Revision: miles@gnu.org--gnu-2004/emacs--unicode--0--patch-17

Merge from emacs--cvs-trunk--0

Patches applied:

 * miles@gnu.org--gnu-2004/emacs--cvs-trunk--0--patch-417
 - miles@gnu.org--gnu-2004/emacs--cvs-trunk--0--patch-419
   Update from CVS

 * miles@gnu.org--gnu-2004/emacs--cvs-trunk--0--patch-420
   Tweak permissions

 * miles@gnu.org--gnu-2004/emacs--cvs-trunk--0--patch-421
 - miles@gnu.org--gnu-2004/emacs--cvs-trunk--0--patch-430
   Update from CVS

15 files changed, 539 insertions, 243 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 00822d9d277..60b8d5da63d 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,131 @@
+2004-06-29  YAMAMOTO Mitsuharu  <mituharu@math.s.chiba-u.ac.jp>
+        
+        * macterm.c (do_window_activate, do_window_deactivate): Remove.
+        (XTread_socket): Send mouse button events to the toolbox
+        dispatcher even when the mouse is grabbed.  Don't process window
+        activate events for non-Emacs windows.  Replace function calls to
+        do_window_activate and do_window_deactivate with their contents.
+        Reset mouse grabbing status when a window is deactivated.
+
+2004-06-29  Steven Tamm  <steventamm@mac.com>
+
+        * macterm.c (mac_get_emulated_btn)
+        (mac_event_to_emacs_modifiers): Fix emulated mouse button
+        support to correctly mask out modifiers.
+
+2004-06-29  David Kastrup  <dak@gnu.org>
+
+        * search.c (Fset_match_data): Allow buffer before end of list
+        which can happen if set-match-data is using a pre-consed list.
+
+2004-06-28  Steven Tamm  <steventamm@mac.com>
+
+        * macterm.c (XTread_socket): Correctly set the frame position
+        after the window is moved.
+
+2004-06-28  Jan Dj,Ad(Brv  <jan.h.d@swipnet.se>
+
+        * gtkutil.c (xg_get_image_for_pixmap): Call g_object_unref on
+        gpix and gmask just before return to avoid memory leak.
+        (xg_get_image_for_pixmap): Add workaround for monochrome displays
+        so insensitive and activated icons look ok.
+
+2004-06-27  Jason Rumney  <jasonr@gnu.org>
+
+        * w32fns.c (file_dialog_callback): Disable edit control if set
+        to directories only on CDN_INITDONE message.
+        (Fx_file_dialog): Default to directories only when prompt starts
+        with "Dired".
+
+2004-06-25  Kim F. Storm  <storm@cua.dk>
+
+        * alloc.c (allocate_misc): Update total_free_markers.
+        (free_misc): New function.
+        (safe_alloca_unwind, free_marker): Use it.
+
+        * lisp.h (free_misc): Add prototype.
+
+        * fns.c (Fmapconcat, Fmapcar): Remove superfluous GCPROs.
+
+2004-06-24  Richard M. Stallman  <rms@gnu.org>
+
+        * emacs.c (Vsignal_USR1_hook, Vsignal_USR2_hook): Definitions deleted.
+        (syms_of_emacs): Lisp variables deleted.
+
+2004-06-23  David Kastrup  <dak@gnu.org>
+
+        * search.c (Freplace_match): Adjust the match-data more thoroughly
+        when replacing strings in the buffer.
+        (Fmatch_data): When INTEGERS is non-nil and the last match was in
+        a buffer, add the buffer as last element to the match data.
+        (Fset_match_data): If an additional element of the match-data is a
+        buffer, restore it to last_thing_searched.
+        (save_search_regs): Save last_thing_searched as part of the match
+        data.
+        (restore_match_data): Restore it again.
+
+2004-06-23  Luc Teirlinck  <teirllm@auburn.edu>
+
+        * keymap.c (Ftext_char_description): Doc fix.
+        * doc.c (Fsnarf_documentation): Doc fix.
+
+2004-06-22  Kim F. Storm  <storm@cua.dk>
+
+        * fns.c (Fmapcar, Fmapconcat): GCPRO the args array.
+
+        * lisp.h (struct Lisp_Save_Value): New member dogc.
+        (SAFE_ALLOCA_LISP): Change second arg to number of elements.
+        Set dogc member in Lisp_Save_Value object so it will be GC'ed.
+        (SAFE_FREE_LISP): New macro.
+
+        * alloc.c (safe_alloca_unwind): Clear dogc and pointer members.
+        (make_save_value): Init new dogc member.
+        (mark_object): Mark Lisp_Save_Value pointer array if dogc is set.
+
+        * fns.c (Fmapconcat, Fmapcar): Use new SAFE_ALLOCA_LISP and
+        SAFE_FREE_LISP macros.
+
+2004-06-22  Kim F. Storm  <storm@cua.dk>
+
+        * lisp.h (SAFE_ALLOCA_LISP): New macro to allocate Lisp_Objects.
+        Temporarily inhibits GC if memory is xmalloc'ed, as the Lisp_Objects
+        in that memory area are unknown to GC.  Add comments.
+
+        * fns.c (Fmapconcat, Fmapcar): Use SAFE_ALLOCA_LISP.
+
+2004-06-21  Kim F. Storm  <storm@cua.dk>
+
+        * lisp.h (MAX_ALLOCA): Define here.
+        (safe_alloca_unwind): Add prototype.
+        (USE_SAFE_ALLOCA, SAFE_ALLOCA, SAFE_FREE): New macros.
+
+        * alloc.c (safe_alloca_unwind): New function.
+
+        * casefiddle.c (casify_object): Use SAFE_ALLOCA.
+
+        * charset.c (Fstring): Use SAFE_ALLOCA.
+
+        * coding.c (MAX_ALLOCA): Remove define.
+
+        * data.c (MAX_ALLOCA): Remove define.
+        (Faset): Use SAFE_ALLOCA.
+
+        * editfns.c (Fformat, Ftranspose_regions): Use SAFE_ALLOCA.
+
+        * fns.c (string_make_multibyte, string_to_multibyte)
+        (string_make_unibyte, Fmapconcat, Fmapcar): Use SAFE_ALLOCA.
+        (MAX_ALLOCA): Remove define.
+        (Fbase64_encode_region, Fbase64_encode_string)
+        (Fbase64_decode_region, Fbase64_decode_string): Use SAFE_ALLOCA.
+        (Fbase64_encode_region, Fbase64_encode_string): Fix potential
+        memory leak if encoding fails.
+
+        * xdisp.c (add_to_log): Use SAFE_ALLOCA.
+
+2004-06-21  Eli Zaretskii  <eliz@gnu.org>
+
+        * print.c (Fwith_output_to_temp_buffer): Doc fix.
+
 2004-06-20  Richard M. Stallman  <rms@gnu.org>
 
         * xfaces.c (Finternal_copy_lisp_face): Small cleanup; doc fix.
diff --git a/src/alloc.c b/src/alloc.c
index ea7886dd4dc..994dc21079f 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -579,6 +579,22 @@ xstrdup (s)
 }
 
 
+/* Unwind for SAFE_ALLOCA */
+
+Lisp_Object
+safe_alloca_unwind (arg)
+     Lisp_Object arg;
+{
+  register struct Lisp_Save_Value *p = XSAVE_VALUE (arg);
+
+  p->dogc = 0;
+  xfree (p->pointer);
+  p->pointer = 0;
+  free_misc (arg);
+  return Qnil;
+}
+
+
 /* Like malloc but used for allocating Lisp data.  NBYTES is the
    number of bytes to allocate, TYPE describes the intended use of the
    allcated memory block (for strings, for conses, ...).  */
@@ -2863,17 +2879,32 @@ allocate_misc ()
           marker_block = new;
           marker_block_index = 0;
           n_marker_blocks++;
+          total_free_markers += MARKER_BLOCK_SIZE;
         }
       XSETMISC (val, &marker_block->markers[marker_block_index]);
       marker_block_index++;
     }
 
+  --total_free_markers;
   consing_since_gc += sizeof (union Lisp_Misc);
   misc_objects_consed++;
   XMARKER (val)->gcmarkbit = 0;
   return val;
 }
 
+/* Free a Lisp_Misc object */
+
+void
+free_misc (misc)
+     Lisp_Object misc;
+{
+  XMISC (misc)->u_marker.type = Lisp_Misc_Free;
+  XMISC (misc)->u_free.chain = marker_free_list;
+  marker_free_list = XMISC (misc);
+
+  total_free_markers++;
+}
+
 /* Return a Lisp_Misc_Save_Value object containing POINTER and
    INTEGER.  This is used to package C values to call record_unwind_protect.
    The unwind function can get the C values back using XSAVE_VALUE.  */
@@ -2891,6 +2922,7 @@ make_save_value (pointer, integer)
   p = XSAVE_VALUE (val);
   p->pointer = pointer;
   p->integer = integer;
+  p->dogc = 0;
   return val;
 }
 
@@ -2919,12 +2951,7 @@ free_marker (marker)
      Lisp_Object marker;
 {
   unchain_marker (XMARKER (marker));
-
-  XMISC (marker)->u_marker.type = Lisp_Misc_Free;
-  XMISC (marker)->u_free.chain = marker_free_list;
-  marker_free_list = XMISC (marker);
-
-  total_free_markers++;
+  free_misc (marker);
 }
 
 
@@ -4924,6 +4951,7 @@ mark_object (arg)
       if (XMARKER (obj)->gcmarkbit)
         break;
       XMARKER (obj)->gcmarkbit = 1;
+
       switch (XMISCTYPE (obj))
         {
         case Lisp_Misc_Buffer_Local_Value:
@@ -4948,6 +4976,8 @@ mark_object (arg)
           /* DO NOT mark thru the marker's chain.
              The buffer's markers chain does not preserve markers from gc;
              instead, markers are removed from the chain when freed by gc.  */
+          break;
+
         case Lisp_Misc_Intfwd:
         case Lisp_Misc_Boolfwd:
         case Lisp_Misc_Objfwd:
@@ -4957,7 +4987,21 @@ mark_object (arg)
              since all markable slots in current buffer marked anyway.  */
           /* Don't need to do Lisp_Objfwd, since the places they point
              are protected with staticpro.  */
+          break;
+
         case Lisp_Misc_Save_Value:
+          {
+            register struct Lisp_Save_Value *ptr = XSAVE_VALUE (obj);
+            /* If DOGC is set, POINTER is the address of a memory
+               area containing INTEGER potential Lisp_Objects.  */
+            if (ptr->dogc)
+              {
+                Lisp_Object *p = (Lisp_Object *) ptr->pointer;
+                int nelt;
+                for (nelt = ptr->integer; nelt > 0; nelt--, p++)
+                  mark_maybe_object (*p);
+              }
+          }
           break;
 
         case Lisp_Misc_Overlay:
diff --git a/src/data.c b/src/data.c
index 935c4348bb7..1071107947c 100644
--- a/src/data.c
+++ b/src/data.c
@@ -1983,11 +1983,6 @@ or a byte-code object.  IDX starts at 0.  */)
     }
 }
 
-/* Don't use alloca for relocating string data larger than this, lest
-   we overflow their stack.  The value is the same as what used in
-   fns.c for base64 handling.  */
-#define MAX_ALLOCA 16*1024
-
 DEFUN ("aset", Faset, Saset, 3, 3, 0,
        doc: /* Store into the element of ARRAY at index IDX the value NEWELT.
 Return NEWELT.  ARRAY may be a vector, a string, a char-table or a
@@ -2051,10 +2046,9 @@ bool-vector.  IDX starts at 0.  */)
           /* We must relocate the string data.  */
           int nchars = SCHARS (array);
           unsigned char *str;
+          USE_SAFE_ALLOCA;
 
-          str = (nbytes <= MAX_ALLOCA
-                 ? (unsigned char *) alloca (nbytes)
-                 : (unsigned char *) xmalloc (nbytes));
+          SAFE_ALLOCA (str, unsigned char *, nbytes);
           bcopy (SDATA (array), str, nbytes);
           allocate_string_data (XSTRING (array), nchars,
                                 nbytes + new_bytes - prev_bytes);
@@ -2062,8 +2056,7 @@ bool-vector.  IDX starts at 0.  */)
           p1 = SDATA (array) + idxval_byte;
           bcopy (str + idxval_byte + prev_bytes, p1 + new_bytes,
                  nbytes - (idxval_byte + prev_bytes));
-          if (nbytes > MAX_ALLOCA)
-            xfree (str);
+          SAFE_FREE (nbytes);
           clear_string_char_byte_cache ();
         }
       while (new_bytes--)
@@ -2086,14 +2079,13 @@ bool-vector.  IDX starts at 0.  */)
           unsigned char workbuf[MAX_MULTIBYTE_LENGTH], *p0 = workbuf, *p1;
           unsigned char *origstr = SDATA (array), *str;
           int nchars, nbytes;
+          USE_SAFE_ALLOCA;
 
           nchars = SCHARS (array);
           nbytes = idxval_byte = count_size_as_multibyte (origstr, idxval);
           nbytes += count_size_as_multibyte (origstr + idxval,
                                              nchars - idxval);
-          str = (nbytes <= MAX_ALLOCA
-                 ? (unsigned char *) alloca (nbytes)
-                 : (unsigned char *) xmalloc (nbytes));
+          SAFE_ALLOCA (str, unsigned char *, nbytes);
           copy_text (SDATA (array), str, nchars, 0, 1);
           PARSE_MULTIBYTE_SEQ (str + idxval_byte, nbytes - idxval_byte,
                                prev_bytes);
@@ -2106,8 +2098,7 @@ bool-vector.  IDX starts at 0.  */)
             *p1++ = *p0++;
           bcopy (str + idxval_byte + prev_bytes, p1,
                  nbytes - (idxval_byte + prev_bytes));
-          if (nbytes > MAX_ALLOCA)
-            xfree (str);
+          SAFE_FREE (nbytes);
           clear_string_char_byte_cache ();
         }
     }
diff --git a/src/doc.c b/src/doc.c
index 2e66c5cea46..8c116210cda 100644
--- a/src/doc.c
+++ b/src/doc.c
@@ -570,7 +570,7 @@ records them in function and variable definitions.
 The function takes one argument, FILENAME, a string;
 it specifies the file name (without a directory) of the DOC file.
 That file is found in `../etc' now; later, when the dumped Emacs is run,
-the same file name is found in the `data-directory'.  */)
+the same file name is found in the `doc-directory'.  */)
      (filename)
      Lisp_Object filename;
 {
diff --git a/src/editfns.c b/src/editfns.c
index 130dffa77de..9928beff678 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -3381,6 +3381,7 @@ usage: (format STRING &rest OBJECTS)  */)
   int longest_format;
   Lisp_Object val;
   int arg_intervals = 0;
+  USE_SAFE_ALLOCA;
 
   /* discarded[I] is 1 if byte I of the format
      string was not copied into the output.
@@ -3429,7 +3430,7 @@ usage: (format STRING &rest OBJECTS)  */)
   longest_format = 0;
 
   /* Make room in result for all the non-%-codes in the control string.  */
-  total = 5 + CONVERTED_BYTE_SIZE (multibyte, args[0]);
+  total = 5 + CONVERTED_BYTE_SIZE (multibyte, args[0]) + 1;
 
   /* Allocate the info and discarded tables.  */
   {
@@ -3622,10 +3623,7 @@ usage: (format STRING &rest OBJECTS)  */)
 
   /* Allocate the space for the result.
      Note that TOTAL is an overestimate.  */
-  if (total < 1000)
-    buf = (char *) alloca (total + 1);
-  else
-    buf = (char *) xmalloc (total + 1);
+  SAFE_ALLOCA (buf, char *, total);
 
   p = buf;
   nchars = 0;
@@ -3758,7 +3756,7 @@ usage: (format STRING &rest OBJECTS)  */)
                 maybe_combine_byte = 1;
               this_nchars = strlen (p);
               if (multibyte)
-                p += str_to_multibyte (p, buf + total - p, this_nchars);
+                p += str_to_multibyte (p, buf + total - 1 - p, this_nchars);
               else
                 p += this_nchars;
               nchars += this_nchars;
@@ -3795,7 +3793,7 @@ usage: (format STRING &rest OBJECTS)  */)
         *p++ = *format++, nchars++;
     }
 
-  if (p > buf + total + 1)
+  if (p > buf + total)
     abort ();
 
   if (maybe_combine_byte)
@@ -3803,8 +3801,7 @@ usage: (format STRING &rest OBJECTS)  */)
   val = make_specified_string (buf, nchars, p - buf, multibyte);
 
   /* If we allocated BUF with malloc, free it too.  */
-  if (total >= 1000)
-    xfree (buf);
+  SAFE_FREE (total);
 
   /* If the format string has text properties, or any of the string
      arguments has text properties, set up text properties of the
@@ -4173,12 +4170,9 @@ Transposing beyond buffer boundaries is an error.  */)
       /* First region smaller than second.  */
       if (len1_byte < len2_byte)
         {
-          /* We use alloca only if it is small,
-             because we want to avoid stack overflow.  */
-          if (len2_byte > 20000)
-            temp = (unsigned char *) xmalloc (len2_byte);
-          else
-            temp = (unsigned char *) alloca (len2_byte);
+          USE_SAFE_ALLOCA;
+
+          SAFE_ALLOCA (temp, unsigned char *, len2_byte);
 
           /* Don't precompute these addresses.  We have to compute them
              at the last minute, because the relocating allocator might
@@ -4189,23 +4183,20 @@ Transposing beyond buffer boundaries is an error.  */)
           bcopy (start2_addr, temp, len2_byte);
           bcopy (start1_addr, start1_addr + len2_byte, len1_byte);
           bcopy (temp, start1_addr, len2_byte);
-          if (len2_byte > 20000)
-            xfree (temp);
+          SAFE_FREE (len2_byte);
         }
       else
         /* First region not smaller than second.  */
         {
-          if (len1_byte > 20000)
-            temp = (unsigned char *) xmalloc (len1_byte);
-          else
-            temp = (unsigned char *) alloca (len1_byte);
+          USE_SAFE_ALLOCA;
+
+          SAFE_ALLOCA (temp, unsigned char *, len1_byte);
           start1_addr = BYTE_POS_ADDR (start1_byte);
           start2_addr = BYTE_POS_ADDR (start2_byte);
           bcopy (start1_addr, temp, len1_byte);
           bcopy (start2_addr, start1_addr, len2_byte);
           bcopy (temp, start1_addr + len2_byte, len1_byte);
-          if (len1_byte > 20000)
-            xfree (temp);
+          SAFE_FREE (len1_byte);
         }
       graft_intervals_into_buffer (tmp_interval1, start1 + len2,
                                    len1, current_buffer, 0);
@@ -4222,6 +4213,8 @@ Transposing beyond buffer boundaries is an error.  */)
       if (len1_byte == len2_byte)
         /* Regions are same size, though, how nice.  */
         {
+          USE_SAFE_ALLOCA;
+
           modify_region (current_buffer, start1, end1);
           modify_region (current_buffer, start2, end2);
           record_change (start1, len1);
@@ -4233,17 +4226,14 @@ Transposing beyond buffer boundaries is an error.  */)
           Fset_text_properties (make_number (start2), make_number (end2),
                                 Qnil, Qnil);
 
-          if (len1_byte > 20000)
-            temp = (unsigned char *) xmalloc (len1_byte);
-          else
-            temp = (unsigned char *) alloca (len1_byte);
+          SAFE_ALLOCA (temp, unsigned char *, len1_byte);
           start1_addr = BYTE_POS_ADDR (start1_byte);
           start2_addr = BYTE_POS_ADDR (start2_byte);
           bcopy (start1_addr, temp, len1_byte);
           bcopy (start2_addr, start1_addr, len2_byte);
           bcopy (temp, start2_addr, len1_byte);
-          if (len1_byte > 20000)
-            xfree (temp);
+          SAFE_FREE (len1_byte);
+
           graft_intervals_into_buffer (tmp_interval1, start2,
                                        len1, current_buffer, 0);
           graft_intervals_into_buffer (tmp_interval2, start1,
@@ -4253,6 +4243,8 @@ Transposing beyond buffer boundaries is an error.  */)
       else if (len1_byte < len2_byte)   /* Second region larger than first */
         /* Non-adjacent & unequal size, area between must also be shifted.  */
         {
+          USE_SAFE_ALLOCA;
+
           modify_region (current_buffer, start1, end2);
           record_change (start1, (end2 - start1));
           tmp_interval1 = copy_intervals (cur_intv, start1, len1);
@@ -4262,18 +4254,15 @@ Transposing beyond buffer boundaries is an error.  */)
                                 Qnil, Qnil);
 
           /* holds region 2 */
-          if (len2_byte > 20000)
-            temp = (unsigned char *) xmalloc (len2_byte);
-          else
-            temp = (unsigned char *) alloca (len2_byte);
+          SAFE_ALLOCA (temp, unsigned char *, len2_byte);
           start1_addr = BYTE_POS_ADDR (start1_byte);
           start2_addr = BYTE_POS_ADDR (start2_byte);
           bcopy (start2_addr, temp, len2_byte);
           bcopy (start1_addr, start1_addr + len_mid + len2_byte, len1_byte);
           safe_bcopy (start1_addr + len1_byte, start1_addr + len2_byte, len_mid);
           bcopy (temp, start1_addr, len2_byte);
-          if (len2_byte > 20000)
-            xfree (temp);
+          SAFE_FREE (len2_byte);
+
           graft_intervals_into_buffer (tmp_interval1, end2 - len1,
                                        len1, current_buffer, 0);
           graft_intervals_into_buffer (tmp_interval_mid, start1 + len2,
@@ -4284,6 +4273,8 @@ Transposing beyond buffer boundaries is an error.  */)
       else
         /* Second region smaller than first.  */
         {
+          USE_SAFE_ALLOCA;
+
           record_change (start1, (end2 - start1));
           modify_region (current_buffer, start1, end2);
 
@@ -4294,18 +4285,15 @@ Transposing beyond buffer boundaries is an error.  */)
                                 Qnil, Qnil);
 
           /* holds region 1 */
-          if (len1_byte > 20000)
-            temp = (unsigned char *) xmalloc (len1_byte);
-          else
-            temp = (unsigned char *) alloca (len1_byte);
+          SAFE_ALLOCA (temp, unsigned char *, len1_byte);
           start1_addr = BYTE_POS_ADDR (start1_byte);
           start2_addr = BYTE_POS_ADDR (start2_byte);
           bcopy (start1_addr, temp, len1_byte);
           bcopy (start2_addr, start1_addr, len2_byte);
           bcopy (start1_addr + len1_byte, start1_addr + len2_byte, len_mid);
           bcopy (temp, start1_addr + len2_byte + len_mid, len1_byte);
-          if (len1_byte > 20000)
-            xfree (temp);
+          SAFE_FREE (len1_byte);
+
           graft_intervals_into_buffer (tmp_interval1, end2 - len1,
                                        len1, current_buffer, 0);
           graft_intervals_into_buffer (tmp_interval_mid, start1 + len2,
diff --git a/src/emacs.c b/src/emacs.c
index d348eb86d29..5b7394627ef 100644
--- a/src/emacs.c
+++ b/src/emacs.c
@@ -126,14 +126,6 @@ Lisp_Object Vkill_emacs_hook;
 /* An empty lisp string.  To avoid having to build any other.  */
 Lisp_Object empty_string;
 
-#ifdef SIGUSR1
-/* Hooks for signal USR1 and USR2 handling.  */
-Lisp_Object Vsignal_USR1_hook;
-#ifdef SIGUSR2
-Lisp_Object Vsignal_USR2_hook;
-#endif
-#endif
-
 /* Search path separator.  */
 Lisp_Object Vpath_separator;
 
@@ -2379,18 +2371,6 @@ The hook is not run in batch mode, i.e., if `noninteractive' is non-nil.  */);
   empty_string = build_string ("");
   staticpro (&empty_string);
 
-#ifdef SIGUSR1
-  DEFVAR_LISP ("signal-USR1-hook", &Vsignal_USR1_hook,
-               doc: /* Hook to be run whenever emacs receives a USR1 signal.  */);
-  Vsignal_USR1_hook = Qnil;
-#ifdef SIGUSR2
-  DEFVAR_LISP ("signal-USR2-hook", &Vsignal_USR2_hook,
-               doc: /* Hook to be run whenever emacs receives a USR2 signal.  */);
-  Vsignal_USR2_hook = Qnil;
-#endif
-#endif
-
-
   DEFVAR_INT ("emacs-priority", &emacs_priority,
               doc: /* Priority for Emacs to run at.
 This value is effective only if set before Emacs is dumped,
diff --git a/src/fns.c b/src/fns.c
index 5e20687494c..2058fb63a4e 100644
--- a/src/fns.c
+++ b/src/fns.c
@@ -929,11 +929,14 @@ string_make_multibyte (string)
   if (nbytes == SBYTES (string))
     return string;
 
-  buf = (unsigned char *) alloca (nbytes);
+  SAFE_ALLOCA (buf, unsigned char *, nbytes);
   copy_text (SDATA (string), buf, SBYTES (string),
              0, 1);
 
-  return make_multibyte_string (buf, SCHARS (string), nbytes);
+  ret = make_multibyte_string (buf, SCHARS (string), nbytes);
+  SAFE_FREE (nbytes);
+
+  return ret;
 }
 
 
@@ -947,6 +950,8 @@ string_to_multibyte (string)
 {
   unsigned char *buf;
   int nbytes;
+  Lisp_Object ret;
+  USE_SAFE_ALLOCA;
 
   if (STRING_MULTIBYTE (string))
     return string;
@@ -957,11 +962,14 @@ string_to_multibyte (string)
   if (nbytes == SBYTES (string))
     return make_multibyte_string (SDATA (string), nbytes, nbytes);
 
-  buf = (unsigned char *) alloca (nbytes);
+  SAFE_ALLOCA (buf, unsigned char *, nbytes);
   bcopy (SDATA (string), buf, SBYTES (string));
   str_to_multibyte (buf, nbytes, SBYTES (string));
 
-  return make_multibyte_string (buf, SCHARS (string), nbytes);
+  ret = make_multibyte_string (buf, SCHARS (string), nbytes);
+  SAFE_FREE (nbytes);
+
+  return ret;
 }
 
 
@@ -971,23 +979,22 @@ Lisp_Object
 string_make_unibyte (string)
      Lisp_Object string;
 {
+  int nchars;
   unsigned char *buf;
   Lisp_Object ret;
+  USE_SAFE_ALLOCA;
 
   if (! STRING_MULTIBYTE (string))
     return string;
 
-  /* We can not use alloca here, because string might be very long.
-     For example when selecting megabytes of text and then pasting it to
-     another application.  */
-  buf = (unsigned char *) xmalloc (SCHARS (string));
+  nchars = SCHARS (string);
 
+  SAFE_ALLOCA (buf, unsigned char *, nchars);
   copy_text (SDATA (string), buf, SBYTES (string),
              1, 0);
 
-  ret = make_unibyte_string (buf, SCHARS (string));
-
-  xfree (buf);
+  ret = make_unibyte_string (buf, nchars);
+  SAFE_FREE (nchars);
 
   return ret;
 }
@@ -2455,6 +2462,8 @@ SEQUENCE may be a list, a vector, a bool-vector, or a string.  */)
   register Lisp_Object *args;
   register int i;
   struct gcpro gcpro1;
+  Lisp_Object ret;
+  USE_SAFE_ALLOCA;
 
   len = Flength (sequence);
   if (CHAR_TABLE_P (sequence))
@@ -2463,7 +2472,7 @@ SEQUENCE may be a list, a vector, a bool-vector, or a string.  */)
   nargs = leni + leni - 1;
   if (nargs < 0) return build_string ("");
 
-  args = (Lisp_Object *) alloca (nargs * sizeof (Lisp_Object));
+  SAFE_ALLOCA_LISP (args, nargs);
 
   GCPRO1 (separator);
   mapcar1 (leni, args, function, sequence);
@@ -2475,7 +2484,10 @@ SEQUENCE may be a list, a vector, a bool-vector, or a string.  */)
   for (i = 1; i < nargs; i += 2)
     args[i] = separator;
 
-  return Fconcat (nargs, args);
+  ret = Fconcat (nargs, args);
+  SAFE_FREE_LISP (nargs);
+
+  return ret;
 }
 
 DEFUN ("mapcar", Fmapcar, Smapcar, 2, 2, 0,
@@ -2488,16 +2500,22 @@ SEQUENCE may be a list, a vector, a bool-vector, or a string.  */)
   register Lisp_Object len;
   register int leni;
   register Lisp_Object *args;
+  Lisp_Object ret;
+  USE_SAFE_ALLOCA;
 
   len = Flength (sequence);
   if (CHAR_TABLE_P (sequence))
     wrong_type_argument (Qlistp, sequence);
   leni = XFASTINT (len);
-  args = (Lisp_Object *) alloca (leni * sizeof (Lisp_Object));
+
+  SAFE_ALLOCA_LISP (args, leni);
 
   mapcar1 (leni, args, function, sequence);
 
-  return Flist (leni, args);
+  ret = Flist (leni, args);
+  SAFE_FREE_LISP (leni);
+
+  return ret;
 }
 
 DEFUN ("mapc", Fmapc, Smapc, 2, 2, 0,
@@ -3114,10 +3132,6 @@ The data read from the system are decoded using `locale-coding-system'.  */)
     }                                   \
   while (IS_BASE64_IGNORABLE (c))
 
-/* Don't use alloca for regions larger than this, lest we overflow
-   their stack.  */
-#define MAX_ALLOCA 16*1024
-
 /* Table of characters coding the 64 values.  */
 static char base64_value_to_char[64] =
 {
@@ -3183,6 +3197,7 @@ into shorter lines.  */)
   int allength, length;
   int ibeg, iend, encoded_length;
   int old_pos = PT;
+  USE_SAFE_ALLOCA;
 
   validate_region (&beg, &end);
 
@@ -3197,10 +3212,7 @@ into shorter lines.  */)
   allength = length + length/3 + 1;
   allength += allength / MIME_LINE_LENGTH + 1 + 6;
 
-  if (allength <= MAX_ALLOCA)
-    encoded = (char *) alloca (allength);
-  else
-    encoded = (char *) xmalloc (allength);
+  SAFE_ALLOCA (encoded, char *, allength);
   encoded_length = base64_encode_1 (BYTE_POS_ADDR (ibeg), encoded, length,
                                     NILP (no_line_break),
                                     !NILP (current_buffer->enable_multibyte_characters));
@@ -3210,8 +3222,7 @@ into shorter lines.  */)
   if (encoded_length < 0)
     {
       /* The encoding wasn't possible. */
-      if (length > MAX_ALLOCA)
-        xfree (encoded);
+      SAFE_FREE (allength);
       error ("Multibyte character in data for base64 encoding");
     }
 
@@ -3219,8 +3230,7 @@ into shorter lines.  */)
      and delete the old.  (Insert first in order to preserve markers.)  */
   SET_PT_BOTH (XFASTINT (beg), ibeg);
   insert (encoded, encoded_length);
-  if (allength > MAX_ALLOCA)
-    xfree (encoded);
+  SAFE_FREE (allength);
   del_range_byte (ibeg + encoded_length, iend + encoded_length, 1);
 
   /* If point was outside of the region, restore it exactly; else just
@@ -3246,6 +3256,7 @@ into shorter lines.  */)
   int allength, length, encoded_length;
   char *encoded;
   Lisp_Object encoded_string;
+  USE_SAFE_ALLOCA;
 
   CHECK_STRING (string);
 
@@ -3257,10 +3268,7 @@ into shorter lines.  */)
   allength += allength / MIME_LINE_LENGTH + 1 + 6;
 
   /* We need to allocate enough room for decoding the text. */
-  if (allength <= MAX_ALLOCA)
-    encoded = (char *) alloca (allength);
-  else
-    encoded = (char *) xmalloc (allength);
+  SAFE_ALLOCA (encoded, char *, allength);
 
   encoded_length = base64_encode_1 (SDATA (string),
                                     encoded, length, NILP (no_line_break),
@@ -3271,14 +3279,12 @@ into shorter lines.  */)
   if (encoded_length < 0)
     {
       /* The encoding wasn't possible. */
-      if (length > MAX_ALLOCA)
-        xfree (encoded);
+      SAFE_FREE (allength);
       error ("Multibyte character in data for base64 encoding");
     }
 
   encoded_string = make_unibyte_string (encoded, encoded_length);
-  if (allength > MAX_ALLOCA)
-    xfree (encoded);
+  SAFE_FREE (allength);
 
   return encoded_string;
 }
@@ -3397,6 +3403,7 @@ If the region can't be decoded, signal an error and don't modify the buffer.  */
   int decoded_length;
   int inserted_chars;
   int multibyte = !NILP (current_buffer->enable_multibyte_characters);
+  USE_SAFE_ALLOCA;
 
   validate_region (&beg, &end);
 
@@ -3409,10 +3416,7 @@ If the region can't be decoded, signal an error and don't modify the buffer.  */
      working on a multibyte buffer, each decoded code may occupy at
      most two bytes.  */
   allength = multibyte ? length * 2 : length;
-  if (allength <= MAX_ALLOCA)
-    decoded = (char *) alloca (allength);
-  else
-    decoded = (char *) xmalloc (allength);
+  SAFE_ALLOCA (decoded, char *, allength);
 
   move_gap_both (XFASTINT (beg), ibeg);
   decoded_length = base64_decode_1 (BYTE_POS_ADDR (ibeg), decoded, length,
@@ -3423,8 +3427,7 @@ If the region can't be decoded, signal an error and don't modify the buffer.  */
   if (decoded_length < 0)
     {
       /* The decoding wasn't possible. */
-      if (allength > MAX_ALLOCA)
-        xfree (decoded);
+      SAFE_FREE (allength);
       error ("Invalid base64 data");
     }
 
@@ -3432,8 +3435,8 @@ If the region can't be decoded, signal an error and don't modify the buffer.  */
      and delete the old.  (Insert first in order to preserve markers.)  */
   TEMP_SET_PT_BOTH (XFASTINT (beg), ibeg);
   insert_1_both (decoded, inserted_chars, decoded_length, 0, 1, 0);
-  if (allength > MAX_ALLOCA)
-    xfree (decoded);
+  SAFE_FREE (allength);
+
   /* Delete the original text.  */
   del_range_both (PT, PT_BYTE, XFASTINT (end) + inserted_chars,
                   iend + decoded_length, 1);
@@ -3458,15 +3461,13 @@ DEFUN ("base64-decode-string", Fbase64_decode_string, Sbase64_decode_string,
   char *decoded;
   int length, decoded_length;
   Lisp_Object decoded_string;
+  USE_SAFE_ALLOCA;
 
   CHECK_STRING (string);
 
   length = SBYTES (string);
   /* We need to allocate enough room for decoding the text. */
-  if (length <= MAX_ALLOCA)
-    decoded = (char *) alloca (length);
-  else
-    decoded = (char *) xmalloc (length);
+  SAFE_ALLOCA (decoded, char *, length);
 
   /* The decoded result should be unibyte. */
   decoded_length = base64_decode_1 (SDATA (string), decoded, length,
@@ -3478,8 +3479,7 @@ DEFUN ("base64-decode-string", Fbase64_decode_string, Sbase64_decode_string,
   else
     decoded_string = Qnil;
 
-  if (length > MAX_ALLOCA)
-    xfree (decoded);
+  SAFE_FREE (length);
   if (!STRINGP (decoded_string))
     error ("Invalid base64 data");
 
diff --git a/src/gtkutil.c b/src/gtkutil.c
index 84aa9f46d4d..3ffba0ba745 100644
--- a/src/gtkutil.c
+++ b/src/gtkutil.c
@@ -248,8 +248,46 @@ xg_get_image_for_pixmap (f, img, widget, old_widget)
 {
   GdkPixmap *gpix;
   GdkPixmap *gmask;
-  GdkDisplay *gdpy = gdk_x11_lookup_xdisplay (FRAME_X_DISPLAY (f));
+  GdkDisplay *gdpy;
+
+  /* If we are on a one bit display, let GTK do all the image handling.
+     This seems to be the only way to make insensitive and activated icons
+     look good.  */
+  if (x_screen_planes (f) == 1)
+    {
+      Lisp_Object specified_file = Qnil;
+      Lisp_Object tail;
+      extern Lisp_Object QCfile;
+
+      for (tail = XCDR (img->spec);
+           NILP (specified_file) && CONSP (tail) && CONSP (XCDR (tail));
+           tail = XCDR (XCDR (tail)))
+        if (EQ (XCAR (tail), QCfile))
+          specified_file = XCAR (XCDR (tail));
+
+        if (STRINGP (specified_file))
+          {
+
+            Lisp_Object file = Qnil;
+            struct gcpro gcpro1;
+            GCPRO1 (file);
 
+            file = x_find_image_file (specified_file);
+            /* We already loaded the image once before calling this
+               function, so this should not fail.  */
+            xassert (STRINGP (file) != 0);
+
+            if (! old_widget)
+              old_widget = GTK_IMAGE (gtk_image_new_from_file (SDATA (file)));
+            else
+              gtk_image_set_from_file (old_widget, SDATA (file));
+
+            UNGCPRO;
+            return GTK_WIDGET (old_widget);
+          }
+    }
+
+  gdpy = gdk_x11_lookup_xdisplay (FRAME_X_DISPLAY (f));
   gpix = gdk_pixmap_foreign_new_for_display (gdpy, img->pixmap);
   gmask = img->mask ? gdk_pixmap_foreign_new_for_display (gdpy, img->mask) : 0;
 
@@ -262,6 +300,12 @@ xg_get_image_for_pixmap (f, img, widget, old_widget)
     }
   else
     {
+      /* This is a workaround to make icons look good on pseudo color
+         displays.  Apparently GTK expects the images to have an alpha
+         channel.  If they don't, insensitive and activated icons will
+         look bad.  This workaround does not work on monochrome displays,
+         and is not needed on true color/static color displays (i.e.
+         16 bits and higher).  */
       int x, y, width, height, rowstride, mask_rowstride;
       GdkPixbuf *icon_buf, *tmp_buf;
       guchar *pixels;
@@ -308,12 +352,9 @@ xg_get_image_for_pixmap (f, img, widget, old_widget)
                 }
             }
 
-          g_object_unref (G_OBJECT (gmask));
           g_object_unref (G_OBJECT (mask_buf));
         }
 
-      g_object_unref (G_OBJECT (gpix));
-
       if (! old_widget)
         old_widget = GTK_IMAGE (gtk_image_new_from_pixbuf (icon_buf));
       else
@@ -322,6 +363,9 @@ xg_get_image_for_pixmap (f, img, widget, old_widget)
       g_object_unref (G_OBJECT (icon_buf));
     }
 
+  g_object_unref (G_OBJECT (gpix));
+  if (gmask) g_object_unref (G_OBJECT (gmask));
+
   return GTK_WIDGET (old_widget);
 }
 
diff --git a/src/keymap.c b/src/keymap.c
index fbf1263a71b..4c23977ef41 100644
--- a/src/keymap.c
+++ b/src/keymap.c
@@ -2273,7 +2273,11 @@ push_text_char_description (c, p)
 
 DEFUN ("text-char-description", Ftext_char_description, Stext_char_description, 1, 1, 0,
        doc: /* Return a pretty description of file-character CHARACTER.
-Control characters turn into "^char", etc.  */)
+Control characters turn into "^char", etc.  This differs from
+`single-key-description' which turns them into "C-char".
+Also, this function recognizes the 2**7 bit as the Meta character,
+whereas `single-key-description' uses the 2**27 bit for Meta.
+See Info node `(elisp)Describing Characters' for examples.  */)
      (character)
      Lisp_Object character;
 {
diff --git a/src/lisp.h b/src/lisp.h
index 7e39313a7fc..aba3073dc68 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -1203,7 +1203,10 @@ struct Lisp_Save_Value
   {
     int type : 16;      /* = Lisp_Misc_Save_Value */
     unsigned gcmarkbit : 1;
-    int spacer : 15;
+    int spacer : 14;
+    /* If DOGC is set, POINTER is the address of a memory
+       area containing INTEGER potential Lisp_Objects.  */
+    unsigned int dogc : 1;
     void *pointer;
     int integer;
   };
@@ -2498,6 +2501,7 @@ extern Lisp_Object make_float P_ ((double));
 extern void display_malloc_warning P_ ((void));
 extern int inhibit_garbage_collection P_ ((void));
 extern Lisp_Object make_save_value P_ ((void *, int));
+extern void free_misc P_ ((Lisp_Object));
 extern void free_marker P_ ((Lisp_Object));
 extern void free_cons P_ ((struct Lisp_Cons *));
 extern void init_alloc_once P_ ((void));
@@ -3290,6 +3294,64 @@ extern Lisp_Object Vdirectory_sep_char;
          : Fcons ((el), (check)))))
 
 
+/* SAFE_ALLOCA normally allocates memory on the stack, but if size is
+   larger than MAX_ALLOCA, use xmalloc to avoid overflowing the stack.  */
+
+#define MAX_ALLOCA 16*1024
+
+extern Lisp_Object safe_alloca_unwind (Lisp_Object);
+
+#define USE_SAFE_ALLOCA                 \
+  int sa_count = SPECPDL_INDEX ()
+
+/* SAFE_ALLOCA allocates a simple buffer.  */
+
+#define SAFE_ALLOCA(buf, type, size)                      \
+  do {                                                    \
+    if ((size) < MAX_ALLOCA)                              \
+      buf = (type) alloca (size);                         \
+    else                                                  \
+      {                                                   \
+        buf = (type) xmalloc (size);                      \
+        record_unwind_protect (safe_alloca_unwind,        \
+                               make_save_value (buf, 0)); \
+      }                                                   \
+  } while (0)
+
+/* SAFE_FREE frees xmalloced memory and enables GC as needed.  */
+
+#define SAFE_FREE(size)                 \
+  do {                                  \
+    if ((size) >= MAX_ALLOCA)           \
+      unbind_to (sa_count, Qnil);       \
+  } while (0)
+
+
+/* SAFE_ALLOCA_LISP allocates an array of Lisp_Objects.  */
+
+#define SAFE_ALLOCA_LISP(buf, nelt)                       \
+  do {                                                    \
+    int size_ = (nelt) * sizeof (Lisp_Object);            \
+    if (size_ < MAX_ALLOCA)                               \
+      buf = (Lisp_Object *) alloca (size_);               \
+    else                                                  \
+      {                                                   \
+        Lisp_Object arg_;                                 \
+        buf = (Lisp_Object *) xmalloc (size_);            \
+        arg_ = make_save_value (buf, nelt);               \
+        XSAVE_VALUE (arg_)->dogc = 1;                     \
+        record_unwind_protect (safe_alloca_unwind, arg_); \
+      }                                                   \
+  } while (0)
+
+#define SAFE_FREE_LISP(nelt)                            \
+  do {                                                  \
+    if (((nelt) * sizeof (Lisp_Object)) >= MAX_ALLOCA)  \
+      unbind_to (sa_count, Qnil);                       \
+  } while (0)
+
+
+
 #endif /* EMACS_LISP_H */
 
 /* arch-tag: 9b2ed020-70eb-47ac-94ee-e1c2a5107d5e
diff --git a/src/macterm.c b/src/macterm.c
index 360dccd4f16..04d6ec3be64 100644
--- a/src/macterm.c
+++ b/src/macterm.c
@@ -7018,7 +7018,7 @@ mac_get_emulated_btn ( UInt32 modifiers )
   int result = 0;
   if (!NILP (Vmac_emulate_three_button_mouse)) {
     int cmdIs3 = !EQ (Vmac_emulate_three_button_mouse, Qreverse);
-    if (modifiers & controlKey)
+    if (modifiers & cmdKey)
       result = cmdIs3 ? 2 : 1;
     else if (modifiers & optionKey)
       result = cmdIs3 ? 1 : 2;
@@ -7038,7 +7038,7 @@ mac_event_to_emacs_modifiers (EventRef eventRef)
   if (!NILP (Vmac_emulate_three_button_mouse) &&
       GetEventClass(eventRef) == kEventClassMouse)
     {
-      mods &= ~(optionKey & cmdKey);
+      mods &= ~(optionKey | cmdKey);
     }
   return mac_to_emacs_modifiers (mods);
 }
@@ -7237,40 +7237,6 @@ is_emacs_window (WindowPtr win)
 }
 
 static void
-do_window_activate (WindowPtr win)
-{
-  struct frame *f;
-
-  if (is_emacs_window (win))
-    {
-      f = mac_window_to_frame (win);
-
-      if (f)
-        {
-          x_new_focus_frame (FRAME_MAC_DISPLAY_INFO (f), f);
-          activate_scroll_bars (f);
-        }
-    }
-}
-
-static void
-do_window_deactivate (WindowPtr win)
-{
-  struct frame *f;
-
-  if (is_emacs_window (win))
-    {
-      f = mac_window_to_frame (win);
-
-      if (f == FRAME_MAC_DISPLAY_INFO (f)->x_focus_frame)
-        {
-          x_new_focus_frame (FRAME_MAC_DISPLAY_INFO (f), 0);
-          deactivate_scroll_bars (f);
-        }
-    }
-}
-
-static void
 do_app_resume ()
 {
   WindowPtr wp;
@@ -8084,6 +8050,25 @@ XTread_socket (sd, expected, hold_quit)
       if (!mac_convert_event_ref (eventRef, &er))
         switch (GetEventClass (eventRef))
           {
+          case kEventClassWindow:
+            if (GetEventKind (eventRef) == kEventWindowBoundsChanged) 
+              {
+                WindowPtr window_ptr;
+                GetEventParameter(eventRef, kEventParamDirectObject,
+                                  typeWindowRef, NULL, sizeof(WindowPtr),
+                                  NULL, &window_ptr);
+                f = mac_window_to_frame (window_ptr);
+                if (f && !f->async_iconified)
+                  {
+                    int x, y;
+                    
+                    x_real_positions (f, &x, &y);
+                    f->left_pos = x;
+                    f->top_pos = y;
+                  }
+                SendEventToEventTarget (eventRef, toolbox_dispatcher);
+              }
+            break;
           case kEventClassMouse:
             if (GetEventKind (eventRef) == kEventMouseWheelMoved)
               {
@@ -8135,6 +8120,14 @@ XTread_socket (sd, expected, hold_quit)
             SInt16 part_code;
             int tool_bar_p = 0;
 
+#if USE_CARBON_EVENTS
+            /* This is needed to send mouse events like aqua window
+               buttons to the correct handler.  */
+            if (SendEventToEventTarget (eventRef, toolbox_dispatcher)
+                != eventNotHandledErr)
+              break;
+#endif
+
             if (dpyinfo->grabbed && last_mouse_frame
                 && FRAME_LIVE_P (last_mouse_frame))
               {
@@ -8150,16 +8143,9 @@ XTread_socket (sd, expected, hold_quit)
                     window_ptr = FrontWindow ();
                   }
 
-#if USE_CARBON_EVENTS
-                /* This is needed to send mouse events like aqua
-                   window buttons to the correct handler.  */
-                if (SendEventToEventTarget (eventRef, toolbox_dispatcher)
-                    != eventNotHandledErr)
-                  break;
-
                 if (!is_emacs_window (window_ptr))
                   break;
-#endif
+
                 part_code = FindWindow (er.where, &window_ptr);
               }
 
@@ -8306,6 +8292,18 @@ XTread_socket (sd, expected, hold_quit)
 #else /* not TARGET_API_MAC_CARBON */
                 DragWindow (window_ptr, er.where, &qd.screenBits.bounds);
 #endif /* not TARGET_API_MAC_CARBON */
+                /* Update the frame parameters.  */
+                {
+                  struct frame *f = mac_window_to_frame (window_ptr);
+                  if (f && !f->async_iconified)
+                    {
+                      int x, y;
+                      
+                      x_real_positions (f, &x, &y);
+                      f->left_pos = x;
+                      f->top_pos = y;
+                    }
+                }
                 break;
 
               case inGoAway:
@@ -8393,24 +8391,38 @@ XTread_socket (sd, expected, hold_quit)
                 break;
               }
 
+            if (!is_emacs_window (window_ptr))
+              break;
+            
+            f = mac_window_to_frame (window_ptr);
+
             if ((er.modifiers & activeFlag) != 0)
               {
+                /* A window has been activated */
                 Point mouse_loc = er.where;
 
-                do_window_activate (window_ptr);
+                x_new_focus_frame (dpyinfo, f);
+                activate_scroll_bars (f);
 
                 SetPortWindowPort (window_ptr);
                 GlobalToLocal (&mouse_loc);
-                /* activateEvt counts as mouse movement,
+                /* Window-activated event counts as mouse movement,
                    so update things that depend on mouse position.  */
                 note_mouse_movement (mac_window_to_frame (window_ptr),
                                      &mouse_loc);
               }
             else
               {
-                do_window_deactivate (window_ptr);
+                /* A window has been deactivated */
+                dpyinfo->grabbed = 0;
+
+                if (f == dpyinfo->x_focus_frame)
+                  {
+                    x_new_focus_frame (dpyinfo, 0);
+                    deactivate_scroll_bars (f);
+                  }
+
 
-                f = mac_window_to_frame (window_ptr);
                 if (f == dpyinfo->mouse_face_mouse_frame)
                   {
                     /* If we move outside the frame, then we're
diff --git a/src/print.c b/src/print.c
index 4b94d77e876..287e77edad1 100644
--- a/src/print.c
+++ b/src/print.c
@@ -658,7 +658,7 @@ If variable `temp-buffer-show-function' is non-nil, call it at the end
 to get the buffer displayed instead of just displaying the non-selected
 buffer and calling the hook.  It gets one argument, the buffer to display.
 
-usage: (with-output-to-temp-buffer BUFFNAME BODY ...)  */)
+usage: (with-output-to-temp-buffer BUFNAME BODY ...)  */)
      (args)
      Lisp_Object args;
 {
diff --git a/src/search.c b/src/search.c
index eba74f418ce..bb3f222e2c1 100644
--- a/src/search.c
+++ b/src/search.c
@@ -2543,15 +2543,20 @@ since only regular expressions have distinguished subexpressions.  */)
   /* Adjust search data for this change.  */
   {
     int oldend = search_regs.end[sub];
+    int oldstart = search_regs.start[sub];
     int change = newpoint - search_regs.end[sub];
     int i;
 
     for (i = 0; i < search_regs.num_regs; i++)
       {
-        if (search_regs.start[i] > oldend)
+        if (search_regs.start[i] >= oldend)
           search_regs.start[i] += change;
-        if (search_regs.end[i] > oldend)
+        else if (search_regs.start[i] > oldstart)
+          search_regs.start[i] = oldstart;
+        if (search_regs.end[i] >= oldend)
           search_regs.end[i] += change;
+        else if (search_regs.end[i] > oldstart)
+          search_regs.end[i] = oldstart;
       }
   }
 
@@ -2620,8 +2625,11 @@ All the elements are markers or nil (nil if the Nth pair didn't match)
 if the last match was on a buffer; integers or nil if a string was matched.
 Use `store-match-data' to reinstate the data in this list.
 
-If INTEGERS (the optional first argument) is non-nil, always use integers
-\(rather than markers) to represent buffer positions.
+If INTEGERS (the optional first argument) is non-nil, always use
+integers \(rather than markers) to represent buffer positions.  In
+this case, and if the last match was in a buffer, the buffer will get
+stored as one additional element at the end of the list.
+
 If REUSE is a list, reuse it as part of the value.  If REUSE is long enough
 to hold all the values, and if INTEGERS is non-nil, no consing is done.
 
@@ -2638,10 +2646,10 @@ Return value is undefined if the last search failed.  */)
 
   prev = Qnil;
 
-  data = (Lisp_Object *) alloca ((2 * search_regs.num_regs)
+  data = (Lisp_Object *) alloca ((2 * search_regs.num_regs + 1)
                                  * sizeof (Lisp_Object));
 
-  len = -1;
+  len = 0;
   for (i = 0; i < search_regs.num_regs; i++)
     {
       int start = search_regs.start[i];
@@ -2668,22 +2676,29 @@ Return value is undefined if the last search failed.  */)
             /* last_thing_searched must always be Qt, a buffer, or Qnil.  */
             abort ();
 
-          len = i;
+          len = 2*(i+1);
         }
       else
         data[2 * i] = data [2 * i + 1] = Qnil;
     }
 
+  if (BUFFERP(last_thing_searched)
+      && ! NILP (integers))
+    {
+      XSETBUFFER(data[len], last_thing_searched);
+      len++;
+    }
+
   /* If REUSE is not usable, cons up the values and return them.  */
   if (! CONSP (reuse))
-    return Flist (2 * len + 2, data);
+    return Flist (len, data);
 
   /* If REUSE is a list, store as many value elements as will fit
      into the elements of REUSE.  */
   for (i = 0, tail = reuse; CONSP (tail);
        i++, tail = XCDR (tail))
     {
-      if (i < 2 * len + 2)
+      if (i < len)
         XSETCAR (tail, data[i]);
       else
         XSETCAR (tail, Qnil);
@@ -2692,8 +2707,8 @@ Return value is undefined if the last search failed.  */)
 
   /* If we couldn't fit all value elements into REUSE,
      cons up the rest of them and add them to the end of REUSE.  */
-  if (i < 2 * len + 2)
-    XSETCDR (prev, Flist (2 * len + 2 - i, data + i));
+  if (i < len)
+    XSETCDR (prev, Flist (len - i, data + i));
 
   return reuse;
 }
@@ -2714,8 +2729,8 @@ LIST should have been created by calling `match-data' previously.  */)
   if (!CONSP (list) && !NILP (list))
     list = wrong_type_argument (Qconsp, list);
 
-  /* Unless we find a marker with a buffer in LIST, assume that this
-     match data came from a string.  */
+  /* Unless we find a marker with a buffer or an explicit buffer
+     in LIST, assume that this match data came from a string.  */
   last_thing_searched = Qt;
 
   /* Allocate registers if they don't already exist.  */
@@ -2746,42 +2761,52 @@ LIST should have been created by calling `match-data' previously.  */)
 
         search_regs.num_regs = length;
       }
-  }
-
-  for (i = 0; i < search_regs.num_regs; i++)
-    {
-      marker = Fcar (list);
-      if (NILP (marker))
-        {
-          search_regs.start[i] = -1;
-          list = Fcdr (list);
-        }
-      else
-        {
-          int from;
-
-          if (MARKERP (marker))
-            {
-              if (XMARKER (marker)->buffer == 0)
-                XSETFASTINT (marker, 0);
-              else
-                XSETBUFFER (last_thing_searched, XMARKER (marker)->buffer);
-            }
-
-          CHECK_NUMBER_COERCE_MARKER (marker);
-          from = XINT (marker);
-          list = Fcdr (list);
 
-          marker = Fcar (list);
-          if (MARKERP (marker) && XMARKER (marker)->buffer == 0)
-            XSETFASTINT (marker, 0);
+    for (i = 0;; i++)
+      {
+        marker = Fcar (list);
+        if (BUFFERP(marker))
+          {
+            XSETBUFFER(last_thing_searched, marker);
+            break;
+          }
+        if (i >= length)
+          break;
+        if (NILP (marker))
+          {
+            search_regs.start[i] = -1;
+            list = Fcdr (list);
+          }
+        else
+          {
+            int from;
+            
+            if (MARKERP (marker))
+              {
+                if (XMARKER (marker)->buffer == 0)
+                  XSETFASTINT (marker, 0);
+                else
+                  XSETBUFFER (last_thing_searched, XMARKER (marker)->buffer);
+              }
+            
+            CHECK_NUMBER_COERCE_MARKER (marker);
+            from = XINT (marker);
+            list = Fcdr (list);
+            
+            marker = Fcar (list);
+            if (MARKERP (marker) && XMARKER (marker)->buffer == 0)
+              XSETFASTINT (marker, 0);
+            
+            CHECK_NUMBER_COERCE_MARKER (marker);
+            search_regs.start[i] = from;
+            search_regs.end[i] = XINT (marker);
+          }
+        list = Fcdr (list);
+      }
 
-          CHECK_NUMBER_COERCE_MARKER (marker);
-          search_regs.start[i] = from;
-          search_regs.end[i] = XINT (marker);
-        }
-      list = Fcdr (list);
-    }
+    for (; i < search_regs.num_regs; i++)
+      search_regs.start[i] = -1;
+  }
 
   return Qnil;
 }
@@ -2790,6 +2815,7 @@ LIST should have been created by calling `match-data' previously.  */)
    during the execution of a sentinel or filter. */
 static int search_regs_saved;
 static struct re_registers saved_search_regs;
+static Lisp_Object saved_last_thing_searched;
 
 /* Called from Flooking_at, Fstring_match, search_buffer, Fstore_match_data
    if asynchronous code (filter or sentinel) is running. */
@@ -2801,6 +2827,8 @@ save_search_regs ()
       saved_search_regs.num_regs = search_regs.num_regs;
       saved_search_regs.start = search_regs.start;
       saved_search_regs.end = search_regs.end;
+      saved_last_thing_searched = last_thing_searched;
+      last_thing_searched = Qnil;
       search_regs.num_regs = 0;
       search_regs.start = 0;
       search_regs.end = 0;
@@ -2823,7 +2851,8 @@ restore_match_data ()
       search_regs.num_regs = saved_search_regs.num_regs;
       search_regs.start = saved_search_regs.start;
       search_regs.end = saved_search_regs.end;
-
+      last_thing_searched = saved_last_thing_searched;
+      saved_last_thing_searched = Qnil;
       search_regs_saved = 0;
     }
 }
diff --git a/src/w32fns.c b/src/w32fns.c
index a5f8c4b61f3..d3342f3ad6a 100644
--- a/src/w32fns.c
+++ b/src/w32fns.c
@@ -7749,7 +7749,8 @@ file_dialog_callback (hwnd, msg, wParam, lParam)
     {
       OFNOTIFY * notify = (OFNOTIFY *)lParam;
       /* Detect when the Filter dropdown is changed.  */
-      if (notify->hdr.code == CDN_TYPECHANGE)
+      if (notify->hdr.code == CDN_TYPECHANGE
+          || notify->hdr.code == CDN_INITDONE)
         {
           HWND dialog = GetParent (hwnd);
           HWND edit_control = GetDlgItem (dialog, FILE_NAME_TEXT_FIELD);
@@ -7763,8 +7764,10 @@ file_dialog_callback (hwnd, msg, wParam, lParam)
             }
           else
             {
-              CommDlg_OpenSave_SetControlText (dialog, FILE_NAME_TEXT_FIELD,
-                                               "");
+              /* Don't override default filename on init done.  */
+              if (notify->hdr.code == CDN_TYPECHANGE)
+                CommDlg_OpenSave_SetControlText (dialog,
+                                                 FILE_NAME_TEXT_FIELD, "");
               EnableWindow (edit_control, TRUE);
             }
         }
@@ -7786,6 +7789,7 @@ specified.  Ensure that file exists if MUSTMATCH is non-nil.  */)
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
   char filename[MAX_PATH + 1];
   char init_dir[MAX_PATH + 1];
+  int default_filter_index = 1; /* 1: All Files, 2: Directories only  */
 
   GCPRO5 (prompt, dir, default_filename, mustmatch, file);
   CHECK_STRING (prompt);
@@ -7809,9 +7813,7 @@ specified.  Ensure that file exists if MUSTMATCH is non-nil.  */)
       if (!file_name_only)
         file_name_only = full_path_name;
       else
-        {
-          file_name_only++;
-        }
+        file_name_only++;
 
       strncpy (filename, file_name_only, MAX_PATH);
       filename[MAX_PATH] = '\0';
@@ -7836,6 +7838,15 @@ specified.  Ensure that file exists if MUSTMATCH is non-nil.  */)
     file_details.nMaxFile = sizeof (filename);
     file_details.lpstrInitialDir = init_dir;
     file_details.lpstrTitle = SDATA (prompt);
+
+    /* If prompt starts with Dired, default to directories only.  */
+    /* A bit hacky, but there doesn't seem to be a better way to
+       DTRT for dired.  */
+    if (strncmp (file_details.lpstrTitle, "Dired", 5) == 0)
+      default_filter_index = 2;
+
+    file_details.nFilterIndex = default_filter_index;
+
     file_details.Flags = (OFN_HIDEREADONLY | OFN_NOCHANGEDIR
                           | OFN_EXPLORER | OFN_ENABLEHOOK);
     if (!NILP (mustmatch))
@@ -7848,7 +7859,7 @@ specified.  Ensure that file exists if MUSTMATCH is non-nil.  */)
         dostounix_filename (filename);
         if (file_details.nFilterIndex == 2)
           {
-            /* "Folder Only" selected - strip dummy file name.  */
+            /* "Directories" selected - strip dummy file name.  */
             char * last = strrchr (filename, '/');
             *last = '\0';
           }
diff --git a/src/xdisp.c b/src/xdisp.c
index 41e00893c30..c95493d5aa3 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -6426,6 +6426,7 @@ add_to_log (format, arg1, arg2)
   char *buffer;
   int len;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
+  USE_SAFE_ALLOCA;
 
   /* Do nothing if called asynchronously.  Inserting text into
      a buffer may call after-change-functions and alike and
@@ -6442,10 +6443,12 @@ add_to_log (format, arg1, arg2)
   msg = Fformat (3, args);
 
   len = SBYTES (msg) + 1;
-  buffer = (char *) alloca (len);
+  SAFE_ALLOCA (buffer, char *, len);
   bcopy (SDATA (msg), buffer, len);
 
   message_dolog (buffer, len - 1, 1, 0);
+  SAFE_FREE (len);
+
   UNGCPRO;
 }