Merge branch 'master' into scratch/comp-static-data

41 files changed, 2820 insertions, 938 deletions

diff --git a/src/.lldbinit b/src/.lldbinit
index 358cea5f8b6..5fdac34b786 100644
--- a/src/.lldbinit
+++ b/src/.lldbinit
@@ -16,7 +16,7 @@
 # You should have received a copy of the GNU General Public License
 # along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
 #
-# Use 'lldb --local-init' or add to your ~/.lldbinit the line
+# Use 'lldb --local-lldbinit' or add to your ~/.lldbinit the line
 #
 # settings set target.load-cwd-lldbinit true
 #
diff --git a/src/ChangeLog.11 b/src/ChangeLog.11
index a00ca453ca4..77180262aca 100644
--- a/src/ChangeLog.11
+++ b/src/ChangeLog.11
@@ -14235,7 +14235,7 @@
         ns_alternate_modifier.  (Bug#1217)
 
         * nsmenu.m (EmacsMenu-parseKeyEquiv:, addItemWithWidgetValue:):
-        Display all shortcuts, including those w/o super modifier.
+        Display all shortcuts, including those without super modifier.
 
         * nsfns.m (ns-read-file-name): Fix typo in assignment statement.
 
diff --git a/src/ChangeLog.12 b/src/ChangeLog.12
index 7f77c0ca077..f455c4de382 100644
--- a/src/ChangeLog.12
+++ b/src/ChangeLog.12
@@ -10836,7 +10836,7 @@
         * gtkutil.c (xg_maybe_add_timer): Port to higher-res time stamps.
 
         * image.c (prepare_image_for_display, clear_image_cache)
-        (lookup_image): Port to higer-resolution time stamps.
+        (lookup_image): Port to higher-resolution time stamps.
 
         * keyboard.c (start_polling, bind_polling_period):
         Check for time stamp overflow.
diff --git a/src/ChangeLog.13 b/src/ChangeLog.13
index 91f8005ac51..0c4e2909ced 100644
--- a/src/ChangeLog.13
+++ b/src/ChangeLog.13
@@ -10579,7 +10579,7 @@
         (../src/$(OLDXMENU), $(OLDXMENU)): Remove.
         (temacs$(EXEEXT)): Depend on $(LIBXMENU), not stamp-oldxmenu.
         ($(lwlibdir)/liblw.a, $(oldXMenudir)/libXMenu11.a, FORCE): New targets.
-        (boostrap-clean): No need to remove stamp-oldxmenu.
+        (bootstrap-clean): No need to remove stamp-oldxmenu.
 
         Fix recently introduced bool vector overrun.
         This was due to an optimization that went awry.
diff --git a/src/ChangeLog.3 b/src/ChangeLog.3
index 4b3675eaa8f..d32e894fa53 100644
--- a/src/ChangeLog.3
+++ b/src/ChangeLog.3
@@ -14422,7 +14422,7 @@
         * s-umips.h: Now include either s-usg5-2-2.h or s-bsd4-3.h
         and then override as needed.
         * m-mips.h: System dependence deleted.
-        LD_SWITCH_MACHINE remains w/ options needed on all systems.
+        LD_SWITCH_MACHINE remains with options needed on all systems.
         * m-pmax.h: A little of that (LIBS_DEBUG) moved here.
         No need to undef LIBS_MACHINE.
 
diff --git a/src/alloc.c b/src/alloc.c
index 0a8c1826614..0a4323d1ceb 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -82,6 +82,37 @@ along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
 #include <valgrind/memcheck.h>
 #endif
 
+/* AddressSanitizer exposes additional functions for manually marking
+   memory as poisoned/unpoisoned.  When ASan is enabled and the needed
+   header is available, memory is poisoned when:
+
+   * An ablock is freed (lisp_align_free), or ablocks are initially
+   allocated (lisp_align_malloc).
+   * An interval_block is initially allocated (make_interval).
+   * A dead INTERVAL is put on the interval free list
+   (sweep_intervals).
+   * A sdata is marked as dead (sweep_strings, pin_string).
+   * An sblock is initially allocated (allocate_string_data).
+   * A string_block is initially allocated (allocate_string).
+   * A dead string is put on string_free_list (sweep_strings).
+   * A float_block is initially allocated (make_float).
+   * A dead float is put on float_free_list.
+   * A cons_block is initially allocated (Fcons).
+   * A dead cons is put on cons_free_list (sweep_cons).
+   * A dead vector is put on vector_free_list (setup_on_free_list),
+   or a new vector block is allocated (allocate_vector_from_block).
+   Accordingly, objects reused from the free list are unpoisoned.
+
+   This feature can be disabled wtih the run-time flag
+   `allow_user_poisoning' set to zero.  */
+#if ADDRESS_SANITIZER && defined HAVE_SANITIZER_ASAN_INTERFACE_H \
+  && !defined GC_ASAN_POISON_OBJECTS
+# define GC_ASAN_POISON_OBJECTS 1
+# include <sanitizer/asan_interface.h>
+#else
+# define GC_ASAN_POISON_OBJECTS 0
+#endif
+
 /* GC_CHECK_MARKED_OBJECTS means do sanity checks on allocated objects.
    We turn that on by default when ENABLE_CHECKING is defined;
    define GC_CHECK_MARKED_OBJECTS to zero to disable.  */
@@ -1164,6 +1195,16 @@ struct ablocks
   (1 & (intptr_t) ABLOCKS_BUSY (abase) ? abase : ((void **) (abase))[-1])
 #endif
 
+#if GC_ASAN_POISON_OBJECTS
+# define ASAN_POISON_ABLOCK(b) \
+  __asan_poison_memory_region (&(b)->x, sizeof ((b)->x))
+# define ASAN_UNPOISON_ABLOCK(b) \
+  __asan_unpoison_memory_region (&(b)->x, sizeof ((b)->x))
+#else
+# define ASAN_POISON_ABLOCK(b) ((void) 0)
+# define ASAN_UNPOISON_ABLOCK(b) ((void) 0)
+#endif
+
 /* The list of free ablock.   */
 static struct ablock *free_ablock;
 
@@ -1242,6 +1283,7 @@ lisp_align_malloc (size_t nbytes, enum mem_type type)
         {
           abase->blocks[i].abase = abase;
           abase->blocks[i].x.next_free = free_ablock;
+          ASAN_POISON_ABLOCK (&abase->blocks[i]);
           free_ablock = &abase->blocks[i];
         }
       intptr_t ialigned = aligned;
@@ -1254,6 +1296,7 @@ lisp_align_malloc (size_t nbytes, enum mem_type type)
       eassert ((intptr_t) ABLOCKS_BUSY (abase) == aligned);
     }
 
+  ASAN_UNPOISON_ABLOCK (free_ablock);
   abase = ABLOCK_ABASE (free_ablock);
   ABLOCKS_BUSY (abase)
     = (struct ablocks *) (2 + (intptr_t) ABLOCKS_BUSY (abase));
@@ -1285,6 +1328,7 @@ lisp_align_free (void *block)
 #endif
   /* Put on free list.  */
   ablock->x.next_free = free_ablock;
+  ASAN_POISON_ABLOCK (ablock);
   free_ablock = ablock;
   /* Update busy count.  */
   intptr_t busy = (intptr_t) ABLOCKS_BUSY (abase) - 2;
@@ -1297,9 +1341,12 @@ lisp_align_free (void *block)
       bool aligned = busy;
       struct ablock **tem = &free_ablock;
       struct ablock *atop = &abase->blocks[aligned ? ABLOCKS_SIZE : ABLOCKS_SIZE - 1];
-
       while (*tem)
         {
+#if GC_ASAN_POISON_OBJECTS
+          __asan_unpoison_memory_region (&(*tem)->x,
+                                         sizeof ((*tem)->x));
+#endif
           if (*tem >= (struct ablock *) abase && *tem < atop)
             {
               i++;
@@ -1428,6 +1475,24 @@ static int interval_block_index = INTERVAL_BLOCK_SIZE;
 
 static INTERVAL interval_free_list;
 
+#if GC_ASAN_POISON_OBJECTS
+# define ASAN_POISON_INTERVAL_BLOCK(b)         \
+  __asan_poison_memory_region ((b)->intervals, \
+                               sizeof ((b)->intervals))
+# define ASAN_UNPOISON_INTERVAL_BLOCK(b)         \
+  __asan_unpoison_memory_region ((b)->intervals, \
+                                 sizeof ((b)->intervals))
+# define ASAN_POISON_INTERVAL(i) \
+  __asan_poison_memory_region ((i), sizeof (*(i)))
+# define ASAN_UNPOISON_INTERVAL(i) \
+  __asan_unpoison_memory_region ((i), sizeof (*(i)))
+#else
+# define ASAN_POISON_INTERVAL_BLOCK(b) ((void) 0)
+# define ASAN_UNPOISON_INTERVAL_BLOCK(b) ((void) 0)
+# define ASAN_POISON_INTERVAL(i) ((void) 0)
+# define ASAN_UNPOISON_INTERVAL(i) ((void) 0)
+#endif
+
 /* Return a new interval.  */
 
 INTERVAL
@@ -1440,6 +1505,7 @@ make_interval (void)
   if (interval_free_list)
     {
       val = interval_free_list;
+      ASAN_UNPOISON_INTERVAL (val);
       interval_free_list = INTERVAL_PARENT (interval_free_list);
     }
   else
@@ -1450,10 +1516,12 @@ make_interval (void)
             = lisp_malloc (sizeof *newi, false, MEM_TYPE_NON_LISP);
 
           newi->next = interval_block;
+          ASAN_POISON_INTERVAL_BLOCK (newi);
           interval_block = newi;
           interval_block_index = 0;
         }
       val = &interval_block->intervals[interval_block_index++];
+      ASAN_UNPOISON_INTERVAL (val);
     }
 
   MALLOC_UNBLOCK_INPUT;
@@ -1694,6 +1762,41 @@ init_strings (void)
   staticpro (&empty_multibyte_string);
 }
 
+#if GC_ASAN_POISON_OBJECTS
+/* Prepare s for denoting a free sdata struct, i.e, poison all bytes
+   in the flexible array member, except the first SDATA_OFFSET bytes.
+   This is only effective for strings of size n where n > sdata_size(n).
+ */
+# define ASAN_PREPARE_DEAD_SDATA(s, size)                          \
+  do {                                                             \
+    __asan_poison_memory_region ((s), sdata_size ((size)));        \
+    __asan_unpoison_memory_region (&(((s))->string),                 \
+                                   sizeof (struct Lisp_String *)); \
+    __asan_unpoison_memory_region (&SDATA_NBYTES ((s)),            \
+                                   sizeof (SDATA_NBYTES ((s))));   \
+   } while (false)
+/* Prepare s for storing string data for NBYTES bytes.  */
+# define ASAN_PREPARE_LIVE_SDATA(s, nbytes) \
+  __asan_unpoison_memory_region ((s), sdata_size ((nbytes)))
+# define ASAN_POISON_SBLOCK_DATA(b, size) \
+  __asan_poison_memory_region ((b)->data, (size))
+# define ASAN_POISON_STRING_BLOCK(b) \
+  __asan_poison_memory_region ((b)->strings, STRING_BLOCK_SIZE)
+# define ASAN_UNPOISON_STRING_BLOCK(b) \
+  __asan_unpoison_memory_region ((b)->strings, STRING_BLOCK_SIZE)
+# define ASAN_POISON_STRING(s) \
+  __asan_poison_memory_region ((s), sizeof (*(s)))
+# define ASAN_UNPOISON_STRING(s) \
+  __asan_unpoison_memory_region ((s), sizeof (*(s)))
+#else
+# define ASAN_PREPARE_DEAD_SDATA(s, size) ((void) 0)
+# define ASAN_PREPARE_LIVE_SDATA(s, nbytes) ((void) 0)
+# define ASAN_POISON_SBLOCK_DATA(b, size) ((void) 0)
+# define ASAN_POISON_STRING_BLOCK(b) ((void) 0)
+# define ASAN_UNPOISON_STRING_BLOCK(b) ((void) 0)
+# define ASAN_POISON_STRING(s) ((void) 0)
+# define ASAN_UNPOISON_STRING(s) ((void) 0)
+#endif
 
 #ifdef GC_CHECK_STRING_BYTES
 
@@ -1812,12 +1915,14 @@ allocate_string (void)
           NEXT_FREE_LISP_STRING (s) = string_free_list;
           string_free_list = s;
         }
+      ASAN_POISON_STRING_BLOCK (b);
     }
 
   check_string_free_list ();
 
   /* Pop a Lisp_String off the free-list.  */
   s = string_free_list;
+  ASAN_UNPOISON_STRING (s);
   string_free_list = NEXT_FREE_LISP_STRING (s);
 
   MALLOC_UNBLOCK_INPUT;
@@ -1877,6 +1982,7 @@ allocate_string_data (struct Lisp_String *s,
 #endif
 
       b = lisp_malloc (size + GC_STRING_EXTRA, clearit, MEM_TYPE_NON_LISP);
+      ASAN_POISON_SBLOCK_DATA (b, size);
 
 #ifdef DOUG_LEA_MALLOC
       if (!mmap_lisp_allowed_p ())
@@ -1898,6 +2004,8 @@ allocate_string_data (struct Lisp_String *s,
         {
           /* Not enough room in the current sblock.  */
           b = lisp_malloc (SBLOCK_SIZE, false, MEM_TYPE_NON_LISP);
+          ASAN_POISON_SBLOCK_DATA (b, SBLOCK_SIZE);
+
           data = b->data;
           b->next = NULL;
           b->next_free = data;
@@ -1910,10 +2018,19 @@ allocate_string_data (struct Lisp_String *s,
         }
 
       data = b->next_free;
+
       if (clearit)
-        memset (SDATA_DATA (data), 0, nbytes);
+        {
+#if GC_ASAN_POISON_OBJECTS
+          /* We are accessing SDATA_DATA (data) before it gets
+           * normally unpoisoned, so do it manually.  */
+          __asan_unpoison_memory_region (SDATA_DATA (data), nbytes);
+#endif
+          memset (SDATA_DATA (data), 0, nbytes);
+        }
     }
 
+  ASAN_PREPARE_LIVE_SDATA (data, nbytes);
   data->string = s;
   b->next_free = (sdata *) ((char *) data + needed + GC_STRING_EXTRA);
   eassert ((uintptr_t) b->next_free % alignof (sdata) == 0);
@@ -2005,12 +2122,16 @@ sweep_strings (void)
       int i, nfree = 0;
       struct Lisp_String *free_list_before = string_free_list;
 
+      ASAN_UNPOISON_STRING_BLOCK (b);
+
       next = b->next;
 
       for (i = 0; i < STRING_BLOCK_SIZE; ++i)
         {
           struct Lisp_String *s = b->strings + i;
 
+          ASAN_UNPOISON_STRING (s);
+
           if (s->u.s.data)
             {
               /* String was not on free-list before.  */
@@ -2047,6 +2168,8 @@ sweep_strings (void)
 
                   /* Put the string on the free-list.  */
                   NEXT_FREE_LISP_STRING (s) = string_free_list;
+                  ASAN_POISON_STRING (s);
+                  ASAN_PREPARE_DEAD_SDATA (data, SDATA_NBYTES (data));
                   string_free_list = s;
                   ++nfree;
                 }
@@ -2055,6 +2178,8 @@ sweep_strings (void)
             {
               /* S was on the free-list before.  Put it there again.  */
               NEXT_FREE_LISP_STRING (s) = string_free_list;
+              ASAN_POISON_STRING (s);
+
               string_free_list = s;
               ++nfree;
             }
@@ -2181,6 +2306,7 @@ compact_small_strings (void)
                   if (from != to)
                     {
                       eassert (tb != b || to < from);
+                      ASAN_PREPARE_LIVE_SDATA (to, nbytes);
                       memmove (to, from, size + GC_STRING_EXTRA);
                       to->string->u.s.data = SDATA_DATA (to);
                     }
@@ -2537,6 +2663,7 @@ pin_string (Lisp_Object string)
       memcpy (s->u.s.data, data, size);
       old_sdata->string = NULL;
       SDATA_NBYTES (old_sdata) = size;
+      ASAN_PREPARE_DEAD_SDATA (old_sdata, size);
     }
   if (s->u.s.size_byte != -3)
     s->u.s.size_byte = -3;
@@ -2601,6 +2728,24 @@ struct float_block
 #define XFLOAT_UNMARK(fptr) \
   UNSETMARKBIT (FLOAT_BLOCK (fptr), FLOAT_INDEX ((fptr)))
 
+#if GC_ASAN_POISON_OBJECTS
+# define ASAN_POISON_FLOAT_BLOCK(fblk)         \
+  __asan_poison_memory_region ((fblk)->floats, \
+                               sizeof ((fblk)->floats))
+# define ASAN_UNPOISON_FLOAT_BLOCK(fblk)         \
+  __asan_unpoison_memory_region ((fblk)->floats, \
+                                 sizeof ((fblk)->floats))
+# define ASAN_POISON_FLOAT(p) \
+  __asan_poison_memory_region ((p), sizeof (struct Lisp_Float))
+# define ASAN_UNPOISON_FLOAT(p) \
+  __asan_unpoison_memory_region ((p), sizeof (struct Lisp_Float))
+#else
+# define ASAN_POISON_FLOAT_BLOCK(fblk) ((void) 0)
+# define ASAN_UNPOISON_FLOAT_BLOCK(fblk) ((void) 0)
+# define ASAN_POISON_FLOAT(p) ((void) 0)
+# define ASAN_UNPOISON_FLOAT(p) ((void) 0)
+#endif
+
 /* Current float_block.  */
 
 static struct float_block *float_block;
@@ -2625,6 +2770,7 @@ make_float (double float_value)
   if (float_free_list)
     {
       XSETFLOAT (val, float_free_list);
+      ASAN_UNPOISON_FLOAT (float_free_list);
       float_free_list = float_free_list->u.chain;
     }
   else
@@ -2635,9 +2781,11 @@ make_float (double float_value)
             = lisp_align_malloc (sizeof *new, MEM_TYPE_FLOAT);
           new->next = float_block;
           memset (new->gcmarkbits, 0, sizeof new->gcmarkbits);
+          ASAN_POISON_FLOAT_BLOCK (new);
           float_block = new;
           float_block_index = 0;
         }
+      ASAN_UNPOISON_FLOAT (&float_block->floats[float_block_index]);
       XSETFLOAT (val, &float_block->floats[float_block_index]);
       float_block_index++;
     }
@@ -2715,6 +2863,19 @@ static int cons_block_index = CONS_BLOCK_SIZE;
 
 static struct Lisp_Cons *cons_free_list;
 
+#if GC_ASAN_POISON_OBJECTS
+# define ASAN_POISON_CONS_BLOCK(b) \
+  __asan_poison_memory_region ((b)->conses, sizeof ((b)->conses))
+# define ASAN_POISON_CONS(p) \
+  __asan_poison_memory_region ((p), sizeof (struct Lisp_Cons))
+# define ASAN_UNPOISON_CONS(p) \
+  __asan_unpoison_memory_region ((p), sizeof (struct Lisp_Cons))
+#else
+# define ASAN_POISON_CONS_BLOCK(b) ((void) 0)
+# define ASAN_POISON_CONS(p) ((void) 0)
+# define ASAN_UNPOISON_CONS(p) ((void) 0)
+#endif
+
 /* Explicitly free a cons cell by putting it on the free-list.  */
 
 void
@@ -2725,6 +2886,7 @@ free_cons (struct Lisp_Cons *ptr)
   cons_free_list = ptr;
   ptrdiff_t nbytes = sizeof *ptr;
   tally_consing (-nbytes);
+  ASAN_POISON_CONS (ptr);
 }
 
 DEFUN ("cons", Fcons, Scons, 2, 2, 0,
@@ -2737,6 +2899,7 @@ DEFUN ("cons", Fcons, Scons, 2, 2, 0,
 
   if (cons_free_list)
     {
+      ASAN_UNPOISON_CONS (cons_free_list);
       XSETCONS (val, cons_free_list);
       cons_free_list = cons_free_list->u.s.u.chain;
     }
@@ -2747,10 +2910,12 @@ DEFUN ("cons", Fcons, Scons, 2, 2, 0,
           struct cons_block *new
             = lisp_align_malloc (sizeof *new, MEM_TYPE_CONS);
           memset (new->gcmarkbits, 0, sizeof new->gcmarkbits);
+          ASAN_POISON_CONS_BLOCK (new);
           new->next = cons_block;
           cons_block = new;
           cons_block_index = 0;
         }
+      ASAN_UNPOISON_CONS (&cons_block->conses[cons_block_index]);
       XSETCONS (val, &cons_block->conses[cons_block_index]);
       cons_block_index++;
     }
@@ -3005,6 +3170,19 @@ static struct large_vector *large_vectors;
 
 Lisp_Object zero_vector;
 
+#if GC_ASAN_POISON_OBJECTS
+# define ASAN_POISON_VECTOR_CONTENTS(v, bytes) \
+  __asan_poison_memory_region ((v)->contents, (bytes))
+# define ASAN_UNPOISON_VECTOR_CONTENTS(v, bytes) \
+  __asan_unpoison_memory_region ((v)->contents, (bytes))
+# define ASAN_UNPOISON_VECTOR_BLOCK(b) \
+  __asan_unpoison_memory_region ((b)->data, sizeof ((b)->data))
+#else
+# define ASAN_POISON_VECTOR_CONTENTS(v, bytes) ((void) 0)
+# define ASAN_UNPOISON_VECTOR_CONTENTS(v, bytes) ((void) 0)
+# define ASAN_UNPOISON_VECTOR_BLOCK(b) ((void) 0)
+#endif
+
 /* Common shortcut to setup vector on a free list.  */
 
 static void
@@ -3017,6 +3195,7 @@ setup_on_free_list (struct Lisp_Vector *v, ptrdiff_t nbytes)
   ptrdiff_t vindex = VINDEX (nbytes);
   eassert (vindex < VECTOR_MAX_FREE_LIST_INDEX);
   set_next_vector (v, vector_free_lists[vindex]);
+  ASAN_POISON_VECTOR_CONTENTS (v, nbytes - header_size);
   vector_free_lists[vindex] = v;
 }
 
@@ -3064,6 +3243,7 @@ allocate_vector_from_block (ptrdiff_t nbytes)
   if (vector_free_lists[index])
     {
       vector = vector_free_lists[index];
+      ASAN_UNPOISON_VECTOR_CONTENTS (vector, nbytes - header_size);
       vector_free_lists[index] = next_vector (vector);
       return vector;
     }
@@ -3077,12 +3257,18 @@ allocate_vector_from_block (ptrdiff_t nbytes)
       {
         /* This vector is larger than requested.  */
         vector = vector_free_lists[index];
+        ASAN_UNPOISON_VECTOR_CONTENTS (vector, nbytes - header_size);
         vector_free_lists[index] = next_vector (vector);
 
         /* Excess bytes are used for the smaller vector,
            which should be set on an appropriate free list.  */
         restbytes = index * roundup_size + VBLOCK_BYTES_MIN - nbytes;
         eassert (restbytes % roundup_size == 0);
+#if GC_ASAN_POISON_OBJECTS
+        /* Ensure that accessing excess bytes does not trigger ASan.  */
+        __asan_unpoison_memory_region (ADVANCE (vector, nbytes),
+                                       restbytes);
+#endif
         setup_on_free_list (ADVANCE (vector, nbytes), restbytes);
         return vector;
       }
@@ -3258,6 +3444,7 @@ sweep_vectors (void)
       for (vector = (struct Lisp_Vector *) block->data;
            VECTOR_IN_BLOCK (vector, block); vector = next)
         {
+          ASAN_UNPOISON_VECTOR_BLOCK (block);
           if (XVECTOR_MARKED_P (vector))
             {
               XUNMARK_VECTOR (vector);
@@ -3633,6 +3820,23 @@ struct symbol_block
   struct symbol_block *next;
 };
 
+#if GC_ASAN_POISON_OBJECTS
+# define ASAN_POISON_SYMBOL_BLOCK(s) \
+  __asan_poison_memory_region ((s)->symbols, sizeof ((s)->symbols))
+# define ASAN_UNPOISON_SYMBOL_BLOCK(s) \
+  __asan_unpoison_memory_region ((s)->symbols, sizeof ((s)->symbols))
+# define ASAN_POISON_SYMBOL(sym) \
+  __asan_poison_memory_region ((sym), sizeof (*(sym)))
+# define ASAN_UNPOISON_SYMBOL(sym) \
+  __asan_unpoison_memory_region ((sym), sizeof (*(sym)))
+
+#else
+# define ASAN_POISON_SYMBOL_BLOCK(s) ((void) 0)
+# define ASAN_UNPOISON_SYMBOL_BLOCK(s) ((void) 0)
+# define ASAN_POISON_SYMBOL(sym) ((void) 0)
+# define ASAN_UNPOISON_SYMBOL(sym) ((void) 0)
+#endif
+
 /* Current symbol block and index of first unused Lisp_Symbol
    structure in it.  */
 
@@ -3686,6 +3890,7 @@ Its value is void, and its function definition and property list are nil.  */)
 
   if (symbol_free_list)
     {
+      ASAN_UNPOISON_SYMBOL (symbol_free_list);
       XSETSYMBOL (val, symbol_free_list);
       symbol_free_list = symbol_free_list->u.s.next;
     }
@@ -3695,10 +3900,13 @@ Its value is void, and its function definition and property list are nil.  */)
         {
           struct symbol_block *new
             = lisp_malloc (sizeof *new, false, MEM_TYPE_SYMBOL);
+          ASAN_POISON_SYMBOL_BLOCK (new);
           new->next = symbol_block;
           symbol_block = new;
           symbol_block_index = 0;
         }
+
+      ASAN_UNPOISON_SYMBOL (&symbol_block->symbols[symbol_block_index]);
       XSETSYMBOL (val, &symbol_block->symbols[symbol_block_index]);
       symbol_block_index++;
     }
@@ -4624,6 +4832,11 @@ static struct Lisp_String *
 live_string_holding (struct mem_node *m, void *p)
 {
   eassert (m->type == MEM_TYPE_STRING);
+#if GC_ASAN_POISON_OBJECTS
+  if (__asan_address_is_poisoned (p))
+    return NULL;
+#endif
+
   struct string_block *b = m->start;
   char *cp = p;
   ptrdiff_t offset = cp - (char *) &b->strings[0];
@@ -4640,6 +4853,10 @@ live_string_holding (struct mem_node *m, void *p)
           || off == offsetof (struct Lisp_String, u.s.data))
         {
           struct Lisp_String *s = p = cp -= off;
+#if GC_ASAN_POISON_OBJECTS
+          if (__asan_region_is_poisoned (s, sizeof (*s)))
+            return NULL;
+#endif
           if (s->u.s.data)
             return s;
         }
@@ -4661,6 +4878,11 @@ static struct Lisp_Cons *
 live_cons_holding (struct mem_node *m, void *p)
 {
   eassert (m->type == MEM_TYPE_CONS);
+#if GC_ASAN_POISON_OBJECTS
+  if (__asan_address_is_poisoned (p))
+    return NULL;
+#endif
+
   struct cons_block *b = m->start;
   char *cp = p;
   ptrdiff_t offset = cp - (char *) &b->conses[0];
@@ -4678,6 +4900,10 @@ live_cons_holding (struct mem_node *m, void *p)
           || off == offsetof (struct Lisp_Cons, u.s.u.cdr))
         {
           struct Lisp_Cons *s = p = cp -= off;
+#if GC_ASAN_POISON_OBJECTS
+          if (__asan_region_is_poisoned (s, sizeof (*s)))
+            return NULL;
+#endif
           if (!deadp (s->u.s.car))
             return s;
         }
@@ -4700,6 +4926,10 @@ static struct Lisp_Symbol *
 live_symbol_holding (struct mem_node *m, void *p)
 {
   eassert (m->type == MEM_TYPE_SYMBOL);
+#if GC_ASAN_POISON_OBJECTS
+  if (__asan_address_is_poisoned (p))
+    return NULL;
+#endif
   struct symbol_block *b = m->start;
   char *cp = p;
   ptrdiff_t offset = cp - (char *) &b->symbols[0];
@@ -4725,6 +4955,10 @@ live_symbol_holding (struct mem_node *m, void *p)
           || off == offsetof (struct Lisp_Symbol, u.s.next))
         {
           struct Lisp_Symbol *s = p = cp -= off;
+#if GC_ASAN_POISON_OBJECTS
+          if (__asan_region_is_poisoned (s, sizeof (*s)))
+            return NULL;
+#endif
           if (!deadp (s->u.s.function))
             return s;
         }
@@ -4747,6 +4981,11 @@ static struct Lisp_Float *
 live_float_holding (struct mem_node *m, void *p)
 {
   eassert (m->type == MEM_TYPE_FLOAT);
+#if GC_ASAN_POISON_OBJECTS
+  if (__asan_address_is_poisoned (p))
+    return NULL;
+#endif
+
   struct float_block *b = m->start;
   char *cp = p;
   ptrdiff_t offset = cp - (char *) &b->floats[0];
@@ -4761,8 +5000,12 @@ live_float_holding (struct mem_node *m, void *p)
           && (b != float_block
               || offset / sizeof b->floats[0] < float_block_index))
         {
-          p = cp - off;
-          return p;
+          struct Lisp_Float *f = (struct Lisp_Float *) (cp - off);
+#if GC_ASAN_POISON_OBJECTS
+          if (__asan_region_is_poisoned (f, sizeof (*f)))
+            return NULL;
+#endif
+          return f;
         }
     }
   return NULL;
@@ -5338,7 +5581,8 @@ valid_lisp_object_p (Lisp_Object obj)
       if (valid <= 0)
         return valid;
 
-      if (SUBRP (obj))
+      /* Strings and conses produced by AUTO_STRING etc. all get here.  */
+      if (SUBRP (obj) || STRINGP (obj) || CONSP (obj))
         return 1;
 
 #ifdef HAVE_STATIC_LISP_GLOBALS
@@ -6287,6 +6531,7 @@ garbage_collect (void)
 
 #ifdef HAVE_X_WINDOWS
   mark_xterm ();
+  mark_xselect ();
 #endif
 
 #ifdef HAVE_NS
@@ -6647,7 +6892,7 @@ mark_buffer (struct buffer *buffer)
   if (!BUFFER_LIVE_P (buffer))
       mark_object (BVAR (buffer, undo_list));
 
-  if (buffer->overlays)
+  if (!itree_empty_p (buffer->overlays))
     mark_overlays (buffer->overlays->root);
 
   /* If this is an indirect buffer, mark its base buffer.  */
@@ -7292,11 +7537,13 @@ sweep_conses (void)
                   struct Lisp_Cons *acons = &cblk->conses[pos];
                   if (!XCONS_MARKED_P (acons))
                     {
+                      ASAN_UNPOISON_CONS (&cblk->conses[pos]);
                       this_free++;
                       cblk->conses[pos].u.s.u.chain = cons_free_list;
                       cons_free_list = &cblk->conses[pos];
                       cons_free_list->u.s.car = dead_object ();
-                    }
+                      ASAN_POISON_CONS (&cblk->conses[pos]);
+                    }
                   else
                     {
                       num_used++;
@@ -7314,6 +7561,7 @@ sweep_conses (void)
         {
           *cprev = cblk->next;
           /* Unhook from the free list.  */
+          ASAN_UNPOISON_CONS (&cblk->conses[0]);
           cons_free_list = cblk->conses[0].u.s.u.chain;
           lisp_align_free (cblk);
         }
@@ -7340,6 +7588,7 @@ sweep_floats (void)
   for (struct float_block *fblk; (fblk = *fprev); )
     {
       int this_free = 0;
+      ASAN_UNPOISON_FLOAT_BLOCK (fblk);
       for (int i = 0; i < lim; i++)
         {
           struct Lisp_Float *afloat = &fblk->floats[i];
@@ -7347,6 +7596,7 @@ sweep_floats (void)
             {
               this_free++;
               fblk->floats[i].u.chain = float_free_list;
+              ASAN_POISON_FLOAT (&fblk->floats[i]);
               float_free_list = &fblk->floats[i];
             }
           else
@@ -7363,7 +7613,8 @@ sweep_floats (void)
         {
           *fprev = fblk->next;
           /* Unhook from the free list.  */
-          float_free_list = fblk->floats[0].u.chain;
+          ASAN_UNPOISON_FLOAT (&fblk->floats[0]);
+          float_free_list = fblk->floats[0].u.chain;
           lisp_align_free (fblk);
         }
       else
@@ -7389,13 +7640,14 @@ sweep_intervals (void)
   for (struct interval_block *iblk; (iblk = *iprev); )
     {
       int this_free = 0;
-
+      ASAN_UNPOISON_INTERVAL_BLOCK (iblk);
       for (int i = 0; i < lim; i++)
         {
           if (!iblk->intervals[i].gcmarkbit)
             {
               set_interval_parent (&iblk->intervals[i], interval_free_list);
               interval_free_list = &iblk->intervals[i];
+              ASAN_POISON_INTERVAL (&iblk->intervals[i]);
               this_free++;
             }
           else
@@ -7412,6 +7664,7 @@ sweep_intervals (void)
         {
           *iprev = iblk->next;
           /* Unhook from the free list.  */
+          ASAN_UNPOISON_INTERVAL (&iblk->intervals[0]);
           interval_free_list = INTERVAL_PARENT (&iblk->intervals[0]);
           lisp_free (iblk);
         }
@@ -7441,6 +7694,8 @@ sweep_symbols (void)
 
   for (sblk = symbol_block; sblk; sblk = *sprev)
     {
+      ASAN_UNPOISON_SYMBOL_BLOCK (sblk);
+
       int this_free = 0;
       struct Lisp_Symbol *sym = sblk->symbols;
       struct Lisp_Symbol *end = sym + lim;
@@ -7462,7 +7717,8 @@ sweep_symbols (void)
               sym->u.s.next = symbol_free_list;
               symbol_free_list = sym;
               symbol_free_list->u.s.function = dead_object ();
-              ++this_free;
+              ASAN_POISON_SYMBOL (sym);
+              ++this_free;
             }
           else
             {
@@ -7481,6 +7737,7 @@ sweep_symbols (void)
         {
           *sprev = sblk->next;
           /* Unhook from the free list.  */
+          ASAN_UNPOISON_SYMBOL (&sblk->symbols[0]);
           symbol_free_list = sblk->symbols[0].u.s.next;
           lisp_free (sblk);
         }
@@ -7548,9 +7805,17 @@ DEFUN ("memory-info", Fmemory_info, Smemory_info, 0, 0, 0,
        doc: /* Return a list of (TOTAL-RAM FREE-RAM TOTAL-SWAP FREE-SWAP).
 All values are in Kbytes.  If there is no swap space,
 last two values are zero.  If the system is not supported
-or memory information can't be obtained, return nil.  */)
+or memory information can't be obtained, return nil.
+If `default-directory’ is remote, return memory information of the
+respective remote host.  */)
   (void)
 {
+  Lisp_Object handler
+    = Ffind_file_name_handler (BVAR (current_buffer, directory),
+                               Qmemory_info);
+  if (!NILP (handler))
+    return call1 (handler, Qmemory_info);
+
 #if defined HAVE_LINUX_SYSINFO
   struct sysinfo si;
   uintmax_t units;
@@ -7972,6 +8237,8 @@ do hash-consing of the objects allocated to pure space.  */);
                doc: /* Non-nil means Emacs cannot get much more Lisp memory.  */);
   Vmemory_full = Qnil;
 
+  DEFSYM (Qmemory_info, "memory-info");
+
   DEFSYM (Qconses, "conses");
   DEFSYM (Qsymbols, "symbols");
   DEFSYM (Qstrings, "strings");
diff --git a/src/buffer.c b/src/buffer.c
index ac7f4f8e9d4..38c3150f2c5 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -604,7 +604,6 @@ even if it is dead.  The return value is never nil.  */)
   set_buffer_intervals (b, NULL);
   BUF_UNCHANGED_MODIFIED (b) = 1;
   BUF_OVERLAY_UNCHANGED_MODIFIED (b) = 1;
-  BUF_CHARS_UNCHANGED_MODIFIED (b) = 1;
   BUF_END_UNCHANGED (b) = 0;
   BUF_BEG_UNCHANGED (b) = 0;
   *(BUF_GPT_ADDR (b)) = *(BUF_Z_ADDR (b)) = 0; /* Put an anchor '\0'.  */
@@ -1748,7 +1747,19 @@ other_buffer_safely (Lisp_Object buffer)
     if (candidate_buffer (buf, buffer))
       return buf;
 
-  return safe_call (1, Qget_scratch_buffer_create);
+  /* This function must return a valid buffer, since it is frequently
+     our last line of defense in the face of the expected buffers
+     becoming dead under our feet.  safe_call below could return nil
+     if recreating *scratch* in Lisp, which does some fancy stuff,
+     signals an error in some weird use case.  */
+  buf = safe_call (1, Qget_scratch_buffer_create);
+  if (NILP (buf))
+    {
+      AUTO_STRING (scratch, "*scratch*");
+      buf = Fget_buffer_create (scratch, Qnil);
+      Fset_buffer_major_mode (buf);
+    }
+  return buf;
 }
 
 DEFUN ("buffer-enable-undo", Fbuffer_enable_undo, Sbuffer_enable_undo,
@@ -3899,11 +3910,11 @@ the value is (point-min).  */)
 /* These functions are for debugging overlays.  */
 
 DEFUN ("overlay-lists", Foverlay_lists, Soverlay_lists, 0, 0, 0,
-       doc: /* Return a pair of lists giving all the overlays of the current buffer.
-The car has all the overlays before the overlay center;
-the cdr has all the overlays after the overlay center.
-Recentering overlays moves overlays between these lists.
-The lists you get are copies, so that changing them has no effect.
+       doc: /* Return a list giving all the overlays of the current buffer.
+
+For backward compatibility, the value is actually a list that
+holds another list; the overlays are in the inner list.
+The list you get is a copy, so that changing it has no effect.
 However, the overlays you get are the real objects that the buffer uses. */)
   (void)
 {
@@ -3919,7 +3930,12 @@ However, the overlays you get are the real objects that the buffer uses. */)
 DEFUN ("overlay-recenter", Foverlay_recenter, Soverlay_recenter, 1, 1, 0,
        doc: /* Recenter the overlays of the current buffer around position POS.
 That makes overlay lookup faster for positions near POS (but perhaps slower
-for positions far away from POS).  */)
+for positions far away from POS).
+
+Since Emacs 29.1, this function is a no-op, because the implementation
+of overlays changed and their lookup is now fast regardless of their
+position in the buffer.  In particular, this function no longer affects
+the value returned by `overlay-lists'.  */)
   (Lisp_Object pos)
 {
   CHECK_FIXNUM_COERCE_MARKER (pos);
@@ -5898,7 +5914,42 @@ this threshold.
 If nil, these display shortcuts will always remain disabled.
 
 There is no reason to change that value except for debugging purposes.  */);
-  XSETFASTINT (Vlong_line_threshold, 10000);
+  XSETFASTINT (Vlong_line_threshold, 50000);
+
+  DEFVAR_INT ("long-line-locked-narrowing-region-size",
+              long_line_locked_narrowing_region_size,
+              doc: /* Region size for locked narrowing in buffers with long lines.
+
+This variable has effect only in buffers which contain one or more
+lines whose length is above `long-line-threshold', which see.  For
+performance reasons, in such buffers, low-level hooks such as
+`fontification-functions' or `post-command-hook' are executed on a
+narrowed buffer, with a narrowing locked with `narrowing-lock'.  This
+variable specifies the size of the narrowed region around point.
+
+To disable that narrowing, set this variable to 0.
+
+See also `long-line-locked-narrowing-bol-search-limit'.
+
+There is no reason to change that value except for debugging purposes.  */);
+  long_line_locked_narrowing_region_size = 500000;
+
+  DEFVAR_INT ("long-line-locked-narrowing-bol-search-limit",
+              long_line_locked_narrowing_bol_search_limit,
+              doc: /* Limit for beginning of line search in buffers with long lines.
+
+This variable has effect only in buffers which contain one or more
+lines whose length is above `long-line-threshold', which see.  For
+performance reasons, in such buffers, low-level hooks such as
+`fontification-functions' or `post-command-hook' are executed on a
+narrowed buffer, with a narrowing locked with `narrowing-lock'.  The
+variable `long-line-locked-narrowing-region-size' specifies the size
+of the narrowed region around point.  This variable, which should be a
+small integer, specifies the number of characters by which that region
+can be extended backwards to make it start at the beginning of a line.
+
+There is no reason to change that value except for debugging purposes.  */);
+  long_line_locked_narrowing_bol_search_limit = 128;
 
   DEFVAR_INT ("large-hscroll-threshold", large_hscroll_threshold,
     doc: /* Horizontal scroll of truncated lines above which to use redisplay shortcuts.
diff --git a/src/buffer.h b/src/buffer.h
index dded0cd98c1..7c3d1903140 100644
--- a/src/buffer.h
+++ b/src/buffer.h
@@ -149,18 +149,12 @@ enum { BEG = 1, BEG_BYTE = BEG };
 #define BUF_BEG_UNCHANGED(buf) ((buf)->text->beg_unchanged)
 #define BUF_END_UNCHANGED(buf) ((buf)->text->end_unchanged)
 
-#define BUF_CHARS_UNCHANGED_MODIFIED(buf) \
-  ((buf)->text->chars_unchanged_modified)
-
 #define UNCHANGED_MODIFIED \
   BUF_UNCHANGED_MODIFIED (current_buffer)
 #define OVERLAY_UNCHANGED_MODIFIED \
   BUF_OVERLAY_UNCHANGED_MODIFIED (current_buffer)
 #define BEG_UNCHANGED BUF_BEG_UNCHANGED (current_buffer)
 #define END_UNCHANGED BUF_END_UNCHANGED (current_buffer)
-
-#define CHARS_UNCHANGED_MODIFIED \
-  BUF_CHARS_UNCHANGED_MODIFIED (current_buffer)
 
 /* Functions to set PT in the current buffer, or another buffer.  */
 
@@ -274,11 +268,6 @@ struct buffer_text
        end_unchanged contain no useful information.  */
     modiff_count overlay_unchanged_modified;
 
-    /* CHARS_MODIFF as of last redisplay that finished.  It's used
-       when we only care about changes in actual buffer text, not in
-       any other kind of changes, like properties etc.  */
-    modiff_count chars_unchanged_modified;
-
     /* Properties of this buffer's text.  */
     INTERVAL intervals;
 
@@ -1277,8 +1266,7 @@ set_buffer_intervals (struct buffer *b, INTERVAL i)
 INLINE bool
 buffer_has_overlays (void)
 {
-  return current_buffer->overlays
-         && (current_buffer->overlays->root != NULL);
+  return !itree_empty_p (current_buffer->overlays);
 }
 
 /* Functions for accessing a character or byte,
diff --git a/src/data.c b/src/data.c
index c6b85e17bc2..7ad06a9faa5 100644
--- a/src/data.c
+++ b/src/data.c
@@ -2619,6 +2619,7 @@ bool-vector.  IDX starts at 0.  */)
     }
   else if (RECORDP (array))
     {
+      CHECK_IMPURE (array, XVECTOR (array));
       if (idxval < 0 || idxval >= PVSIZE (array))
         args_out_of_range (array, idx);
       ASET (array, idxval, newelt);
diff --git a/src/dispextern.h b/src/dispextern.h
index 2afbdeabaab..df6134e68f0 100644
--- a/src/dispextern.h
+++ b/src/dispextern.h
@@ -2342,6 +2342,14 @@ struct it
      optimize display.  */
   ptrdiff_t narrowed_zv;
 
+  /* Begin position of the buffer for the locked narrowing around
+     low-level hooks.  */
+  ptrdiff_t locked_narrowing_begv;
+
+  /* End position of the buffer for the locked narrowing around
+     low-level hooks.  */
+  ptrdiff_t locked_narrowing_zv;
+
   /* C string to iterate over.  Non-null means get characters from
      this string, otherwise characters are read from current_buffer
      or it->string.  */
@@ -3405,6 +3413,8 @@ void init_iterator (struct it *, struct window *, ptrdiff_t,
 ptrdiff_t get_narrowed_begv (struct window *, ptrdiff_t);
 ptrdiff_t get_narrowed_zv (struct window *, ptrdiff_t);
 ptrdiff_t get_closer_narrowed_begv (struct window *, ptrdiff_t);
+ptrdiff_t get_locked_narrowing_begv (ptrdiff_t);
+ptrdiff_t get_locked_narrowing_zv (ptrdiff_t);
 void init_iterator_to_row_start (struct it *, struct window *,
                                  struct glyph_row *);
 void start_display (struct it *, struct window *, struct text_pos);
diff --git a/src/editfns.c b/src/editfns.c
index 17dca4708ed..8d56ef21d90 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -2653,88 +2653,216 @@ DEFUN ("delete-and-extract-region", Fdelete_and_extract_region,
   return del_range_1 (XFIXNUM (start), XFIXNUM (end), 1, 1);
 }
 
-DEFUN ("widen", Fwiden, Swiden, 0, 0, "",
-       doc: /* Remove restrictions (narrowing) from current buffer.
-This allows the buffer's full text to be seen and edited.
+/* Alist of buffers in which locked narrowing is used.  The car of
+   each list element is a buffer, the cdr is a list of triplets (tag
+   begv-marker zv-marker).  The last element of that list always uses
+   the (uninterned) Qoutermost_narrowing tag and records the narrowing
+   bounds that were set by the user and that are visible on display.
+   This alist is used internally by narrow-to-region, widen,
+   narrowing-lock, narrowing-unlock and save-restriction.  */
+static Lisp_Object narrowing_locks;
+
+/* Add BUF with its LOCKS in the narrowing_locks alist.  */
+static void
+narrowing_locks_add (Lisp_Object buf, Lisp_Object locks)
+{
+  narrowing_locks = nconc2 (list1 (list2 (buf, locks)), narrowing_locks);
+}
 
-Note that, when the current buffer contains one or more lines whose
-length is above `long-line-threshold', Emacs may decide to leave, for
-performance reasons, the accessible portion of the buffer unchanged
-after this function is called from low-level hooks, such as
-`jit-lock-functions' or `post-command-hook'.  */)
-  (void)
+/* Remove BUF and its locks from the narrowing_locks alist.  Do
+   nothing if BUF is not present in narrowing_locks.  */
+static void
+narrowing_locks_remove (Lisp_Object buf)
+{
+  narrowing_locks = Fdelq (Fassoc (buf, narrowing_locks, Qnil),
+                           narrowing_locks);
+}
+
+/* Retrieve one of the BEGV/ZV bounds of a narrowing in BUF from the
+   narrowing_locks alist, as a pointer to a struct Lisp_Marker, or
+   NULL if BUF is not in narrowing_locks or is a killed buffer.  When
+   OUTERMOST is true, the bounds that were set by the user and that
+   are visible on display are returned.  Otherwise the innermost
+   locked narrowing bounds are returned.  */
+static struct Lisp_Marker *
+narrowing_lock_get_bound (Lisp_Object buf, bool begv, bool outermost)
+{
+  if (NILP (Fbuffer_live_p (buf)))
+    return NULL;
+  Lisp_Object buffer_locks = assq_no_quit (buf, narrowing_locks);
+  if (NILP (buffer_locks))
+    return NULL;
+  buffer_locks = XCAR (XCDR (buffer_locks));
+  Lisp_Object bounds
+    = outermost
+      ? XCDR (assq_no_quit (Qoutermost_narrowing, buffer_locks))
+      : XCDR (XCAR (buffer_locks));
+  eassert (! NILP (bounds));
+  Lisp_Object marker = begv ? XCAR (bounds) : XCAR (XCDR (bounds));
+  eassert (EQ (Fmarker_buffer (marker), buf));
+  return XMARKER (marker);
+}
+
+/* Retrieve the tag of the innermost narrowing in BUF.  Return nil if
+   BUF is not in narrowing_locks or is a killed buffer.  */
+static Lisp_Object
+narrowing_lock_peek_tag (Lisp_Object buf)
 {
-  if (! NILP (Vrestrictions_locked))
+  if (NILP (Fbuffer_live_p (buf)))
     return Qnil;
-  if (BEG != BEGV || Z != ZV)
-    current_buffer->clip_changed = 1;
-  BEGV = BEG;
-  BEGV_BYTE = BEG_BYTE;
-  SET_BUF_ZV_BOTH (current_buffer, Z, Z_BYTE);
-  /* Changing the buffer bounds invalidates any recorded current column.  */
-  invalidate_current_column ();
-  return Qnil;
+  Lisp_Object buffer_locks = assq_no_quit (buf, narrowing_locks);
+  if (NILP (buffer_locks))
+    return Qnil;
+  Lisp_Object tag = XCAR (XCAR (XCAR (XCDR (buffer_locks))));
+  eassert (! NILP (tag));
+  return tag;
 }
 
+/* Add a LOCK for BUF in the narrowing_locks alist.  */
 static void
-unwind_locked_begv (Lisp_Object point_min)
+narrowing_lock_push (Lisp_Object buf, Lisp_Object lock)
 {
-  SET_BUF_BEGV (current_buffer, XFIXNUM (point_min));
+  Lisp_Object buffer_locks = assq_no_quit (buf, narrowing_locks);
+  if (NILP (buffer_locks))
+    narrowing_locks_add (buf, list1 (lock));
+  else
+    XSETCDR (buffer_locks, list1 (nconc2 (list1 (lock),
+                                          XCAR (XCDR (buffer_locks)))));
 }
 
+/* Remove the innermost lock in BUF from the narrowing_locks alist.
+   Do nothing if BUF is not present in narrowing_locks.  */
 static void
-unwind_locked_zv (Lisp_Object point_max)
+narrowing_lock_pop (Lisp_Object buf)
 {
-  SET_BUF_ZV (current_buffer, XFIXNUM (point_max));
+  Lisp_Object buffer_locks = assq_no_quit (buf, narrowing_locks);
+  if (NILP (buffer_locks))
+    return;
+  if (EQ (narrowing_lock_peek_tag (buf), Qoutermost_narrowing))
+    narrowing_locks_remove (buf);
+  else
+    XSETCDR (buffer_locks, list1 (XCDR (XCAR (XCDR (buffer_locks)))));
 }
 
-/* Internal function for Fnarrow_to_region, meant to be used with a
-   third argument 'true', in which case it should be followed by "specbind
-   (Qrestrictions_locked, Qt)".  */
-Lisp_Object
-narrow_to_region_internal (Lisp_Object start, Lisp_Object end, bool lock)
+static void
+unwind_reset_outermost_narrowing (Lisp_Object buf)
 {
-  EMACS_INT s = fix_position (start), e = fix_position (end);
-
-  if (e < s)
+  struct Lisp_Marker *begv = narrowing_lock_get_bound (buf, true, false);
+  struct Lisp_Marker *zv = narrowing_lock_get_bound (buf, false, false);
+  if (begv != NULL && zv != NULL)
     {
-      EMACS_INT tem = s; s = e; e = tem;
+      SET_BUF_BEGV_BOTH (XBUFFER (buf), begv->charpos, begv->bytepos);
+      SET_BUF_ZV_BOTH (XBUFFER (buf), zv->charpos, zv->bytepos);
     }
+  else
+    narrowing_locks_remove (buf);
+}
 
-  if (lock)
+/* Restore the narrowing bounds that were set by the user, and restore
+   the bounds of the locked narrowing upon return.
+   In particular, this function is called when redisplay starts, so
+   that if a Lisp function executed during redisplay calls (redisplay)
+   while a locked narrowing is in effect, the locked narrowing will
+   not be visible on display.  */
+void
+reset_outermost_narrowings (void)
+{
+  Lisp_Object val, buf;
+  for (val = narrowing_locks; CONSP (val); val = XCDR (val))
     {
-      if (!(BEGV <= s && s <= e && e <= ZV))
-        args_out_of_range (start, end);
+      buf = XCAR (XCAR (val));
+      eassert (BUFFERP (buf));
+      struct Lisp_Marker *begv = narrowing_lock_get_bound (buf, true, true);
+      struct Lisp_Marker *zv = narrowing_lock_get_bound (buf, false, true);
+      if (begv != NULL && zv != NULL)
+        {
+          SET_BUF_BEGV_BOTH (XBUFFER (buf), begv->charpos, begv->bytepos);
+          SET_BUF_ZV_BOTH (XBUFFER (buf), zv->charpos, zv->bytepos);
+          record_unwind_protect (unwind_reset_outermost_narrowing, buf);
+        }
+      else
+        narrowing_locks_remove (buf);
+    }
+}
 
-      if (BEGV != s || ZV != e)
-        current_buffer->clip_changed = 1;
+/* Helper functions to save and restore the narrowing locks of the
+   current buffer in Fsave_restriction.  */
+static Lisp_Object
+narrowing_locks_save (void)
+{
+  Lisp_Object buf = Fcurrent_buffer ();
+  Lisp_Object locks = assq_no_quit (buf, narrowing_locks);
+  if (NILP (locks))
+    return Qnil;
+  locks = XCAR (XCDR (locks));
+  return Fcons (buf, Fcopy_sequence (locks));
+}
 
-      record_unwind_protect (restore_point_unwind, Fpoint_marker ());
-      record_unwind_protect (unwind_locked_begv, Fpoint_min ());
-      record_unwind_protect (unwind_locked_zv, Fpoint_max ());
+static void
+narrowing_locks_restore (Lisp_Object buf_and_saved_locks)
+{
+  if (NILP (buf_and_saved_locks))
+    return;
+  Lisp_Object buf = XCAR (buf_and_saved_locks);
+  Lisp_Object saved_locks = XCDR (buf_and_saved_locks);
+  narrowing_locks_remove (buf);
+  narrowing_locks_add (buf, saved_locks);
+}
 
-      SET_BUF_BEGV (current_buffer, s);
-      SET_BUF_ZV (current_buffer, e);
+static void
+unwind_narrow_to_region_locked (Lisp_Object tag)
+{
+  Fnarrowing_unlock (tag);
+  Fwiden ();
+}
+
+/* Narrow current_buffer to BEGV-ZV with a narrowing locked with TAG.  */
+void
+narrow_to_region_locked (Lisp_Object begv, Lisp_Object zv, Lisp_Object tag)
+{
+  Fnarrow_to_region (begv, zv);
+  Fnarrowing_lock (tag);
+  record_unwind_protect (restore_point_unwind, Fpoint_marker ());
+  record_unwind_protect (unwind_narrow_to_region_locked, tag);
+}
+
+DEFUN ("widen", Fwiden, Swiden, 0, 0, "",
+       doc: /* Remove restrictions (narrowing) from current buffer.
+
+This allows the buffer's full text to be seen and edited, unless
+restrictions have been locked with `narrowing-lock', which see, in
+which case the narrowing that was current when `narrowing-lock' was
+called is restored.  */)
+  (void)
+{
+  Fset (Qoutermost_narrowing, Qnil);
+  Lisp_Object buf = Fcurrent_buffer ();
+  Lisp_Object tag = narrowing_lock_peek_tag (buf);
+
+  if (NILP (tag))
+    {
+      if (BEG != BEGV || Z != ZV)
+        current_buffer->clip_changed = 1;
+      BEGV = BEG;
+      BEGV_BYTE = BEG_BYTE;
+      SET_BUF_ZV_BOTH (current_buffer, Z, Z_BYTE);
     }
   else
     {
-      if (! NILP (Vrestrictions_locked))
-        return Qnil;
-
-      if (!(BEG <= s && s <= e && e <= Z))
-        args_out_of_range (start, end);
-
-      if (BEGV != s || ZV != e)
+      struct Lisp_Marker *begv = narrowing_lock_get_bound (buf, true, false);
+      struct Lisp_Marker *zv = narrowing_lock_get_bound (buf, false, false);
+      eassert (begv != NULL && zv != NULL);
+      if (begv->charpos != BEGV || zv->charpos != ZV)
         current_buffer->clip_changed = 1;
-
-      SET_BUF_BEGV (current_buffer, s);
-      SET_BUF_ZV (current_buffer, e);
+      SET_BUF_BEGV_BOTH (current_buffer, begv->charpos, begv->bytepos);
+      SET_BUF_ZV_BOTH (current_buffer, zv->charpos, zv->bytepos);
+      /* If the only remaining bounds in narrowing_locks for
+         current_buffer are the bounds that were set by the user, no
+         locked narrowing is in effect in current_buffer anymore:
+         remove it from the narrowing_locks alist.  */
+      if (EQ (tag, Qoutermost_narrowing))
+        narrowing_lock_pop (buf);
     }
-
-  if (PT < s)
-    SET_PT (s);
-  if (e < PT)
-    SET_PT (e);
   /* Changing the buffer bounds invalidates any recorded current column.  */
   invalidate_current_column ();
   return Qnil;
@@ -2751,14 +2879,110 @@ When calling from Lisp, pass two arguments START and END:
 positions (integers or markers) bounding the text that should
 remain visible.
 
-Note that, when the current buffer contains one or more lines whose
-length is above `long-line-threshold', Emacs may decide to leave, for
-performance reasons, the accessible portion of the buffer unchanged
-after this function is called from low-level hooks, such as
-`jit-lock-functions' or `post-command-hook'.  */)
+When restrictions have been locked with `narrowing-lock', which see,
+`narrow-to-region' can be used only within the limits of the
+restrictions that were current when `narrowing-lock' was called.  If
+the START or END arguments are outside these limits, the corresponding
+limit of the locked restriction is used instead of the argument.  */)
   (Lisp_Object start, Lisp_Object end)
 {
-  return narrow_to_region_internal (start, end, false);
+  EMACS_INT s = fix_position (start), e = fix_position (end);
+
+  if (e < s)
+    {
+      EMACS_INT tem = s; s = e; e = tem;
+    }
+
+  if (!(BEG <= s && s <= e && e <= Z))
+    args_out_of_range (start, end);
+
+  Lisp_Object buf = Fcurrent_buffer ();
+  if (! NILP (narrowing_lock_peek_tag (buf)))
+    {
+      struct Lisp_Marker *begv = narrowing_lock_get_bound (buf, true, false);
+      struct Lisp_Marker *zv = narrowing_lock_get_bound (buf, false, false);
+      eassert (begv != NULL && zv != NULL);
+      /* Limit the start and end positions to those of the locked
+         narrowing.  */
+      if (s < begv->charpos) s = begv->charpos;
+      if (s > zv->charpos) s = zv->charpos;
+      if (e < begv->charpos) e = begv->charpos;
+      if (e > zv->charpos) e = zv->charpos;
+    }
+
+  /* Record the accessible range of the buffer when narrow-to-region
+     is called, that is, before applying the narrowing.  It is used
+     only by narrowing-lock.  */
+  Fset (Qoutermost_narrowing, list3 (Qoutermost_narrowing,
+                                     Fpoint_min_marker (),
+                                     Fpoint_max_marker ()));
+
+  if (BEGV != s || ZV != e)
+    current_buffer->clip_changed = 1;
+
+  SET_BUF_BEGV (current_buffer, s);
+  SET_BUF_ZV (current_buffer, e);
+
+  if (PT < s)
+    SET_PT (s);
+  if (e < PT)
+    SET_PT (e);
+  /* Changing the buffer bounds invalidates any recorded current column.  */
+  invalidate_current_column ();
+  return Qnil;
+}
+
+DEFUN ("narrowing-lock", Fnarrowing_lock, Snarrowing_lock, 1, 1, 0,
+       doc: /* Lock the current narrowing with TAG.
+
+When restrictions are locked, `narrow-to-region' and `widen' can be
+used only within the limits of the restrictions that were current when
+`narrowing-lock' was called, unless the lock is removed by calling
+`narrowing-unlock' with TAG.
+
+Locking restrictions should be used sparingly, after carefully
+considering the potential adverse effects on the code that will be
+executed within locked restrictions.  It is typically meant to be used
+around portions of code that would become too slow, and make Emacs
+unresponsive, if they were executed in a large buffer.  For example,
+restrictions are locked by Emacs around low-level hooks such as
+`fontification-functions' or `post-command-hook'.
+
+Locked restrictions are never visible on display, and can therefore
+not be used as a stronger variant of normal restrictions.  */)
+  (Lisp_Object tag)
+{
+  Lisp_Object buf = Fcurrent_buffer ();
+  Lisp_Object outermost_narrowing
+    = buffer_local_value (Qoutermost_narrowing, buf);
+  /* If narrowing-lock is called without being preceded by
+     narrow-to-region, do nothing.  */
+  if (NILP (outermost_narrowing))
+    return Qnil;
+  if (NILP (narrowing_lock_peek_tag (buf)))
+    narrowing_lock_push (buf, outermost_narrowing);
+  narrowing_lock_push (buf, list3 (tag,
+                                   Fpoint_min_marker (),
+                                   Fpoint_max_marker ()));
+  return Qnil;
+}
+
+DEFUN ("narrowing-unlock", Fnarrowing_unlock, Snarrowing_unlock, 1, 1, 0,
+       doc: /* Unlock a narrowing locked with (narrowing-lock TAG).
+
+Unlocking restrictions locked with `narrowing-lock' should be used
+sparingly, after carefully considering the reasons why restrictions
+were locked.  Restrictions are typically locked around portions of
+code that would become too slow, and make Emacs unresponsive, if they
+were executed in a large buffer.  For example, restrictions are locked
+by Emacs around low-level hooks such as `fontification-functions' or
+`post-command-hook'.  */)
+  (Lisp_Object tag)
+{
+  Lisp_Object buf = Fcurrent_buffer ();
+  if (EQ (narrowing_lock_peek_tag (buf), tag))
+    narrowing_lock_pop (buf);
+  return Qnil;
 }
 
 Lisp_Object
@@ -2858,11 +3082,12 @@ DEFUN ("save-restriction", Fsave_restriction, Ssave_restriction, 0, UNEVALLED, 0
        doc: /* Execute BODY, saving and restoring current buffer's restrictions.
 The buffer's restrictions make parts of the beginning and end invisible.
 \(They are set up with `narrow-to-region' and eliminated with `widen'.)
-This special form, `save-restriction', saves the current buffer's restrictions
-when it is entered, and restores them when it is exited.
+This special form, `save-restriction', saves the current buffer's
+restrictions, as well as their locks if they have been locked with
+`narrowing-lock', when it is entered, and restores them when it is exited.
 So any `narrow-to-region' within BODY lasts only until the end of the form.
-The old restrictions settings are restored
-even in case of abnormal exit (throw or error).
+The old restrictions settings are restored even in case of abnormal exit
+\(throw or error).
 
 The value returned is the value of the last form in BODY.
 
@@ -2877,6 +3102,7 @@ usage: (save-restriction &rest BODY)  */)
   specpdl_ref count = SPECPDL_INDEX ();
 
   record_unwind_protect (save_restriction_restore, save_restriction_save ());
+  record_unwind_protect (narrowing_locks_restore, narrowing_locks_save ());
   val = Fprogn (body);
   return unbind_to (count, val);
 }
@@ -3053,18 +3279,18 @@ The other arguments are substituted into it to make the result, a string.
 The format control string may contain %-sequences meaning to substitute
 the next available argument, or the argument explicitly specified:
 
-%s means print a string argument.  Actually, prints any object, with `princ'.
-%d means print as signed number in decimal.
-%o means print a number in octal.
-%x means print a number in hex.
+%s means produce a string argument.  Actually, produces any object with `princ'.
+%d means produce as signed number in decimal.
+%o means produce a number in octal.
+%x means produce a number in hex.
 %X is like %x, but uses upper case.
-%e means print a number in exponential notation.
-%f means print a number in decimal-point notation.
-%g means print a number in exponential notation if the exponent would be
+%e means produce a number in exponential notation.
+%f means produce a number in decimal-point notation.
+%g means produce a number in exponential notation if the exponent would be
    less than -4 or greater than or equal to the precision (default: 6);
-   otherwise it prints in decimal-point notation.
-%c means print a number as a single character.
-%S means print any object as an s-expression (using `prin1').
+   otherwise it produces in decimal-point notation.
+%c means produce a number as a single character.
+%S means produce any object as an s-expression (using `prin1').
 
 The argument used for %d, %o, %x, %e, %f, %g or %c must be a number.
 %o, %x, and %X treat arguments as unsigned if `binary-as-unsigned' is t
@@ -3099,7 +3325,7 @@ included even if the precision is zero, and also forces trailing
 zeros after the decimal point to be left in place.
 
 The width specifier supplies a lower limit for the length of the
-printed representation.  The padding, if any, normally goes on the
+produced representation.  The padding, if any, normally goes on the
 left, but it goes on the right if the - flag is present.  The padding
 character is normally a space, but it is 0 if the 0 flag is present.
 The 0 flag is ignored if the - flag is present, or the format sequence
@@ -3108,7 +3334,7 @@ is something other than %d, %o, %x, %e, %f, and %g.
 For %e and %f sequences, the number after the "." in the precision
 specifier says how many decimal places to show; if zero, the decimal
 point itself is omitted.  For %g, the precision specifies how many
-significant digits to print; zero or omitted are treated as 1.
+significant digits to produce; zero or omitted are treated as 1.
 For %s and %S, the precision specifier truncates the string to the
 given width.
 
@@ -4518,6 +4744,8 @@ syms_of_editfns (void)
   DEFSYM (Qwall, "wall");
   DEFSYM (Qpropertize, "propertize");
 
+  staticpro (&narrowing_locks);
+
   DEFVAR_LISP ("inhibit-field-text-motion", Vinhibit_field_text_motion,
                doc: /* Non-nil means text motion commands don't notice fields.  */);
   Vinhibit_field_text_motion = Qnil;
@@ -4577,11 +4805,12 @@ This variable is experimental; email 32252@debbugs.gnu.org if you need
 it to be non-nil.  */);
   binary_as_unsigned = false;
 
-  DEFSYM (Qrestrictions_locked, "restrictions-locked");
-  DEFVAR_LISP ("restrictions-locked", Vrestrictions_locked,
-               doc: /* If non-nil, restrictions are currently locked.  */);
-  Vrestrictions_locked = Qnil;
-  Funintern (Qrestrictions_locked, Qnil);
+  DEFVAR_LISP ("outermost-narrowing", Voutermost_narrowing,
+               doc: /* Outermost narrowing bounds, if any.  Internal use only.  */);
+  Voutermost_narrowing = Qnil;
+  Fmake_variable_buffer_local (Qoutermost_narrowing);
+  DEFSYM (Qoutermost_narrowing, "outermost-narrowing");
+  Funintern (Qoutermost_narrowing, Qnil);
 
   defsubr (&Spropertize);
   defsubr (&Schar_equal);
@@ -4674,6 +4903,8 @@ it to be non-nil.  */);
   defsubr (&Sdelete_and_extract_region);
   defsubr (&Swiden);
   defsubr (&Snarrow_to_region);
+  defsubr (&Snarrowing_lock);
+  defsubr (&Snarrowing_unlock);
   defsubr (&Ssave_restriction);
   defsubr (&Stranspose_regions);
 }
diff --git a/src/emacs-module.h.in b/src/emacs-module.h.in
index bef89b059fc..d485de5aa18 100644
--- a/src/emacs-module.h.in
+++ b/src/emacs-module.h.in
@@ -183,6 +183,21 @@ struct emacs_env_29
 @module_env_snippet_29@
 };
 
+struct emacs_env_30
+{
+@module_env_snippet_25@
+
+@module_env_snippet_26@
+
+@module_env_snippet_27@
+
+@module_env_snippet_28@
+
+@module_env_snippet_29@
+
+@module_env_snippet_30@
+};
+
 /* Every module should define a function as follows.  */
 extern int emacs_module_init (struct emacs_runtime *runtime)
   EMACS_NOEXCEPT
diff --git a/src/emacs.c b/src/emacs.c
index 105539aa192..d8a2863fd9c 100644
--- a/src/emacs.c
+++ b/src/emacs.c
@@ -295,6 +295,7 @@ Initialization options:\n\
 --no-site-lisp, -nsl        do not add site-lisp directories to load-path\n\
 --no-splash                 do not display a splash screen on startup\n\
 --no-window-system, -nw     do not communicate with X, ignoring $DISPLAY\n\
+--init-directory=DIR        use DIR when looking for the Emacs init files.\n\
 ",
     "\
 --quick, -Q                 equivalent to:\n\
@@ -1923,6 +1924,12 @@ Using an Emacs configured with --with-x-toolkit=lucid does not have this problem
          Vcoding_system_hash_table.  */
       syms_of_coding ();        /* This should be after syms_of_fileio.  */
       init_frame_once ();       /* Before init_window_once.  */
+      /* init_window_once calls make_initial_frame, which calls
+         Fcurrent_time and bset_display_time, both of which allocate
+         bignums.  Without the following call to init_bignums, crashes
+         happen on Windows 9X after dumping when GC tries to free a
+         pointer allocated on the system heap.  */
+      init_bignum ();
       init_window_once ();      /* Init the window system.  */
 #ifdef HAVE_WINDOW_SYSTEM
       init_fringe_once ();      /* Swap bitmaps if necessary.  */
diff --git a/src/fileio.c b/src/fileio.c
index 92335b639cd..e7c2af81421 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -134,6 +134,7 @@ static dev_t timestamp_file_system;
    is added here.  */
 static Lisp_Object Vwrite_region_annotation_buffers;
 
+static Lisp_Object emacs_readlinkat (int, char const *);
 static Lisp_Object file_name_directory (Lisp_Object);
 static bool a_write (int, Lisp_Object, ptrdiff_t, ptrdiff_t,
                      Lisp_Object *, struct coding_system *);
@@ -2219,7 +2220,7 @@ permissions.  */)
       report_file_error ("Copying permissions to", newname);
     }
 #else /* not WINDOWSNT */
-  ifd = emacs_open (SSDATA (encoded_file), O_RDONLY, 0);
+  ifd = emacs_open (SSDATA (encoded_file), O_RDONLY | O_NONBLOCK, 0);
 
   if (ifd < 0)
     report_file_error ("Opening input file", file);
@@ -2427,16 +2428,11 @@ DEFUN ("make-directory-internal", Fmake_directory_internal,
   (Lisp_Object directory)
 {
   const char *dir;
-  Lisp_Object handler;
   Lisp_Object encoded_dir;
 
   CHECK_STRING (directory);
   directory = Fexpand_file_name (directory, Qnil);
 
-  handler = Ffind_file_name_handler (directory, Qmake_directory_internal);
-  if (!NILP (handler))
-    return call2 (handler, Qmake_directory_internal, directory);
-
   encoded_dir = ENCODE_FILE (directory);
 
   dir = SSDATA (encoded_dir);
@@ -2710,31 +2706,19 @@ This is what happens in interactive use with M-x.  */)
     }
   if (dirp)
     call4 (Qcopy_directory, file, newname, Qt, Qnil);
-  else
-    {
-      Lisp_Object symlink_target
-        = (S_ISLNK (file_st.st_mode)
-           ? check_emacs_readlinkat (AT_FDCWD, file, SSDATA (encoded_file))
-           : Qnil);
-      if (!NILP (symlink_target))
-        Fmake_symbolic_link (symlink_target, newname, ok_if_already_exists);
-      else if (S_ISFIFO (file_st.st_mode))
-        {
-          /* If it's a FIFO, calling `copy-file' will hang if it's a
-             inter-file system move, so do it here.  (It will signal
-             an error in that case, but it won't hang in any case.)  */
-          if (!NILP (ok_if_already_exists))
-            barf_or_query_if_file_exists (newname, false,
-                                          "rename to it",
-                                          FIXNUMP (ok_if_already_exists),
-                                          false);
-          if (rename (SSDATA (encoded_file), SSDATA (encoded_newname)) != 0)
-            report_file_errno ("Renaming", list2 (file, newname), errno);
-          return Qnil;
-        }
+  else if (S_ISREG (file_st.st_mode))
+    Fcopy_file (file, newname, ok_if_already_exists, Qt, Qt, Qt);
+  else if (S_ISLNK (file_st.st_mode))
+    {
+      Lisp_Object target = emacs_readlinkat (AT_FDCWD,
+                                             SSDATA (encoded_file));
+      if (!NILP (target))
+        Fmake_symbolic_link (target, newname, ok_if_already_exists);
       else
-        Fcopy_file (file, newname, ok_if_already_exists, Qt, Qt, Qt);
+        report_file_error ("Renaming", list2 (file, newname));
     }
+  else
+    report_file_errno ("Renaming", list2 (file, newname), rename_errno);
 
   specpdl_ref count = SPECPDL_INDEX ();
   specbind (Qdelete_by_moving_to_trash, Qnil);
diff --git a/src/fns.c b/src/fns.c
index 7cc6d00afef..eeb65cadf3f 100644
--- a/src/fns.c
+++ b/src/fns.c
@@ -334,7 +334,9 @@ Letter-case is significant, but text properties are ignored. */)
 DEFUN ("string-equal", Fstring_equal, Sstring_equal, 2, 2, 0,
        doc: /* Return t if two strings have identical contents.
 Case is significant, but text properties are ignored.
-Symbols are also allowed; their print names are used instead.  */)
+Symbols are also allowed; their print names are used instead.
+
+See also `string-equal-ignore-case'.  */)
   (register Lisp_Object s1, Lisp_Object s2)
 {
   if (SYMBOLP (s1))
@@ -495,8 +497,13 @@ Symbols are also allowed; their print names are used instead.  */)
           int ws = sizeof (word_t);
           const word_t *w1 = (const word_t *) SDATA (string1);
           const word_t *w2 = (const word_t *) SDATA (string2);
-          while (b < nb - ws + 1 && w1[b / ws] == w2[b / ws])
-            b += ws;
+          while (b < nb - ws + 1)
+            {
+              if (UNALIGNED_LOAD_SIZE (w1, b / ws)
+                  != UNALIGNED_LOAD_SIZE (w2, b / ws))
+                break;
+              b += ws;
+            }
         }
 
       /* Scan forward to the differing byte.  */
@@ -3936,7 +3943,7 @@ system.
 If the region can't be decoded, signal an error and don't modify the buffer.
 Optional third argument BASE64URL determines whether to use the URL variant
 of the base 64 encoding, as defined in RFC 4648.
-If optional fourth argument INGORE-INVALID is non-nil invalid characters
+If optional fourth argument IGNORE-INVALID is non-nil invalid characters
 are ignored instead of signaling an error.  */)
      (Lisp_Object beg, Lisp_Object end, Lisp_Object base64url,
       Lisp_Object ignore_invalid)
diff --git a/src/frame.c b/src/frame.c
index b57b296be54..7d902dabd4f 100644
--- a/src/frame.c
+++ b/src/frame.c
@@ -1892,12 +1892,61 @@ other_frames (struct frame *f, bool invisible, bool force)
 
       if (f != f1)
         {
+          /* The following code is defined out because it is
+             responsible for a performance drop under X connections
+             over a network, and its purpose is unclear.  XSync does
+             not handle events (or call any callbacks defined by
+             Emacs), and as such it should not note any "recent change
+             in visibility".
+
+             When writing new code, please try as hard as possible to
+             avoid calls that require a roundtrip to the X server.
+             When such calls are inevitable, use the XCB library to
+             handle multiple consecutive requests with a data reply in
+             a more asynchronous fashion.  The following code
+             demonstrates why:
+
+               rc = XGetWindowProperty (dpyinfo->display, window, ...
+               status = XGrabKeyboard (dpyinfo->display, ...
+
+             here, `XGetWindowProperty' will wait for a reply from the
+             X server before returning, and thus allowing Emacs to
+             make the XGrabKeyboard request, which in itself also
+             requires waiting a reply.  When XCB is available, this
+             code could be written:
+
+#ifdef HAVE_XCB
+               xcb_get_property_cookie_t cookie1;
+               xcb_get_property_reply_t *reply1;
+               xcb_grab_keyboard_cookie_t cookie2;
+               xcb_grab_keyboard_reply_t *reply2;
+
+               cookie1 = xcb_get_property (dpyinfo->xcb_connection, window, ...
+               cookie2 = xcb_grab_keyboard (dpyinfo->xcb_connection, ...
+               reply1 = xcb_get_property_reply (dpyinfo->xcb_connection,
+                                                cookie1);
+               reply2 = xcb_grab_keyboard_reply (dpyinfo->xcb_connection,
+                                                cookie2);
+#endif
+
+             In this code, the GetProperty and GrabKeyboard requests
+             are made simultaneously, and replies are then obtained
+             from the server at once, avoiding the extraneous
+             roundtrip to the X server after the call to
+             `XGetWindowProperty'.
+
+             However, please keep an alternative implementation
+             available for use when Emacs is built without XCB.  */
+
+#if 0
           /* Verify that we can still talk to the frame's X window, and
              note any recent change in visibility.  */
 #ifdef HAVE_X_WINDOWS
           if (FRAME_WINDOW_P (f1))
             x_sync (f1);
 #endif
+#endif
+
           if (!FRAME_TOOLTIP_P (f1)
               /* Tooltips and child frames count neither for
                  invisibility nor for deletions.  */
@@ -2214,17 +2263,24 @@ delete_frame (Lisp_Object frame, Lisp_Object force)
     /* Since a similar behavior was observed on the Lucid and Motif
        builds (see Bug#5802, Bug#21509, Bug#23499, Bug#27816), we now
        don't delete the terminal for these builds either.  */
-    if (terminal->reference_count == 0 &&
-        (terminal->type == output_x_window || terminal->type == output_pgtk))
+    if (terminal->reference_count == 0
+        && (terminal->type == output_x_window
+            || terminal->type == output_pgtk))
       terminal->reference_count = 1;
 #endif /* USE_X_TOOLKIT || USE_GTK */
+
     if (terminal->reference_count == 0)
       {
         Lisp_Object tmp;
         XSETTERMINAL (tmp, terminal);
 
         kb = NULL;
-        Fdelete_terminal (tmp, NILP (force) ? Qt : force);
+
+        /* If force is noelisp, the terminal is going away inside
+           x_delete_terminal, and a recursive call to Fdelete_terminal
+           is unsafe!  */
+        if (!EQ (force, Qnoelisp))
+          Fdelete_terminal (tmp, NILP (force) ? Qt : force);
       }
     else
       kb = terminal->kboard;
diff --git a/src/frame.h b/src/frame.h
index d6fd62b2ac2..dcd32036b86 100644
--- a/src/frame.h
+++ b/src/frame.h
@@ -1718,7 +1718,6 @@ extern void x_wm_set_icon_position (struct frame *, int, int);
 #if !defined USE_X_TOOLKIT
 extern const char *x_get_resource_string (const char *, const char *);
 #endif
-extern void x_sync (struct frame *);
 #endif /* HAVE_X_WINDOWS */
 
 #if !defined (HAVE_NS) && !defined (HAVE_PGTK)
diff --git a/src/gnutls.c b/src/gnutls.c
index 7f0aaf85a41..4093865cae5 100644
--- a/src/gnutls.c
+++ b/src/gnutls.c
@@ -2282,7 +2282,7 @@ gnutls_symmetric_aead (bool encrypting, gnutls_cipher_algorithm_t gca,
   Lisp_Object output;
   if (GNUTLS_E_SUCCESS <= ret)
     output = make_unibyte_string (storage, storage_length);
-  explicit_bzero (storage, storage_length);
+  memset_explicit (storage, 0, storage_length);
   gnutls_aead_cipher_deinit (acipher);
 
   if (ret < GNUTLS_E_SUCCESS)
diff --git a/src/gtkutil.c b/src/gtkutil.c
index a6bba096a43..592bb497749 100644
--- a/src/gtkutil.c
+++ b/src/gtkutil.c
@@ -2103,7 +2103,7 @@ xg_frame_restack (struct frame *f1, struct frame *f2, bool above_flag)
 
       gdk_window_restack (gwin1, gwin2, above_flag);
 #ifndef HAVE_PGTK
-      x_sync (f1);
+      XSync (FRAME_X_DISPLAY (f1), False);
 #else
       gdk_flush ();
 #endif
@@ -4793,7 +4793,7 @@ xg_update_scrollbar_pos (struct frame *f,
          here to get some events.  */
 
 #ifndef HAVE_PGTK
-      x_sync (f);
+      XSync (FRAME_X_DISPLAY (f), False);
 #else
       gdk_flush ();
 #endif
@@ -4894,7 +4894,7 @@ xg_update_horizontal_scrollbar_pos (struct frame *f,
       }
 
 #ifndef HAVE_PGTK
-      x_sync (f);
+      XSync (FRAME_X_DISPLAY (f), False);
 #else
       gdk_flush ();
 #endif
diff --git a/src/image.c b/src/image.c
index 600c32571e1..b881e43e951 100644
--- a/src/image.c
+++ b/src/image.c
@@ -193,8 +193,8 @@ static void anim_prune_animation_cache (Lisp_Object);
 #ifdef USE_CAIRO
 
 static Emacs_Pix_Container
-image_create_pix_container (struct frame *f, unsigned int width,
-                            unsigned int height, unsigned int depth)
+image_create_pix_container (unsigned int width, unsigned int height,
+                            unsigned int depth)
 {
   Emacs_Pix_Container pimg;
 
@@ -237,7 +237,7 @@ image_pix_container_create_from_bitmap_data (struct frame *f,
                                              unsigned long fg,
                                              unsigned long bg)
 {
-  Emacs_Pix_Container pimg = image_create_pix_container (f, width, height, 0);
+  Emacs_Pix_Container pimg = image_create_pix_container (width, height, 0);
   int bytes_per_line = (width + (CHAR_BIT - 1)) / CHAR_BIT;
 
   for (int y = 0; y < height; y++)
@@ -3342,7 +3342,7 @@ image_create_x_image_and_pixmap_1 (struct frame *f, int width, int height, int d
   eassert (input_blocked_p ());
 
   /* Allocate a pixmap of the same size.  */
-  *pixmap = image_create_pix_container (f, width, height, depth);
+  *pixmap = image_create_pix_container (width, height, depth);
   if (*pixmap == NO_PIXMAP)
     {
       *pimg = NULL;
@@ -11309,6 +11309,15 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
                                                     img->face_font_size);
           viewbox_height = svg_css_length_to_pixels (iheight, dpi,
                                                      img->face_font_size);
+
+          /* Here one dimension could be zero because in percent unit.
+             So calculate this dimension with the other.  */
+          if (! (0 < viewbox_width) && (iwidth.unit == RSVG_UNIT_PERCENT))
+            viewbox_width = (viewbox_height * viewbox.width / viewbox.height)
+              * iwidth.length;
+          else if (! (0 < viewbox_height) && (iheight.unit == RSVG_UNIT_PERCENT))
+            viewbox_height = (viewbox_width * viewbox.height / viewbox.width)
+              * iheight.length;
         }
       else if (has_width && has_viewbox)
         {
diff --git a/src/itree.c b/src/itree.c
index 04fa9e827a2..688d5c82476 100644
--- a/src/itree.c
+++ b/src/itree.c
@@ -15,7 +15,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 
 You should have received a copy of the GNU General Public License
-along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
+along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
 
 #include <config.h>
 #include <math.h>
@@ -1376,7 +1376,7 @@ itree_iterator_first_node (struct itree_tree *tree,
   return node;
 }
 
-/* Start a iterator enumerating all intervals in [BEGIN,END) in the
+/* Start an iterator enumerating all intervals in [BEGIN,END) in the
    given ORDER.  */
 
 struct itree_iterator *
diff --git a/src/itree.h b/src/itree.h
index 291fa53fd30..f1e2bf3bfde 100644
--- a/src/itree.h
+++ b/src/itree.h
@@ -15,7 +15,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 
 You should have received a copy of the GNU General Public License
-along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
+along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
 
 #ifndef ITREE_H
 #define ITREE_H
@@ -25,6 +25,8 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 
 #include "lisp.h"
 
+INLINE_HEADER_BEGIN
+
 /* The tree and node structs are mainly here, so they can be
    allocated.
 
@@ -114,6 +116,11 @@ extern void itree_node_set_region (struct itree_tree *, struct itree_node *,
                                    ptrdiff_t, ptrdiff_t);
 extern struct itree_tree *itree_create (void);
 extern void itree_destroy (struct itree_tree *);
+INLINE bool
+itree_empty_p (struct itree_tree *tree)
+{
+  return !tree || !tree->root;
+}
 extern intmax_t itree_size (struct itree_tree *);
 extern void itree_clear (struct itree_tree *);
 extern void itree_insert (struct itree_tree *, struct itree_node *,
@@ -178,4 +185,6 @@ struct itree_iterator
 #define ITREE_FOREACH_NARROW(beg, end) \
   itree_iterator_narrow (itree_iter_, beg, end)
 
+INLINE_HEADER_END
+
 #endif
diff --git a/src/keyboard.c b/src/keyboard.c
index 811998823cc..d68b50428a9 100644
--- a/src/keyboard.c
+++ b/src/keyboard.c
@@ -1910,10 +1910,14 @@ safe_run_hooks_maybe_narrowed (Lisp_Object hook, struct window *w)
 
   specbind (Qinhibit_quit, Qt);
 
-  if (current_buffer->long_line_optimizations_p)
-    narrow_to_region_internal (make_fixnum (get_narrowed_begv (w, PT)),
-                               make_fixnum (get_narrowed_zv (w, PT)),
-                               true);
+  if (current_buffer->long_line_optimizations_p
+      && long_line_locked_narrowing_region_size > 0)
+    {
+      ptrdiff_t begv = get_locked_narrowing_begv (PT);
+      ptrdiff_t zv = get_locked_narrowing_zv (PT);
+      if (begv != BEG || zv != Z)
+        narrow_to_region_locked (make_fixnum (begv), make_fixnum (zv), hook);
+    }
 
   run_hook_with_args (2, ((Lisp_Object []) {hook, hook}),
                       safe_run_hook_funcall);
@@ -12727,8 +12731,9 @@ the error might happen repeatedly and make Emacs nonfunctional.
 
 Note that, when the current buffer contains one or more lines whose
 length is above `long-line-threshold', these hook functions are called
-with the buffer narrowed to a small portion around point, and the
-narrowing is locked (see `narrow-to-region'), so that these hook
+with the buffer narrowed to a small portion around point (whose size
+is specified by `long-line-locked-narrowing-region-size'), and the
+narrowing is locked (see `narrowing-lock'), so that these hook
 functions cannot use `widen' to gain access to other portions of
 buffer text.
 
@@ -12748,8 +12753,9 @@ avoid making Emacs unresponsive while the user types.
 
 Note that, when the current buffer contains one or more lines whose
 length is above `long-line-threshold', these hook functions are called
-with the buffer narrowed to a small portion around point, and the
-narrowing is locked (see `narrow-to-region'), so that these hook
+with the buffer narrowed to a small portion around point (whose size
+is specified by `long-line-locked-narrowing-region-size'), and the
+narrowing is locked (see `narrowing-lock'), so that these hook
 functions cannot use `widen' to gain access to other portions of
 buffer text.
 
diff --git a/src/lisp.h b/src/lisp.h
index 3d9c48449aa..3791bf2b0c3 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -4728,7 +4728,8 @@ extern void save_restriction_restore (Lisp_Object);
 extern Lisp_Object make_buffer_string (ptrdiff_t, ptrdiff_t, bool);
 extern Lisp_Object make_buffer_string_both (ptrdiff_t, ptrdiff_t, ptrdiff_t,
                                             ptrdiff_t, bool);
-extern Lisp_Object narrow_to_region_internal (Lisp_Object, Lisp_Object, bool);
+extern void narrow_to_region_locked (Lisp_Object, Lisp_Object, Lisp_Object);
+extern void reset_outermost_narrowings (void);
 extern void init_editfns (void);
 extern void syms_of_editfns (void);
 
@@ -5336,6 +5337,26 @@ __lsan_ignore_object (void const *p)
 }
 #endif
 
+/* If built with USE_SANITIZER_UNALIGNED_LOAD defined, use compiler
+   provided ASan functions to perform unaligned loads, allowing ASan
+   to catch bugs which it might otherwise miss.  */
+#if defined HAVE_SANITIZER_COMMON_INTERFACE_DEFS_H \
+  && defined ADDRESS_SANITIZER                     \
+  && defined USE_SANITIZER_UNALIGNED_LOAD
+# include <sanitizer/common_interface_defs.h>
+# if (SIZE_MAX == UINT64_MAX)
+#  define UNALIGNED_LOAD_SIZE(a, i) \
+   (size_t) __sanitizer_unaligned_load64 ((void *) ((a) + (i)))
+# elif (SIZE_MAX == UINT32_MAX)
+#  define UNALIGNED_LOAD_SIZE(a, i) \
+   (size_t) __sanitizer_unaligned_load32 ((void *) ((a) + (i)))
+# else
+#  define UNALIGNED_LOAD_SIZE(a, i) *((a) + (i))
+# endif
+#else
+# define UNALIGNED_LOAD_SIZE(a, i) *((a) + (i))
+#endif
+
 extern void xputenv (const char *);
 
 extern char *egetenv_internal (const char *, ptrdiff_t);
diff --git a/src/lread.c b/src/lread.c
index 0a6e4201e40..d838a18de5a 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -3375,7 +3375,7 @@ read_bool_vector (Lisp_Object readcharfun)
           break;
         }
       if (INT_MULTIPLY_WRAPV (length, 10, &length)
-          | INT_ADD_WRAPV (length, c - '0', &length))
+          || INT_ADD_WRAPV (length, c - '0', &length))
         invalid_syntax ("#&", readcharfun);
     }
 
@@ -3421,7 +3421,7 @@ skip_lazy_string (Lisp_Object readcharfun)
           break;
         }
       if (INT_MULTIPLY_WRAPV (nskip, 10, &nskip)
-          | INT_ADD_WRAPV (nskip, c - '0', &nskip))
+          || INT_ADD_WRAPV (nskip, c - '0', &nskip))
         invalid_syntax ("#@", readcharfun);
       digits++;
       if (digits == 2 && nskip == 0)
@@ -5468,15 +5468,6 @@ to the specified file name if a suffix is allowed or required.  */);
   Vload_suffixes =
     Fcons (build_pure_c_string (MODULES_SECONDARY_SUFFIX), Vload_suffixes);
 #endif
-
-  DEFVAR_LISP ("dynamic-library-suffixes", Vdynamic_library_suffixes,
-               doc: /* A list of suffixes for loadable dynamic libraries.  */);
-  Vdynamic_library_suffixes =
-    Fcons (build_pure_c_string (DYNAMIC_LIB_SECONDARY_SUFFIX), Qnil);
-  Vdynamic_library_suffixes =
-    Fcons (build_pure_c_string (DYNAMIC_LIB_SUFFIX),
-           Vdynamic_library_suffixes);
-
 #endif
   DEFVAR_LISP ("module-file-suffix", Vmodule_file_suffix,
                doc: /* Suffix of loadable module file, or nil if modules are not supported.  */);
@@ -5485,6 +5476,20 @@ to the specified file name if a suffix is allowed or required.  */);
 #else
   Vmodule_file_suffix = Qnil;
 #endif
+
+  DEFVAR_LISP ("dynamic-library-suffixes", Vdynamic_library_suffixes,
+               doc: /* A list of suffixes for loadable dynamic libraries.  */);
+
+#ifndef MSDOS
+  Vdynamic_library_suffixes
+    = Fcons (build_pure_c_string (DYNAMIC_LIB_SECONDARY_SUFFIX), Qnil);
+  Vdynamic_library_suffixes
+    = Fcons (build_pure_c_string (DYNAMIC_LIB_SUFFIX),
+             Vdynamic_library_suffixes);
+#else
+  Vdynamic_library_suffixes = Qnil;
+#endif
+
   DEFVAR_LISP ("load-file-rep-suffixes", Vload_file_rep_suffixes,
                doc: /* List of suffixes that indicate representations of \
 the same file.
diff --git a/src/module-env-29.h b/src/module-env-29.h
index 6ca03773181..e69de29bb2d 100644
--- a/src/module-env-29.h
+++ b/src/module-env-29.h
@@ -1,3 +0,0 @@
-  /* Add module environment functions newly added in Emacs 29 here.
-     Before Emacs 29 is released, remove this comment and start
-     module-env-30.h on the master branch.  */
diff --git a/src/module-env-30.h b/src/module-env-30.h
new file mode 100644
index 00000000000..6ca03773181
--- /dev/null
+++ b/src/module-env-30.h
@@ -0,0 +1,3 @@
+  /* Add module environment functions newly added in Emacs 29 here.
+     Before Emacs 29 is released, remove this comment and start
+     module-env-30.h on the master branch.  */
diff --git a/src/pdumper.c b/src/pdumper.c
index 75fe697dcd7..70f90f0d8aa 100644
--- a/src/pdumper.c
+++ b/src/pdumper.c
@@ -2748,7 +2748,7 @@ dump_hash_table (struct dump_context *ctx,
 static dump_off
 dump_buffer (struct dump_context *ctx, const struct buffer *in_buffer)
 {
-#if CHECK_STRUCTS && !defined HASH_buffer_193CAA5E45
+#if CHECK_STRUCTS && !defined HASH_buffer_DB34E5D09F
 # error "buffer changed. See CHECK_STRUCTS comment in config.h."
 #endif
   struct buffer munged_buffer = *in_buffer;
@@ -2811,7 +2811,6 @@ dump_buffer (struct dump_context *ctx, const struct buffer *in_buffer)
       DUMP_FIELD_COPY (out, buffer, own_text.end_unchanged);
       DUMP_FIELD_COPY (out, buffer, own_text.unchanged_modified);
       DUMP_FIELD_COPY (out, buffer, own_text.overlay_unchanged_modified);
-      DUMP_FIELD_COPY (out, buffer, own_text.chars_unchanged_modified);
       if (buffer->own_text.intervals)
         dump_field_fixup_later (ctx, out, buffer, &buffer->own_text.intervals);
       dump_field_lv_rawptr (ctx, out, buffer, &buffer->own_text.markers,
@@ -2863,7 +2862,7 @@ dump_buffer (struct dump_context *ctx, const struct buffer *in_buffer)
   DUMP_FIELD_COPY (out, buffer, inhibit_buffer_hooks);
   DUMP_FIELD_COPY (out, buffer, long_line_optimizations_p);
 
-  if (buffer->overlays && buffer->overlays->root != NULL)
+  if (!itree_empty_p (buffer->overlays))
     /* We haven't implemented the code to dump overlays.  */
     emacs_abort ();
   else
@@ -3003,7 +3002,7 @@ dump_vectorlike (struct dump_context *ctx,
                  Lisp_Object lv,
                  dump_off offset)
 {
-#if CHECK_STRUCTS && !defined HASH_pvec_type_AFF6FED5BD
+#if CHECK_STRUCTS && !defined HASH_pvec_type_5F2059C47E
 # error "pvec_type changed. See CHECK_STRUCTS comment in config.h."
 #endif
   const struct Lisp_Vector *v = XVECTOR (lv);
diff --git a/src/sqlite.c b/src/sqlite.c
index ac860f55bcd..d9b9333fb3c 100644
--- a/src/sqlite.c
+++ b/src/sqlite.c
@@ -55,6 +55,7 @@ DEF_DLL_FN (SQLITE_API const char*, sqlite3_errmsg, (sqlite3*));
 #if SQLITE_VERSION_NUMBER >= 3007015
 DEF_DLL_FN (SQLITE_API const char*, sqlite3_errstr, (int));
 #endif
+DEF_DLL_FN (SQLITE_API const char*, sqlite3_libversion, (void));
 DEF_DLL_FN (SQLITE_API int, sqlite3_step, (sqlite3_stmt*));
 DEF_DLL_FN (SQLITE_API int, sqlite3_changes, (sqlite3*));
 DEF_DLL_FN (SQLITE_API int, sqlite3_column_count, (sqlite3_stmt*));
@@ -96,6 +97,7 @@ DEF_DLL_FN (SQLITE_API int, sqlite3_load_extension,
 # if SQLITE_VERSION_NUMBER >= 3007015
 #  undef sqlite3_errstr
 # endif
+# undef sqlite3_libversion
 # undef sqlite3_step
 # undef sqlite3_changes
 # undef sqlite3_column_count
@@ -124,6 +126,7 @@ DEF_DLL_FN (SQLITE_API int, sqlite3_load_extension,
 # if SQLITE_VERSION_NUMBER >= 3007015
 #  define sqlite3_errstr fn_sqlite3_errstr
 # endif
+# define sqlite3_libversion fn_sqlite3_libversion
 # define sqlite3_step fn_sqlite3_step
 # define sqlite3_changes fn_sqlite3_changes
 # define sqlite3_column_count fn_sqlite3_column_count
@@ -155,6 +158,7 @@ load_dll_functions (HMODULE library)
 #if SQLITE_VERSION_NUMBER >= 3007015
   LOAD_DLL_FN (library, sqlite3_errstr);
 #endif
+  LOAD_DLL_FN (library, sqlite3_libversion);
   LOAD_DLL_FN (library, sqlite3_step);
   LOAD_DLL_FN (library, sqlite3_changes);
   LOAD_DLL_FN (library, sqlite3_column_count);
@@ -763,6 +767,16 @@ This will free the resources held by SET.  */)
   return Qt;
 }
 
+DEFUN ("sqlite-version", Fsqlite_version, Ssqlite_version, 0, 0, 0,
+       doc: /* Return the version string of the SQLite library.
+Signal an error if SQLite support is not available.  */)
+  (void)
+{
+  if (!init_sqlite_functions ())
+    error ("sqlite support is not available");
+  return build_string (sqlite3_libversion ());
+}
+
 #endif /* HAVE_SQLITE3 */
 
 DEFUN ("sqlitep", Fsqlitep, Ssqlitep, 1, 1, 0,
@@ -814,6 +828,7 @@ syms_of_sqlite (void)
   defsubr (&Ssqlite_columns);
   defsubr (&Ssqlite_more_p);
   defsubr (&Ssqlite_finalize);
+  defsubr (&Ssqlite_version);
   DEFSYM (Qset, "set");
   DEFSYM (Qfull, "full");
 #endif
diff --git a/src/sysdep.c b/src/sysdep.c
index 736723bdf3d..8402ffe308c 100644
--- a/src/sysdep.c
+++ b/src/sysdep.c
@@ -2653,10 +2653,11 @@ emacs_perror (char const *message)
 int
 renameat_noreplace (int srcfd, char const *src, int dstfd, char const *dst)
 {
-#if defined SYS_renameat2 && defined RENAME_NOREPLACE
-  return syscall (SYS_renameat2, srcfd, src, dstfd, dst, RENAME_NOREPLACE);
-#elif defined CYGWIN && defined RENAME_NOREPLACE
+#if HAVE_RENAMEAT2 && defined RENAME_NOREPLACE
   return renameat2 (srcfd, src, dstfd, dst, RENAME_NOREPLACE);
+#elif defined SYS_renameat2 && defined RENAME_NOREPLACE
+  /* Linux kernel 3.15 (2014) or later, with glibc 2.27 (2018) or earlier.  */
+  return syscall (SYS_renameat2, srcfd, src, dstfd, dst, RENAME_NOREPLACE);
 #elif defined RENAME_EXCL
   return renameatx_np (srcfd, src, dstfd, dst, RENAME_EXCL);
 #else
diff --git a/src/timefns.c b/src/timefns.c
index eed2edf1cc0..dcc6403fd9d 100644
--- a/src/timefns.c
+++ b/src/timefns.c
@@ -40,6 +40,10 @@ along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
 #include <stdio.h>
 #include <stdlib.h>
 
+#ifdef WINDOWSNT
+extern clock_t sys_clock (void);
+#endif
+
 #ifdef HAVE_TIMEZONE_T
 # include <sys/param.h>
 # if defined __NetBSD_Version__ && __NetBSD_Version__ < 700000000
@@ -1194,7 +1198,7 @@ For example, nil stands for the current time.  */)
      quicker while we're at it.  This means (time-subtract X X) does
      not signal an error if X is not a valid time value, but that's OK.  */
   if (BASE_EQ (a, b))
-    return timespec_to_lisp ((struct timespec) {0});
+    return make_lisp_time ((struct timespec) {0});
 
   return time_arith (a, b, true);
 }
diff --git a/src/treesit.c b/src/treesit.c
index 21e1f866f78..c882d455137 100644
--- a/src/treesit.c
+++ b/src/treesit.c
@@ -52,7 +52,6 @@ along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
 #undef ts_node_named_descendant_for_byte_range
 #undef ts_node_next_named_sibling
 #undef ts_node_next_sibling
-#undef ts_node_parent
 #undef ts_node_prev_named_sibling
 #undef ts_node_prev_sibling
 #undef ts_node_start_byte
@@ -76,7 +75,9 @@ along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
 #undef ts_query_predicates_for_pattern
 #undef ts_query_string_value_for_id
 #undef ts_set_allocator
+#undef ts_tree_cursor_copy
 #undef ts_tree_cursor_current_node
+#undef ts_tree_cursor_delete
 #undef ts_tree_cursor_goto_first_child
 #undef ts_tree_cursor_goto_next_sibling
 #undef ts_tree_cursor_goto_parent
@@ -109,7 +110,6 @@ DEF_DLL_FN (TSNode, ts_node_named_descendant_for_byte_range,
             (TSNode, uint32_t, uint32_t));
 DEF_DLL_FN (TSNode, ts_node_next_named_sibling, (TSNode));
 DEF_DLL_FN (TSNode, ts_node_next_sibling, (TSNode));
-DEF_DLL_FN (TSNode, ts_node_parent, (TSNode));
 DEF_DLL_FN (TSNode, ts_node_prev_named_sibling, (TSNode));
 DEF_DLL_FN (TSNode, ts_node_prev_sibling, (TSNode));
 DEF_DLL_FN (uint32_t, ts_node_start_byte, (TSNode));
@@ -143,7 +143,9 @@ DEF_DLL_FN (const char *, ts_query_string_value_for_id,
             (const TSQuery *, uint32_t, uint32_t *));
 DEF_DLL_FN (void, ts_set_allocator,
             (void *(*)(size_t), void *(*)(size_t, size_t), void *(*)(void *, size_t), void (*)(void *)));
+DEF_DLL_FN (TSTreeCursor, ts_tree_cursor_copy, (const TSTreeCursor *));
 DEF_DLL_FN (TSNode, ts_tree_cursor_current_node, (const TSTreeCursor *));
+DEF_DLL_FN (void, ts_tree_cursor_delete, (const TSTreeCursor *));
 DEF_DLL_FN (bool, ts_tree_cursor_goto_first_child, (TSTreeCursor *));
 DEF_DLL_FN (bool, ts_tree_cursor_goto_next_sibling, (TSTreeCursor *));
 DEF_DLL_FN (bool, ts_tree_cursor_goto_parent, (TSTreeCursor *));
@@ -182,7 +184,6 @@ init_treesit_functions (void)
   LOAD_DLL_FN (library, ts_node_named_descendant_for_byte_range);
   LOAD_DLL_FN (library, ts_node_next_named_sibling);
   LOAD_DLL_FN (library, ts_node_next_sibling);
-  LOAD_DLL_FN (library, ts_node_parent);
   LOAD_DLL_FN (library, ts_node_prev_named_sibling);
   LOAD_DLL_FN (library, ts_node_prev_sibling);
   LOAD_DLL_FN (library, ts_node_start_byte);
@@ -206,7 +207,9 @@ init_treesit_functions (void)
   LOAD_DLL_FN (library, ts_query_predicates_for_pattern);
   LOAD_DLL_FN (library, ts_query_string_value_for_id);
   LOAD_DLL_FN (library, ts_set_allocator);
+  LOAD_DLL_FN (library, ts_tree_cursor_copy);
   LOAD_DLL_FN (library, ts_tree_cursor_current_node);
+  LOAD_DLL_FN (library, ts_tree_cursor_delete);
   LOAD_DLL_FN (library, ts_tree_cursor_goto_first_child);
   LOAD_DLL_FN (library, ts_tree_cursor_goto_next_sibling);
   LOAD_DLL_FN (library, ts_tree_cursor_goto_parent);
@@ -239,7 +242,6 @@ init_treesit_functions (void)
 #define ts_node_named_descendant_for_byte_range fn_ts_node_named_descendant_for_byte_range
 #define ts_node_next_named_sibling fn_ts_node_next_named_sibling
 #define ts_node_next_sibling fn_ts_node_next_sibling
-#define ts_node_parent fn_ts_node_parent
 #define ts_node_prev_named_sibling fn_ts_node_prev_named_sibling
 #define ts_node_prev_sibling fn_ts_node_prev_sibling
 #define ts_node_start_byte fn_ts_node_start_byte
@@ -263,7 +265,9 @@ init_treesit_functions (void)
 #define ts_query_predicates_for_pattern fn_ts_query_predicates_for_pattern
 #define ts_query_string_value_for_id fn_ts_query_string_value_for_id
 #define ts_set_allocator fn_ts_set_allocator
+#define ts_tree_cursor_copy fn_ts_tree_cursor_copy
 #define ts_tree_cursor_current_node fn_ts_tree_cursor_current_node
+#define ts_tree_cursor_delete fn_ts_tree_cursor_delete
 #define ts_tree_cursor_goto_first_child fn_ts_tree_cursor_goto_first_child
 #define ts_tree_cursor_goto_next_sibling fn_ts_tree_cursor_goto_next_sibling
 #define ts_tree_cursor_goto_parent fn_ts_tree_cursor_goto_parent
@@ -288,7 +292,7 @@ init_treesit_functions (void)
      slow enough to make insignificant any performance advantages from
      using the cursor.  Not exposing the cursor also minimizes the
      number of new types this adds to Emacs Lisp; currently, this adds
-     only the parser and node types.
+     only the parser, node, and compiled query types.
 
    - Because updating the change is handled on the C level as each
      change is made in the buffer, there is no way for Lisp to update
@@ -314,7 +318,7 @@ init_treesit_functions (void)
      See: https://github.com/tree-sitter/tree-sitter/issues/445
 
    treesit.h has some commentary on the two main data structure for
-   the parser and node.  treesit_ensure_position_synced has some
+   the parser and node.  treesit_sync_visible_region has some
    commentary on how we make tree-sitter play well with narrowing (the
    tree-sitter parser only sees the visible region, so we need to
    translate positions back and forth).  Most action happens in
@@ -384,7 +388,18 @@ init_treesit_functions (void)
    mysteriously drops.  3) what if a user uses so many stuff that the
    default cache size (20) is not enough and we end up thrashing?
    These are all imaginary scenarios but they are not impossible
-   :-) */
+   :-)
+
+   Parsers in indirect buffers: We make indirect buffers to share the
+   parser of its base buffer.  Indirect buffers and their base buffer
+   share the same buffer content but not other buffer attributes.  If
+   they have separate parser lists, changes made in an indirect buffer
+   will only update parsers of that indirect buffer, and not parsers
+   in the base buffer or other indirect buffers, and vice versa.  We
+   could keep track of all the base and indirect buffers, and update
+   all of their parsers, but ultimately decide to take a simpler
+   approach, which is to make indirect buffers share their base
+   buffer's parser list.  The discussion can be found in bug#59693.  */
 
 
 /*** Initialization */
@@ -697,9 +712,10 @@ void
 treesit_record_change (ptrdiff_t start_byte, ptrdiff_t old_end_byte,
                        ptrdiff_t new_end_byte)
 {
-  Lisp_Object parser_list;
-
-  parser_list = BVAR (current_buffer, ts_parser_list);
+  struct buffer *base_buffer = current_buffer;
+  if (current_buffer->base_buffer)
+    base_buffer = current_buffer->base_buffer;
+  Lisp_Object parser_list = BVAR (base_buffer, ts_parser_list);
 
   FOR_EACH_TAIL_SAFE (parser_list)
     {
@@ -707,6 +723,8 @@ treesit_record_change (ptrdiff_t start_byte, ptrdiff_t old_end_byte,
       Lisp_Object lisp_parser = XCAR (parser_list);
       treesit_check_parser (lisp_parser);
       TSTree *tree = XTS_PARSER (lisp_parser)->tree;
+      /* See comment (ref:visible-beg-null) if you wonder why we don't
+      update visible_beg/end when tree is NULL.  */
       if (tree != NULL)
         {
           eassert (start_byte <= old_end_byte);
@@ -742,7 +760,7 @@ treesit_record_change (ptrdiff_t start_byte, ptrdiff_t old_end_byte,
           XTS_PARSER (lisp_parser)->timestamp++;
 
           /* VISIBLE_BEG/END records tree-sitter's range of view in
-             the buffer.  Ee need to adjust them when tree-sitter's
+             the buffer.  We need to adjust them when tree-sitter's
              view changes.  */
           ptrdiff_t visi_beg_delta;
           if (old_end_byte > new_end_byte)
@@ -765,20 +783,68 @@ treesit_record_change (ptrdiff_t start_byte, ptrdiff_t old_end_byte,
     }
 }
 
-/* Make sure PARSER's visible_beg and visible_end are in sync with
-   BUF_BEGV_BYTE and BUG_ZV_BYTE.  When calling this function you must
-   make sure the current buffer's size is not larger than UINT32_MAX.
-   Basically always call treesit_check_buffer_size before this
-   function.  */
+/* Comment (ref:visible-beg-null) The purpose of visible_beg/end is to
+   keep track of "which part of the buffer does the tree-sitter tree
+   see", in order to update the tree correctly.  Visible_beg/end have
+   two purposes: they "clip" buffer changes within them, and they
+   translate positions in the buffer to positions in the tree
+   (buffer position - visible_beg = tree position).
+
+   Conceptually, visible_beg/end hold the visible region of the buffer
+   when we last reparsed.  In-between two reparses, we don't really
+   care if the visible region of the buffer changes.
+
+   Right before we reparse, we make tree-sitter's visible region
+   match that of the buffer, and update visible_beg/end.
+
+   That is, the whole purpose of visible_beg/end (and also of
+   treesit_record_change and treesit_sync_visible_region) is to update
+   the tree (by ts_tree_edit).  So if the tree is NULL,
+   visible_beg/end are considered uninitialized.  Only when we already
+   have a tree, do we need to keep track of position changes and
+   update it correctly, so it can be fed into ts_parser_parse as the
+   old tree, so that tree-sitter will only parse the changed part,
+   incrementally.
+
+   In a nutshell, tree-sitter incremental parsing in Emacs looks like:
+
+   treesit_record_change (tree)  \
+   treesit_record_change (tree)  | user edits buffer
+   ...                           /
+
+   treesit_sync_visible_region (tree) \ treesit_ensure_parsed
+   ts_parser_parse(tree) -> tree      /
+
+   treesit_record_change (tree)  \
+   treesit_record_change (tree)  | user edits buffer
+   ...                           /
+
+   and so on.  */
+
+/* Make sure the tree's visible range is in sync with the buffer's
+   visible range, and PARSER's visible_beg and visible_end are in sync
+   with BUF_BEGV_BYTE and BUG_ZV_BYTE.  When calling this function you
+   must make sure the current buffer's size in bytes is not larger than
+   UINT32_MAX.  Basically, always call treesit_check_buffer_size before
+   this function.
+
+   If buffer range changed since last parse (visible_beg/end doesn't
+   match buffer visible beginning/end), set need_reparse to true.  */
 static void
-treesit_ensure_position_synced (Lisp_Object parser)
+treesit_sync_visible_region (Lisp_Object parser)
 {
   TSTree *tree = XTS_PARSER (parser)->tree;
+  struct buffer *buffer = XBUFFER (XTS_PARSER (parser)->buffer);
 
+  /* If we are setting visible_beg/end for the first time, we can skip
+  the offset acrobatics and updating the tree below.  */
   if (tree == NULL)
-    return;
+    {
+      XTS_PARSER (parser)->visible_beg = BUF_BEGV_BYTE (buffer);
+      XTS_PARSER (parser)->visible_end = BUF_ZV_BYTE (buffer);
+      return;
+    }
 
-  struct buffer *buffer = XBUFFER (XTS_PARSER (parser)->buffer);
   ptrdiff_t visible_beg = XTS_PARSER (parser)->visible_beg;
   ptrdiff_t visible_end = XTS_PARSER (parser)->visible_end;
   eassert (0 <= visible_beg);
@@ -787,6 +853,12 @@ treesit_ensure_position_synced (Lisp_Object parser)
   eassert (BUF_BEGV_BYTE (buffer) <= UINT32_MAX);
   eassert (BUF_ZV_BYTE (buffer) <= UINT32_MAX);
 
+  /* If buffer restriction changed and user requests for a node (hence
+     this function is called), we need to reparse.  */
+  if (visible_beg != BUF_BEGV_BYTE (buffer)
+      || visible_end != BUF_ZV_BYTE (buffer))
+    XTS_PARSER (parser)->need_reparse = true;
+
   /* Before we parse or set ranges, catch up with the narrowing
      situation.  We change visible_beg and visible_end to match
      BUF_BEGV_BYTE and BUF_ZV_BYTE, and inform tree-sitter of the
@@ -832,6 +904,8 @@ treesit_ensure_position_synced (Lisp_Object parser)
     }
   eassert (0 <= visible_beg);
   eassert (visible_beg <= visible_end);
+  eassert (visible_beg == BUF_BEGV_BYTE (buffer));
+  eassert (visible_end == BUF_ZV_BYTE (buffer));
 
   XTS_PARSER (parser)->visible_beg = visible_beg;
   XTS_PARSER (parser)->visible_end = visible_end;
@@ -875,16 +949,19 @@ treesit_call_after_change_functions (TSTree *old_tree, TSTree *new_tree,
 static void
 treesit_ensure_parsed (Lisp_Object parser)
 {
+  struct buffer *buffer = XBUFFER (XTS_PARSER (parser)->buffer);
+
+  /* Before we parse, catch up with the narrowing situation.  */
+  treesit_check_buffer_size (buffer);
+  /* This function has to run before we check for need_reparse flag,
+     because it might set the flag to true.  */
+  treesit_sync_visible_region (parser);
+
   if (!XTS_PARSER (parser)->need_reparse)
     return;
   TSParser *treesit_parser = XTS_PARSER (parser)->parser;
   TSTree *tree = XTS_PARSER (parser)->tree;
   TSInput input = XTS_PARSER (parser)->input;
-  struct buffer *buffer = XBUFFER (XTS_PARSER (parser)->buffer);
-
-  /* Before we parse, catch up with the narrowing situation.  */
-  treesit_check_buffer_size (buffer);
-  treesit_ensure_position_synced (parser);
 
   TSTree *new_tree = ts_parser_parse (treesit_parser, tree, input);
   /* This should be very rare (impossible, really): it only happens
@@ -983,8 +1060,8 @@ make_treesit_parser (Lisp_Object buffer, TSParser *parser,
   TSInput input = {lisp_parser, treesit_read_buffer, TSInputEncodingUTF8};
   lisp_parser->input = input;
   lisp_parser->need_reparse = true;
-  lisp_parser->visible_beg = BUF_BEGV (XBUFFER (buffer));
-  lisp_parser->visible_end = BUF_ZV (XBUFFER (buffer));
+  lisp_parser->visible_beg = BUF_BEGV_BYTE (XBUFFER (buffer));
+  lisp_parser->visible_end = BUF_ZV_BYTE (XBUFFER (buffer));
   lisp_parser->timestamp = 0;
   lisp_parser->deleted = false;
   lisp_parser->has_range = false;
@@ -1191,12 +1268,16 @@ DEFUN ("treesit-parser-create",
        1, 3, 0,
        doc: /* Create and return a parser in BUFFER for LANGUAGE.
 
-The parser is automatically added to BUFFER's parser list, as
-returned by `treesit-parser-list'.
-LANGUAGE is a language symbol.  If BUFFER is nil or omitted, it
-defaults to the current buffer.  If BUFFER already has a parser for
-LANGUAGE, return that parser, but if NO-REUSE is non-nil, always
-create a new parser.  */)
+The parser is automatically added to BUFFER's parser list, as returned
+by `treesit-parser-list'.  LANGUAGE is a language symbol.  If BUFFER
+is nil or omitted, it defaults to the current buffer.  If BUFFER
+already has a parser for LANGUAGE, return that parser, but if NO-REUSE
+is non-nil, always create a new parser.
+
+If that buffer is an indirect buffer, its base buffer is used instead.
+That is, indirect buffers use their base buffer's parsers.  Lisp
+programs should widen as necessary should they want to use a parser in
+an indirect buffer.  */)
   (Lisp_Object language, Lisp_Object buffer, Lisp_Object no_reuse)
 {
   treesit_initialize ();
@@ -1210,16 +1291,21 @@ create a new parser.  */)
       CHECK_BUFFER (buffer);
       buf = XBUFFER (buffer);
     }
+  if (buf->base_buffer)
+    buf = buf->base_buffer;
+
   treesit_check_buffer_size (buf);
 
   /* See if we can reuse a parser.  */
-  for (Lisp_Object tail = BVAR (buf, ts_parser_list);
-       NILP (no_reuse) && !NILP (tail);
-       tail = XCDR (tail))
+  if (NILP (no_reuse))
     {
-      struct Lisp_TS_Parser *parser = XTS_PARSER (XCAR (tail));
-      if (EQ (parser->language_symbol, language))
-        return XCAR (tail);
+      Lisp_Object tail = BVAR (buf, ts_parser_list);
+      FOR_EACH_TAIL (tail)
+      {
+        struct Lisp_TS_Parser *parser = XTS_PARSER (XCAR (tail));
+        if (EQ (parser->language_symbol, language))
+          return XCAR (tail);
+      }
     }
 
   /* Load language.  */
@@ -1268,7 +1354,10 @@ DEFUN ("treesit-parser-list",
        Ftreesit_parser_list, Streesit_parser_list,
        0, 1, 0,
        doc: /* Return BUFFER's parser list.
-BUFFER defaults to the current buffer.  */)
+
+BUFFER defaults to the current buffer.  If that buffer is an indirect
+buffer, its base buffer is used instead.  That is, indirect buffers
+use their base buffer's parsers.  */)
   (Lisp_Object buffer)
 {
   struct buffer *buf;
@@ -1279,6 +1368,9 @@ BUFFER defaults to the current buffer.  */)
       CHECK_BUFFER (buffer);
       buf = XBUFFER (buffer);
     }
+  if (buf->base_buffer)
+    buf = buf->base_buffer;
+
   /* Return a fresh list so messing with that list doesn't affect our
      internal data.  */
   Lisp_Object return_list = Qnil;
@@ -1365,9 +1457,10 @@ treesit_check_range_argument (Lisp_Object ranges)
   CHECK_LIST_END (tail, ranges);
 }
 
-/* Generate a list of ranges in Lisp from RANGES.  This function
-   doesn't take ownership of RANGES.  BUFFER is used to convert
-   between tree-sitter buffer offset and buffer position.  */
+/* Generate a list of ranges in Lisp from RANGES.  Assumes tree-sitter
+   tree and the buffer has the same visible region (wrt narrowing).
+   This function doesn't take ownership of RANGES.  BUFFER is used to
+   convert between tree-sitter buffer offset and buffer position.  */
 static Lisp_Object
 treesit_make_ranges (const TSRange *ranges, uint32_t len,
                      struct buffer *buffer)
@@ -1412,7 +1505,7 @@ buffer.  */)
   treesit_initialize ();
   /* Before we parse, catch up with narrowing/widening.  */
   treesit_check_buffer_size (XBUFFER (XTS_PARSER (parser)->buffer));
-  treesit_ensure_position_synced (parser);
+  treesit_sync_visible_region (parser);
 
   bool success;
   if (NILP (ranges))
@@ -1439,9 +1532,9 @@ buffer.  */)
       for (int idx = 0; !NILP (ranges); idx++, ranges = XCDR (ranges))
         {
           Lisp_Object range = XCAR (ranges);
-          EMACS_INT beg_byte = buf_charpos_to_bytepos (buffer,
+          ptrdiff_t beg_byte = buf_charpos_to_bytepos (buffer,
                                                        XFIXNUM (XCAR (range)));
-          EMACS_INT end_byte = buf_charpos_to_bytepos (buffer,
+          ptrdiff_t end_byte = buf_charpos_to_bytepos (buffer,
                                                        XFIXNUM (XCDR (range)));
           /* Shouldn't violate assertion since we just checked for
              buffer size at the beginning of this function.  */
@@ -1476,8 +1569,8 @@ DEFUN ("treesit-parser-included-ranges",
        Streesit_parser_included_ranges,
        1, 1, 0,
        doc: /* Return the ranges set for PARSER.
-See `treesit-parser-set-ranges'.  If no ranges are set for PARSER,
-return nil.  */)
+If no ranges are set for PARSER, return nil.
+See also `treesit-parser-set-included-ranges'.  */)
   (Lisp_Object parser)
 {
   treesit_check_parser (parser);
@@ -1498,7 +1591,7 @@ return nil.  */)
   /* Our return value depends on the buffer state (BUF_BEGV_BYTE,
      etc), so we need to sync up.  */
   treesit_check_buffer_size (XBUFFER (XTS_PARSER (parser)->buffer));
-  treesit_ensure_position_synced (parser);
+  treesit_sync_visible_region (parser);
 
   struct buffer *buffer = XBUFFER (XTS_PARSER (parser)->buffer);
   return treesit_make_ranges (ranges, len, buffer);
@@ -1580,6 +1673,17 @@ treesit_check_node (Lisp_Object obj)
     xsignal1 (Qtreesit_node_outdated, obj);
 }
 
+/* Checks that OBJ is a positive integer and it is within the visible
+   portion of BUF. */
+static void
+treesit_check_position (Lisp_Object obj, struct buffer *buf)
+{
+  treesit_check_positive_integer (obj);
+  ptrdiff_t pos = XFIXNUM (obj);
+  if (pos < BUF_BEGV (buf) || pos > BUF_ZV (buf))
+    xsignal1 (Qargs_out_of_range, obj);
+}
+
 bool
 treesit_node_uptodate_p (Lisp_Object obj)
 {
@@ -1658,6 +1762,8 @@ If NODE is nil, return nil.  */)
   return build_string (string);
 }
 
+static TSTreeCursor treesit_cursor_helper (TSNode, Lisp_Object);
+
 DEFUN ("treesit-node-parent",
        Ftreesit_node_parent, Streesit_node_parent, 1, 1, 0,
        doc: /* Return the immediate parent of NODE.
@@ -1668,13 +1774,18 @@ Return nil if NODE has no parent.  If NODE is nil, return nil.  */)
   treesit_check_node (node);
   treesit_initialize ();
 
-  TSNode treesit_node = XTS_NODE (node)->node;
-  TSNode parent = ts_node_parent (treesit_node);
+  Lisp_Object return_value = Qnil;
 
-  if (ts_node_is_null (parent))
-    return Qnil;
-
-  return make_treesit_node (XTS_NODE (node)->parser, parent);
+  TSNode treesit_node = XTS_NODE (node)->node;
+  Lisp_Object parser = XTS_NODE (node)->parser;
+  TSTreeCursor cursor = treesit_cursor_helper (treesit_node, parser);
+  if (ts_tree_cursor_goto_parent (&cursor))
+  {
+    TSNode parent = ts_tree_cursor_current_node (&cursor);
+    return_value = make_treesit_node (parser, parent);
+  }
+  ts_tree_cursor_delete (&cursor);
+  return return_value;
 }
 
 DEFUN ("treesit-node-child",
@@ -1928,14 +2039,12 @@ Note that this function returns an immediate child, not the smallest
   if (NILP (node))
     return Qnil;
   treesit_check_node (node);
-  treesit_check_positive_integer (pos);
 
   struct buffer *buf = XBUFFER (XTS_PARSER (XTS_NODE (node)->parser)->buffer);
   ptrdiff_t visible_beg = XTS_PARSER (XTS_NODE (node)->parser)->visible_beg;
   ptrdiff_t byte_pos = buf_charpos_to_bytepos (buf, XFIXNUM (pos));
 
-  if (byte_pos < BUF_BEGV_BYTE (buf) || byte_pos > BUF_ZV_BYTE (buf))
-    xsignal1 (Qargs_out_of_range, pos);
+  treesit_check_position (pos, buf);
 
   treesit_initialize ();
 
@@ -1966,19 +2075,14 @@ If NODE is nil, return nil.  */)
 {
   if (NILP (node)) return Qnil;
   treesit_check_node (node);
-  CHECK_INTEGER (beg);
-  CHECK_INTEGER (end);
 
   struct buffer *buf = XBUFFER (XTS_PARSER (XTS_NODE (node)->parser)->buffer);
   ptrdiff_t visible_beg = XTS_PARSER (XTS_NODE (node)->parser)->visible_beg;
   ptrdiff_t byte_beg = buf_charpos_to_bytepos (buf, XFIXNUM (beg));
   ptrdiff_t byte_end = buf_charpos_to_bytepos (buf, XFIXNUM (end));
 
-  /* Checks for BUFFER_BEG <= BEG <= END <= BUFFER_END.  */
-  if (!(BUF_BEGV_BYTE (buf) <= byte_beg
-        && byte_beg <= byte_end
-        && byte_end <= BUF_ZV_BYTE (buf)))
-    xsignal2 (Qargs_out_of_range, beg, end);
+  treesit_check_position (beg, buf);
+  treesit_check_position (end, buf);
 
   treesit_initialize ();
 
@@ -2229,8 +2333,6 @@ treesit_predicate_match (Lisp_Object args, struct capture_range captures)
 
   Lisp_Object regexp = XCAR (args);
   Lisp_Object capture_name = XCAR (XCDR (args));
-  Lisp_Object text = treesit_predicate_capture_name_to_text (capture_name,
-                                                             captures);
 
   /* It's probably common to get the argument order backwards.  Catch
      this mistake early and show helpful explanation, because Emacs
@@ -2245,6 +2347,9 @@ treesit_predicate_match (Lisp_Object args, struct capture_range captures)
               build_pure_c_string ("The second argument to `match' should "
                                    "be a capture name, not a string"));
 
+  Lisp_Object text = treesit_predicate_capture_name_to_text (capture_name,
+                                                             captures);
+
   if (fast_string_match (regexp, text) >= 0)
     return true;
   else
@@ -2363,21 +2468,24 @@ the query.  */)
   (Lisp_Object node, Lisp_Object query,
    Lisp_Object beg, Lisp_Object end, Lisp_Object node_only)
 {
-  if (!NILP (beg))
-    CHECK_INTEGER (beg);
-  if (!NILP (end))
-    CHECK_INTEGER (end);
-
   if (!(TS_COMPILED_QUERY_P (query)
         || CONSP (query) || STRINGP (query)))
     wrong_type_argument (Qtreesit_query_p, query);
 
+  treesit_initialize ();
+
   /* Resolve NODE into an actual node.  */
   Lisp_Object lisp_node;
   if (TS_NODEP (node))
-    lisp_node = node;
+    {
+      treesit_check_node (node); /* Check if up-to-date.  */
+      lisp_node = node;
+    }
   else if (TS_PARSERP (node))
-    lisp_node = Ftreesit_parser_root_node (node);
+    {
+      treesit_check_parser (node); /* Check if deleted.  */
+      lisp_node = Ftreesit_parser_root_node (node);
+    }
   else if (SYMBOLP (node))
     {
       Lisp_Object parser
@@ -2389,8 +2497,6 @@ the query.  */)
               list4 (Qor, Qtreesit_node_p, Qtreesit_parser_p, Qsymbolp),
               node);
 
-  treesit_initialize ();
-
   /* Extract C values from Lisp objects.  */
   TSNode treesit_node
     = XTS_NODE (lisp_node)->node;
@@ -2401,6 +2507,13 @@ the query.  */)
   const TSLanguage *lang
     = ts_parser_language (XTS_PARSER (lisp_parser)->parser);
 
+  /* Check BEG and END.  */
+  struct buffer *buf = XBUFFER (XTS_PARSER (lisp_parser)->buffer);
+  if (!NILP (beg))
+    treesit_check_position (beg, buf);
+  if (!NILP (end))
+    treesit_check_position (end, buf);
+
   /* Initialize query objects.  At the end of this block, we should
      have a working TSQuery and a TSQueryCursor.  */
   TSQuery *treesit_query;
@@ -2444,14 +2557,15 @@ the query.  */)
   /* Set query range.  */
   if (!NILP (beg) && !NILP (end))
     {
-      EMACS_INT beg_byte = XFIXNUM (beg);
-      EMACS_INT end_byte = XFIXNUM (end);
+      ptrdiff_t beg_byte = CHAR_TO_BYTE (XFIXNUM (beg));
+      ptrdiff_t end_byte = CHAR_TO_BYTE (XFIXNUM (end));
       /* We never let tree-sitter run on buffers too large, so these
          assertion should never hit.  */
       eassert (beg_byte - visible_beg <= UINT32_MAX);
       eassert (end_byte - visible_beg <= UINT32_MAX);
-      ts_query_cursor_set_byte_range (cursor, (uint32_t) beg_byte - visible_beg,
-                                      (uint32_t) end_byte - visible_beg);
+      ts_query_cursor_set_byte_range (cursor,
+                                      (uint32_t) (beg_byte - visible_beg),
+                                      (uint32_t) (end_byte - visible_beg));
     }
 
   /* Execute query.  */
@@ -2517,62 +2631,210 @@ the query.  */)
 
 /*** Navigation */
 
-/* Return the next/previous named/unnamed sibling of NODE.  FORWARD
-   controls the direction and NAMED controls the nameness.  */
-static TSNode
-treesit_traverse_sibling_helper (TSNode node, bool forward, bool named)
+static inline void
+treesit_assume_true (bool val)
+{
+  eassert (val == true);
+}
+
+/* Create a TSTreeCursor pointing at NODE.  PARSER is the lisp parser
+   that produced NODE.
+
+   The reason we need this instead of simply using ts_tree_cursor_new
+   is that we have to create the cursor on the root node and traverse
+   down to NODE, in order to record the correct stack of parent nodes.
+   Otherwise going to sibling or parent of NODE wouldn't work.
+
+   (Wow perfect filling.)  */
+static TSTreeCursor
+treesit_cursor_helper (TSNode node, Lisp_Object parser)
+{
+  uint32_t end_pos = ts_node_end_byte (node);
+  TSNode root = ts_tree_root_node (XTS_PARSER (parser)->tree);
+  TSTreeCursor cursor = ts_tree_cursor_new (root);
+  TSNode cursor_node = ts_tree_cursor_current_node (&cursor);
+  /* This is like treesit-node-at.  We go down from the root node,
+     either to first child or next sibling, repeatedly, and finally
+     arrive at NODE.  */
+  while (!ts_node_eq (node, cursor_node))
+    {
+      treesit_assume_true (ts_tree_cursor_goto_first_child (&cursor));
+      cursor_node = ts_tree_cursor_current_node (&cursor);
+      /* ts_tree_cursor_goto_first_child_for_byte is not reliable, so
+         we just go through each sibling.  */
+      while (ts_node_is_missing (cursor_node)
+             || ts_node_end_byte (cursor_node) < end_pos)
+        {
+          /* A "missing" node has zero width, so it's possible that
+             its end = NODE.end but it's not NODE, so we skip them.
+             But we need to make sure this missing node is not the
+             node we are looking for before skipping it.  */
+          if (ts_node_is_missing (cursor_node)
+              && ts_node_eq (node, cursor_node))
+            return cursor;
+          treesit_assume_true (ts_tree_cursor_goto_next_sibling (&cursor));
+          cursor_node = ts_tree_cursor_current_node (&cursor);
+        }
+      /* Right now CURSOR.end >= NODE.end.  But what if CURSOR.end =
+         NODE.end, and there are missing nodes after CURSOR, and the
+         missing node after CURSOR is the NODE we are looking for??
+         Well, create a probe and look ahead.  (This is tested by
+         treesit-cursor-helper-with-missing-node.)  */
+      TSTreeCursor probe = ts_tree_cursor_copy (&cursor);
+      TSNode probe_node;
+      while (ts_tree_cursor_goto_next_sibling (&probe))
+        {
+          probe_node = ts_tree_cursor_current_node (&probe);
+          if (!ts_node_is_missing (probe_node))
+            break;
+          if (ts_node_eq (probe_node, node))
+            {
+              ts_tree_cursor_delete (&cursor);
+              return probe;
+            }
+        }
+      ts_tree_cursor_delete (&probe);
+    }
+  return cursor;
+}
+
+/* Move CURSOR to the next/previous sibling.  FORWARD controls the
+   direction.  NAMED controls the namedness.  If there is a valid
+   sibling, move CURSOR to it and return true, otherwise return false.
+   When false is returned, CURSOR points to a sibling node of the node
+   we started at, but exactly which is undefined.  */
+static bool
+treesit_traverse_sibling_helper (TSTreeCursor *cursor,
+                                 bool forward, bool named)
 {
   if (forward)
     {
-      if (named)
-        return ts_node_next_named_sibling (node);
-      else
-        return ts_node_next_sibling (node);
+      if (!named)
+        return ts_tree_cursor_goto_next_sibling (cursor);
+      /* Else named...  */
+      while (ts_tree_cursor_goto_next_sibling (cursor))
+        {
+          if (ts_node_is_named (ts_tree_cursor_current_node (cursor)))
+            return true;
+        }
+      return false;
     }
-  else
+  else /* Backward.  */
     {
-      if (named)
-        return ts_node_prev_named_sibling (node);
-      else
-        return ts_node_prev_sibling (node);
+      /* Go to first child and go through each sibling, until we find
+         the one just before the starting node.  */
+      TSNode start = ts_tree_cursor_current_node (cursor);
+      if (!ts_tree_cursor_goto_parent (cursor))
+        return false;
+      treesit_assume_true (ts_tree_cursor_goto_first_child (cursor));
+
+      /* Now CURSOR is at the first child.  If we started at the first
+         child, then there is no further siblings.  */
+      TSNode first_child = ts_tree_cursor_current_node (cursor);
+      if (ts_node_eq (first_child, start))
+        return false;
+
+      /* PROBE is always DELTA siblings ahead of CURSOR. */
+      TSTreeCursor probe = ts_tree_cursor_copy (cursor);
+      /* This is position of PROBE minus position of CURSOR.  */
+      ptrdiff_t delta = 0;
+      TSNode probe_node;
+      TSNode cursor_node;
+      while (ts_tree_cursor_goto_next_sibling (&probe))
+        {
+          /* Move PROBE forward, if it equals to the starting node,
+             CURSOR points to the node we want (prev valid sibling of
+             the starting node).  */
+          delta++;
+          probe_node = ts_tree_cursor_current_node (&probe);
+
+          /* PROBE matched, depending on NAMED, return true/false.  */
+          if (ts_node_eq (probe_node, start))
+            {
+              ts_tree_cursor_delete (&probe);
+              cursor_node = ts_tree_cursor_current_node (cursor);
+              ts_tree_cursor_delete (&probe);
+              return (!named || (named && ts_node_is_named (cursor_node)));
+            }
+
+          /* PROBE didn't match, move CURSOR forward to PROBE's
+             position, but if we are looking for named nodes, only
+             move CURSOR to PROBE if PROBE is at a named node.  */
+          if (!named || (named && ts_node_is_named (probe_node)))
+            for (; delta > 0; delta--)
+              treesit_assume_true (ts_tree_cursor_goto_next_sibling (cursor));
+        }
+      ts_tree_cursor_delete (&probe);
+      return false;
     }
 }
 
-/* Return the first/last named/unnamed child of NODE.  FORWARD controls
-   the direction and NAMED controls the nameness.  */
-static TSNode
-treesit_traverse_child_helper (TSNode node, bool forward, bool named)
+/* Move CURSOR to the first/last child.  FORWARD controls the
+   direction.  NAMED controls the namedness.  If there is a valid
+   child, move CURSOR to it and return true, otherwise don't move
+   CURSOR and return false.  */
+static bool
+treesit_traverse_child_helper (TSTreeCursor *cursor,
+                               bool forward, bool named)
 {
   if (forward)
     {
-      if (named)
-        return ts_node_named_child (node, 0);
+      if (!named)
+        return ts_tree_cursor_goto_first_child (cursor);
       else
-        return ts_node_child (node, 0);
-    }
-  else
-    {
-      if (named)
         {
-          uint32_t count = ts_node_named_child_count (node);
-          uint32_t idx = count == 0 ? 0 : count - 1;
-          return ts_node_named_child (node, idx);
+          if (!ts_tree_cursor_goto_first_child (cursor))
+            return false;
+          /* After this point, if you return false, make sure to go
+             back to parent.  */
+          TSNode first_child = ts_tree_cursor_current_node (cursor);
+          if (ts_node_is_named (first_child))
+            return true;
+
+          if (treesit_traverse_sibling_helper (cursor, true, true))
+            return true;
+          else
+            {
+              treesit_assume_true (ts_tree_cursor_goto_parent (cursor));
+              return false;
+            }
         }
+    }
+  else /* Backward.  */
+    {
+      if (!ts_tree_cursor_goto_first_child (cursor))
+        return false;
+      /* After this point, if you return false, make sure to go
+         back to parent.  */
+
+      /* First go to the last child.  */
+      while (ts_tree_cursor_goto_next_sibling (cursor));
+
+      if (!named)
+        return true;
+      /* Else named... */
+      if (treesit_traverse_sibling_helper(cursor, false, true))
+        return true;
       else
         {
-          uint32_t count = ts_node_child_count (node);
-          uint32_t idx = count == 0 ? 0 : count - 1;
-          return ts_node_child (node, idx);
+          treesit_assume_true (ts_tree_cursor_goto_parent (cursor));
+          return false;
         }
     }
 }
 
-/* Return true if NODE matches PRED.  PRED can be a string or a
-   function.  This function doesn't check for PRED's type.  */
+/* Return true if the node at CURSOR matches PRED.  PRED can be a
+   string or a function.  This function assumes PRED is either a
+   string or a function.  If NAMED is true, also check that the node
+   is named.  */
 static bool
-treesit_traverse_match_predicate (TSNode node, Lisp_Object pred,
-                                  Lisp_Object parser)
+treesit_traverse_match_predicate (TSTreeCursor *cursor, Lisp_Object pred,
+                                  Lisp_Object parser, bool named)
 {
+  TSNode node = ts_tree_cursor_current_node (cursor);
+  if (named && !ts_node_is_named (node))
+    return false;
+
   if (STRINGP (pred))
     {
       const char *type = ts_node_type (node);
@@ -2583,74 +2845,60 @@ treesit_traverse_match_predicate (TSNode node, Lisp_Object pred,
       Lisp_Object lisp_node = make_treesit_node (parser, node);
       return !NILP (CALLN (Ffuncall, pred, lisp_node));
     }
-
 }
 
-/* Traverse the parse tree starting from ROOT (but ROOT is not
-   matches against PRED).  PRED can be a function (takes a node and
-   returns nil/non-nil),or a string (treated as regexp matching the
-   node's type, ignores case, must be all single byte characters).  If
-   the node satisfies PRED , terminate, set ROOT to that node, and
-   return true.  If no node satisfies PRED, return FALSE.  PARSER is
-   the parser of ROOT.
+/* Traverse the parse tree starting from CURSOR.  PRED can be a
+   function (takes a node and returns nil/non-nil), or a string
+   (treated as regexp matching the node's type, must be all single
+   byte characters).  If the node satisfies PRED, leave CURSOR on that
+   node and return true.  If no node satisfies PRED, move CURSOR back
+   to starting position and return false.
 
-   LIMIT is the number of levels we descend in the tree.  If NO_LIMIT
-   is true, LIMIT is ignored.  FORWARD controls the direction in which
-   we traverse the tree, true means forward, false backward.  If NAMED
-   is true, only traverse named nodes, if false, all nodes.  If
-   SKIP_ROOT is true, don't match ROOT.  */
+   LIMIT is the number of levels we descend in the tree.  FORWARD
+   controls the direction in which we traverse the tree, true means
+   forward, false backward.  If SKIP_ROOT is true, don't match ROOT.
+   */
 static bool
-treesit_search_dfs (TSNode *root, Lisp_Object pred, Lisp_Object parser,
-                    bool named, bool forward, ptrdiff_t limit, bool no_limit,
+treesit_search_dfs (TSTreeCursor *cursor,
+                    Lisp_Object pred, Lisp_Object parser,
+                    bool forward, bool named, ptrdiff_t limit,
                     bool skip_root)
 {
-  /* TSTreeCursor doesn't allow us to move backward, so we can't use
-     it.  We could use limit == -1 to indicate no_limit == true, but
-     separating them is safer.  */
-  TSNode node = *root;
+  if (!skip_root
+      && treesit_traverse_match_predicate (cursor, pred, parser, named))
+    return true;
 
-  if (!skip_root && treesit_traverse_match_predicate (node, pred, parser))
-    {
-      *root = node;
-      return true;
-    }
+  if (limit == 0)
+    return false;
 
-  if (!no_limit && limit <= 0)
+  if (!treesit_traverse_child_helper (cursor, forward, named))
     return false;
-  else
+  /* After this point, if you return false, make sure to go back to
+     parent.  */
+
+  do /* Iterate through each child.  */
     {
-      int count = (named
-                   ? ts_node_named_child_count (node)
-                   : ts_node_child_count (node));
-      for (int offset = 0; offset < count; offset++)
-        {
-          uint32_t idx = forward ? offset : count - offset - 1;
-          TSNode child = (named
-                          ? ts_node_named_child (node, idx)
-                          : ts_node_child (node, idx));
-
-          if (!ts_node_is_null (child)
-              && treesit_search_dfs (&child, pred, parser, named,
-                                     forward, limit - 1, no_limit, false))
-            {
-              *root = child;
-              return true;
-            }
-        }
-      return false;
+      if (treesit_search_dfs (cursor, pred, parser, forward,
+                              named, limit - 1, false))
+        return true;
     }
+  while (treesit_traverse_sibling_helper (cursor, forward, false));
+
+  /* No match in any child's subtree, go back to starting node.  */
+  treesit_assume_true (ts_tree_cursor_goto_parent (cursor));
+  return false;
 }
 
 /* Go through the whole tree linearly, leaf-first, starting from
    START.  PRED, PARSER, NAMED, FORWARD are the same as in
-   ts_search_subtre.  If UP_ONLY is true, never go to children, only
-   sibling and parents.  */
+   ts_search_subtree.  If a match is found, leave CURSOR at that node,
+   and return true, if no match is found, return false, and CURSOR's
+   position is undefined.  */
 static bool
-treesit_search_forward (TSNode *start, Lisp_Object pred, Lisp_Object parser,
-                        bool named, bool forward)
+treesit_search_forward (TSTreeCursor *cursor,
+                        Lisp_Object pred, Lisp_Object parser,
+                        bool forward, bool named)
 {
-  TSNode node = *start;
-
   /* We don't search for subtree and always search from the leaf
      nodes.  This way repeated call of this function traverses each
      node in the tree once and only once:
@@ -2660,39 +2908,26 @@ treesit_search_forward (TSNode *start, Lisp_Object pred, Lisp_Object parser,
   bool initial = true;
   while (true)
     {
-      if (!initial /* We don't match START.  */
-          && treesit_traverse_match_predicate (node, pred, parser))
-        {
-          *start = node;
-          return true;
-        }
+      if (!initial /* We don't match the starting node.  */
+          && treesit_traverse_match_predicate (cursor, pred, parser, named))
+        return true;
       initial = false;
 
-      TSNode next = treesit_traverse_sibling_helper (node, forward, named);
-      while (ts_node_is_null (next))
+      /* Try going to the next sibling, if there is no next sibling,
+         go to parent and try again.  */
+      while (!treesit_traverse_sibling_helper (cursor, forward, named))
         {
           /* There is no next sibling, go to parent.  */
-          node = ts_node_parent (node);
-          if (ts_node_is_null (node))
+          if (!ts_tree_cursor_goto_parent (cursor))
             return false;
 
-          if (treesit_traverse_match_predicate (node, pred, parser))
-            {
-              *start = node;
+          if (treesit_traverse_match_predicate (cursor, pred, parser, named))
               return true;
-            }
-          next = treesit_traverse_sibling_helper (node, forward, named);
         }
       /* We are at the next sibling, deep dive into the first leaf
          node.  */
-      TSNode next_next = treesit_traverse_child_helper (next, forward, named);
-      while (!ts_node_is_null (next_next))
-        {
-          next = next_next;
-          next_next = treesit_traverse_child_helper (next, forward, named);
-        }
-      /* At this point NEXT is a leaf node.  */
-      node = next;
+      while (treesit_traverse_child_helper (cursor, forward, false));
+      /* At this point CURSOR is at a leaf node.  */
     }
 }
 
@@ -2707,7 +2942,8 @@ node's type, or a function that takes a node and returns nil/non-nil.
 
 By default, only traverse named nodes, but if ALL is non-nil, traverse
 all nodes.  If BACKWARD is non-nil, traverse backwards.  If LIMIT is
-non-nil, only traverse nodes up to that number of levels down in the tree.
+non-nil, only traverse nodes up to that number of levels down in the
+tree.  If LIMIT is nil, default to 1000.
 
 Return the first matched node, or nil if none matches.  */)
   (Lisp_Object node, Lisp_Object predicate, Lisp_Object backward,
@@ -2719,11 +2955,10 @@ Return the first matched node, or nil if none matches.  */)
   CHECK_SYMBOL (all);
   CHECK_SYMBOL (backward);
 
-  ptrdiff_t the_limit = 0;
-  bool no_limit = false;
-  if (NILP (limit))
-    no_limit = true;
-  else
+  /* We use a default limit of 1000.  See bug#59426 for the
+     discussion.  */
+  ptrdiff_t the_limit = 1000;
+  if (!NILP (limit))
     {
       CHECK_FIXNUM (limit);
       the_limit = XFIXNUM (limit);
@@ -2731,13 +2966,17 @@ Return the first matched node, or nil if none matches.  */)
 
   treesit_initialize ();
 
-  TSNode treesit_node = XTS_NODE (node)->node;
   Lisp_Object parser = XTS_NODE (node)->parser;
-  if (treesit_search_dfs (&treesit_node, predicate, parser, NILP (all),
-                          NILP (backward), the_limit, no_limit, false))
-    return make_treesit_node (parser, treesit_node);
-  else
-    return Qnil;
+  Lisp_Object return_value = Qnil;
+  TSTreeCursor cursor = treesit_cursor_helper (XTS_NODE (node)->node, parser);
+  if (treesit_search_dfs (&cursor, predicate, parser, NILP (backward),
+                          NILP (all), the_limit, false))
+    {
+      TSNode node = ts_tree_cursor_current_node (&cursor);
+      return_value = make_treesit_node (parser, node);
+    }
+  ts_tree_cursor_delete (&cursor);
+  return return_value;
 }
 
 DEFUN ("treesit-search-forward",
@@ -2781,13 +3020,17 @@ always traverse leaf nodes first, then upwards.  */)
 
   treesit_initialize ();
 
-  TSNode treesit_start = XTS_NODE (start)->node;
   Lisp_Object parser = XTS_NODE (start)->parser;
-  if (treesit_search_forward (&treesit_start, predicate, parser, NILP (all),
-                              NILP (backward)))
-    return make_treesit_node (parser, treesit_start);
-  else
-    return Qnil;
+  Lisp_Object return_value = Qnil;
+  TSTreeCursor cursor = treesit_cursor_helper (XTS_NODE (start)->node, parser);
+  if (treesit_search_forward (&cursor, predicate, parser,
+                              NILP (backward), NILP (all)))
+    {
+      TSNode node = ts_tree_cursor_current_node (&cursor);
+      return_value = make_treesit_node (parser, node);
+    }
+  ts_tree_cursor_delete (&cursor);
+  return return_value;
 }
 
 /* Recursively traverse the tree under CURSOR, and append the result
@@ -2797,15 +3040,14 @@ always traverse leaf nodes first, then upwards.  */)
 static void
 treesit_build_sparse_tree (TSTreeCursor *cursor, Lisp_Object parent,
                            Lisp_Object pred, Lisp_Object process_fn,
-                           ptrdiff_t limit, bool no_limit, Lisp_Object parser)
+                           ptrdiff_t limit, Lisp_Object parser)
 {
-
-  TSNode node = ts_tree_cursor_current_node (cursor);
-  bool match = treesit_traverse_match_predicate (node, pred, parser);
+  bool match = treesit_traverse_match_predicate (cursor, pred, parser, false);
   if (match)
     {
       /* If this node matches pred, add a new node to the parent's
          children list.  */
+      TSNode node = ts_tree_cursor_current_node (cursor);
       Lisp_Object lisp_node = make_treesit_node (parser, node);
       if (!NILP (process_fn))
         lisp_node = CALLN (Ffuncall, process_fn, lisp_node);
@@ -2816,8 +3058,7 @@ treesit_build_sparse_tree (TSTreeCursor *cursor, Lisp_Object parent,
       parent = this;
     }
   /* Go through each child.  */
-  if ((no_limit || limit > 0)
-      && ts_tree_cursor_goto_first_child (cursor))
+  if (limit > 0 && ts_tree_cursor_goto_first_child (cursor))
     {
       do
         {
@@ -2825,7 +3066,7 @@ treesit_build_sparse_tree (TSTreeCursor *cursor, Lisp_Object parent,
              Then C compilers should be smart enough not to copy NODE
              to stack.  */
           treesit_build_sparse_tree (cursor, parent, pred, process_fn,
-                                     limit - 1, no_limit, parser);
+                                     limit - 1, parser);
         }
       while (ts_tree_cursor_goto_next_sibling (cursor));
       /* Don't forget to come back to this node.  */
@@ -2866,7 +3107,8 @@ If PROCESS-FN is non-nil, it should be a function of one argument.  In
 that case, instead of returning the matched nodes, pass each node to
 PROCESS-FN, and use its return value instead.
 
-If non-nil, LIMIT is the number of levels to go down the tree from ROOT.
+If non-nil, LIMIT is the number of levels to go down the tree from
+ROOT.  If LIMIT is nil or omitted, it defaults to 1000.
 
 Each node in the returned tree looks like (NODE . (CHILD ...)).  The
 root of this tree might be nil, if ROOT doesn't match PREDICATE.
@@ -2885,11 +3127,11 @@ a regexp.  */)
 
   if (!NILP (process_fn))
     CHECK_TYPE (FUNCTIONP (process_fn), Qfunctionp, process_fn);
-  ptrdiff_t the_limit = 0;
-  bool no_limit = false;
-  if (NILP (limit))
-    no_limit = true;
-  else
+
+  /* We use a default limit of 1000.  See bug#59426 for the
+     discussion.  */
+  ptrdiff_t the_limit = 1000;
+  if (!NILP (limit))
     {
       CHECK_FIXNUM (limit);
       the_limit = XFIXNUM (limit);
@@ -2897,11 +3139,12 @@ a regexp.  */)
 
   treesit_initialize ();
 
-  TSTreeCursor cursor = ts_tree_cursor_new (XTS_NODE (root)->node);
   Lisp_Object parser = XTS_NODE (root)->parser;
   Lisp_Object parent = Fcons (Qnil, Qnil);
+  TSTreeCursor cursor = treesit_cursor_helper (XTS_NODE (root)->node, parser);
   treesit_build_sparse_tree (&cursor, parent, predicate, process_fn,
-                             the_limit, no_limit, parser);
+                             the_limit, parser);
+  ts_tree_cursor_delete (&cursor);
   Fsetcdr (parent, Fnreverse (Fcdr (parent)));
   if (NILP (Fcdr (parent)))
     return Qnil;
diff --git a/src/treesit.h b/src/treesit.h
index 1473126c5bc..6f6423ff472 100644
--- a/src/treesit.h
+++ b/src/treesit.h
@@ -56,13 +56,12 @@ struct Lisp_TS_Parser
      this field to true to force tree-sitter to re-parse.  */
   bool need_reparse;
   /* These two positions record the buffer byte position (1-based) of
-     the "visible region" that tree-sitter sees.  Unlike markers,
-     These two positions do not change as the user inserts and deletes
-     text around them.  Before re-parse, we move these positions to
-     match BUF_BEGV_BYTE and BUF_ZV_BYTE.  Note that we don't need to
-     synchronize these positions when retrieving them in a function
-     that involves a node: if the node is not outdated, these
-     positions are synchronized.  */
+     the "visible region" that tree-sitter sees.  Before re-parse, we
+     move these positions to match BUF_BEGV_BYTE and BUF_ZV_BYTE.
+     Note that we don't need to synchronize these positions when
+     retrieving them in a function that involves a node: if the node
+     is not outdated, these positions are synchronized.  See comment
+     (ref:visible-beg-null) in treesit.c for more explanation.  */
   ptrdiff_t visible_beg;
   ptrdiff_t visible_end;
   /* This counter is incremented every time a change is made to the
diff --git a/src/window.c b/src/window.c
index f116b9a9d72..90fa6ac2dfe 100644
--- a/src/window.c
+++ b/src/window.c
@@ -2639,7 +2639,7 @@ window_list (void)
           Lisp_Object arglist = Qnil;
 
           /* We are visiting windows in canonical order, and add
-             new windows at the front of args[1], which means we
+             new windows at the front of arglist, which means we
              have to reverse this list at the end.  */
           foreach_window (XFRAME (frame), add_window_to_list, &arglist);
           arglist = Fnreverse (arglist);
@@ -7329,6 +7329,14 @@ the return value is nil.  Otherwise the value is t.  */)
             last_selected_window)
         = selected_window;
 
+      /* We may have deleted windows above.  Then again, maybe we
+         haven't: the functions we call to maybe delete windows can
+         decide a window cannot be deleted.  Force recalculation of
+         Vwindow_list next time it is needed, to make sure stale
+         windows with no buffers don't escape into the wild, which
+         will cause crashes elsewhere.  */
+      Vwindow_list = Qnil;
+
       if (NILP (data->focus_frame)
           || (FRAMEP (data->focus_frame)
               && FRAME_LIVE_P (XFRAME (data->focus_frame))))
diff --git a/src/xdisp.c b/src/xdisp.c
index 5dcf21dc4ce..e8df230ef89 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -3533,6 +3533,33 @@ get_closer_narrowed_begv (struct window *w, ptrdiff_t pos)
   return max ((pos / len - 1) * len, BEGV);
 }
 
+ptrdiff_t
+get_locked_narrowing_begv (ptrdiff_t pos)
+{
+  if (long_line_locked_narrowing_region_size <= 0)
+    return BEGV;
+  int len = long_line_locked_narrowing_region_size / 2;
+  int begv = max (pos - len, BEGV);
+  int limit = long_line_locked_narrowing_bol_search_limit;
+  while (limit > 0)
+    {
+      if (begv == BEGV || FETCH_BYTE (CHAR_TO_BYTE (begv) - 1) == '\n')
+        return begv;
+      begv--;
+      limit--;
+    }
+  return begv;
+}
+
+ptrdiff_t
+get_locked_narrowing_zv (ptrdiff_t pos)
+{
+  if (long_line_locked_narrowing_region_size <= 0)
+    return ZV;
+  int len = long_line_locked_narrowing_region_size / 2;
+  return min (pos + len, ZV);
+}
+
 static void
 unwind_narrowed_begv (Lisp_Object point_min)
 {
@@ -4366,18 +4393,20 @@ handle_fontified_prop (struct it *it)
 
       eassert (it->end_charpos == ZV);
 
-      if (current_buffer->long_line_optimizations_p)
+      if (current_buffer->long_line_optimizations_p
+          && long_line_locked_narrowing_region_size > 0)
         {
-          ptrdiff_t begv = it->narrowed_begv;
-          ptrdiff_t zv = it->narrowed_zv;
+          ptrdiff_t begv = it->locked_narrowing_begv;
+          ptrdiff_t zv = it->locked_narrowing_zv;
           ptrdiff_t charpos = IT_CHARPOS (*it);
           if (charpos < begv || charpos > zv)
             {
-              begv = get_narrowed_begv (it->w, charpos);
-              zv = get_narrowed_zv (it->w, charpos);
+              begv = get_locked_narrowing_begv (charpos);
+              zv = get_locked_narrowing_zv (charpos);
             }
-          narrow_to_region_internal (make_fixnum (begv), make_fixnum (zv), true);
-          specbind (Qrestrictions_locked, Qt);
+          if (begv != BEG || zv != Z)
+            narrow_to_region_locked (make_fixnum (begv), make_fixnum (zv),
+                                     Qfontification_functions);
         }
 
       /* Don't allow Lisp that runs from 'fontification-functions'
@@ -6252,13 +6281,16 @@ static ptrdiff_t
 string_buffer_position (Lisp_Object string, ptrdiff_t around_charpos)
 {
   const int MAX_DISTANCE = 1000;
+  ptrdiff_t forward_limit = min (around_charpos + MAX_DISTANCE, ZV);
   ptrdiff_t found = string_buffer_position_lim (string, around_charpos,
-                                                around_charpos + MAX_DISTANCE,
-                                                false);
+                                                forward_limit, false);
 
   if (!found)
-    found = string_buffer_position_lim (string, around_charpos,
-                                        around_charpos - MAX_DISTANCE, true);
+    {
+      ptrdiff_t backward_limit = max (around_charpos - MAX_DISTANCE, BEGV);
+      found = string_buffer_position_lim (string, around_charpos,
+                                          backward_limit, true);
+    }
   return found;
 }
 
@@ -7435,12 +7467,20 @@ reseat (struct it *it, struct text_pos pos, bool force_p)
         {
           it->narrowed_begv = get_narrowed_begv (it->w, window_point (it->w));
           it->narrowed_zv = get_narrowed_zv (it->w, window_point (it->w));
+          it->locked_narrowing_begv
+            = get_locked_narrowing_begv (window_point (it->w));
+          it->locked_narrowing_zv
+            = get_locked_narrowing_zv (window_point (it->w));
         }
       else if ((pos.charpos < it->narrowed_begv || pos.charpos > it->narrowed_zv)
                 && (!redisplaying_p || it->line_wrap == TRUNCATE))
         {
           it->narrowed_begv = get_narrowed_begv (it->w, pos.charpos);
           it->narrowed_zv = get_narrowed_zv (it->w, pos.charpos);
+          it->locked_narrowing_begv
+            = get_locked_narrowing_begv (window_point (it->w));
+          it->locked_narrowing_zv
+            = get_locked_narrowing_zv (window_point (it->w));
         }
     }
 
@@ -16266,7 +16306,6 @@ do { if (! polling_stopped_here) stop_polling ();	\
 do { if (polling_stopped_here) start_polling ();        \
        polling_stopped_here = false; } while (false)
 
-
 /* Perhaps in the future avoid recentering windows if it
    is not necessary; currently that causes some problems.  */
 
@@ -16352,6 +16391,8 @@ redisplay_internal (void)
   FOR_EACH_FRAME (tail, frame)
     XFRAME (frame)->already_hscrolled_p = false;
 
+  reset_outermost_narrowings ();
+
  retry:
   /* Remember the currently selected window.  */
   sw = w;
@@ -17226,7 +17267,6 @@ mark_window_display_accurate_1 (struct window *w, bool accurate_p)
 
       BUF_UNCHANGED_MODIFIED (b) = BUF_MODIFF (b);
       BUF_OVERLAY_UNCHANGED_MODIFIED (b) = BUF_OVERLAY_MODIFF (b);
-      BUF_CHARS_UNCHANGED_MODIFIED (b) = BUF_CHARS_MODIFF (b);
       BUF_BEG_UNCHANGED (b) = BUF_GPT (b) - BUF_BEG (b);
       BUF_END_UNCHANGED (b) = BUF_Z (b) - BUF_GPT (b);
 
@@ -19392,6 +19432,13 @@ redisplay_window (Lisp_Object window, bool just_this_one_p)
             blank_row (w, row, y);
           goto finish_scroll_bars;
         }
+      else if (minibuf_level >= 1)
+        {
+          /* We could have a message produced by set-minibuffer-message
+             displayed in the mini-window as an overlay, so resize the
+             mini-window if needed.  */
+          resize_mini_window (w, false);
+        }
 
       clear_glyph_matrix (w->desired_matrix);
     }
@@ -19497,7 +19544,8 @@ redisplay_window (Lisp_Object window, bool just_this_one_p)
   /* Check whether the buffer to be displayed contains long lines.  */
   if (!NILP (Vlong_line_threshold)
       && !current_buffer->long_line_optimizations_p
-      && CHARS_MODIFF - CHARS_UNCHANGED_MODIFIED > 8)
+      && (CHARS_MODIFF - UNCHANGED_MODIFIED > 8
+          || current_buffer->clip_changed))
     {
       ptrdiff_t cur, next, found, max = 0, threshold;
       threshold = XFIXNUM (Vlong_line_threshold);
@@ -22578,7 +22626,8 @@ usage: (trace-to-stderr STRING &rest OBJECTS)  */)
  ***********************************************************************/
 
 /* Return a temporary glyph row holding the glyphs of an overlay arrow.
-   Used for non-window-redisplay windows, and for windows w/o left fringe.  */
+   Used for non-window-redisplay windows, and for windows without left
+   fringe.  */
 
 static struct glyph_row *
 get_overlay_arrow_glyph_row (struct window *w, Lisp_Object overlay_arrow_string)
@@ -26272,16 +26321,17 @@ display_menu_bar (struct window *w)
   it.first_visible_x = 0;
   it.last_visible_x = FRAME_PIXEL_WIDTH (f);
 #elif defined (HAVE_X_WINDOWS) /* X without toolkit.  */
+  struct window *menu_window = NULL;
+  struct face *face = FACE_FROM_ID (f, MENU_FACE_ID);
+
   if (FRAME_WINDOW_P (f))
     {
       /* Menu bar lines are displayed in the desired matrix of the
          dummy window menu_bar_window.  */
-      struct window *menu_w;
-      menu_w = XWINDOW (f->menu_bar_window);
-      init_iterator (&it, menu_w, -1, -1, menu_w->desired_matrix->rows,
+      menu_window = XWINDOW (f->menu_bar_window);
+      init_iterator (&it, menu_window, -1, -1,
+                     menu_window->desired_matrix->rows,
                      MENU_FACE_ID);
-      it.first_visible_x = 0;
-      it.last_visible_x = FRAME_PIXEL_WIDTH (f);
     }
   else
 #endif /* not USE_X_TOOLKIT and not USE_GTK */
@@ -26335,6 +26385,50 @@ display_menu_bar (struct window *w)
 
   /* Compute the total height of the lines.  */
   compute_line_metrics (&it);
+  it.glyph_row->full_width_p = true;
+  it.glyph_row->continued_p = false;
+  it.glyph_row->truncated_on_left_p = false;
+  it.glyph_row->truncated_on_right_p = false;
+
+#if defined (HAVE_X_WINDOWS) && !defined (USE_X_TOOLKIT) && !defined (USE_GTK)
+  /* Make a 3D menu bar have a shadow at its right end.  */
+  extend_face_to_end_of_line (&it);
+  if (face->box != FACE_NO_BOX)
+    {
+      struct glyph *last = (it.glyph_row->glyphs[TEXT_AREA]
+                            + it.glyph_row->used[TEXT_AREA] - 1);
+      int box_thickness = face->box_vertical_line_width;
+      last->right_box_line_p = true;
+      /* Add back the space for the right box line we subtracted in
+         init_iterator, since the right_box_line_p flag will make the
+         glyph wider.  We actually add only as much space as is
+         available for the last glyph of the menu bar and whatever
+         space is left beyond it, since that glyph could be only
+         partially visible.  */
+      if (box_thickness > 0)
+        last->pixel_width += max (0, (box_thickness
+                                      - (it.current_x - it.last_visible_x)));
+    }
+
+  /* With the non-toolkit version, modify the menu bar window height
+     accordingly.  */
+  if (FRAME_WINDOW_P (it.f) && menu_window)
+    {
+      struct glyph_row *row;
+      int delta_height;
+
+      row = it.glyph_row;
+      delta_height
+        = ((row->y + row->height)
+           - WINDOW_BOX_HEIGHT_NO_MODE_LINE (menu_window));
+
+      if (delta_height != 0)
+        {
+          FRAME_MENU_BAR_HEIGHT (it.f) += delta_height;
+          adjust_frame_size (it.f, -1, -1, 3, false, Qmenu_bar_lines);
+        }
+    }
+#endif
 }
 
 /* Deep copy of a glyph row, including the glyphs.  */
@@ -36711,10 +36805,11 @@ fontify a region starting at POS in the current buffer, and give
 fontified regions the property `fontified' with a non-nil value.
 
 Note that, when the buffer contains one or more lines whose length is
-above `long-line-threshold', these functions are called with the buffer
-narrowed to a small portion around POS, and the narrowing is locked (see
-`narrow-to-region'), so that these functions cannot use `widen' to gain
-access to other portions of buffer text.  */);
+above `long-line-threshold', these functions are called with the
+buffer narrowed to a small portion around POS (whose size is specified
+by `long-line-locked-narrowing-region-size'), and the narrowing is
+locked (see `narrowing-lock'), so that these functions cannot use
+`widen' to gain access to other portions of buffer text.  */);
   Vfontification_functions = Qnil;
   Fmake_variable_buffer_local (Qfontification_functions);
 
diff --git a/src/xfaces.c b/src/xfaces.c
index df078227c8a..be4a7ca71cc 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -6014,6 +6014,23 @@ realize_non_ascii_face (struct frame *f, Lisp_Object font_object,
 }
 #endif  /* HAVE_WINDOW_SYSTEM */
 
+/* Remove the attribute at INDEX from the font object if SYMBOL
+   appears in `font-fallback-ignored-attributes'.  */
+
+static void
+font_maybe_unset_attribute (Lisp_Object font_object,
+                            enum font_property_index index, Lisp_Object symbol)
+{
+  Lisp_Object tail = Vface_font_lax_matched_attributes;
+
+  eassert (CONSP (tail));
+
+  FOR_EACH_TAIL_SAFE (tail)
+    {
+      if (EQ (XCAR (tail), symbol))
+        ASET (font_object, index, Qnil);
+    }
+}
 
 /* Realize the fully-specified face with attributes ATTRS in face
    cache CACHE for ASCII characters.  Do it for GUI frame CACHE->f.
@@ -6071,8 +6088,48 @@ realize_gui_face (struct face_cache *cache, Lisp_Object attrs[LFACE_VECTOR_SIZE]
             emacs_abort ();
         }
       if (! FONT_OBJECT_P (attrs[LFACE_FONT_INDEX]))
-        attrs[LFACE_FONT_INDEX]
-          = font_load_for_lface (f, attrs, attrs[LFACE_FONT_INDEX]);
+        {
+          Lisp_Object spec = copy_font_spec (attrs[LFACE_FONT_INDEX]);
+
+          /* Maybe unset several values in SPEC, usually the width,
+             slant, and weight.  The best possible values for these
+             attributes are determined in font_find_for_lface, called
+             by font_load_for_lface, when the list of candidate fonts
+             returned by font_list_entities is sorted by font_select_entity
+             (which calls font_sort_entities, which calls font_score).
+             If these attributes are not unset here, the candidate
+             font list returned by font_list_entities only contains
+             fonts that are exact matches for these weight, slant, and
+             width attributes, which could lead to suboptimal or wrong
+             font selection.  (bug#5934) */
+          if (EQ (Vface_font_lax_matched_attributes, Qt))
+            {
+              /* The default case: clear the font attributes that
+                 affect its appearance the least, to try to find some
+                 font that is close, if not exact, match.  */
+              ASET (spec, FONT_WEIGHT_INDEX, Qnil);
+              ASET (spec, FONT_SLANT_INDEX, Qnil);
+              ASET (spec, FONT_WIDTH_INDEX, Qnil);
+            }
+          else if (!NILP (Vface_font_lax_matched_attributes))
+            {
+              /* Also allow unsetting specific attributes for
+                 debugging purposes.  */
+              font_maybe_unset_attribute (spec, FONT_WEIGHT_INDEX, QCweight);
+              font_maybe_unset_attribute (spec, FONT_SLANT_INDEX, QCslant);
+              font_maybe_unset_attribute (spec, FONT_WIDTH_INDEX, QCwidth);
+              font_maybe_unset_attribute (spec, FONT_FAMILY_INDEX, QCfamily);
+              font_maybe_unset_attribute (spec, FONT_FOUNDRY_INDEX, QCfoundry);
+              font_maybe_unset_attribute (spec, FONT_REGISTRY_INDEX, QCregistry);
+              font_maybe_unset_attribute (spec, FONT_ADSTYLE_INDEX, QCadstyle);
+              font_maybe_unset_attribute (spec, FONT_SIZE_INDEX, QCsize);
+              font_maybe_unset_attribute (spec, FONT_DPI_INDEX, QCdpi);
+              font_maybe_unset_attribute (spec, FONT_SPACING_INDEX, QCspacing);
+              font_maybe_unset_attribute (spec, FONT_AVGWIDTH_INDEX, QCavgwidth);
+            }
+
+          attrs[LFACE_FONT_INDEX] = font_load_for_lface (f, attrs, spec);
+        }
       if (FONT_OBJECT_P (attrs[LFACE_FONT_INDEX]))
         {
           face->font = XFONT_OBJECT (attrs[LFACE_FONT_INDEX]);
@@ -7360,6 +7417,35 @@ Lisp programs that change the value of this variable should also
 clear the face cache, see `clear-face-cache'.  */);
   face_near_same_color_threshold = 30000;
 
+  DEFVAR_LISP ("face-font-lax-matched-attributes",
+               Vface_font_lax_matched_attributes,
+               doc: /* Whether to match some face attributes in lax manner when realizing faces.
+
+If non-nil, some font-related face attributes will be matched in a lax
+manner when looking for candidate fonts.
+If the value is t, the default, the search for fonts will not insist
+on exact match for 3 font attributes: weight, width, and slant.
+Instead, it will examine the available fonts with various values of
+these attributes, and select the font that is the closest possible
+match.  (If an exact match is available, it will still be selected,
+as that is the closest match.)  For example, looking for a semi-bold
+font might select a bold or a medium-weight font if no semi-bold font
+matching other attributes can be found.  This is especially important
+when the `default' face specifies unusual values for one or more of
+these 3 attributes, which other installed fonts don't support.
+
+The value can also be a list of font-related face attribute symbols;
+see `set-face-attribute' for the full list of attributes.  Then the
+corresponding face attributes will be treated as "soft" constraints
+in the manner described above, instead of the default 3 attributes.
+
+If the value is nil, candidate fonts might be rejected if the don't
+have exactly the same values of attributes as the face requests.
+
+This variable exists for debugging of the font-selection process,
+and we advise not to change it otherwise.  */);
+  Vface_font_lax_matched_attributes = Qt;
+
 #ifdef HAVE_WINDOW_SYSTEM
   defsubr (&Sbitmap_spec_p);
   defsubr (&Sx_list_fonts);
diff --git a/src/xfns.c b/src/xfns.c
index fa2c0751d90..668f711bdb5 100644
--- a/src/xfns.c
+++ b/src/xfns.c
@@ -43,7 +43,6 @@ along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
 #ifdef USE_XCB
 #include <xcb/xcb.h>
 #include <xcb/xproto.h>
-#include <xcb/xcb_aux.h>
 #endif
 
 #include "bitmaps/gray.xbm"
@@ -1368,7 +1367,7 @@ x_set_mouse_color (struct frame *f, Lisp_Object arg, Lisp_Object oldval)
          XCreateFontCursor is not a request that waits for a reply,
          and as such can return IDs that will not actually be used by
          the server.  */
-      x_ignore_errors_for_next_request (FRAME_DISPLAY_INFO (f));
+      x_ignore_errors_for_next_request (FRAME_DISPLAY_INFO (f), 0);
 
       /* Free any successfully created cursors.  */
       for (i = 0; i < mouse_cursor_max; i++)
@@ -2643,12 +2642,18 @@ append_wm_protocols (struct x_display_info *dpyinfo,
   if (existing)
     XFree (existing);
 
-  if (!found_wm_ping)
-    protos[num_protos++] = dpyinfo->Xatom_net_wm_ping;
+  if (!dpyinfo->untrusted)
+    {
+      /* Untrusted clients cannot use these protocols which require
+         communicating with the window manager.  */
+
+      if (!found_wm_ping)
+        protos[num_protos++] = dpyinfo->Xatom_net_wm_ping;
 #if !defined HAVE_GTK3 && defined HAVE_XSYNC
-  if (!found_wm_sync_request && dpyinfo->xsync_supported_p)
-    protos[num_protos++] = dpyinfo->Xatom_net_wm_sync_request;
+      if (!found_wm_sync_request && dpyinfo->xsync_supported_p)
+        protos[num_protos++] = dpyinfo->Xatom_net_wm_sync_request;
 #endif
+    }
 
   if (num_protos)
     XChangeProperty (dpyinfo->display,
@@ -5723,13 +5728,13 @@ x_get_net_workarea (struct x_display_info *dpyinfo, XRectangle *rect)
     = xcb_get_property (dpyinfo->xcb_connection, 0,
                         (xcb_window_t) dpyinfo->root_window,
                         (xcb_atom_t) dpyinfo->Xatom_net_current_desktop,
-                        XCB_ATOM_CARDINAL, 0, 1);
+                        XA_CARDINAL, 0, 1);
 
   workarea_cookie
     = xcb_get_property (dpyinfo->xcb_connection, 0,
                         (xcb_window_t) dpyinfo->root_window,
                         (xcb_atom_t) dpyinfo->Xatom_net_workarea,
-                        XCB_ATOM_CARDINAL, 0, UINT32_MAX);
+                        XA_CARDINAL, 0, UINT32_MAX);
 
   reply = xcb_get_property_reply (dpyinfo->xcb_connection,
                                   current_desktop_cookie, &error);
@@ -5740,7 +5745,7 @@ x_get_net_workarea (struct x_display_info *dpyinfo, XRectangle *rect)
   else
     {
       if (xcb_get_property_value_length (reply) != 4
-          || reply->type != XCB_ATOM_CARDINAL || reply->format != 32)
+          || reply->type != XA_CARDINAL || reply->format != 32)
         rc = false;
       else
         current_workspace = *(uint32_t *) xcb_get_property_value (reply);
@@ -5755,7 +5760,7 @@ x_get_net_workarea (struct x_display_info *dpyinfo, XRectangle *rect)
     free (error), rc = false;
   else
     {
-      if (rc && reply->type == XCB_ATOM_CARDINAL && reply->format == 32
+      if (rc && reply->type == XA_CARDINAL && reply->format == 32
           && (xcb_get_property_value_length (reply) / sizeof (uint32_t)
               >= current_workspace + 4))
         {
@@ -7079,8 +7084,8 @@ that mouse buttons are being held down, such as immediately after a
   /* Catch errors since interning lots of targets can potentially
      generate a BadAlloc error.  */
   x_catch_errors (FRAME_X_DISPLAY (f));
-  XInternAtoms (FRAME_X_DISPLAY (f), target_names,
-                ntargets, False, target_atoms);
+  x_intern_atoms (FRAME_DISPLAY_INFO (f), target_names,
+                  ntargets, target_atoms);
   x_check_errors (FRAME_X_DISPLAY (f),
                   "Failed to intern target atoms: %s");
   x_uncatch_errors_after_check ();
@@ -7377,20 +7382,6 @@ If TERMINAL is omitted or nil, that stands for the selected frame's display.  */
   return Qnil;
 }
 
-/* Wait for responses to all X commands issued so far for frame F.  */
-
-void
-x_sync (struct frame *f)
-{
-  block_input ();
-#ifndef USE_XCB
-  XSync (FRAME_X_DISPLAY (f), False);
-#else
-  xcb_aux_sync (FRAME_DISPLAY_INFO (f)->xcb_connection);
-#endif
-  unblock_input ();
-}
-
 
 /***********************************************************************
                            Window properties
@@ -7484,7 +7475,7 @@ silently ignored.  */)
       elsize = element_format == 32 ? sizeof (long) : element_format >> 3;
       data = xnmalloc (nelements, elsize);
 
-      x_fill_property_data (FRAME_X_DISPLAY (f), value, data, nelements,
+      x_fill_property_data (FRAME_DISPLAY_INFO (f), value, data, nelements,
                             element_format);
     }
   else
@@ -8455,10 +8446,10 @@ compute_tip_xy (struct frame *f, Lisp_Object parms, Lisp_Object dx,
   int min_x, min_y, max_x, max_y = -1;
 
   /* User-specified position?  */
-  left = Fcdr (Fassq (Qleft, parms));
-  top  = Fcdr (Fassq (Qtop, parms));
-  right = Fcdr (Fassq (Qright, parms));
-  bottom = Fcdr (Fassq (Qbottom, parms));
+  left = CDR (Fassq (Qleft, parms));
+  top  = CDR (Fassq (Qtop, parms));
+  right = CDR (Fassq (Qright, parms));
+  bottom = CDR (Fassq (Qbottom, parms));
 
   /* Move the tooltip window where the mouse pointer is.  Resize and
      show it.  */
@@ -8824,14 +8815,14 @@ Text larger than the specified size is clipped.  */)
           for (tail = parms; CONSP (tail); tail = XCDR (tail))
             {
               elt = XCAR (tail);
-              parm = Fcar (elt);
+              parm = CAR (elt);
               /* The left, top, right and bottom parameters are handled
                  by compute_tip_xy so they can be ignored here.  */
               if (!EQ (parm, Qleft) && !EQ (parm, Qtop)
                   && !EQ (parm, Qright) && !EQ (parm, Qbottom))
                 {
                   last = Fassq (parm, tip_last_parms);
-                  if (NILP (Fequal (Fcdr (elt), Fcdr (last))))
+                  if (NILP (Fequal (CDR (elt), CDR (last))))
                     {
                       /* We lost, delete the old tooltip.  */
                       delete = true;
@@ -8852,9 +8843,9 @@ Text larger than the specified size is clipped.  */)
           for (tail = tip_last_parms; CONSP (tail); tail = XCDR (tail))
             {
               elt = XCAR (tail);
-              parm = Fcar (elt);
+              parm = CAR (elt);
               if (!EQ (parm, Qleft) && !EQ (parm, Qtop) && !EQ (parm, Qright)
-                  && !EQ (parm, Qbottom) && !NILP (Fcdr (elt)))
+                  && !EQ (parm, Qbottom) && !NILP (CDR (elt)))
                 {
                   /* We lost, delete the old tooltip.  */
                   delete = true;
@@ -8975,8 +8966,8 @@ Text larger than the specified size is clipped.  */)
                                   make_fixnum (w->pixel_height), Qnil,
                                   Qnil);
   /* Add the frame's internal border to calculated size.  */
-  width = XFIXNUM (Fcar (size)) + 2 * FRAME_INTERNAL_BORDER_WIDTH (tip_f);
-  height = XFIXNUM (Fcdr (size)) + 2 * FRAME_INTERNAL_BORDER_WIDTH (tip_f);
+  width = XFIXNUM (CAR (size)) + 2 * FRAME_INTERNAL_BORDER_WIDTH (tip_f);
+  height = XFIXNUM (CDR (size)) + 2 * FRAME_INTERNAL_BORDER_WIDTH (tip_f);
 
   /* Calculate position of tooltip frame.  */
   compute_tip_xy (tip_f, parms, dx, dy, width, height, &root_x, &root_y);
diff --git a/src/xftfont.c b/src/xftfont.c
index 6043ef9f94f..b9686db2a73 100644
--- a/src/xftfont.c
+++ b/src/xftfont.c
@@ -628,6 +628,12 @@ xftfont_shape (Lisp_Object lgstring, Lisp_Object direction)
 static int
 xftfont_end_for_frame (struct frame *f)
 {
+  /* XftDrawDestroy tries to access dpyinfo->display, which could've
+     been destroyed by now, causing Emacs to crash.  The alternative
+     is to leak the XftDraw, but that's better than a crash.  */
+  if (!FRAME_X_DISPLAY (f))
+    return 0;
+
   block_input ();
   XftDraw *xft_draw;
 
diff --git a/src/xselect.c b/src/xselect.c
index a381fa23522..05548be311f 100644
--- a/src/xselect.c
+++ b/src/xselect.c
@@ -16,7 +16,6 @@ GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
 
-
 /* Rewritten by jwz */
 
 #include <config.h>
@@ -44,7 +43,7 @@ struct prop_location;
 struct selection_data;
 
 static void x_decline_selection_request (struct selection_input_event *);
-static bool x_convert_selection (Lisp_Object, Lisp_Object, Atom, bool,
+static bool x_convert_selection (Lisp_Object, Lisp_Object, Atom,
                                  struct x_display_info *, bool);
 static bool waiting_for_other_props_on_window (Display *, Window);
 static struct prop_location *expect_property_change (Display *, Window,
@@ -77,18 +76,20 @@ static void x_send_client_event (Lisp_Object, Lisp_Object, Lisp_Object,
 #define TRACE0(fmt)             (void) 0
 #define TRACE1(fmt, a0)         (void) 0
 #define TRACE2(fmt, a0, a1)     (void) 0
+#define TRACE3(fmt, a0, a1, a2) (void) 0
 #endif
 
 /* Bytes needed to represent 'long' data.  This is as per libX11; it
    is not necessarily sizeof (long).  */
 #define X_LONG_SIZE 4
 
-/* If this is a smaller number than the max-request-size of the display,
-   emacs will use INCR selection transfer when the selection is larger
-   than this.  The max-request-size is usually around 64k, so if you want
-   emacs to use incremental selection transfers when the selection is
-   smaller than that, set this.  I added this mostly for debugging the
-   incremental transfer stuff, but it might improve server performance.
+/* If this is a smaller number than the max-request-size of the
+   display, Emacs will use INCR selection transfer when the selection
+   is larger than this.  The max-request-size is usually around 64k,
+   so if you want emacs to use incremental selection transfers when
+   the selection is smaller than that, set this.  I added this mostly
+   for debugging the incremental transfer stuff, but it might improve
+   server performance.
 
    This value cannot exceed INT_MAX / max (X_LONG_SIZE, sizeof (long))
    because it is multiplied by X_LONG_SIZE and by sizeof (long) in
@@ -101,7 +102,9 @@ static void x_send_client_event (Lisp_Object, Lisp_Object, Lisp_Object,
 static int
 selection_quantum (Display *display)
 {
-  long mrs = XExtendedMaxRequestSize (display);
+  long mrs;
+
+  mrs = XExtendedMaxRequestSize (display);
 
   if (!mrs)
     mrs = XMaxRequestSize (display);
@@ -281,10 +284,8 @@ x_own_selection (Lisp_Object selection_name, Lisp_Object selection_value,
     timestamp = dpyinfo->last_user_time;
 
   block_input ();
-  x_catch_errors (display);
-  XSetSelectionOwner (display, selection_atom, selecting_window, timestamp);
-  x_check_errors (display, "Can't set selection: %s");
-  x_uncatch_errors_after_check ();
+  XSetSelectionOwner (display, selection_atom, selecting_window,
+                      timestamp);
   unblock_input ();
 
   /* Now update the local cache */
@@ -308,7 +309,7 @@ x_own_selection (Lisp_Object selection_name, Lisp_Object selection_value,
         /* We know it's not the CAR, so it's easy.  */
         Lisp_Object rest = dpyinfo->terminal->Vselection_alist;
         for (; CONSP (rest); rest = XCDR (rest))
-          if (EQ (prev_value, Fcar (XCDR (rest))))
+          if (EQ (prev_value, CAR (XCDR (rest))))
             {
               XSETCDR (rest, XCDR (XCDR (rest)));
               break;
@@ -369,7 +370,7 @@ x_get_local_selection (Lisp_Object selection_symbol, Lisp_Object target_type,
         specbind (Qinhibit_quit, Qt);
 
       CHECK_SYMBOL (target_type);
-      handler_fn = Fcdr (Fassq (target_type, Vselection_converter_alist));
+      handler_fn = CDR (Fassq (target_type, Vselection_converter_alist));
 
       if (CONSP (handler_fn))
         handler_fn = XCDR (handler_fn);
@@ -459,7 +460,7 @@ x_decline_selection_request (struct selection_input_event *event)
   /* The reason for the error may be that the receiver has
      died in the meantime.  Handle that case.  */
   block_input ();
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSendEvent (dpyinfo->display, reply->requestor,
               False, 0, &reply_base);
   x_stop_ignoring_errors (dpyinfo);
@@ -472,19 +473,65 @@ x_decline_selection_request (struct selection_input_event *event)
 
 struct selection_data
 {
+  /* Pointer to the selection data.  */
   unsigned char *data;
+
+  /* A Lisp_Object containing the selection data.  This is either
+     Qnil, or `data' is NULL.  If non-nil, then this must be a string
+     whose contents will be written out verbatim.  */
+  Lisp_Object string;
+
+  /* The size, in number of items, of the selection data.
+     The value is meaningless if string is non-nil.  */
   ptrdiff_t size;
+
+  /* The format of the selection data.  */
   int format;
+
+  /* The type of the selection data.  */
   Atom type;
-  bool nofree;
+
+  /* The property describing the selection data.  */
   Atom property;
-  /* This can be set to non-NULL during x_reply_selection_request, if
-     the selection is waiting for an INCR transfer to complete.  Don't
-     free these; that's done by unexpect_property_change.  */
-  struct prop_location *wait_object;
+
+  /* The next piece of selection data in the current selection request
+     stack frame.  This can be NULL.  */
   struct selection_data *next;
 };
 
+/* Structure representing a single outstanding selection request (or
+   subrequest if MULTIPLE is being used.)  */
+
+struct transfer
+{
+  /* The requestor of this transfer.  */
+  Window requestor;
+
+  /* The current offset in items into the selection data, and the
+     number of items to send with each ChangeProperty request.  */
+  size_t offset, items_per_request;
+
+  /* The display info associated with the transfer.  */
+  struct x_display_info *dpyinfo;
+
+  /* The converted selection data.  */
+  struct selection_data data;
+
+  /* The next and last selection transfers on this list.  */
+  struct transfer *next, *last;
+
+  /* The atimer for the timeout.  */
+  struct atimer *timeout;
+
+  /* The selection serial.  */
+  unsigned int serial;
+
+  /* Flags.  */
+  int flags;
+};
+
+#define SELECTED_EVENTS 1
+
 struct x_selection_request
 {
   /* The last element in this stack.  */
@@ -499,8 +546,8 @@ struct x_selection_request
   /* Linked list of the above (in support of MULTIPLE targets).  */
   struct selection_data *converted_selections;
 
-  /* "Data" to send a requestor for a failed MULTIPLE subtarget.  */
-  Atom conversion_fail_tag;
+  /* The serial used to handle X errors.  */
+  unsigned int serial;
 
   /* Whether or not conversion was successful.  */
   bool converted;
@@ -511,6 +558,50 @@ struct x_selection_request
 
 struct x_selection_request *selection_request_stack;
 
+/* List of all outstanding selection transfers which are currently
+   being processed.  */
+
+struct transfer outstanding_transfers;
+
+/* A counter for selection serials.  */
+
+static unsigned int selection_serial;
+
+
+
+struct prop_location
+{
+  int identifier;
+  Display *display;
+  Window window;
+  Atom property;
+  int desired_state;
+  bool arrived;
+  struct prop_location *next;
+};
+
+static int prop_location_identifier;
+
+static Lisp_Object property_change_reply;
+
+static struct prop_location *property_change_reply_object;
+
+static struct prop_location *property_change_wait_list;
+
+static void
+set_property_change_object (struct prop_location *location)
+{
+  /* Input must be blocked so we don't get the event before we set
+     these.  */
+  if (! input_blocked_p ())
+    emacs_abort ();
+
+  XSETCAR (property_change_reply, Qnil);
+  property_change_reply_object = location;
+}
+
+
+
 static void
 x_push_current_selection_request (struct selection_input_event *se,
                                   struct x_display_info *dpyinfo)
@@ -523,7 +614,6 @@ x_push_current_selection_request (struct selection_input_event *se,
   frame->request = se;
   frame->dpyinfo = dpyinfo;
   frame->converted_selections = NULL;
-  frame->conversion_fail_tag = None;
 
   selection_request_stack = frame;
 }
@@ -554,7 +644,7 @@ x_selection_request_lisp_error (void)
   for (cs = frame->converted_selections; cs; cs = next)
     {
       next = cs->next;
-      if (! cs->nofree && cs->data)
+      if (cs->data)
         xfree (cs->data);
       xfree (cs);
     }
@@ -564,250 +654,450 @@ x_selection_request_lisp_error (void)
     x_decline_selection_request (frame->request);
 }
 
-static void
-x_catch_errors_unwind (void)
+
+
+static size_t
+c_size_for_format (int format)
 {
-  block_input ();
-  x_uncatch_errors ();
-  unblock_input ();
+  switch (format)
+    {
+    case 8:
+      return sizeof (char);
+
+    case 16:
+      return sizeof (short);
+
+    case 32:
+      return sizeof (long);
+    }
+
+  emacs_abort ();
 }
-
 
-/* This stuff is so that INCR selections are reentrant (that is, so we can
-   be servicing multiple INCR selection requests simultaneously.)  I haven't
-   actually tested that yet.  */
+static size_t
+x_size_for_format (int format)
+{
+  switch (format)
+    {
+    case 8:
+      return 1;
+
+    case 16:
+      return 2;
 
-/* Keep a list of the property changes that are awaited.  */
+    case 32:
+      return 4;
+    }
 
-struct prop_location
+  emacs_abort ();
+}
+
+/* Return a pointer to the remaining part of the selection data, given
+   a pointer to a struct selection_data and an offset in items.  Place
+   the number of items remaining in REMAINING.  Garbage collection
+   must not happen, or the returned pointer becomes invalid.  */
+
+static unsigned char *
+selection_data_for_offset (struct selection_data *data,
+                           long offset, size_t *remaining)
 {
-  int identifier;
-  Display *display;
-  Window window;
-  Atom property;
-  int desired_state;
-  bool arrived;
-  struct prop_location *next;
-};
+  unsigned char *base;
+  size_t size;
 
-static int prop_location_identifier;
+  if (!NILP (data->string))
+    {
+      base = SDATA (data->string);
+      size = SBYTES (data->string);
+    }
+  else
+    {
+      base = data->data;
+      size = data->size;
+    }
 
-static Lisp_Object property_change_reply;
+  if (offset >= size)
+    {
+      *remaining = 0;
+      return NULL;
+    }
 
-static struct prop_location *property_change_reply_object;
+  base += (offset * c_size_for_format (data->format));
+  *remaining = size - offset;
+  return base;
+}
 
-static struct prop_location *property_change_wait_list;
+/* Return the size, in bytes transferred to the X server, of
+   data->size items of selection data in data->format-bit
+   quantities.  */
 
-static void
-set_property_change_object (struct prop_location *location)
+static size_t
+selection_data_size (struct selection_data *data)
 {
-  /* Input must be blocked so we don't get the event before we set these.  */
-  if (! input_blocked_p ())
-    emacs_abort ();
-  XSETCAR (property_change_reply, Qnil);
-  property_change_reply_object = location;
+  size_t scratch;
+
+  if (!NILP (data->string))
+    return SBYTES (data->string);
+
+  switch (data->format)
+    {
+    case 8:
+      return (size_t) data->size;
+
+    case 16:
+      if (INT_MULTIPLY_WRAPV (data->size, 2, &scratch))
+        return SIZE_MAX;
+
+      return scratch;
+
+    case 32:
+      if (INT_MULTIPLY_WRAPV (data->size, 4, &scratch))
+        return SIZE_MAX;
+
+      return scratch;
+    }
+
+  /* The specified format is invalid.  */
+  emacs_abort ();
 }
 
-
-/* Send the reply to a selection request event EVENT.  */
+/* Return whether or not another outstanding selection transfer is
+   still selecting for events on the specified requestor window.  */
 
-#ifdef TRACE_SELECTION
-static int x_reply_selection_request_cnt;
-#endif  /* TRACE_SELECTION */
+static bool
+transfer_selecting_event (struct x_display_info *dpyinfo,
+                          Window requestor)
+{
+  struct transfer *next;
+
+  next = outstanding_transfers.next;
+  for (; next != &outstanding_transfers; next = next->next)
+    {
+      if (next->requestor == requestor
+          && next->dpyinfo == dpyinfo)
+        return true;
+    }
+
+  return false;
+}
+
+/* Cancel the specified selection transfer.  When called by
+   `start_transfer', the transfer may be partially formed.  */
 
 static void
-x_reply_selection_request (struct selection_input_event *event,
-                           struct x_display_info *dpyinfo)
+x_cancel_selection_transfer (struct transfer *transfer)
 {
-  XEvent reply_base;
-  XSelectionEvent *reply = &(reply_base.xselection);
-  Display *display = SELECTION_EVENT_DISPLAY (event);
-  Window window = SELECTION_EVENT_REQUESTOR (event);
-  ptrdiff_t bytes_remaining;
-  int max_bytes = selection_quantum (display);
-  specpdl_ref count = SPECPDL_INDEX ();
-  struct selection_data *cs;
-  struct x_selection_request *frame;
+  xfree (transfer->data.data);
 
-  frame = selection_request_stack;
+  if (transfer->next)
+    {
+      transfer->next->last = transfer->last;
+      transfer->last->next = transfer->next;
+    }
 
-  reply->type = SelectionNotify;
-  reply->display = display;
-  reply->requestor = window;
-  reply->selection = SELECTION_EVENT_SELECTION (event);
-  reply->time = SELECTION_EVENT_TIME (event);
-  reply->target = SELECTION_EVENT_TARGET (event);
-  reply->property = SELECTION_EVENT_PROPERTY (event);
-  if (reply->property == None)
-    reply->property = reply->target;
+  if (transfer->flags & SELECTED_EVENTS
+      && !transfer_selecting_event (transfer->dpyinfo,
+                                    transfer->requestor)
+      /* This can be called from x_delete_display.  */
+      && transfer->dpyinfo->display)
+    {
+      /* Ignore errors generated by the change window request in case
+         the window has gone away.  */
+      block_input ();
+      x_ignore_errors_for_next_request (transfer->dpyinfo, 0);
+      XSelectInput (transfer->dpyinfo->display,
+                    transfer->requestor, NoEventMask);
+      x_stop_ignoring_errors (transfer->dpyinfo);
+      unblock_input ();
+    }
 
-  block_input ();
-  /* The protected block contains wait_for_property_change, which can
-     run random lisp code (process handlers) or signal.  Therefore, we
-     put the x_uncatch_errors call in an unwind.  */
-  record_unwind_protect_void (x_catch_errors_unwind);
-  x_catch_errors (display);
+  cancel_atimer (transfer->timeout);
+  xfree (transfer);
+}
 
-  /* Loop over converted selections, storing them in the requested
-     properties.  If data is large, only store the first N bytes
-     (section 2.7.2 of ICCCM).  Note that we store the data for a
-     MULTIPLE request in the opposite order; the ICCM says only that
-     the conversion itself must be done in the same order. */
-  for (cs = frame->converted_selections; cs; cs = cs->next)
+static void
+x_selection_transfer_timeout (struct atimer *atimer)
+{
+  struct transfer *transfer;
+
+  transfer = atimer->client_data;
+  x_cancel_selection_transfer (transfer);
+}
+
+/* Start a selection transfer to write the specified selection data to
+   its requestor.  If the data is small enough, write it to the
+   requestor window and return.  Otherwise, start INCR transfer and
+   begin listening for PropertyNotify events on the requestor.  */
+
+static void
+x_start_selection_transfer (struct x_display_info *dpyinfo, Window requestor,
+                            struct selection_data *data)
+{
+  struct transfer *transfer;
+  intmax_t timeout;
+  intmax_t secs;
+  int nsecs;
+  size_t remaining, max_size;
+  unsigned char *xdata;
+  unsigned long data_size;
+
+  timeout = max (0, x_selection_timeout);
+  secs = timeout / 1000;
+  nsecs = (timeout % 1000) * 1000000;
+
+  transfer = xzalloc (sizeof *transfer);
+  transfer->requestor = requestor;
+  transfer->dpyinfo = dpyinfo;
+
+  transfer->timeout = start_atimer (ATIMER_RELATIVE,
+                                    make_timespec (secs, nsecs),
+                                    x_selection_transfer_timeout,
+                                    transfer);
+
+  /* Note that DATA is copied into transfer.  DATA->data is then set
+     to NULL, giving the struct transfer ownership over the selection
+     data.  */
+
+  transfer->data = *data;
+  data->data = NULL;
+
+  /* Finally, transfer now holds a reference to data->string, if it is
+     present.  GC cannot be allowed to happen until this function
+     returns.  */
+  data->string = Qnil;
+
+  /* Now, try to write the selection data.  If it is bigger than
+     selection_quantum (dpyinfo->display), start incremental transfer
+     and link the transfer onto the list of pending selections.
+     Otherwise, write the transfer at once.  */
+
+  max_size = selection_quantum (dpyinfo->display);
+
+  TRACE3 (" x_start_selection_transfer: transferring to 0x%lx.  "
+          "transfer consists of %zu bytes, quantum being %zu",
+          requestor, selection_data_size (&transfer->data),
+          max_size);
+
+  if (selection_data_size (&transfer->data) > max_size)
     {
-      if (cs->property == None)
-        continue;
+      /* Begin incremental selection transfer.  First, calculate how
+         many elements it is ok to write for every ChangeProperty
+         request.  */
+      transfer->items_per_request
+        = (max_size / x_size_for_format (transfer->data.format));
+      TRACE1 (" x_start_selection_transfer: starting incremental"
+              " selection transfer, with %zu items per request",
+              transfer->items_per_request);
+
+      /* Next, link the transfer onto the list of pending selection
+         transfers.  */
+      transfer->next = outstanding_transfers.next;
+      transfer->last = &outstanding_transfers;
+      transfer->next->last = transfer;
+      transfer->last->next = transfer;
+
+      /* Find a valid (non-zero) serial for the selection transfer.
+         Any asynchronously trapped errors will then cause the
+         selection transfer to be cancelled.  */
+      transfer->serial = (++selection_serial
+                          ? selection_serial
+                          : ++selection_serial);
+
+      /* Now, write the INCR property to begin incremental selection
+         transfer.  offset is currently 0.  */
+
+      data_size = selection_data_size (&transfer->data);
+
+      /* Set SELECTED_EVENTS before the actual XSelectInput
+         request.  */
+      transfer->flags |= SELECTED_EVENTS;
+
+      x_ignore_errors_for_next_request (dpyinfo, transfer->serial);
+      XChangeProperty (dpyinfo->display, requestor,
+                       transfer->data.property,
+                       dpyinfo->Xatom_INCR, 32, PropModeReplace,
+                       (unsigned char *) &data_size, 1);
+
+      /* This assumes that Emacs is not selecting for any other events
+         from the requestor!
+
+         If the holder of some manager selections (i.e. the settings
+         manager) asks Emacs for selection data, things will subtly go
+         wrong.  */
+      XSelectInput (dpyinfo->display, requestor, PropertyChangeMask);
+      x_stop_ignoring_errors (dpyinfo);
+    }
+  else
+    {
+      /* Write the property data now.  */
+      xdata = selection_data_for_offset (&transfer->data,
+                                         0, &remaining);
+      eassert (remaining <= INT_MAX);
+
+      TRACE1 (" x_start_selection_transfer:  writing"
+              " %zu elements directly to requestor window",
+              remaining);
+
+      x_ignore_errors_for_next_request (dpyinfo, 0);
+      XChangeProperty (dpyinfo->display, requestor,
+                       transfer->data.property,
+                       transfer->data.type,
+                       transfer->data.format,
+                       PropModeReplace, xdata, remaining);
+      x_stop_ignoring_errors (dpyinfo);
+
+      /* Next, get rid of the transfer.  */
+      x_cancel_selection_transfer (transfer);
+    }
+}
 
-      bytes_remaining = cs->size;
-      bytes_remaining *= cs->format >> 3;
-      if (bytes_remaining <= max_bytes)
-        {
-          /* Send all the data at once, with minimal handshaking.  */
-          TRACE1 ("Sending all %"pD"d bytes", bytes_remaining);
-          XChangeProperty (display, window, cs->property,
-                           cs->type, cs->format, PropModeReplace,
-                           cs->data, cs->size);
-        }
-      else
-        {
-          /* Send an INCR tag to initiate incremental transfer.  */
-          long value[1];
-
-          TRACE2 ("Start sending %"pD"d bytes incrementally (%s)",
-                  bytes_remaining, XGetAtomName (display, cs->property));
-          cs->wait_object
-            = expect_property_change (display, window, cs->property,
-                                      PropertyDelete);
-
-          /* XChangeProperty expects an array of long even if long is
-             more than 32 bits.  */
-          value[0] = min (bytes_remaining, X_LONG_MAX);
-          XChangeProperty (display, window, cs->property,
-                           dpyinfo->Xatom_INCR, 32, PropModeReplace,
-                           (unsigned char *) value, 1);
-          XSelectInput (display, window, PropertyChangeMask);
-        }
+/* Write out the next piece of data that is part of the specified
+   selection transfer.  If no more data remains to be written, write
+   the EOF property and complete the transfer.  */
+
+static void
+x_continue_selection_transfer (struct transfer *transfer)
+{
+  size_t remaining;
+  unsigned char *xdata;
+
+  xdata = selection_data_for_offset (&transfer->data,
+                                     transfer->offset,
+                                     &remaining);
+  remaining = min (remaining, transfer->items_per_request);
+
+  if (!remaining)
+    {
+      /* The transfer is finished.  Write zero-length property data to
+         signal EOF and remove the transfer.  */
+      TRACE0 (" x_continue_selection_transfer: writing 0 items to"
+              " indicate EOF");
+      x_ignore_errors_for_next_request (transfer->dpyinfo, 0);
+      XChangeProperty (transfer->dpyinfo->display,
+                       transfer->requestor,
+                       transfer->data.property,
+                       transfer->data.type,
+                       transfer->data.format,
+                       PropModeReplace,
+                       NULL, 0);
+      x_stop_ignoring_errors (transfer->dpyinfo);
+      TRACE0 (" x_continue_selection_transfer: done sending incrementally");
+
+      x_cancel_selection_transfer (transfer);
+    }
+  else
+    {
+      TRACE2 (" x_continue_selection_transfer: writing %zu items"
+              "; current offset is %zu", remaining, transfer->offset);
+      eassert (remaining <= INT_MAX);
+
+      transfer->offset += remaining;
+
+      x_ignore_errors_for_next_request (transfer->dpyinfo,
+                                        transfer->serial);
+      XChangeProperty (transfer->dpyinfo->display,
+                       transfer->requestor,
+                       transfer->data.property,
+                       transfer->data.type,
+                       transfer->data.format,
+                       PropModeReplace, xdata,
+                       remaining);
+      x_stop_ignoring_errors (transfer->dpyinfo);
     }
+}
 
-  /* Now issue the SelectionNotify event.  */
-  XSendEvent (display, window, False, 0, &reply_base);
-  XFlush (display);
+void
+x_remove_selection_transfers (struct x_display_info *dpyinfo)
+{
+  struct transfer *next, *last;
 
-#ifdef TRACE_SELECTION
-  {
-    char *sel = XGetAtomName (display, reply->selection);
-    char *tgt = XGetAtomName (display, reply->target);
-    TRACE3 ("Sent SelectionNotify: %s, target %s (%d)",
-            sel, tgt, ++x_reply_selection_request_cnt);
-    if (sel) XFree (sel);
-    if (tgt) XFree (tgt);
-  }
-#endif /* TRACE_SELECTION */
+  next = outstanding_transfers.next;
+  while (next != &outstanding_transfers)
+    {
+      last = next;
+      next = next->next;
 
-  /* Finish sending the rest of each of the INCR values.  This should
-     be improved; there's a chance of deadlock if more than one
-     subtarget in a MULTIPLE selection requires an INCR transfer, and
-     the requestor and Emacs loop waiting on different transfers.  */
-  for (cs = frame->converted_selections; cs; cs = cs->next)
-    if (cs->wait_object)
-      {
-        int format_bytes = cs->format / 8;
-        bool had_errors_p = x_had_errors_p (display);
+      if (last->dpyinfo == dpyinfo)
+        x_cancel_selection_transfer (last);
+    }
+}
 
-        /* Must set this inside block_input ().  unblock_input may read
-           events and setting property_change_reply in
-           wait_for_property_change is then too late.  */
-        set_property_change_object (cs->wait_object);
-        unblock_input ();
+/* Handle an X error generated trying to write to a window.  SERIAL
+   identifies the outstanding incremental selection transfer, which is
+   immediately removed.  */
 
-        bytes_remaining = cs->size;
-        bytes_remaining *= format_bytes;
+void
+x_handle_selection_error (unsigned int serial, XErrorEvent *error)
+{
+  struct transfer *next, *last;
 
-        /* Wait for the requestor to ack by deleting the property.
-           This can run Lisp code (process handlers) or signal.  */
-        if (! had_errors_p)
-          {
-            TRACE1 ("Waiting for ACK (deletion of %s)",
-                    XGetAtomName (display, cs->property));
-            wait_for_property_change (cs->wait_object);
-          }
-        else
-          unexpect_property_change (cs->wait_object);
+  if (error->error_code != BadWindow)
+    /* The error was not caused by the window going away.  As such,
+       Emacs must deselect for PropertyChangeMask from the requestor
+       window, which isn't safe here.  Return and wait for the timeout
+       to run.  */
+    return;
 
-        while (bytes_remaining)
-          {
-            int i = ((bytes_remaining < max_bytes)
-                     ? bytes_remaining
-                     : max_bytes) / format_bytes;
-            block_input ();
-
-            cs->wait_object
-              = expect_property_change (display, window, cs->property,
-                                        PropertyDelete);
-
-            TRACE1 ("Sending increment of %d elements", i);
-            TRACE1 ("Set %s to increment data",
-                    XGetAtomName (display, cs->property));
-
-            /* Append the next chunk of data to the property.  */
-            XChangeProperty (display, window, cs->property,
-                             cs->type, cs->format, PropModeAppend,
-                             cs->data, i);
-            bytes_remaining -= i * format_bytes;
-            cs->data += i * ((cs->format == 32) ? sizeof (long)
-                             : format_bytes);
-            XFlush (display);
-            had_errors_p = x_had_errors_p (display);
-            /* See comment above about property_change_reply.  */
-            set_property_change_object (cs->wait_object);
-            unblock_input ();
-
-            if (had_errors_p) break;
-
-            /* Wait for the requestor to ack this chunk by deleting
-               the property.  This can run Lisp code or signal.  */
-            TRACE1 ("Waiting for increment ACK (deletion of %s)",
-                    XGetAtomName (display, cs->property));
-            wait_for_property_change (cs->wait_object);
-          }
+  next = outstanding_transfers.next;
+  while (next != &outstanding_transfers)
+    {
+      last = next;
+      next = next->next;
 
-        /* Now write a zero-length chunk to the property to tell the
-           requestor that we're done.  */
-        block_input ();
-        if (! waiting_for_other_props_on_window (display, window))
-          XSelectInput (display, window, 0);
-
-        TRACE1 ("Set %s to a 0-length chunk to indicate EOF",
-                XGetAtomName (display, cs->property));
-        XChangeProperty (display, window, cs->property,
-                         cs->type, cs->format, PropModeReplace,
-                         cs->data, 0);
-        TRACE0 ("Done sending incrementally");
-      }
+      if (last->serial == serial)
+        {
+          /* Clear SELECTED_EVENTS, so x_cancel_selection_transfer
+             will not make X requests.  That is unsafe inside an error
+             handler, and unnecessary because the window has already
+             gone.  */
+          last->flags &= ~SELECTED_EVENTS;
+          x_cancel_selection_transfer (last);
+        }
+    }
+}
 
-  /* rms, 2003-01-03: I think I have fixed this bug.  */
-  /* The window we're communicating with may have been deleted
-     in the meantime (that's a real situation from a bug report).
-     In this case, there may be events in the event queue still
-     referring to the deleted window, and we'll get a BadWindow error
-     in XTread_socket when processing the events.  I don't have
-     an idea how to fix that.  gerd, 2001-01-98.   */
-  /* 2004-09-10: XSync and UNBLOCK so that possible protocol errors are
-     delivered before uncatch errors.  */
-  XSync (display, False);
-  unblock_input ();
+/* Send the reply to a selection request event EVENT.  */
+
+static void
+x_reply_selection_request (struct selection_input_event *event,
+                           struct x_display_info *dpyinfo)
+{
+  XEvent message;
+  struct selection_data *cs;
+  struct x_selection_request *frame;
 
-  /* GTK queues events in addition to the queue in Xlib.  So we
-     UNBLOCK to enter the event loop and get possible errors delivered,
-     and then BLOCK again because x_uncatch_errors requires it.  */
   block_input ();
-  /* This calls x_uncatch_errors.  */
-  unbind_to (count, Qnil);
+  frame = selection_request_stack;
+
+  message.xselection.type = SelectionNotify;
+  message.xselection.display = dpyinfo->display;
+  message.xselection.requestor = SELECTION_EVENT_REQUESTOR (event);
+  message.xselection.selection = SELECTION_EVENT_SELECTION (event);
+  message.xselection.time = SELECTION_EVENT_TIME (event);
+  message.xselection.target = SELECTION_EVENT_TARGET (event);
+  message.xselection.property = SELECTION_EVENT_PROPERTY (event);
+
+  if (message.xselection.property == None)
+    message.xselection.property = message.xselection.target;
+
+  /* For each of the converted selections, start a write transfer from
+     Emacs to the requestor.  */
+  for (cs = frame->converted_selections; cs; cs = cs->next)
+    x_start_selection_transfer (dpyinfo,
+                                SELECTION_EVENT_REQUESTOR (event),
+                                cs);
+
+
+  /* Send the SelectionNotify event to the requestor, telling it that
+     the property data has arrived.  */
+  x_ignore_errors_for_next_request (dpyinfo, 0);
+  XSendEvent (dpyinfo->display, SELECTION_EVENT_REQUESTOR (event),
+              False, NoEventMask, &message);
+  x_stop_ignoring_errors (dpyinfo);
   unblock_input ();
 }
-
-/* Handle a SelectionRequest event EVENT.
-   This is called from keyboard.c when such an event is found in the queue.  */
+
+/* Handle a SelectionRequest event EVENT.  This is called from
+   keyboard.c when such an event is found in the queue.  */
 
 static void
 x_handle_selection_request (struct selection_input_event *event)
@@ -892,7 +1182,9 @@ x_handle_selection_request (struct selection_input_event *event)
       ptrdiff_t j, nselections;
       struct selection_data cs;
 
-      if (property == None) goto DONE;
+      if (property == None)
+        goto DONE;
+
       multprop
         = x_get_window_property_as_lisp_data (dpyinfo, requestor, property,
                                               QMULTIPLE, selection, true);
@@ -904,23 +1196,24 @@ x_handle_selection_request (struct selection_input_event *event)
       /* Perform conversions.  This can signal.  */
       for (j = 0; j < nselections; j++)
         {
-          Lisp_Object subtarget = AREF (multprop, 2*j);
+          Lisp_Object subtarget = AREF (multprop, 2 * j);
           Atom subproperty = symbol_to_x_atom (dpyinfo,
                                                AREF (multprop, 2*j+1));
           bool subsuccess = false;
 
           if (subproperty != None)
             subsuccess = x_convert_selection (selection_symbol, subtarget,
-                                              subproperty, true, dpyinfo,
+                                              subproperty, dpyinfo,
                                               use_alternate);
           if (!subsuccess)
-            ASET (multprop, 2*j+1, Qnil);
+            ASET (multprop, 2 * j + 1, Qnil);
         }
+
       /* Save conversion results */
       lisp_data_to_selection_data (dpyinfo, multprop, &cs);
 
-      /* If cs.type is ATOM, change it to ATOM_PAIR.  This is because
-         the parameters to a MULTIPLE are ATOM_PAIRs.  */
+      /* If cs.type is ATOM, change it to ATOM_PAIR.  This is
+         because the parameters to a MULTIPLE are ATOM_PAIRs.  */
 
       if (cs.type == XA_ATOM)
         cs.type = dpyinfo->Xatom_ATOM_PAIR;
@@ -929,27 +1222,29 @@ x_handle_selection_request (struct selection_input_event *event)
                        cs.type, cs.format, PropModeReplace,
                        cs.data, cs.size);
       success = true;
+
+      xfree (cs.data);
     }
   else
     {
       if (property == None)
         property = SELECTION_EVENT_TARGET (event);
+
       success = x_convert_selection (selection_symbol,
                                      target_symbol, property,
-                                     false, dpyinfo,
-                                     use_alternate);
+                                     dpyinfo, use_alternate);
     }
 
  DONE:
 
-  if (pushed)
-    selection_request_stack->converted = true;
-
   if (success)
     x_reply_selection_request (event, dpyinfo);
   else
     x_decline_selection_request (event);
 
+  if (pushed)
+    selection_request_stack->converted = true;
+
   /* Run the `x-sent-selection-functions' abnormal hook.  */
   if (!NILP (Vx_sent_selection_functions)
       && !BASE_EQ (Vx_sent_selection_functions, Qunbound))
@@ -960,19 +1255,18 @@ x_handle_selection_request (struct selection_input_event *event)
  REALLY_DONE:
 
   unbind_to (count, Qnil);
+  return;
 }
 
 /* Perform the requested selection conversion, and write the data to
    the converted_selections linked list, where it can be accessed by
-   x_reply_selection_request.  If FOR_MULTIPLE, write out
-   the data even if conversion fails, using conversion_fail_tag.
+   x_reply_selection_request.
 
    Return true if successful.  */
 
 static bool
-x_convert_selection (Lisp_Object selection_symbol,
-                     Lisp_Object target_symbol, Atom property,
-                     bool for_multiple, struct x_display_info *dpyinfo,
+x_convert_selection (Lisp_Object selection_symbol, Lisp_Object target_symbol,
+                     Atom property, struct x_display_info *dpyinfo,
                      bool use_alternate)
 {
   Lisp_Object lisp_selection;
@@ -988,33 +1282,16 @@ x_convert_selection (Lisp_Object selection_symbol,
   /* A nil return value means we can't perform the conversion.  */
   if (NILP (lisp_selection)
       || (CONSP (lisp_selection) && NILP (XCDR (lisp_selection))))
-    {
-      if (for_multiple)
-        {
-          cs = xmalloc (sizeof *cs);
-          cs->data = ((unsigned char *)
-                      &selection_request_stack->conversion_fail_tag);
-          cs->size = 1;
-          cs->format = 32;
-          cs->type = XA_ATOM;
-          cs->nofree = true;
-          cs->property = property;
-          cs->wait_object = NULL;
-          cs->next = frame->converted_selections;
-          frame->converted_selections = cs;
-        }
-
-      return false;
-    }
+    return false;
 
   /* Otherwise, record the converted selection to binary.  */
   cs = xmalloc (sizeof *cs);
   cs->data = NULL;
-  cs->nofree = true;
+  cs->string = Qnil;
   cs->property = property;
-  cs->wait_object = NULL;
   cs->next = frame->converted_selections;
   frame->converted_selections = cs;
+
   lisp_data_to_selection_data (dpyinfo, lisp_selection, cs);
   return true;
 }
@@ -1129,14 +1406,14 @@ x_clear_frame_selections (struct frame *f)
   while (CONSP (t->Vselection_alist)
          && EQ (frame, XCAR (XCDR (XCDR (XCDR (XCAR (t->Vselection_alist)))))))
     {
-      selection = Fcar (Fcar (t->Vselection_alist));
+      selection = CAR (CAR (t->Vselection_alist));
 
       if (!x_should_preserve_selection (selection))
         /* Run the `x-lost-selection-functions' abnormal hook.  */
         CALLN (Frun_hook_with_args, Qx_lost_selection_functions,
                selection);
       else
-        lost = Fcons (Fcar (t->Vselection_alist), lost);
+        lost = Fcons (CAR (t->Vselection_alist), lost);
 
       tset_selection_alist (t, XCDR (t->Vselection_alist));
     }
@@ -1274,6 +1551,10 @@ void
 x_handle_property_notify (const XPropertyEvent *event)
 {
   struct prop_location *rest;
+  struct transfer *next;
+#ifdef TRACE_SELECTION
+  char *name;
+#endif
 
   for (rest = property_change_wait_list; rest; rest = rest->next)
     {
@@ -1283,9 +1564,16 @@ x_handle_property_notify (const XPropertyEvent *event)
           && rest->display == event->display
           && rest->desired_state == event->state)
         {
+#ifdef TRACE_SELECTION
+          name = XGetAtomName (event->display, event->atom);
+
           TRACE2 ("Expected %s of property %s",
                   (event->state == PropertyDelete ? "deletion" : "change"),
-                  XGetAtomName (event->display, event->atom));
+                  name ? name : "unknown");
+
+          if (name)
+            XFree (name);
+#endif
 
           rest->arrived = true;
 
@@ -1297,6 +1585,26 @@ x_handle_property_notify (const XPropertyEvent *event)
           return;
         }
     }
+
+  /* Look for a property change for an outstanding selection
+     transfer.  */
+  next = outstanding_transfers.next;
+  while (next != &outstanding_transfers)
+    {
+      if (next->dpyinfo->display == event->display
+          && next->requestor == event->window
+          && next->data.property == event->atom
+          && event->state == PropertyDelete)
+        {
+          TRACE1 ("Expected PropertyDelete event arrived from the"
+                  " requestor window %lx", next->requestor);
+
+          x_continue_selection_transfer (next);
+          return;
+        }
+
+      next = next->next;
+    }
 }
 
 static void
@@ -1450,10 +1758,10 @@ x_get_window_property (Display *display, Window window, Atom property,
   /* Maximum value for TOTAL_SIZE.  It cannot exceed PTRDIFF_MAX - 1
      and SIZE_MAX - 1, for an extra byte at the end.  And it cannot
      exceed LONG_MAX * X_LONG_SIZE, for XGetWindowProperty.  */
-  ptrdiff_t total_size_max =
-    ((min (PTRDIFF_MAX, SIZE_MAX) - 1) / x_long_size < LONG_MAX
-     ? min (PTRDIFF_MAX, SIZE_MAX) - 1
-     : LONG_MAX * x_long_size);
+  ptrdiff_t total_size_max
+    = ((min (PTRDIFF_MAX, SIZE_MAX) - 1) / x_long_size < LONG_MAX
+       ? min (PTRDIFF_MAX, SIZE_MAX) - 1
+       : LONG_MAX * x_long_size);
 
   block_input ();
 
@@ -1946,10 +2254,14 @@ static void
 lisp_data_to_selection_data (struct x_display_info *dpyinfo,
                              Lisp_Object obj, struct selection_data *cs)
 {
-  Lisp_Object type = Qnil;
+  Lisp_Object type;
+  char **name_buffer;
+
+  USE_SAFE_ALLOCA;
+
+  type = Qnil;
 
   eassert (cs != NULL);
-  cs->nofree = false;
 
   if (CONSP (obj) && SYMBOLP (XCAR (obj)))
     {
@@ -1959,8 +2271,10 @@ lisp_data_to_selection_data (struct x_display_info *dpyinfo,
         obj = XCAR (obj);
     }
 
+  /* This is not the same as declining.  */
+
   if (EQ (obj, QNULL) || (EQ (type, QNULL)))
-    {                           /* This is not the same as declining */
+    {
       cs->format = 32;
       cs->size = 0;
       cs->data = NULL;
@@ -1971,12 +2285,14 @@ lisp_data_to_selection_data (struct x_display_info *dpyinfo,
       if (SCHARS (obj) < SBYTES (obj))
         /* OBJ is a multibyte string containing a non-ASCII char.  */
         signal_error ("Non-ASCII string must be encoded in advance", obj);
+
       if (NILP (type))
         type = QSTRING;
+
       cs->format = 8;
-      cs->size = SBYTES (obj);
-      cs->data = SDATA (obj);
-      cs->nofree = true;
+      cs->size = -1;
+      cs->data = NULL;
+      cs->string = obj;
     }
   else if (SYMBOLP (obj))
     {
@@ -2048,8 +2364,19 @@ lisp_data_to_selection_data (struct x_display_info *dpyinfo,
           x_atoms = data;
           cs->format = 32;
           cs->size = size;
-          for (i = 0; i < size; i++)
-            x_atoms[i] = symbol_to_x_atom (dpyinfo, AREF (obj, i));
+
+          if (size == 1)
+            x_atoms[0] = symbol_to_x_atom (dpyinfo, AREF (obj, i));
+          else
+            {
+              SAFE_NALLOCA (name_buffer, sizeof *x_atoms, size);
+
+              for (i = 0; i < size; i++)
+                name_buffer[i] = SSDATA (SYMBOL_NAME (AREF (obj, i)));
+
+              x_intern_atoms (dpyinfo, name_buffer, size,
+                              x_atoms);
+            }
         }
       else
         /* This vector is an INTEGER set, or something like it */
@@ -2091,6 +2418,8 @@ lisp_data_to_selection_data (struct x_display_info *dpyinfo,
     signal_error (/* Qselection_error */ "Unrecognized selection data", obj);
 
   cs->type = symbol_to_x_atom (dpyinfo, type);
+
+  SAFE_FREE ();
 }
 
 static Lisp_Object
@@ -2618,8 +2947,8 @@ x_check_property_data (Lisp_Object data)
    XClientMessageEvent).  */
 
 void
-x_fill_property_data (Display *dpy, Lisp_Object data, void *ret,
-                      int nelements_max, int format)
+x_fill_property_data (struct x_display_info *dpyinfo, Lisp_Object data,
+                      void *ret, int nelements_max, int format)
 {
   unsigned long val;
   unsigned long  *d32 = (unsigned long  *) ret;
@@ -2654,7 +2983,7 @@ x_fill_property_data (Display *dpy, Lisp_Object data, void *ret,
       else if (STRINGP (o))
         {
           block_input ();
-          val = XInternAtom (dpy, SSDATA (o), False);
+          val = x_intern_cached_atom (dpyinfo, SSDATA (o), false);
           unblock_input ();
         }
       else
@@ -2942,7 +3271,7 @@ x_send_client_event (Lisp_Object display, Lisp_Object dest, Lisp_Object from,
 
   memset (event.xclient.data.l, 0, sizeof (event.xclient.data.l));
   /* event.xclient.data can hold 20 chars, 10 shorts, or 5 longs.  */
-  x_fill_property_data (dpyinfo->display, values, event.xclient.data.b,
+  x_fill_property_data (dpyinfo, values, event.xclient.data.b,
                         5 * 32 / event.xclient.format,
                         event.xclient.format);
 
@@ -3002,10 +3331,11 @@ syms_of_xselect (void)
 
   reading_selection_reply = Fcons (Qnil, Qnil);
   staticpro (&reading_selection_reply);
-
   staticpro (&property_change_reply);
 
-  /* FIXME: Duplicate definition in nsselect.c.  */
+  outstanding_transfers.next = &outstanding_transfers;
+  outstanding_transfers.last = &outstanding_transfers;
+
   DEFVAR_LISP ("selection-converter-alist", Vselection_converter_alist,
                doc: /* An alist associating X Windows selection-types with functions.
 These functions are called to convert the selection, with three args:
@@ -3120,9 +3450,43 @@ Note that this does not affect setting or owning selections.  */);
 static void
 syms_of_xselect_for_pdumper (void)
 {
+  outstanding_transfers.next = &outstanding_transfers;
+  outstanding_transfers.last = &outstanding_transfers;
+
   reading_selection_window = 0;
   reading_which_selection = 0;
   property_change_wait_list = 0;
   prop_location_identifier = 0;
   property_change_reply = Fcons (Qnil, Qnil);
 }
+
+void
+mark_xselect (void)
+{
+  struct transfer *next;
+  struct x_selection_request *frame;
+  struct selection_data *cs;
+
+  /* Mark all the strings being used as selection data.  A string that
+     is still reachable is always reachable via either the selection
+     request stack or the list of outstanding transfers.  */
+
+  next = outstanding_transfers.next;
+
+  if (!next)
+    /* syms_of_xselect has not yet been called.  */
+    return;
+
+  while (next != &outstanding_transfers)
+    {
+      mark_object (next->data.string);
+      next = next->next;
+    }
+
+  frame = selection_request_stack;
+  for (; frame; frame = frame->last)
+    {
+      for (cs = frame->converted_selections; cs; cs = cs->next)
+        mark_object (cs->string);
+    }
+}
diff --git a/src/xterm.c b/src/xterm.c
index cfd8c385d1d..60d48165650 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -26,6 +26,22 @@ along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
    contains subroutines comprising the redisplay interface, setting up
    scroll bars and widgets, and handling input.
 
+   X WINDOW SYSTEM
+
+   The X Window System is a windowing system for bitmap graphics
+   displays which originated at MIT in 1984.  Version 11, which is
+   currently supported by Emacs, first appeared in September 1987.
+
+   X has a long history and has been developed by many different
+   organizations over the years; at present, it is being primarily
+   developed by the X.Org Foundation.  It is the main window system
+   that Emacs is developed and tested against, and X version 10 was
+   the first window system that Emacs was ported to.  As a consequence
+   of its age and wide availability, X contains many idiosyncrasies,
+   but that has not prevented it from becoming the dominant free
+   window system, and the platform of reference for all GUI code in
+   Emacs.
+
    Some of what is explained below also applies to the other window
    systems that Emacs supports, to varying degrees.  YMMV.
 
@@ -555,7 +571,56 @@ along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
   drop happening with the primary selection and synthetic button
   events (see `x_dnd_do_unsupported_drop').  That function implements
   the OffiX drag-and-drop protocol by default.  See
-  `x-dnd-handle-unsupported-drop' in `x-dnd.el' for more details.  */
+  `x-dnd-handle-unsupported-drop' in `x-dnd.el' for more details.
+
+  DISPLAY ERROR HANDLING
+
+  While error handling under X was originally designed solely as a
+  mechanism for the X server to report fatal errors to clients, most
+  clients (including Emacs) have adopted a system of "error traps" to
+  handle or discard these errors as they arrive.  Discarding errors is
+  usually necessary when Emacs performs an X request that might fail:
+  for example, sending a message to a window that may no longer exist,
+  or might not exist at all.  Handling errors is then necessary when
+  the detailed error must be reported to another piece of code: for
+  example, as a Lisp error.
+
+  It is not acceptable for Emacs to crash when it is sent invalid data
+  by another client, or by Lisp.  As a result, errors must be caught
+  around Xlib functions generating requests containing resource
+  identifiers that could potentially be invalid, such as window or
+  atom identifiers provided in a client message from another program,
+  or a child window ID obtained through XTranslateCoordinates that may
+  refer to a window that has been deleted in the meantime.
+
+  There are two sets of functions used to perform this "error
+  trapping".  Which one should be used depends on what kind of
+  processing must be done on the error.  The first consists of the
+  functions `x_ignore_errors_for_next_request' and
+  `x_stop_ignoring_errors', which ignore errors generated by requests
+  made in between a call to the first function and a corresponding
+  call to the second.  They should be used for simple asynchronous
+  requests that do not require a reply from the X server: using them
+  instead of the second set improves performance, as they simply
+  record a range of request serials to ignore errors from, instead of
+  synchronizing with the X server to handle errors.
+
+  The second set consists of the following functions:
+
+    - x_catch_errors_with_handler
+    - x_catch_errors
+    - x_uncatch_errors_after_check
+    - x_uncatch_errors
+    - x_check_errors
+    - x_had_errors_p
+    - x_clear_errors
+
+  Callers using this set should consult the comment(s) on top of the
+  aformentioned functions.  They should not be used when the requests
+  being made do not require roundtrips to the X server, and obtaining
+  the details of any error generated is unecessary, as
+  `x_uncatch_errors' will always synchronize with the X server, which
+  is a potentially slow operation.  */
 
 #include <config.h>
 #include <stdlib.h>
@@ -574,7 +639,6 @@ along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
 #ifdef USE_XCB
 #include <xcb/xproto.h>
 #include <xcb/xcb.h>
-#include <xcb/xcb_aux.h>
 #endif
 
 /* If we have Xfixes extension, use it for pointer blanking.  */
@@ -1052,6 +1116,20 @@ static const struct x_atom_ref x_atom_refs[] =
     /* Old OffiX (a.k.a. old KDE) drop protocol support.  */
     ATOM_REFS_INIT ("DndProtocol", Xatom_DndProtocol)
     ATOM_REFS_INIT ("_DND_PROTOCOL", Xatom_DND_PROTOCOL)
+    /* Here are some atoms that are not actually used from C, just
+       defined to make replying to selection requests fast.  */
+    ATOM_REFS_INIT ("text/plain;charset=utf-8", Xatom_text_plain_charset_utf_8)
+    ATOM_REFS_INIT ("LENGTH", Xatom_LENGTH)
+    ATOM_REFS_INIT ("FILE_NAME", Xatom_FILE_NAME)
+    ATOM_REFS_INIT ("CHARACTER_POSITION", Xatom_CHARACTER_POSITION)
+    ATOM_REFS_INIT ("LINE_NUMBER", Xatom_LINE_NUMBER)
+    ATOM_REFS_INIT ("COLUMN_NUMBER", Xatom_COLUMN_NUMBER)
+    ATOM_REFS_INIT ("OWNER_OS", Xatom_OWNER_OS)
+    ATOM_REFS_INIT ("HOST_NAME", Xatom_HOST_NAME)
+    ATOM_REFS_INIT ("USER", Xatom_USER)
+    ATOM_REFS_INIT ("CLASS", Xatom_CLASS)
+    ATOM_REFS_INIT ("NAME", Xatom_NAME)
+    ATOM_REFS_INIT ("SAVE_TARGETS", Xatom_SAVE_TARGETS)
   };
 
 enum
@@ -2509,7 +2587,7 @@ xm_send_drop_message (struct x_display_info *dpyinfo, Window source,
   *((uint32_t *) &msg.xclient.data.b[12]) = dmsg->index_atom;
   *((uint32_t *) &msg.xclient.data.b[16]) = dmsg->source_window;
 
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSendEvent (dpyinfo->display, target, False, NoEventMask, &msg);
   x_stop_ignoring_errors (dpyinfo);
 }
@@ -2536,7 +2614,7 @@ xm_send_top_level_enter_message (struct x_display_info *dpyinfo, Window source,
   msg.xclient.data.b[18] = 0;
   msg.xclient.data.b[19] = 0;
 
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSendEvent (dpyinfo->display, target, False, NoEventMask, &msg);
   x_stop_ignoring_errors (dpyinfo);
 }
@@ -2567,7 +2645,7 @@ xm_send_drag_motion_message (struct x_display_info *dpyinfo, Window source,
   msg.xclient.data.b[18] = 0;
   msg.xclient.data.b[19] = 0;
 
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSendEvent (dpyinfo->display, target, False, NoEventMask, &msg);
   x_stop_ignoring_errors (dpyinfo);
 }
@@ -2626,7 +2704,7 @@ xm_send_top_level_leave_message (struct x_display_info *dpyinfo, Window source,
   msg.xclient.data.b[18] = 0;
   msg.xclient.data.b[19] = 0;
 
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSendEvent (dpyinfo->display, target, False, NoEventMask, &msg);
   x_stop_ignoring_errors (dpyinfo);
 }
@@ -2921,7 +2999,7 @@ x_dnd_free_toplevels (bool display_alive)
       if (n_windows)
         {
           eassume (dpyinfo);
-          x_ignore_errors_for_next_request (dpyinfo);
+          x_ignore_errors_for_next_request (dpyinfo, 0);
 
           for (i = 0; i < n_windows; ++i)
             {
@@ -3058,7 +3136,7 @@ x_dnd_compute_toplevels (struct x_display_info *dpyinfo)
                                      0, 0);
       get_property_cookies[i]
         = xcb_get_property (dpyinfo->xcb_connection, 0, (xcb_window_t) toplevels[i],
-                            (xcb_atom_t) dpyinfo->Xatom_wm_state, XCB_ATOM_ANY,
+                            (xcb_atom_t) dpyinfo->Xatom_wm_state, 0,
                             0, 2);
       xm_property_cookies[i]
         = xcb_get_property (dpyinfo->xcb_connection, 0, (xcb_window_t) toplevels[i],
@@ -3069,7 +3147,7 @@ x_dnd_compute_toplevels (struct x_display_info *dpyinfo)
         = xcb_get_property (dpyinfo->xcb_connection, 0,
                             (xcb_window_t) toplevels[i],
                             (xcb_atom_t) dpyinfo->Xatom_net_frame_extents,
-                            XCB_ATOM_CARDINAL, 0, 4);
+                            XA_CARDINAL, 0, 4);
       get_geometry_cookies[i]
         = xcb_get_geometry (dpyinfo->xcb_connection, (xcb_window_t) toplevels[i]);
 
@@ -3197,7 +3275,7 @@ x_dnd_compute_toplevels (struct x_display_info *dpyinfo)
         {
           if (xcb_get_property_value_length (extent_property_reply) == 16
               && extent_property_reply->format == 32
-              && extent_property_reply->type == XCB_ATOM_CARDINAL)
+              && extent_property_reply->type == XA_CARDINAL)
             {
               fextents = xcb_get_property_value (extent_property_reply);
               frame_extents[0] = fextents[0];
@@ -3291,7 +3369,7 @@ x_dnd_compute_toplevels (struct x_display_info *dpyinfo)
 
           if (dpyinfo->xshape_supported_p)
             {
-              x_ignore_errors_for_next_request (dpyinfo);
+              x_ignore_errors_for_next_request (dpyinfo, 0);
               XShapeSelectInput (dpyinfo->display,
                                  toplevels[i],
                                  ShapeNotifyMask);
@@ -3456,7 +3534,7 @@ x_dnd_compute_toplevels (struct x_display_info *dpyinfo)
             }
 #endif
 
-          x_ignore_errors_for_next_request (dpyinfo);
+          x_ignore_errors_for_next_request (dpyinfo, 0);
           XSelectInput (dpyinfo->display, toplevels[i],
                         (attrs.your_event_mask
                          | StructureNotifyMask
@@ -3571,13 +3649,13 @@ x_dnd_get_proxy_proto (struct x_display_info *dpyinfo, Window wdesc,
     xdnd_proxy_cookie = xcb_get_property (dpyinfo->xcb_connection, 0,
                                           (xcb_window_t) wdesc,
                                           (xcb_atom_t) dpyinfo->Xatom_XdndProxy,
-                                          XCB_ATOM_WINDOW, 0, 1);
+                                          XA_WINDOW, 0, 1);
 
   if (proto_out)
     xdnd_proto_cookie = xcb_get_property (dpyinfo->xcb_connection, 0,
                                           (xcb_window_t) wdesc,
                                           (xcb_atom_t) dpyinfo->Xatom_XdndAware,
-                                          XCB_ATOM_ATOM, 0, 1);
+                                          XA_ATOM, 0, 1);
 
   if (proxy_out)
     {
@@ -3589,7 +3667,7 @@ x_dnd_get_proxy_proto (struct x_display_info *dpyinfo, Window wdesc,
       else
         {
           if (reply->format == 32
-              && reply->type == XCB_ATOM_WINDOW
+              && reply->type == XA_WINDOW
               && (xcb_get_property_value_length (reply) >= 4))
             *proxy_out = *(xcb_window_t *) xcb_get_property_value (reply);
 
@@ -3607,7 +3685,7 @@ x_dnd_get_proxy_proto (struct x_display_info *dpyinfo, Window wdesc,
       else
         {
           if (reply->format == 32
-              && reply->type == XCB_ATOM_ATOM
+              && reply->type == XA_ATOM
               && (xcb_get_property_value_length (reply) >= 4))
             *proto_out = (int) *(xcb_atom_t *) xcb_get_property_value (reply);
 
@@ -3791,15 +3869,15 @@ x_dnd_get_wm_state_and_proto (struct x_display_info *dpyinfo,
   wmstate_cookie = xcb_get_property (dpyinfo->xcb_connection, 0,
                                      (xcb_window_t) window,
                                      (xcb_atom_t) dpyinfo->Xatom_wm_state,
-                                     XCB_ATOM_ANY, 0, 2);
+                                     0, 0, 2);
   xdnd_proto_cookie = xcb_get_property (dpyinfo->xcb_connection, 0,
                                         (xcb_window_t) window,
                                         (xcb_atom_t) dpyinfo->Xatom_XdndAware,
-                                        XCB_ATOM_ATOM, 0, 1);
+                                        XA_ATOM, 0, 1);
   xdnd_proxy_cookie = xcb_get_property (dpyinfo->xcb_connection, 0,
                                         (xcb_window_t) window,
                                         (xcb_atom_t) dpyinfo->Xatom_XdndProxy,
-                                        XCB_ATOM_WINDOW, 0, 1);
+                                        XA_WINDOW, 0, 1);
   xm_style_cookie = xcb_get_property (dpyinfo->xcb_connection, 0,
                                       (xcb_window_t) window,
                                       (xcb_atom_t) dpyinfo->Xatom_MOTIF_DRAG_RECEIVER_INFO,
@@ -3846,7 +3924,7 @@ x_dnd_get_wm_state_and_proto (struct x_display_info *dpyinfo,
   else
     {
       if (reply->format == 32
-          && reply->type == XCB_ATOM_WINDOW
+          && reply->type == XA_WINDOW
           && (xcb_get_property_value_length (reply) >= 4))
         *proxy_out = *(xcb_window_t *) xcb_get_property_value (reply);
 
@@ -3962,6 +4040,12 @@ x_dnd_do_unsupported_drop (struct x_display_info *dpyinfo,
   if (owner != FRAME_X_WINDOW (f))
     return;
 
+  /* mouse-drag-and-drop-region will immediately deactivate the mark
+     after this is set.  Make sure the primary selection is not
+     clobbered in that case by setting `deactivate-mark' to
+     Qdont_save.  */
+  Vdeactivate_mark = Qdont_save;
+
   event.xbutton.window = child;
   event.xbutton.subwindow = None;
   event.xbutton.x = dest_x;
@@ -3975,7 +4059,7 @@ x_dnd_do_unsupported_drop (struct x_display_info *dpyinfo,
   event.xbutton.type = ButtonPress;
   event.xbutton.time = before + 1;
 
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSendEvent (dpyinfo->display, child,
               True, ButtonPressMask, &event);
 
@@ -4487,7 +4571,7 @@ x_dnd_send_enter (struct frame *f, Window target, Window toplevel,
      so we don't have to set it again.  */
   x_dnd_init_type_lists = true;
 
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSendEvent (FRAME_X_DISPLAY (f), target, False, NoEventMask, &msg);
   x_stop_ignoring_errors (dpyinfo);
 }
@@ -4559,7 +4643,7 @@ x_dnd_send_position (struct frame *f, Window target, Window toplevel,
             return;
         }
 
-      x_ignore_errors_for_next_request (dpyinfo);
+      x_ignore_errors_for_next_request (dpyinfo, 0);
       XSendEvent (FRAME_X_DISPLAY (f), target, False, NoEventMask, &msg);
       x_stop_ignoring_errors (dpyinfo);
 
@@ -4586,7 +4670,7 @@ x_dnd_send_leave (struct frame *f, Window target, Window toplevel)
   x_dnd_waiting_for_status_window = None;
   x_dnd_pending_send_position.type = 0;
 
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSendEvent (FRAME_X_DISPLAY (f), target, False, NoEventMask, &msg);
   x_stop_ignoring_errors (dpyinfo);
 }
@@ -4619,7 +4703,7 @@ x_dnd_send_drop (struct frame *f, Window target, Window toplevel,
   if (supported >= 1)
     msg.xclient.data.l[2] = timestamp;
 
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSendEvent (FRAME_X_DISPLAY (f), target, False, NoEventMask, &msg);
   x_stop_ignoring_errors (dpyinfo);
   return true;
@@ -6731,7 +6815,7 @@ x_set_frame_alpha (struct frame *f)
      Do this unconditionally as this function is called on reparent when
      alpha has not changed on the frame.  */
 
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
 
   if (!FRAME_PARENT_FRAME (f))
     {
@@ -6907,6 +6991,7 @@ static void
 x_sync_wait_for_frame_drawn_event (struct frame *f)
 {
   XEvent event;
+  struct x_display_info *dpyinfo;
 
   if (!FRAME_X_WAITING_FOR_DRAW (f)
       /* The compositing manager can't draw a frame if it is
@@ -6914,21 +6999,42 @@ x_sync_wait_for_frame_drawn_event (struct frame *f)
       || !FRAME_VISIBLE_P (f))
     return;
 
+  dpyinfo = FRAME_DISPLAY_INFO (f);
+
   /* Wait for the frame drawn message to arrive.  */
   if (x_if_event (FRAME_X_DISPLAY (f), &event,
                   x_sync_is_frame_drawn_event, (XPointer) f,
                   make_timespec (1, 0)))
     {
-      /* TODO: display this warning in the echo area.  */
-      fprintf (stderr, "Warning: compositing manager spent more than 1 second "
-               "drawing a frame.  Frame synchronization has been disabled\n");
-      FRAME_X_OUTPUT (f)->use_vsync_p = false;
+      /* The first time a draw hangs, treat it as a random fluctuation
+         on the part of the compositor.  If the next draw continues to
+         hang, disable frame synchronization.  */
+      if (FRAME_X_DRAW_JUST_HUNG (f))
+        {
+          fprintf (stderr, "Warning: compositing manager spent more than 1 "
+                   "second drawing a frame.  Frame synchronization has "
+                   "been disabled\n");
+          FRAME_X_OUTPUT (f)->use_vsync_p = false;
+
+          /* Remove the compositor bypass property from the outer
+             window.  */
+          XDeleteProperty (dpyinfo->display, FRAME_OUTER_WINDOW (f),
+                           dpyinfo->Xatom_net_wm_bypass_compositor);
 
-      /* Also change the frame parameter to reflect the new state.  */
-      store_frame_param (f, Quse_frame_synchronization, Qnil);
+          /* Also change the frame parameter to reflect the new
+             state.  */
+          store_frame_param (f, Quse_frame_synchronization, Qnil);
+        }
+      else
+        {
+          fprintf (stderr, "Warning: compositing manager spent more than 1 "
+                   "second drawing a frame.  Frame synchronization will be "
+                   "disabled if this happens again\n");
+          FRAME_X_DRAW_JUST_HUNG (f) = true;
+        }
     }
   else
-    x_sync_note_frame_times (FRAME_DISPLAY_INFO (f), f, &event);
+    x_sync_note_frame_times (dpyinfo, f, &event);
 
   FRAME_X_WAITING_FOR_DRAW (f) = false;
 }
@@ -7128,8 +7234,26 @@ static void
 x_sync_handle_frame_drawn (struct x_display_info *dpyinfo,
                            XEvent *message, struct frame *f)
 {
+  XSyncValue value, counter;
+
   if (FRAME_OUTER_WINDOW (f) == message->xclient.window)
-    FRAME_X_WAITING_FOR_DRAW (f) = false;
+    {
+      counter = FRAME_X_COUNTER_VALUE (f);
+
+      /* Check that the counter in the message is the same as the
+         counter in the frame.  */
+      XSyncIntsToValue (&value,
+                        message->xclient.data.l[0] & 0xffffffff,
+                        message->xclient.data.l[1] & 0xffffffff);
+
+      if (XSyncValueEqual (value, counter))
+        FRAME_X_WAITING_FOR_DRAW (f) = false;
+
+      /* As long as a _NET_WM_FRAME_DRAWN message arrives, we know
+         that the compositor is still sending events, so avoid timing
+         out.  */
+      FRAME_X_DRAW_JUST_HUNG (f) = false;
+    }
 
   x_sync_note_frame_times (dpyinfo, f, message);
 }
@@ -10959,6 +11083,31 @@ x_clear_frame (struct frame *f)
   unblock_input ();
 }
 
+/* Send a message to frame F telling the event loop to track whether
+   or not an hourglass is being displayed.  This is required to ignore
+   the right events when the hourglass is mapped without callig XSync
+   after displaying or hiding the hourglass.  */
+
+static void
+x_send_hourglass_message (struct frame *f, bool hourglass_enabled)
+{
+  struct x_display_info *dpyinfo;
+  XEvent msg;
+
+  dpyinfo = FRAME_DISPLAY_INFO (f);
+  memset (&msg, 0, sizeof msg);
+
+  msg.xclient.type = ClientMessage;
+  msg.xclient.message_type
+    = dpyinfo->Xatom_EMACS_TMP;
+  msg.xclient.format = 8;
+  msg.xclient.window = FRAME_X_WINDOW (f);
+  msg.xclient.data.b[0] = hourglass_enabled ? 1 : 0;
+
+  XSendEvent (dpyinfo->display, FRAME_X_WINDOW (f),
+              False, NoEventMask, &msg);
+}
+
 /* RIF: Show hourglass cursor on frame F.  */
 
 static void
@@ -10979,14 +11128,14 @@ x_show_hourglass (struct frame *f)
       if (popup_activated ())
         return;
 
+      x_send_hourglass_message (f, true);
+
 #ifdef USE_X_TOOLKIT
       if (x->widget)
 #else
       if (FRAME_OUTER_WINDOW (f))
 #endif
        {
-         x->hourglass_p = true;
-
          if (!x->hourglass_window)
            {
 #ifndef USE_XCB
@@ -11053,15 +11202,11 @@ x_hide_hourglass (struct frame *f)
     {
 #ifndef USE_XCB
       XUnmapWindow (FRAME_X_DISPLAY (f), x->hourglass_window);
-      /* Sync here because XTread_socket looks at the
-         hourglass_p flag that is reset to zero below.  */
-      XSync (FRAME_X_DISPLAY (f), False);
 #else
       xcb_unmap_window (FRAME_DISPLAY_INFO (f)->xcb_connection,
                         (xcb_window_t) x->hourglass_window);
-      xcb_aux_sync (FRAME_DISPLAY_INFO (f)->xcb_connection);
 #endif
-      x->hourglass_p = false;
+      x_send_hourglass_message (f, false);
     }
 }
 
@@ -11185,21 +11330,32 @@ XTflash (struct frame *f)
 static void
 XTring_bell (struct frame *f)
 {
-  if (FRAME_X_DISPLAY (f))
+  struct x_display_info *dpyinfo;
+
+  if (!FRAME_X_DISPLAY (f))
+    return;
+
+  dpyinfo = FRAME_DISPLAY_INFO (f);
+
+  if (visible_bell)
+    XTflash (f);
+  else
     {
-      if (visible_bell)
-        XTflash (f);
-      else
-        {
-          block_input ();
+      /* When Emacs is untrusted, Bell requests sometimes generate
+         Access errors.  This is not in the security extension
+         specification but seems to be a bug in the X consortium XKB
+         implementation.  */
+
+      block_input ();
+      x_ignore_errors_for_next_request (dpyinfo, 0);
 #ifdef HAVE_XKB
-          XkbBell (FRAME_X_DISPLAY (f), None, 0, None);
+      XkbBell (FRAME_X_DISPLAY (f), FRAME_X_WINDOW (f), 0, None);
 #else
-          XBell (FRAME_X_DISPLAY (f), 0);
+      XBell (FRAME_X_DISPLAY (f), 0);
 #endif
-          XFlush (FRAME_X_DISPLAY (f));
-          unblock_input ();
-        }
+      XFlush (FRAME_X_DISPLAY (f));
+      x_stop_ignoring_errors (dpyinfo);
+      unblock_input ();
     }
 }
 
@@ -11445,7 +11601,7 @@ x_frame_highlight (struct frame *f)
      the window-manager in use, tho something more is at play since I've been
      using that same window-manager binary for ever.  Let's not crash just
      because of this (bug#9310).  */
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSetWindowBorder (FRAME_X_DISPLAY (f), FRAME_X_WINDOW (f),
                     f->output_data.x->border_pixel);
   x_stop_ignoring_errors (dpyinfo);
@@ -11468,7 +11624,7 @@ x_frame_unhighlight (struct frame *f)
 
   block_input ();
   /* Same as above for XSetWindowBorder (bug#9310).  */
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSetWindowBorderPixmap (FRAME_X_DISPLAY (f), FRAME_X_WINDOW (f),
                           f->output_data.x->border_tile);
   x_stop_ignoring_errors (dpyinfo);
@@ -11532,7 +11688,7 @@ x_new_focus_frame (struct x_display_info *dpyinfo, struct frame *frame)
   x_frame_rehighlight (dpyinfo);
 }
 
-#ifdef HAVE_XFIXES
+#if defined HAVE_XFIXES && XFIXES_VERSION >= 40000
 
 /* True if the display in DPYINFO supports a version of Xfixes
    sufficient for pointer blanking.  */
@@ -11544,11 +11700,12 @@ x_fixes_pointer_blanking_supported (struct x_display_info *dpyinfo)
           && dpyinfo->xfixes_major >= 4);
 }
 
-#endif /* HAVE_XFIXES */
+#endif /* HAVE_XFIXES && XFIXES_VERSION >= 40000 */
 
 /* Toggle mouse pointer visibility on frame F using the XFixes
    extension.  */
-#ifdef HAVE_XFIXES
+#if defined HAVE_XFIXES && XFIXES_VERSION >= 40000
+
 static void
 xfixes_toggle_visible_pointer (struct frame *f, bool invisible)
 
@@ -11559,6 +11716,7 @@ xfixes_toggle_visible_pointer (struct frame *f, bool invisible)
     XFixesShowCursor (FRAME_X_DISPLAY (f), FRAME_X_WINDOW (f));
   f->pointer_invisible = invisible;
 }
+
 #endif /* HAVE_XFIXES */
 
 /* Create invisible cursor on the X display referred by DPYINFO.  */
@@ -11607,7 +11765,7 @@ x_toggle_visible_pointer (struct frame *f, bool invisible)
   if (dpyinfo->invisible_cursor == None)
     dpyinfo->invisible_cursor = make_invisible_cursor (dpyinfo);
 
-#ifndef HAVE_XFIXES
+#if !defined HAVE_XFIXES || XFIXES_VERSION < 40000
   if (dpyinfo->invisible_cursor == None)
     invisible = false;
 #else
@@ -11640,7 +11798,7 @@ static void
 XTtoggle_invisible_pointer (struct frame *f, bool invisible)
 {
   block_input ();
-#ifdef HAVE_XFIXES
+#if defined HAVE_XFIXES && XFIXES_VERSION >= 40000
   if (FRAME_DISPLAY_INFO (f)->fixes_pointer_blanking
       && x_fixes_pointer_blanking_supported (FRAME_DISPLAY_INFO (f)))
     xfixes_toggle_visible_pointer (f, invisible);
@@ -12229,6 +12387,13 @@ x_dnd_begin_drag_and_drop (struct frame *f, Time time, Atom xaction,
   struct xi_device_t *device;
 #endif
 
+  if (FRAME_DISPLAY_INFO (f)->untrusted)
+    /* Untrusted clients cannot send messages to trusted clients or
+       read the window tree, so drag and drop will likely not work at
+       all.  */
+    error ("Drag-and-drop is not possible when the client is"
+           " not trusted by the X server.");
+
   base = SPECPDL_INDEX ();
 
   /* Bind this here to avoid juggling bindings and SAFE_FREE in
@@ -15000,9 +15165,7 @@ x_send_scroll_bar_event (Lisp_Object window, enum scroll_bar_part part,
   XClientMessageEvent *ev = &event.xclient;
   struct window *w = XWINDOW (window);
   struct frame *f = XFRAME (w->frame);
-  intptr_t iw = (intptr_t) w;
   verify (INTPTR_WIDTH <= 64);
-  int sign_shift = INTPTR_WIDTH - 32;
 
   /* Don't do anything if too many scroll bar events have been
      sent but not received.  */
@@ -15019,15 +15182,11 @@ x_send_scroll_bar_event (Lisp_Object window, enum scroll_bar_part part,
   ev->window = FRAME_X_WINDOW (f);
   ev->format = 32;
 
-  /* A 32-bit X client can pass a window pointer through the X server
-     as-is.
-
-     A 64-bit client is in trouble because a pointer does not fit in
-     the 32 bits given for ClientMessage data and will be truncated by
-     Xlib.  So use two slots and hope that X12 will resolve such
-     issues someday.  */
-  ev->data.l[0] = iw >> 31 >> 1;
-  ev->data.l[1] = sign_shift <= 0 ? iw : iw << sign_shift >> sign_shift;
+  /* These messages formerly contained a pointer to the window, but
+     now that information is kept internally.  The following two
+     fields are thus zero.  */
+  ev->data.l[0] = 0;
+  ev->data.l[1] = 0;
   ev->data.l[2] = part;
   ev->data.l[3] = portion;
   ev->data.l[4] = whole;
@@ -18458,7 +18617,7 @@ handle_one_xevent (struct x_display_info *dpyinfo,
                       x_dnd_waiting_for_status_window = None;
                     else
                       {
-                        x_ignore_errors_for_next_request (dpyinfo);
+                        x_ignore_errors_for_next_request (dpyinfo, 0);
                         XSendEvent (dpyinfo->display, target,
                                     False, NoEventMask,
                                     &x_dnd_pending_send_position);
@@ -18572,6 +18731,16 @@ handle_one_xevent (struct x_display_info *dpyinfo,
               }
           }
 
+        if (event->xclient.message_type == dpyinfo->Xatom_EMACS_TMP
+            && event->xclient.format == 8)
+          {
+            /* This is actually an hourglass message.  Set whether or
+               not events from here on have the hourglass enabled.  */
+
+            if (any)
+              FRAME_X_OUTPUT (any)->hourglass_p = event->xclient.data.b[0];
+          }
+
         if (event->xclient.message_type == dpyinfo->Xatom_wm_protocols
             && event->xclient.format == 32)
           {
@@ -19160,7 +19329,7 @@ handle_one_xevent (struct x_display_info *dpyinfo,
                 = xcb_get_property (dpyinfo->xcb_connection, 0,
                                     (xcb_window_t) FRAME_OUTER_WINDOW (f),
                                     (xcb_atom_t) dpyinfo->Xatom_net_wm_window_opacity,
-                                    XCB_ATOM_CARDINAL, 0, 1);
+                                    XA_CARDINAL, 0, 1);
               opacity_reply
                 = xcb_get_property_reply (dpyinfo->xcb_connection,
                                           opacity_cookie, &error);
@@ -19169,9 +19338,9 @@ handle_one_xevent (struct x_display_info *dpyinfo,
                 free (error), rc = false;
               else
                 rc = (opacity_reply->format == 32
-                      && (opacity_reply->type == XCB_ATOM_CARDINAL
-                          || opacity_reply->type == XCB_ATOM_ATOM
-                          || opacity_reply->type == XCB_ATOM_WINDOW)
+                      && (opacity_reply->type == XA_CARDINAL
+                          || opacity_reply->type == XA_ATOM
+                          || opacity_reply->type == XA_WINDOW)
                       && (xcb_get_property_value_length (opacity_reply) >= 4));
 
               if (rc)
@@ -21317,7 +21486,7 @@ handle_one_xevent (struct x_display_info *dpyinfo,
 
             if (FRAME_PARENT_FRAME (f) || (hf && frame_ancestor_p (f, hf)))
               {
-                x_ignore_errors_for_next_request (dpyinfo);
+                x_ignore_errors_for_next_request (dpyinfo, 0);
                 XSetInputFocus (FRAME_X_DISPLAY (f), FRAME_OUTER_WINDOW (f),
                                 RevertToParent, event->xbutton.time);
                 x_stop_ignoring_errors (dpyinfo);
@@ -21430,7 +21599,9 @@ handle_one_xevent (struct x_display_info *dpyinfo,
                   if (!NILP (tab_bar_arg))
                     inev.ie.arg = tab_bar_arg;
                 }
-            if (FRAME_X_EMBEDDED_P (f))
+
+            if (FRAME_X_EMBEDDED_P (f)
+                && !FRAME_NO_ACCEPT_FOCUS (f))
               xembed_send_message (f, event->xbutton.time,
                                    XEMBED_REQUEST_FOCUS, 0, 0, 0);
           }
@@ -23013,7 +23184,7 @@ handle_one_xevent (struct x_display_info *dpyinfo,
                           /* This can generate XI_BadDevice if the
                              device's attachment was destroyed
                              server-side.  */
-                          x_ignore_errors_for_next_request (dpyinfo);
+                          x_ignore_errors_for_next_request (dpyinfo, 0);
                           XISetFocus (dpyinfo->display, device->attachment,
                                       /* Note that the input extension
                                          only supports RevertToParent-type
@@ -23026,7 +23197,7 @@ handle_one_xevent (struct x_display_info *dpyinfo,
                          events to handle focus.  Errors are still
                          caught here in case the window is not
                          viewable.  */
-                      x_ignore_errors_for_next_request (dpyinfo);
+                      x_ignore_errors_for_next_request (dpyinfo, 0);
                       XSetInputFocus (FRAME_X_DISPLAY (f), FRAME_OUTER_WINDOW (f),
                                       RevertToParent, xev->time);
                       x_stop_ignoring_errors (dpyinfo);
@@ -23198,7 +23369,9 @@ handle_one_xevent (struct x_display_info *dpyinfo,
                         if (!NILP (tab_bar_arg))
                           inev.ie.arg = tab_bar_arg;
                       }
-                  if (FRAME_X_EMBEDDED_P (f))
+
+                  if (FRAME_X_EMBEDDED_P (f)
+                      && !FRAME_NO_ACCEPT_FOCUS (f))
                     xembed_send_message (f, xev->time,
                                          XEMBED_REQUEST_FOCUS, 0, 0, 0);
                 }
@@ -24033,7 +24206,7 @@ handle_one_xevent (struct x_display_info *dpyinfo,
 #ifndef HAVE_GTK3
                   else if (x_input_grab_touch_events)
                     {
-                      x_ignore_errors_for_next_request (dpyinfo);
+                      x_ignore_errors_for_next_request (dpyinfo, 0);
                       XIAllowTouchEvents (dpyinfo->display, xev->deviceid,
                                           xev->detail, xev->event, XIRejectTouch);
                       x_stop_ignoring_errors (dpyinfo);
@@ -25461,14 +25634,38 @@ x_clean_failable_requests (struct x_display_info *dpyinfo)
                                     + (last - first));
 }
 
+/* Protect a section of X requests: ignore errors generated by X
+   requests made from now until `x_stop_ignoring_errors'.  Each call
+   must be paired with a call to `x_stop_ignoring_errors', and
+   recursive calls inside the protected section are not allowed.
+
+   The advantage over x_catch_errors followed by
+   x_uncatch_errors_after_check is that this function does not sync to
+   catch errors if requests were made.  It should be used instead of
+   those two functions for catching errors around requests that do not
+   require a reply.
+
+   As a special feature intended to support xselect.c,
+   SELECTION_SERIAL may be an arbitrary number greater than zero: when
+   that is the case, x_select_handle_selection_error is called with
+   the specified number to delete the selection request that
+   encountered the error.  */
+
 void
-x_ignore_errors_for_next_request (struct x_display_info *dpyinfo)
+x_ignore_errors_for_next_request (struct x_display_info *dpyinfo,
+                                  unsigned int selection_serial)
 {
   struct x_failable_request *request, *max;
   unsigned long next_request;
 #ifdef HAVE_GTK3
   GdkDisplay *gdpy;
+#endif
 
+  /* This code is not reentrant, so be sure nothing calls it
+     recursively in response to input.  */
+  block_input ();
+
+#ifdef HAVE_GTK3
   /* GTK 3 tends to override our own error handler inside certain
      callbacks, which this can be called from.  Instead of trying to
      restore our own, add a trap for the following requests with
@@ -25510,6 +25707,7 @@ x_ignore_errors_for_next_request (struct x_display_info *dpyinfo)
 
   request->start = next_request;
   request->end = 0;
+  request->selection_serial = selection_serial;
 
   dpyinfo->next_failable_request++;
 }
@@ -25537,6 +25735,8 @@ x_stop_ignoring_errors (struct x_display_info *dpyinfo)
   if (gdpy)
     gdk_x11_display_error_trap_pop_ignored (gdpy);
 #endif
+
+  unblock_input ();
 }
 
 /* Undo the last x_catch_errors call.
@@ -25929,9 +26129,11 @@ For details, see etc/PROBLEMS.\n",
           if (!ioerror && dpyinfo)
             {
               /* Dump the list of error handlers for debugging
-                 purposes.  */
+                 purposes if the list exists.  */
 
-              fprintf (stderr, "X error handlers currently installed:\n");
+              if ((dpyinfo->failable_requests
+                   != dpyinfo->next_failable_request) || x_error_message)
+                fprintf (stderr, "X error handlers currently installed:\n");
 
               for (failable = dpyinfo->failable_requests;
                    failable < dpyinfo->next_failable_request;
@@ -26020,6 +26222,12 @@ x_error_handler (Display *display, XErrorEvent *event)
                                                 + (last - fail));
             }
 
+          /* If a selection transfer is the cause of this error,
+             remove the selection transfer now.  */
+          if (fail->selection_serial)
+            x_handle_selection_error (fail->selection_serial,
+                                      event);
+
           return 0;
         }
     }
@@ -26572,38 +26780,43 @@ x_set_offset (struct frame *f, int xoff, int yoff, int change_gravity)
                modified_left, modified_top);
 #endif
 
-  /* 'x_sync_with_move' is too costly for dragging child frames.  */
-  if (!FRAME_PARENT_FRAME (f)
-      /* If no window manager exists, just calling XSync will be
-         sufficient to ensure that the window geometry has been
-         updated.  */
-      && NILP (Vx_no_window_manager))
-    {
-      x_sync_with_move (f, f->left_pos, f->top_pos,
-                        FRAME_DISPLAY_INFO (f)->wm_type == X_WMTYPE_UNKNOWN);
-
-      /* change_gravity is non-zero when this function is called from Lisp to
-         programmatically move a frame.  In that case, we call
-         x_check_expected_move to discover if we have a "Type A" or "Type B"
-         window manager, and, for a "Type A" window manager, adjust the position
-         of the frame.
-
-         We call x_check_expected_move if a programmatic move occurred, and
-         either the window manager type (A/B) is unknown or it is Type A but we
-         need to compute the top/left offset adjustment for this frame.  */
-
-      if (change_gravity != 0
-          && (FRAME_DISPLAY_INFO (f)->wm_type == X_WMTYPE_UNKNOWN
-              || (FRAME_DISPLAY_INFO (f)->wm_type == X_WMTYPE_A
-                  && (FRAME_X_OUTPUT (f)->move_offset_left == 0
-                      && FRAME_X_OUTPUT (f)->move_offset_top == 0))))
-        x_check_expected_move (f, modified_left, modified_top);
-    }
-  /* Instead, just wait for the last ConfigureWindow request to
-     complete.  No window manager is involved when moving child
-     frames.  */
-  else
-    XSync (FRAME_X_DISPLAY (f), False);
+  /* The following code is too slow over a latent network
+     connection.  */
+  if (NILP (Vx_lax_frame_positioning))
+    {
+      /* 'x_sync_with_move' is too costly for dragging child frames.  */
+      if (!FRAME_PARENT_FRAME (f)
+          /* If no window manager exists, just calling XSync will be
+             sufficient to ensure that the window geometry has been
+             updated.  */
+          && NILP (Vx_no_window_manager))
+        {
+          x_sync_with_move (f, f->left_pos, f->top_pos,
+                            FRAME_DISPLAY_INFO (f)->wm_type == X_WMTYPE_UNKNOWN);
+
+          /* change_gravity is non-zero when this function is called from Lisp to
+             programmatically move a frame.  In that case, we call
+             x_check_expected_move to discover if we have a "Type A" or "Type B"
+             window manager, and, for a "Type A" window manager, adjust the position
+             of the frame.
+
+             We call x_check_expected_move if a programmatic move occurred, and
+             either the window manager type (A/B) is unknown or it is Type A but we
+             need to compute the top/left offset adjustment for this frame.  */
+
+          if (change_gravity != 0
+              && (FRAME_DISPLAY_INFO (f)->wm_type == X_WMTYPE_UNKNOWN
+                  || (FRAME_DISPLAY_INFO (f)->wm_type == X_WMTYPE_A
+                      && (FRAME_X_OUTPUT (f)->move_offset_left == 0
+                          && FRAME_X_OUTPUT (f)->move_offset_top == 0))))
+            x_check_expected_move (f, modified_left, modified_top);
+        }
+      /* Instead, just wait for the last ConfigureWindow request to
+         complete.  No window manager is involved when moving child
+         frames.  */
+      else
+        XSync (FRAME_X_DISPLAY (f), False);
+    }
 
   unblock_input ();
 }
@@ -26663,6 +26876,12 @@ x_wm_supports_1 (struct x_display_info *dpyinfo, Atom want_atom)
   if (!NILP (Vx_no_window_manager))
     return false;
 
+  /* If the window system says Emacs is untrusted, there will be no
+     way to send any information to the window manager, making any
+     hints useless.  */
+  if (dpyinfo->untrusted)
+    return false;
+
   block_input ();
 
   x_catch_errors (dpy);
@@ -26713,13 +26932,14 @@ x_wm_supports_1 (struct x_display_info *dpyinfo, Atom want_atom)
 
       if (rc != Success || actual_type != XA_ATOM || x_had_errors_p (dpy))
         {
-          if (tmp_data) XFree (tmp_data);
+          if (tmp_data)
+            XFree (tmp_data);
           x_uncatch_errors ();
           unblock_input ();
           return false;
         }
 
-      dpyinfo->net_supported_atoms = (Atom *)tmp_data;
+      dpyinfo->net_supported_atoms = (Atom *) tmp_data;
       dpyinfo->nr_net_supported_atoms = actual_size;
       dpyinfo->net_supported_window = wmcheck_window;
     }
@@ -27132,13 +27352,12 @@ do_ewmh_fullscreen (struct frame *f)
 static void
 XTfullscreen_hook (struct frame *f)
 {
-  if (FRAME_VISIBLE_P (f))
-    {
-      block_input ();
-      x_check_fullscreen (f);
-      x_sync (f);
-      unblock_input ();
-    }
+  if (!FRAME_VISIBLE_P (f))
+    return;
+
+  block_input ();
+  x_check_fullscreen (f);
+  unblock_input ();
 }
 
 
@@ -27232,10 +27451,7 @@ x_check_fullscreen (struct frame *f)
       if (FRAME_VISIBLE_P (f))
         x_wait_for_event (f, ConfigureNotify);
       else
-        {
-          change_frame_size (f, width, height, false, true, false);
-          x_sync (f);
-        }
+        change_frame_size (f, width, height, false, true, false);
     }
 
   /* `x_net_wm_state' might have reset the fullscreen frame parameter,
@@ -27409,6 +27625,12 @@ x_set_window_size_1 (struct frame *f, bool change_gravity,
      we have to make sure to do it here.  */
   SET_FRAME_GARBAGED (f);
 
+  /* The following code is too slow over a latent network
+     connection, so skip it when the user says so.  */
+
+  if (!NILP (Vx_lax_frame_positioning))
+    return;
+
   /* Now, strictly speaking, we can't be sure that this is accurate,
      but the window manager will get around to dealing with the size
      change request eventually, and we'll hear how it went when the
@@ -27449,8 +27671,6 @@ x_set_window_size_1 (struct frame *f, bool change_gravity,
       adjust_frame_size (f, FRAME_PIXEL_TO_TEXT_WIDTH (f, width),
                          FRAME_PIXEL_TO_TEXT_HEIGHT (f, height),
                          5, 0, Qx_set_window_size_1);
-
-      x_sync (f);
     }
 }
 
@@ -27504,7 +27724,7 @@ frame_set_mouse_pixel_position (struct frame *f, int pix_x, int pix_y)
       && deviceid != -1)
     {
       block_input ();
-      x_ignore_errors_for_next_request (FRAME_DISPLAY_INFO (f));
+      x_ignore_errors_for_next_request (FRAME_DISPLAY_INFO (f), 0);
       XIWarpPointer (FRAME_X_DISPLAY (f), deviceid, None,
                      FRAME_X_WINDOW (f), 0, 0, 0, 0, pix_x, pix_y);
       x_stop_ignoring_errors (FRAME_DISPLAY_INFO (f));
@@ -27801,7 +28021,7 @@ x_set_input_focus (struct x_display_info *dpyinfo, Window window,
         {
           eassert (device->use == XIMasterPointer);
 
-          x_ignore_errors_for_next_request (dpyinfo);
+          x_ignore_errors_for_next_request (dpyinfo, 0);
           XISetFocus (dpyinfo->display, device->attachment,
                       /* Note that the input extension
                          only supports RevertToParent-type
@@ -27816,7 +28036,7 @@ x_set_input_focus (struct x_display_info *dpyinfo, Window window,
 
   /* Otherwise, use the pointer device that the X server says is the
      client pointer.  */
-  x_ignore_errors_for_next_request (dpyinfo);
+  x_ignore_errors_for_next_request (dpyinfo, 0);
   XSetInputFocus (dpyinfo->display, window, RevertToParent, time);
   x_stop_ignoring_errors (dpyinfo);
 }
@@ -27838,6 +28058,15 @@ x_focus_frame (struct frame *f, bool noactivate)
 
   dpyinfo = FRAME_DISPLAY_INFO (f);
 
+  if (dpyinfo->untrusted)
+    /* The X server ignores all input focus related requests from
+       untrusted clients.  */
+    return;
+
+  /* The code below is not reentrant wrt to dpyinfo->x_focus_frame and
+     friends being set.  */
+  block_input ();
+
   if (FRAME_X_EMBEDDED_P (f))
     /* For Xembedded frames, normally the embedder forwards key
        events.  See XEmbed Protocol Specification at
@@ -27866,7 +28095,7 @@ x_focus_frame (struct frame *f, bool noactivate)
              the current workspace, and mapping it, etc, before moving
              input focus to the frame.  */
           x_ewmh_activate_frame (f);
-          return;
+          goto out;
         }
 
       if (NILP (Vx_no_window_manager))
@@ -27900,6 +28129,9 @@ x_focus_frame (struct frame *f, bool noactivate)
                               matter.  */
                            CurrentTime);
     }
+
+ out:
+  unblock_input ();
 }
 
 
@@ -27946,7 +28178,7 @@ xembed_send_message (struct frame *f, Time t, enum xembed_message msg,
      but I don't understand why: there is no way for clients to
      survive the death of the parent anyway.  */
 
-  x_ignore_errors_for_next_request (FRAME_DISPLAY_INFO (f));
+  x_ignore_errors_for_next_request (FRAME_DISPLAY_INFO (f), 0);
   XSendEvent (FRAME_X_DISPLAY (f), FRAME_X_OUTPUT (f)->parent_desc,
               False, NoEventMask, &event);
   x_stop_ignoring_errors (FRAME_DISPLAY_INFO (f));
@@ -28097,6 +28329,7 @@ x_make_frame_visible (struct frame *f)
         && !FRAME_ICONIFIED_P (f)
         && !FRAME_X_EMBEDDED_P (f)
         && !FRAME_PARENT_FRAME (f)
+        && NILP (Vx_lax_frame_positioning)
         && f->win_gravity == NorthWestGravity
         && previously_visible)
       {
@@ -28125,7 +28358,8 @@ x_make_frame_visible (struct frame *f)
       }
 
     /* Try to wait for a MapNotify event (that is what tells us when a
-       frame becomes visible).  */
+       frame becomes visible).  Unless `x-lax-frame-positioning' is
+       non-nil: there, that is a little slow.  */
 
 #ifdef CYGWIN
     /* On Cygwin, which uses input polling, we need to force input to
@@ -28143,7 +28377,8 @@ x_make_frame_visible (struct frame *f)
     poll_suppress_count = old_poll_suppress_count;
 #endif
 
-    if (!FRAME_VISIBLE_P (f))
+    if (!FRAME_VISIBLE_P (f)
+        && NILP (Vx_lax_frame_positioning))
       {
         if (CONSP (frame_size_history))
           frame_size_history_plain
@@ -28200,7 +28435,7 @@ x_make_frame_invisible (struct frame *f)
         error ("Can't notify window manager of window withdrawal");
       }
 
-  x_sync (f);
+  XSync (FRAME_X_DISPLAY (f), False);
 
   /* We can't distinguish this from iconification
      just by the event that we get from the server.
@@ -28798,6 +29033,53 @@ x_get_atom_name (struct x_display_info *dpyinfo, Atom atom,
   return value;
 }
 
+/* Intern an array of atoms, and do so quickly, avoiding extraneous
+   roundtrips to the X server.
+
+   Avoid sending atoms that have already been found to the X server.
+   This cannot do anything that will end up triggering garbage
+   collection.  */
+
+void
+x_intern_atoms (struct x_display_info *dpyinfo, char **names, int count,
+                Atom *atoms_return)
+{
+  int i, j, indices[256];
+  char *new_names[256];
+  Atom results[256], candidate;
+
+  if (count > 256)
+    /* Atoms array too big to inspect reasonably, just send it to the
+       server and back.  */
+    XInternAtoms (dpyinfo->display, new_names, count, False, atoms_return);
+  else
+    {
+      for (i = 0, j = 0; i < count; ++i)
+        {
+          candidate = x_intern_cached_atom (dpyinfo, names[i],
+                                            true);
+
+          if (candidate)
+            atoms_return[i] = candidate;
+          else
+            {
+              indices[j++] = i;
+              new_names[j - 1] = names[i];
+            }
+        }
+
+      if (!j)
+        return;
+
+      /* Now, get the results back from the X server.  */
+      XInternAtoms (dpyinfo->display, new_names, j, False,
+                    results);
+
+      for (i = 0; i < j; ++i)
+        atoms_return[indices[i]] = results[i];
+    }
+}
+
 #ifndef USE_GTK
 
 /* Set up XEmbed for F, and change its save set to handle the parent
@@ -29346,6 +29628,7 @@ struct x_display_info *
 x_term_init (Lisp_Object display_name, char *xrm_option, char *resource_name)
 {
   Display *dpy;
+  XKeyboardState keyboard_state;
   struct terminal *terminal;
   struct x_display_info *dpyinfo;
   XrmDatabase xrdb;
@@ -29565,6 +29848,32 @@ x_term_init (Lisp_Object display_name, char *xrm_option, char *resource_name)
   dpyinfo = xzalloc (sizeof *dpyinfo);
   terminal = x_create_terminal (dpyinfo);
 
+  if (!NILP (Vx_detect_server_trust))
+    {
+      /* Detect whether or not the X server trusts this client, which
+         is done by making a SetKeyboardControl request and checking
+         for an Access error.  */
+      XGrabServer (dpy);
+      XGetKeyboardControl (dpy, &keyboard_state);
+
+      x_catch_errors (dpy);
+
+      /* At this point, the display is not on x_display_list, so
+         x_uncatch_errors won't sync.  However, that's okay because
+         x_had_errors_p will.  */
+
+      if (keyboard_state.global_auto_repeat
+          == AutoRepeatModeOn)
+        XAutoRepeatOn (dpy);
+      else
+        XAutoRepeatOff (dpy);
+
+      if (x_had_errors_p (dpy))
+        dpyinfo->untrusted = true;
+      x_uncatch_errors_after_check ();
+      XUngrabServer (dpy);
+    }
+
   dpyinfo->next_failable_request = dpyinfo->failable_requests;
 
   {
@@ -29585,13 +29894,17 @@ x_term_init (Lisp_Object display_name, char *xrm_option, char *resource_name)
           {
             char *vendor = ServerVendor (dpy);
 
-            /* Temporarily hide the partially initialized terminal.  */
+            /* Temporarily hide the partially initialized terminal.
+               Use safe_call so that if a signal happens, a partially
+               initialized display (and display connection) is not
+               kept around.  */
             terminal_list = terminal->next_terminal;
             unblock_input ();
-            kset_system_key_alist
-              (terminal->kboard,
-               call1 (Qvendor_specific_keysyms,
-                      vendor ? build_string (vendor) : empty_unibyte_string));
+            kset_system_key_alist (terminal->kboard,
+                                   safe_call1 (Qvendor_specific_keysyms,
+                                               (vendor
+                                                ? build_string (vendor)
+                                                : empty_unibyte_string)));
             block_input ();
             terminal->next_terminal = terminal_list;
             terminal_list = terminal;
@@ -30209,7 +30522,7 @@ x_term_init (Lisp_Object display_name, char *xrm_option, char *resource_name)
                                    1, 0, 1);
 
   dpyinfo->invisible_cursor = make_invisible_cursor (dpyinfo);
-#ifdef HAVE_XFIXES
+#if defined HAVE_XFIXES && XFIXES_VERSION >= 40000
   dpyinfo->fixes_pointer_blanking = egetenv ("EMACS_XFIXES");
 #endif
 
@@ -30537,8 +30850,13 @@ x_delete_display (struct x_display_info *dpyinfo)
       last = ie;
     }
 
+  /* Delete selection requests bound for dpyinfo from the keyboard
+     buffer.  */
   x_delete_selection_requests (dpyinfo);
 
+  /* And remove any outstanding selection transfers.  */
+  x_remove_selection_transfers (dpyinfo);
+
   if (next_noop_dpyinfo == dpyinfo)
     next_noop_dpyinfo = dpyinfo->next;
 
@@ -30568,6 +30886,9 @@ x_delete_display (struct x_display_info *dpyinfo)
         }
     }
 
+  if (dpyinfo->net_supported_atoms)
+    XFree (dpyinfo->net_supported_atoms);
+
   xfree (dpyinfo->color_names);
   xfree (dpyinfo->color_names_length);
   xfree (dpyinfo->x_id_name);
@@ -30679,7 +31000,11 @@ static struct redisplay_interface x_redisplay_interface =
 void
 x_delete_terminal (struct terminal *terminal)
 {
-  struct x_display_info *dpyinfo = terminal->display_info.x;
+  struct x_display_info *dpyinfo;
+  struct frame *f;
+  Lisp_Object tail, frame;
+
+  dpyinfo = terminal->display_info.x;
 
   /* Protect against recursive calls.  delete_frame in
      delete_terminal calls us back when it deletes our last frame.  */
@@ -30687,6 +31012,19 @@ x_delete_terminal (struct terminal *terminal)
     return;
 
   block_input ();
+
+  /* Delete all remaining frames on the display that is going away.
+     Otherwise, font backends assume the display is still up, and
+     xftfont_end_for_frame crashes.  */
+  FOR_EACH_FRAME (tail, frame)
+    {
+      f = XFRAME (frame);
+
+      if (FRAME_LIVE_P (f) && f->terminal == terminal)
+        /* Pass Qnoelisp rather than Qt.  */
+        delete_frame (frame, Qnoelisp);
+    }
+
 #ifdef HAVE_X_I18N
   /* We must close our connection to the XIM server before closing the
      X display.  */
@@ -30700,6 +31038,10 @@ x_delete_terminal (struct terminal *terminal)
       image_destroy_all_bitmaps (dpyinfo);
       XSetCloseDownMode (dpyinfo->display, DestroyAll);
 
+      /* Delete the scratch cursor GC, should it exist.  */
+      if (dpyinfo->scratch_cursor_gc)
+        XFreeGC (dpyinfo->display, dpyinfo->scratch_cursor_gc);
+
       /* Get rid of any drag-and-drop operation that might be in
          progress as well.  */
       if ((x_dnd_in_progress || x_dnd_waiting_for_finish)
@@ -31020,7 +31362,7 @@ x_catch_errors_for_lisp (struct x_display_info *dpyinfo)
   if (!x_fast_protocol_requests)
     x_catch_errors (dpyinfo->display);
   else
-    x_ignore_errors_for_next_request (dpyinfo);
+    x_ignore_errors_for_next_request (dpyinfo, 0);
 }
 
 void
@@ -31229,6 +31571,8 @@ syms_of_xterm (void)
   DEFSYM (Qnow, "now");
   DEFSYM (Qx_dnd_targets_list, "x-dnd-targets-list");
   DEFSYM (Qx_auto_preserve_selections, "x-auto-preserve-selections");
+  DEFSYM (Qexpose, "expose");
+  DEFSYM (Qdont_save, "dont-save");
 
 #ifdef USE_GTK
   xg_default_icon_file = build_pure_c_string ("icons/hicolor/scalable/apps/emacs.svg");
@@ -31398,7 +31742,6 @@ always uses gtk_window_move and ignores the value of this variable.  */);
 This option is only effective when Emacs is built with XInput 2
 support. */);
   Vx_scroll_event_delta_factor = make_float (1.0);
-  DEFSYM (Qexpose, "expose");
 
   DEFVAR_BOOL ("x-gtk-use-native-input", x_gtk_use_native_input,
                doc: /* Non-nil means to use GTK for input method support.
@@ -31612,4 +31955,25 @@ select text over slow X connections.
 If that is still too slow, setting this variable to the symbol
 `really-fast' will make Emacs return only cached values.  */);
   Vx_use_fast_mouse_position = Qnil;
+
+  DEFVAR_LISP ("x-detect-server-trust", Vx_detect_server_trust,
+    doc: /* If non-nil, Emacs should detect whether or not it is trusted by X.
+
+If non-nil, Emacs will make an X request at connection startup that is
+prohibited to untrusted clients under the X Security Extension and
+check whether or not a resulting Access error is generated by the X
+server.  If the X server reports the error, Emacs will disable certain
+features that do not work for untrusted clients.  */);
+  Vx_detect_server_trust = Qnil;
+
+  DEFVAR_LISP ("x-lax-frame-positioning", Vx_lax_frame_positioning,
+    doc: /* If non-nil, Emacs won't compensate for WM geometry behavior.
+
+Setting this to non-nil is useful when the compensation proves to be
+too slow, which is usually true when the X server is located over a
+network connection with high latency.  Doing so will make frame
+creation and placement faster at the cost of reducing the accuracy of
+frame placement via frame parameters, `set-frame-position', and
+`set-frame-size'.  */);
+  Vx_lax_frame_positioning = Qnil;
 }
diff --git a/src/xterm.h b/src/xterm.h
index c36920081d3..832ffc172b9 100644
--- a/src/xterm.h
+++ b/src/xterm.h
@@ -21,6 +21,22 @@ along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
 #define XTERM_H
 
 #include <X11/Xlib.h>
+
+#ifdef HAVE_XFIXES
+#include <X11/extensions/Xfixes.h>
+
+#if defined HAVE_XINPUT2 && XFIXES_MAJOR < 5
+/* XI2 headers need PointerBarrier, which is not defined in old
+   versions of the fixes library.  Define that type here.  */
+typedef XID PointerBarrier;
+#endif
+#if defined HAVE_XCOMPOSITE && XFIXES_MAJOR < 2
+/* Recent Composite headers need XserverRegion, which is not defined
+   in old versions of the fixes library.  Define that type here.  */
+typedef XID XserverRegion;
+#endif
+#endif
+
 #include <X11/cursorfont.h>
 
 /* Include Xutil.h after keysym.h to work around a bug that prevents
@@ -318,6 +334,9 @@ struct x_failable_request
   /* If this is zero, then the request has not yet been made.
      Otherwise, this is the request that ends this sequence.  */
   unsigned long end;
+
+  /* Any selection event serial associated with this error trap.  */
+  unsigned int selection_serial;
 };
 
 #ifdef HAVE_XFIXES
@@ -360,6 +379,10 @@ struct x_display_info
   /* Number of frames that are on this display.  */
   int reference_count;
 
+  /* True if this display connection cannot communicate with the
+     window manager because it is not trusted by the X server.  */
+  bool untrusted;
+
   /* The Screen this connection is connected to.  */
   Screen *screen;
 
@@ -406,7 +429,7 @@ struct x_display_info
      Unused if this display supports Xfixes extension.  */
   Cursor invisible_cursor;
 
-#ifdef HAVE_XFIXES
+#if defined HAVE_XFIXES && XFIXES_VERSION >= 40000
   /* Whether or not to use Xfixes for pointer blanking.  */
   bool fixes_pointer_blanking;
 #endif
@@ -537,6 +560,12 @@ struct x_display_info
      KDE" protocol in x-dnd.el). */
   Atom Xatom_DndProtocol, Xatom_DND_PROTOCOL;
 
+  /* Atoms to make x_intern_cached_atom fast.  */
+  Atom Xatom_text_plain_charset_utf_8, Xatom_LENGTH, Xatom_FILE_NAME,
+    Xatom_CHARACTER_POSITION, Xatom_LINE_NUMBER, Xatom_COLUMN_NUMBER,
+    Xatom_OWNER_OS, Xatom_HOST_NAME, Xatom_USER, Xatom_CLASS,
+    Xatom_NAME, Xatom_SAVE_TARGETS;
+
   /* The frame (if any) which has the X window that has keyboard focus.
      Zero if none.  This is examined by Ffocus_frame in xfns.c.  Note
      that a mere EnterNotify event can set this; if you need to know the
@@ -1179,6 +1208,10 @@ struct x_output
      frame.  */
   bool_bf waiting_for_frame_p : 1;
 
+  /* Whether or not Emacs just skipped waiting for a frame due to a
+     timeout.  */
+  bool_bf draw_just_hung_p : 1;
+
 #if !defined USE_GTK && defined HAVE_CLOCK_GETTIME
   /* Whether or not Emacs should wait for the compositing manager to
      draw frames before starting a new frame.  */
@@ -1392,6 +1425,8 @@ extern void x_mark_frame_dirty (struct frame *f);
   FRAME_X_OUTPUT (f)->extended_frame_counter
 #define FRAME_X_WAITING_FOR_DRAW(f)             \
   FRAME_X_OUTPUT (f)->waiting_for_frame_p
+#define FRAME_X_DRAW_JUST_HUNG(f)               \
+  FRAME_X_OUTPUT (f)->draw_just_hung_p
 #define FRAME_X_COUNTER_VALUE(f)                \
   FRAME_X_OUTPUT (f)->current_extended_counter_value
 #endif
@@ -1638,7 +1673,8 @@ extern bool x_had_errors_p (Display *);
 extern void x_unwind_errors_to (int);
 extern void x_uncatch_errors (void);
 extern void x_uncatch_errors_after_check (void);
-extern void x_ignore_errors_for_next_request (struct x_display_info *);
+extern void x_ignore_errors_for_next_request (struct x_display_info *,
+                                              unsigned int);
 extern void x_stop_ignoring_errors (struct x_display_info *);
 extern void x_clear_errors (Display *);
 extern void x_set_window_size (struct frame *, bool, int, int);
@@ -1711,6 +1747,11 @@ extern Lisp_Object x_handle_translate_coordinates (struct frame *, Lisp_Object,
 
 extern Bool x_query_pointer (Display *, Window, Window *, Window *, int *,
                              int *, int *, int *, unsigned int *);
+extern Atom x_intern_cached_atom (struct x_display_info *, const char *,
+                                  bool);
+extern void x_intern_atoms (struct x_display_info *, char **, int, Atom *);
+extern char *x_get_atom_name (struct x_display_info *, Atom, bool *)
+  ATTRIBUTE_MALLOC ATTRIBUTE_DEALLOC_FREE;
 
 #ifdef HAVE_GTK3
 extern void x_scroll_bar_configure (GdkEvent *);
@@ -1792,6 +1833,9 @@ extern void x_handle_property_notify (const XPropertyEvent *);
 extern void x_handle_selection_notify (const XSelectionEvent *);
 extern void x_handle_selection_event (struct selection_input_event *);
 extern void x_clear_frame_selections (struct frame *);
+extern void x_remove_selection_transfers (struct x_display_info *);
+extern void x_handle_selection_error (unsigned int, XErrorEvent *);
+
 extern Lisp_Object x_atom_to_symbol (struct x_display_info *, Atom);
 extern Atom symbol_to_x_atom (struct x_display_info *, Lisp_Object);
 
@@ -1801,11 +1845,8 @@ extern bool x_handle_dnd_message (struct frame *,
                                   struct input_event *,
                                   bool, int, int);
 extern int x_check_property_data (Lisp_Object);
-extern void x_fill_property_data (Display *,
-                                  Lisp_Object,
-                                  void *,
-                                  int,
-                                  int);
+extern void x_fill_property_data (struct x_display_info *, Lisp_Object,
+                                  void *, int, int);
 extern Lisp_Object x_property_data_to_lisp (struct frame *,
                                             const unsigned char *,
                                             Atom,
@@ -1818,10 +1859,10 @@ extern Lisp_Object x_timestamp_for_selection (struct x_display_info *,
                                               Lisp_Object);
 extern void x_own_selection (Lisp_Object, Lisp_Object, Lisp_Object,
                              Lisp_Object, Time);
-extern Atom x_intern_cached_atom (struct x_display_info *, const char *,
-                                  bool);
-extern char *x_get_atom_name (struct x_display_info *, Atom, bool *)
-  ATTRIBUTE_MALLOC ATTRIBUTE_DEALLOC_FREE;
+
+extern void mark_xselect (void);
+
+/* Misc definitions.  */
 
 #ifdef USE_GTK
 extern bool xg_set_icon (struct frame *, Lisp_Object);