Fix recently introduced bool vector overrun.

This was due to an optimization that went awry.
Reported by Glenn Morris in
<http://lists.gnu.org/archive/html/emacs-devel/2013-11/msg00622.html>.
* alloc.c (make_uninit_bool_vector): Don't allocate a dummy word
for empty vectors, undoing the 2013-11-18 change.
* data.c (bool_vector_binop_driver): Rely on this.
Fix bug that occasionally overran the destination.
* lisp.h (struct Lisp_Bool_vector): Document this.

1 files changed, 27 insertions, 23 deletions

diff --git a/src/data.c b/src/data.c
index 33dd11049ec..bdd56bf0f62 100644
--- a/src/data.c
+++ b/src/data.c
@@ -3054,60 +3054,64 @@ bool_vector_binop_driver (Lisp_Object a,
       switch (op)
         {
         case bool_vector_exclusive_or:
-          while (destdata[i] == (adata[i] ^ bdata[i]))
-            if (! (++i < nr_words))
-              return Qnil;
+          for (; i < nr_words; i++)
+            if (destdata[i] != (adata[i] ^ bdata[i]))
+              goto set_dest;
           break;
 
         case bool_vector_subsetp:
-        case bool_vector_union:
-          while (destdata[i] == (adata[i] | bdata[i]))
-            if (! (++i < nr_words))
+          for (; i < nr_words; i++)
+            if (adata[i] &~ bdata[i])
               return Qnil;
+          return Qt;
+
+        case bool_vector_union:
+          for (; i < nr_words; i++)
+            if (destdata[i] != (adata[i] | bdata[i]))
+              goto set_dest;
           break;
 
         case bool_vector_intersection:
-          while (destdata[i] == (adata[i] & bdata[i]))
-            if (! (++i < nr_words))
-              return Qnil;
+          for (; i < nr_words; i++)
+            if (destdata[i] != (adata[i] & bdata[i]))
+              goto set_dest;
           break;
 
         case bool_vector_set_difference:
-          while (destdata[i] == (adata[i] &~ bdata[i]))
-            if (! (++i < nr_words))
-              return Qnil;
+          for (; i < nr_words; i++)
+            if (destdata[i] != (adata[i] &~ bdata[i]))
+              goto set_dest;
           break;
         }
+
+      return Qnil;
     }
 
+ set_dest:
   switch (op)
     {
     case bool_vector_exclusive_or:
-      do
+      for (; i < nr_words; i++)
         destdata[i] = adata[i] ^ bdata[i];
-      while (++i < nr_words);
-      break;
-
-    case bool_vector_subsetp:
       break;
 
     case bool_vector_union:
-      do
+      for (; i < nr_words; i++)
         destdata[i] = adata[i] | bdata[i];
-      while (++i < nr_words);
       break;
 
     case bool_vector_intersection:
-      do
+      for (; i < nr_words; i++)
         destdata[i] = adata[i] & bdata[i];
-      while (++i < nr_words);
       break;
 
     case bool_vector_set_difference:
-      do
+      for (; i < nr_words; i++)
         destdata[i] = adata[i] &~ bdata[i];
-      while (++i < nr_words);
       break;
+
+    default:
+      eassume (0);
     }
 
   return dest;