (min (PTRDIFF_MAX, SIZE_MAX) / item_size < nitems)
+    memory_full (SIZE_MAX);
+  return xrealloc (pa, nitems * item_size);
+}
+
+
+/* Grow PA, which points to an array of *NITEMS items, and return the
+   location of the reallocated array, updating *NITEMS to reflect its
+   new size.  The new array will contain at least NITEMS_INCR_MIN more
+   items, but will not contain more than NITEMS_MAX items total.
+   ITEM_SIZE is the size of each item, in bytes.
+
+   ITEM_SIZE and NITEMS_INCR_MIN must be positive.  *NITEMS must be
+   nonnegative.  If NITEMS_MAX is -1, it is treated as if it were
+   infinity.
+
+   If PA is null, then allocate a new array instead of reallocating
+   the old one.  Thus, to grow an array A without saving its old
+   contents, invoke xfree (A) immediately followed by xgrowalloc (0,
+   &NITEMS, ...).
+
+   Block interrupt input as needed.  If memory exhaustion occurs, set
+   *NITEMS to zero if PA is null, and signal an error (i.e., do not
+   return).  */
+
+void *
+xpalloc (void *pa, ptrdiff_t *nitems, ptrdiff_t nitems_incr_min,
+         ptrdiff_t nitems_max, ptrdiff_t item_size)
+{
+  /* The approximate size to use for initial small allocation
+     requests.  This is the largest "small" request for the GNU C
+     library malloc.  */
+  enum { DEFAULT_MXFAST = 64 * sizeof (size_t) / 4 };
+
+  /* If the array is tiny, grow it to about (but no greater than)
+     DEFAULT_MXFAST bytes.  Otherwise, grow it by about 50%.  */
+  ptrdiff_t n = *nitems;
+  ptrdiff_t tiny_max = DEFAULT_MXFAST / item_size - n;
+  ptrdiff_t half_again = n >> 1;
+  ptrdiff_t incr_estimate = max (tiny_max, half_again);
+
+  /* Adjust the increment according to three constraints: NITEMS_INCR_MIN,
+     NITEMS_MAX, and what the C language can represent safely.  */
+  ptrdiff_t C_language_max = min (PTRDIFF_MAX, SIZE_MAX) / item_size;
+  ptrdiff_t n_max = (0 <= nitems_max && nitems_max < C_language_max
+                     ? nitems_max : C_language_max);
+  ptrdiff_t nitems_incr_max = n_max - n;
+  ptrdiff_t incr = max (nitems_incr_min, min (incr_estimate, nitems_incr_max));
+
+  xassert (0 < item_size && 0 < nitems_incr_min && 0 <= n && -1 <= nitems_max);
+  if (! pa)
+    *nitems = 0;
+  if (nitems_incr_max < incr)
+    memory_full (SIZE_MAX);
+  n += incr;
+  pa = xrealloc (pa, n * item_size);
+  *nitems = n;
+  return pa;
+}
+
+
 /* Like strdup, but uses xmalloc.  */
 
 char *
diff --git a/src/bidi.c b/src/bidi.c
index 425a0be9578..bb29647ea88 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -316,6 +316,21 @@ static ptrdiff_t bidi_cache_last_idx;	/* slot of last cache hit */
 static ptrdiff_t bidi_cache_start = 0;  /* start of cache for this
                                            "stack" level */
 
+/* 5-slot stack for saving the start of the previous level of the
+   cache.  xdisp.c maintains a 5-slot stack for its iterator state,
+   and we need the same size of our stack.  */
+static ptrdiff_t bidi_cache_start_stack[IT_STACK_SIZE];
+static int bidi_cache_sp;
+
+/* Size of header used by bidi_shelve_cache.  */
+enum
+  {
+    bidi_shelve_header_size =
+      (sizeof (bidi_cache_idx) + sizeof (bidi_cache_start_stack)
+       + sizeof (bidi_cache_sp) + sizeof (bidi_cache_start)
+       + sizeof (bidi_cache_last_idx))
+  };
+
 /* Reset the cache state to the empty state.  We only reset the part
    of the cache relevant to iteration of the current object.  Previous
    objects, which are pushed on the display iterator's stack, are left
@@ -338,9 +353,9 @@ bidi_cache_shrink (void)
 {
   if (bidi_cache_size > BIDI_CACHE_CHUNK)
     {
-      bidi_cache_size = BIDI_CACHE_CHUNK;
       bidi_cache =
-        (struct bidi_it *) xrealloc (bidi_cache, bidi_cache_size * elsz);
+        (struct bidi_it *) xrealloc (bidi_cache, BIDI_CACHE_CHUNK * elsz);
+      bidi_cache_size = BIDI_CACHE_CHUNK;
     }
   bidi_cache_reset ();
 }
@@ -473,21 +488,19 @@ bidi_cache_ensure_space (ptrdiff_t idx)
   /* Enlarge the cache as needed.  */
   if (idx >= bidi_cache_size)
     {
-      ptrdiff_t new_size;
-
       /* The bidi cache cannot be larger than the largest Lisp string
          or buffer.  */
       ptrdiff_t string_or_buffer_bound =
         max (BUF_BYTES_MAX, STRING_BYTES_BOUND);
 
       /* Also, it cannot be larger than what C can represent.  */
-      ptrdiff_t c_bound = min (PTRDIFF_MAX, SIZE_MAX) / elsz;
+      ptrdiff_t c_bound =
+        (min (PTRDIFF_MAX, SIZE_MAX) - bidi_shelve_header_size) / elsz;
 
-      if (min (string_or_buffer_bound, c_bound) <= idx)
-        memory_full (SIZE_MAX);
-      new_size = idx - idx % BIDI_CACHE_CHUNK + BIDI_CACHE_CHUNK;
-      bidi_cache = (struct bidi_it *) xrealloc (bidi_cache, new_size * elsz);
-      bidi_cache_size = new_size;
+      bidi_cache =
+        xpalloc (bidi_cache, &bidi_cache_size,
+                 max (BIDI_CACHE_CHUNK, idx - bidi_cache_size + 1),
+                 min (string_or_buffer_bound, c_bound), elsz);
     }
 }
 
@@ -540,7 +553,7 @@ bidi_cache_iterator_state (struct bidi_it *bidi_it, int resolved)
       bidi_cache[idx].next_for_ws = bidi_it->next_for_ws;
       bidi_cache[idx].ignore_bn_limit = bidi_it->ignore_bn_limit;
       bidi_cache[idx].disp_pos = bidi_it->disp_pos;
-      bidi_cache[idx].disp_prop_p = bidi_it->disp_prop_p;
+      bidi_cache[idx].disp_prop = bidi_it->disp_prop;
     }
 
   bidi_cache_last_idx = idx;
@@ -580,11 +593,6 @@ bidi_peek_at_next_level (struct bidi_it *bidi_it)
 /***********************************************************************
              Pushing and popping the bidi iterator state
  ***********************************************************************/
-/* 5-slot stack for saving the start of the previous level of the
-   cache.  xdisp.c maintains a 5-slot stack for its iterator state,
-   and we need the same size of our stack.  */
-static ptrdiff_t bidi_cache_start_stack[IT_STACK_SIZE];
-static int bidi_cache_sp;
 
 /* Push the bidi iterator state in preparation for reordering a
    different object, e.g. display string found at certain buffer
@@ -639,21 +647,16 @@ void *
 bidi_shelve_cache (void)
 {
   unsigned char *databuf;
+  ptrdiff_t alloc;
 
   /* Empty cache.  */
   if (bidi_cache_idx == 0)
     return NULL;
 
-  databuf = xmalloc (sizeof (bidi_cache_idx)
-                     + bidi_cache_idx * sizeof (struct bidi_it)
-                     + sizeof (bidi_cache_start_stack)
-                     + sizeof (bidi_cache_sp) + sizeof (bidi_cache_start)
-                     + sizeof (bidi_cache_last_idx));
-  bidi_cache_total_alloc +=
-    sizeof (bidi_cache_idx) + bidi_cache_idx * sizeof (struct bidi_it)
-    + sizeof (bidi_cache_start_stack)
-    + sizeof (bidi_cache_sp) + sizeof (bidi_cache_start)
-    + sizeof (bidi_cache_last_idx);
+  alloc = (bidi_shelve_header_size
+           + bidi_cache_idx * sizeof (struct bidi_it));
+  databuf = xmalloc (alloc);
+  bidi_cache_total_alloc += alloc;
 
   memcpy (databuf, &bidi_cache_idx, sizeof (bidi_cache_idx));
   memcpy (databuf + sizeof (bidi_cache_idx),
@@ -706,9 +709,7 @@ bidi_unshelve_cache (void *databuf, int just_free)
 
           memcpy (&idx, p, sizeof (bidi_cache_idx));
           bidi_cache_total_alloc -=
-            sizeof (bidi_cache_idx) + idx * sizeof (struct bidi_it)
-            + sizeof (bidi_cache_start_stack) + sizeof (bidi_cache_sp)
-            + sizeof (bidi_cache_start) + sizeof (bidi_cache_last_idx);
+            bidi_shelve_header_size + idx * sizeof (struct bidi_it);
         }
       else
         {
@@ -737,9 +738,7 @@ bidi_unshelve_cache (void *databuf, int just_free)
                   + sizeof (bidi_cache_start),
                   sizeof (bidi_cache_last_idx));
           bidi_cache_total_alloc -=
-            sizeof (bidi_cache_idx) + bidi_cache_idx * sizeof (struct bidi_it)
-            + sizeof (bidi_cache_start_stack) + sizeof (bidi_cache_sp)
-            + sizeof (bidi_cache_start) + sizeof (bidi_cache_last_idx);
+            bidi_shelve_header_size + bidi_cache_idx * sizeof (struct bidi_it);
         }
 
       xfree (p);
@@ -828,7 +827,7 @@ bidi_init_it (EMACS_INT charpos, EMACS_INT bytepos, int frame_window_p,
     bidi_it->prev_for_neutral.orig_type = UNKNOWN_BT;
   bidi_it->sor = L2R;    /* FIXME: should it be user-selectable? */
   bidi_it->disp_pos = -1;       /* invalid/unknown */
-  bidi_it->disp_prop_p = 0;
+  bidi_it->disp_prop = 0;
   /* We can only shrink the cache if we are at the bottom level of its
      "stack".  */
   if (bidi_cache_start == 0)
@@ -908,19 +907,21 @@ bidi_char_at_pos (EMACS_INT bytepos, const unsigned char *s, int unibyte)
 
 /* Fetch and return the character at BYTEPOS/CHARPOS.  If that
    character is covered by a display string, treat the entire run of
-   covered characters as a single character u+FFFC, and return their
-   combined length in CH_LEN and NCHARS.  DISP_POS specifies the
-   character position of the next display string, or -1 if not yet
-   computed.  DISP_PROP_P non-zero means that there's really a display
-   string at DISP_POS, as opposed to when we searched till DISP_POS
-   without findingone.  When the next character is at or beyond that
+   covered characters as a single character, either u+2029 or u+FFFC,
+   and return their combined length in CH_LEN and NCHARS.  DISP_POS
+   specifies the character position of the next display string, or -1
+   if not yet computed.  When the next character is at or beyond that
    position, the function updates DISP_POS with the position of the
-   next display string.  STRING->s is the C string to iterate, or NULL
-   if iterating over a buffer or a Lisp string; in the latter case,
-   STRING->lstring is the Lisp string.  */
+   next display string.  DISP_PROP non-zero means that there's really
+   a display string at DISP_POS, as opposed to when we searched till
+   DISP_POS without finding one.  If DISP_PROP is 2, it means the
+   display spec is of the form `(space ...)', which is replaced with
+   u+2029 to handle it as a paragraph separator.  STRING->s is the C
+   string to iterate, or NULL if iterating over a buffer or a Lisp
+   string; in the latter case, STRING->lstring is the Lisp string.  */
 static inline int
 bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
-                 int *disp_prop_p, struct bidi_string_data *string,
+                 int *disp_prop, struct bidi_string_data *string,
                  int frame_window_p, EMACS_INT *ch_len, EMACS_INT *nchars)
 {
   int ch;
@@ -934,7 +935,7 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
     {
       SET_TEXT_POS (pos, charpos, bytepos);
       *disp_pos = compute_display_string_pos (&pos, string, frame_window_p,
-                                              disp_prop_p);
+                                              disp_prop);
     }
 
   /* Fetch the character at BYTEPOS.  */
@@ -944,9 +945,9 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
       *ch_len = 1;
       *nchars = 1;
       *disp_pos = endpos;
-      *disp_prop_p = 0;
+      *disp_prop = 0;
     }
-  else if (charpos >= *disp_pos && *disp_prop_p)
+  else if (charpos >= *disp_pos && *disp_prop)
     {
       EMACS_INT disp_end_pos;
 
@@ -954,9 +955,23 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
          property.  Hopefully, it will never be needed.  */
       if (charpos > *disp_pos)
         abort ();
-      /* Return the Unicode Object Replacement Character to represent
-         the entire run of characters covered by the display string.  */
-      ch = 0xFFFC;
+      /* Text covered by `display' properties and overlays with
+         display properties or display strings is handled as a single
+         character that represents the entire run of characters
+         covered by the display property.  */
+      if (*disp_prop == 2)
+        {
+          /* `(space ...)' display specs are handled as paragraph
+             separators for the purposes of the reordering; see UAX#9
+             section 3 and clause HL1 in section 4.3 there.  */
+          ch = 0x2029;
+        }
+      else
+        {
+          /* All other display specs are handled as the Unicode Object
+             Replacement Character.  */
+          ch = 0xFFFC;
+        }
       disp_end_pos = compute_display_string_end (*disp_pos, string);
       *nchars = disp_end_pos - *disp_pos;
       if (*nchars <= 0)
@@ -1014,11 +1029,11 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
   /* If we just entered a run of characters covered by a display
      string, compute the position of the next display string.  */
   if (charpos + *nchars <= endpos && charpos + *nchars > *disp_pos
-      && *disp_prop_p)
+      && *disp_prop)
     {
       SET_TEXT_POS (pos, charpos + *nchars, bytepos + *ch_len);
       *disp_pos = compute_display_string_pos (&pos, string, frame_window_p,
-                                              disp_prop_p);
+                                              disp_prop);
     }
 
   return ch;
@@ -1126,7 +1141,7 @@ bidi_paragraph_init (bidi_dir_t dir, struct bidi_it *bidi_it, int no_default_p)
       int ch;
       EMACS_INT ch_len, nchars;
       EMACS_INT pos, disp_pos = -1;
-      int disp_prop_p = 0;
+      int disp_prop = 0;
       bidi_type_t type;
       const unsigned char *s;
 
@@ -1174,7 +1189,7 @@ bidi_paragraph_init (bidi_dir_t dir, struct bidi_it *bidi_it, int no_default_p)
         bytepos = pstartbyte;
         if (!string_p)
           pos = BYTE_TO_CHAR (bytepos);
-        ch = bidi_fetch_char (bytepos, pos, &disp_pos, &disp_prop_p,
+        ch = bidi_fetch_char (bytepos, pos, &disp_pos, &disp_prop,
                               &bidi_it->string,
                               bidi_it->frame_window_p, &ch_len, &nchars);
         type = bidi_get_type (ch, NEUTRAL_DIR);
@@ -1199,7 +1214,7 @@ bidi_paragraph_init (bidi_dir_t dir, struct bidi_it *bidi_it, int no_default_p)
               break;
             /* Fetch next character and advance to get past it.  */
             ch = bidi_fetch_char (bytepos, pos, &disp_pos,
-                                  &disp_prop_p, &bidi_it->string,
+                                  &disp_prop, &bidi_it->string,
                                   bidi_it->frame_window_p, &ch_len, &nchars);
             pos += nchars;
             bytepos += ch_len;
@@ -1336,7 +1351,7 @@ bidi_resolve_explicit_1 (struct bidi_it *bidi_it)
       bidi_it->ch_len = 1;
       bidi_it->nchars = 1;
       bidi_it->disp_pos = (string_p ? bidi_it->string.schars : ZV);
-      bidi_it->disp_prop_p = 0;
+      bidi_it->disp_prop = 0;
     }
   else
     {
@@ -1344,7 +1359,7 @@ bidi_resolve_explicit_1 (struct bidi_it *bidi_it)
          display string, treat the entire run of covered characters as
          a single character u+FFFC.  */
       curchar = bidi_fetch_char (bidi_it->bytepos, bidi_it->charpos,
-                                 &bidi_it->disp_pos, &bidi_it->disp_prop_p,
+                                 &bidi_it->disp_pos, &bidi_it->disp_prop,
                                  &bidi_it->string, bidi_it->frame_window_p,
                                  &bidi_it->ch_len, &bidi_it->nchars);
     }
@@ -2079,7 +2094,7 @@ bidi_level_of_next_char (struct bidi_it *bidi_it)
       struct bidi_string_data bs = bidi_it->string;
       bidi_type_t chtype;
       int fwp = bidi_it->frame_window_p;
-      int dpp = bidi_it->disp_prop_p;
+      int dpp = bidi_it->disp_prop;
 
       if (bidi_it->nchars <= 0)
         abort ();
diff --git a/src/buffer.c b/src/buffer.c
index 832044ae6f4..37d2975c8c7 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -2557,13 +2557,10 @@ overlays_at (EMACS_INT pos, int extend, Lisp_Object **vec_ptr,
                  Either make it bigger, or don't store any more in it.  */
               if (extend)
                 {
-                  if ((OVERLAY_COUNT_MAX - 4) / 2 < len)
-                    memory_full (SIZE_MAX);
-                  /* Make it work with an initial len == 0.  */
-                  len = len * 2 + 4;
-                  *len_ptr = len;
-                  vec = (Lisp_Object *) xrealloc (vec, len * sizeof (Lisp_Object));
+                  vec = xpalloc (vec, len_ptr, 1, OVERLAY_COUNT_MAX,
+                                 sizeof *vec);
                   *vec_ptr = vec;
+                  len = *len_ptr;
                 }
               else
                 inhibit_storing = 1;
@@ -2600,13 +2597,10 @@ overlays_at (EMACS_INT pos, int extend, Lisp_Object **vec_ptr,
             {
               if (extend)
                 {
-                  if ((OVERLAY_COUNT_MAX - 4) / 2 < len)
-                    memory_full (SIZE_MAX);
-                  /* Make it work with an initial len == 0.  */
-                  len = len * 2 + 4;
-                  *len_ptr = len;
-                  vec = (Lisp_Object *) xrealloc (vec, len * sizeof (Lisp_Object));
+                  vec = xpalloc (vec, len_ptr, 1, OVERLAY_COUNT_MAX,
+                                 sizeof *vec);
                   *vec_ptr = vec;
+                  len = *len_ptr;
                 }
               else
                 inhibit_storing = 1;
@@ -2697,13 +2691,10 @@ overlays_in (EMACS_INT beg, EMACS_INT end, int extend,
                  Either make it bigger, or don't store any more in it.  */
               if (extend)
                 {
-                  if ((OVERLAY_COUNT_MAX - 4) / 2 < len)
-                    memory_full (SIZE_MAX);
-                  /* Make it work with an initial len == 0.  */
-                  len = len * 2 + 4;
-                  *len_ptr = len;
-                  vec = (Lisp_Object *) xrealloc (vec, len * sizeof (Lisp_Object));
+                  vec = xpalloc (vec, len_ptr, 1, OVERLAY_COUNT_MAX,
+                                 sizeof *vec);
                   *vec_ptr = vec;
+                  len = *len_ptr;
                 }
               else
                 inhibit_storing = 1;
@@ -2745,13 +2736,10 @@ overlays_in (EMACS_INT beg, EMACS_INT end, int extend,
             {
               if (extend)
                 {
-                  if ((OVERLAY_COUNT_MAX - 4) / 2 < len)
-                    memory_full (SIZE_MAX);
-                  /* Make it work with an initial len == 0.  */
-                  len = len * 2 + 4;
-                  *len_ptr = len;
-                  vec = (Lisp_Object *) xrealloc (vec, len * sizeof (Lisp_Object));
+                  vec = xpalloc (vec, len_ptr, 1, OVERLAY_COUNT_MAX,
+                                 sizeof *vec);
                   *vec_ptr = vec;
+                  len = *len_ptr;
                 }
               else
                 inhibit_storing = 1;
@@ -2933,7 +2921,7 @@ struct sortstrlist
   struct sortstr *buf;  /* An array that expands as needed; never freed.  */
   ptrdiff_t size;       /* Allocated length of that array.  */
   ptrdiff_t used;       /* How much of the array is currently in use.  */
-  EMACS_INT bytes;              /* Total length of the strings in buf.  */
+  ptrdiff_t bytes;      /* Total length of the strings in buf.  */
 };
 
 /* Buffers for storing information about the overlays touching a given
@@ -2944,7 +2932,7 @@ static struct sortstrlist overlay_heads, overlay_tails;
 static unsigned char *overlay_str_buf;
 
 /* Allocated length of overlay_str_buf.  */
-static EMACS_INT overlay_str_len;
+static ptrdiff_t overlay_str_len;
 
 /* A comparison function suitable for passing to qsort.  */
 static int
@@ -2966,17 +2954,7 @@ record_overlay_string (struct sortstrlist *ssl, Lisp_Object str,
   EMACS_INT nbytes;
 
   if (ssl->used == ssl->size)
-    {
-      if (min (PTRDIFF_MAX, SIZE_MAX) / (sizeof (struct sortstr) * 2)
-          < ssl->size)
-        memory_full (SIZE_MAX);
-      else if (0 < ssl->size)
-        ssl->size *= 2;
-      else
-        ssl->size = 5;
-      ssl->buf = ((struct sortstr *)
-                  xrealloc (ssl->buf, ssl->size * sizeof (struct sortstr)));
-    }
+    ssl->buf = xpalloc (ssl->buf, &ssl->size, 5, -1, sizeof *ssl->buf);
   ssl->buf[ssl->used].string = str;
   ssl->buf[ssl->used].string2 = str2;
   ssl->buf[ssl->used].size = size;
@@ -2991,6 +2969,8 @@ record_overlay_string (struct sortstrlist *ssl, Lisp_Object str,
   else
     nbytes = SBYTES (str);
 
+  if (INT_ADD_OVERFLOW (ssl->bytes, nbytes))
+    memory_full (SIZE_MAX);
   ssl->bytes += nbytes;
 
   if (STRINGP (str2))
@@ -3003,6 +2983,8 @@ record_overlay_string (struct sortstrlist *ssl, Lisp_Object str,
       else
         nbytes = SBYTES (str2);
 
+      if (INT_ADD_OVERFLOW (ssl->bytes, nbytes))
+        memory_full (SIZE_MAX);
       ssl->bytes += nbytes;
     }
 }
@@ -3096,14 +3078,15 @@ overlay_strings (EMACS_INT pos, struct window *w, unsigned char **pstr)
       Lisp_Object tem;
       EMACS_INT i;
       unsigned char *p;
-      EMACS_INT total = overlay_heads.bytes + overlay_tails.bytes;
+      ptrdiff_t total;
 
+      if (INT_ADD_OVERFLOW (overlay_heads.bytes, overlay_tails.bytes))
+        memory_full (SIZE_MAX);
+      total = overlay_heads.bytes + overlay_tails.bytes;
       if (total > overlay_str_len)
-        {
-          overlay_str_len = total;
-          overlay_str_buf = (unsigned char *)xrealloc (overlay_str_buf,
-                                                       total);
-        }
+        overlay_str_buf = xpalloc (overlay_str_buf, &overlay_str_len,
+                                   total - overlay_str_len, -1, 1);
+
       p = overlay_str_buf;
       for (i = overlay_tails.used; --i >= 0;)
         {
diff --git a/src/callproc.c b/src/callproc.c
index 3a91be3d8da..1bdb57a27d0 100644
--- a/src/callproc.c
+++ b/src/callproc.c
@@ -252,7 +252,7 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
           val = Qraw_text;
         else
           {
-            SAFE_ALLOCA (args2, Lisp_Object *, (nargs + 1) * sizeof *args2);
+            SAFE_NALLOCA (args2, 1, nargs + 1);
             args2[0] = Qcall_process;
             for (i = 0; i < nargs; i++) args2[i + 1] = args[i];
             coding_systems = Ffind_operation_coding_system (nargs + 1, args2);
@@ -726,7 +726,7 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
             {
               ptrdiff_t i;
 
-              SAFE_ALLOCA (args2, Lisp_Object *, (nargs + 1) * sizeof *args2);
+              SAFE_NALLOCA (args2, 1, nargs + 1);
               args2[0] = Qcall_process;
               for (i = 0; i < nargs; i++) args2[i + 1] = args[i];
               coding_systems
@@ -1024,7 +1024,7 @@ usage: (call-process-region START END PROGRAM &optional DELETE BUFFER DISPLAY &r
   else
     {
       USE_SAFE_ALLOCA;
-      SAFE_ALLOCA (args2, Lisp_Object *, (nargs + 1) * sizeof *args2);
+      SAFE_NALLOCA (args2, 1, nargs + 1);
       args2[0] = Qcall_process_region;
       for (i = 0; i < nargs; i++) args2[i + 1] = args[i];
       coding_systems = Ffind_operation_coding_system (nargs + 1, args2);
@@ -1153,7 +1153,7 @@ child_setup (int in, int out, int err, register char **new_argv, int set_pgrp, L
      cleaned up in the usual way. */
   {
     register char *temp;
-    register int i;
+    size_t i; /* size_t, because ptrdiff_t might overflow here!  */
 
     i = SBYTES (current_dir);
 #ifdef MSDOS
diff --git a/src/category.c b/src/category.c
index 08eadb04730..a822bb654b0 100644
--- a/src/category.c
+++ b/src/category.c
@@ -67,7 +67,7 @@ static Lisp_Object
 hash_get_category_set (Lisp_Object table, Lisp_Object category_set)
 {
   struct Lisp_Hash_Table *h;
-  EMACS_INT i;
+  ptrdiff_t i;
   EMACS_UINT hash;
 
   if (NILP (XCHAR_TABLE (table)->extras[1]))
diff --git a/src/ccl.c b/src/ccl.c
index 9cfcbfe8703..b28a284f70a 100644
--- a/src/ccl.c
+++ b/src/ccl.c
@@ -1303,7 +1303,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 
             case CCL_LookupIntConstTbl:
               {
-                EMACS_INT eop;
+                ptrdiff_t eop;
                 struct Lisp_Hash_Table *h;
                 GET_CCL_RANGE (eop, ccl_prog, ic++, 0,
                                (VECTORP (Vtranslation_hash_table_vector)
@@ -1329,7 +1329,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 
             case CCL_LookupCharConstTbl:
               {
-                EMACS_INT eop;
+                ptrdiff_t eop;
                 struct Lisp_Hash_Table *h;
                 GET_CCL_RANGE (eop, ccl_prog, ic++, 0,
                                (VECTORP (Vtranslation_hash_table_vector)
@@ -1770,7 +1770,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
         }
 
       msglen = strlen (msg);
-      if (dst + msglen <= dst_end)
+      if (msglen <= dst_end - dst)
         {
           for (i = 0; i < msglen; i++)
             *dst++ = msg[i];
@@ -2061,12 +2061,13 @@ usage: (ccl-execute-on-string CCL-PROGRAM STATUS STRING &optional CONTINUE UNIBY
   Lisp_Object val;
   struct ccl_program ccl;
   int i;
-  EMACS_INT outbufsize;
+  ptrdiff_t outbufsize;
   unsigned char *outbuf, *outp;
-  EMACS_INT str_chars, str_bytes;
+  ptrdiff_t str_chars, str_bytes;
 #define CCL_EXECUTE_BUF_SIZE 1024
   int source[CCL_EXECUTE_BUF_SIZE], destination[CCL_EXECUTE_BUF_SIZE];
-  EMACS_INT consumed_chars, consumed_bytes, produced_chars;
+  ptrdiff_t consumed_chars, consumed_bytes, produced_chars;
+  int buf_magnification;
 
   if (setup_ccl_program (&ccl, ccl_prog) < 0)
     error ("Invalid CCL program");
@@ -2093,6 +2094,10 @@ usage: (ccl-execute-on-string CCL-PROGRAM STATUS STRING &optional CONTINUE UNIBY
         ccl.ic = i;
     }
 
+  buf_magnification = ccl.buf_magnification ? ccl.buf_magnification : 1;
+
+  if ((min (PTRDIFF_MAX, SIZE_MAX) - 256) / buf_magnification < str_bytes)
+    memory_full (SIZE_MAX);
   outbufsize = (ccl.buf_magnification
                 ? str_bytes * ccl.buf_magnification + 256
                 : str_bytes + 256);
@@ -2122,31 +2127,25 @@ usage: (ccl-execute-on-string CCL-PROGRAM STATUS STRING &optional CONTINUE UNIBY
       src_size = j;
       while (1)
         {
+          int max_expansion = NILP (unibyte_p) ? MAX_MULTIBYTE_LENGTH : 1;
+          ptrdiff_t offset, shortfall;
           ccl_driver (&ccl, src, destination, src_size, CCL_EXECUTE_BUF_SIZE,
                       Qnil);
           produced_chars += ccl.produced;
+          offset = outp - outbuf;
+          shortfall = ccl.produced * max_expansion - (outbufsize - offset);
+          if (0 < shortfall)
+            {
+              outbuf = xpalloc (outbuf, &outbufsize, shortfall, -1, 1);
+              outp = outbuf + offset;
+            }
           if (NILP (unibyte_p))
             {
-              if (outp - outbuf + MAX_MULTIBYTE_LENGTH * ccl.produced
-                  > outbufsize)
-                {
-                  EMACS_INT offset = outp - outbuf;
-                  outbufsize += MAX_MULTIBYTE_LENGTH * ccl.produced;
-                  outbuf = (unsigned char *) xrealloc (outbuf, outbufsize);
-                  outp = outbuf + offset;
-                }
               for (j = 0; j < ccl.produced; j++)
                 CHAR_STRING_ADVANCE (destination[j], outp);
             }
           else
             {
-              if (outp - outbuf + ccl.produced > outbufsize)
-                {
-                  EMACS_INT offset = outp - outbuf;
-                  outbufsize += ccl.produced;
-                  outbuf = (unsigned char *) xrealloc (outbuf, outbufsize);
-                  outp = outbuf + offset;
-                }
               for (j = 0; j < ccl.produced; j++)
                 *outp++ = destination[j];
             }
diff --git a/src/character.c b/src/character.c
index 8e9b3e3775e..fb9b8a9b93e 100644
--- a/src/character.c
+++ b/src/character.c
@@ -326,7 +326,7 @@ usage: (char-width CHAR)  */)
   disp = dp ? DISP_CHAR_VECTOR (dp, c) : Qnil;
 
   if (VECTORP (disp))
-    width = ASIZE (disp);
+    width = sanitize_char_width (ASIZE (disp));
   else
     width = CHAR_WIDTH (c);
 
@@ -358,7 +358,7 @@ c_string_width (const unsigned char *str, EMACS_INT len, int precision,
         {
           val = DISP_CHAR_VECTOR (dp, c);
           if (VECTORP (val))
-            thiswidth = ASIZE (val);
+            thiswidth = sanitize_char_width (ASIZE (val));
           else
             thiswidth = CHAR_WIDTH (c);
         }
@@ -423,7 +423,7 @@ lisp_string_width (Lisp_Object string, EMACS_INT precision,
     {
       EMACS_INT chars, bytes, thiswidth;
       Lisp_Object val;
-      int cmp_id;
+      ptrdiff_t cmp_id;
       EMACS_INT ignore, end;
 
       if (find_composition (i, -1, &ignore, &end, &val, string)
@@ -451,7 +451,7 @@ lisp_string_width (Lisp_Object string, EMACS_INT precision,
             {
               val = DISP_CHAR_VECTOR (dp, c);
               if (VECTORP (val))
-                thiswidth = ASIZE (val);
+                thiswidth = sanitize_char_width (ASIZE (val));
               else
                 thiswidth = CHAR_WIDTH (c);
             }
@@ -902,7 +902,7 @@ usage: (string &rest CHARACTERS)  */)
   Lisp_Object str;
   USE_SAFE_ALLOCA;
 
-  SAFE_ALLOCA (buf, unsigned char *, MAX_MULTIBYTE_LENGTH * n);
+  SAFE_NALLOCA (buf, MAX_MULTIBYTE_LENGTH, n);
   p = buf;
 
   for (i = 0; i < n; i++)
diff --git a/src/character.h b/src/character.h
index 063b5147dc9..09bcf17ab96 100644
--- a/src/character.h
+++ b/src/character.h
@@ -556,6 +556,16 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
   } while (0)
 
 
+/* Return a non-outlandish value for the tab width.  */
+
+#define SANE_TAB_WIDTH(buf) \
+  sanitize_tab_width (XFASTINT (BVAR (buf, tab_width)))
+static inline int
+sanitize_tab_width (EMACS_INT width)
+{
+  return 0 < width && width <= 1000 ? width : 8;
+}
+
 /* Return the width of ASCII character C.  The width is measured by
    how many columns C will occupy on the screen when displayed in the
    current buffer.  */
@@ -563,12 +573,20 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #define ASCII_CHAR_WIDTH(c)                                             \
   (c < 0x20                                                             \
    ? (c == '\t'                                                         \
-      ? XFASTINT (BVAR (current_buffer, tab_width))                             \
+      ? SANE_TAB_WIDTH (current_buffer)                                 \
       : (c == '\n' ? 0 : (NILP (BVAR (current_buffer, ctl_arrow)) ? 4 : 2)))    \
    : (c < 0x7f                                                          \
       ? 1                                                               \
       : ((NILP (BVAR (current_buffer, ctl_arrow)) ? 4 : 2))))
 
+/* Return a non-outlandish value for a character width.  */
+
+static inline int
+sanitize_char_width (EMACS_INT width)
+{
+  return 0 <= width && width <= 1000 ? width : 1000;
+}
+
 /* Return the width of character C.  The width is measured by how many
    columns C will occupy on the screen when displayed in the current
    buffer.  */
@@ -576,7 +594,7 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #define CHAR_WIDTH(c)           \
   (ASCII_CHAR_P (c)             \
    ? ASCII_CHAR_WIDTH (c)       \
-   : XINT (CHAR_TABLE_REF (Vchar_width_table, c)))
+   : sanitize_char_width (XINT (CHAR_TABLE_REF (Vchar_width_table, c))))
 
 /* If C is a variation selector, return the index numnber of the
    variation selector (1..256).  Otherwise, return 0.  */
diff --git a/src/charset.c b/src/charset.c
index 55234aa76aa..6967b9df611 100644
--- a/src/charset.c
+++ b/src/charset.c
@@ -61,7 +61,7 @@ Lisp_Object Vcharset_hash_table;
 /* Table of struct charset.  */
 struct charset *charset_table;
 
-static int charset_table_size;
+static ptrdiff_t charset_table_size;
 static int charset_table_used;
 
 Lisp_Object Qcharsetp;
@@ -419,7 +419,7 @@ load_charset_map (struct charset *charset, struct charset_map_entries *entries,
    paying attention to comment character '#'.  */
 
 static inline unsigned
-read_hex (FILE *fp, int *eof)
+read_hex (FILE *fp, int *eof, int *overflow)
 {
   int c;
   unsigned n;
@@ -441,15 +441,16 @@ read_hex (FILE *fp, int *eof)
       *eof = 1;
       return 0;
     }
-  *eof = 0;
   n = 0;
-  if (c == 'x')
-    while ((c = getc (fp)) != EOF && isxdigit (c))
+  while (isxdigit (c = getc (fp)))
+    {
+      if (UINT_MAX >> 4 < n)
+        *overflow = 1;
       n = ((n << 4)
-           | (c <= '9' ? c - '0' : c <= 'F' ? c - 'A' + 10 : c - 'a' + 10));
-  else
-    while ((c = getc (fp)) != EOF && isdigit (c))
-      n = (n * 10) + c - '0';
+           | (c - ('0' <= c && c <= '9' ? '0'
+                   : 'A' <= c && c <= 'F' ? 'A' - 10
+                   : 'a' - 10)));
+    }
   if (c != EOF)
     ungetc (c, fp);
   return n;
@@ -479,7 +480,6 @@ load_charset_map_from_file (struct charset *charset, Lisp_Object mapfile, int co
   unsigned max_code = CHARSET_MAX_CODE (charset);
   int fd;
   FILE *fp;
-  int eof;
   Lisp_Object suffixes;
   struct charset_map_entries *head, *entries;
   int n_entries, count;
@@ -504,22 +504,27 @@ load_charset_map_from_file (struct charset *charset, Lisp_Object mapfile, int co
   memset (entries, 0, sizeof (struct charset_map_entries));
 
   n_entries = 0;
-  eof = 0;
   while (1)
     {
-      unsigned from, to;
-      int c;
+      unsigned from, to, c;
       int idx;
+      int eof = 0, overflow = 0;
 
-      from = read_hex (fp, &eof);
+      from = read_hex (fp, &eof, &overflow);
       if (eof)
         break;
       if (getc (fp) == '-')
-        to = read_hex (fp, &eof);
+        to = read_hex (fp, &eof, &overflow);
       else
         to = from;
-      c = (int) read_hex (fp, &eof);
+      if (eof)
+        break;
+      c = read_hex (fp, &eof, &overflow);
+      if (eof)
+        break;
 
+      if (overflow)
+        continue;
       if (from < min_code || to > max_code || from > to || c > MAX_CHAR)
         continue;
 
@@ -1145,13 +1150,25 @@ usage: (define-charset-internal ...)  */)
                                      hash_code);
       if (charset_table_used == charset_table_size)
         {
-          struct charset *new_table
-            = (struct charset *) xmalloc (sizeof (struct charset)
-                                          * (charset_table_size + 16));
-          memcpy (new_table, charset_table,
-                  sizeof (struct charset) * charset_table_size);
-          charset_table_size += 16;
+          /* Ensure that charset IDs fit into 'int' as well as into the
+             restriction imposed by fixnums.  Although the 'int' restriction
+             could be removed, too much other code would need altering; for
+             example, the IDs are stuffed into struct
+             coding_system.charbuf[i] entries, which are 'int'.  */
+          int old_size = charset_table_size;
+          struct charset *new_table =
+            xpalloc (0, &charset_table_size, 1,
+                     min (INT_MAX, MOST_POSITIVE_FIXNUM),
+                     sizeof *charset_table);
+          memcpy (new_table, charset_table, old_size * sizeof *new_table);
           charset_table = new_table;
+          /* FIXME: Doesn't this leak memory?  The old charset_table becomes
+             unreachable.  It could be that this is intentional, because the
+             old charset table may be in a dumped emacs, and reallocating such
+             a table may not work.  If the memory leak is intentional, a
+             comment should be added to explain this.  If not, the old
+             charset_table should be freed, by passing it as the 1st argument
+             to xpalloc and removing the memcpy.  */
         }
       id = charset_table_used++;
       new_definition_p = 1;
@@ -2210,14 +2227,16 @@ struct charset_sort_data
 {
   Lisp_Object charset;
   int id;
-  int priority;
+  ptrdiff_t priority;
 };
 
 static int
 charset_compare (const void *d1, const void *d2)
 {
   const struct charset_sort_data *data1 = d1, *data2 = d2;
-  return (data1->priority - data2->priority);
+  if (data1->priority != data2->priority)
+    return data1->priority < data2->priority ? -1 : 1;
+  return 0;
 }
 
 DEFUN ("sort-charsets", Fsort_charsets, Ssort_charsets, 1, 1, 0,
@@ -2227,7 +2246,8 @@ See also `charset-priority-list' and `set-charset-priority'.  */)
      (Lisp_Object charsets)
 {
   Lisp_Object len = Flength (charsets);
-  int n = XFASTINT (len), i, j, done;
+  ptrdiff_t n = XFASTINT (len), i, j;
+  int done;
   Lisp_Object tail, elt, attrs;
   struct charset_sort_data *sort_data;
   int id, min_id = INT_MAX, max_id = INT_MIN;
@@ -2235,7 +2255,7 @@ See also `charset-priority-list' and `set-charset-priority'.  */)
 
   if (n == 0)
     return Qnil;
-  SAFE_ALLOCA (sort_data, struct charset_sort_data *, sizeof (*sort_data) * n);
+  SAFE_NALLOCA (sort_data, 1, n);
   for (tail = charsets, i = 0; CONSP (tail); tail = XCDR (tail), i++)
     {
       elt = XCAR (tail);
@@ -2310,6 +2330,17 @@ init_charset_once (void)
 void
 syms_of_charset (void)
 {
+  /* Allocate an initial charset table that is just under 64 KiB in size.
+     This should be large enough so that the charset table need not be
+     reallocated during an initial bootstrap.  Allocating anything larger than
+     64 KiB in an initial run may not work, because glibc malloc might use
+     mmap for larger allocations, and these don't work well across dumped
+     systems.  */
+  enum {
+    initial_malloc_max = (1 << 16) - 1,
+    charset_table_size_init = initial_malloc_max / sizeof (struct charset)
+  };
+
   DEFSYM (Qcharsetp, "charsetp");
 
   DEFSYM (Qascii, "ascii");
@@ -2342,9 +2373,9 @@ syms_of_charset (void)
     Vcharset_hash_table = Fmake_hash_table (2, args);
   }
 
-  charset_table_size = 128;
-  charset_table = ((struct charset *)
-                   xmalloc (sizeof (struct charset) * charset_table_size));
+  charset_table = (struct charset *) xmalloc (sizeof (struct charset)
+                                              * charset_table_size_init);
+  charset_table_size = charset_table_size_init;
   charset_table_used = 0;
 
   defsubr (&Scharsetp);
diff --git a/src/charset.h b/src/charset.h
index c2a52a38e7e..be02bc0feae 100644
--- a/src/charset.h
+++ b/src/charset.h
@@ -148,7 +148,7 @@ struct charset
   int id;
 
   /* Index to Vcharset_hash_table.  */
-  EMACS_INT hash_index;
+  ptrdiff_t hash_index;
 
   /* Dimension of the charset: 1, 2, 3, or 4.  */
   int dimension;
@@ -341,7 +341,7 @@ extern int emacs_mule_charset[256];
    number of the charset.  Otherwise, signal an error. */
 #define CHECK_CHARSET_GET_ID(x, id)                                     \
   do {                                                                  \
-    int idx;                                                            \
+    ptrdiff_t idx;                                                      \
                                                                         \
     if (! SYMBOLP (x) || (idx = CHARSET_SYMBOL_HASH_INDEX (x)) < 0)     \
       wrong_type_argument (Qcharsetp, (x));                             \
diff --git a/src/cmds.c b/src/cmds.c
index c079ad7168f..5a155ac77a5 100644
--- a/src/cmds.c
+++ b/src/cmds.c
@@ -472,7 +472,7 @@ internal_self_insert (int c, EMACS_INT n)
     {
       USE_SAFE_ALLOCA;
       char *strn, *p;
-      SAFE_ALLOCA (strn, char *, n * len);
+      SAFE_NALLOCA (strn, len, n);
       for (p = strn; n > 0; n--, p += len)
         memcpy (p, str, len);
       insert_and_inherit (strn, p - strn);
diff --git a/src/coding.c b/src/coding.c
index 65c8a767c2b..5fd59d394d9 100644
--- a/src/coding.c
+++ b/src/coding.c
@@ -5838,7 +5838,7 @@ coding_charset_list (struct coding_system *coding)
 Lisp_Object
 coding_system_charset_list (Lisp_Object coding_system)
 {
-  int id;
+  ptrdiff_t id;
   Lisp_Object attrs, charset_list;
 
   CHECK_CODING_SYSTEM_GET_ID (coding_system, id);
@@ -6683,8 +6683,12 @@ produce_chars (struct coding_system *coding, Lisp_Object translation_table,
                     break;
                 }
 
-              if (dst + MAX_MULTIBYTE_LENGTH * to_nchars > dst_end)
+              if ((dst_end - dst) / MAX_MULTIBYTE_LENGTH < to_nchars)
                 {
+                  if (((min (PTRDIFF_MAX, SIZE_MAX) - (buf_end - buf))
+                       / MAX_MULTIBYTE_LENGTH)
+                      < to_nchars)
+                    memory_full (SIZE_MAX);
                   dst = alloc_destination (coding,
                                            buf_end - buf
                                            + MAX_MULTIBYTE_LENGTH * to_nchars,
@@ -7888,11 +7892,10 @@ encode_coding_object (struct coding_system *coding,
     }
   else if (EQ (dst_object, Qt))
     {
+      ptrdiff_t dst_bytes = max (1, coding->src_chars);
       coding->dst_object = Qnil;
-      coding->dst_bytes = coding->src_chars;
-      if (coding->dst_bytes == 0)
-        coding->dst_bytes = 1;
-      coding->destination = (unsigned char *) xmalloc (coding->dst_bytes);
+      coding->destination = (unsigned char *) xmalloc (dst_bytes);
+      coding->dst_bytes = dst_bytes;
       coding->dst_multibyte = 0;
     }
   else
@@ -8076,7 +8079,7 @@ detect_coding_system (const unsigned char *src,
   Lisp_Object attrs, eol_type;
   Lisp_Object val = Qnil;
   struct coding_system coding;
-  int id;
+  ptrdiff_t id;
   struct coding_detection_info detect_info;
   enum coding_category base_category;
   int null_byte_found = 0, eight_bit_found = 0;
diff --git a/src/coding.h b/src/coding.h
index 85e153dcc3a..fdf9b762e75 100644
--- a/src/coding.h
+++ b/src/coding.h
@@ -415,7 +415,7 @@ struct coding_system
      setup_coding_system.  At the early stage of building time, this
      value is -1 in the array coding_categories to indicate that no
      coding-system of that category is yet defined.  */
-  int id;
+  ptrdiff_t id;
 
   /* Flag bits of the coding system.  The meaning of each bit is common
      to all types of coding systems.  */
diff --git a/src/composite.c b/src/composite.c
index 3308a028042..2a3fbe29552 100644
--- a/src/composite.c
+++ b/src/composite.c
@@ -142,10 +142,10 @@ Lisp_Object Qcomposition;
 struct composition **composition_table;
 
 /* The current size of `composition_table'.  */
-static int composition_table_size;
+static ptrdiff_t composition_table_size;
 
 /* Number of compositions currently made. */
-int n_compositions;
+ptrdiff_t n_compositions;
 
 /* Hash table for compositions.  The key is COMPONENTS-VEC of
    `composition' property.  The value is the corresponding
@@ -172,19 +172,30 @@ Lisp_Object composition_temp;
 
    If the composition is invalid, return -1.  */
 
-int
+ptrdiff_t
 get_composition_id (EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT nchars,
                     Lisp_Object prop, Lisp_Object string)
 {
   Lisp_Object id, length, components, key, *key_contents;
-  int glyph_len;
+  ptrdiff_t glyph_len;
   struct Lisp_Hash_Table *hash_table = XHASH_TABLE (composition_hash_table);
-  EMACS_INT hash_index;
+  ptrdiff_t hash_index;
   EMACS_UINT hash_code;
+  enum composition_method method;
   struct composition *cmp;
   EMACS_INT i;
   int ch;
 
+  /* Maximum length of a string of glyphs.  XftGlyphExtents limits
+     this to INT_MAX, and Emacs limits it further.  Divide INT_MAX - 1
+     by 2 because x_produce_glyphs computes glyph_len * 2 + 1.  Divide
+     the size by MAX_MULTIBYTE_LENGTH because encode_terminal_code
+     multiplies glyph_len by MAX_MULTIBYTE_LENGTH.  */
+  enum {
+    GLYPH_LEN_MAX = min ((INT_MAX - 1) / 2,
+                         min (PTRDIFF_MAX, SIZE_MAX) / MAX_MULTIBYTE_LENGTH)
+  };
+
   /* PROP should be
         Form-A: ((LENGTH . COMPONENTS) . MODIFICATION-FUNC)
      or
@@ -258,21 +269,9 @@ get_composition_id (EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT nchars,
   /* This composition is a new one.  We must register it.  */
 
   /* Check if we have sufficient memory to store this information.  */
-  if (composition_table_size == 0)
-    {
-      composition_table_size = 256;
-      composition_table
-        = (struct composition **) xmalloc (sizeof (composition_table[0])
-                                           * composition_table_size);
-    }
-  else if (composition_table_size <= n_compositions)
-    {
-      composition_table_size += 256;
-      composition_table
-        = (struct composition **) xrealloc (composition_table,
-                                            sizeof (composition_table[0])
-                                            * composition_table_size);
-    }
+  if (composition_table_size <= n_compositions)
+    composition_table = xpalloc (composition_table, &composition_table_size,
+                                 1, -1, sizeof *composition_table);
 
   key_contents = XVECTOR (key)->contents;
 
@@ -316,20 +315,26 @@ get_composition_id (EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT nchars,
   /* Register the composition in composition_hash_table.  */
   hash_index = hash_put (hash_table, key, id, hash_code);
 
+  method = (NILP (components)
+            ? COMPOSITION_RELATIVE
+            : ((INTEGERP (components) || STRINGP (components))
+               ? COMPOSITION_WITH_ALTCHARS
+               : COMPOSITION_WITH_RULE_ALTCHARS));
+
+  glyph_len = (method == COMPOSITION_WITH_RULE_ALTCHARS
+               ? (ASIZE (key) + 1) / 2
+               : ASIZE (key));
+
+  if (GLYPH_LEN_MAX < glyph_len)
+    memory_full (SIZE_MAX);
+
   /* Register the composition in composition_table.  */
   cmp = (struct composition *) xmalloc (sizeof (struct composition));
 
-  cmp->method = (NILP (components)
-                 ? COMPOSITION_RELATIVE
-                 : ((INTEGERP (components) || STRINGP (components))
-                    ? COMPOSITION_WITH_ALTCHARS
-                    : COMPOSITION_WITH_RULE_ALTCHARS));
+  cmp->method = method;
   cmp->hash_index = hash_index;
-  glyph_len = (cmp->method == COMPOSITION_WITH_RULE_ALTCHARS
-               ? (ASIZE (key) + 1) / 2
-               : ASIZE (key));
   cmp->glyph_len = glyph_len;
-  cmp->offsets = (short *) xmalloc (sizeof (short) * glyph_len * 2);
+  cmp->offsets = xnmalloc (glyph_len, 2 * sizeof *cmp->offsets);
   cmp->font = NULL;
 
   if (cmp->method != COMPOSITION_WITH_RULE_ALTCHARS)
@@ -656,7 +661,7 @@ static Lisp_Object
 gstring_lookup_cache (Lisp_Object header)
 {
   struct Lisp_Hash_Table *h = XHASH_TABLE (gstring_hash_table);
-  EMACS_INT i = hash_lookup (h, header, NULL);
+  ptrdiff_t i = hash_lookup (h, header, NULL);
 
   return (i >= 0 ? HASH_VALUE (h, i) : Qnil);
 }
@@ -691,7 +696,7 @@ composition_gstring_put_cache (Lisp_Object gstring, EMACS_INT len)
 }
 
 Lisp_Object
-composition_gstring_from_id (int id)
+composition_gstring_from_id (ptrdiff_t id)
 {
   struct Lisp_Hash_Table *h = XHASH_TABLE (gstring_hash_table);
 
diff --git a/src/composite.h b/src/composite.h
index 8cedfdbe352..c57e2a0e9b3 100644
--- a/src/composite.h
+++ b/src/composite.h
@@ -170,7 +170,7 @@ extern Lisp_Object composition_temp;
 
 struct composition {
   /* Number of glyphs of the composition components.  */
-  unsigned glyph_len;
+  int glyph_len;
 
   /* Width, ascent, and descent pixels of the composition.  */
   short pixel_width, ascent, descent;
@@ -193,7 +193,7 @@ struct composition {
   void *font;
 
   /* Pointer to an array of x-offset and y-offset (by pixels) of
-     glyphs.  This points to a sufficient memory space (sizeof (int) *
+     glyphs.  This points to a sufficient memory space (sizeof (short) *
      glyph_len * 2) that is allocated when the composition is
      registered in composition_table.  X-offset and Y-offset of Nth
      glyph are (2N)th and (2N+1)th elements respectively.  */
@@ -204,7 +204,7 @@ struct composition {
    COMPOSITION-ID.  */
 extern struct composition **composition_table;
 /* Number of the currently registered compositions.  */
-extern int n_compositions;
+extern ptrdiff_t n_compositions;
 
 /* Mask bits for CHECK_MASK arg to update_compositions.
    For a change in the region FROM and TO, check compositions ... */
@@ -216,8 +216,8 @@ extern int n_compositions;
 
 extern Lisp_Object Qcomposition;
 extern Lisp_Object composition_hash_table;
-extern int get_composition_id (EMACS_INT, EMACS_INT, EMACS_INT,
-                               Lisp_Object, Lisp_Object);
+extern ptrdiff_t get_composition_id (EMACS_INT, EMACS_INT, EMACS_INT,
+                                     Lisp_Object, Lisp_Object);
 extern int find_composition (EMACS_INT, EMACS_INT, EMACS_INT *, EMACS_INT *,
                              Lisp_Object *, Lisp_Object);
 extern void update_compositions (EMACS_INT, EMACS_INT, int);
@@ -299,7 +299,7 @@ struct face;
 struct font_metrics;
 
 extern Lisp_Object composition_gstring_put_cache (Lisp_Object, EMACS_INT);
-extern Lisp_Object composition_gstring_from_id (int);
+extern Lisp_Object composition_gstring_from_id (ptrdiff_t);
 extern int composition_gstring_p (Lisp_Object);
 extern int composition_gstring_width (Lisp_Object, EMACS_INT, EMACS_INT,
                                       struct font_metrics *);
diff --git a/src/dispextern.h b/src/dispextern.h
index 4d890fe6a37..641391b8c9c 100644
--- a/src/dispextern.h
+++ b/src/dispextern.h
@@ -582,7 +582,7 @@ struct glyph_pool
   struct glyph *glyphs;
 
   /* Allocated size of `glyphs'.  */
-  int nglyphs;
+  ptrdiff_t nglyphs;
 
   /* Number of rows and columns in a matrix.  */
   int nrows, ncolumns;
@@ -632,7 +632,7 @@ struct glyph_matrix
   struct glyph_row *rows;
 
   /* Number of elements allocated for the vector rows above.  */
-  int rows_allocated;
+  ptrdiff_t rows_allocated;
 
   /* The number of rows used by the window if all lines were displayed
      with the smallest possible character height.  */
@@ -1247,7 +1247,7 @@ struct glyph_string
   struct composition *cmp;
 
   /* If not negative, this string describes a compos.  */
-  int cmp_id;
+  ptrdiff_t cmp_id;
 
   /* Start and end glyph indices in a glyph-string.  */
   int cmp_from, cmp_to;
@@ -1718,7 +1718,8 @@ struct face_cache
   struct face **faces_by_id;
 
   /* The allocated size, and number of used slots of faces_by_id.  */
-  int size, used;
+  ptrdiff_t size;
+  int used;
 
   /* Flag indicating that attributes of the `menu' face have been
      changed.  */
@@ -1870,8 +1871,9 @@ struct bidi_it {
   bidi_dir_t sor;               /* direction of start-of-run in effect */
   int scan_dir;                 /* direction of text scan, 1: forw, -1: back */
   EMACS_INT disp_pos;           /* position of display string after ch */
-  int disp_prop_p;              /* if non-zero, there really is a
-                                   `display' property/string at disp_pos */
+  int disp_prop;                /* if non-zero, there really is a
+                                   `display' property/string at disp_pos;
+                                   if 2, the property is a `space' spec */
   int stack_idx;                /* index of current data on the stack */
   /* Note: Everything from here on is not copied/saved when the bidi
      iterator state is saved, pushed, or popped.  So only put here
@@ -2075,7 +2077,7 @@ struct composition_it
   EMACS_INT stop_pos;
   /* ID number of the composition or glyph-string.  If negative, we
      are not iterating over a composition now.  */
-  int id;
+  ptrdiff_t id;
   /* If non-negative, character that triggers the automatic
      composition at `stop_pos', and this is an automatic composition.
      If negative, this is a static composition.  This is set to -2
@@ -2265,7 +2267,7 @@ struct it
       struct {
         Lisp_Object object;
         struct it_slice slice;
-        int image_id;
+        ptrdiff_t image_id;
       } image;
       /* method == GET_FROM_COMPOSITION */
       struct {
@@ -2402,7 +2404,7 @@ struct it
   enum glyphless_display_method glyphless_method;
 
   /* If what == IT_IMAGE, the id of the image to display.  */
-  int image_id;
+  ptrdiff_t image_id;
 
 #ifdef HAVE_XWIDGETS  
   /* If what == IT_XWIDGET*/
@@ -2856,7 +2858,7 @@ struct image
   EMACS_UINT hash;
 
   /* Image id of this image.  */
-  int id;
+  ptrdiff_t id;
 
   /* Hash collision chain.  */
   struct image *next, *prev;
@@ -2875,13 +2877,13 @@ struct image_cache
   struct image **images;
 
   /* Allocated size of `images'.  */
-  unsigned size;
+  ptrdiff_t size;
 
   /* Number of images in the cache.  */
-  unsigned used;
+  ptrdiff_t used;
 
   /* Reference count (number of frames sharing this cache).  */
-  int refcount;
+  ptrdiff_t refcount;
 };
 
 
@@ -3148,7 +3150,7 @@ void w32_reset_fringes (void);
 extern int x_bitmap_height (struct frame *, ptrdiff_t);
 extern int x_bitmap_width (struct frame *, ptrdiff_t);
 extern int x_bitmap_pixmap (struct frame *, ptrdiff_t);
-extern void x_reference_bitmap (struct frame *, int);
+extern void x_reference_bitmap (struct frame *, ptrdiff_t);
 extern ptrdiff_t x_create_bitmap_from_data (struct frame *, char *,
                                             unsigned int, unsigned int);
 extern ptrdiff_t x_create_bitmap_from_file (struct frame *, Lisp_Object);
@@ -3169,7 +3171,7 @@ void clear_image_caches (Lisp_Object);
 void mark_image_cache (struct image_cache *);
 int valid_image_p (Lisp_Object);
 void prepare_image_for_display (struct frame *, struct image *);
-int lookup_image (struct frame *, Lisp_Object);
+ptrdiff_t lookup_image (struct frame *, Lisp_Object);
 
 unsigned long image_background (struct image *, struct frame *,
                                 XImagePtr_or_DC ximg);
diff --git a/src/dispnew.c b/src/dispnew.c
index a09421a9f15..751ff04f4d7 100644
--- a/src/dispnew.c
+++ b/src/dispnew.c
@@ -497,12 +497,12 @@ adjust_glyph_matrix (struct window *w, struct glyph_matrix *matrix, int x, int y
   /* Enlarge MATRIX->rows if necessary.  New rows are cleared.  */
   if (matrix->rows_allocated < dim.height)
     {
-      ptrdiff_t size = dim.height * sizeof (struct glyph_row);
+      int old_alloc = matrix->rows_allocated;
       new_rows = dim.height - matrix->rows_allocated;
-      matrix->rows = (struct glyph_row *) xrealloc (matrix->rows, size);
-      memset (matrix->rows + matrix->rows_allocated, 0,
-              new_rows * sizeof *matrix->rows);
-      matrix->rows_allocated = dim.height;
+      matrix->rows = xpalloc (matrix->rows, &matrix->rows_allocated,
+                              new_rows, INT_MAX, sizeof *matrix->rows);
+      memset (matrix->rows + old_alloc, 0,
+              (matrix->rows_allocated - old_alloc) * sizeof *matrix->rows);
     }
   else
     new_rows = 0;
@@ -574,9 +574,8 @@ adjust_glyph_matrix (struct window *w, struct glyph_matrix *matrix, int x, int y
           while (row < end)
             {
               row->glyphs[LEFT_MARGIN_AREA]
-                = (struct glyph *) xrealloc (row->glyphs[LEFT_MARGIN_AREA],
-                                             (dim.width
-                                              * sizeof (struct glyph)));
+                = xnrealloc (row->glyphs[LEFT_MARGIN_AREA],
+                             dim.width, sizeof (struct glyph));
 
               /* The mode line never has marginal areas.  */
               if (row == matrix->rows + dim.height - 1
@@ -1215,7 +1214,7 @@ line_draw_cost (struct glyph_matrix *matrix, int vpos)
   struct glyph *end = beg + row->used[TEXT_AREA];
   int len;
   Lisp_Object *glyph_table_base = GLYPH_TABLE_BASE;
-  int glyph_table_len = GLYPH_TABLE_LENGTH;
+  ptrdiff_t glyph_table_len = GLYPH_TABLE_LENGTH;
 
   /* Ignore trailing and leading spaces if we can.  */
   if (!FRAME_MUST_WRITE_SPACES (SELECTED_FRAME ())) /* XXX Is SELECTED_FRAME OK here? */
@@ -1389,7 +1388,7 @@ free_glyph_pool (struct glyph_pool *pool)
 static int
 realloc_glyph_pool (struct glyph_pool *pool, struct dim matrix_dim)
 {
-  int needed;
+  ptrdiff_t needed;
   int changed_p;
 
   changed_p = (pool->glyphs == 0
@@ -1397,24 +1396,17 @@ realloc_glyph_pool (struct glyph_pool *pool, struct dim matrix_dim)
                || matrix_dim.width != pool->ncolumns);
 
   /* Enlarge the glyph pool.  */
-  needed = matrix_dim.width * matrix_dim.height;
+  needed = matrix_dim.width;
+  if (INT_MULTIPLY_OVERFLOW (needed, matrix_dim.height))
+    memory_full (SIZE_MAX);
+  needed *= matrix_dim.height;
   if (needed > pool->nglyphs)
     {
-      ptrdiff_t size = needed * sizeof (struct glyph);
-
-      if (pool->glyphs)
-        {
-          pool->glyphs = (struct glyph *) xrealloc (pool->glyphs, size);
-          memset (pool->glyphs + pool->nglyphs, 0,
-                  size - pool->nglyphs * sizeof (struct glyph));
-        }
-      else
-        {
-          pool->glyphs = (struct glyph *) xmalloc (size);
-          memset (pool->glyphs, 0, size);
-        }
-
-      pool->nglyphs = needed;
+      ptrdiff_t old_nglyphs = pool->nglyphs;
+      pool->glyphs = xpalloc (pool->glyphs, &pool->nglyphs,
+                              needed - old_nglyphs, -1, sizeof *pool->glyphs);
+      memset (pool->glyphs + old_nglyphs, 0,
+              (pool->nglyphs - old_nglyphs) * sizeof *pool->glyphs);
     }
 
   /* Remember the number of rows and columns because (a) we use them
@@ -4167,7 +4159,7 @@ struct row_entry
   int new_line_number;
 
   /* Bucket index of this row_entry in the hash table row_table.  */
-  int bucket;
+  ptrdiff_t bucket;
 
   /* The row described by this entry.  */
   struct glyph_row *row;
@@ -4181,29 +4173,29 @@ struct row_entry
    that we need a larger one.  */
 
 static struct row_entry *row_entry_pool;
-static int row_entry_pool_size;
+static ptrdiff_t row_entry_pool_size;
 
 /* Index of next free entry in row_entry_pool.  */
 
-static int row_entry_idx;
+static ptrdiff_t row_entry_idx;
 
 /* The hash table used during scrolling, and the table's size.  This
    table is used to quickly identify equal rows in the desired and
    current matrix.  */
 
 static struct row_entry **row_table;
-static int row_table_size;
+static ptrdiff_t row_table_size;
 
 /* Vectors of pointers to row_entry structures belonging to the
    current and desired matrix, and the size of the vectors.  */
 
 static struct row_entry **old_lines, **new_lines;
-static int old_lines_size, new_lines_size;
+static ptrdiff_t old_lines_size, new_lines_size;
 
 /* A pool to allocate run structures from, and its size.  */
 
 static struct run *run_pool;
-static int runs_size;
+static ptrdiff_t runs_size;
 
 /* A vector of runs of lines found during scrolling.  */
 
@@ -4215,7 +4207,7 @@ static inline struct row_entry *
 add_row_entry (struct glyph_row *row)
 {
   struct row_entry *entry;
-  int i = row->hash % row_table_size;
+  ptrdiff_t i = row->hash % row_table_size;
 
   entry = row_table[i];
   while (entry && !row_equal_p (entry->row, row, 1))
@@ -4268,9 +4260,10 @@ scrolling_window (struct window *w, int header_line_p)
   struct glyph_matrix *desired_matrix = w->desired_matrix;
   struct glyph_matrix *current_matrix = w->current_matrix;
   int yb = window_text_bottom_y (w);
-  int i, j, first_old, first_new, last_old, last_new;
-  int nruns, n, run_idx;
-  ptrdiff_t nbytes;
+  ptrdiff_t i;
+  int j, first_old, first_new, last_old, last_new;
+  int nruns, run_idx;
+  ptrdiff_t n;
   struct row_entry *entry;
   struct redisplay_interface *rif = FRAME_RIF (XFRAME (WINDOW_FRAME (w)));
 
@@ -4361,45 +4354,59 @@ scrolling_window (struct window *w, int header_line_p)
   if (last_new == first_new)
     return 0;
 
+  /* Check for integer overflow in size calculation.
+
+     If next_almost_prime checks (N) for divisibility by 2..10, then
+     it can return at most N + 10, e.g., next_almost_prime (1) == 11.
+     So, set next_almost_prime_increment_max to 10.
+
+     It's just a coincidence that next_almost_prime_increment_max ==
+     NEXT_ALMOST_PRIME_LIMIT - 1.  If NEXT_ALMOST_PRIME_LIMIT were
+     13, then next_almost_prime_increment_max would be 14, e.g.,
+     because next_almost_prime (113) would be 127.  */
+  {
+    verify (NEXT_ALMOST_PRIME_LIMIT == 11);
+    enum { next_almost_prime_increment_max = 10 };
+    ptrdiff_t row_table_max =
+      (min (PTRDIFF_MAX, SIZE_MAX) / (3 * sizeof *row_table)
+       - next_almost_prime_increment_max);
+    ptrdiff_t current_nrows_max = row_table_max - desired_matrix->nrows;
+    if (current_nrows_max < current_matrix->nrows)
+      memory_full (SIZE_MAX);
+  }
+
   /* Reallocate vectors, tables etc. if necessary.  */
 
   if (current_matrix->nrows > old_lines_size)
-    {
-      old_lines_size = current_matrix->nrows;
-      nbytes = old_lines_size * sizeof *old_lines;
-      old_lines = (struct row_entry **) xrealloc (old_lines, nbytes);
-    }
+    old_lines = xpalloc (old_lines, &old_lines_size,
+                         current_matrix->nrows - old_lines_size,
+                         INT_MAX, sizeof *old_lines);
 
   if (desired_matrix->nrows > new_lines_size)
-    {
-      new_lines_size = desired_matrix->nrows;
-      nbytes = new_lines_size * sizeof *new_lines;
-      new_lines = (struct row_entry **) xrealloc (new_lines, nbytes);
-    }
+    new_lines = xpalloc (new_lines, &new_lines_size,
+                         desired_matrix->nrows - new_lines_size,
+                         INT_MAX, sizeof *new_lines);
 
-  n = desired_matrix->nrows + current_matrix->nrows;
-  if (3 * n > row_table_size)
+  n = desired_matrix->nrows;
+  n += current_matrix->nrows;
+  if (row_table_size < 3 * n)
     {
-      row_table_size = next_almost_prime (3 * n);
-      nbytes = row_table_size * sizeof *row_table;
-      row_table = (struct row_entry **) xrealloc (row_table, nbytes);
-      memset (row_table, 0, nbytes);
+      ptrdiff_t size = next_almost_prime (3 * n);
+      row_table = xnrealloc (row_table, size, sizeof *row_table);
+      row_table_size = size;
+      memset (row_table, 0, size * sizeof *row_table);
     }
 
   if (n > row_entry_pool_size)
-    {
-      row_entry_pool_size = n;
-      nbytes = row_entry_pool_size * sizeof *row_entry_pool;
-      row_entry_pool = (struct row_entry *) xrealloc (row_entry_pool, nbytes);
-    }
+    row_entry_pool = xpalloc (row_entry_pool, &row_entry_pool_size,
+                              n - row_entry_pool_size,
+                              -1, sizeof *row_entry_pool);
 
   if (desired_matrix->nrows > runs_size)
     {
+      runs = xnrealloc (runs, desired_matrix->nrows, sizeof *runs);
+      run_pool = xnrealloc (run_pool, desired_matrix->nrows, sizeof *run_pool);
       runs_size = desired_matrix->nrows;
-      nbytes = runs_size * sizeof *runs;
-      runs = (struct run **) xrealloc (runs, nbytes);
-      nbytes = runs_size * sizeof *run_pool;
-      run_pool = (struct run *) xrealloc (run_pool, nbytes);
     }
 
   nruns = run_idx = 0;
diff --git a/src/doc.c b/src/doc.c
index 69646f5af51..83e943c42b8 100644
--- a/src/doc.c
+++ b/src/doc.c
@@ -39,7 +39,7 @@ Lisp_Object Qfunction_documentation;
 extern Lisp_Object Qclosure;
 /* Buffer used for reading from documentation file.  */
 static char *get_doc_string_buffer;
-static int get_doc_string_buffer_size;
+static ptrdiff_t get_doc_string_buffer_size;
 
 static unsigned char *read_bytecode_pointer;
 static Lisp_Object Fdocumentation_property (Lisp_Object, Lisp_Object,
@@ -166,20 +166,19 @@ get_doc_string (Lisp_Object filepos, int unibyte, int definition)
   p = get_doc_string_buffer;
   while (1)
     {
-      EMACS_INT space_left = (get_doc_string_buffer_size
+      ptrdiff_t space_left = (get_doc_string_buffer_size - 1
                               - (p - get_doc_string_buffer));
       int nread;
 
       /* Allocate or grow the buffer if we need to.  */
-      if (space_left == 0)
+      if (space_left <= 0)
         {
-          EMACS_INT in_buffer = p - get_doc_string_buffer;
-          get_doc_string_buffer_size += 16 * 1024;
-          get_doc_string_buffer
-            = (char *) xrealloc (get_doc_string_buffer,
-                                 get_doc_string_buffer_size + 1);
+          ptrdiff_t in_buffer = p - get_doc_string_buffer;
+          get_doc_string_buffer =
+            xpalloc (get_doc_string_buffer, &get_doc_string_buffer_size,
+                     16 * 1024, -1, 1);
           p = get_doc_string_buffer + in_buffer;
-          space_left = (get_doc_string_buffer_size
+          space_left = (get_doc_string_buffer_size - 1
                         - (p - get_doc_string_buffer));
         }
 
@@ -713,16 +712,16 @@ a new string, without any text properties, is returned.  */)
   int changed = 0;
   register unsigned char *strp;
   register char *bufp;
-  EMACS_INT idx;
-  EMACS_INT bsize;
+  ptrdiff_t idx;
+  ptrdiff_t bsize;
   Lisp_Object tem;
   Lisp_Object keymap;
   unsigned char *start;
-  EMACS_INT length, length_byte;
+  ptrdiff_t length, length_byte;
   Lisp_Object name;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
   int multibyte;
-  EMACS_INT nchars;
+  ptrdiff_t nchars;
 
   if (NILP (string))
     return Qnil;
@@ -774,7 +773,7 @@ a new string, without any text properties, is returned.  */)
         }
       else if (strp[0] == '\\' && strp[1] == '[')
         {
-          EMACS_INT start_idx;
+          ptrdiff_t start_idx;
           int follow_remap = 1;
 
           changed = 1;
@@ -813,7 +812,9 @@ a new string, without any text properties, is returned.  */)
 
           if (NILP (tem))       /* but not on any keys */
             {
-              EMACS_INT offset = bufp - buf;
+              ptrdiff_t offset = bufp - buf;
+              if (STRING_BYTES_BOUND - 4 < bsize)
+                string_overflow ();
               buf = (char *) xrealloc (buf, bsize += 4);
               bufp = buf + offset;
               memcpy (bufp, "M-x ", 4);
@@ -836,7 +837,7 @@ a new string, without any text properties, is returned.  */)
       else if (strp[0] == '\\' && (strp[1] == '{' || strp[1] == '<'))
         {
           struct buffer *oldbuf;
-          EMACS_INT start_idx;
+          ptrdiff_t start_idx;
           /* This is for computing the SHADOWS arg for describe_map_tree.  */
           Lisp_Object active_maps = Fcurrent_active_maps (Qnil, Qnil);
           Lisp_Object earlier_maps;
@@ -907,7 +908,9 @@ a new string, without any text properties, is returned.  */)
           length_byte = SBYTES (tem);
         subst:
           {
-            EMACS_INT offset = bufp - buf;
+            ptrdiff_t offset = bufp - buf;
+            if (STRING_BYTES_BOUND - length_byte < bsize)
+              string_overflow ();
             buf = (char *) xrealloc (buf, bsize += length_byte);
             bufp = buf + offset;
             memcpy (bufp, start, length_byte);
diff --git a/src/editfns.c b/src/editfns.c
index 297f7b6d7e4..6759016766f 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -2107,7 +2107,7 @@ static char set_time_zone_rule_tz2[] = "TZ=GMT+1";
 void
 set_time_zone_rule (const char *tzstring)
 {
-  int envptrs;
+  ptrdiff_t envptrs;
   char **from, **to, **newenv;
 
   /* Make the ENVIRON vector longer with room for TZSTRING.  */
@@ -3357,7 +3357,7 @@ usage: (save-restriction &rest BODY)  */)
 static char *message_text;
 
 /* Allocated length of that buffer.  */
-static int message_length;
+static ptrdiff_t message_length;
 
 DEFUN ("message", Fmessage, Smessage, 1, MANY, 0,
        doc: /* Display a message at the bottom of the screen.
@@ -3439,8 +3439,8 @@ usage: (message-box FORMAT-STRING &rest ARGS)  */)
         }
       if (SBYTES (val) > message_length)
         {
+          message_text = (char *) xrealloc (message_text, SBYTES (val));
           message_length = SBYTES (val);
-          message_text = (char *)xrealloc (message_text, message_length);
         }
       memcpy (message_text, SDATA (val), SBYTES (val));
       message2 (message_text, SBYTES (val),
@@ -3889,7 +3889,7 @@ usage: (format STRING &rest OBJECTS)  */)
                       : -1)),
 
                 /* Maximum number of bytes generated by any format, if
-                   precision is no more than DBL_USEFUL_PRECISION_MAX.
+                   precision is no more than USEFUL_PRECISION_MAX.
                    On all practical hosts, %f is the worst case.  */
                 SPRINTF_BUFSIZE =
                   sizeof "-." + (DBL_MAX_10_EXP + 1) + USEFUL_PRECISION_MAX,
@@ -4165,7 +4165,7 @@ usage: (format STRING &rest OBJECTS)  */)
          character.  CONVBYTES says how much room is needed.  Allocate
          enough room (and then some) and do it again.  */
       {
-        EMACS_INT used = p - buf;
+        ptrdiff_t used = p - buf;
 
         if (max_bufsize - used < convbytes)
           string_overflow ();
diff --git a/src/emacs.c b/src/emacs.c
index 868df894353..b89d3d82e82 100644
--- a/src/emacs.c
+++ b/src/emacs.c
@@ -1361,24 +1361,17 @@ Using an Emacs configured with --with-x-toolkit=lucid does not have this problem
     /* If we have the form --display=NAME,
        convert it into  -d name.
        This requires inserting a new element into argv.  */
-    if (displayname != 0 && skip_args - count_before == 1)
+    if (displayname && count_before < skip_args)
       {
-        char **new = (char **) xmalloc (sizeof (char *) * (argc + 2));
-        int j;
-
-        for (j = 0; j < count_before + 1; j++)
-          new[j] = argv[j];
-        new[count_before + 1] = (char *) "-d";
-        new[count_before + 2] = displayname;
-        for (j = count_before + 2; j <argc; j++)
-          new[j + 1] = argv[j];
-        argv = new;
-        argc++;
+        if (skip_args == count_before + 1)
+          {
+            memmove (argv + count_before + 3, argv + count_before + 2,
+                     (argc - (count_before + 2)) * sizeof *argv);
+            argv[count_before + 2] = displayname;
+            argc++;
+          }
+        argv[count_before + 1] = (char *) "-d";
       }
-    /* Change --display to -d, when its arg is separate.  */
-    else if (displayname != 0 && skip_args > count_before
-             && argv[count_before + 1][1] == '-')
-      argv[count_before + 1] = (char *) "-d";
 
     if (! no_site_lisp)
       {
@@ -1844,8 +1837,8 @@ sort_args (int argc, char **argv)
      0 for an option that takes no arguments,
      1 for an option that takes one argument, etc.
      -1 for an ordinary non-option argument.  */
-  int *options = (int *) xmalloc (sizeof (int) * argc);
-  int *priority = (int *) xmalloc (sizeof (int) * argc);
+  int *options = xnmalloc (argc, sizeof *options);
+  int *priority = xnmalloc (argc, sizeof *priority);
   int to = 1;
   int incoming_used = 1;
   int from;
diff --git a/src/eval.c b/src/eval.c
index 372e9954620..e722b53fb72 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -133,8 +133,9 @@ static Lisp_Object Ffetch_bytecode (Lisp_Object);
 void
 init_eval_once (void)
 {
-  specpdl_size = 50;
-  specpdl = (struct specbinding *) xmalloc (specpdl_size * sizeof (struct specbinding));
+  enum { size = 50 };
+  specpdl = (struct specbinding *) xmalloc (size * sizeof (struct specbinding));
+  specpdl_size = size;
   specpdl_ptr = specpdl;
   /* Don't forget to update docs (lispref node "Local Variables").  */
   max_specpdl_size = 1300; /* 1000 is not enough for CEDET's c-by.el.  */
@@ -192,7 +193,7 @@ call_debugger (Lisp_Object arg)
   if (lisp_eval_depth + 40 > max_lisp_eval_depth)
     max_lisp_eval_depth = lisp_eval_depth + 40;
 
-  if (SPECPDL_INDEX () + 100 > max_specpdl_size)
+  if (max_specpdl_size - 100 < SPECPDL_INDEX ())
     max_specpdl_size = SPECPDL_INDEX () + 100;
 
 #ifdef HAVE_WINDOW_SYSTEM
@@ -3254,17 +3255,21 @@ static void
 grow_specpdl (void)
 {
   register int count = SPECPDL_INDEX ();
-  if (specpdl_size >= max_specpdl_size)
+  int max_size =
+    min (max_specpdl_size,
+         min (max (PTRDIFF_MAX, SIZE_MAX) / sizeof (struct specbinding),
+              INT_MAX));
+  int size;
+  if (max_size <= specpdl_size)
     {
       if (max_specpdl_size < 400)
-        max_specpdl_size = 400;
-      if (specpdl_size >= max_specpdl_size)
+        max_size = max_specpdl_size = 400;
+      if (max_size <= specpdl_size)
         signal_error ("Variable binding depth exceeds max-specpdl-size", Qnil);
     }
-  specpdl_size *= 2;
-  if (specpdl_size > max_specpdl_size)
-    specpdl_size = max_specpdl_size;
-  specpdl = (struct specbinding *) xrealloc (specpdl, specpdl_size * sizeof (struct specbinding));
+  size = specpdl_size < max_size / 2 ? 2 * specpdl_size : max_size;
+  specpdl = xnrealloc (specpdl, size, sizeof *specpdl);
+  specpdl_size = size;
   specpdl_ptr = specpdl + count;
 }
 
diff --git a/src/fileio.c b/src/fileio.c
index 61713689351..60ee35bb399 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -2912,7 +2912,7 @@ symbolic notation, like the `chmod' command from GNU Coreutils.  */)
 
   encoded_absname = ENCODE_FILE (absname);
 
-  if (chmod (SSDATA (encoded_absname), XINT (mode)) < 0)
+  if (chmod (SSDATA (encoded_absname), XINT (mode) & 07777) < 0)
     report_file_error ("Doing chmod", Fcons (absname, Qnil));
 
   return Qnil;
@@ -5114,11 +5114,11 @@ auto_save_1 (void)
     {
       if (stat (SSDATA (BVAR (current_buffer, filename)), &st) >= 0)
         /* But make sure we can overwrite it later!  */
-        auto_save_mode_bits = st.st_mode | 0600;
+        auto_save_mode_bits = (st.st_mode | 0600) & 0777;
       else if ((modes = Ffile_modes (BVAR (current_buffer, filename)),
                 INTEGERP (modes)))
         /* Remote files don't cooperate with stat.  */
-        auto_save_mode_bits = XINT (modes) | 0600;
+        auto_save_mode_bits = (XINT (modes) | 0600) & 0777;
     }
 
   return
diff --git a/src/fns.c b/src/fns.c
index 9c9d19fe26a..a3af6b8c15a 100644
--- a/src/fns.c
+++ b/src/fns.c
@@ -602,7 +602,7 @@ concat (ptrdiff_t nargs, Lisp_Object *args,
 
   prev = Qnil;
   if (STRINGP (val))
-    SAFE_ALLOCA (textprops, struct textprop_rec *, sizeof (struct textprop_rec) * nargs);
+    SAFE_NALLOCA (textprops, 1, nargs);
 
   for (argnum = 0; argnum < nargs; argnum++)
     {
@@ -3395,11 +3395,13 @@ check_hash_table (Lisp_Object obj)
 
 
 /* Value is the next integer I >= N, N >= 0 which is "almost" a prime
-   number.  */
+   number.  A number is "almost" a prime number if it is not divisible
+   by any integer in the range 2 .. (NEXT_ALMOST_PRIME_LIMIT - 1).  */
 
 EMACS_INT
 next_almost_prime (EMACS_INT n)
 {
+  verify (NEXT_ALMOST_PRIME_LIMIT == 11);
   for (n |= 1; ; n += 2)
     if (n % 3 != 0 && n % 5 != 0 && n % 7 != 0)
       return n;
@@ -3787,11 +3789,11 @@ maybe_resize_hash_table (struct Lisp_Hash_Table *h)
    the hash code of KEY.  Value is the index of the entry in H
    matching KEY, or -1 if not found.  */
 
-EMACS_INT
+ptrdiff_t
 hash_lookup (struct Lisp_Hash_Table *h, Lisp_Object key, EMACS_UINT *hash)
 {
   EMACS_UINT hash_code;
-  EMACS_INT start_of_bucket;
+  ptrdiff_t start_of_bucket;
   Lisp_Object idx;
 
   hash_code = h->hashfn (h, key);
@@ -3821,11 +3823,11 @@ hash_lookup (struct Lisp_Hash_Table *h, Lisp_Object key, EMACS_UINT *hash)
    HASH is a previously computed hash code of KEY.
    Value is the index of the entry in H matching KEY.  */
 
-EMACS_INT
+ptrdiff_t
 hash_put (struct Lisp_Hash_Table *h, Lisp_Object key, Lisp_Object value,
           EMACS_UINT hash)
 {
-  EMACS_INT start_of_bucket, i;
+  ptrdiff_t start_of_bucket, i;
 
   xassert ((hash & ~INTMASK) == 0);
 
@@ -4482,7 +4484,7 @@ If KEY is not found, return DFLT which defaults to nil.  */)
   (Lisp_Object key, Lisp_Object table, Lisp_Object dflt)
 {
   struct Lisp_Hash_Table *h = check_hash_table (table);
-  EMACS_INT i = hash_lookup (h, key, NULL);
+  ptrdiff_t i = hash_lookup (h, key, NULL);
   return i >= 0 ? HASH_VALUE (h, i) : dflt;
 }
 
@@ -4494,7 +4496,7 @@ VALUE.  In any case, return VALUE.  */)
   (Lisp_Object key, Lisp_Object value, Lisp_Object table)
 {
   struct Lisp_Hash_Table *h = check_hash_table (table);
-  EMACS_INT i;
+  ptrdiff_t i;
   EMACS_UINT hash;
 
   i = hash_lookup (h, key, &hash);
diff --git a/src/frame.c b/src/frame.c
index 19ce78dfd9c..711109a70c6 100644
--- a/src/frame.c
+++ b/src/frame.c
@@ -160,7 +160,7 @@ set_menu_bar_lines (struct frame *f, Lisp_Object value, Lisp_Object oldval)
   if (FRAME_MINIBUF_ONLY_P (f))
     return;
 
-  if (INTEGERP (value))
+  if (TYPE_RANGED_INTEGERP (int, value))
     nlines = XINT (value);
   else
     nlines = 0;
@@ -2992,7 +2992,7 @@ x_set_frame_parameters (FRAME_PTR f, Lisp_Object alist)
         f->size_hint_flags &= ~ (XNegative | YNegative);
         if (EQ (left, Qminus))
           f->size_hint_flags |= XNegative;
-        else if (INTEGERP (left))
+        else if (TYPE_RANGED_INTEGERP (int, left))
           {
             leftpos = XINT (left);
             if (leftpos < 0)
@@ -3000,21 +3000,21 @@ x_set_frame_parameters (FRAME_PTR f, Lisp_Object alist)
           }
         else if (CONSP (left) && EQ (XCAR (left), Qminus)
                  && CONSP (XCDR (left))
-                 && INTEGERP (XCAR (XCDR (left))))
+                 && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (left)), INT_MAX))
           {
             leftpos = - XINT (XCAR (XCDR (left)));
             f->size_hint_flags |= XNegative;
           }
         else if (CONSP (left) && EQ (XCAR (left), Qplus)
                  && CONSP (XCDR (left))
-                 && INTEGERP (XCAR (XCDR (left))))
+                 && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (left))))
           {
             leftpos = XINT (XCAR (XCDR (left)));
           }
 
         if (EQ (top, Qminus))
           f->size_hint_flags |= YNegative;
-        else if (INTEGERP (top))
+        else if (TYPE_RANGED_INTEGERP (int, top))
           {
             toppos = XINT (top);
             if (toppos < 0)
@@ -3022,14 +3022,14 @@ x_set_frame_parameters (FRAME_PTR f, Lisp_Object alist)
           }
         else if (CONSP (top) && EQ (XCAR (top), Qminus)
                  && CONSP (XCDR (top))
-                 && INTEGERP (XCAR (XCDR (top))))
+                 && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (top)), INT_MAX))
           {
             toppos = - XINT (XCAR (XCDR (top)));
             f->size_hint_flags |= YNegative;
           }
         else if (CONSP (top) && EQ (XCAR (top), Qplus)
                  && CONSP (XCDR (top))
-                 && INTEGERP (XCAR (XCDR (top))))
+                 && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (top))))
           {
             toppos = XINT (XCAR (XCDR (top)));
           }
@@ -3481,7 +3481,7 @@ x_set_scroll_bar_width (struct frame *f, Lisp_Object arg, Lisp_Object oldval)
         x_set_window_size (f, 0, FRAME_COLS (f), FRAME_LINES (f));
       do_pending_window_change (0);
     }
-  else if (INTEGERP (arg) && XINT (arg) > 0
+  else if (RANGED_INTEGERP (1, arg, INT_MAX)
            && XFASTINT (arg) != FRAME_CONFIG_SCROLL_BAR_WIDTH (f))
     {
       if (XFASTINT (arg) <= 2 * VERTICAL_SCROLL_BAR_WIDTH_TRIM)
@@ -3520,7 +3520,7 @@ x_set_alpha (struct frame *f, Lisp_Object arg, Lisp_Object oldval)
 {
   double alpha = 1.0;
   double newval[2];
-  int i, ialpha;
+  int i;
   Lisp_Object item;
 
   for (i = 0; i < 2; i++)
@@ -3544,7 +3544,7 @@ x_set_alpha (struct frame *f, Lisp_Object arg, Lisp_Object oldval)
         }
       else if (INTEGERP (item))
         {
-          ialpha = XINT (item);
+          EMACS_INT ialpha = XINT (item);
           if (ialpha < 0 || 100 < ialpha)
             args_out_of_range (make_number (0), make_number (100));
           else
@@ -4031,11 +4031,15 @@ x_figure_window_size (struct frame *f, Lisp_Object parms, int toolbar_p)
       if (!EQ (tem0, Qunbound))
         {
           CHECK_NUMBER (tem0);
+          if (! (0 <= XINT (tem0) && XINT (tem0) <= INT_MAX))
+            xsignal1 (Qargs_out_of_range, tem0);
           FRAME_LINES (f) = XINT (tem0);
         }
       if (!EQ (tem1, Qunbound))
         {
           CHECK_NUMBER (tem1);
+          if (! (0 <= XINT (tem1) && XINT (tem1) <= INT_MAX))
+            xsignal1 (Qargs_out_of_range, tem1);
           SET_FRAME_COLS (f, XINT (tem1));
         }
       if (!NILP (tem2) && !EQ (tem2, Qunbound))
@@ -4066,12 +4070,10 @@ x_figure_window_size (struct frame *f, Lisp_Object parms, int toolbar_p)
                 ? tool_bar_button_relief
                 : DEFAULT_TOOL_BAR_BUTTON_RELIEF);
 
-      if (INTEGERP (Vtool_bar_button_margin)
-          && XINT (Vtool_bar_button_margin) > 0)
+      if (RANGED_INTEGERP (1, Vtool_bar_button_margin, INT_MAX))
         margin = XFASTINT (Vtool_bar_button_margin);
       else if (CONSP (Vtool_bar_button_margin)
-               && INTEGERP (XCDR (Vtool_bar_button_margin))
-               && XINT (XCDR (Vtool_bar_button_margin)) > 0)
+               && RANGED_INTEGERP (1, XCDR (Vtool_bar_button_margin), INT_MAX))
         margin = XFASTINT (XCDR (Vtool_bar_button_margin));
       else
         margin = 0;
@@ -4097,14 +4099,14 @@ x_figure_window_size (struct frame *f, Lisp_Object parms, int toolbar_p)
         }
       else if (CONSP (tem0) && EQ (XCAR (tem0), Qminus)
                && CONSP (XCDR (tem0))
-               && INTEGERP (XCAR (XCDR (tem0))))
+               && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (tem0)), INT_MAX))
         {
           f->top_pos = - XINT (XCAR (XCDR (tem0)));
           window_prompting |= YNegative;
         }
       else if (CONSP (tem0) && EQ (XCAR (tem0), Qplus)
                && CONSP (XCDR (tem0))
-               && INTEGERP (XCAR (XCDR (tem0))))
+               && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (tem0))))
         {
           f->top_pos = XINT (XCAR (XCDR (tem0)));
         }
@@ -4125,14 +4127,14 @@ x_figure_window_size (struct frame *f, Lisp_Object parms, int toolbar_p)
         }
       else if (CONSP (tem1) && EQ (XCAR (tem1), Qminus)
                && CONSP (XCDR (tem1))
-               && INTEGERP (XCAR (XCDR (tem1))))
+               && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (tem1)), INT_MAX))
         {
           f->left_pos = - XINT (XCAR (XCDR (tem1)));
           window_prompting |= XNegative;
         }
       else if (CONSP (tem1) && EQ (XCAR (tem1), Qplus)
                && CONSP (XCDR (tem1))
-               && INTEGERP (XCAR (XCDR (tem1))))
+               && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (tem1))))
         {
           f->left_pos = XINT (XCAR (XCDR (tem1)));
         }
diff --git a/src/frame.h b/src/frame.h
index 8dccfb8540a..3775403810f 100644
--- a/src/frame.h
+++ b/src/frame.h
@@ -258,11 +258,11 @@ struct frame
 
   /* Size of this frame, excluding fringes, scroll bars etc.,
      in units of canonical characters.  */
-  EMACS_INT text_lines, text_cols;
+  int text_lines, text_cols;
 
   /* Total size of this frame (i.e. its native window), in units of
      canonical characters.  */
-  EMACS_INT total_lines, total_cols;
+  int total_lines, total_cols;
 
   /* New text height and width for pending size change.
      0 if no change pending.  */
diff --git a/src/fringe.c b/src/fringe.c
index a4dc9433aff..5878c541247 100644
--- a/src/fringe.c
+++ b/src/fringe.c
@@ -1610,22 +1610,25 @@ If BITMAP already exists, the existing definition is replaced.  */)
 
           if (n == max_fringe_bitmaps)
             {
-              if ((max_fringe_bitmaps + 20) > MAX_FRINGE_BITMAPS)
+              int bitmaps = max_fringe_bitmaps + 20;
+              if (MAX_FRINGE_BITMAPS < bitmaps)
                 error ("No free fringe bitmap slots");
 
               i = max_fringe_bitmaps;
-              max_fringe_bitmaps += 20;
               fringe_bitmaps
                 = ((struct fringe_bitmap **)
-                   xrealloc (fringe_bitmaps, max_fringe_bitmaps * sizeof (struct fringe_bitmap *)));
+                   xrealloc (fringe_bitmaps, bitmaps * sizeof *fringe_bitmaps));
               fringe_faces
-                = (Lisp_Object *) xrealloc (fringe_faces, max_fringe_bitmaps * sizeof (Lisp_Object));
+                = (Lisp_Object *) xrealloc (fringe_faces,
+                                            bitmaps * sizeof *fringe_faces);
 
-              for (; i < max_fringe_bitmaps; i++)
+              for (i = max_fringe_bitmaps; i < bitmaps; i++)
                 {
                   fringe_bitmaps[i] = NULL;
                   fringe_faces[i] = Qnil;
                 }
+
+              max_fringe_bitmaps = bitmaps;
             }
         }
 
diff --git a/src/ftfont.c b/src/ftfont.c
index 5c98073057c..7858a31be21 100644
--- a/src/ftfont.c
+++ b/src/ftfont.c
@@ -686,7 +686,10 @@ ftfont_get_open_type_spec (Lisp_Object otf_spec)
       if (NILP (val))
         continue;
       len = Flength (val);
-      spec->features[i] = malloc (sizeof (int) * XINT (len));
+      spec->features[i] =
+        (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (int) < XINT (len)
+         ? 0
+         : malloc (sizeof (int) * XINT (len)));
       if (! spec->features[i])
         {
           if (i > 0 && spec->features[0])
@@ -1765,15 +1768,10 @@ static OTF_GlyphString otf_gstring;
 static void
 setup_otf_gstring (int size)
 {
-  if (otf_gstring.size == 0)
+  if (otf_gstring.size < size)
     {
-      otf_gstring.glyphs = (OTF_Glyph *) xmalloc (sizeof (OTF_Glyph) * size);
-      otf_gstring.size = size;
-    }
-  else if (otf_gstring.size < size)
-    {
-      otf_gstring.glyphs = xrealloc (otf_gstring.glyphs,
-                                     sizeof (OTF_Glyph) * size);
+      otf_gstring.glyphs = xnrealloc (otf_gstring.glyphs,
+                                      size, sizeof (OTF_Glyph));
       otf_gstring.size = size;
     }
   otf_gstring.used = size;
@@ -2449,17 +2447,19 @@ ftfont_shape_by_flt (Lisp_Object lgstring, struct font *font,
         }
     }
 
+  if (INT_MAX / 2 < len)
+    memory_full (SIZE_MAX);
+
   if (gstring.allocated == 0)
     {
-      gstring.allocated = len * 2;
       gstring.glyph_size = sizeof (MFLTGlyph);
-      gstring.glyphs = xmalloc (sizeof (MFLTGlyph) * gstring.allocated);
+      gstring.glyphs = xnmalloc (len * 2, sizeof (MFLTGlyph));
+      gstring.allocated = len * 2;
     }
   else if (gstring.allocated < len * 2)
     {
+      gstring.glyphs = xnrealloc (gstring.glyphs, len * 2, sizeof (MFLTGlyph));
       gstring.allocated = len * 2;
-      gstring.glyphs = xrealloc (gstring.glyphs,
-                                 sizeof (MFLTGlyph) * gstring.allocated);
     }
   memset (gstring.glyphs, 0, sizeof (MFLTGlyph) * len);
   for (i = 0; i < len; i++)
@@ -2508,9 +2508,11 @@ ftfont_shape_by_flt (Lisp_Object lgstring, struct font *font,
       int result = mflt_run (&gstring, 0, len, &flt_font_ft.flt_font, flt);
       if (result != -2)
         break;
-      gstring.allocated += gstring.allocated;
-      gstring.glyphs = xrealloc (gstring.glyphs,
-                                 sizeof (MFLTGlyph) * gstring.allocated);
+      if (INT_MAX / 2 < gstring.allocated)
+        memory_full (SIZE_MAX);
+      gstring.glyphs = xnrealloc (gstring.glyphs,
+                                  gstring.allocated, 2 * sizeof (MFLTGlyph));
+      gstring.allocated *= 2;
     }
   if (gstring.used > LGSTRING_GLYPH_LEN (lgstring))
     return Qnil;
diff --git a/src/gtkutil.c b/src/gtkutil.c
index dd4d99b9d33..c39119c8151 100644
--- a/src/gtkutil.c
+++ b/src/gtkutil.c
@@ -487,7 +487,8 @@ get_utf8_string (const char *str)
   if (!utf8_str)
     {
       /* Probably some control characters in str.  Escape them. */
-      size_t nr_bad = 0;
+      ptrdiff_t len;
+      ptrdiff_t nr_bad = 0;
       gsize bytes_read;
       gsize bytes_written;
       unsigned char *p = (unsigned char *)str;
@@ -511,7 +512,10 @@ get_utf8_string (const char *str)
         }
       if (cp) g_free (cp);
 
-      up = utf8_str = xmalloc (strlen (str) + nr_bad * 4 + 1);
+      len = strlen (str);
+      if ((min (PTRDIFF_MAX, SIZE_MAX) - len - 1) / 4 < nr_bad)
+        memory_full (SIZE_MAX);
+      up = utf8_str = xmalloc (len + nr_bad * 4 + 1);
       p = (unsigned char *)str;
 
       while (! (cp = g_locale_to_utf8 ((char *)p, -1, &bytes_read,
@@ -3296,8 +3300,8 @@ static int scroll_bar_width_for_theme;
 static struct
 {
   GtkWidget **widgets;
-  int max_size;
-  int used;
+  ptrdiff_t max_size;
+  ptrdiff_t used;
 } id_to_widget;
 
 /* Grow this much every time we need to allocate more  */
@@ -3306,17 +3310,20 @@ static struct
 
 /* Store the widget pointer W in id_to_widget and return the integer index.  */
 
-static int
+static ptrdiff_t
 xg_store_widget_in_map (GtkWidget *w)
 {
-  int i;
+  ptrdiff_t i;
 
   if (id_to_widget.max_size == id_to_widget.used)
     {
-      int new_size = id_to_widget.max_size + ID_TO_WIDGET_INCR;
+      ptrdiff_t new_size;
+      if (TYPE_MAXIMUM (Window) - ID_TO_WIDGET_INCR < id_to_widget.max_size)
+        memory_full (SIZE_MAX);
 
-      id_to_widget.widgets = xrealloc (id_to_widget.widgets,
-                                       sizeof (GtkWidget *)*new_size);
+      new_size = id_to_widget.max_size + ID_TO_WIDGET_INCR;
+      id_to_widget.widgets = xnrealloc (id_to_widget.widgets,
+                                        new_size, sizeof (GtkWidget *));
 
       for (i = id_to_widget.max_size; i < new_size; ++i)
         id_to_widget.widgets[i] = 0;
@@ -3345,7 +3352,7 @@ xg_store_widget_in_map (GtkWidget *w)
    Called when scroll bar is destroyed.  */
 
 static void
-xg_remove_widget_from_map (int idx)
+xg_remove_widget_from_map (ptrdiff_t idx)
 {
   if (idx < id_to_widget.max_size && id_to_widget.widgets[idx] != 0)
     {
@@ -3357,7 +3364,7 @@ xg_remove_widget_from_map (int idx)
 /* Get the widget pointer at IDX from id_to_widget. */
 
 static GtkWidget *
-xg_get_widget_from_map (int idx)
+xg_get_widget_from_map (ptrdiff_t idx)
 {
   if (idx < id_to_widget.max_size && id_to_widget.widgets[idx] != 0)
     return id_to_widget.widgets[idx];
@@ -3396,10 +3403,10 @@ xg_get_default_scrollbar_width (void)
 /* Return the scrollbar id for X Window WID on display DPY.
    Return -1 if WID not in id_to_widget.  */
 
-int
+ptrdiff_t
 xg_get_scroll_id_for_window (Display *dpy, Window wid)
 {
-  int idx;
+  ptrdiff_t idx;
   GtkWidget *w;
 
   w = xg_win_to_widget (dpy, wid);
@@ -3421,7 +3428,7 @@ xg_get_scroll_id_for_window (Display *dpy, Window wid)
 static void
 xg_gtk_scroll_destroy (GtkWidget *widget, gpointer data)
 {
-  int id = (intptr_t) data;
+  intptr_t id = (intptr_t) data;
   xg_remove_widget_from_map (id);
 }
 
@@ -3496,7 +3503,7 @@ xg_create_scroll_bar (FRAME_PTR f,
 /* Remove the scroll bar represented by SCROLLBAR_ID from the frame F.  */
 
 void
-xg_remove_scroll_bar (FRAME_PTR f, int scrollbar_id)
+xg_remove_scroll_bar (FRAME_PTR f, ptrdiff_t scrollbar_id)
 {
   GtkWidget *w = xg_get_widget_from_map (scrollbar_id);
   if (w)
@@ -3515,7 +3522,7 @@ xg_remove_scroll_bar (FRAME_PTR f, int scrollbar_id)
 
 void
 xg_update_scrollbar_pos (FRAME_PTR f,
-                         int scrollbar_id,
+                         ptrdiff_t scrollbar_id,
                          int top,
                          int left,
                          int width,
@@ -4429,7 +4436,7 @@ update_frame_tool_bar (FRAME_PTR f)
       int enabled_p = !NILP (PROP (TOOL_BAR_ITEM_ENABLED_P));
       int selected_p = !NILP (PROP (TOOL_BAR_ITEM_SELECTED_P));
       int idx;
-      int img_id;
+      ptrdiff_t img_id;
       int icon_size = 0;
       struct image *img = NULL;
       Lisp_Object image;
diff --git a/src/gtkutil.h b/src/gtkutil.h
index 769e56da917..2dfb3a5ed6c 100644
--- a/src/gtkutil.h
+++ b/src/gtkutil.h
@@ -114,17 +114,17 @@ extern int xg_event_is_for_menubar (FRAME_PTR f, XEvent *event);
 
 extern int xg_have_tear_offs (void);
 
-extern int xg_get_scroll_id_for_window (Display *dpy, Window wid);
+extern ptrdiff_t xg_get_scroll_id_for_window (Display *dpy, Window wid);
 
 extern void xg_create_scroll_bar (FRAME_PTR f,
                                   struct scroll_bar *bar,
                                   GCallback scroll_callback,
                                   GCallback end_callback,
                                   const char *scroll_bar_name);
-extern void xg_remove_scroll_bar (FRAME_PTR f, int scrollbar_id);
+extern void xg_remove_scroll_bar (FRAME_PTR f, ptrdiff_t scrollbar_id);
 
 extern void xg_update_scrollbar_pos (FRAME_PTR f,
-                                     int scrollbar_id,
+                                     ptrdiff_t scrollbar_id,
                                      int top,
                                      int left,
                                      int width,
@@ -185,4 +185,3 @@ extern int xg_ignore_gtk_scrollbar;
 
 #endif /* USE_GTK */
 #endif /* GTKUTIL_H */
-
diff --git a/src/image.c b/src/image.c
index 65be22b087a..d0d28bea582 100644
--- a/src/image.c
+++ b/src/image.c
@@ -196,7 +196,7 @@ x_bitmap_width (FRAME_PTR f, ptrdiff_t id)
 int
 x_bitmap_pixmap (FRAME_PTR f, ptrdiff_t id)
 {
-  return (int) FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].pixmap;
+  return FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].pixmap;
 }
 #endif
 
@@ -216,15 +216,6 @@ x_allocate_bitmap_record (FRAME_PTR f)
   Display_Info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
   ptrdiff_t i;
 
-  if (dpyinfo->bitmaps == NULL)
-    {
-      dpyinfo->bitmaps_size = 10;
-      dpyinfo->bitmaps
-        = (Bitmap_Record *) xmalloc (dpyinfo->bitmaps_size * sizeof (Bitmap_Record));
-      dpyinfo->bitmaps_last = 1;
-      return 1;
-    }
-
   if (dpyinfo->bitmaps_last < dpyinfo->bitmaps_size)
     return ++dpyinfo->bitmaps_last;
 
@@ -232,20 +223,16 @@ x_allocate_bitmap_record (FRAME_PTR f)
     if (dpyinfo->bitmaps[i].refcount == 0)
       return i + 1;
 
-  if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (Bitmap_Record) / 2
-      < dpyinfo->bitmaps_size)
-    memory_full (SIZE_MAX);
-  dpyinfo->bitmaps_size *= 2;
-  dpyinfo->bitmaps
-    = (Bitmap_Record *) xrealloc (dpyinfo->bitmaps,
-                                  dpyinfo->bitmaps_size * sizeof (Bitmap_Record));
+  dpyinfo->bitmaps =
+    xpalloc (dpyinfo->bitmaps, &dpyinfo->bitmaps_size,
+             10, -1, sizeof *dpyinfo->bitmaps);
   return ++dpyinfo->bitmaps_last;
 }
 
 /* Add one reference to the reference count of the bitmap with id ID.  */
 
 void
-x_reference_bitmap (FRAME_PTR f, int id)
+x_reference_bitmap (FRAME_PTR f, ptrdiff_t id)
 {
   ++FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].refcount;
 }
@@ -807,29 +794,30 @@ parse_image_spec (Lisp_Object spec, struct image_keyword *keywords,
           break;
 
         case IMAGE_POSITIVE_INTEGER_VALUE:
-          if (!INTEGERP (value) || XINT (value) <= 0)
+          if (! RANGED_INTEGERP (1, value, INT_MAX))
             return 0;
           break;
 
         case IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR:
-          if (INTEGERP (value) && XINT (value) >= 0)
+          if (RANGED_INTEGERP (1, value, INT_MAX))
             break;
           if (CONSP (value)
-              && INTEGERP (XCAR (value)) && INTEGERP (XCDR (value))
-              && XINT (XCAR (value)) >= 0 && XINT (XCDR (value)) >= 0)
+              && RANGED_INTEGERP (1, XCAR (value), INT_MAX)
+              && RANGED_INTEGERP (1, XCDR (value), INT_MAX))
             break;
           return 0;
 
         case IMAGE_ASCENT_VALUE:
           if (SYMBOLP (value) && EQ (value, Qcenter))
             break;
-          else if (INTEGERP (value)
-                   && XINT (value) >= 0
-                   && XINT (value) <= 100)
+          else if (RANGED_INTEGERP (0, value, 100))
             break;
           return 0;
 
         case IMAGE_NON_NEGATIVE_INTEGER_VALUE:
+          /* Unlike the other integer-related cases, this one does not
+             verify that VALUE fits in 'int'.  This is because callers
+             want EMACS_INT.  */
           if (!INTEGERP (value) || XINT (value) < 0)
             return 0;
           break;
@@ -849,7 +837,7 @@ parse_image_spec (Lisp_Object spec, struct image_keyword *keywords,
           break;
 
         case IMAGE_INTEGER_VALUE:
-          if (!INTEGERP (value))
+          if (! TYPE_RANGED_INTEGERP (int, value))
             return 0;
           break;
 
@@ -919,7 +907,7 @@ or omitted means use the selected frame.  */)
   if (valid_image_p (spec))
     {
       struct frame *f = check_x_frame (frame);
-      int id = lookup_image (f, spec);
+      ptrdiff_t id = lookup_image (f, spec);
       struct image *img = IMAGE_FROM_ID (f, id);
       int width = img->width + 2 * img->hmargin;
       int height = img->height + 2 * img->vmargin;
@@ -949,7 +937,7 @@ or omitted means use the selected frame.  */)
   if (valid_image_p (spec))
     {
       struct frame *f = check_x_frame (frame);
-      int id = lookup_image (f, spec);
+      ptrdiff_t id = lookup_image (f, spec);
       struct image *img = IMAGE_FROM_ID (f, id);
       if (img->mask)
         mask = Qt;
@@ -972,7 +960,7 @@ or omitted means use the selected frame.  */)
   if (valid_image_p (spec))
     {
       struct frame *f = check_x_frame (frame);
-      int id = lookup_image (f, spec);
+      ptrdiff_t id = lookup_image (f, spec);
       struct image *img = IMAGE_FROM_ID (f, id);
       ext = img->lisp_data;
     }
@@ -1125,7 +1113,7 @@ image_ascent (struct image *img, struct face *face, struct glyph_slice *slice)
         ascent = height / 2;
     }
   else
-    ascent = (int) (height * img->ascent / 100.0);
+    ascent = height * (img->ascent / 100.0);
 
   return ascent;
 }
@@ -1371,11 +1359,12 @@ x_alloc_image_color (struct frame *f, struct image *img, Lisp_Object color_name,
     {
       /* This isn't called frequently so we get away with simply
          reallocating the color vector to the needed size, here.  */
-      ++img->ncolors;
+      ptrdiff_t ncolors = img->ncolors + 1;
       img->colors =
         (unsigned long *) xrealloc (img->colors,
-                                    img->ncolors * sizeof *img->colors);
-      img->colors[img->ncolors - 1] = color.pixel;
+                                    ncolors * sizeof *img->colors);
+      img->colors[ncolors - 1] = color.pixel;
+      img->ncolors = ncolors;
       result = color.pixel;
     }
   else
@@ -1403,8 +1392,9 @@ make_image_cache (void)
   int size;
 
   memset (c, 0, sizeof *c);
-  c->size = 50;
-  c->images = (struct image **) xmalloc (c->size * sizeof *c->images);
+  size = 50;
+  c->images = (struct image **) xmalloc (size * sizeof *c->images);
+  c->size = size;
   size = IMAGE_CACHE_BUCKETS_SIZE * sizeof *c->buckets;
   c->buckets = (struct image **) xmalloc (size);
   memset (c->buckets, 0, size);
@@ -1470,7 +1460,7 @@ free_image_cache (struct frame *f)
   struct image_cache *c = FRAME_IMAGE_CACHE (f);
   if (c)
     {
-      int i;
+      ptrdiff_t i;
 
       /* Cache should not be referenced by any frame when freed.  */
       xassert (c->refcount == 0);
@@ -1500,7 +1490,7 @@ clear_image_cache (struct frame *f, Lisp_Object filter)
 
   if (c)
     {
-      int i, nfreed = 0;
+      ptrdiff_t i, nfreed = 0;
 
       /* Block input so that we won't be interrupted by a SIGIO
          while being in an inconsistent state.  */
@@ -1524,8 +1514,8 @@ clear_image_cache (struct frame *f, Lisp_Object filter)
         {
           /* Free cache based on timestamp.  */
           EMACS_TIME t;
-          time_t old;
-          int delay, nimages = 0;
+          double old, delay;
+          ptrdiff_t nimages = 0;
 
           for (i = 0; i < c->used; ++i)
             if (c->images[i])
@@ -1533,9 +1523,10 @@ clear_image_cache (struct frame *f, Lisp_Object filter)
 
           /* If the number of cached images has grown unusually large,
              decrease the cache eviction delay (Bug#6230).  */
-          delay = XFASTINT (Vimage_cache_eviction_delay);
+          delay = XINT (Vimage_cache_eviction_delay);
           if (nimages > 40)
-            delay = max (1, 1600 * delay / (nimages*nimages));
+            delay = 1600 * delay / nimages / nimages;
+          delay = max (delay, 1);
 
           EMACS_GET_TIME (t);
           old = EMACS_SECS (t) - delay;
@@ -1711,7 +1702,7 @@ postprocess_image (struct frame *f, struct image *img)
 /* Return the id of image with Lisp specification SPEC on frame F.
    SPEC must be a valid Lisp image specification (see valid_image_p).  */
 
-int
+ptrdiff_t
 lookup_image (struct frame *f, Lisp_Object spec)
 {
   struct image *img;
@@ -1770,15 +1761,12 @@ lookup_image (struct frame *f, Lisp_Object spec)
             img->ascent = CENTERED_IMAGE_ASCENT;
 
           margin = image_spec_value (spec, QCmargin, NULL);
-          if (INTEGERP (margin) && XINT (margin) >= 0)
+          if (INTEGERP (margin))
             img->vmargin = img->hmargin = XFASTINT (margin);
-          else if (CONSP (margin) && INTEGERP (XCAR (margin))
-                   && INTEGERP (XCDR (margin)))
+          else if (CONSP (margin))
             {
-              if (XINT (XCAR (margin)) > 0)
-                img->hmargin = XFASTINT (XCAR (margin));
-              if (XINT (XCDR (margin)) > 0)
-                img->vmargin = XFASTINT (XCDR (margin));
+              img->hmargin = XFASTINT (XCAR (margin));
+              img->vmargin = XFASTINT (XCDR (margin));
             }
 
           relief = image_spec_value (spec, QCrelief, NULL);
@@ -1825,7 +1813,7 @@ static void
 cache_image (struct frame *f, struct image *img)
 {
   struct image_cache *c = FRAME_IMAGE_CACHE (f);
-  int i;
+  ptrdiff_t i;
 
   /* Find a free slot in c->images.  */
   for (i = 0; i < c->used; ++i)
@@ -1834,13 +1822,7 @@ cache_image (struct frame *f, struct image *img)
 
   /* If no free slot found, maybe enlarge c->images.  */
   if (i == c->used && c->used == c->size)
-    {
-      if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *c->images / 2 < c->size)
-        memory_full (SIZE_MAX);
-      c->size *= 2;
-      c->images = (struct image **) xrealloc (c->images,
-                                              c->size * sizeof *c->images);
-    }
+    c->images = xpalloc (c->images, &c->size, 1, -1, sizeof *c->images);
 
   /* Add IMG to c->images, and assign IMG an id.  */
   c->images[i] = img;
@@ -1879,7 +1861,7 @@ mark_image_cache (struct image_cache *c)
 {
   if (c)
     {
-      int i;
+      ptrdiff_t i;
       for (i = 0; i < c->used; ++i)
         if (c->images[i])
           mark_image (c->images[i]);
@@ -2076,7 +2058,7 @@ x_create_x_image_and_pixmap (struct frame *f, int width, int height, int depth,
       DWORD err = GetLastError ();
       Lisp_Object errcode;
       /* All system errors are < 10000, so the following is safe.  */
-      XSETINT (errcode, (int) err);
+      XSETINT (errcode, err);
       image_error ("Unable to create bitmap, error code %d", errcode, Qnil);
       x_destroy_x_image (*ximg);
       return 0;
@@ -2355,7 +2337,7 @@ xbm_image_p (Lisp_Object object)
   else
     {
       Lisp_Object data;
-      EMACS_INT width, height;
+      int width, height;
 
       /* Entries for `:width', `:height' and `:data' must be present.  */
       if (!kw[XBM_WIDTH].count
@@ -3587,9 +3569,8 @@ xpm_load (struct frame *f, struct image *img)
 #endif /* HAVE_NTGUI */
 
       /* Remember allocated colors.  */
+      img->colors = xnmalloc (attrs.nalloc_pixels, sizeof *img->colors);
       img->ncolors = attrs.nalloc_pixels;
-      img->colors = (unsigned long *) xmalloc (img->ncolors
-                                               * sizeof *img->colors);
       for (i = 0; i < attrs.nalloc_pixels; ++i)
         {
           img->colors[i] = attrs.alloc_pixels[i];
@@ -3813,8 +3794,8 @@ xpm_get_color_table_h (Lisp_Object color_table,
                        int chars_len)
 {
   struct Lisp_Hash_Table *table = XHASH_TABLE (color_table);
-  int i = hash_lookup (table, make_unibyte_string (chars_start, chars_len),
-                       NULL);
+  ptrdiff_t i =
+    hash_lookup (table, make_unibyte_string (chars_start, chars_len), NULL);
 
   return i >= 0 ? HASH_VALUE (table, i) : Qnil;
 }
@@ -4163,6 +4144,12 @@ static struct ct_color **ct_table;
 /* Number of entries in the color table.  */
 
 static int ct_colors_allocated;
+enum
+{
+  ct_colors_allocated_max =
+    min (INT_MAX,
+         min (PTRDIFF_MAX, SIZE_MAX) / sizeof (unsigned long))
+};
 
 /* Initialize the color table.  */
 
@@ -4249,7 +4236,14 @@ lookup_rgb_color (struct frame *f, int r, int g, int b)
       XColor color;
       Colormap cmap;
       int rc;
+#else
+      COLORREF color;
+#endif
 
+      if (ct_colors_allocated_max <= ct_colors_allocated)
+        return FRAME_FOREGROUND_PIXEL (f);
+
+#ifdef HAVE_X_WINDOWS
       color.red = r;
       color.green = g;
       color.blue = b;
@@ -4271,7 +4265,6 @@ lookup_rgb_color (struct frame *f, int r, int g, int b)
         return FRAME_FOREGROUND_PIXEL (f);
 
 #else
-      COLORREF color;
 #ifdef HAVE_NTGUI
       color = PALETTERGB (r, g, b);
 #else
@@ -4312,6 +4305,9 @@ lookup_pixel_color (struct frame *f, unsigned long pixel)
       Colormap cmap;
       int rc;
 
+      if (ct_colors_allocated_max <= ct_colors_allocated)
+        return FRAME_FOREGROUND_PIXEL (f);
+
 #ifdef HAVE_X_WINDOWS
       cmap = FRAME_X_COLORMAP (f);
       color.pixel = pixel;
@@ -4450,7 +4446,9 @@ x_to_xcolors (struct frame *f, struct image *img, int rgb_p)
   HGDIOBJ prev;
 #endif /* HAVE_NTGUI */
 
-  colors = (XColor *) xmalloc (img->width * img->height * sizeof *colors);
+  if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *colors / img->width < img->height)
+    memory_full (SIZE_MAX);
+  colors = (XColor *) xmalloc (sizeof *colors * img->width * img->height);
 
 #ifndef HAVE_NTGUI
   /* Get the X image IMG->pixmap.  */
@@ -4602,7 +4600,9 @@ x_detect_edges (struct frame *f, struct image *img, int *matrix, int color_adjus
 
 #define COLOR(A, X, Y) ((A) + (Y) * img->width + (X))
 
-  new = (XColor *) xmalloc (img->width * img->height * sizeof *new);
+  if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *new / img->width < img->height)
+    memory_full (SIZE_MAX);
+  new = (XColor *) xmalloc (sizeof *new * img->width * img->height);
 
   for (y = 0; y < img->height; ++y)
     {
@@ -5880,7 +5880,7 @@ png_load (struct frame *f, struct image *img)
 
       for (x = 0; x < width; ++x)
         {
-          unsigned r, g, b;
+          int r, g, b;
 
           r = *p++ << 8;
           g = *p++ << 8;
@@ -6745,17 +6745,29 @@ tiff_size_of_memory (thandle_t data)
 }
 
 
+static void tiff_handler (const char *, const char *, const char *, va_list)
+  ATTRIBUTE_FORMAT_PRINTF (3, 0);
+static void
+tiff_handler (const char *log_format, const char *title,
+              const char *format, va_list ap)
+{
+  /* doprnt is not suitable here, as TIFF handlers are called from
+     libtiff and are passed arbitrary printf directives.  Instead, use
+     vsnprintf, taking care to be portable to nonstandard environments
+     where vsnprintf returns -1 on buffer overflow.  Since it's just a
+     log entry, it's OK to truncate it.  */
+  char buf[4000];
+  int len = vsnprintf (buf, sizeof buf, format, ap);
+  add_to_log (log_format, build_string (title),
+              make_string (buf, max (0, min (len, sizeof buf - 1))));
+}
+
 static void tiff_error_handler (const char *, const char *, va_list)
   ATTRIBUTE_FORMAT_PRINTF (2, 0);
 static void
 tiff_error_handler (const char *title, const char *format, va_list ap)
 {
-  char buf[512];
-  int len;
-
-  len = sprintf (buf, "TIFF error: %s ", title);
-  vsprintf (buf + len, format, ap);
-  add_to_log (buf, Qnil, Qnil);
+  tiff_handler ("TIFF error: %s %s", title, format, ap);
 }
 
 
@@ -6764,12 +6776,7 @@ static void tiff_warning_handler (const char *, const char *, va_list)
 static void
 tiff_warning_handler (const char *title, const char *format, va_list ap)
 {
-  char buf[512];
-  int len;
-
-  len = sprintf (buf, "TIFF warning: %s ", title);
-  vsprintf (buf + len, format, ap);
-  add_to_log (buf, Qnil, Qnil);
+  tiff_handler ("TIFF warning: %s %s", title, format, ap);
 }
 
 
@@ -6845,8 +6852,9 @@ tiff_load (struct frame *f, struct image *img)
   image = image_spec_value (img->spec, QCindex, NULL);
   if (INTEGERP (image))
     {
-      int ino = XFASTINT (image);
-      if (!fn_TIFFSetDirectory (tiff, ino))
+      EMACS_INT ino = XFASTINT (image);
+      if (! (TYPE_MINIMUM (tdir_t) <= ino && ino <= TYPE_MAXIMUM (tdir_t)
+             && fn_TIFFSetDirectory (tiff, ino)))
         {
           image_error ("Invalid image number `%s' in image `%s'",
                        image, img->spec);
@@ -7144,7 +7152,7 @@ gif_load (struct frame *f, struct image *img)
   Lisp_Object specified_file = image_spec_value (img->spec, QCfile, NULL);
   Lisp_Object specified_data = image_spec_value (img->spec, QCdata, NULL);
   unsigned long bgcolor = 0;
-  int idx;
+  EMACS_INT idx;
 
   if (NILP (specified_data))
     {
@@ -7379,7 +7387,7 @@ gif_load (struct frame *f, struct image *img)
   img->lisp_data = Qnil;
   if (gif->SavedImages[idx].ExtensionBlockCount > 0)
     {
-      unsigned int delay = 0;
+      int delay = 0;
       ExtensionBlock *ext = gif->SavedImages[idx].ExtensionBlocks;
       for (i = 0; i < gif->SavedImages[idx].ExtensionBlockCount; i++, ext++)
         /* Append (... FUNCTION "BYTES") */
@@ -7400,7 +7408,7 @@ gif_load (struct frame *f, struct image *img)
       if (delay)
         img->lisp_data
           = Fcons (Qdelay,
-                   Fcons (make_float (((double) delay) * 0.01),
+                   Fcons (make_float (delay / 100.0),
                           img->lisp_data));
     }
 
@@ -7576,10 +7584,10 @@ imagemagick_load_image (struct frame *f, struct image *img,
   Lisp_Object image;
   Lisp_Object value;
   Lisp_Object crop;
-  long ino;
+  EMACS_INT ino;
   int desired_width, desired_height;
   double rotation;
-  int imagemagick_rendermethod;
+  EMACS_INT imagemagick_rendermethod;
   int pixelwidth;
   ImageInfo  *image_info;
   ExceptionInfo *exception;
@@ -7606,7 +7614,7 @@ imagemagick_load_image (struct frame *f, struct image *img,
       status = MagickPingImageBlob (ping_wand, contents, size);
     }
 
-  if (ino >= MagickGetNumberImages (ping_wand))
+  if (! (0 <= ino && ino < MagickGetNumberImages (ping_wand)))
     {
       image_error ("Invalid image number `%s' in image `%s'",
                    image, img->spec);
@@ -7681,28 +7689,28 @@ imagemagick_load_image (struct frame *f, struct image *img,
      efficient.  */
   crop = image_spec_value (img->spec, QCcrop, NULL);
 
-  if (CONSP (crop) && INTEGERP (XCAR (crop)))
+  if (CONSP (crop) && TYPE_RANGED_INTEGERP (size_t, XCAR (crop)))
     {
       /* After some testing, it seems MagickCropImage is the fastest crop
          function in ImageMagick.  This crop function seems to do less copying
          than the alternatives, but it still reads the entire image into memory
-         before croping, which is aparently difficult to avoid when using
+         before cropping, which is apparently difficult to avoid when using
          imagemagick.  */
-      int w, h;
-      w = XFASTINT (XCAR (crop));
+      size_t crop_width = XINT (XCAR (crop));
       crop = XCDR (crop);
-      if (CONSP (crop) && INTEGERP (XCAR (crop)))
+      if (CONSP (crop) && TYPE_RANGED_INTEGERP (size_t, XCAR (crop)))
         {
-          h = XFASTINT (XCAR (crop));
+          size_t crop_height = XINT (XCAR (crop));
           crop = XCDR (crop);
-          if (CONSP (crop) && INTEGERP (XCAR (crop)))
+          if (CONSP (crop) && TYPE_RANGED_INTEGERP (ssize_t, XCAR (crop)))
             {
-              x = XFASTINT (XCAR (crop));
+              ssize_t crop_x = XINT (XCAR (crop));
               crop = XCDR (crop);
-              if (CONSP (crop) && INTEGERP (XCAR (crop)))
+              if (CONSP (crop) && TYPE_RANGED_INTEGERP (ssize_t, XCAR (crop)))
                 {
-                  y = XFASTINT (XCAR (crop));
-                  MagickCropImage (image_wand, w, h, x, y);
+                  ssize_t crop_y = XINT (XCAR (crop));
+                  MagickCropImage (image_wand, crop_width, crop_height,
+                                   crop_x, crop_y);
                 }
             }
         }
@@ -7748,9 +7756,11 @@ imagemagick_load_image (struct frame *f, struct image *img,
 
   init_color_table ();
   imagemagick_rendermethod = (INTEGERP (Vimagemagick_render_type)
-                              ? XFASTINT (Vimagemagick_render_type) : 0);
+                              ? XINT (Vimagemagick_render_type) : 0);
   if (imagemagick_rendermethod == 0)
     {
+      size_t image_height;
+
       /* Try to create a x pixmap to hold the imagemagick pixmap.  */
       if (!x_create_x_image_and_pixmap (f, width, height, 0,
                                         &ximg, &img->pixmap))
@@ -7779,7 +7789,8 @@ imagemagick_load_image (struct frame *f, struct image *img,
           goto imagemagick_error;
         }
 
-      for (y = 0; y < (long) MagickGetImageHeight (image_wand); y++)
+      image_height = MagickGetImageHeight (image_wand);
+      for (y = 0; y < image_height; y++)
         {
           pixels = PixelGetNextIteratorRow (iterator, &width);
           if (pixels == (PixelWand **) NULL)
@@ -8285,10 +8296,10 @@ svg_load_image (struct frame *f,         /* Pointer to emacs frame structure.  *
     {
       for (x = 0; x < width; ++x)
         {
-          unsigned red;
-          unsigned green;
-          unsigned blue;
-          unsigned opacity;
+          int red;
+          int green;
+          int blue;
+          int opacity;
 
           red     = *pixels++;
           green   = *pixels++;
@@ -8469,7 +8480,8 @@ gs_image_p (Lisp_Object object)
 static int
 gs_load (struct frame *f, struct image *img)
 {
-  char buffer[100];
+  uprintmax_t printnum1, printnum2;
+  char buffer[sizeof " " + INT_STRLEN_BOUND (printmax_t)];
   Lisp_Object window_and_pixmap_id = Qnil, loader, pt_height, pt_width;
   Lisp_Object frame;
   double in_width, in_height;
@@ -8481,16 +8493,19 @@ gs_load (struct frame *f, struct image *img)
      info.  */
   pt_width = image_spec_value (img->spec, QCpt_width, NULL);
   in_width = INTEGERP (pt_width) ? XFASTINT (pt_width) / 72.0 : 0;
-  img->width = in_width * FRAME_X_DISPLAY_INFO (f)->resx;
+  in_width *= FRAME_X_DISPLAY_INFO (f)->resx;
   pt_height = image_spec_value (img->spec, QCpt_height, NULL);
   in_height = INTEGERP (pt_height) ? XFASTINT (pt_height) / 72.0 : 0;
-  img->height = in_height * FRAME_X_DISPLAY_INFO (f)->resy;
+  in_height *= FRAME_X_DISPLAY_INFO (f)->resy;
 
-  if (!check_image_size (f, img->width, img->height))
+  if (! (in_width <= INT_MAX && in_height <= INT_MAX
+         && check_image_size (f, in_width, in_height)))
     {
       image_error ("Invalid image size (see `max-image-size')", Qnil, Qnil);
       return 0;
     }
+  img->width = in_width;
+  img->height = in_height;
 
   /* Create the pixmap.  */
   xassert (img->pixmap == NO_PIXMAP);
@@ -8515,14 +8530,14 @@ gs_load (struct frame *f, struct image *img)
      if successful.  We do not record_unwind_protect here because
      other places in redisplay like calling window scroll functions
      don't either.  Let the Lisp loader use `unwind-protect' instead.  */
-  sprintf (buffer, "%lu %lu",
-           (unsigned long) FRAME_X_WINDOW (f),
-           (unsigned long) img->pixmap);
+  printnum1 = FRAME_X_WINDOW (f);
+  printnum2 = img->pixmap;
+  sprintf (buffer, "%"pMu" %"pMu, printnum1, printnum2);
   window_and_pixmap_id = build_string (buffer);
 
-  sprintf (buffer, "%lu %lu",
-           FRAME_FOREGROUND_PIXEL (f),
-           FRAME_BACKGROUND_PIXEL (f));
+  printnum1 = FRAME_FOREGROUND_PIXEL (f);
+  printnum2 = FRAME_BACKGROUND_PIXEL (f);
+  sprintf (buffer, "%"pMu" %"pMu, printnum1, printnum2);
   pixel_colors = build_string (buffer);
 
   XSETFRAME (frame, f);
@@ -8547,7 +8562,8 @@ void
 x_kill_gs_process (Pixmap pixmap, struct frame *f)
 {
   struct image_cache *c = FRAME_IMAGE_CACHE (f);
-  int class, i;
+  int class;
+  ptrdiff_t i;
   struct image *img;
 
   /* Find the image containing PIXMAP.  */
@@ -8651,7 +8667,7 @@ DEFUN ("imagep", Fimagep, Simagep, 1, 1, 0,
 DEFUN ("lookup-image", Flookup_image, Slookup_image, 1, 1, 0, "")
   (Lisp_Object spec)
 {
-  int id = -1;
+  ptrdiff_t id = -1;
 
   if (valid_image_p (spec))
     id = lookup_image (SELECTED_FRAME (), spec);
diff --git a/src/indent.c b/src/indent.c
index 70689311dd5..313315e9081 100644
--- a/src/indent.c
+++ b/src/indent.c
@@ -284,7 +284,7 @@ skip_invisible (EMACS_INT pos, EMACS_INT *next_boundary_p, EMACS_INT to, Lisp_Ob
     else                                                                \
       {                                                                 \
         if (dp != 0 && VECTORP (DISP_CHAR_VECTOR (dp, ch)))             \
-          width = ASIZE (DISP_CHAR_VECTOR (dp, ch));                    \
+          width = sanitize_char_width (ASIZE (DISP_CHAR_VECTOR (dp, ch))); \
         else                                                            \
           width = CHAR_WIDTH (ch);                                      \
       }                                                                 \
@@ -318,15 +318,6 @@ invalidate_current_column (void)
   last_known_column_point = 0;
 }
 
-/* Return a non-outlandish value for the tab width.  */
-
-static int
-sane_tab_width (void)
-{
-  EMACS_INT n = XFASTINT (BVAR (current_buffer, tab_width));
-  return 0 < n && n <= 1000 ? n : 8;
-}
-
 EMACS_INT
 current_column (void)
 {
@@ -335,7 +326,7 @@ current_column (void)
   register int tab_seen;
   EMACS_INT post_tab;
   register int c;
-  int tab_width = sane_tab_width ();
+  int tab_width = SANE_TAB_WIDTH (current_buffer);
   int ctl_arrow = !NILP (BVAR (current_buffer, ctl_arrow));
   register struct Lisp_Char_Table *dp = buffer_display_table ();
 
@@ -515,7 +506,7 @@ check_display_width (EMACS_INT pos, EMACS_INT col, EMACS_INT *endpos)
 static void
 scan_for_column (EMACS_INT *endpos, EMACS_INT *goalcol, EMACS_INT *prevcol)
 {
-  int tab_width = sane_tab_width ();
+  int tab_width = SANE_TAB_WIDTH (current_buffer);
   register int ctl_arrow = !NILP (BVAR (current_buffer, ctl_arrow));
   register struct Lisp_Char_Table *dp = buffer_display_table ();
   int multibyte = !NILP (BVAR (current_buffer, enable_multibyte_characters));
@@ -732,7 +723,7 @@ string_display_width (Lisp_Object string, Lisp_Object beg, Lisp_Object end)
   register int tab_seen;
   int post_tab;
   register int c;
-  int tab_width = sane_tab_width ();
+  int tab_width = SANE_TAB_WIDTH (current_buffer);
   int ctl_arrow = !NILP (current_buffer->ctl_arrow);
   register struct Lisp_Char_Table *dp = buffer_display_table ();
   int b, e;
@@ -808,7 +799,7 @@ The return value is COLUMN.  */)
 {
   EMACS_INT mincol;
   register EMACS_INT fromcol;
-  int tab_width = sane_tab_width ();
+  int tab_width = SANE_TAB_WIDTH (current_buffer);
 
   CHECK_NUMBER (column);
   if (NILP (minimum))
@@ -867,7 +858,7 @@ static EMACS_INT
 position_indentation (register int pos_byte)
 {
   register EMACS_INT column = 0;
-  int tab_width = sane_tab_width ();
+  int tab_width = SANE_TAB_WIDTH (current_buffer);
   register unsigned char *p;
   register unsigned char *stop;
   unsigned char *start;
@@ -1116,7 +1107,7 @@ compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_
   register EMACS_INT pos;
   EMACS_INT pos_byte;
   register int c = 0;
-  int tab_width = sane_tab_width ();
+  int tab_width = SANE_TAB_WIDTH (current_buffer);
   register int ctl_arrow = !NILP (BVAR (current_buffer, ctl_arrow));
   register struct Lisp_Char_Table *dp = window_display_table (win);
   EMACS_INT selective
@@ -1432,7 +1423,7 @@ compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_
          the text character-by-character.  */
       if (current_buffer->width_run_cache && pos >= next_width_run)
         {
-          EMACS_INT run_end;
+          ptrdiff_t run_end;
           int common_width
             = region_cache_forward (current_buffer,
                                     current_buffer->width_run_cache,
diff --git a/src/keyboard.c b/src/keyboard.c
index 95f64847a4f..054cd3e9a20 100644
--- a/src/keyboard.c
+++ b/src/keyboard.c
@@ -438,16 +438,16 @@ static void (*keyboard_init_hook) (void);
 static int read_avail_input (int);
 static void get_input_pending (int *, int);
 static int readable_events (int);
-static Lisp_Object read_char_x_menu_prompt (int, Lisp_Object *,
+static Lisp_Object read_char_x_menu_prompt (ptrdiff_t, Lisp_Object *,
                                             Lisp_Object, int *);
-static Lisp_Object read_char_minibuf_menu_prompt (int, int,
+static Lisp_Object read_char_minibuf_menu_prompt (int, ptrdiff_t,
                                                   Lisp_Object *);
 static Lisp_Object make_lispy_event (struct input_event *);
 #if defined (HAVE_MOUSE) || defined (HAVE_GPM)
 static Lisp_Object make_lispy_movement (struct frame *, Lisp_Object,
                                         enum scroll_bar_part,
                                         Lisp_Object, Lisp_Object,
-                                        unsigned long);
+                                        Time);
 #endif
 static Lisp_Object modify_event_symbol (EMACS_INT, unsigned, Lisp_Object,
                                         Lisp_Object, const char *const *,
@@ -1303,7 +1303,7 @@ some_mouse_moved (void)
 /* This is the actual command reading loop,
    sans error-handling encapsulation.  */
 
-static int read_key_sequence (Lisp_Object *, size_t, Lisp_Object,
+static int read_key_sequence (Lisp_Object *, int, Lisp_Object,
                               int, int, int);
 void safe_run_hooks (Lisp_Object);
 static void adjust_point_for_property (EMACS_INT, int);
@@ -2270,7 +2270,8 @@ do { if (polling_stopped_here) start_polling ();	\
    Value is t if we showed a menu and the user rejected it.  */
 
 Lisp_Object
-read_char (int commandflag, int nmaps, Lisp_Object *maps, Lisp_Object prev_event,
+read_char (int commandflag, ptrdiff_t nmaps, Lisp_Object *maps,
+           Lisp_Object prev_event,
            int *used_mouse_menu, struct timeval *end_time)
 {
   volatile Lisp_Object c;
@@ -7421,7 +7422,7 @@ menu_bar_items (Lisp_Object old)
 {
   /* The number of keymaps we're scanning right now, and the number of
      keymaps we have allocated space for.  */
-  int nmaps;
+  ptrdiff_t nmaps;
 
   /* maps[0..nmaps-1] are the prefix definitions of KEYBUF[0..t-1]
      in the current keymaps, or nil where it is not a prefix.  */
@@ -7429,7 +7430,7 @@ menu_bar_items (Lisp_Object old)
 
   Lisp_Object def, tail;
 
-  int mapno;
+  ptrdiff_t mapno;
   Lisp_Object oquit;
 
   /* In order to build the menus, we need to call the keymap
@@ -7474,7 +7475,7 @@ menu_bar_items (Lisp_Object old)
            recognized when the menu-bar (or mode-line) is updated,
            which does not normally happen after every command.  */
         Lisp_Object tem;
-        int nminor;
+        ptrdiff_t nminor;
         nminor = current_minor_maps (NULL, &tmaps);
         maps = (Lisp_Object *) alloca ((nminor + 3) * sizeof (maps[0]));
         nmaps = 0;
@@ -7978,7 +7979,7 @@ Lisp_Object
 tool_bar_items (Lisp_Object reuse, int *nitems)
 {
   Lisp_Object *maps;
-  int nmaps, i;
+  ptrdiff_t nmaps, i;
   Lisp_Object oquit;
   Lisp_Object *tmaps;
 
@@ -8018,7 +8019,7 @@ tool_bar_items (Lisp_Object reuse, int *nitems)
          recognized when the tool-bar (or mode-line) is updated,
          which does not normally happen after every command.  */
       Lisp_Object tem;
-      int nminor;
+      ptrdiff_t nminor;
       nminor = current_minor_maps (NULL, &tmaps);
       maps = (Lisp_Object *) alloca ((nminor + 3) * sizeof (maps[0]));
       nmaps = 0;
@@ -8290,10 +8291,11 @@ parse_tool_bar_item (Lisp_Object key, Lisp_Object item)
       Lisp_Object tcapt = PROP (TOOL_BAR_ITEM_CAPTION);
       const char *label = SYMBOLP (tkey) ? SSDATA (SYMBOL_NAME (tkey)) : "";
       const char *capt = STRINGP (tcapt) ? SSDATA (tcapt) : "";
-      EMACS_INT max_lbl = 2 * tool_bar_max_label_size;
+      ptrdiff_t max_lbl =
+        2 * max (0, min (tool_bar_max_label_size, STRING_BYTES_BOUND / 2));
       char *buf = (char *) xmalloc (max_lbl + 1);
       Lisp_Object new_lbl;
-      size_t caption_len = strlen (capt);
+      ptrdiff_t caption_len = strlen (capt);
 
       if (caption_len <= max_lbl && capt[0] != '\0')
         {
@@ -8306,7 +8308,7 @@ parse_tool_bar_item (Lisp_Object key, Lisp_Object item)
 
       if (strlen (label) <= max_lbl && label[0] != '\0')
         {
-          int j;
+          ptrdiff_t j;
           if (label != buf)
             strcpy (buf, label);
 
@@ -8415,10 +8417,10 @@ append_tool_bar_item (void)
    and do auto-saving in the inner call of read_char. */
 
 static Lisp_Object
-read_char_x_menu_prompt (int nmaps, Lisp_Object *maps, Lisp_Object prev_event,
-                         int *used_mouse_menu)
+read_char_x_menu_prompt (ptrdiff_t nmaps, Lisp_Object *maps,
+                         Lisp_Object prev_event, int *used_mouse_menu)
 {
-  int mapno;
+  ptrdiff_t mapno;
 
   if (used_mouse_menu)
     *used_mouse_menu = 0;
@@ -8446,7 +8448,7 @@ read_char_x_menu_prompt (int nmaps, Lisp_Object *maps, Lisp_Object prev_event,
       Lisp_Object *realmaps
         = (Lisp_Object *) alloca (nmaps * sizeof (Lisp_Object));
       Lisp_Object value;
-      int nmaps1 = 0;
+      ptrdiff_t nmaps1 = 0;
 
       /* Use the maps that are not nil.  */
       for (mapno = 0; mapno < nmaps; mapno++)
@@ -8497,17 +8499,18 @@ read_char_x_menu_prompt (int nmaps, Lisp_Object *maps, Lisp_Object prev_event,
    We make this bigger when necessary, and never free it.  */
 static char *read_char_minibuf_menu_text;
 /* Size of that buffer.  */
-static int read_char_minibuf_menu_width;
+static ptrdiff_t read_char_minibuf_menu_width;
 
 static Lisp_Object
-read_char_minibuf_menu_prompt (int commandflag, int nmaps, Lisp_Object *maps)
+read_char_minibuf_menu_prompt (int commandflag,
+                               ptrdiff_t nmaps, Lisp_Object *maps)
 {
-  int mapno;
+  ptrdiff_t mapno;
   register Lisp_Object name;
-  int nlength;
+  ptrdiff_t nlength;
   /* FIXME: Use the minibuffer's frame width.  */
-  int width = FRAME_COLS (SELECTED_FRAME ()) - 4;
-  int idx = -1;
+  ptrdiff_t width = FRAME_COLS (SELECTED_FRAME ()) - 4;
+  ptrdiff_t idx = -1;
   int nobindings = 1;
   Lisp_Object rest, vector;
   char *menu;
@@ -8532,16 +8535,13 @@ read_char_minibuf_menu_prompt (int commandflag, int nmaps, Lisp_Object *maps)
 
   /* Make sure we have a big enough buffer for the menu text.  */
   width = max (width, SBYTES (name));
-  if (read_char_minibuf_menu_text == 0)
+  if (STRING_BYTES_BOUND - 4 < width)
+    memory_full (SIZE_MAX);
+  if (width + 4 > read_char_minibuf_menu_width)
     {
-      read_char_minibuf_menu_width = width + 4;
-      read_char_minibuf_menu_text = (char *) xmalloc (width + 4);
-    }
-  else if (width + 4 > read_char_minibuf_menu_width)
-    {
-      read_char_minibuf_menu_width = width + 4;
       read_char_minibuf_menu_text
         = (char *) xrealloc (read_char_minibuf_menu_text, width + 4);
+      read_char_minibuf_menu_width = width + 4;
     }
   menu = read_char_minibuf_menu_text;
 
@@ -8560,7 +8560,7 @@ read_char_minibuf_menu_prompt (int commandflag, int nmaps, Lisp_Object *maps)
   while (1)
     {
       int notfirst = 0;
-      int i = nlength;
+      ptrdiff_t i = nlength;
       Lisp_Object obj;
       Lisp_Object orig_defn_macro;
 
@@ -8659,7 +8659,7 @@ read_char_minibuf_menu_prompt (int commandflag, int nmaps, Lisp_Object *maps)
                       < width
                       || !notfirst)
                     {
-                      int thiswidth;
+                      ptrdiff_t thiswidth;
 
                       /* Punctuate between strings.  */
                       if (notfirst)
@@ -8675,9 +8675,7 @@ read_char_minibuf_menu_prompt (int commandflag, int nmaps, Lisp_Object *maps)
                       if (! char_matches)
                         {
                           /* Add as much of string as fits.  */
-                          thiswidth = SCHARS (desc);
-                          if (thiswidth + i > width)
-                            thiswidth = width - i;
+                          thiswidth = min (SCHARS (desc), width - i);
                           memcpy (menu + i, SDATA (desc), thiswidth);
                           i += thiswidth;
                           strcpy (menu + i, " = ");
@@ -8685,9 +8683,7 @@ read_char_minibuf_menu_prompt (int commandflag, int nmaps, Lisp_Object *maps)
                         }
 
                       /* Add as much of string as fits.  */
-                      thiswidth = SCHARS (s);
-                      if (thiswidth + i > width)
-                        thiswidth = width - i;
+                      thiswidth = min (SCHARS (s), width - i);
                       memcpy (menu + i, SDATA (s), thiswidth);
                       i += thiswidth;
                       menu[i] = 0;
@@ -8762,10 +8758,10 @@ read_char_minibuf_menu_prompt (int commandflag, int nmaps, Lisp_Object *maps)
    NEXT may be the same array as CURRENT.  */
 
 static int
-follow_key (Lisp_Object key, int nmaps, Lisp_Object *current, Lisp_Object *defs,
-            Lisp_Object *next)
+follow_key (Lisp_Object key, ptrdiff_t nmaps, Lisp_Object *current,
+            Lisp_Object *defs, Lisp_Object *next)
 {
-  int i, first_binding;
+  ptrdiff_t i, first_binding;
 
   first_binding = nmaps;
   for (i = nmaps - 1; i >= 0; i--)
@@ -8865,7 +8861,7 @@ access_keymap_keyremap (Lisp_Object map, Lisp_Object key, Lisp_Object prompt,
    The return value is non-zero if the remapping actually took place.  */
 
 static int
-keyremap_step (Lisp_Object *keybuf, size_t bufsize, volatile keyremap *fkey,
+keyremap_step (Lisp_Object *keybuf, int bufsize, volatile keyremap *fkey,
                int input, int doit, int *diff, Lisp_Object prompt)
 {
   Lisp_Object next, key;
@@ -8887,7 +8883,7 @@ keyremap_step (Lisp_Object *keybuf, size_t bufsize, volatile keyremap *fkey,
 
       *diff = len - (fkey->end - fkey->start);
 
-      if (input + *diff >= bufsize)
+      if (bufsize - input <= *diff)
         error ("Key sequence too long");
 
       /* Shift the keys that follow fkey->end.  */
@@ -8958,7 +8954,7 @@ keyremap_step (Lisp_Object *keybuf, size_t bufsize, volatile keyremap *fkey,
    from the selected window's buffer.  */
 
 static int
-read_key_sequence (Lisp_Object *keybuf, size_t bufsize, Lisp_Object prompt,
+read_key_sequence (Lisp_Object *keybuf, int bufsize, Lisp_Object prompt,
                    int dont_downcase_last, int can_return_switch_frame,
                    int fix_current_buffer)
 {
@@ -8975,8 +8971,8 @@ read_key_sequence (Lisp_Object *keybuf, size_t bufsize, Lisp_Object prompt,
 
   /* The number of keymaps we're scanning right now, and the number of
      keymaps we have allocated space for.  */
-  int nmaps;
-  int nmaps_allocated = 0;
+  ptrdiff_t nmaps;
+  ptrdiff_t nmaps_allocated = 0;
 
   /* defs[0..nmaps-1] are the definitions of KEYBUF[0..t-1] in
      the current keymaps.  */
@@ -9000,7 +8996,7 @@ read_key_sequence (Lisp_Object *keybuf, size_t bufsize, Lisp_Object prompt,
   /* The index in submaps[] of the first keymap that has a binding for
      this key sequence.  In other words, the lowest i such that
      submaps[i] is non-nil.  */
-  int first_binding;
+  ptrdiff_t first_binding;
   /* Index of the first key that has no binding.
      It is useless to try fkey.start larger than that.  */
   int first_unbound;
@@ -9161,8 +9157,8 @@ read_key_sequence (Lisp_Object *keybuf, size_t bufsize, Lisp_Object prompt,
     }
   else
     {
-      int nminor;
-      int total;
+      ptrdiff_t nminor;
+      ptrdiff_t total;
       Lisp_Object *maps;
 
       nminor = current_minor_maps (0, &maps);
@@ -9228,7 +9224,8 @@ read_key_sequence (Lisp_Object *keybuf, size_t bufsize, Lisp_Object prompt,
          echo_local_start and keys_local_start allow us to throw away
          just one key.  */
       int echo_local_start IF_LINT (= 0);
-      int keys_local_start, local_first_binding;
+      int keys_local_start;
+      ptrdiff_t local_first_binding;
 
       eassert (indec.end == t || (indec.end > t && indec.end <= mock_input));
       eassert (indec.start <= indec.end);
@@ -9565,7 +9562,7 @@ read_key_sequence (Lisp_Object *keybuf, size_t bufsize, Lisp_Object prompt,
                   && (NILP (fake_prefixed_keys)
                       || NILP (Fmemq (key, fake_prefixed_keys))))
                 {
-                  if (t + 1 >= bufsize)
+                  if (bufsize - t <= 1)
                     error ("Key sequence too long");
 
                   keybuf[t]     = posn;
@@ -9646,7 +9643,7 @@ read_key_sequence (Lisp_Object *keybuf, size_t bufsize, Lisp_Object prompt,
                  insert the dummy prefix event `menu-bar'.  */
               if (EQ (posn, Qmenu_bar) || EQ (posn, Qtool_bar))
                 {
-                  if (t + 1 >= bufsize)
+                  if (bufsize - t <= 1)
                     error ("Key sequence too long");
                   keybuf[t] = posn;
                   keybuf[t+1] = key;
diff --git a/src/keyboard.h b/src/keyboard.h
index 69c804c873d..d4339d0529b 100644
--- a/src/keyboard.h
+++ b/src/keyboard.h
@@ -440,7 +440,7 @@ struct input_event;
 
 extern Lisp_Object parse_modifiers (Lisp_Object);
 extern Lisp_Object reorder_modifiers (Lisp_Object);
-extern Lisp_Object read_char (int, int, Lisp_Object *, Lisp_Object,
+extern Lisp_Object read_char (int, ptrdiff_t, Lisp_Object *, Lisp_Object,
                               int *, EMACS_TIME *);
 extern int parse_solitary_modifier (Lisp_Object symbol);
 
diff --git a/src/keymap.c b/src/keymap.c
index 3b0edbf4fb3..32b531daac4 100644
--- a/src/keymap.c
+++ b/src/keymap.c
@@ -1399,7 +1399,7 @@ silly_event_symbol_error (Lisp_Object c)
    some systems, static gets macro-defined to be the empty string.
    Ickypoo.  */
 static Lisp_Object *cmm_modes = NULL, *cmm_maps = NULL;
-static int cmm_size = 0;
+static ptrdiff_t cmm_size = 0;
 
 /* Store a pointer to an array of the currently active minor modes in
    *modeptr, a pointer to an array of the keymaps of the currently
@@ -1419,10 +1419,10 @@ static int cmm_size = 0;
    loop.  Instead, we'll use realloc/malloc and silently truncate the
    list, let the key sequence be read, and hope some other piece of
    code signals the error.  */
-int
+ptrdiff_t
 current_minor_maps (Lisp_Object **modeptr, Lisp_Object **mapptr)
 {
-  int i = 0;
+  ptrdiff_t i = 0;
   int list_number = 0;
   Lisp_Object alist, assoc, var, val;
   Lisp_Object emulation_alists;
@@ -1465,9 +1465,16 @@ current_minor_maps (Lisp_Object **modeptr, Lisp_Object **mapptr)
 
             if (i >= cmm_size)
               {
-                int newsize, allocsize;
+                ptrdiff_t newsize, allocsize;
                 Lisp_Object *newmodes, *newmaps;
 
+                /* Check for size calculation overflow.  Other code
+                   (e.g., read_key_sequence) adds 3 to the count
+                   later, so subtract 3 from the limit here.  */
+                if (min (PTRDIFF_MAX, SIZE_MAX) / (2 * sizeof *newmodes) - 3
+                    < cmm_size)
+                  break;
+
                 newsize = cmm_size == 0 ? 30 : cmm_size * 2;
                 allocsize = newsize * sizeof *newmodes;
 
diff --git a/src/keymap.h b/src/keymap.h
index 2c826b64e1f..ec9d4cadbb1 100644
--- a/src/keymap.h
+++ b/src/keymap.h
@@ -38,7 +38,7 @@ extern Lisp_Object get_keymap (Lisp_Object, int, int);
 EXFUN (Fset_keymap_parent, 2);
 extern int describe_map_tree (Lisp_Object, int, Lisp_Object, Lisp_Object,
                               const char *, int, int, int, int);
-extern int current_minor_maps (Lisp_Object **, Lisp_Object **);
+extern ptrdiff_t current_minor_maps (Lisp_Object **, Lisp_Object **);
 extern void initial_define_key (Lisp_Object, int, const char *);
 extern void initial_define_lispy_key (Lisp_Object, const char *, const char *);
 extern void syms_of_keymap (void);
diff --git a/src/lisp.h b/src/lisp.h
index 14bd429a45e..5ca31132668 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -1708,6 +1708,11 @@ typedef struct {
 #define NUMBERP(x) (INTEGERP (x) || FLOATP (x))
 #define NATNUMP(x) (INTEGERP (x) && XINT (x) >= 0)
 
+#define RANGED_INTEGERP(lo, x, hi) \
+  (INTEGERP (x) && (lo) <= XINT (x) && XINT (x) <= (hi))
+#define TYPE_RANGED_INTEGERP(type, x) \
+  RANGED_INTEGERP (TYPE_MINIMUM (type), x, TYPE_MAXIMUM (type))
+
 #define INTEGERP(x) (LISP_INT_TAG_P (XTYPE ((x))))
 #define SYMBOLP(x) (XTYPE ((x)) == Lisp_Symbol)
 #define MISCP(x) (XTYPE ((x)) == Lisp_Misc)
@@ -2555,6 +2560,7 @@ extern void syms_of_syntax (void);
 
 /* Defined in fns.c */
 extern Lisp_Object QCrehash_size, QCrehash_threshold;
+enum { NEXT_ALMOST_PRIME_LIMIT = 11 };
 extern EMACS_INT next_almost_prime (EMACS_INT);
 extern Lisp_Object larger_vector (Lisp_Object, EMACS_INT, Lisp_Object);
 extern void sweep_weak_hash_tables (void);
@@ -2566,8 +2572,8 @@ EMACS_UINT sxhash (Lisp_Object, int);
 Lisp_Object make_hash_table (Lisp_Object, Lisp_Object, Lisp_Object,
                              Lisp_Object, Lisp_Object, Lisp_Object,
                              Lisp_Object);
-EMACS_INT hash_lookup (struct Lisp_Hash_Table *, Lisp_Object, EMACS_UINT *);
-EMACS_INT hash_put (struct Lisp_Hash_Table *, Lisp_Object, Lisp_Object,
+ptrdiff_t hash_lookup (struct Lisp_Hash_Table *, Lisp_Object, EMACS_UINT *);
+ptrdiff_t hash_put (struct Lisp_Hash_Table *, Lisp_Object, Lisp_Object,
                     EMACS_UINT);
 void init_weak_hash_tables (void);
 extern void init_fns (void);
@@ -3573,6 +3579,9 @@ extern int immediate_quit;	    /* Nonzero means ^G can quit instantly */
 extern POINTER_TYPE *xmalloc (size_t);
 extern POINTER_TYPE *xrealloc (POINTER_TYPE *, size_t);
 extern void xfree (POINTER_TYPE *);
+extern void *xnmalloc (ptrdiff_t, ptrdiff_t);
+extern void *xnrealloc (void *, ptrdiff_t, ptrdiff_t);
+extern void *xpalloc (void *, ptrdiff_t *, ptrdiff_t, ptrdiff_t, ptrdiff_t);
 
 extern char *xstrdup (const char *);
 
@@ -3690,6 +3699,23 @@ extern Lisp_Object safe_alloca_unwind (Lisp_Object);
       }                                                   \
   } while (0)
 
+/* SAFE_NALLOCA sets BUF to a newly allocated array of MULTIPLIER *
+   NITEMS items, each of the same type as *BUF.  MULTIPLIER must
+   positive.  The code is tuned for MULTIPLIER being a constant.  */
+
+#define SAFE_NALLOCA(buf, multiplier, nitems)                   \
+  do {                                                          \
+    if ((nitems) <= MAX_ALLOCA / sizeof *(buf) / (multiplier))  \
+      (buf) = alloca (sizeof *(buf) * (multiplier) * (nitems)); \
+    else                                                        \
+      {                                                          \
+        (buf) = xnmalloc (nitems, sizeof *(buf) * (multiplier)); \
+        sa_must_free = 1;                                        \
+        record_unwind_protect (safe_alloca_unwind,               \
+                               make_save_value (buf, 0));        \
+      }                                                          \
+  } while (0)
+
 /* SAFE_FREE frees xmalloced memory and enables GC as needed.  */
 
 #define SAFE_FREE()                     \
diff --git a/src/lread.c b/src/lread.c
index 6d1a7b102d7..d24da729df6 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -2637,14 +2637,14 @@ read1 (register Lisp_Object readcharfun, int *pch, int first_in_list)
 
               if (saved_doc_string_size == 0)
                 {
+                  saved_doc_string = (char *) xmalloc (nskip + extra);
                   saved_doc_string_size = nskip + extra;
-                  saved_doc_string = (char *) xmalloc (saved_doc_string_size);
                 }
               if (nskip > saved_doc_string_size)
                 {
-                  saved_doc_string_size = nskip + extra;
                   saved_doc_string = (char *) xrealloc (saved_doc_string,
-                                                        saved_doc_string_size);
+                                                        nskip + extra);
+                  saved_doc_string_size = nskip + extra;
                 }
 
               saved_doc_string_position = file_tell (instream);
@@ -2907,7 +2907,8 @@ read1 (register Lisp_Object readcharfun, int *pch, int first_in_list)
                 if (min (PTRDIFF_MAX, SIZE_MAX) / 2 < read_buffer_size)
                   memory_full (SIZE_MAX);
                 read_buffer = (char *) xrealloc (read_buffer,
-                                                 read_buffer_size *= 2);
+                                                 read_buffer_size * 2);
+                read_buffer_size *= 2;
                 p = read_buffer + offset;
                 end = read_buffer + read_buffer_size;
               }
@@ -3050,7 +3051,8 @@ read1 (register Lisp_Object readcharfun, int *pch, int first_in_list)
                   if (min (PTRDIFF_MAX, SIZE_MAX) / 2 < read_buffer_size)
                     memory_full (SIZE_MAX);
                   read_buffer = (char *) xrealloc (read_buffer,
-                                                   read_buffer_size *= 2);
+                                                   read_buffer_size * 2);
+                  read_buffer_size *= 2;
                   p = read_buffer + offset;
                   end = read_buffer + read_buffer_size;
                 }
@@ -3080,7 +3082,8 @@ read1 (register Lisp_Object readcharfun, int *pch, int first_in_list)
               if (min (PTRDIFF_MAX, SIZE_MAX) / 2 < read_buffer_size)
                 memory_full (SIZE_MAX);
               read_buffer = (char *) xrealloc (read_buffer,
-                                               read_buffer_size *= 2);
+                                               read_buffer_size * 2);
+              read_buffer_size *= 2;
               p = read_buffer + offset;
               end = read_buffer + read_buffer_size;
             }
@@ -3962,6 +3965,7 @@ void
 init_obarray (void)
 {
   Lisp_Object oblength;
+  ptrdiff_t size = 100 + MAX_MULTIBYTE_LENGTH;
 
   XSETFASTINT (oblength, OBARRAY_SIZE);
 
@@ -3994,8 +3998,8 @@ init_obarray (void)
 
   DEFSYM (Qvariable_documentation, "variable-documentation");
 
-  read_buffer_size = 100 + MAX_MULTIBYTE_LENGTH;
-  read_buffer = (char *) xmalloc (read_buffer_size);
+  read_buffer = (char *) xmalloc (size);
+  read_buffer_size = size;
 }
 
 void
diff --git a/src/macros.c b/src/macros.c
index 60f30c3fbbe..f6cd3a3ccad 100644
--- a/src/macros.c
+++ b/src/macros.c
@@ -62,9 +62,9 @@ macro before appending to it. */)
 
   if (!current_kboard->kbd_macro_buffer)
     {
-      current_kboard->kbd_macro_bufsize = 30;
       current_kboard->kbd_macro_buffer
         = (Lisp_Object *)xmalloc (30 * sizeof (Lisp_Object));
+      current_kboard->kbd_macro_bufsize = 30;
     }
   update_mode_lines++;
   if (NILP (append))
@@ -202,7 +202,7 @@ store_kbd_macro_char (Lisp_Object c)
           if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *kb->kbd_macro_buffer / 2
               < kb->kbd_macro_bufsize)
             memory_full (SIZE_MAX);
-          nbytes = kb->kbd_macro_bufsize * 2 * sizeof *kb->kbd_macro_buffer;
+          nbytes = kb->kbd_macro_bufsize * (2 * sizeof *kb->kbd_macro_buffer);
           kb->kbd_macro_buffer
             = (Lisp_Object *) xrealloc (kb->kbd_macro_buffer, nbytes);
           kb->kbd_macro_bufsize *= 2;
diff --git a/src/makefile.w32-in b/src/makefile.w32-in
index 792b66b0e4f..53cb5f857ab 100644
--- a/src/makefile.w32-in
+++ b/src/makefile.w32-in
@@ -469,6 +469,7 @@ $(BLD)/alloc.$(O) : \
         $(SRC)/syssignal.h \
         $(SRC)/w32.h \
         $(NT_INC)/unistd.h \
+        $(GNU_LIB)/verify.h \
         $(BLOCKINPUT_H) \
         $(CHARACTER_H) \
         $(CONFIG_H) \
diff --git a/src/minibuf.c b/src/minibuf.c
index 7e59cf157b5..eb564a10ec6 100644
--- a/src/minibuf.c
+++ b/src/minibuf.c
@@ -1723,7 +1723,7 @@ the values STRING, PREDICATE and `lambda'.  */)
   (Lisp_Object string, Lisp_Object collection, Lisp_Object predicate)
 {
   Lisp_Object regexps, tail, tem = Qnil;
-  EMACS_INT i = 0;
+  ptrdiff_t i = 0;
 
   CHECK_STRING (string);
 
diff --git a/src/nsmenu.m b/src/nsmenu.m
index 6bde229ed4d..951282910ac 100644
--- a/src/nsmenu.m
+++ b/src/nsmenu.m
@@ -1014,7 +1014,7 @@ update_frame_tool_bar (FRAME_PTR f)
       BOOL enabled_p = !NILP (TOOLPROP (TOOL_BAR_ITEM_ENABLED_P));
       BOOL selected_p = !NILP (TOOLPROP (TOOL_BAR_ITEM_SELECTED_P));
       int idx;
-      int img_id;
+      ptrdiff_t img_id;
       struct image *img;
       Lisp_Object image;
       Lisp_Object helpObj;
diff --git a/src/nsterm.h b/src/nsterm.h
index 902f35c96ea..188ec732e82 100644
--- a/src/nsterm.h
+++ b/src/nsterm.h
@@ -416,8 +416,8 @@ struct ns_bitmap_record
 /* this to map between emacs color indices and NSColor objects */
 struct ns_color_table
 {
-  unsigned int size;
-  unsigned int avail;
+  ptrdiff_t size;
+  ptrdiff_t avail;
 #ifdef __OBJC__
   NSColor **colors;
   NSMutableSet *empty_indices;
diff --git a/src/nsterm.m b/src/nsterm.m
index 582e53e202c..4c9574c35ba 100644
--- a/src/nsterm.m
+++ b/src/nsterm.m
@@ -1341,7 +1341,7 @@ unsigned long
 ns_index_color (NSColor *color, struct frame *f)
 {
   struct ns_color_table *color_table = FRAME_NS_DISPLAY_INFO (f)->color_table;
-  int idx;
+  ptrdiff_t idx;
   NSNumber *index;
 
   if (!color_table->colors)
@@ -1356,7 +1356,7 @@ ns_index_color (NSColor *color, struct frame *f)
 
   /* do we already have this color ? */
   {
-    int i;
+    ptrdiff_t i;
     for (i = 1; i < color_table->avail; i++)
       {
         if (color_table->colors[i] && [color_table->colors[i] isEqual: color])
@@ -1371,17 +1371,14 @@ ns_index_color (NSColor *color, struct frame *f)
     {
       index = [color_table->empty_indices anyObject];
       [color_table->empty_indices removeObject: index];
-      idx = [index unsignedIntValue];
+      idx = [index unsignedLongValue];
     }
   else
     {
       if (color_table->avail == color_table->size)
-        {
-          color_table->size += NS_COLOR_CAPACITY;
-          color_table->colors
-            = (NSColor **)xrealloc (color_table->colors,
-                                    color_table->size * sizeof (NSColor *));
-        }
+        color_table->colors =
+          xpalloc (color_table->colors, &color_table->size, 1,
+                   min (ULONG_MAX, PTRDIFF_MAX), sizeof *color_table->colors);
       idx = color_table->avail++;
     }
 
@@ -2321,7 +2318,7 @@ ns_draw_fringe_bitmap (struct window *w, struct glyph_row *row,
       if (!img)
         {
           unsigned short *bits = p->bits + p->dh;
-          int len = 8 * p->h/8;
+          int len = p->h;
           int i;
           unsigned char *cbits = xmalloc (len);
 
@@ -4867,7 +4864,7 @@ ns_term_shutdown (int sig)
         }
     }
 
-  
+
 #if !defined (NS_IMPL_COCOA) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
   /* if we get here we should send the key for input manager processing */
   if (firstTime && [[NSInputManager currentInputManager]
diff --git a/src/process.c b/src/process.c
index 977cfb964e2..a8088322147 100644
--- a/src/process.c
+++ b/src/process.c
@@ -3573,52 +3573,27 @@ format; see the description of ADDRESS in `make-network-process'.  */)
   struct ifconf ifconf;
   struct ifreq *ifreq;
   void *buf = NULL;
-  int buf_size = 512, s, i;
+  ptrdiff_t buf_size = 512;
+  int s, i;
   Lisp_Object res;
 
   s = socket (AF_INET, SOCK_STREAM, 0);
   if (s < 0)
     return Qnil;
 
-  ifconf.ifc_buf = 0;
-  ifconf.ifc_len = 0;
-  if (ioctl (s, SIOCGIFCONF, &ifconf) == 0 && ifconf.ifc_len > 0)
+  do
     {
-      ifconf.ifc_buf = xmalloc (ifconf.ifc_len);
-      if (ifconf.ifc_buf == NULL)
-        {
-          close (s);
-          return Qnil;
-        }
+      buf = xpalloc (buf, &buf_size, 1, INT_MAX, 1);
+      ifconf.ifc_buf = buf;
+      ifconf.ifc_len = buf_size;
       if (ioctl (s, SIOCGIFCONF, &ifconf))
         {
           close (s);
-          xfree (ifconf.ifc_buf);
+          xfree (buf);
           return Qnil;
         }
     }
-  else
-    do
-      {
-        buf_size *= 2;
-        buf = xrealloc (buf, buf_size);
-        if (!buf)
-          {
-            close (s);
-            return Qnil;
-          }
-
-        ifconf.ifc_buf = buf;
-        ifconf.ifc_len = buf_size;
-        if (ioctl (s, SIOCGIFCONF, &ifconf))
-          {
-            close (s);
-            xfree (buf);
-            return Qnil;
-          }
-
-      }
-    while (ifconf.ifc_len == buf_size);
+  while (ifconf.ifc_len == buf_size);
 
   close (s);
 
diff --git a/src/region-cache.c b/src/region-cache.c
index d701f4d71b0..ed7a07a6709 100644
--- a/src/region-cache.c
+++ b/src/region-cache.c
@@ -63,7 +63,7 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
    revalidate_region_cache to see how this helps.  */
 
 struct boundary {
-  EMACS_INT pos;
+  ptrdiff_t pos;
   int value;
 };
 
@@ -73,16 +73,16 @@ struct region_cache {
   struct boundary *boundaries;
 
   /* boundaries[gap_start ... gap_start + gap_len - 1] is the gap.  */
-  EMACS_INT gap_start, gap_len;
+  ptrdiff_t gap_start, gap_len;
 
   /* The number of elements allocated to boundaries, not including the
      gap.  */
-  EMACS_INT cache_len;
+  ptrdiff_t cache_len;
 
   /* The areas that haven't changed since the last time we cleaned out
      invalid entries from the cache.  These overlap when the buffer is
      entirely unchanged.  */
-  EMACS_INT beg_unchanged, end_unchanged;
+  ptrdiff_t beg_unchanged, end_unchanged;
 
   /* The first and last positions in the buffer.  Because boundaries
      store their positions relative to the start (BEG) and end (Z) of
@@ -92,7 +92,7 @@ struct region_cache {
 
      Yes, buffer_beg is always 1.  It's there for symmetry with
      buffer_end and the BEG and BUF_BEG macros.  */
-  EMACS_INT buffer_beg, buffer_end;
+  ptrdiff_t buffer_beg, buffer_end;
 };
 
 /* Return the position of boundary i in cache c.  */
@@ -173,17 +173,17 @@ free_region_cache (struct region_cache *c)
    This operation should be logarithmic in the number of cache
    entries.  It would be nice if it took advantage of locality of
    reference, too, by searching entries near the last entry found.  */
-static EMACS_INT
-find_cache_boundary (struct region_cache *c, EMACS_INT pos)
+static ptrdiff_t
+find_cache_boundary (struct region_cache *c, ptrdiff_t pos)
 {
-  EMACS_INT low = 0, high = c->cache_len;
+  ptrdiff_t low = 0, high = c->cache_len;
 
   while (low + 1 < high)
     {
       /* mid is always a valid index, because low < high and ">> 1"
          rounds down.  */
-      EMACS_INT mid = (low + high) >> 1;
-      EMACS_INT boundary = BOUNDARY_POS (c, mid);
+      ptrdiff_t mid = (low >> 1) + (high >> 1) + (low & high & 1);
+      ptrdiff_t boundary = BOUNDARY_POS (c, mid);
 
       if (pos < boundary)
         high = mid;
@@ -208,13 +208,13 @@ find_cache_boundary (struct region_cache *c, EMACS_INT pos)
 /* Move the gap of cache C to index POS, and make sure it has space
    for at least MIN_SIZE boundaries.  */
 static void
-move_cache_gap (struct region_cache *c, EMACS_INT pos, EMACS_INT min_size)
+move_cache_gap (struct region_cache *c, ptrdiff_t pos, ptrdiff_t min_size)
 {
   /* Copy these out of the cache and into registers.  */
-  EMACS_INT gap_start = c->gap_start;
-  EMACS_INT gap_len = c->gap_len;
-  EMACS_INT buffer_beg = c->buffer_beg;
-  EMACS_INT buffer_end = c->buffer_end;
+  ptrdiff_t gap_start = c->gap_start;
+  ptrdiff_t gap_len = c->gap_len;
+  ptrdiff_t buffer_beg = c->buffer_beg;
+  ptrdiff_t buffer_end = c->buffer_end;
 
   if (pos < 0
       || pos > c->cache_len)
@@ -246,17 +246,11 @@ move_cache_gap (struct region_cache *c, EMACS_INT pos, EMACS_INT min_size)
      when the portion after the gap is smallest.  */
   if (gap_len < min_size)
     {
-      EMACS_INT i;
-
-      /* Always make at least NEW_CACHE_GAP elements, as long as we're
-         expanding anyway.  */
-      if (min_size < NEW_CACHE_GAP)
-        min_size = NEW_CACHE_GAP;
+      ptrdiff_t i;
 
       c->boundaries =
-        (struct boundary *) xrealloc (c->boundaries,
-                                      ((min_size + c->cache_len)
-                                       * sizeof (*c->boundaries)));
+        xpalloc (c->boundaries, &c->cache_len, min_size, -1,
+                 sizeof *c->boundaries);
 
       /* Some systems don't provide a version of the copy routine that
          can be trusted to shift memory upward into an overlapping
@@ -293,7 +287,7 @@ move_cache_gap (struct region_cache *c, EMACS_INT pos, EMACS_INT min_size)
 /* Insert a new boundary in cache C; it will have cache index I,
    and have the specified POS and VALUE.  */
 static void
-insert_cache_boundary (struct region_cache *c, EMACS_INT i, EMACS_INT pos,
+insert_cache_boundary (struct region_cache *c, ptrdiff_t i, ptrdiff_t pos,
                        int value)
 {
   /* i must be a valid cache index.  */
@@ -331,9 +325,9 @@ insert_cache_boundary (struct region_cache *c, EMACS_INT i, EMACS_INT pos,
 
 static void
 delete_cache_boundaries (struct region_cache *c,
-                         EMACS_INT start, EMACS_INT end)
+                         ptrdiff_t start, ptrdiff_t end)
 {
-  EMACS_INT len = end - start;
+  ptrdiff_t len = end - start;
 
   /* Gotta be in range.  */
   if (start < 0
@@ -384,7 +378,7 @@ delete_cache_boundaries (struct region_cache *c,
 /* Set the value in cache C for the region START..END to VALUE.  */
 static void
 set_cache_region (struct region_cache *c,
-                  EMACS_INT start, EMACS_INT end, int value)
+                  ptrdiff_t start, ptrdiff_t end, int value)
 {
   if (start > end)
     abort ();
@@ -407,8 +401,8 @@ set_cache_region (struct region_cache *c,
        index of the earliest boundary after the last character in
        start..end.  (This tortured terminology is intended to answer
        all the "< or <=?" sort of questions.)  */
-    EMACS_INT start_ix = find_cache_boundary (c, start);
-    EMACS_INT end_ix   = find_cache_boundary (c, end - 1) + 1;
+    ptrdiff_t start_ix = find_cache_boundary (c, start);
+    ptrdiff_t end_ix   = find_cache_boundary (c, end - 1) + 1;
 
     /* We must remember the value established by the last boundary
        before end; if that boundary's domain stretches beyond end,
@@ -486,7 +480,7 @@ set_cache_region (struct region_cache *c,
    args to pass are the same before and after such an operation.)  */
 void
 invalidate_region_cache (struct buffer *buf, struct region_cache *c,
-                         EMACS_INT head, EMACS_INT tail)
+                         ptrdiff_t head, ptrdiff_t tail)
 {
   /* Let chead = c->beg_unchanged, and
          ctail = c->end_unchanged.
@@ -624,7 +618,7 @@ revalidate_region_cache (struct buffer *buf, struct region_cache *c)
      corresponds to the modified region of the buffer.  */
   else
     {
-      EMACS_INT modified_ix;
+      ptrdiff_t modified_ix;
 
       /* These positions are correct, relative to both the cache basis
          and the buffer basis.  */
@@ -693,7 +687,7 @@ revalidate_region_cache (struct buffer *buf, struct region_cache *c)
    no newlines", in the case of the line cache).  */
 void
 know_region_cache (struct buffer *buf, struct region_cache *c,
-                   EMACS_INT start, EMACS_INT end)
+                   ptrdiff_t start, ptrdiff_t end)
 {
   revalidate_region_cache (buf, c);
 
@@ -708,14 +702,14 @@ know_region_cache (struct buffer *buf, struct region_cache *c,
    position after POS where the knownness changes.  */
 int
 region_cache_forward (struct buffer *buf, struct region_cache *c,
-                      EMACS_INT pos, EMACS_INT *next)
+                      ptrdiff_t pos, ptrdiff_t *next)
 {
   revalidate_region_cache (buf, c);
 
   {
-    EMACS_INT i = find_cache_boundary (c, pos);
+    ptrdiff_t i = find_cache_boundary (c, pos);
     int i_value = BOUNDARY_VALUE (c, i);
-    EMACS_INT j;
+    ptrdiff_t j;
 
     /* Beyond the end of the buffer is unknown, by definition.  */
     if (pos >= BUF_Z (buf))
@@ -744,7 +738,7 @@ region_cache_forward (struct buffer *buf, struct region_cache *c,
    the purposes of CACHE.  If NEXT is non-zero, set *NEXT to the nearest
    position before POS where the knownness changes.  */
 int region_cache_backward (struct buffer *buf, struct region_cache *c,
-                           EMACS_INT pos, EMACS_INT *next)
+                           ptrdiff_t pos, ptrdiff_t *next)
 {
   revalidate_region_cache (buf, c);
 
@@ -757,9 +751,9 @@ int region_cache_backward (struct buffer *buf, struct region_cache *c,
     }
 
   {
-    EMACS_INT i = find_cache_boundary (c, pos - 1);
+    ptrdiff_t i = find_cache_boundary (c, pos - 1);
     int i_value = BOUNDARY_VALUE (c, i);
-    EMACS_INT j;
+    ptrdiff_t j;
 
     if (next)
       {
@@ -785,18 +779,18 @@ void pp_cache (struct region_cache *) EXTERNALLY_VISIBLE;
 void
 pp_cache (struct region_cache *c)
 {
-  int i;
-  EMACS_INT beg_u = c->buffer_beg + c->beg_unchanged;
-  EMACS_INT end_u = c->buffer_end - c->end_unchanged;
+  ptrdiff_t i;
+  ptrdiff_t beg_u = c->buffer_beg + c->beg_unchanged;
+  ptrdiff_t end_u = c->buffer_end - c->end_unchanged;
 
   fprintf (stderr,
-           "basis: %"pI"d..%"pI"d    modified: %"pI"d..%"pI"d\n",
+           "basis: %"pD"d..%"pD"d    modified: %"pD"d..%"pD"d\n",
            c->buffer_beg, c->buffer_end,
            beg_u, end_u);
 
   for (i = 0; i < c->cache_len; i++)
     {
-      EMACS_INT pos = BOUNDARY_POS (c, i);
+      ptrdiff_t pos = BOUNDARY_POS (c, i);
 
       putc (((pos < beg_u) ? 'v'
              : (pos == beg_u) ? '-'
@@ -806,6 +800,6 @@ pp_cache (struct region_cache *c)
              : (pos == end_u) ? '-'
              : ' '),
             stderr);
-      fprintf (stderr, "%"pI"d : %d\n", pos, BOUNDARY_VALUE (c, i));
+      fprintf (stderr, "%"pD"d : %d\n", pos, BOUNDARY_VALUE (c, i));
     }
 }
diff --git a/src/region-cache.h b/src/region-cache.h
index ea767ed0dc3..8e1be716776 100644
--- a/src/region-cache.h
+++ b/src/region-cache.h
@@ -72,7 +72,7 @@ void free_region_cache (struct region_cache *);
    no newlines", in the case of the line cache).  */
 extern void know_region_cache (struct buffer *BUF,
                                struct region_cache *CACHE,
-                               EMACS_INT START, EMACS_INT END);
+                               ptrdiff_t START, ptrdiff_t END);
 
 /* Indicate that a section of BUF has changed, to invalidate CACHE.
    HEAD is the number of chars unchanged at the beginning of the buffer.
@@ -84,7 +84,7 @@ extern void know_region_cache (struct buffer *BUF,
    args to pass are the same before and after such an operation.)  */
 extern void invalidate_region_cache (struct buffer *BUF,
                                      struct region_cache *CACHE,
-                                     EMACS_INT HEAD, EMACS_INT TAIL);
+                                     ptrdiff_t HEAD, ptrdiff_t TAIL);
 
 /* The scanning functions.
 
@@ -100,13 +100,13 @@ extern void invalidate_region_cache (struct buffer *BUF,
    position after POS where the knownness changes.  */
 extern int region_cache_forward (struct buffer *BUF,
                                  struct region_cache *CACHE,
-                                 EMACS_INT POS,
-                                 EMACS_INT *NEXT);
+                                 ptrdiff_t POS,
+                                 ptrdiff_t *NEXT);
 
 /* Return true if the text immediately before POS in BUF is known, for
    the purposes of CACHE.  If NEXT is non-zero, set *NEXT to the nearest
    position before POS where the knownness changes.  */
 extern int region_cache_backward (struct buffer *BUF,
                                   struct region_cache *CACHE,
-                                  EMACS_INT POS,
-                                  EMACS_INT *NEXT);
+                                  ptrdiff_t POS,
+                                  ptrdiff_t *NEXT);
diff --git a/src/scroll.c b/src/scroll.c
index 6291936a541..05f6fdf85f0 100644
--- a/src/scroll.c
+++ b/src/scroll.c
@@ -969,32 +969,14 @@ do_line_insertion_deletion_costs (FRAME_PTR frame,
                                   const char *cleanup_string,
                                   int coefficient)
 {
-  if (FRAME_INSERT_COST (frame) != 0)
-    {
-      FRAME_INSERT_COST (frame) =
-        (int *) xrealloc (FRAME_INSERT_COST (frame),
-                          FRAME_LINES (frame) * sizeof (int));
-      FRAME_DELETEN_COST (frame) =
-        (int *) xrealloc (FRAME_DELETEN_COST (frame),
-                          FRAME_LINES (frame) * sizeof (int));
-      FRAME_INSERTN_COST (frame) =
-        (int *) xrealloc (FRAME_INSERTN_COST (frame),
-                          FRAME_LINES (frame) * sizeof (int));
-      FRAME_DELETE_COST (frame) =
-        (int *) xrealloc (FRAME_DELETE_COST (frame),
-                          FRAME_LINES (frame) * sizeof (int));
-    }
-  else
-    {
-      FRAME_INSERT_COST (frame) =
-        (int *) xmalloc (FRAME_LINES (frame) * sizeof (int));
-      FRAME_DELETEN_COST (frame) =
-        (int *) xmalloc (FRAME_LINES (frame) * sizeof (int));
-      FRAME_INSERTN_COST (frame) =
-        (int *) xmalloc (FRAME_LINES (frame) * sizeof (int));
-      FRAME_DELETE_COST (frame) =
-        (int *) xmalloc (FRAME_LINES (frame) * sizeof (int));
-    }
+  FRAME_INSERT_COST (frame) =
+    xnrealloc (FRAME_INSERT_COST (frame), FRAME_LINES (frame), sizeof (int));
+  FRAME_DELETEN_COST (frame) =
+    xnrealloc (FRAME_DELETEN_COST (frame), FRAME_LINES (frame), sizeof (int));
+  FRAME_INSERTN_COST (frame) =
+    xnrealloc (FRAME_INSERTN_COST (frame), FRAME_LINES (frame), sizeof (int));
+  FRAME_DELETE_COST (frame) =
+    xnrealloc (FRAME_DELETE_COST (frame), FRAME_LINES (frame), sizeof (int));
 
   ins_del_costs (frame,
                  ins_line_string, multi_ins_string,
diff --git a/src/search.c b/src/search.c
index a56df784cd2..d892792cbaa 100644
--- a/src/search.c
+++ b/src/search.c
@@ -683,7 +683,7 @@ scan_buffer (register int target, EMACS_INT start, EMACS_INT end,
            to see where we can avoid some scanning.  */
         if (target == '\n' && newline_cache)
           {
-            EMACS_INT next_change;
+            ptrdiff_t next_change;
             immediate_quit = 0;
             while (region_cache_forward
                    (current_buffer, newline_cache, start_byte, &next_change))
@@ -755,7 +755,7 @@ scan_buffer (register int target, EMACS_INT start, EMACS_INT end,
         /* Consult the newline cache, if appropriate.  */
         if (target == '\n' && newline_cache)
           {
-            EMACS_INT next_change;
+            ptrdiff_t next_change;
             immediate_quit = 0;
             while (region_cache_backward
                    (current_buffer, newline_cache, start_byte, &next_change))
@@ -2640,15 +2640,17 @@ since only regular expressions have distinguished subexpressions.  */)
      perform substitution on the replacement string.  */
   if (NILP (literal))
     {
-      EMACS_INT length = SBYTES (newtext);
+      ptrdiff_t length = SBYTES (newtext);
       unsigned char *substed;
-      EMACS_INT substed_alloc_size, substed_len;
+      ptrdiff_t substed_alloc_size, substed_len;
       int buf_multibyte = !NILP (BVAR (current_buffer, enable_multibyte_characters));
       int str_multibyte = STRING_MULTIBYTE (newtext);
       int really_changed = 0;
 
-      substed_alloc_size = length * 2 + 100;
-      substed = (unsigned char *) xmalloc (substed_alloc_size + 1);
+      substed_alloc_size = ((STRING_BYTES_BOUND - 100) / 2 < length
+                            ? STRING_BYTES_BOUND
+                            : length * 2 + 100);
+      substed = (unsigned char *) xmalloc (substed_alloc_size);
       substed_len = 0;
 
       /* Go thru NEWTEXT, producing the actual text to insert in
@@ -2659,7 +2661,7 @@ since only regular expressions have distinguished subexpressions.  */)
         {
           unsigned char str[MAX_MULTIBYTE_LENGTH];
           const unsigned char *add_stuff = NULL;
-          EMACS_INT add_len = 0;
+          ptrdiff_t add_len = 0;
           int idx = -1;
 
           if (str_multibyte)
@@ -2723,7 +2725,7 @@ since only regular expressions have distinguished subexpressions.  */)
              set up ADD_STUFF and ADD_LEN to point to it.  */
           if (idx >= 0)
             {
-              EMACS_INT begbyte = CHAR_TO_BYTE (search_regs.start[idx]);
+              ptrdiff_t begbyte = CHAR_TO_BYTE (search_regs.start[idx]);
               add_len = CHAR_TO_BYTE (search_regs.end[idx]) - begbyte;
               if (search_regs.start[idx] < GPT && GPT < search_regs.end[idx])
                 move_gap (search_regs.start[idx]);
@@ -2734,12 +2736,11 @@ since only regular expressions have distinguished subexpressions.  */)
              is invariably ADD_LEN bytes starting at ADD_STUFF.  */
 
           /* Make sure SUBSTED is big enough.  */
-          if (substed_len + add_len >= substed_alloc_size)
-            {
-              substed_alloc_size = substed_len + add_len + 500;
-              substed = (unsigned char *) xrealloc (substed,
-                                                    substed_alloc_size + 1);
-            }
+          if (substed_alloc_size - substed_len < add_len)
+            substed =
+              xpalloc (substed, &substed_alloc_size,
+                       add_len - (substed_alloc_size - substed_len),
+                       STRING_BYTES_BOUND, 1);
 
           /* Now add to the end of SUBSTED.  */
           if (add_stuff)
@@ -2973,7 +2974,7 @@ LIST should have been created by calling `match-data' previously.
 If optional arg RESEAT is non-nil, make markers on LIST point nowhere.  */)
   (register Lisp_Object list, Lisp_Object reseat)
 {
-  register int i;
+  ptrdiff_t i;
   register Lisp_Object marker;
 
   if (running_asynch_code)
@@ -2987,31 +2988,21 @@ If optional arg RESEAT is non-nil, make markers on LIST point nowhere.  */)
 
   /* Allocate registers if they don't already exist.  */
   {
-    int length = XFASTINT (Flength (list)) / 2;
+    ptrdiff_t length = XFASTINT (Flength (list)) / 2;
 
     if (length > search_regs.num_regs)
       {
-        if (search_regs.num_regs == 0)
-          {
-            search_regs.start
-              = (regoff_t *) xmalloc (length * sizeof (regoff_t));
-            search_regs.end
-              = (regoff_t *) xmalloc (length * sizeof (regoff_t));
-          }
-        else
-          {
-            search_regs.start
-              = (regoff_t *) xrealloc (search_regs.start,
-                                       length * sizeof (regoff_t));
-            search_regs.end
-              = (regoff_t *) xrealloc (search_regs.end,
-                                       length * sizeof (regoff_t));
-          }
-
-        for (i = search_regs.num_regs; i < length; i++)
+        ptrdiff_t num_regs = search_regs.num_regs;
+        search_regs.start =
+          xpalloc (search_regs.start, &num_regs, length - num_regs,
+                   min (PTRDIFF_MAX, UINT_MAX), sizeof (regoff_t));
+        search_regs.end =
+          xrealloc (search_regs.end, num_regs * sizeof (regoff_t));
+
+        for (i = search_regs.num_regs; i < num_regs; i++)
           search_regs.start[i] = -1;
 
-        search_regs.num_regs = length;
+        search_regs.num_regs = num_regs;
       }
 
     for (i = 0; CONSP (list); i++)
diff --git a/src/sysdep.c b/src/sysdep.c
index 4bd1f54b9e6..57fff94f552 100644
--- a/src/sysdep.c
+++ b/src/sysdep.c
@@ -2640,7 +2640,7 @@ system_process_attributes (Lisp_Object pid)
   ssize_t nread;
   const char *cmd = NULL;
   char *cmdline = NULL;
-  size_t cmdsize = 0, cmdline_size;
+  ptrdiff_t cmdsize = 0, cmdline_size;
   unsigned char c;
   int proc_id, ppid, uid, gid, pgrp, sess, tty, tpgid, thcount;
   unsigned long long u_time, s_time, cutime, cstime, start;
@@ -2822,8 +2822,10 @@ system_process_attributes (Lisp_Object pid)
   if (fd >= 0)
     {
       char ch;
-      for (cmdline_size = 0; emacs_read (fd, &ch, 1) == 1; cmdline_size++)
+      for (cmdline_size = 0; cmdline_size < STRING_BYTES_BOUND; cmdline_size++)
         {
+          if (emacs_read (fd, &ch, 1) != 1)
+            break;
           c = ch;
           if (isspace (c) || c == '\\')
             cmdline_size++;     /* for later quoting, see below */
@@ -2844,7 +2846,7 @@ system_process_attributes (Lisp_Object pid)
               nread = 0;
             }
           /* We don't want trailing null characters.  */
-          for (p = cmdline + nread - 1; p > cmdline && !*p; p--)
+          for (p = cmdline + nread; p > cmdline + 1 && !p[-1]; p--)
             nread--;
           for (p = cmdline; p < cmdline + nread; p++)
             {
diff --git a/src/term.c b/src/term.c
index 22056451cb9..f3bf3a947cb 100644
--- a/src/term.c
+++ b/src/term.c
@@ -136,10 +136,6 @@ enum no_color_bit
 
 static int max_frame_cols;
 
-/* The largest frame height in any call to calculate_costs.  */
-
-static int max_frame_lines;
-
 /* Non-zero if we have dropped our controlling tty and therefore
    should not open a frame on stdout. */
 static int no_controlling_tty;
@@ -497,8 +493,8 @@ tty_clear_end_of_line (struct frame *f, int first_unused_hpos)
 static unsigned char *encode_terminal_src;
 static unsigned char *encode_terminal_dst;
 /* Allocated sizes of the above buffers.  */
-static int encode_terminal_src_size;
-static int encode_terminal_dst_size;
+static ptrdiff_t encode_terminal_src_size;
+static ptrdiff_t encode_terminal_dst_size;
 
 /* Encode SRC_LEN glyphs starting at SRC to terminal output codes.
    Set CODING->produced to the byte-length of the resulting byte
@@ -509,8 +505,8 @@ encode_terminal_code (struct glyph *src, int src_len, struct coding_system *codi
 {
   struct glyph *src_end = src + src_len;
   unsigned char *buf;
-  int nchars, nbytes, required;
-  register int tlen = GLYPH_TABLE_LENGTH;
+  ptrdiff_t nchars, nbytes, required;
+  ptrdiff_t tlen = GLYPH_TABLE_LENGTH;
   register Lisp_Object *tbase = GLYPH_TABLE_BASE;
   Lisp_Object charset_list;
 
@@ -518,13 +514,13 @@ encode_terminal_code (struct glyph *src, int src_len, struct coding_system *codi
      multibyte-form.  But, it may be enlarged on demand if
      Vglyph_table contains a string or a composite glyph is
      encountered.  */
-  required = MAX_MULTIBYTE_LENGTH * src_len;
+  if (min (PTRDIFF_MAX, SIZE_MAX) / MAX_MULTIBYTE_LENGTH < src_len)
+    memory_full (SIZE_MAX);
+  required = src_len;
+  required *= MAX_MULTIBYTE_LENGTH;
   if (encode_terminal_src_size < required)
     {
-      if (encode_terminal_src)
-        encode_terminal_src = xrealloc (encode_terminal_src, required);
-      else
-        encode_terminal_src = xmalloc (required);
+      encode_terminal_src = xrealloc (encode_terminal_src, required);
       encode_terminal_src_size = required;
     }
 
@@ -544,19 +540,21 @@ encode_terminal_code (struct glyph *src, int src_len, struct coding_system *codi
           if (src->u.cmp.automatic)
             {
               gstring = composition_gstring_from_id (src->u.cmp.id);
-              required = src->slice.cmp.to + 1 - src->slice.cmp.from;
+              required = src->slice.cmp.to - src->slice.cmp.from + 1;
             }
           else
             {
               cmp = composition_table[src->u.cmp.id];
-              required = MAX_MULTIBYTE_LENGTH * cmp->glyph_len;
+              required = cmp->glyph_len;
+              required *= MAX_MULTIBYTE_LENGTH;
             }
 
-          if (encode_terminal_src_size < nbytes + required)
+          if (encode_terminal_src_size - nbytes < required)
             {
-              encode_terminal_src_size = nbytes + required;
-              encode_terminal_src = xrealloc (encode_terminal_src,
-                                              encode_terminal_src_size);
+              encode_terminal_src =
+                xpalloc (encode_terminal_src, &encode_terminal_src_size,
+                         required - (encode_terminal_src_size - nbytes),
+                         -1, 1);
               buf = encode_terminal_src + nbytes;
             }
 
@@ -627,11 +625,11 @@ encode_terminal_code (struct glyph *src, int src_len, struct coding_system *codi
           if (NILP (string))
             {
               nbytes = buf - encode_terminal_src;
-              if (encode_terminal_src_size < nbytes + MAX_MULTIBYTE_LENGTH)
+              if (encode_terminal_src_size - nbytes < MAX_MULTIBYTE_LENGTH)
                 {
-                  encode_terminal_src_size = nbytes + MAX_MULTIBYTE_LENGTH;
-                  encode_terminal_src = xrealloc (encode_terminal_src,
-                                                  encode_terminal_src_size);
+                  encode_terminal_src =
+                    xpalloc (encode_terminal_src, &encode_terminal_src_size,
+                             MAX_MULTIBYTE_LENGTH, -1, 1);
                   buf = encode_terminal_src + nbytes;
                 }
               if (CHAR_BYTE8_P (c)
@@ -659,11 +657,13 @@ encode_terminal_code (struct glyph *src, int src_len, struct coding_system *codi
               if (! STRING_MULTIBYTE (string))
                 string = string_to_multibyte (string);
               nbytes = buf - encode_terminal_src;
-              if (encode_terminal_src_size < nbytes + SBYTES (string))
+              if (encode_terminal_src_size - nbytes < SBYTES (string))
                 {
-                  encode_terminal_src_size = nbytes + SBYTES (string);
-                  encode_terminal_src = xrealloc (encode_terminal_src,
-                                                  encode_terminal_src_size);
+                  encode_terminal_src =
+                    xpalloc (encode_terminal_src, &encode_terminal_src_size,
+                             (SBYTES (string)
+                              - (encode_terminal_src_size - nbytes)),
+                             -1, 1);
                   buf = encode_terminal_src + nbytes;
                 }
               memcpy (buf, SDATA (string), SBYTES (string));
@@ -684,12 +684,9 @@ encode_terminal_code (struct glyph *src, int src_len, struct coding_system *codi
   coding->source = encode_terminal_src;
   if (encode_terminal_dst_size == 0)
     {
+      encode_terminal_dst = xrealloc (encode_terminal_dst,
+                                      encode_terminal_src_size);
       encode_terminal_dst_size = encode_terminal_src_size;
-      if (encode_terminal_dst)
-        encode_terminal_dst = xrealloc (encode_terminal_dst,
-                                        encode_terminal_dst_size);
-      else
-        encode_terminal_dst = xmalloc (encode_terminal_dst_size);
     }
   coding->destination = encode_terminal_dst;
   coding->dst_bytes = encode_terminal_dst_size;
@@ -1156,21 +1153,17 @@ calculate_costs (struct frame *frame)
          char_ins_del_vector (i.e., char_ins_del_cost) isn't used because
          X turns off char_ins_del_ok. */
 
-      max_frame_lines = max (max_frame_lines, FRAME_LINES (frame));
       max_frame_cols = max (max_frame_cols, FRAME_COLS (frame));
+      if ((min (PTRDIFF_MAX, SIZE_MAX) / sizeof (int) - 1) / 2
+          < max_frame_cols)
+        memory_full (SIZE_MAX);
 
-      if (char_ins_del_vector != 0)
-        char_ins_del_vector
-          = (int *) xrealloc (char_ins_del_vector,
-                              (sizeof (int)
-                               + 2 * max_frame_cols * sizeof (int)));
-      else
-        char_ins_del_vector
-          = (int *) xmalloc (sizeof (int)
-                             + 2 * max_frame_cols * sizeof (int));
+      char_ins_del_vector =
+        xrealloc (char_ins_del_vector,
+                  (sizeof (int) + 2 * sizeof (int) * max_frame_cols));
 
       memset (char_ins_del_vector, 0,
-              (sizeof (int) + 2 * max_frame_cols * sizeof (int)));
+              (sizeof (int) + 2 * sizeof (int) * max_frame_cols));
 
 
       if (f && (!tty->TS_ins_line && !tty->TS_del_line))
diff --git a/src/termcap.c b/src/termcap.c
index 96b9303d62d..6f24817fa72 100644
--- a/src/termcap.c
+++ b/src/termcap.c
@@ -480,7 +480,7 @@ tgetent (char *bp, const char *name)
       /* If BP is malloc'd by us, make sure it is big enough.  */
       if (malloc_size)
         {
-          int offset1 = bp1 - bp, offset2 = tc_search_point - bp;
+          ptrdiff_t offset1 = bp1 - bp, offset2 = tc_search_point - bp;
           malloc_size = offset1 + buf.size;
           bp = termcap_name = (char *) xrealloc (bp, malloc_size);
           bp1 = termcap_name + offset1;
@@ -619,7 +619,6 @@ gobble_line (int fd, register struct termcap_buffer *bufp, char *append_end)
   register char *end;
   register int nread;
   register char *buf = bufp->beg;
-  register char *tem;
 
   if (!append_end)
     append_end = bufp->ptr;
@@ -636,14 +635,14 @@ gobble_line (int fd, register struct termcap_buffer *bufp, char *append_end)
         {
           if (bufp->full == bufp->size)
             {
-              if ((PTRDIFF_MAX - 1) / 2 < bufp->size)
-                memory_full (SIZE_MAX);
-              bufp->size *= 2;
+              ptrdiff_t ptr_offset = bufp->ptr - buf;
+              ptrdiff_t append_end_offset = append_end - buf;
               /* Add 1 to size to ensure room for terminating null.  */
-              tem = (char *) xrealloc (buf, bufp->size + 1);
-              bufp->ptr = (bufp->ptr - buf) + tem;
-              append_end = (append_end - buf) + tem;
-              bufp->beg = buf = tem;
+              ptrdiff_t size = bufp->size + 1;
+              bufp->beg = buf = xpalloc (buf, &size, 1, -1, 1);
+              bufp->size = size - 1;
+              bufp->ptr = buf + ptr_offset;
+              append_end = buf + append_end_offset;
             }
         }
       else
diff --git a/src/termhooks.h b/src/termhooks.h
index 1310fba2f0a..a025e2798d9 100644
--- a/src/termhooks.h
+++ b/src/termhooks.h
@@ -291,12 +291,12 @@ enum {
   /* The next four modifier bits are used also in keyboard events at
      the Lisp level.
 
-     It's probably not the greatest idea to use the 2^23 bit for any
+     It's probably not the greatest idea to use the 2^28 bit for any
      modifier.  It may or may not be the sign bit, depending on
-     VALBITS, so using it to represent a modifier key means that
+     FIXNUM_BITS, so using it to represent a modifier key means that
      characters thus modified have different integer equivalents
      depending on the architecture they're running on.  Oh, and
-     applying XINT to a character whose 2^23 bit is set sign-extends
+     applying XINT to a character whose 2^28 bit is set might sign-extend
      it, so you get a bunch of bits in the mask you didn't want.
 
      The CHAR_ macros are defined in lisp.h.  */
diff --git a/src/tparam.c b/src/tparam.c
index ed28cd7397f..ac21667d65b 100644
--- a/src/tparam.c
+++ b/src/tparam.c
@@ -79,24 +79,25 @@ tparam1 (const char *string, char *outstring, int len,
   register const char *p = string;
   register char *op = outstring;
   char *outend;
-  int outlen = 0;
+  char *new = 0;
+  ptrdiff_t outlen = 0;
 
   register int tem;
   int *old_argp = argp;                 /* can move */
   int *fixed_argp = argp;               /* never moves */
   int explicit_param_p = 0;             /* set by %p */
-  int doleft = 0;
-  int doup = 0;
+  ptrdiff_t doleft = 0;
+  ptrdiff_t doup = 0;
+  ptrdiff_t append_len = 0;
 
   outend = outstring + len;
 
   while (1)
     {
       /* If the buffer might be too short, make it bigger.  */
-      if (op + 5 >= outend)
+      while (outend - op - append_len <= 5)
         {
-          register char *new;
-          int offset = op - outstring;
+          ptrdiff_t offset = op - outstring;
 
           if (outlen == 0)
             {
@@ -106,8 +107,7 @@ tparam1 (const char *string, char *outstring, int len,
             }
           else
             {
-              outlen *= 2;
-              new = (char *) xrealloc (outstring, outlen);
+              new = xpalloc (outstring, &outlen, 1, -1, 1);
             }
 
           op = new + offset;
@@ -167,11 +167,15 @@ tparam1 (const char *string, char *outstring, int len,
                      and this is one of them, increment it.  */
                   while (tem == 0 || tem == '\n' || tem == '\t')
                     {
+                      ptrdiff_t append_len_incr;
                       tem++;
                       if (argp == old_argp)
-                        doup++, outend -= strlen (up);
+                        doup++, append_len_incr = strlen (up);
                       else
-                        doleft++, outend -= strlen (left);
+                        doleft++, append_len_incr = strlen (left);
+                      if (INT_ADD_OVERFLOW (append_len, append_len_incr))
+                        memory_full (SIZE_MAX);
+                      append_len += append_len_incr;
                     }
                 }
               *op++ = tem ? tem : 0200;
@@ -273,7 +277,7 @@ main (int argc, char **argv)
   args[0] = atoi (argv[2]);
   args[1] = atoi (argv[3]);
   args[2] = atoi (argv[4]);
-  tparam1 (argv[1], buf, "LEFT", "UP", args);
+  tparam1 (argv[1], buf, 50, "LEFT", "UP", args);
   printf ("%s\n", buf);
   return 0;
 }
diff --git a/src/window.c b/src/window.c
index c7a4e1872fc..c8266696b2d 100644
--- a/src/window.c
+++ b/src/window.c
@@ -5074,7 +5074,7 @@ and redisplay normally--don't erase and redraw the frame.  */)
           && (!EQ (Vrecenter_redisplay, Qtty)
               || !NILP (Ftty_type (selected_frame))))
         {
-          int i;
+          ptrdiff_t i;
 
           /* Invalidate pixel data calculated for all compositions.  */
           for (i = 0; i < n_compositions; i++)
diff --git a/src/xdisp.c b/src/xdisp.c
index 580bd59908b..7e06938b3d3 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -2483,10 +2483,7 @@ init_iterator (struct it *it, struct window *w,
   else if (INTEGERP (w->redisplay_end_trigger))
     it->redisplay_end_trigger_charpos = XINT (w->redisplay_end_trigger);
 
-  /* Correct bogus values of tab_width.  */
-  it->tab_width = XINT (BVAR (current_buffer, tab_width));
-  if (it->tab_width <= 0 || it->tab_width > 1000)
-    it->tab_width = 8;
+  it->tab_width = SANE_TAB_WIDTH (current_buffer);
 
   /* Are lines in the display truncated?  */
   if (base_face_id != DEFAULT_FACE_ID
@@ -3151,11 +3148,15 @@ next_overlay_change (EMACS_INT pos)
    text property whose value is a string.  STRING is data about the
    string to iterate; if STRING->lstring is nil, we are iterating a
    buffer.  FRAME_WINDOW_P is non-zero when we are displaying a window
-   on a GUI frame.  */
+   on a GUI frame.  DISP_PROP is set to zero if we searched
+   MAX_DISP_SCAN characters forward without finding any display
+   strings, non-zero otherwise.  It is set to 2 if the display string
+   uses any kind of `(space ...)' spec that will produce a stretch of
+   white space in the text area.  */
 EMACS_INT
 compute_display_string_pos (struct text_pos *position,
                             struct bidi_string_data *string,
-                            int frame_window_p, int *disp_prop_p)
+                            int frame_window_p, int *disp_prop)
 {
   /* OBJECT = nil means current buffer.  */
   Lisp_Object object =
@@ -3168,8 +3169,9 @@ compute_display_string_pos (struct text_pos *position,
   EMACS_INT lim =
     (charpos < eob - MAX_DISP_SCAN) ? charpos + MAX_DISP_SCAN : eob;
   struct text_pos tpos;
+  int rv = 0;
 
-  *disp_prop_p = 1;
+  *disp_prop = 1;
 
   if (charpos >= eob
       /* We don't support display properties whose values are strings
@@ -3178,7 +3180,7 @@ compute_display_string_pos (struct text_pos *position,
       /* C strings cannot have display properties.  */
       || (string->s && !STRINGP (object)))
     {
-      *disp_prop_p = 0;
+      *disp_prop = 0;
       return eob;
     }
 
@@ -3195,9 +3197,11 @@ compute_display_string_pos (struct text_pos *position,
           || !EQ (Fget_char_property (make_number (charpos - 1), Qdisplay,
                                       object),
                   spec))
-      && handle_display_spec (NULL, spec, object, Qnil, &tpos, bufpos,
-                              frame_window_p))
+      && (rv = handle_display_spec (NULL, spec, object, Qnil, &tpos, bufpos,
+                                    frame_window_p)))
     {
+      if (rv == 2)
+        *disp_prop = 2;
       return charpos;
     }
 
@@ -3209,7 +3213,7 @@ compute_display_string_pos (struct text_pos *position,
     CHARPOS (tpos) = XFASTINT (pos);
     if (CHARPOS (tpos) >= lim)
       {
-        *disp_prop_p = 0;
+        *disp_prop = 0;
         break;
       }
     if (STRINGP (object))
@@ -3220,8 +3224,10 @@ compute_display_string_pos (struct text_pos *position,
     if (!STRINGP (object))
       bufpos = CHARPOS (tpos);
   } while (NILP (spec)
-           || !handle_display_spec (NULL, spec, object, Qnil, &tpos, bufpos,
-                                    frame_window_p));
+           || !(rv = handle_display_spec (NULL, spec, object, Qnil, &tpos,
+                                          bufpos, frame_window_p)));
+  if (rv == 2)
+    *disp_prop = 2;
 
   return CHARPOS (tpos);
 }
@@ -4083,7 +4089,9 @@ handle_display_prop (struct it *it)
 /* Subroutine of handle_display_prop.  Returns non-zero if the display
    specification in SPEC is a replacing specification, i.e. it would
    replace the text covered by `display' property with something else,
-   such as an image or a display string.
+   such as an image or a display string.  If SPEC includes any kind or
+   `(space ...) specification, the value is 2; this is used by
+   compute_display_string_pos, which see.
 
    See handle_single_display_spec for documentation of arguments.
    frame_window_p is non-zero if the window being redisplayed is on a
@@ -4100,6 +4108,7 @@ handle_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
                      EMACS_INT bufpos, int frame_window_p)
 {
   int replacing_p = 0;
+  int rv;
 
   if (CONSP (spec)
       /* Simple specerties.  */
@@ -4121,11 +4130,11 @@ handle_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
     {
       for (; CONSP (spec); spec = XCDR (spec))
         {
-          if (handle_single_display_spec (it, XCAR (spec), object, overlay,
-                                          position, bufpos, replacing_p,
-                                          frame_window_p))
+          if ((rv = handle_single_display_spec (it, XCAR (spec), object,
+                                                overlay, position, bufpos,
+                                                replacing_p, frame_window_p)))
             {
-              replacing_p = 1;
+              replacing_p = rv;
               /* If some text in a string is replaced, `position' no
                  longer points to the position of `object'.  */
               if (!it || STRINGP (object))
@@ -4137,11 +4146,11 @@ handle_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
     {
       int i;
       for (i = 0; i < ASIZE (spec); ++i)
-        if (handle_single_display_spec (it, AREF (spec, i), object, overlay,
-                                        position, bufpos, replacing_p,
-                                        frame_window_p))
+        if ((rv = handle_single_display_spec (it, AREF (spec, i), object,
+                                              overlay, position, bufpos,
+                                              replacing_p, frame_window_p)))
           {
-            replacing_p = 1;
+            replacing_p = rv;
             /* If some text in a string is replaced, `position' no
                longer points to the position of `object'.  */
             if (!it || STRINGP (object))
@@ -4150,9 +4159,10 @@ handle_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
     }
   else
     {
-      if (handle_single_display_spec (it, spec, object, overlay,
-                                      position, bufpos, 0, frame_window_p))
-        replacing_p = 1;
+      if ((rv = handle_single_display_spec (it, spec, object, overlay,
+                                            position, bufpos, 0,
+                                            frame_window_p)))
+        replacing_p = rv;
     }
 
   return replacing_p;
@@ -4532,8 +4542,17 @@ handle_single_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
 
   if (valid_p && !display_replaced_p)
     {
+      int retval = 1;
+
       if (!it)
-        return 1;
+        {
+          /* Callers need to know whether the display spec is any kind
+             of `(space ...)' spec that is about to affect text-area
+             display.  */
+          if (CONSP (value) && EQ (XCAR (value), Qspace) && NILP (location))
+            retval = 2;
+          return retval;
+        }
 
       /* Save current settings of IT so that we can restore them
          when we are finished with the glyph property value.  */
@@ -4591,6 +4610,7 @@ handle_single_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
           it->method = GET_FROM_STRETCH;
           it->object = value;
           *position = it->position = start_pos;
+          retval = 1 + (it->area == TEXT_AREA);
         }
 #ifdef HAVE_XWIDGETS
       else if (XWIDGETP(value))
@@ -4621,7 +4641,7 @@ handle_single_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
         }
 #endif /* HAVE_WINDOW_SYSTEM */
 
-      return 1;
+      return retval;
     }
 
   /* Invalid property or property not supported.  Restore
@@ -5592,7 +5612,7 @@ forward_to_next_line_start (struct it *it, int *skipped_p,
               if (it->bidi_it.disp_pos < limit)
                 {
                   it->bidi_it.disp_pos = limit;
-                  it->bidi_it.disp_prop_p = 0;
+                  it->bidi_it.disp_prop = 0;
                 }
               do {
                 bprev = it->bidi_it;
@@ -10471,13 +10491,14 @@ static void
 store_mode_line_noprop_char (char c)
 {
   /* If output position has reached the end of the allocated buffer,
-     double the buffer's size.  */
+     increase the buffer's size.  */
   if (mode_line_noprop_ptr == mode_line_noprop_buf_end)
     {
-      int len = MODE_LINE_NOPROP_LEN (0);
-      int new_size = 2 * len * sizeof *mode_line_noprop_buf;
-      mode_line_noprop_buf = (char *) xrealloc (mode_line_noprop_buf, new_size);
-      mode_line_noprop_buf_end = mode_line_noprop_buf + new_size;
+      ptrdiff_t len = MODE_LINE_NOPROP_LEN (0);
+      ptrdiff_t size = len;
+      mode_line_noprop_buf =
+        xpalloc (mode_line_noprop_buf, &size, 1, STRING_BYTES_BOUND, 1);
+      mode_line_noprop_buf_end = mode_line_noprop_buf + size;
       mode_line_noprop_ptr = mode_line_noprop_buf + len;
     }
 
@@ -10539,9 +10560,9 @@ x_consider_frame_title (Lisp_Object frame)
       /* Do we have more than one visible frame on this X display?  */
       Lisp_Object tail;
       Lisp_Object fmt;
-      int title_start;
+      ptrdiff_t title_start;
       char *title;
-      int len;
+      ptrdiff_t len;
       struct it it;
       int count = SPECPDL_INDEX ();
 
@@ -14631,19 +14652,39 @@ try_cursor_movement (Lisp_Object window, struct text_pos startp, int *scroll_ste
 
               do
                 {
+                  int at_zv_p = 0, exact_match_p = 0;
+
                   if (MATRIX_ROW_START_CHARPOS (row) <= PT
                       && PT <= MATRIX_ROW_END_CHARPOS (row)
                       && cursor_row_p (row))
                     rv |= set_cursor_from_row (w, row, w->current_matrix,
                                                0, 0, 0, 0);
-                  /* As soon as we've found the first suitable row
-                     whose ends_at_zv_p flag is set, we are done.  */
-                  if (rv
-                      && MATRIX_ROW (w->current_matrix, w->cursor.vpos)->ends_at_zv_p)
+                  /* As soon as we've found the exact match for point,
+                     or the first suitable row whose ends_at_zv_p flag
+                     is set, we are done.  */
+                  at_zv_p =
+                    MATRIX_ROW (w->current_matrix, w->cursor.vpos)->ends_at_zv_p;
+                  if (!at_zv_p)
+                    {
+                      struct glyph_row *candidate =
+                        MATRIX_ROW (w->current_matrix, w->cursor.vpos);
+                      struct glyph *g =
+                        candidate->glyphs[TEXT_AREA] + w->cursor.hpos;
+                      EMACS_INT endpos = MATRIX_ROW_END_CHARPOS (candidate);
+
+                      exact_match_p =
+                        (BUFFERP (g->object) && g->charpos == PT)
+                        || (INTEGERP (g->object)
+                            && (g->charpos == PT
+                                || (g->charpos == 0 && endpos - 1 == PT)));
+                    }
+                  if (rv && (at_zv_p || exact_match_p))
                     {
                       rc = CURSOR_MOVEMENT_SUCCESS;
                       break;
                     }
+                  if (MATRIX_ROW_BOTTOM_Y (row) == last_y)
+                    break;
                   ++row;
                 }
               while (((MATRIX_ROW_CONTINUATION_LINE_P (row)
@@ -14655,7 +14696,9 @@ try_cursor_movement (Lisp_Object window, struct text_pos startp, int *scroll_ste
                  loop before all the candidates were examined, signal
                  to the caller that this method failed.  */
               if (rc != CURSOR_MOVEMENT_SUCCESS
-                  && (!rv || MATRIX_ROW_CONTINUATION_LINE_P (row)))
+                  && !(rv
+                       && !MATRIX_ROW_CONTINUATION_LINE_P (row)
+                       && !row->continued_p))
                 rc = CURSOR_MOVEMENT_MUST_SCROLL;
               else if (rv)
                 rc = CURSOR_MOVEMENT_SUCCESS;
@@ -15115,6 +15158,7 @@ redisplay_window (Lisp_Object window, int just_this_one_p)
                || (XFASTINT (w->last_modified) >= MODIFF
                    && XFASTINT (w->last_overlay_modified) >= OVERLAY_MODIFF)))
     {
+      int d1, d2, d3, d4, d5, d6;
 
       /* If first window line is a continuation line, and window start
          is inside the modified region, but the first change is before
@@ -15136,7 +15180,14 @@ redisplay_window (Lisp_Object window, int just_this_one_p)
              compute_window_start_on_continuation_line.  (See also
              bug#197).  */
           && XMARKER (w->start)->buffer == current_buffer
-          && compute_window_start_on_continuation_line (w))
+          && compute_window_start_on_continuation_line (w)
+          /* It doesn't make sense to force the window start like we
+             do at label force_start if it is already known that point
+             will not be visible in the resulting window, because
+             doing so will move point from its correct position
+             instead of scrolling the window to bring point into view.
+             See bug#9324.  */
+          && pos_visible_p (w, PT, &d1, &d2, &d3, &d4, &d5, &d6))
         {
           w->force_start = Qt;
           SET_TEXT_POS_FROM_MARKER (startp, w->start);
@@ -21456,7 +21507,7 @@ calc_pixel_width_or_height (double *res, struct it *it, Lisp_Object prop,
           if (FRAME_WINDOW_P (it->f)
               && valid_image_p (prop))
             {
-              int id = lookup_image (it->f, prop);
+              ptrdiff_t id = lookup_image (it->f, prop);
               struct image *img = IMAGE_FROM_ID (it->f, id);
 
               return OK_PIXELS (width_p ? img->width : img->height);
@@ -22363,7 +22414,7 @@ compute_overhangs_and_x (struct glyph_string *s, int x, int backward_p)
   do {                                                                      \
     int face_id = (row)->glyphs[area][START].face_id;                       \
     struct face *base_face = FACE_FROM_ID (f, face_id);                     \
-    int cmp_id = (row)->glyphs[area][START].u.cmp.id;                       \
+    ptrdiff_t cmp_id = (row)->glyphs[area][START].u.cmp.id;                 \
     struct composition *cmp = composition_table[cmp_id];                    \
     XChar2b *char2b;                                                        \
     struct glyph_string *first_s IF_LINT (= NULL);                          \
diff --git a/src/xfaces.c b/src/xfaces.c
index 52b86638a50..431ca07b8df 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -403,7 +403,7 @@ static int next_lface_id;
 /* A vector mapping Lisp face Id's to face names.  */
 
 static Lisp_Object *lface_id_to_name;
-static int lface_id_to_name_size;
+static ptrdiff_t lface_id_to_name_size;
 
 /* TTY color-related functions (defined in tty-colors.el).  */
 
@@ -2682,12 +2682,10 @@ Value is a vector of face attributes.  */)
          The mapping from Lisp face to Lisp face id is given by the
          property `face' of the Lisp face name.  */
       if (next_lface_id == lface_id_to_name_size)
-        {
-          int new_size = max (50, 2 * lface_id_to_name_size);
-          int sz = new_size * sizeof *lface_id_to_name;
-          lface_id_to_name = (Lisp_Object *) xrealloc (lface_id_to_name, sz);
-          lface_id_to_name_size = new_size;
-        }
+        lface_id_to_name =
+          xpalloc (lface_id_to_name, &lface_id_to_name_size, 1,
+                   min (INT_MAX, MOST_POSITIVE_FIXNUM),
+                   sizeof *lface_id_to_name);
 
       lface_id_to_name[next_lface_id] = face;
       Fput (face, Qface, make_number (next_lface_id));
@@ -4428,15 +4426,8 @@ cache_face (struct face_cache *c, struct face *face, unsigned int hash)
   if (i == c->used)
     {
       if (c->used == c->size)
-        {
-          int new_size, sz;
-          new_size = min (2 * c->size, MAX_FACE_ID);
-          if (new_size == c->size)
-            abort ();  /* Alternatives?  ++kfs */
-          sz = new_size * sizeof *c->faces_by_id;
-          c->faces_by_id = (struct face **) xrealloc (c->faces_by_id, sz);
-          c->size = new_size;
-        }
+        c->faces_by_id = xpalloc (c->faces_by_id, &c->size, 1, MAX_FACE_ID,
+                                  sizeof *c->faces_by_id);
       c->used++;
     }
 
diff --git a/src/xfns.c b/src/xfns.c
index eec19b9d275..9a3d5fcda83 100644
--- a/src/xfns.c
+++ b/src/xfns.c
@@ -145,7 +145,8 @@ static Lisp_Object Qcompound_text, Qcancel_timer;
 Lisp_Object Qfont_param;
 
 #if GLYPH_DEBUG
-static int image_cache_refcount, dpyinfo_refcount;
+static ptrdiff_t image_cache_refcount;
+static int dpyinfo_refcount;
 #endif
 
 #if defined (USE_GTK) && defined (HAVE_FREETYPE)
@@ -1470,7 +1471,8 @@ x_set_scroll_bar_background (struct frame *f, Lisp_Object value, Lisp_Object old
    the result should be `COMPOUND_TEXT'.  */
 
 static unsigned char *
-x_encode_text (Lisp_Object string, Lisp_Object coding_system, int selectionp, int *text_bytes, int *stringp, int *freep)
+x_encode_text (Lisp_Object string, Lisp_Object coding_system, int selectionp,
+               ptrdiff_t *text_bytes, int *stringp, int *freep)
 {
   int result = string_xstring_p (string);
   struct coding_system coding;
@@ -1488,8 +1490,8 @@ x_encode_text (Lisp_Object string, Lisp_Object coding_system, int selectionp, in
   coding.mode |= (CODING_MODE_SAFE_ENCODING | CODING_MODE_LAST_BLOCK);
   /* We suppress producing escape sequences for composition.  */
   coding.common_flags &= ~CODING_ANNOTATION_MASK;
+  coding.destination = xnmalloc (SCHARS (string), 2);
   coding.dst_bytes = SCHARS (string) * 2;
-  coding.destination = (unsigned char *) xmalloc (coding.dst_bytes);
   encode_coding_object (&coding, string, 0, 0,
                         SCHARS (string), SBYTES (string), Qnil);
   *text_bytes = coding.produced;
@@ -1511,7 +1513,8 @@ x_set_name_internal (FRAME_PTR f, Lisp_Object name)
       BLOCK_INPUT;
       {
         XTextProperty text, icon;
-        int bytes, stringp;
+        ptrdiff_t bytes;
+        int stringp;
         int do_free_icon_value = 0, do_free_text_value = 0;
         Lisp_Object coding_system;
         Lisp_Object encoded_name;
@@ -1550,6 +1553,8 @@ x_set_name_internal (FRAME_PTR f, Lisp_Object name)
                          : FRAME_X_DISPLAY_INFO (f)->Xatom_COMPOUND_TEXT);
         text.format = 8;
         text.nitems = bytes;
+        if (text.nitems != bytes)
+          error ("Window name too large");
 
         if (!STRINGP (f->icon_name))
           {
@@ -1565,6 +1570,8 @@ x_set_name_internal (FRAME_PTR f, Lisp_Object name)
                              : FRAME_X_DISPLAY_INFO (f)->Xatom_COMPOUND_TEXT);
             icon.format = 8;
             icon.nitems = bytes;
+            if (icon.nitems != bytes)
+              error ("Icon name too large");
 
             encoded_icon_name = ENCODE_UTF_8 (f->icon_name);
           }
@@ -4193,21 +4200,19 @@ FRAME.  Default is to change on the edit X window.  */)
 
   if (CONSP (value))
     {
+      ptrdiff_t elsize;
+
       nelements = x_check_property_data (value);
       if (nelements == -1)
         error ("Bad data in VALUE, must be number, string or cons");
 
-      if (element_format == 8)
-        data = (unsigned char *) xmalloc (nelements);
-      else if (element_format == 16)
-        data = (unsigned char *) xmalloc (nelements*2);
-      else /* format == 32 */
-        /* The man page for XChangeProperty:
-               "If the specified format is 32, the property data must be a
-                long array."
-           This applies even if long is more than 64 bits.  The X library
-           converts to 32 bits before sending to the X server.  */
-        data = (unsigned char *) xmalloc (nelements * sizeof(long));
+      /* The man page for XChangeProperty:
+             "If the specified format is 32, the property data must be a
+              long array."
+         This applies even if long is more than 32 bits.  The X library
+         converts to 32 bits before sending to the X server.  */
+      elsize = element_format == 32 ? sizeof (long) : element_format >> 3;
+      data = xnmalloc (nelements, elsize);
 
       x_fill_property_data (FRAME_X_DISPLAY (f), value, data, element_format);
     }
@@ -4215,7 +4220,9 @@ FRAME.  Default is to change on the edit X window.  */)
     {
       CHECK_STRING (value);
       data = SDATA (value);
-      nelements = SCHARS (value);
+      if (INT_MAX < SBYTES (value))
+        error ("VALUE too long");
+      nelements = SBYTES (value);
     }
 
   BLOCK_INPUT;
diff --git a/src/xgselect.c b/src/xgselect.c
index 9ccdd37489f..339ec475117 100644
--- a/src/xgselect.c
+++ b/src/xgselect.c
@@ -29,7 +29,7 @@ along with GNU Emacs.  If not, see <http§://www.gnu.org/licenses/>.  */
 #include <setjmp.h>
 
 static GPollFD *gfds;
-static int gfds_size;
+static ptrdiff_t gfds_size;
 
 int
 xg_select (int max_fds, SELECT_TYPE *rfds, SELECT_TYPE *wfds, SELECT_TYPE *efds,
@@ -54,10 +54,9 @@ xg_select (int max_fds, SELECT_TYPE *rfds, SELECT_TYPE *wfds, SELECT_TYPE *efds,
   do {
     if (n_gfds > gfds_size)
       {
-        while (n_gfds > gfds_size)
-          gfds_size *= 2;
         xfree (gfds);
-        gfds = xmalloc (sizeof (*gfds) * gfds_size);
+        gfds = xpalloc (0, &gfds_size, n_gfds - gfds_size, INT_MAX,
+                        sizeof *gfds);
       }
 
     n_gfds = g_main_context_query (context,
diff --git a/src/xrdb.c b/src/xrdb.c
index 6a16e3260bd..63f06738b98 100644
--- a/src/xrdb.c
+++ b/src/xrdb.c
@@ -426,24 +426,22 @@ get_environ_db (void)
 {
   XrmDatabase db;
   char *p;
-  char *path = 0, *home = 0;
-  const char *host;
+  char *path = 0;
 
   if ((p = getenv ("XENVIRONMENT")) == NULL)
     {
-      home = gethomedir ();
-      host = get_system_name ();
-      path = (char *) xmalloc (strlen (home)
-                              + sizeof (".Xdefaults-")
-                              + strlen (host));
-      sprintf (path, "%s%s%s", home, ".Xdefaults-", host);
+      static char const xdefaults[] = ".Xdefaults-";
+      char *home = gethomedir ();
+      char const *host = get_system_name ();
+      ptrdiff_t pathsize = strlen (home) + sizeof xdefaults + strlen (host);
+      path = (char *) xrealloc (home, pathsize);
+      strcat (strcat (path, xdefaults), host);
       p = path;
     }
 
   db = XrmGetFileDatabase (p);
 
   xfree (path);
-  xfree (home);
 
   return db;
 }
diff --git a/src/xselect.c b/src/xselect.c
index f63977a73de..77bda79007c 100644
--- a/src/xselect.c
+++ b/src/xselect.c
@@ -66,22 +66,15 @@ static Lisp_Object wait_for_property_change_unwind (Lisp_Object);
 static void wait_for_property_change (struct prop_location *);
 static Lisp_Object x_get_foreign_selection (Lisp_Object, Lisp_Object,
                                             Lisp_Object, Lisp_Object);
-static void x_get_window_property (Display *, Window, Atom,
-                                   unsigned char **, int *,
-                                   Atom *, int *, unsigned long *, int);
-static void receive_incremental_selection (Display *, Window, Atom,
-                                           Lisp_Object, unsigned,
-                                           unsigned char **, int *,
-                                           Atom *, int *, unsigned long *);
 static Lisp_Object x_get_window_property_as_lisp_data (Display *,
                                                        Window, Atom,
                                                        Lisp_Object, Atom);
 static Lisp_Object selection_data_to_lisp_data (Display *,
                                                 const unsigned char *,
-                                                int, Atom, int);
+                                                ptrdiff_t, Atom, int);
 static void lisp_data_to_selection_data (Display *, Lisp_Object,
                                          unsigned char **, Atom *,
-                                         unsigned *, int *, int *);
+                                         ptrdiff_t *, int *, int *);
 static Lisp_Object clean_local_selection_data (Lisp_Object);
 
 /* Printing traces to stderr.  */
@@ -114,15 +107,39 @@ static Lisp_Object Qcompound_text_with_extensions;
 static Lisp_Object Qforeign_selection;
 static Lisp_Object Qx_lost_selection_functions, Qx_sent_selection_functions;
 
+/* Bytes needed to represent 'long' data.  This is as per libX11; it
+   is not necessarily sizeof (long).  */
+#define X_LONG_SIZE 4
+
+/* Extreme 'short' and 'long' values suitable for libX11.  */
+#define X_SHRT_MAX 0x7fff
+#define X_SHRT_MIN (-1 - X_SHRT_MAX)
+#define X_LONG_MAX 0x7fffffff
+#define X_LONG_MIN (-1 - X_LONG_MAX)
+
 /* If this is a smaller number than the max-request-size of the display,
    emacs will use INCR selection transfer when the selection is larger
    than this.  The max-request-size is usually around 64k, so if you want
    emacs to use incremental selection transfers when the selection is
    smaller than that, set this.  I added this mostly for debugging the
-   incremental transfer stuff, but it might improve server performance.  */
-#define MAX_SELECTION_QUANTUM 0xFFFFFF
+   incremental transfer stuff, but it might improve server performance.
 
-#define SELECTION_QUANTUM(dpy) ((XMaxRequestSize(dpy) << 2) - 100)
+   This value cannot exceed INT_MAX / max (X_LONG_SIZE, sizeof (long))
+   because it is multiplied by X_LONG_SIZE and by sizeof (long) in
+   subscript calculations.  Similarly for PTRDIFF_MAX - 1 or SIZE_MAX
+   - 1 in place of INT_MAX.  */
+#define MAX_SELECTION_QUANTUM                                           \
+  ((int) min (0xFFFFFF, (min (INT_MAX, min (PTRDIFF_MAX, SIZE_MAX) - 1) \
+                         / max (X_LONG_SIZE, sizeof (long)))))
+
+static int
+selection_quantum (Display *display)
+{
+  long mrs = XMaxRequestSize (display);
+  return (mrs < MAX_SELECTION_QUANTUM / X_LONG_SIZE + 25
+          ? (mrs - 25) * X_LONG_SIZE
+          : MAX_SELECTION_QUANTUM);
+}
 
 #define LOCAL_SELECTION(selection_symbol,dpyinfo)                       \
   assq_no_quit (selection_symbol, dpyinfo->terminal->Vselection_alist)
@@ -477,7 +494,7 @@ static struct x_display_info *selection_request_dpyinfo;
 struct selection_data
 {
   unsigned char *data;
-  unsigned int size;
+  ptrdiff_t size;
   int format;
   Atom type;
   int nofree;
@@ -581,14 +598,11 @@ x_reply_selection_request (struct input_event *event, struct x_display_info *dpy
   XSelectionEvent *reply = &(reply_base.xselection);
   Display *display = SELECTION_EVENT_DISPLAY (event);
   Window window = SELECTION_EVENT_REQUESTOR (event);
-  int bytes_remaining;
-  int max_bytes = SELECTION_QUANTUM (display);
+  ptrdiff_t bytes_remaining;
+  int max_bytes = selection_quantum (display);
   int count = SPECPDL_INDEX ();
   struct selection_data *cs;
 
-  if (max_bytes > MAX_SELECTION_QUANTUM)
-    max_bytes = MAX_SELECTION_QUANTUM;
-
   reply->type = SelectionNotify;
   reply->display = display;
   reply->requestor = window;
@@ -616,11 +630,12 @@ x_reply_selection_request (struct input_event *event, struct x_display_info *dpy
       if (cs->property == None)
         continue;
 
-      bytes_remaining = cs->size * (cs->format / 8);
+      bytes_remaining = cs->size;
+      bytes_remaining *= cs->format >> 3;
       if (bytes_remaining <= max_bytes)
         {
           /* Send all the data at once, with minimal handshaking.  */
-          TRACE1 ("Sending all %d bytes", bytes_remaining);
+          TRACE1 ("Sending all %"pD"d bytes", bytes_remaining);
           XChangeProperty (display, window, cs->property,
                            cs->type, cs->format, PropModeReplace,
                            cs->data, cs->size);
@@ -630,7 +645,7 @@ x_reply_selection_request (struct input_event *event, struct x_display_info *dpy
           /* Send an INCR tag to initiate incremental transfer.  */
           long value[1];
 
-          TRACE2 ("Start sending %d bytes incrementally (%s)",
+          TRACE2 ("Start sending %"pD"d bytes incrementally (%s)",
                   bytes_remaining, XGetAtomName (display, cs->property));
           cs->wait_object
             = expect_property_change (display, window, cs->property,
@@ -638,7 +653,7 @@ x_reply_selection_request (struct input_event *event, struct x_display_info *dpy
 
           /* XChangeProperty expects an array of long even if long is
              more than 32 bits.  */
-          value[0] = bytes_remaining;
+          value[0] = min (bytes_remaining, X_LONG_MAX);
           XChangeProperty (display, window, cs->property,
                            dpyinfo->Xatom_INCR, 32, PropModeReplace,
                            (unsigned char *) value, 1);
@@ -672,7 +687,8 @@ x_reply_selection_request (struct input_event *event, struct x_display_info *dpy
         int had_errors = x_had_errors_p (display);
         UNBLOCK_INPUT;
 
-        bytes_remaining = cs->size * format_bytes;
+        bytes_remaining = cs->size;
+        bytes_remaining *= format_bytes;
 
         /* Wait for the requester to ack by deleting the property.
            This can run Lisp code (process handlers) or signal.  */
@@ -810,7 +826,7 @@ x_handle_selection_request (struct input_event *event)
          non-None property.  */
       Window requestor = SELECTION_EVENT_REQUESTOR (event);
       Lisp_Object multprop;
-      int j, nselections;
+      ptrdiff_t j, nselections;
 
       if (property == None) goto DONE;
       multprop
@@ -1269,19 +1285,28 @@ x_get_foreign_selection (Lisp_Object selection_symbol, Lisp_Object target_type,
 
 static void
 x_get_window_property (Display *display, Window window, Atom property,
-                       unsigned char **data_ret, int *bytes_ret,
+                       unsigned char **data_ret, ptrdiff_t *bytes_ret,
                        Atom *actual_type_ret, int *actual_format_ret,
                        unsigned long *actual_size_ret, int delete_p)
 {
-  int total_size;
+  ptrdiff_t total_size;
   unsigned long bytes_remaining;
-  int offset = 0;
+  ptrdiff_t offset = 0;
+  unsigned char *data = 0;
   unsigned char *tmp_data = 0;
   int result;
-  int buffer_size = SELECTION_QUANTUM (display);
+  int buffer_size = selection_quantum (display);
+
+  /* Wide enough to avoid overflow in expressions using it.  */
+  ptrdiff_t x_long_size = X_LONG_SIZE;
 
-  if (buffer_size > MAX_SELECTION_QUANTUM)
-    buffer_size = MAX_SELECTION_QUANTUM;
+  /* Maximum value for TOTAL_SIZE.  It cannot exceed PTRDIFF_MAX - 1
+     and SIZE_MAX - 1, for an extra byte at the end.  And it cannot
+     exceed LONG_MAX * X_LONG_SIZE, for XGetWindowProperty.  */
+  ptrdiff_t total_size_max =
+    ((min (PTRDIFF_MAX, SIZE_MAX) - 1) / x_long_size < LONG_MAX
+     ? min (PTRDIFF_MAX, SIZE_MAX) - 1
+     : LONG_MAX * x_long_size);
 
   BLOCK_INPUT;
 
@@ -1292,49 +1317,44 @@ x_get_window_property (Display *display, Window window, Atom property,
                                actual_size_ret,
                                &bytes_remaining, &tmp_data);
   if (result != Success)
-    {
-      UNBLOCK_INPUT;
-      *data_ret = 0;
-      *bytes_ret = 0;
-      return;
-    }
+    goto done;
 
   /* This was allocated by Xlib, so use XFree.  */
   XFree ((char *) tmp_data);
 
   if (*actual_type_ret == None || *actual_format_ret == 0)
-    {
-      UNBLOCK_INPUT;
-      return;
-    }
+    goto done;
 
-  total_size = bytes_remaining + 1;
-  *data_ret = (unsigned char *) xmalloc (total_size);
+  if (total_size_max < bytes_remaining)
+    goto size_overflow;
+  total_size = bytes_remaining;
+  data = malloc (total_size + 1);
+  if (! data)
+    goto memory_exhausted;
 
   /* Now read, until we've gotten it all.  */
   while (bytes_remaining)
     {
-#ifdef TRACE_SELECTION
-      unsigned long last = bytes_remaining;
-#endif
+      ptrdiff_t bytes_gotten;
+      int bytes_per_item;
       result
         = XGetWindowProperty (display, window, property,
-                              (long)offset/4, (long)buffer_size/4,
+                              offset / X_LONG_SIZE,
+                              buffer_size / X_LONG_SIZE,
                               False,
                               AnyPropertyType,
                               actual_type_ret, actual_format_ret,
                               actual_size_ret, &bytes_remaining, &tmp_data);
 
-      TRACE2 ("Read %lu bytes from property %s",
-              last - bytes_remaining,
-              XGetAtomName (display, property));
-
       /* If this doesn't return Success at this point, it means that
          some clod deleted the selection while we were in the midst of
          reading it.  Deal with that, I guess.... */
       if (result != Success)
         break;
 
+      bytes_per_item = *actual_format_ret >> 3;
+      xassert (*actual_size_ret <= buffer_size / bytes_per_item);
+
       /* The man page for XGetWindowProperty says:
          "If the returned format is 32, the returned data is represented
           as a long array and should be cast to that type to obtain the
@@ -1348,32 +1368,61 @@ x_get_window_property (Display *display, Window window, Atom property,
          The bytes and offsets passed to XGetWindowProperty refers to the
          property and those are indeed in 32 bit quantities if format is 32.  */
 
+      bytes_gotten = *actual_size_ret;
+      bytes_gotten *= bytes_per_item;
+
+      TRACE2 ("Read %"pD"d bytes from property %s",
+              bytes_gotten, XGetAtomName (display, property));
+
+      if (total_size - offset < bytes_gotten)
+        {
+          unsigned char *data1;
+          ptrdiff_t remaining_lim = total_size_max - offset - bytes_gotten;
+          if (remaining_lim < 0 || remaining_lim < bytes_remaining)
+            goto size_overflow;
+          total_size = offset + bytes_gotten + bytes_remaining;
+          data1 = realloc (data, total_size + 1);
+          if (! data1)
+            goto memory_exhausted;
+          data = data1;
+        }
+
       if (32 < BITS_PER_LONG && *actual_format_ret == 32)
         {
           unsigned long i;
-          int  *idata = (int *) ((*data_ret) + offset);
+          int  *idata = (int *) (data + offset);
           long *ldata = (long *) tmp_data;
 
           for (i = 0; i < *actual_size_ret; ++i)
-            {
-              idata[i]= (int) ldata[i];
-              offset += 4;
-            }
+            idata[i] = ldata[i];
         }
       else
-        {
-          *actual_size_ret *= *actual_format_ret / 8;
-          memcpy ((*data_ret) + offset, tmp_data, *actual_size_ret);
-          offset += *actual_size_ret;
-        }
+        memcpy (data + offset, tmp_data, bytes_gotten);
+
+      offset += bytes_gotten;
 
       /* This was allocated by Xlib, so use XFree.  */
       XFree ((char *) tmp_data);
     }
 
   XFlush (display);
+  data[offset] = '\0';
+
+ done:
   UNBLOCK_INPUT;
+  *data_ret = data;
   *bytes_ret = offset;
+  return;
+
+ size_overflow:
+  free (data);
+  UNBLOCK_INPUT;
+  memory_full (SIZE_MAX);
+
+ memory_exhausted:
+  free (data);
+  UNBLOCK_INPUT;
+  memory_full (total_size + 1);
 }
 
 /* Use xfree, not XFree, to free the data obtained with this function.  */
@@ -1382,16 +1431,19 @@ static void
 receive_incremental_selection (Display *display, Window window, Atom property,
                                Lisp_Object target_type,
                                unsigned int min_size_bytes,
-                               unsigned char **data_ret, int *size_bytes_ret,
+                               unsigned char **data_ret,
+                               ptrdiff_t *size_bytes_ret,
                                Atom *type_ret, int *format_ret,
                                unsigned long *size_ret)
 {
-  int offset = 0;
+  ptrdiff_t offset = 0;
   struct prop_location *wait_object;
+  if (min (PTRDIFF_MAX, SIZE_MAX) < min_size_bytes)
+    memory_full (SIZE_MAX);
+  *data_ret = (unsigned char *) xmalloc (min_size_bytes);
   *size_bytes_ret = min_size_bytes;
-  *data_ret = (unsigned char *) xmalloc (*size_bytes_ret);
 
-  TRACE1 ("Read %d bytes incrementally", min_size_bytes);
+  TRACE1 ("Read %u bytes incrementally", min_size_bytes);
 
   /* At this point, we have read an INCR property.
      Delete the property to ack it.
@@ -1416,7 +1468,7 @@ receive_incremental_selection (Display *display, Window window, Atom property,
   while (1)
     {
       unsigned char *tmp_data;
-      int tmp_size_bytes;
+      ptrdiff_t tmp_size_bytes;
 
       TRACE0 ("  Wait for property change");
       wait_for_property_change (wait_object);
@@ -1429,7 +1481,7 @@ receive_incremental_selection (Display *display, Window window, Atom property,
                              &tmp_data, &tmp_size_bytes,
                              type_ret, format_ret, size_ret, 1);
 
-      TRACE1 ("  Read increment of %d bytes", tmp_size_bytes);
+      TRACE1 ("  Read increment of %"pD"d bytes", tmp_size_bytes);
 
       if (tmp_size_bytes == 0) /* we're done */
         {
@@ -1452,11 +1504,10 @@ receive_incremental_selection (Display *display, Window window, Atom property,
       XFlush (display);
       UNBLOCK_INPUT;
 
-      if (*size_bytes_ret < offset + tmp_size_bytes)
-        {
-          *size_bytes_ret = offset + tmp_size_bytes;
-          *data_ret = (unsigned char *) xrealloc (*data_ret, *size_bytes_ret);
-        }
+      if (*size_bytes_ret - offset < tmp_size_bytes)
+        *data_ret = xpalloc (*data_ret, size_bytes_ret,
+                             tmp_size_bytes - (*size_bytes_ret - offset),
+                             -1, 1);
 
       memcpy ((*data_ret) + offset, tmp_data, tmp_size_bytes);
       offset += tmp_size_bytes;
@@ -1482,7 +1533,7 @@ x_get_window_property_as_lisp_data (Display *display, Window window,
   int actual_format;
   unsigned long actual_size;
   unsigned char *data = 0;
-  int bytes = 0;
+  ptrdiff_t bytes = 0;
   Lisp_Object val;
   struct x_display_info *dpyinfo = x_display_info_for_display (display);
 
@@ -1574,7 +1625,7 @@ x_get_window_property_as_lisp_data (Display *display, Window window,
 
 static Lisp_Object
 selection_data_to_lisp_data (Display *display, const unsigned char *data,
-                             int size, Atom type, int format)
+                             ptrdiff_t size, Atom type, int format)
 {
   struct x_display_info *dpyinfo = x_display_info_for_display (display);
 
@@ -1607,7 +1658,7 @@ selection_data_to_lisp_data (Display *display, const unsigned char *data,
            /* Treat ATOM_PAIR type similar to list of atoms.  */
            || type == dpyinfo->Xatom_ATOM_PAIR)
     {
-      int i;
+      ptrdiff_t i;
       /* On a 64 bit machine sizeof(Atom) == sizeof(long) == 8.
          But the callers of these function has made sure the data for
          format == 32 is an array of int.  Thus, use int instead
@@ -1634,28 +1685,29 @@ selection_data_to_lisp_data (Display *display, const unsigned char *data,
   else if (format == 32 && size == sizeof (int))
     return INTEGER_TO_CONS (((unsigned int *) data) [0]);
   else if (format == 16 && size == sizeof (short))
-    return make_number ((int) (((unsigned short *) data) [0]));
+    return make_number (((unsigned short *) data) [0]);
 
   /* Convert any other kind of data to a vector of numbers, represented
      as above (as an integer, or a cons of two 16 bit integers.)
    */
   else if (format == 16)
     {
-      int i;
+      ptrdiff_t i;
       Lisp_Object v;
       v = Fmake_vector (make_number (size / 2), make_number (0));
       for (i = 0; i < size / 2; i++)
         {
-          int j = (int) ((unsigned short *) data) [i];
+          EMACS_INT j = ((unsigned short *) data) [i];
           Faset (v, make_number (i), make_number (j));
         }
       return v;
     }
   else
     {
-      int i;
-      Lisp_Object v = Fmake_vector (make_number (size / 4), make_number (0));
-      for (i = 0; i < size / 4; i++)
+      ptrdiff_t i;
+      Lisp_Object v = Fmake_vector (make_number (size / X_LONG_SIZE),
+                                    make_number (0));
+      for (i = 0; i < size / X_LONG_SIZE; i++)
         {
           unsigned int j = ((unsigned int *) data) [i];
           Faset (v, make_number (i), INTEGER_TO_CONS (j));
@@ -1670,7 +1722,7 @@ selection_data_to_lisp_data (Display *display, const unsigned char *data,
 static void
 lisp_data_to_selection_data (Display *display, Lisp_Object obj,
                              unsigned char **data_ret, Atom *type_ret,
-                             unsigned int *size_ret,
+                             ptrdiff_t *size_ret,
                              int *format_ret, int *nofree_ret)
 {
   Lisp_Object type = Qnil;
@@ -1707,22 +1759,20 @@ lisp_data_to_selection_data (Display *display, Lisp_Object obj,
     }
   else if (SYMBOLP (obj))
     {
+      *data_ret = (unsigned char *) xmalloc (sizeof (Atom) + 1);
       *format_ret = 32;
       *size_ret = 1;
-      *data_ret = (unsigned char *) xmalloc (sizeof (Atom) + 1);
       (*data_ret) [sizeof (Atom)] = 0;
       (*(Atom **) data_ret) [0] = symbol_to_x_atom (dpyinfo, obj);
       if (NILP (type)) type = QATOM;
     }
-  else if (INTEGERP (obj)
-           && XINT (obj) < 0xFFFF
-           && XINT (obj) > -0xFFFF)
+  else if (RANGED_INTEGERP (X_SHRT_MIN, obj, X_SHRT_MAX))
     {
+      *data_ret = (unsigned char *) xmalloc (sizeof (short) + 1);
       *format_ret = 16;
       *size_ret = 1;
-      *data_ret = (unsigned char *) xmalloc (sizeof (short) + 1);
       (*data_ret) [sizeof (short)] = 0;
-      (*(short **) data_ret) [0] = (short) XINT (obj);
+      (*(short **) data_ret) [0] = XINT (obj);
       if (NILP (type)) type = QINTEGER;
     }
   else if (INTEGERP (obj)
@@ -1731,11 +1781,11 @@ lisp_data_to_selection_data (Display *display, Lisp_Object obj,
                    || (CONSP (XCDR (obj))
                        && INTEGERP (XCAR (XCDR (obj)))))))
     {
+      *data_ret = (unsigned char *) xmalloc (sizeof (long) + 1);
       *format_ret = 32;
       *size_ret = 1;
-      *data_ret = (unsigned char *) xmalloc (sizeof (long) + 1);
       (*data_ret) [sizeof (long)] = 0;
-      (*(unsigned long **) data_ret) [0] = cons_to_unsigned (obj, ULONG_MAX);
+      (*(long **) data_ret) [0] = cons_to_signed (obj, X_LONG_MIN, X_LONG_MAX);
       if (NILP (type)) type = QINTEGER;
     }
   else if (VECTORP (obj))
@@ -1744,50 +1794,55 @@ lisp_data_to_selection_data (Display *display, Lisp_Object obj,
          a set of 16 or 32 bit INTEGERs;
          or a set of ATOM_PAIRs (represented as [[A1 A2] [A3 A4] ...]
        */
-      int i;
+      ptrdiff_t i;
+      ptrdiff_t size = ASIZE (obj);
 
       if (SYMBOLP (XVECTOR (obj)->contents [0]))
         /* This vector is an ATOM set */
         {
           if (NILP (type)) type = QATOM;
-          *size_ret = ASIZE (obj);
-          *format_ret = 32;
-          for (i = 0; i < *size_ret; i++)
+          for (i = 0; i < size; i++)
             if (!SYMBOLP (XVECTOR (obj)->contents [i]))
               signal_error ("All elements of selection vector must have same type", obj);
 
-          *data_ret = (unsigned char *) xmalloc ((*size_ret) * sizeof (Atom));
-          for (i = 0; i < *size_ret; i++)
+          *data_ret = xnmalloc (size, sizeof (Atom));
+          *format_ret = 32;
+          *size_ret = size;
+          for (i = 0; i < size; i++)
             (*(Atom **) data_ret) [i]
               = symbol_to_x_atom (dpyinfo, XVECTOR (obj)->contents [i]);
         }
       else
         /* This vector is an INTEGER set, or something like it */
         {
-          int data_size = 2;
-          *size_ret = ASIZE (obj);
+          int format = 16;
+          int data_size = sizeof (short);
           if (NILP (type)) type = QINTEGER;
-          *format_ret = 16;
-          for (i = 0; i < *size_ret; i++)
-            if (CONSP (XVECTOR (obj)->contents [i]))
-              *format_ret = 32;
-            else if (!INTEGERP (XVECTOR (obj)->contents [i]))
-              signal_error (/* Qselection_error */
-    "Elements of selection vector must be integers or conses of integers",
-                            obj);
-
-          /* Use sizeof(long) even if it is more than 32 bits.  See comment
-             in x_get_window_property and x_fill_property_data.  */
-
-          if (*format_ret == 32) data_size = sizeof(long);
-          *data_ret = (unsigned char *) xmalloc (*size_ret * data_size);
-          for (i = 0; i < *size_ret; i++)
-            if (*format_ret == 32)
-              (*((unsigned long **) data_ret)) [i] =
-                cons_to_unsigned (XVECTOR (obj)->contents [i], ULONG_MAX);
-            else
-              (*((unsigned short **) data_ret)) [i] =
-                cons_to_unsigned (XVECTOR (obj)->contents [i], USHRT_MAX);
+          for (i = 0; i < size; i++)
+            {
+              intmax_t v = cons_to_signed (XVECTOR (obj)->contents[i],
+                                           X_LONG_MIN, X_LONG_MAX);
+              if (X_SHRT_MIN <= v && v <= X_SHRT_MAX)
+                {
+                  /* Use sizeof (long) even if it is more than 32 bits.
+                     See comment in x_get_window_property and
+                     x_fill_property_data.  */
+                  data_size = sizeof (long);
+                  format = 32;
+                }
+            }
+          *data_ret = xnmalloc (size, data_size);
+          *format_ret = format;
+          *size_ret = size;
+          for (i = 0; i < size; i++)
+            {
+              long v = cons_to_signed (XVECTOR (obj)->contents[i],
+                                       X_LONG_MIN, X_LONG_MAX);
+              if (format == 32)
+                (*((long **) data_ret)) [i] = v;
+              else
+                (*((short **) data_ret)) [i] = v;
+            }
         }
     }
   else
@@ -1817,8 +1872,8 @@ clean_local_selection_data (Lisp_Object obj)
     }
   if (VECTORP (obj))
     {
-      int i;
-      int size = ASIZE (obj);
+      ptrdiff_t i;
+      ptrdiff_t size = ASIZE (obj);
       Lisp_Object copy;
       if (size == 1)
         return clean_local_selection_data (XVECTOR (obj)->contents [0]);
@@ -2213,6 +2268,8 @@ x_check_property_data (Lisp_Object data)
       else if (CONSP (o) &&
                (! NUMBERP (XCAR (o)) || ! NUMBERP (XCDR (o))))
         return -1;
+      if (size == INT_MAX)
+        return -1;
       size++;
     }
 
@@ -2294,8 +2351,11 @@ Lisp_Object
 x_property_data_to_lisp (struct frame *f, const unsigned char *data,
                          Atom type, int format, long unsigned int size)
 {
+  ptrdiff_t format_bytes = format >> 3;
+  if (PTRDIFF_MAX / format_bytes < size)
+    memory_full (SIZE_MAX);
   return selection_data_to_lisp_data (FRAME_X_DISPLAY (f),
-                                      data, size*format/8, type, format);
+                                      data, size * format_bytes, type, format);
 }
 
 /* Get the mouse position in frame relative coordinates.  */
@@ -2401,15 +2461,9 @@ FRAME is on.  If FRAME is nil, the selected frame is used.  */)
       return Qnil;
 
   if (dpyinfo->x_dnd_atoms_length == dpyinfo->x_dnd_atoms_size)
-    {
-      if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *dpyinfo->x_dnd_atoms / 2
-          < dpyinfo->x_dnd_atoms_size)
-        memory_full (SIZE_MAX);
-      dpyinfo->x_dnd_atoms_size *= 2;
-      dpyinfo->x_dnd_atoms = xrealloc (dpyinfo->x_dnd_atoms,
-                                       sizeof (*dpyinfo->x_dnd_atoms)
-                                       * dpyinfo->x_dnd_atoms_size);
-    }
+    dpyinfo->x_dnd_atoms =
+      xpalloc (dpyinfo->x_dnd_atoms, &dpyinfo->x_dnd_atoms_size,
+               1, -1, sizeof *dpyinfo->x_dnd_atoms);
 
   dpyinfo->x_dnd_atoms[dpyinfo->x_dnd_atoms_length++] = x_atom;
   return Qnil;
@@ -2444,7 +2498,7 @@ x_handle_dnd_message (struct frame *f, XClientMessageEvent *event, struct x_disp
   if (32 < BITS_PER_LONG && event->format == 32)
     {
       for (i = 0; i < 5; ++i) /* There are only 5 longs in a ClientMessage. */
-        idata[i] = (int) event->data.l[i];
+        idata[i] = event->data.l[i];
       data = (unsigned char *) idata;
     }
 
diff --git a/src/xsmfns.c b/src/xsmfns.c
index cb56ae648d1..55daec73307 100644
--- a/src/xsmfns.c
+++ b/src/xsmfns.c
@@ -223,9 +223,11 @@ smc_save_yourself_CB (SmcConn smcConn,
   props[props_idx]->name = xstrdup (SmRestartCommand);
   props[props_idx]->type = xstrdup (SmLISTofARRAY8);
   /* /path/to/emacs, --smid=xxx --no-splash --chdir=dir ... */
+  if (INT_MAX - 3 < initial_argc)
+    memory_full (SIZE_MAX);
   i = 3 + initial_argc;
   props[props_idx]->num_vals = i;
-  vp = (SmPropValue *) xmalloc (i * sizeof(*vp));
+  vp = xnmalloc (i, sizeof *vp);
   props[props_idx]->vals = vp;
   props[props_idx]->vals[vp_idx].length = strlen (emacs_program);
   props[props_idx]->vals[vp_idx++].value = emacs_program;
diff --git a/src/xterm.c b/src/xterm.c
index cefb98a476d..be456a61a6f 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -1662,19 +1662,18 @@ x_color_cells (Display *dpy, int *ncells)
   if (dpyinfo->color_cells == NULL)
     {
       Screen *screen = dpyinfo->screen;
+      int ncolor_cells = XDisplayCells (dpy, XScreenNumberOfScreen (screen));
       int i;
 
-      dpyinfo->ncolor_cells
-        = XDisplayCells (dpy, XScreenNumberOfScreen (screen));
-      dpyinfo->color_cells
-        = (XColor *) xmalloc (dpyinfo->ncolor_cells
-                              * sizeof *dpyinfo->color_cells);
+      dpyinfo->color_cells = xnmalloc (ncolor_cells,
+                                       sizeof *dpyinfo->color_cells);
+      dpyinfo->ncolor_cells = ncolor_cells;
 
-      for (i = 0; i < dpyinfo->ncolor_cells; ++i)
+      for (i = 0; i < ncolor_cells; ++i)
         dpyinfo->color_cells[i].pixel = i;
 
       XQueryColors (dpy, dpyinfo->cmap,
-                    dpyinfo->color_cells, dpyinfo->ncolor_cells);
+                    dpyinfo->color_cells, ncolor_cells);
     }
 
   *ncells = dpyinfo->ncolor_cells;
@@ -4233,7 +4232,7 @@ xt_action_hook (Widget widget, XtPointer client_data, String action_name,
    x_send_scroll_bar_event and x_scroll_bar_to_input_event.  */
 
 static struct window **scroll_bar_windows;
-static size_t scroll_bar_windows_size;
+static ptrdiff_t scroll_bar_windows_size;
 
 
 /* Send a client message with message type Xatom_Scrollbar for a
@@ -4248,7 +4247,7 @@ x_send_scroll_bar_event (Lisp_Object window, int part, int portion, int whole)
   XClientMessageEvent *ev = (XClientMessageEvent *) &event;
   struct window *w = XWINDOW (window);
   struct frame *f = XFRAME (w->frame);
-  size_t i;
+  ptrdiff_t i;
 
   BLOCK_INPUT;
 
@@ -4269,16 +4268,15 @@ x_send_scroll_bar_event (Lisp_Object window, int part, int portion, int whole)
 
   if (i == scroll_bar_windows_size)
     {
-      size_t new_size = max (10, 2 * scroll_bar_windows_size);
-      size_t nbytes = new_size * sizeof *scroll_bar_windows;
-      size_t old_nbytes = scroll_bar_windows_size * sizeof *scroll_bar_windows;
-
-      if ((size_t) -1 / sizeof *scroll_bar_windows < new_size)
-        memory_full (SIZE_MAX);
-      scroll_bar_windows = (struct window **) xrealloc (scroll_bar_windows,
-                                                        nbytes);
+      ptrdiff_t old_nbytes =
+        scroll_bar_windows_size * sizeof *scroll_bar_windows;
+      ptrdiff_t nbytes;
+      enum { XClientMessageEvent_MAX = 0x7fffffff };
+      scroll_bar_windows =
+        xpalloc (scroll_bar_windows, &scroll_bar_windows_size, 1,
+                 XClientMessageEvent_MAX, sizeof *scroll_bar_windows);
+      nbytes = scroll_bar_windows_size * sizeof *scroll_bar_windows;
       memset (&scroll_bar_windows[i], 0, nbytes - old_nbytes);
-      scroll_bar_windows_size = new_size;
     }
 
   scroll_bar_windows[i] = w;
@@ -5856,11 +5854,12 @@ handle_one_xevent (struct x_display_info *dpyinfo, XEvent *eventptr,
   } inev;
   int count = 0;
   int do_help = 0;
-  int nbytes = 0;
+  ptrdiff_t nbytes = 0;
   struct frame *f = NULL;
   struct coding_system coding;
   XEvent event = *eventptr;
   Mouse_HLInfo *hlinfo = &dpyinfo->mouse_highlight;
+  USE_SAFE_ALLOCA;
 
   *finish = X_EVENT_NORMAL;
 
@@ -6556,7 +6555,7 @@ handle_one_xevent (struct x_display_info *dpyinfo, XEvent *eventptr,
             }
 
           {     /* Raw bytes, not keysym.  */
-            register int i;
+            ptrdiff_t i;
             int nchars, len;
 
             for (i = 0, nchars = 0; i < nbytes; i++)
@@ -6569,7 +6568,6 @@ handle_one_xevent (struct x_display_info *dpyinfo, XEvent *eventptr,
             if (nchars < nbytes)
               {
                 /* Decode the input data.  */
-                int require;
 
                 /* The input should be decoded with `coding_system'
                    which depends on which X*LookupString function
@@ -6582,9 +6580,9 @@ handle_one_xevent (struct x_display_info *dpyinfo, XEvent *eventptr,
                    gives us composition information.  */
                 coding.common_flags &= ~CODING_ANNOTATION_MASK;
 
-                require = MAX_MULTIBYTE_LENGTH * nbytes;
-                coding.destination = alloca (require);
-                coding.dst_bytes = require;
+                SAFE_NALLOCA (coding.destination, MAX_MULTIBYTE_LENGTH,
+                              nbytes);
+                coding.dst_bytes = MAX_MULTIBYTE_LENGTH * nbytes;
                 coding.mode |= CODING_MODE_LAST_BLOCK;
                 decode_coding_c_string (&coding, copy_bufptr, nbytes, Qnil);
                 nbytes = coding.produced;
@@ -7043,6 +7041,7 @@ handle_one_xevent (struct x_display_info *dpyinfo, XEvent *eventptr,
       count++;
     }
 
+  SAFE_FREE ();
   *eventptr = event;
   return count;
 }
@@ -9872,6 +9871,7 @@ x_term_init (Lisp_Object display_name, char *xrm_option, char *resource_name)
   struct x_display_info *dpyinfo;
   XrmDatabase xrdb;
   Mouse_HLInfo *hlinfo;
+  ptrdiff_t lim;
 
   BLOCK_INPUT;
 
@@ -10094,12 +10094,15 @@ x_term_init (Lisp_Object display_name, char *xrm_option, char *resource_name)
   XSetAfterFunction (x_current_display, x_trace_wire);
 #endif /* ! 0 */
 
+  lim = min (PTRDIFF_MAX, SIZE_MAX) - sizeof "@";
+  if (lim - SBYTES (Vinvocation_name) < SBYTES (Vsystem_name))
+    memory_full (SIZE_MAX);
   dpyinfo->x_id_name
     = (char *) xmalloc (SBYTES (Vinvocation_name)
                         + SBYTES (Vsystem_name)
                         + 2);
-  sprintf (dpyinfo->x_id_name, "%s@%s",
-           SSDATA (Vinvocation_name), SSDATA (Vsystem_name));
+  strcat (strcat (strcpy (dpyinfo->x_id_name, SSDATA (Vinvocation_name)), "@"),
+          SSDATA (Vsystem_name));
 
   /* Figure out which modifier bits mean what.  */
   x_find_modifier_meanings (dpyinfo);