Merge remote-tracking branch 'savannah/master' into HEAD

17 files changed, 383 insertions, 359 deletions

diff --git a/src/character.c b/src/character.c
index 4902e564b1d..5860f6a0c8c 100644
--- a/src/character.c
+++ b/src/character.c
@@ -495,9 +495,9 @@ parse_str_as_multibyte (const unsigned char *str, ptrdiff_t len,
 
 /* Arrange unibyte text at STR of NBYTES bytes as a multibyte text.
    It actually converts only such 8-bit characters that don't construct
-   a multibyte sequence to multibyte forms of Latin-1 characters.  If
-   NCHARS is nonzero, set *NCHARS to the number of characters in the
-   text.  It is assured that we can use LEN bytes at STR as a work
+   a multibyte sequence to multibyte forms of raw bytes.  If NCHARS
+   is nonzero, set *NCHARS to the number of characters in the text.
+   It is assured that we can use LEN bytes at STR as a work
    area and that is enough.  Return the number of bytes of the
    resulting text.  */
 
diff --git a/src/coding.c b/src/coding.c
index 51bd441de9d..221a9cad898 100644
--- a/src/coding.c
+++ b/src/coding.c
@@ -10895,7 +10895,10 @@ usage: (define-coding-system-internal ...)  */)
   ASET (attrs, coding_attr_base_name, name);
 
   Lisp_Object val = args[coding_arg_mnemonic];
-  if (! STRINGP (val))
+  /* decode_mode_spec_coding assumes the mnemonic is a single character.  */
+  if (STRINGP (val))
+    val = make_fixnum (STRING_CHAR (SDATA (val)));
+  else
     CHECK_CHARACTER (val);
   ASET (attrs, coding_attr_mnemonic, val);
 
@@ -11408,7 +11411,10 @@ DEFUN ("coding-system-put", Fcoding_system_put, Scoding_system_put,
   attrs = AREF (spec, 0);
   if (EQ (prop, QCmnemonic))
     {
-      if (! STRINGP (val))
+      /* decode_mode_spec_coding assumes the mnemonic is a single character.  */
+      if (STRINGP (val))
+        val = make_fixnum (STRING_CHAR (SDATA (val)));
+      else
         CHECK_CHARACTER (val);
       ASET (attrs, coding_attr_mnemonic, val);
     }
diff --git a/src/dispextern.h b/src/dispextern.h
index 311867a0c8c..956ca96eb61 100644
--- a/src/dispextern.h
+++ b/src/dispextern.h
@@ -3056,9 +3056,9 @@ struct image
      if necessary.  */
   unsigned long background;
 
-  /* Foreground and background colors of the frame on which the image
+  /* Foreground and background colors of the face on which the image
      is created.  */
-  unsigned long frame_foreground, frame_background;
+  unsigned long face_foreground, face_background;
 
   /* True if this image has a `transparent' background -- that is, is
      uses an image mask.  The accessor macro for this is
@@ -3475,7 +3475,7 @@ void clear_image_caches (Lisp_Object);
 void mark_image_cache (struct image_cache *);
 bool valid_image_p (Lisp_Object);
 void prepare_image_for_display (struct frame *, struct image *);
-ptrdiff_t lookup_image (struct frame *, Lisp_Object);
+ptrdiff_t lookup_image (struct frame *, Lisp_Object, int);
 
 #if defined HAVE_X_WINDOWS || defined USE_CAIRO || defined HAVE_NS
 #define RGB_PIXEL_COLOR unsigned long
diff --git a/src/editfns.c b/src/editfns.c
index 949f3825a3c..7e1e24ef16a 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -1877,9 +1877,6 @@ determines whether case is significant or ignored.  */)
 #undef EQUAL
 #define USE_HEURISTIC
 
-/* Counter used to rarely_quit in replace-buffer-contents.  */
-static unsigned short rbc_quitcounter;
-
 #define XVECREF_YVECREF_EQUAL(ctx, xoff, yoff)  \
   buffer_chars_equal ((ctx), (xoff), (yoff))
 
@@ -1900,10 +1897,11 @@ static unsigned short rbc_quitcounter;
   unsigned char *deletions;                     \
   unsigned char *insertions;                    \
   struct timespec time_limit;                   \
-  unsigned int early_abort_tests;
+  sys_jmp_buf jmp;                              \
+  unsigned short quitcounter;
 
-#define NOTE_DELETE(ctx, xoff) set_bit ((ctx)->deletions, (xoff))
-#define NOTE_INSERT(ctx, yoff) set_bit ((ctx)->insertions, (yoff))
+#define NOTE_DELETE(ctx, xoff) set_bit ((ctx)->deletions, xoff)
+#define NOTE_INSERT(ctx, yoff) set_bit ((ctx)->insertions, yoff)
 #define EARLY_ABORT(ctx) compareseq_early_abort (ctx)
 
 struct context;
@@ -1956,6 +1954,28 @@ nil.  */)
   if (a == b)
     error ("Cannot replace a buffer with itself");
 
+  ptrdiff_t too_expensive;
+  if (NILP (max_costs))
+    too_expensive = 1000000;
+  else if (FIXNUMP (max_costs))
+    too_expensive = clip_to_bounds (0, XFIXNUM (max_costs), PTRDIFF_MAX);
+  else
+    {
+      CHECK_INTEGER (max_costs);
+      too_expensive = NILP (Fnatnump (max_costs)) ? 0 : PTRDIFF_MAX;
+    }
+
+  struct timespec time_limit = make_timespec (0, -1);
+  if (!NILP (max_secs))
+    {
+      struct timespec
+        tlim = timespec_add (current_timespec (),
+                             lisp_time_argument (max_secs)),
+        tmax = make_timespec (TYPE_MAXIMUM (time_t), TIMESPEC_HZ - 1);
+      if (timespec_cmp (tlim, tmax) < 0)
+        time_limit = tlim;
+    }
+
   ptrdiff_t min_a = BEGV;
   ptrdiff_t min_b = BUF_BEGV (b);
   ptrdiff_t size_a = ZV - min_a;
@@ -1985,36 +2005,24 @@ nil.  */)
 
   ptrdiff_t count = SPECPDL_INDEX ();
 
-  /* FIXME: It is not documented how to initialize the contents of the
-     context structure.  This code cargo-cults from the existing
-     caller in src/analyze.c of GNU Diffutils, which appears to
-     work.  */
 
   ptrdiff_t diags = size_a + size_b + 3;
+  ptrdiff_t del_bytes = size_a / CHAR_BIT + 1;
+  ptrdiff_t ins_bytes = size_b / CHAR_BIT + 1;
   ptrdiff_t *buffer;
+  ptrdiff_t bytes_needed;
+  if (INT_MULTIPLY_WRAPV (diags, 2 * sizeof *buffer, &bytes_needed)
+      || INT_ADD_WRAPV (del_bytes + ins_bytes, bytes_needed, &bytes_needed))
+    memory_full (SIZE_MAX);
   USE_SAFE_ALLOCA;
-  SAFE_NALLOCA (buffer, 2, diags);
-
-  if (NILP (max_costs))
-    XSETFASTINT (max_costs, 1000000);
-  else
-    CHECK_FIXNUM (max_costs);
-
-  struct timespec time_limit = make_timespec (0, -1);
-  if (!NILP (max_secs))
-    {
-      struct timespec
-        tlim = timespec_add (current_timespec (),
-                             lisp_time_argument (max_secs)),
-        tmax = make_timespec (TYPE_MAXIMUM (time_t), TIMESPEC_HZ - 1);
-      if (timespec_cmp (tlim, tmax) < 0)
-        time_limit = tlim;
-    }
+  buffer = SAFE_ALLOCA (bytes_needed);
+  unsigned char *deletions_insertions = memset (buffer + 2 * diags, 0,
+                                                del_bytes + ins_bytes);
 
-  /* Micro-optimization: Casting to size_t generates much better
-     code.  */
-  ptrdiff_t del_bytes = (size_t) size_a / CHAR_BIT + 1;
-  ptrdiff_t ins_bytes = (size_t) size_b / CHAR_BIT + 1;
+  /* FIXME: It is not documented how to initialize the contents of the
+     context structure.  This code cargo-cults from the existing
+     caller in src/analyze.c of GNU Diffutils, which appears to
+     work.  */
   struct context ctx = {
     .buffer_a = a,
     .buffer_b = b,
@@ -2022,21 +2030,22 @@ nil.  */)
     .beg_b = min_b,
     .a_unibyte = BUF_ZV (a) == BUF_ZV_BYTE (a),
     .b_unibyte = BUF_ZV (b) == BUF_ZV_BYTE (b),
-    .deletions = SAFE_ALLOCA (del_bytes),
-    .insertions = SAFE_ALLOCA (ins_bytes),
+    .deletions = deletions_insertions,
+    .insertions = deletions_insertions + del_bytes,
     .fdiag = buffer + size_b + 1,
     .bdiag = buffer + diags + size_b + 1,
     .heuristic = true,
-    .too_expensive = XFIXNUM (max_costs),
+    .too_expensive = too_expensive,
     .time_limit = time_limit,
-    .early_abort_tests = 0
   };
-  memclear (ctx.deletions, del_bytes);
-  memclear (ctx.insertions, ins_bytes);
 
   /* compareseq requires indices to be zero-based.  We add BEGV back
      later.  */
-  bool early_abort = compareseq (0, size_a, 0, size_b, false, &ctx);
+  bool early_abort;
+  if (! sys_setjmp (ctx.jmp))
+    early_abort = compareseq (0, size_a, 0, size_b, false, &ctx);
+  else
+    early_abort = true;
 
   if (early_abort)
     {
@@ -2046,8 +2055,6 @@ nil.  */)
       return Qnil;
     }
 
-  rbc_quitcounter = 0;
-
   Fundo_boundary ();
   bool modification_hooks_inhibited = false;
   record_unwind_protect_excursion ();
@@ -2071,13 +2078,12 @@ nil.  */)
      walk backwards, we don’t have to keep the positions in sync.  */
   while (i >= 0 || j >= 0)
     {
-      /* Allow the user to quit if this gets too slow.  */
-      rarely_quit (++rbc_quitcounter);
+      rarely_quit (++ctx.quitcounter);
 
       /* Check whether there is a change (insertion or deletion)
          before the current position.  */
-      if ((i > 0 && bit_is_set (ctx.deletions, i - 1)) ||
-          (j > 0 && bit_is_set (ctx.insertions, j - 1)))
+      if ((i > 0 && bit_is_set (ctx.deletions, i - 1))
+          || (j > 0 && bit_is_set (ctx.insertions, j - 1)))
         {
           ptrdiff_t end_a = min_a + i;
           ptrdiff_t end_b = min_b + j;
@@ -2087,8 +2093,6 @@ nil.  */)
           while (j > 0 && bit_is_set (ctx.insertions, j - 1))
             --j;
 
-          rarely_quit (rbc_quitcounter++);
-
           ptrdiff_t beg_a = min_a + i;
           ptrdiff_t beg_b = min_b + j;
           eassert (beg_a <= end_a);
@@ -2108,7 +2112,6 @@ nil.  */)
     }
 
   SAFE_FREE_UNBIND_TO (count, Qnil);
-  rbc_quitcounter = 0;
 
   if (modification_hooks_inhibited)
     {
@@ -2122,21 +2125,15 @@ nil.  */)
 static void
 set_bit (unsigned char *a, ptrdiff_t i)
 {
-  eassert (i >= 0);
-  /* Micro-optimization: Casting to size_t generates much better
-     code.  */
-  size_t j = i;
-  a[j / CHAR_BIT] |= (1 << (j % CHAR_BIT));
+  eassume (0 <= i);
+  a[i / CHAR_BIT] |= (1 << (i % CHAR_BIT));
 }
 
 static bool
 bit_is_set (const unsigned char *a, ptrdiff_t i)
 {
-  eassert (i >= 0);
-  /* Micro-optimization: Casting to size_t generates much better
-     code.  */
-  size_t j = i;
-  return a[j / CHAR_BIT] & (1 << (j % CHAR_BIT));
+  eassume (0 <= i);
+  return a[i / CHAR_BIT] & (1 << (i % CHAR_BIT));
 }
 
 /* Return true if the characters at position POS_A of buffer
@@ -2155,12 +2152,16 @@ static bool
 buffer_chars_equal (struct context *ctx,
                     ptrdiff_t pos_a, ptrdiff_t pos_b)
 {
+  if (!++ctx->quitcounter)
+    {
+      maybe_quit ();
+      if (compareseq_early_abort (ctx))
+        sys_longjmp (ctx->jmp, 1);
+    }
+
   pos_a += ctx->beg_a;
   pos_b += ctx->beg_b;
 
-  /* Allow the user to escape out of a slow compareseq call.  */
-  rarely_quit (++rbc_quitcounter);
-
   ptrdiff_t bpos_a =
     ctx->a_unibyte ? pos_a : buf_charpos_to_bytepos (ctx->buffer_a, pos_a);
   ptrdiff_t bpos_b =
diff --git a/src/fileio.c b/src/fileio.c
index 37072d9b6bd..c91af36fdf6 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -827,9 +827,9 @@ the root directory.  */)
   ptrdiff_t tlen;
 #ifdef DOS_NT
   int drive = 0;
-  bool collapse_newdir = true;
   bool is_escaped = 0;
 #endif /* DOS_NT */
+  bool collapse_newdir = true;
   ptrdiff_t length, nbytes;
   Lisp_Object handler, result, handled_name;
   bool multibyte;
@@ -1065,7 +1065,7 @@ the root directory.  */)
 #endif /* WINDOWSNT */
 #endif /* DOS_NT */
 
-  /* If nm is absolute, look for `/./' or `/../' or `//''sequences; if
+  /* If nm is absolute, look for "/./" or "/../" or "//" sequences; if
      none are found, we can probably return right away.  We will avoid
      allocating a new string if name is already fully expanded.  */
   if (
@@ -1183,9 +1183,7 @@ the root directory.  */)
               newdir = SSDATA (hdir);
               newdirlim = newdir + SBYTES (hdir);
             }
-#ifdef DOS_NT
           collapse_newdir = false;
-#endif
         }
       else                      /* ~user/filename */
         {
@@ -1205,9 +1203,7 @@ the root directory.  */)
 
               while (*++nm && !IS_DIRECTORY_SEP (*nm))
                 continue;
-#ifdef DOS_NT
               collapse_newdir = false;
-#endif
             }
 
           /* If we don't find a user of that name, leave the name
@@ -1374,12 +1370,15 @@ the root directory.  */)
     }
 #endif /* DOS_NT */
 
+  length = newdirlim - newdir;
+
+#ifdef DOS_NT
   /* Ignore any slash at the end of newdir, unless newdir is
      just "/" or "//".  */
-  length = newdirlim - newdir;
   while (length > 1 && IS_DIRECTORY_SEP (newdir[length - 1])
          && ! (length == 2 && IS_DIRECTORY_SEP (newdir[0])))
     length--;
+#endif
 
   /* Now concatenate the directory and name to new space in the stack frame.  */
   tlen = length + file_name_as_directory_slop + (nmlim - nm) + 1;
@@ -1393,12 +1392,16 @@ the root directory.  */)
 #else  /* not DOS_NT */
   target = SAFE_ALLOCA (tlen);
 #endif /* not DOS_NT */
-  *target = 0;
   nbytes = 0;
 
   if (newdir)
     {
-      if (nm[0] == 0 || IS_DIRECTORY_SEP (nm[0]))
+#ifndef DOS_NT
+      bool treat_as_absolute = !collapse_newdir;
+#else
+      bool treat_as_absolute = !nm[0] || IS_DIRECTORY_SEP (nm[0]);
+#endif
+      if (treat_as_absolute)
         {
 #ifdef DOS_NT
           /* If newdir is effectively "C:/", then the drive letter will have
@@ -1410,13 +1413,23 @@ the root directory.  */)
                 && newdir[1] == '\0'))
 #endif
             {
+              /* With ~ or ~user, leave NEWDIR as-is to avoid transforming
+                 it from a symlink (or a regular file!) into a directory.  */
               memcpy (target, newdir, length);
-              target[length] = 0;
               nbytes = length;
             }
         }
       else
         nbytes = file_name_as_directory (target, newdir, length, multibyte);
+
+#ifndef DOS_NT
+      /* If TARGET ends in a directory separator, omit leading
+         directory separators from NM so that concatenating a TARGET "/"
+         to an NM "/foo" does not result in the incorrect "//foo".  */
+      if (nbytes && IS_DIRECTORY_SEP (target[nbytes - 1]))
+        while (IS_DIRECTORY_SEP (nm[0]))
+          nm++;
+#endif
     }
 
   memcpy (target + nbytes, nm, nmlim - nm + 1);
@@ -1433,6 +1446,20 @@ the root directory.  */)
           {
             *o++ = *p++;
           }
+#ifndef DOS_NT
+        else if (p[1] == '.' && IS_DIRECTORY_SEP (p[2]))
+          {
+            /* Replace "/./" with "/".  */
+            p += 2;
+          }
+        else if (p[1] == '.' && !p[2])
+          {
+            /* At the end of the file name, replace "/." with "/".
+               The trailing "/" is for symlinks.  */
+            *o++ = *p;
+            p += 2;
+          }
+#else
         else if (p[1] == '.'
                  && (IS_DIRECTORY_SEP (p[2])
                      || p[2] == 0))
@@ -1443,6 +1470,7 @@ the root directory.  */)
               *o++ = *p;
             p += 2;
           }
+#endif
         else if (p[1] == '.' && p[2] == '.'
                  /* `/../' is the "superroot" on certain file systems.
                     Turned off on DOS_NT systems because they have no
@@ -1456,21 +1484,35 @@ the root directory.  */)
 #endif
                  && (IS_DIRECTORY_SEP (p[3]) || p[3] == 0))
           {
-#ifdef WINDOWSNT
+#ifndef DOS_NT
+            while (o != target)
+              {
+                o--;
+                if (IS_DIRECTORY_SEP (*o))
+                  {
+                    /* Keep "/" at the end of the name, for symlinks.  */
+                    o += p[3] == 0;
+
+                    break;
+                  }
+              }
+#else
+# ifdef WINDOWSNT
             char *prev_o = o;
-#endif
+# endif
             while (o != target && (--o, !IS_DIRECTORY_SEP (*o)))
               continue;
-#ifdef WINDOWSNT
+# ifdef WINDOWSNT
             /* Don't go below server level in UNC filenames.  */
             if (o == target + 1 && IS_DIRECTORY_SEP (*o)
                 && IS_DIRECTORY_SEP (*target))
               o = prev_o;
             else
-#endif
+# endif
             /* Keep initial / only if this is the whole name.  */
             if (o == target && IS_ANY_SEP (*o) && p[3] == 0)
               ++o;
+#endif
             p += 3;
           }
         else if (IS_DIRECTORY_SEP (p[1])
diff --git a/src/font.c b/src/font.c
index 5c01c7ff796..2786a772dc3 100644
--- a/src/font.c
+++ b/src/font.c
@@ -5521,11 +5521,11 @@ footprint in sessions that use lots of different fonts.  */);
 #endif
 
   DEFVAR_BOOL ("xft-ignore-color-fonts",
-               Vxft_ignore_color_fonts,
+               xft_ignore_color_fonts,
                doc: /*
 Non-nil means don't query fontconfig for color fonts, since they often
 cause Xft crashes.  Only has an effect in Xft builds.  */);
-  Vxft_ignore_color_fonts = 1;
+  xft_ignore_color_fonts = true;
 
 #ifdef HAVE_WINDOW_SYSTEM
 #ifdef HAVE_FREETYPE
diff --git a/src/ftfont.c b/src/ftfont.c
index a904007a329..6fca9c85093 100644
--- a/src/ftfont.c
+++ b/src/ftfont.c
@@ -768,7 +768,7 @@ ftfont_spec_pattern (Lisp_Object spec, char *otlayout, struct OpenTypeSpec **ots
 #if defined HAVE_XFT && defined FC_COLOR
   /* We really don't like color fonts, they cause Xft crashes.  See
      Bug#30874.  */
-  if (Vxft_ignore_color_fonts
+  if (xft_ignore_color_fonts
       && ! FcPatternAddBool (pattern, FC_COLOR, FcFalse))
     goto err;
 #endif
@@ -911,7 +911,7 @@ ftfont_list (struct frame *f, Lisp_Object spec)
            returns them even when it shouldn't really do so, so we
            need to manually skip them here (Bug#37786).  */
         FcBool b;
-        if (Vxft_ignore_color_fonts
+        if (xft_ignore_color_fonts
             && FcPatternGetBool (fontset->fonts[i], FC_COLOR, 0, &b)
             == FcResultMatch && b != FcFalse)
             continue;
diff --git a/src/gnutls.c b/src/gnutls.c
index 416fb154701..0010553a9d4 100644
--- a/src/gnutls.c
+++ b/src/gnutls.c
@@ -2298,6 +2298,8 @@ gnutls_symmetric_aead (bool encrypting, gnutls_cipher_algorithm_t gca,
 # endif
 }
 
+static Lisp_Object cipher_cache;
+
 static Lisp_Object
 gnutls_symmetric (bool encrypting, Lisp_Object cipher,
                   Lisp_Object key, Lisp_Object iv,
@@ -2329,7 +2331,9 @@ gnutls_symmetric (bool encrypting, Lisp_Object cipher,
 
   if (SYMBOLP (cipher))
     {
-      info = Fassq (cipher, Fgnutls_ciphers ());
+      if (NILP (cipher_cache))
+        cipher_cache = Fgnutls_ciphers ();
+      info = Fassq (cipher, cipher_cache);
       if (!CONSP (info))
         xsignal2 (Qerror,
                   build_string ("GnuTLS cipher is invalid or not found"),
@@ -2914,6 +2918,9 @@ level in the ones.  For builds without libgnutls, the value is -1.  */);
   defsubr (&Sgnutls_hash_digest);
   defsubr (&Sgnutls_symmetric_encrypt);
   defsubr (&Sgnutls_symmetric_decrypt);
+
+  cipher_cache = Qnil;
+  staticpro (&cipher_cache);
 #endif
 
   DEFVAR_INT ("gnutls-log-level", global_gnutls_log_level,
diff --git a/src/gtkutil.c b/src/gtkutil.c
index 1fe160acca9..fafd94c0f71 100644
--- a/src/gtkutil.c
+++ b/src/gtkutil.c
@@ -5113,7 +5113,7 @@ update_frame_tool_bar (struct frame *f)
           else
             idx = -1;
 
-          img_id = lookup_image (f, image);
+          img_id = lookup_image (f, image, -1);
           img = IMAGE_FROM_ID (f, img_id);
           prepare_image_for_display (f, img);
 
diff --git a/src/image.c b/src/image.c
index 123de54ba27..35c5946c72f 100644
--- a/src/image.c
+++ b/src/image.c
@@ -758,10 +758,10 @@ struct image_type
 
   /* Load IMG which is used on frame F from information contained in
      IMG->spec.  Value is true if successful.  */
-  bool (*load) (struct frame *f, struct image *img);
+  bool (*load_img) (struct frame *f, struct image *img);
 
   /* Free resources of image IMG which is used on frame F.  */
-  void (*free) (struct frame *f, struct image *img);
+  void (*free_img) (struct frame *f, struct image *img);
 
 #ifdef WINDOWSNT
   /* Initialization function (used for dynamic loading of image
@@ -1081,7 +1081,7 @@ calling this function.  */)
   if (valid_image_p (spec))
     {
       struct frame *f = decode_window_system_frame (frame);
-      ptrdiff_t id = lookup_image (f, spec);
+      ptrdiff_t id = lookup_image (f, spec, -1);
       struct image *img = IMAGE_FROM_ID (f, id);
       int width = img->width + 2 * img->hmargin;
       int height = img->height + 2 * img->vmargin;
@@ -1111,7 +1111,7 @@ or omitted means use the selected frame.  */)
   if (valid_image_p (spec))
     {
       struct frame *f = decode_window_system_frame (frame);
-      ptrdiff_t id = lookup_image (f, spec);
+      ptrdiff_t id = lookup_image (f, spec, -1);
       struct image *img = IMAGE_FROM_ID (f, id);
       if (img->mask)
         mask = Qt;
@@ -1134,7 +1134,7 @@ or omitted means use the selected frame.  */)
   if (valid_image_p (spec))
     {
       struct frame *f = decode_window_system_frame (frame);
-      ptrdiff_t id = lookup_image (f, spec);
+      ptrdiff_t id = lookup_image (f, spec, -1);
       struct image *img = IMAGE_FROM_ID (f, id);
       ext = img->lisp_data;
     }
@@ -1197,13 +1197,8 @@ free_image (struct frame *f, struct image *img)
         XRenderFreePicture (FRAME_X_DISPLAY (f), img->mask_picture);
 #endif
 
-      /* Windows NT redefines 'free', but in this file, we need to
-         avoid the redefinition.  */
-#ifdef WINDOWSNT
-#undef free
-#endif
       /* Free resources, then free IMG.  */
-      img->type->free (f, img);
+      img->type->free_img (f, img);
       xfree (img);
     }
 }
@@ -1249,7 +1244,7 @@ prepare_image_for_display (struct frame *f, struct image *img)
   /* If IMG doesn't have a pixmap yet, load it now, using the image
      type dependent loader function.  */
   if (img->pixmap == NO_PIXMAP && !img->load_failed_p)
-    img->load_failed_p = ! img->type->load (f, img);
+    img->load_failed_p = ! img->type->load_img (f, img);
 
 #ifdef USE_CAIRO
   if (!img->load_failed_p)
@@ -1266,7 +1261,7 @@ prepare_image_for_display (struct frame *f, struct image *img)
           if (img->cr_data == NULL)
             {
               img->load_failed_p = 1;
-              img->type->free (f, img);
+              img->type->free_img (f, img);
             }
         }
       unblock_input ();
@@ -1611,7 +1606,9 @@ equal_lists (Lisp_Object a, Lisp_Object b)
 /* Find an image matching SPEC in the cache, and return it.  If no
    image is found, return NULL.  */
 static struct image *
-search_image_cache (struct frame *f, Lisp_Object spec, EMACS_UINT hash)
+search_image_cache (struct frame *f, Lisp_Object spec, EMACS_UINT hash,
+                    unsigned long foreground, unsigned long background,
+                    bool ignore_colors)
 {
   struct image *img;
   struct image_cache *c = FRAME_IMAGE_CACHE (f);
@@ -1634,8 +1631,8 @@ search_image_cache (struct frame *f, Lisp_Object spec, EMACS_UINT hash)
   for (img = c->buckets[i]; img; img = img->next)
     if (img->hash == hash
         && equal_lists (img->spec, spec)
-        && img->frame_foreground == FRAME_FOREGROUND_PIXEL (f)
-        && img->frame_background == FRAME_BACKGROUND_PIXEL (f))
+        && (ignore_colors || (img->face_foreground == foreground
+                              && img->face_background == background)))
       break;
   return img;
 }
@@ -1646,8 +1643,13 @@ search_image_cache (struct frame *f, Lisp_Object spec, EMACS_UINT hash)
 static void
 uncache_image (struct frame *f, Lisp_Object spec)
 {
-  struct image *img = search_image_cache (f, spec, sxhash (spec));
-  if (img)
+  struct image *img;
+
+  /* Because the background colors are based on the current face, we
+     can have multiple copies of an image with the same spec. We want
+     to remove them all to ensure the user doesn't see an old version
+     of the image when the face changes.  */
+  while ((img = search_image_cache (f, spec, sxhash (spec), 0, 0, true)))
     {
       free_image (f, img);
       /* As display glyphs may still be referring to the image ID, we
@@ -2133,7 +2135,17 @@ image_set_transform (struct frame *f, struct image *img)
 
   /* Determine size.  */
   int width, height;
-  compute_image_size (img->width, img->height, img->spec, &width, &height);
+
+#ifdef HAVE_RSVG
+  /* SVGs are pre-scaled to the correct size.  */
+  if (EQ (image_spec_value (img->spec, QCtype, NULL), Qsvg))
+    {
+      width = img->width;
+      height = img->height;
+    }
+  else
+#endif
+    compute_image_size (img->width, img->height, img->spec, &width, &height);
 
   /* Determine rotation.  */
   double rotation = 0.0;
@@ -2312,11 +2324,16 @@ image_set_transform (struct frame *f, struct image *img)
    SPEC must be a valid Lisp image specification (see valid_image_p).  */
 
 ptrdiff_t
-lookup_image (struct frame *f, Lisp_Object spec)
+lookup_image (struct frame *f, Lisp_Object spec, int face_id)
 {
   struct image *img;
   EMACS_UINT hash;
 
+  struct face *face = (face_id >= 0) ? FACE_FROM_ID (f, face_id)
+    : FACE_FROM_ID (f, DEFAULT_FACE_ID);
+  unsigned long foreground = FACE_COLOR_TO_PIXEL (face->foreground, f);
+  unsigned long background = FACE_COLOR_TO_PIXEL (face->background, f);
+
   /* F must be a window-system frame, and SPEC must be a valid image
      specification.  */
   eassert (FRAME_WINDOW_P (f));
@@ -2324,7 +2341,7 @@ lookup_image (struct frame *f, Lisp_Object spec)
 
   /* Look up SPEC in the hash table of the image cache.  */
   hash = sxhash (spec);
-  img = search_image_cache (f, spec, hash);
+  img = search_image_cache (f, spec, hash, foreground, background, true);
   if (img && img->load_failed_p)
     {
       free_image (f, img);
@@ -2337,9 +2354,9 @@ lookup_image (struct frame *f, Lisp_Object spec)
       block_input ();
       img = make_image (spec, hash);
       cache_image (f, img);
-      img->load_failed_p = ! img->type->load (f, img);
-      img->frame_foreground = FRAME_FOREGROUND_PIXEL (f);
-      img->frame_background = FRAME_BACKGROUND_PIXEL (f);
+      img->face_foreground = foreground;
+      img->face_background = background;
+      img->load_failed_p = ! img->type->load_img (f, img);
 
       /* If we can't load the image, and we don't have a width and
          height, use some arbitrary width and height so that we can
@@ -2393,8 +2410,7 @@ lookup_image (struct frame *f, Lisp_Object spec)
               if (!NILP (bg))
                 {
                   img->background
-                    = image_alloc_image_color (f, img, bg,
-                                               FRAME_BACKGROUND_PIXEL (f));
+                    = image_alloc_image_color (f, img, bg, background);
                   img->background_valid = 1;
                 }
             }
@@ -3667,8 +3683,8 @@ xbm_load_image (struct frame *f, struct image *img, char *contents, char *end)
                              &data, 0);
   if (rc)
     {
-      unsigned long foreground = FRAME_FOREGROUND_PIXEL (f);
-      unsigned long background = FRAME_BACKGROUND_PIXEL (f);
+      unsigned long foreground = img->face_foreground;
+      unsigned long background = img->face_background;
       bool non_default_colors = 0;
       Lisp_Object value;
 
@@ -3764,8 +3780,8 @@ xbm_load (struct frame *f, struct image *img)
     {
       struct image_keyword fmt[XBM_LAST];
       Lisp_Object data;
-      unsigned long foreground = FRAME_FOREGROUND_PIXEL (f);
-      unsigned long background = FRAME_BACKGROUND_PIXEL (f);
+      unsigned long foreground = img->face_foreground;
+      unsigned long background = img->face_background;
       bool non_default_colors = 0;
       char *bits;
       bool parsed_p;
@@ -6125,8 +6141,8 @@ pbm_load (struct frame *f, struct image *img)
       unsigned char c = 0;
       int g;
       struct image_keyword fmt[PBM_LAST];
-      unsigned long fg = FRAME_FOREGROUND_PIXEL (f);
-      unsigned long bg = FRAME_BACKGROUND_PIXEL (f);
+      unsigned long fg = img->face_foreground;
+      unsigned long bg = img->face_background;
       /* Parse the image specification.  */
       memcpy (fmt, pbm_format, sizeof fmt);
       parse_image_spec (img->spec, fmt, PBM_LAST, Qpbm);
@@ -9433,6 +9449,7 @@ enum svg_keyword_index
   SVG_ALGORITHM,
   SVG_HEURISTIC_MASK,
   SVG_MASK,
+  SVG_FOREGROUND,
   SVG_BACKGROUND,
   SVG_LAST
 };
@@ -9451,6 +9468,7 @@ static const struct image_keyword svg_format[SVG_LAST] =
   {":conversion",       IMAGE_DONT_CHECK_VALUE_TYPE,            0},
   {":heuristic-mask",   IMAGE_DONT_CHECK_VALUE_TYPE,            0},
   {":mask",             IMAGE_DONT_CHECK_VALUE_TYPE,            0},
+  {":foreground",       IMAGE_STRING_OR_NIL_VALUE,              0},
   {":background",       IMAGE_STRING_OR_NIL_VALUE,              0}
 };
 
@@ -9715,6 +9733,8 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
   int height;
   const guint8 *pixels;
   int rowstride;
+  char *wrapped_contents = NULL;
+  ptrdiff_t wrapped_size;
 
 #if ! GLIB_CHECK_VERSION (2, 36, 0)
   /* g_type_init is a glib function that must be called prior to
@@ -9722,6 +9742,8 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
   g_type_init ();
 #endif
 
+  /* Parse the unmodified SVG data so we can get its initial size.  */
+
 #if LIBRSVG_CHECK_VERSION (2, 32, 0)
   GInputStream *input_stream
     = g_memory_input_stream_new_from_data (contents, size, NULL);
@@ -9750,6 +9772,105 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
   rsvg_handle_write (rsvg_handle, (unsigned char *) contents, size, &err);
   if (err) goto rsvg_error;
 
+  /* The parsing is complete, rsvg_handle is ready to be used, close
+     it for further writes.  */
+  rsvg_handle_close (rsvg_handle, &err);
+  if (err) goto rsvg_error;
+#endif
+
+  /* Get the image dimensions.  */
+  rsvg_handle_get_dimensions (rsvg_handle, &dimension_data);
+
+  /* We are now done with the unmodified data.  */
+  g_object_unref (rsvg_handle);
+
+  /* Calculate the final image size.  */
+  compute_image_size (dimension_data.width, dimension_data.height,
+                      img->spec, &width, &height);
+
+  /* Wrap the SVG data in another SVG.  This allows us to set the
+     width and height, as well as modify the foreground and background
+     colors.  */
+  {
+    Lisp_Object value;
+    unsigned long foreground = img->face_foreground;
+    unsigned long background = img->face_background;
+
+    Lisp_Object encoded_contents
+      = Fbase64_encode_string (make_unibyte_string (contents, size), Qt);
+
+    /* The wrapper sets the foreground color, width and height, and
+       viewBox must contain the dimensions of the original image.  It
+       also draws a rectangle over the whole space, set to the
+       background color, before including the original image.  This
+       acts to set the background color, instead of leaving it
+       transparent.  */
+    const char *wrapper =
+      "<svg xmlns:xlink=\"http://www.w3.org/1999/xlink\" "
+      "xmlns:xi=\"http://www.w3.org/2001/XInclude\" "
+      "style=\"color: #%06X; fill: currentColor;\" "
+      "width=\"%d\" height=\"%d\" preserveAspectRatio=\"none\" "
+      "viewBox=\"0 0 %d %d\">"
+      "<rect width=\"100%%\" height=\"100%%\" fill=\"#%06X\"/>"
+      "<xi:include href=\"data:image/svg+xml;base64,%s\"></xi:include>"
+      "</svg>";
+
+    /* FIXME: I've added 64 in the hope it will cover the size of the
+       width and height strings and things.  */
+    int buffer_size = SBYTES (encoded_contents) + strlen (wrapper) + 64;
+
+    value = image_spec_value (img->spec, QCforeground, NULL);
+    if (!NILP (value))
+      foreground = image_alloc_image_color (f, img, value, img->face_foreground);
+    value = image_spec_value (img->spec, QCbackground, NULL);
+    if (!NILP (value))
+      {
+        background = image_alloc_image_color (f, img, value, img->face_background);
+        img->background = background;
+        img->background_valid = 1;
+      }
+
+    wrapped_contents = malloc (buffer_size);
+
+    if (!wrapped_contents
+        || buffer_size <= snprintf (wrapped_contents, buffer_size, wrapper,
+                                    foreground & 0xFFFFFF, width, height,
+                                    dimension_data.width, dimension_data.height,
+                                    background & 0xFFFFFF, SSDATA (encoded_contents)))
+      goto rsvg_error;
+
+    wrapped_size = strlen (wrapped_contents);
+  }
+
+  /* Now we parse the wrapped version.  */
+
+#if LIBRSVG_CHECK_VERSION (2, 32, 0)
+  input_stream = g_memory_input_stream_new_from_data (wrapped_contents, wrapped_size, NULL);
+  base_file = filename ? g_file_new_for_path (filename) : NULL;
+  rsvg_handle = rsvg_handle_new_from_stream_sync (input_stream, base_file,
+                                                  RSVG_HANDLE_FLAGS_NONE,
+                                                  NULL, &err);
+  if (base_file)
+    g_object_unref (base_file);
+  g_object_unref (input_stream);
+
+  /* Check rsvg_handle too, to avoid librsvg 2.40.13 bug (Bug#36773#26).  */
+  if (!rsvg_handle || err) goto rsvg_error;
+#else
+  /* Make a handle to a new rsvg object.  */
+  rsvg_handle = rsvg_handle_new ();
+  eassume (rsvg_handle);
+
+  /* Set base_uri for properly handling referenced images (via 'href').
+     See rsvg bug 596114 - "image refs are relative to curdir, not .svg file"
+     <https://gitlab.gnome.org/GNOME/librsvg/issues/33>. */
+  if (filename)
+    rsvg_handle_set_base_uri (rsvg_handle, filename);
+
+  /* Parse the contents argument and fill in the rsvg_handle.  */
+  rsvg_handle_write (rsvg_handle, (unsigned char *) wrapped_contents, wrapped_size, &err);
+  if (err) goto rsvg_error;
+
   /* The parsing is complete, rsvg_handle is ready to used, close it
      for further writes.  */
   rsvg_handle_close (rsvg_handle, &err);
@@ -9768,6 +9889,7 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
   pixbuf = rsvg_handle_get_pixbuf (rsvg_handle);
   if (!pixbuf) goto rsvg_error;
   g_object_unref (rsvg_handle);
+  free (wrapped_contents);
 
   /* Extract some meta data from the svg handle.  */
   width     = gdk_pixbuf_get_width (pixbuf);
@@ -9792,25 +9914,6 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
 
     init_color_table ();
 
-    /* Handle alpha channel by combining the image with a background
-       color.  */
-    Emacs_Color background;
-    Lisp_Object specified_bg = image_spec_value (img->spec, QCbackground, NULL);
-    if (!STRINGP (specified_bg)
-        || !FRAME_TERMINAL (f)->defined_color_hook (f,
-                                                    SSDATA (specified_bg),
-                                                    &background,
-                                                    false,
-                                                    false))
-      FRAME_TERMINAL (f)->query_frame_background_color (f, &background);
-
-    /* SVG pixmaps specify transparency in the last byte, so right
-       shift 8 bits to get rid of it, since emacs doesn't support
-       transparency.  */
-    background.red   >>= 8;
-    background.green >>= 8;
-    background.blue  >>= 8;
-
     /* This loop handles opacity values, since Emacs assumes
        non-transparent images.  Each pixel must be "flattened" by
        calculating the resulting color, given the transparency of the
@@ -9822,16 +9925,11 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
             int red     = *pixels++;
             int green   = *pixels++;
             int blue    = *pixels++;
-            int opacity = *pixels++;
 
-            red   = ((red * opacity)
-                     + (background.red * ((1 << 8) - opacity)));
-            green = ((green * opacity)
-                     + (background.green * ((1 << 8) - opacity)));
-            blue  = ((blue * opacity)
-                     + (background.blue * ((1 << 8) - opacity)));
+            /* Skip opacity.  */
+            pixels++;
 
-            PUT_PIXEL (ximg, x, y, lookup_rgb_color (f, red, green, blue));
+            PUT_PIXEL (ximg, x, y, lookup_rgb_color (f, red << 8, green << 8, blue << 8));
           }
 
         pixels += rowstride - 4 * width;
@@ -9861,6 +9959,8 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
  rsvg_error:
   if (rsvg_handle)
     g_object_unref (rsvg_handle);
+  if (wrapped_contents)
+    free (wrapped_contents);
   /* FIXME: Use error->message so the user knows what is the actual
      problem with the image.  */
   image_error ("Error parsing SVG image `%s'", img->spec);
@@ -10159,7 +10259,7 @@ DEFUN ("lookup-image", Flookup_image, Slookup_image, 1, 1, 0,
   ptrdiff_t id = -1;
 
   if (valid_image_p (spec))
-    id = lookup_image (SELECTED_FRAME (), spec);
+    id = lookup_image (SELECTED_FRAME (), spec, -1);
 
   debug_print (spec);
   return make_fixnum (id);
diff --git a/src/keymap.c b/src/keymap.c
index d98b27b7a1b..0608bdddeea 100644
--- a/src/keymap.c
+++ b/src/keymap.c
@@ -3277,7 +3277,7 @@ describe_map (Lisp_Object map, Lisp_Object prefix,
           ptrdiff_t pt = max (PT - 1, BEG);
 
           SET_PT (pt);
-          insert_string ("\n  (that binding is currently shadowed by another mode)");
+          insert_string ("\n  (this binding is currently shadowed)");
           pt = min (PT + 1, Z);
           SET_PT (pt);
         }
diff --git a/src/nsmenu.m b/src/nsmenu.m
index b7e4cbd5654..e313fc03f40 100644
--- a/src/nsmenu.m
+++ b/src/nsmenu.m
@@ -1092,7 +1092,7 @@ update_frame_tool_bar (struct frame *f)
           continue;
         }
 
-      img_id = lookup_image (f, image);
+      img_id = lookup_image (f, image, -1);
       img = IMAGE_FROM_ID (f, img_id);
       prepare_image_for_display (f, img);
 
diff --git a/src/regex-emacs.c b/src/regex-emacs.c
index c44cce9f787..971a5f63749 100644
--- a/src/regex-emacs.c
+++ b/src/regex-emacs.c
@@ -929,7 +929,7 @@ typedef struct
    ? 0                                                                  \
    : ((fail_stack).stack                                                \
       = REGEX_REALLOCATE ((fail_stack).stack,                           \
-          (fail_stack).size * sizeof (fail_stack_elt_t),                \
+          (fail_stack).avail * sizeof (fail_stack_elt_t),               \
           min (emacs_re_max_failures * TYPICAL_FAILURE_SIZE,                  \
                ((fail_stack).size * FAIL_STACK_GROWTH_FACTOR))          \
           * sizeof (fail_stack_elt_t)),                                 \
@@ -969,7 +969,11 @@ typedef struct
 #define ENSURE_FAIL_STACK(space)                                        \
 while (REMAINING_AVAIL_SLOTS <= space) {                                \
   if (!GROW_FAIL_STACK (fail_stack))                                    \
-    return -2;                                                          \
+    {                                                                   \
+      unbind_to (count, Qnil);                                          \
+      SAFE_FREE ();                                                     \
+      return -2;                                                        \
+    }                                                                   \
   DEBUG_PRINT ("\n  Doubled stack; size now: %td\n", fail_stack.size);  \
   DEBUG_PRINT ("         slots available: %td\n", REMAINING_AVAIL_SLOTS);\
 }
@@ -979,6 +983,8 @@ while (REMAINING_AVAIL_SLOTS <= space) {				\
 do {                                                                    \
   char *destination;                                                    \
   intptr_t n = num;                                                     \
+  eassert (0 < n && n < num_regs);                                      \
+  eassert (REG_UNSET (regstart[n]) <= REG_UNSET (regend[n]));           \
   ENSURE_FAIL_STACK(3);                                                 \
   DEBUG_PRINT ("    Push reg %"PRIdPTR" (spanning %p -> %p)\n",         \
                n, regstart[n], regend[n]);                              \
@@ -1017,8 +1023,10 @@ do {									\
     }                                                                   \
   else                                                                  \
     {                                                                   \
+      eassert (0 < pfreg && pfreg < num_regs);                          \
       regend[pfreg] = POP_FAILURE_POINTER ();                           \
       regstart[pfreg] = POP_FAILURE_POINTER ();                         \
+      eassert (REG_UNSET (regstart[pfreg]) <= REG_UNSET (regend[pfreg])); \
       DEBUG_PRINT ("     Pop reg %ld (spanning %p -> %p)\n",            \
                    pfreg, regstart[pfreg], regend[pfreg]);              \
     }                                                                   \
@@ -3864,6 +3872,10 @@ re_match_2_internal (struct re_pattern_buffer *bufp,
                      re_char *string2, ptrdiff_t size2,
                      ptrdiff_t pos, struct re_registers *regs, ptrdiff_t stop)
 {
+  eassume (0 <= size1);
+  eassume (0 <= size2);
+  eassume (0 <= pos && pos <= stop && stop <= size1 + size2);
+
   /* General temporaries.  */
   int mcnt;
 
@@ -3919,8 +3931,7 @@ re_match_2_internal (struct re_pattern_buffer *bufp,
      attempt) by a subexpression part of the pattern, that is, the
      regnum-th regstart pointer points to where in the pattern we began
      matching and the regnum-th regend points to right after where we
-     stopped matching the regnum-th subexpression.  (The zeroth register
-     keeps track of what the whole pattern matches.)  */
+     stopped matching the regnum-th subexpression.  */
   re_char **regstart UNINIT, **regend UNINIT;
 
   /* The following record the register info as found in the above
@@ -3969,29 +3980,22 @@ re_match_2_internal (struct re_pattern_buffer *bufp,
   /* Do not bother to initialize all the register variables if there are
      no groups in the pattern, as it takes a fair amount of time.  If
      there are groups, we include space for register 0 (the whole
-     pattern), even though we never use it, since it simplifies the
-     array indexing.  We should fix this.  */
-  if (bufp->re_nsub)
+     pattern) in REGSTART[0], even though we never use it, to avoid
+     the undefined behavior of subtracting 1 from REGSTART.  */
+  ptrdiff_t re_nsub = num_regs - 1;
+  if (0 < re_nsub)
     {
-      regstart = SAFE_ALLOCA (num_regs * 4 * sizeof *regstart);
+      regstart = SAFE_ALLOCA ((re_nsub * 4 + 1) * sizeof *regstart);
       regend = regstart + num_regs;
-      best_regstart = regend + num_regs;
-      best_regend = best_regstart + num_regs;
-    }
+      best_regstart = regend + re_nsub;
+      best_regend = best_regstart + re_nsub;
 
-  /* The starting position is bogus.  */
-  if (pos < 0 || pos > size1 + size2)
-    {
-      unbind_to (count, Qnil);
-      SAFE_FREE ();
-      return -1;
+      /* Initialize subexpression text positions to unset, to mark ones
+         that no start_memory/stop_memory has been seen for.  */
+      for (re_char **apos = regstart + 1; apos < best_regstart + 1; apos++)
+        *apos = NULL;
     }
 
-  /* Initialize subexpression text positions to -1 to mark ones that no
-     start_memory/stop_memory has been seen for.  */
-  for (ptrdiff_t reg = 1; reg < num_regs; reg++)
-    regstart[reg] = regend[reg] = NULL;
-
   /* We move 'string1' into 'string2' if the latter's empty -- but not if
      'string1' is null.  */
   if (size2 == 0 && string1 != NULL)
@@ -4126,6 +4130,8 @@ re_match_2_internal (struct re_pattern_buffer *bufp,
                     {
                       regstart[reg] = best_regstart[reg];
                       regend[reg] = best_regend[reg];
+                      eassert (REG_UNSET (regstart[reg])
+                               <= REG_UNSET (regend[reg]));
                     }
                 }
             } /* d != end_match_2 */
@@ -4173,7 +4179,9 @@ re_match_2_internal (struct re_pattern_buffer *bufp,
 
               for (ptrdiff_t reg = 1; reg < num_regs; reg++)
                 {
-                  if (REG_UNSET (regstart[reg]) || REG_UNSET (regend[reg]))
+                  eassert (REG_UNSET (regstart[reg])
+                           <= REG_UNSET (regend[reg]));
+                  if (REG_UNSET (regend[reg]))
                     regs->start[reg] = regs->end[reg] = -1;
                   else
                     {
@@ -4373,12 +4381,12 @@ re_match_2_internal (struct re_pattern_buffer *bufp,
            registers data structure) under the register number.  */
         case start_memory:
           DEBUG_PRINT ("EXECUTING start_memory %d:\n", *p);
+          eassert (0 < *p && *p < num_regs);
 
           /* In case we need to undo this operation (via backtracking).  */
           PUSH_FAILURE_REG (*p);
 
           regstart[*p] = d;
-          regend[*p] = NULL;    /* probably unnecessary.  -sm  */
           DEBUG_PRINT ("  regstart: %td\n", POINTER_TO_OFFSET (regstart[*p]));
 
           /* Move past the register number and inner group count.  */
@@ -4391,6 +4399,7 @@ re_match_2_internal (struct re_pattern_buffer *bufp,
         case stop_memory:
           DEBUG_PRINT ("EXECUTING stop_memory %d:\n", *p);
 
+          eassert (0 < *p && *p < num_regs);
           eassert (!REG_UNSET (regstart[*p]));
           /* Strictly speaking, there should be code such as:
 
@@ -4423,7 +4432,9 @@ re_match_2_internal (struct re_pattern_buffer *bufp,
             DEBUG_PRINT ("EXECUTING duplicate %d.\n", regno);
 
             /* Can't back reference a group which we've never matched.  */
-            if (REG_UNSET (regstart[regno]) || REG_UNSET (regend[regno]))
+            eassert (0 < regno && regno < num_regs);
+            eassert (REG_UNSET (regstart[regno]) <= REG_UNSET (regend[regno]));
+            if (REG_UNSET (regend[regno]))
               goto fail;
 
             /* Where in input to try to start matching.  */
diff --git a/src/syntax.c b/src/syntax.c
index 9f77ea5f9b0..7f0fc341f6e 100644
--- a/src/syntax.c
+++ b/src/syntax.c
@@ -807,7 +807,7 @@ back_comment (ptrdiff_t from, ptrdiff_t from_byte, ptrdiff_t stop,
 
       /* Ignore escaped characters, except comment-enders which cannot
          be escaped.  */
-      if ((Vcomment_end_can_be_escaped || code != Sendcomment)
+      if ((comment_end_can_be_escaped || code != Sendcomment)
           && char_quoted (from, from_byte))
         continue;
 
@@ -2336,7 +2336,7 @@ forw_comment (ptrdiff_t from, ptrdiff_t from_byte, ptrdiff_t stop,
           && SYNTAX_FLAGS_COMMENT_STYLE (syntax, 0) == style
           && (SYNTAX_FLAGS_COMMENT_NESTED (syntax) ?
               (nesting > 0 && --nesting == 0) : nesting < 0)
-          && !(Vcomment_end_can_be_escaped && char_quoted (from, from_byte)))
+          && !(comment_end_can_be_escaped && char_quoted (from, from_byte)))
         /* We have encountered a comment end of the same style
            as the comment sequence which began this comment
            section.  */
@@ -2569,7 +2569,7 @@ between them, return t; otherwise return nil.  */)
             }
           else if (code == Sendcomment)
             {
-              found = (!quoted || !Vcomment_end_can_be_escaped)
+              found = (!quoted || !comment_end_can_be_escaped)
                 && back_comment (from, from_byte, stop, comnested, comstyle,
                                  &out_charpos, &out_bytepos);
               if (!found)
@@ -3760,9 +3760,9 @@ character of that word.
 In both cases, LIMIT bounds the search. */);
   Vfind_word_boundary_function_table = Fmake_char_table (Qnil, Qnil);
 
-  DEFVAR_BOOL ("comment-end-can-be-escaped", Vcomment_end_can_be_escaped,
+  DEFVAR_BOOL ("comment-end-can-be-escaped", comment_end_can_be_escaped,
                doc: /* Non-nil means an escaped ender inside a comment doesn't end the comment.  */);
-  Vcomment_end_can_be_escaped = 0;
+  comment_end_can_be_escaped = false;
   DEFSYM (Qcomment_end_can_be_escaped, "comment-end-can-be-escaped");
   Fmake_variable_buffer_local (Qcomment_end_can_be_escaped);
 
diff --git a/src/sysdep.c b/src/sysdep.c
index a1050c4309a..e161172a79b 100644
--- a/src/sysdep.c
+++ b/src/sysdep.c
@@ -1761,24 +1761,6 @@ deliver_thread_signal (int sig, signal_handler_t handler)
   errno = old_errno;
 }
 
-#if !HAVE_DECL_SYS_SIGLIST
-# undef sys_siglist
-# ifdef _sys_siglist
-#  define sys_siglist _sys_siglist
-# elif HAVE_DECL___SYS_SIGLIST
-#  define sys_siglist __sys_siglist
-# else
-#  define sys_siglist my_sys_siglist
-static char const *sys_siglist[NSIG];
-# endif
-#endif
-
-#ifdef _sys_nsig
-# define sys_siglist_entries _sys_nsig
-#else
-# define sys_siglist_entries NSIG
-#endif
-
 /* Handle bus errors, invalid instruction, etc.  */
 static void
 handle_fatal_signal (int sig)
@@ -1970,143 +1952,6 @@ init_signals (void)
   main_thread_id = pthread_self ();
 #endif
 
-#if !HAVE_DECL_SYS_SIGLIST && !defined _sys_siglist
-  if (! initialized)
-    {
-      sys_siglist[SIGABRT] = "Aborted";
-# ifdef SIGAIO
-      sys_siglist[SIGAIO] = "LAN I/O interrupt";
-# endif
-      sys_siglist[SIGALRM] = "Alarm clock";
-# ifdef SIGBUS
-      sys_siglist[SIGBUS] = "Bus error";
-# endif
-# ifdef SIGCHLD
-      sys_siglist[SIGCHLD] = "Child status changed";
-# endif
-# ifdef SIGCONT
-      sys_siglist[SIGCONT] = "Continued";
-# endif
-# ifdef SIGDANGER
-      sys_siglist[SIGDANGER] = "Swap space dangerously low";
-# endif
-# ifdef SIGDGNOTIFY
-      sys_siglist[SIGDGNOTIFY] = "Notification message in queue";
-# endif
-# ifdef SIGEMT
-      sys_siglist[SIGEMT] = "Emulation trap";
-# endif
-      sys_siglist[SIGFPE] = "Arithmetic exception";
-# ifdef SIGFREEZE
-      sys_siglist[SIGFREEZE] = "SIGFREEZE";
-# endif
-# ifdef SIGGRANT
-      sys_siglist[SIGGRANT] = "Monitor mode granted";
-# endif
-      sys_siglist[SIGHUP] = "Hangup";
-      sys_siglist[SIGILL] = "Illegal instruction";
-      sys_siglist[SIGINT] = "Interrupt";
-# ifdef SIGIO
-      sys_siglist[SIGIO] = "I/O possible";
-# endif
-# ifdef SIGIOINT
-      sys_siglist[SIGIOINT] = "I/O intervention required";
-# endif
-# ifdef SIGIOT
-      sys_siglist[SIGIOT] = "IOT trap";
-# endif
-      sys_siglist[SIGKILL] = "Killed";
-# ifdef SIGLOST
-      sys_siglist[SIGLOST] = "Resource lost";
-# endif
-# ifdef SIGLWP
-      sys_siglist[SIGLWP] = "SIGLWP";
-# endif
-# ifdef SIGMSG
-      sys_siglist[SIGMSG] = "Monitor mode data available";
-# endif
-# ifdef SIGPHONE
-      sys_siglist[SIGWIND] = "SIGPHONE";
-# endif
-      sys_siglist[SIGPIPE] = "Broken pipe";
-# ifdef SIGPOLL
-      sys_siglist[SIGPOLL] = "Pollable event occurred";
-# endif
-# ifdef SIGPROF
-      sys_siglist[SIGPROF] = "Profiling timer expired";
-# endif
-# ifdef SIGPTY
-      sys_siglist[SIGPTY] = "PTY I/O interrupt";
-# endif
-# ifdef SIGPWR
-      sys_siglist[SIGPWR] = "Power-fail restart";
-# endif
-      sys_siglist[SIGQUIT] = "Quit";
-# ifdef SIGRETRACT
-      sys_siglist[SIGRETRACT] = "Need to relinquish monitor mode";
-# endif
-# ifdef SIGSAK
-      sys_siglist[SIGSAK] = "Secure attention";
-# endif
-      sys_siglist[SIGSEGV] = "Segmentation violation";
-# ifdef SIGSOUND
-      sys_siglist[SIGSOUND] = "Sound completed";
-# endif
-# ifdef SIGSTOP
-      sys_siglist[SIGSTOP] = "Stopped (signal)";
-# endif
-# ifdef SIGSTP
-      sys_siglist[SIGSTP] = "Stopped (user)";
-# endif
-# ifdef SIGSYS
-      sys_siglist[SIGSYS] = "Bad argument to system call";
-# endif
-      sys_siglist[SIGTERM] = "Terminated";
-# ifdef SIGTHAW
-      sys_siglist[SIGTHAW] = "SIGTHAW";
-# endif
-# ifdef SIGTRAP
-      sys_siglist[SIGTRAP] = "Trace/breakpoint trap";
-# endif
-# ifdef SIGTSTP
-      sys_siglist[SIGTSTP] = "Stopped (user)";
-# endif
-# ifdef SIGTTIN
-      sys_siglist[SIGTTIN] = "Stopped (tty input)";
-# endif
-# ifdef SIGTTOU
-      sys_siglist[SIGTTOU] = "Stopped (tty output)";
-# endif
-# ifdef SIGURG
-      sys_siglist[SIGURG] = "Urgent I/O condition";
-# endif
-# ifdef SIGUSR1
-      sys_siglist[SIGUSR1] = "User defined signal 1";
-# endif
-# ifdef SIGUSR2
-      sys_siglist[SIGUSR2] = "User defined signal 2";
-# endif
-# ifdef SIGVTALRM
-      sys_siglist[SIGVTALRM] = "Virtual timer expired";
-# endif
-# ifdef SIGWAITING
-      sys_siglist[SIGWAITING] = "Process's LWPs are blocked";
-# endif
-# ifdef SIGWINCH
-      sys_siglist[SIGWINCH] = "Window size changed";
-# endif
-# ifdef SIGWIND
-      sys_siglist[SIGWIND] = "SIGWIND";
-# endif
-# ifdef SIGXCPU
-      sys_siglist[SIGXCPU] = "CPU time limit exceeded";
-# endif
-# ifdef SIGXFSZ
-      sys_siglist[SIGXFSZ] = "File size limit exceeded";
-# endif
-    }
-#endif /* !HAVE_DECL_SYS_SIGLIST && !_sys_siglist */
-
   /* Don't alter signal handlers if dumping.  On some machines,
      changing signal handlers sets static data that would make signals
      fail to work right when the dumped Emacs is run.  */
@@ -2762,15 +2607,13 @@ renameat_noreplace (int srcfd, char const *src, int dstfd, char const *dst)
 #endif
 }
 
-/* Like strsignal, except async-signal-safe, and this function typically
+/* Like strsignal, except async-signal-safe, and this function
    returns a string in the C locale rather than the current locale.  */
 char const *
 safe_strsignal (int code)
 {
-  char const *signame = 0;
+  char const *signame = sigdescr_np (code);
 
-  if (0 <= code && code < sys_siglist_entries)
-    signame = sys_siglist[code];
   if (! signame)
     signame = "Unknown signal";
 
diff --git a/src/window.c b/src/window.c
index ef58f43a0bd..e7433969d29 100644
--- a/src/window.c
+++ b/src/window.c
@@ -5462,7 +5462,7 @@ window_scroll (Lisp_Object window, EMACS_INT n, bool whole, bool noerror)
 
   wset_redisplay (XWINDOW (window));
 
-  if (whole && Vfast_but_imprecise_scrolling)
+  if (whole && fast_but_imprecise_scrolling)
     specbind (Qfontification_functions, Qnil);
 
   /* On GUI frames, use the pixel-based version which is much slower
@@ -8398,7 +8398,7 @@ pixelwise even if this option is nil.  */);
   window_resize_pixelwise = false;
 
   DEFVAR_BOOL ("fast-but-imprecise-scrolling",
-               Vfast_but_imprecise_scrolling,
+               fast_but_imprecise_scrolling,
                doc: /* When non-nil, accelerate scrolling operations.
 This comes into play when scrolling rapidly over previously
 unfontified buffer regions.  Only those portions of the buffer which
@@ -8406,7 +8406,7 @@ are actually going to be displayed get fontified.
 
 Note that this optimization can cause the portion of the buffer
 displayed after a scrolling operation to be somewhat inaccurate.  */);
-  Vfast_but_imprecise_scrolling = false;
+  fast_but_imprecise_scrolling = false;
 
   defsubr (&Sselected_window);
   defsubr (&Sold_selected_window);
diff --git a/src/xdisp.c b/src/xdisp.c
index a1f7706ead2..dd737580438 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -538,7 +538,7 @@ it_char_has_category(struct it *it, int cat)
 static bool
 char_can_wrap_before (struct it *it)
 {
-  if (!Vword_wrap_by_category)
+  if (!word_wrap_by_category)
     return !IT_DISPLAYING_WHITESPACE (it);
 
   /* For CJK (LTR) text in RTL paragraph, EOL and BOL are flipped.
@@ -560,7 +560,7 @@ char_can_wrap_before (struct it *it)
 static bool
 char_can_wrap_after (struct it *it)
 {
-  if (!Vword_wrap_by_category)
+  if (!word_wrap_by_category)
     return IT_DISPLAYING_WHITESPACE (it);
 
   /* For CJK (LTR) text in RTL paragraph, EOL and BOL are flipped.
@@ -589,7 +589,7 @@ char_can_wrap_after (struct it *it)
 static int
 fill_column_indicator_column (struct it *it, int char_width)
 {
-  if (Vdisplay_fill_column_indicator
+  if (display_fill_column_indicator
       && !it->w->pseudo_window_p
       && it->continuation_lines_width == 0
       && CHARACTERP (Vdisplay_fill_column_indicator_character))
@@ -5771,7 +5771,7 @@ handle_single_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
       else
         {
           it->what = IT_IMAGE;
-          it->image_id = lookup_image (it->f, value);
+          it->image_id = lookup_image (it->f, value, it->face_id);
           it->position = start_pos;
           it->object = NILP (object) ? it->w->contents : object;
           it->method = GET_FROM_IMAGE;
@@ -12565,6 +12565,11 @@ gui_consider_frame_title (Lisp_Object frame)
       display_mode_element (&it, 0, -1, -1, fmt, Qnil, false);
       len = MODE_LINE_NOPROP_LEN (title_start);
       title = mode_line_noprop_buf + title_start;
+      /* Make sure that any raw bytes in the title are properly
+         represented by their multibyte sequences.  */
+      ptrdiff_t nchars = 0;
+      len = str_as_multibyte ((unsigned char *)title,
+                              mode_line_noprop_buf_end - title, len, &nchars);
       unbind_to (count, Qnil);
 
       /* Set the title only if it's changed.  This avoids consing in
@@ -12576,9 +12581,10 @@ gui_consider_frame_title (Lisp_Object frame)
            || SBYTES (f->name) != len
            || memcmp (title, SDATA (f->name), len) != 0)
           && FRAME_TERMINAL (f)->implicit_set_name_hook)
-        FRAME_TERMINAL (f)->implicit_set_name_hook (f,
-                                                    make_string (title, len),
-                                                    Qnil);
+        {
+          Lisp_Object title_string = make_multibyte_string (title, nchars, len);
+          FRAME_TERMINAL (f)->implicit_set_name_hook (f, title_string, Qnil);
+        }
     }
 }
 
@@ -21923,7 +21929,7 @@ extend_face_to_end_of_line (struct it *it)
       && !face->stipple
 #endif
       && !it->glyph_row->reversed_p
-      && !Vdisplay_fill_column_indicator)
+      && !display_fill_column_indicator)
     return;
 
   /* Set the glyph row flag indicating that the face of the last glyph
@@ -22517,7 +22523,7 @@ push_prefix_prop (struct it *it, Lisp_Object prop)
   else if (IMAGEP (prop))
     {
       it->what = IT_IMAGE;
-      it->image_id = lookup_image (it->f, prop);
+      it->image_id = lookup_image (it->f, prop, it->face_id);
       it->method = GET_FROM_IMAGE;
     }
 #endif /* HAVE_WINDOW_SYSTEM */
@@ -25631,6 +25637,12 @@ display_mode_element (struct it *it, int depth, int field_width, int precision,
                     spec = decode_mode_spec (it->w, c, field, &string);
                     eassert (NILP (string) || STRINGP (string));
                     multibyte = !NILP (string) && STRING_MULTIBYTE (string);
+                    /* Non-ASCII characters in SPEC should cause mode-line
+                       element be displayed as a multibyte string.  */
+                    ptrdiff_t nbytes = strlen (spec);
+                    if (multibyte_chars_in_text ((const unsigned char *)spec,
+                                                 nbytes) != nbytes)
+                      multibyte = true;
 
                     switch (mode_line_target)
                       {
@@ -26249,9 +26261,11 @@ decode_mode_spec_coding (Lisp_Object coding_system, char *buf, bool eol_flag)
       attrs = AREF (val, 0);
       eolvalue = AREF (val, 2);
 
-      *buf++ = multibyte
-        ? XFIXNAT (CODING_ATTR_MNEMONIC (attrs))
-        : ' ';
+      if (multibyte)
+        buf += CHAR_STRING (XFIXNAT (CODING_ATTR_MNEMONIC (attrs)),
+                            (unsigned char *) buf);
+      else
+        *buf++ = ' ';
 
       if (eol_flag)
         {
@@ -27431,7 +27445,7 @@ calc_pixel_width_or_height (double *res, struct it *it, Lisp_Object prop,
           if (FRAME_WINDOW_P (it->f)
               && valid_image_p (prop))
             {
-              ptrdiff_t id = lookup_image (it->f, prop);
+              ptrdiff_t id = lookup_image (it->f, prop, it->face_id);
               struct image *img = IMAGE_FROM_ID (it->f, id);
 
               return OK_PIXELS (width_p ? img->width : img->height);
@@ -34758,7 +34772,7 @@ A value of nil means to respect the value of `truncate-lines'.
 If `word-wrap' is enabled, you might want to reduce this.  */);
   Vtruncate_partial_width_windows = make_fixnum (50);
 
-  DEFVAR_BOOL("word-wrap-by-category", Vword_wrap_by_category, doc: /*
+  DEFVAR_BOOL("word-wrap-by-category", word_wrap_by_category, doc: /*
     Non-nil means also wrap after characters of a certain category.
 Normally when `word-wrap' is on, Emacs only breaks lines after
 whitespace characters.  When this option is turned on, Emacs also
@@ -34773,7 +34787,7 @@ when breaking lines.  That means characters with the ">" category
 don't appear at the beginning of a line (e.g., FULLWIDTH COMMA), and
 characters with the "<" category don't appear at the end of a line
 (e.g., LEFT DOUBLE ANGLE BRACKET).  */);
-  Vword_wrap_by_category = false;
+  word_wrap_by_category = false;
 
   DEFVAR_LISP ("line-number-display-limit", Vline_number_display_limit,
     doc: /* Maximum buffer size for which line number should be displayed.
@@ -35170,10 +35184,10 @@ It has no effect when set to 0, or when line numbers are not absolute.  */);
   DEFSYM (Qdisplay_line_numbers_offset, "display-line-numbers-offset");
   Fmake_variable_buffer_local (Qdisplay_line_numbers_offset);
 
-  DEFVAR_BOOL ("display-fill-column-indicator", Vdisplay_fill_column_indicator,
+  DEFVAR_BOOL ("display-fill-column-indicator", display_fill_column_indicator,
     doc: /* Non-nil means display the fill column indicator.
 See Info node `Displaying Boundaries' for details.  */);
-  Vdisplay_fill_column_indicator = false;
+  display_fill_column_indicator = false;
   DEFSYM (Qdisplay_fill_column_indicator, "display-fill-column-indicator");
   Fmake_variable_buffer_local (Qdisplay_fill_column_indicator);