Merge from trunk.

7 files changed, 97 insertions, 52 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index d38d2df6b8c..9f86c42d43b 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -101,6 +101,40 @@
 
         * xterm.h (x_check_errors): Add ATTRIBUTE_FORMAT_PRINTF.
 
+2011-08-29  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * image.c (parse_image_spec): Check for nonnegative, not for positive,
+        when checking :margin (Bug#9390).
+        (IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR):
+        Renamed from IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,
+        so that the name doesn't mislead.  All uses changed.
+
+2011-08-28  Johan Bockgård  <bojohan@gnu.org>
+
+        * term.c (init_tty) [HAVE_GPM]: Move mouse settings after
+        set_tty_hooks.
+
+2011-08-27  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (move_it_to): Don't bail out early when reaching
+        position beyond to_charpos, if we are scanning backwards.
+        (move_it_vertically_backward): When DY == 0, make sure we get to
+        the first character in the line after the newline.
+
+2011-08-27  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * ccl.c: Improve and simplify overflow checking (Bug#9196).
+        (ccl_driver): Do not generate an out-of-range pointer.
+        (Fccl_execute_on_string): Remove unnecessary check for
+        integer overflow, noted by Stefan Monnier in
+        <http://lists.gnu.org/archive/html/emacs-devel/2011-08/msg00979.html>.
+        Remove a FIXME that didn't need fixing.
+        Simplify the newly-introduced buffer reallocation code.
+
+2011-08-27  Juanma Barranquero  <lekktu@gmail.com>
+
+        * makefile.w32-in ($(BLD)/alloc.$(O)): Depend on lib/verify.h.
+
 2011-08-26  Paul Eggert  <eggert@cs.ucla.edu>
 
         Integer and memory overflow issues (Bug#9196).
diff --git a/src/bidi.c b/src/bidi.c
index 564d985f890..bb29647ea88 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -910,16 +910,15 @@ bidi_char_at_pos (EMACS_INT bytepos, const unsigned char *s, int unibyte)
    covered characters as a single character, either u+2029 or u+FFFC,
    and return their combined length in CH_LEN and NCHARS.  DISP_POS
    specifies the character position of the next display string, or -1
-   if not yet computed.  DISP_PROP non-zero means that there's really
+   if not yet computed.  When the next character is at or beyond that
+   position, the function updates DISP_POS with the position of the
+   next display string.  DISP_PROP non-zero means that there's really
    a display string at DISP_POS, as opposed to when we searched till
    DISP_POS without finding one.  If DISP_PROP is 2, it means the
    display spec is of the form `(space ...)', which is replaced with
-   u+2029 to handle it as a paragraph separator.  When the next
-   character is at or beyond that position, the function updates
-   DISP_POS with the position of the next display string.  STRING->s
-   is the C string to iterate, or NULL if iterating over a buffer or a
-   Lisp string; in the latter case, STRING->lstring is the Lisp
-   string.  */
+   u+2029 to handle it as a paragraph separator.  STRING->s is the C
+   string to iterate, or NULL if iterating over a buffer or a Lisp
+   string; in the latter case, STRING->lstring is the Lisp string.  */
 static inline int
 bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
                  int *disp_prop, struct bidi_string_data *string,
diff --git a/src/ccl.c b/src/ccl.c
index dc0adae6877..b28a284f70a 100644
--- a/src/ccl.c
+++ b/src/ccl.c
@@ -1770,7 +1770,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
         }
 
       msglen = strlen (msg);
-      if (dst + msglen <= dst_end)
+      if (msglen <= dst_end - dst)
         {
           for (i = 0; i < msglen; i++)
             *dst++ = msg[i];
@@ -2127,37 +2127,25 @@ usage: (ccl-execute-on-string CCL-PROGRAM STATUS STRING &optional CONTINUE UNIBY
       src_size = j;
       while (1)
         {
+          int max_expansion = NILP (unibyte_p) ? MAX_MULTIBYTE_LENGTH : 1;
+          ptrdiff_t offset, shortfall;
           ccl_driver (&ccl, src, destination, src_size, CCL_EXECUTE_BUF_SIZE,
                       Qnil);
           produced_chars += ccl.produced;
+          offset = outp - outbuf;
+          shortfall = ccl.produced * max_expansion - (outbufsize - offset);
+          if (0 < shortfall)
+            {
+              outbuf = xpalloc (outbuf, &outbufsize, shortfall, -1, 1);
+              outp = outbuf + offset;
+            }
           if (NILP (unibyte_p))
             {
-              /* FIXME: Surely this should be buf_magnification instead.
-                 MAX_MULTIBYTE_LENGTH overestimates the storage needed.  */
-              int magnification = MAX_MULTIBYTE_LENGTH;
-
-              ptrdiff_t offset = outp - outbuf;
-              ptrdiff_t shortfall;
-              if (INT_MULTIPLY_OVERFLOW (ccl.produced, magnification))
-                memory_full (SIZE_MAX);
-              shortfall = ccl.produced * magnification - (outbufsize - offset);
-              if (0 < shortfall)
-                {
-                  outbuf = xpalloc (outbuf, &outbufsize, shortfall, -1, 1);
-                  outp = outbuf + offset;
-                }
               for (j = 0; j < ccl.produced; j++)
                 CHAR_STRING_ADVANCE (destination[j], outp);
             }
           else
             {
-              ptrdiff_t offset = outp - outbuf;
-              ptrdiff_t shortfall = ccl.produced - (outbufsize - offset);
-              if (0 < shortfall)
-                {
-                  outbuf = xpalloc (outbuf, &outbufsize, shortfall, -1, 1);
-                  outp = outbuf + offset;
-                }
               for (j = 0; j < ccl.produced; j++)
                 *outp++ = destination[j];
             }
diff --git a/src/image.c b/src/image.c
index d0d28bea582..d6bfc4050ca 100644
--- a/src/image.c
+++ b/src/image.c
@@ -691,7 +691,7 @@ enum image_value_type
   IMAGE_STRING_OR_NIL_VALUE,
   IMAGE_SYMBOL_VALUE,
   IMAGE_POSITIVE_INTEGER_VALUE,
-  IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,
+  IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR,
   IMAGE_NON_NEGATIVE_INTEGER_VALUE,
   IMAGE_ASCENT_VALUE,
   IMAGE_INTEGER_VALUE,
@@ -798,12 +798,12 @@ parse_image_spec (Lisp_Object spec, struct image_keyword *keywords,
             return 0;
           break;
 
-        case IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR:
-          if (RANGED_INTEGERP (1, value, INT_MAX))
+        case IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR:
+          if (RANGED_INTEGERP (0, value, INT_MAX))
             break;
           if (CONSP (value)
-              && RANGED_INTEGERP (1, XCAR (value), INT_MAX)
-              && RANGED_INTEGERP (1, XCDR (value), INT_MAX))
+              && RANGED_INTEGERP (0, XCAR (value), INT_MAX)
+              && RANGED_INTEGERP (0, XCDR (value), INT_MAX))
             break;
           return 0;
 
@@ -2256,7 +2256,7 @@ static const struct image_keyword xbm_format[XBM_LAST] =
   {":foreground",       IMAGE_STRING_OR_NIL_VALUE,              0},
   {":background",       IMAGE_STRING_OR_NIL_VALUE,              0},
   {":ascent",           IMAGE_ASCENT_VALUE,                     0},
-  {":margin",           IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,   0},
+  {":margin",           IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR, 0},
   {":relief",           IMAGE_INTEGER_VALUE,                    0},
   {":conversion",       IMAGE_DONT_CHECK_VALUE_TYPE,            0},
   {":heuristic-mask",   IMAGE_DONT_CHECK_VALUE_TYPE,            0},
@@ -3051,7 +3051,7 @@ static const struct image_keyword xpm_format[XPM_LAST] =
   {":file",             IMAGE_STRING_VALUE,                     0},
   {":data",             IMAGE_STRING_VALUE,                     0},
   {":ascent",           IMAGE_ASCENT_VALUE,                     0},
-  {":margin",           IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,   0},
+  {":margin",           IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR, 0},
   {":relief",           IMAGE_INTEGER_VALUE,                    0},
   {":conversion",       IMAGE_DONT_CHECK_VALUE_TYPE,            0},
   {":heuristic-mask",   IMAGE_DONT_CHECK_VALUE_TYPE,            0},
@@ -4980,7 +4980,7 @@ static const struct image_keyword pbm_format[PBM_LAST] =
   {":file",             IMAGE_STRING_VALUE,                     0},
   {":data",             IMAGE_STRING_VALUE,                     0},
   {":ascent",           IMAGE_ASCENT_VALUE,                     0},
-  {":margin",           IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,   0},
+  {":margin",           IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR, 0},
   {":relief",           IMAGE_INTEGER_VALUE,                    0},
   {":conversion",       IMAGE_DONT_CHECK_VALUE_TYPE,            0},
   {":heuristic-mask",   IMAGE_DONT_CHECK_VALUE_TYPE,            0},
@@ -5395,7 +5395,7 @@ static const struct image_keyword png_format[PNG_LAST] =
   {":data",             IMAGE_STRING_VALUE,                     0},
   {":file",             IMAGE_STRING_VALUE,                     0},
   {":ascent",           IMAGE_ASCENT_VALUE,                     0},
-  {":margin",           IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,   0},
+  {":margin",           IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR, 0},
   {":relief",           IMAGE_INTEGER_VALUE,                    0},
   {":conversion",       IMAGE_DONT_CHECK_VALUE_TYPE,            0},
   {":heuristic-mask",   IMAGE_DONT_CHECK_VALUE_TYPE,            0},
@@ -6015,7 +6015,7 @@ static const struct image_keyword jpeg_format[JPEG_LAST] =
   {":data",             IMAGE_STRING_VALUE,                     0},
   {":file",             IMAGE_STRING_VALUE,                     0},
   {":ascent",           IMAGE_ASCENT_VALUE,                     0},
-  {":margin",           IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,   0},
+  {":margin",           IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR, 0},
   {":relief",           IMAGE_INTEGER_VALUE,                    0},
   {":conversions",      IMAGE_DONT_CHECK_VALUE_TYPE,            0},
   {":heuristic-mask",   IMAGE_DONT_CHECK_VALUE_TYPE,            0},
@@ -6565,7 +6565,7 @@ static const struct image_keyword tiff_format[TIFF_LAST] =
   {":data",             IMAGE_STRING_VALUE,                     0},
   {":file",             IMAGE_STRING_VALUE,                     0},
   {":ascent",           IMAGE_ASCENT_VALUE,                     0},
-  {":margin",           IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,   0},
+  {":margin",           IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR, 0},
   {":relief",           IMAGE_INTEGER_VALUE,                    0},
   {":conversions",      IMAGE_DONT_CHECK_VALUE_TYPE,            0},
   {":heuristic-mask",   IMAGE_DONT_CHECK_VALUE_TYPE,            0},
@@ -7002,7 +7002,7 @@ static const struct image_keyword gif_format[GIF_LAST] =
   {":data",             IMAGE_STRING_VALUE,                     0},
   {":file",             IMAGE_STRING_VALUE,                     0},
   {":ascent",           IMAGE_ASCENT_VALUE,                     0},
-  {":margin",           IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,   0},
+  {":margin",           IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR, 0},
   {":relief",           IMAGE_INTEGER_VALUE,                    0},
   {":conversion",       IMAGE_DONT_CHECK_VALUE_TYPE,            0},
   {":heuristic-mask",   IMAGE_DONT_CHECK_VALUE_TYPE,            0},
@@ -7487,7 +7487,7 @@ static struct image_keyword imagemagick_format[IMAGEMAGICK_LAST] =
     {":data",           IMAGE_STRING_VALUE,                     0},
     {":file",           IMAGE_STRING_VALUE,                     0},
     {":ascent",         IMAGE_ASCENT_VALUE,                     0},
-    {":margin",         IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,   0},
+    {":margin",         IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR, 0},
     {":relief",         IMAGE_INTEGER_VALUE,                    0},
     {":conversion",     IMAGE_DONT_CHECK_VALUE_TYPE,            0},
     {":heuristic-mask", IMAGE_DONT_CHECK_VALUE_TYPE,            0},
@@ -8010,7 +8010,7 @@ static const struct image_keyword svg_format[SVG_LAST] =
   {":data",             IMAGE_STRING_VALUE,                     0},
   {":file",             IMAGE_STRING_VALUE,                     0},
   {":ascent",           IMAGE_ASCENT_VALUE,                     0},
-  {":margin",           IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,   0},
+  {":margin",           IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR, 0},
   {":relief",           IMAGE_INTEGER_VALUE,                    0},
   {":conversion",       IMAGE_DONT_CHECK_VALUE_TYPE,            0},
   {":heuristic-mask",   IMAGE_DONT_CHECK_VALUE_TYPE,            0},
@@ -8405,7 +8405,7 @@ static const struct image_keyword gs_format[GS_LAST] =
   {":loader",           IMAGE_FUNCTION_VALUE,                   0},
   {":bounding-box",     IMAGE_DONT_CHECK_VALUE_TYPE,            1},
   {":ascent",           IMAGE_ASCENT_VALUE,                     0},
-  {":margin",           IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR,   0},
+  {":margin",           IMAGE_NON_NEGATIVE_INTEGER_VALUE_OR_PAIR, 0},
   {":relief",           IMAGE_INTEGER_VALUE,                    0},
   {":conversion",       IMAGE_DONT_CHECK_VALUE_TYPE,            0},
   {":heuristic-mask",   IMAGE_DONT_CHECK_VALUE_TYPE,            0},
diff --git a/src/makefile.w32-in b/src/makefile.w32-in
index 792b66b0e4f..53cb5f857ab 100644
--- a/src/makefile.w32-in
+++ b/src/makefile.w32-in
@@ -469,6 +469,7 @@ $(BLD)/alloc.$(O) : \
         $(SRC)/syssignal.h \
         $(SRC)/w32.h \
         $(NT_INC)/unistd.h \
+        $(GNU_LIB)/verify.h \
         $(BLOCKINPUT_H) \
         $(CHARACTER_H) \
         $(CONFIG_H) \
diff --git a/src/term.c b/src/term.c
index 48d4069e20e..fb07fc4490e 100644
--- a/src/term.c
+++ b/src/term.c
@@ -3138,11 +3138,6 @@ init_tty (const char *name, const char *terminal_type, int must_succeed)
   encode_terminal_src_size = 0;
   encode_terminal_dst_size = 0;
 
-#ifdef HAVE_GPM
-  terminal->mouse_position_hook = term_mouse_position;
-  tty->mouse_highlight.mouse_face_window = Qnil;
-#endif
-
 
 #ifndef DOS_NT
   set_tty_hooks (terminal);
@@ -3402,6 +3397,11 @@ use the Bourne shell command `TERM=... export TERM' (C-shell:\n\
   tty->TN_max_colors = 16;  /* Required to be non-zero for tty-display-color-p */
 #endif  /* DOS_NT */
 
+#ifdef HAVE_GPM
+  terminal->mouse_position_hook = term_mouse_position;
+  tty->mouse_highlight.mouse_face_window = Qnil;
+#endif
+
   terminal->kboard = (KBOARD *) xmalloc (sizeof (KBOARD));
   init_kboard (terminal->kboard);
   KVAR (terminal->kboard, Vwindow_system) = Qnil;
diff --git a/src/xdisp.c b/src/xdisp.c
index b60e3b466a8..2afc8fc9af1 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -8360,7 +8360,14 @@ move_it_to (struct it *it, EMACS_INT to_charpos, int to_x, int to_y, int to_vpos
       else if (BUFFERP (it->object)
                && (it->method == GET_FROM_BUFFER
                    || it->method == GET_FROM_STRETCH)
-               && IT_CHARPOS (*it) >= to_charpos)
+               && IT_CHARPOS (*it) >= to_charpos
+               /* Under bidi iteration, a call to set_iterator_to_next
+                  can scan far beyond to_charpos if the initial
+                  portion of the next line needs to be reordered.  In
+                  that case, give move_it_in_display_line_to another
+                  chance below.  */
+               && !(it->bidi_p
+                    && it->bidi_it.scan_dir == -1))
         skip = MOVE_POS_MATCH_OR_ZV;
       else
         skip = move_it_in_display_line_to (it, to_charpos, -1, MOVE_TO_POS);
@@ -8495,7 +8502,8 @@ move_it_vertically_backward (struct it *it, int dy)
   reseat_1 (it, it->current.pos, 1);
 
   /* We are now surely at a line start.  */
-  it->current_x = it->hpos = 0;
+  it->current_x = it->hpos = 0; /* FIXME: this is incorrect when bidi
+                                   reordering is in effect.  */
   it->continuation_lines_width = 0;
 
   /* Move forward and see what y-distance we moved.  First move to the
@@ -8529,10 +8537,25 @@ move_it_vertically_backward (struct it *it, int dy)
   if (dy == 0)
     {
       /* DY == 0 means move to the start of the screen line.  The
-         value of nlines is > 0 if continuation lines were involved.  */
+         value of nlines is > 0 if continuation lines were involved,
+         or if the original IT position was at start of a line.  */
       RESTORE_IT (it, it, it2data);
       if (nlines > 0)
         move_it_by_lines (it, nlines);
+      /* The above code moves us to some position NLINES down,
+         usually to its first glyph (leftmost in an L2R line), but
+         that's not necessarily the start of the line, under bidi
+         reordering.  We want to get to the character position
+         that is immediately after the newline of the previous
+         line.  */
+      if (it->bidi_p && IT_CHARPOS (*it) > BEGV
+          && FETCH_BYTE (IT_BYTEPOS (*it) - 1) != '\n')
+        {
+          EMACS_INT nl_pos =
+            find_next_newline_no_quit (IT_CHARPOS (*it) - 1, -1);
+
+          move_it_to (it, nl_pos, -1, -1, -1, MOVE_TO_POS);
+        }
       bidi_unshelve_cache (it3data, 1);
     }
   else