merge trunk

29 files changed, 311 insertions, 129 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index fd6f42acb91..372bf383fb8 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -4,6 +4,114 @@
         (BACKWARD_CHAR): Wrap the arg STOP by parenthesis.
         (find_automatic_composition): Mostly rewrite for efficiency.
 
+2011-05-18  Juanma Barranquero  <lekktu@gmail.com>
+
+        * makefile.w32-in: Update dependencies.
+
+2011-05-18  Christoph Scholtes  <cschol2112@googlemail.com>
+
+        * menu.c: Include limits.h (fixes the MS-Windows build broken by
+        revision 104625).
+
+2011-05-18  Paul Eggert  <eggert@cs.ucla.edu>
+
+        Fix some integer overflow issues, such as string length overflow.
+
+        * insdel.c (count_size_as_multibyte): Check for string overflow.
+
+        * character.c (lisp_string_width): Check for string overflow.
+        Use EMACS_INT, not int, for string indexes and lengths; in
+        particular, 2nd arg is now EMACS_INT, not int.  Do not crash if
+        the resulting string length overflows an EMACS_INT; instead,
+        report a string overflow if no precision given.  When checking for
+        precision exhaustion, use a check that cannot possibly have
+        integer overflow.  (Bug#8675)
+        * character.h (lisp_string_width): Adjust to new signature.
+
+        * alloc.c (string_overflow): New function.
+        (Fmake_string): Use it.  This doesn't change behavior, but saves
+        a few bytes and will simplify future changes.
+        * character.c (string_escape_byte8): Likewise.
+        * lisp.h (string_overflow): New decl.
+
+        Fixups, following up to the user-interface timestamp change.
+        * nsterm.m (last_mouse_movement_time, ns_mouse_position): Use Time
+        for UI timestamps, instead of unsigned long.
+        * msdos.c (mouse_get_pos): Likewise.
+        * w32inevt.c (movement_time, w32_console_mouse_position): Likewise.
+        * w32gui.h (Time): Define by including "systime.h" rather than by
+        declaring it ourselves.  (Bug#8664)
+
+        * dispextern.h (struct image): Don't assume time_t <= unsigned long.
+        * image.c (clear_image_cache): Likewise.
+
+        * term.c (term_mouse_position): Don't assume time_t wraparound.
+
+        Be more systematic about user-interface timestamps.
+        Before, the code sometimes used 'Time', sometimes 'unsigned long',
+        and sometimes 'EMACS_UINT', to represent these timestamps.  This
+        change causes it to use 'Time' uniformly, as that's what X uses.
+        This makes the code easier to follow, and makes it easier to catch
+        integer overflow bugs such as Bug#8664.
+        * frame.c (Fmouse_position, Fmouse_pixel_position):
+        Use Time, not unsigned long, for user-interface timestamps.
+        * keyboard.c (last_event_timestamp, kbd_buffer_get_event): Likewise.
+        (button_down_time, make_lispy_position, make_lispy_movement): Likewise.
+        * keyboard.h (last_event_timestamp): Likewise.
+        * menu.c (Fx_popup_menu) [!HAVE_X_WINDOWS]: Likewise.
+        * menu.h (xmenu_show): Likewise.
+        * term.c (term_mouse_position): Likewise.
+        * termhooks.h (struct input_event.timestamp): Likewise.
+        (struct terminal.mouse_position_hook): Likewise.
+        * xmenu.c (create_and_show_popup_menu, xmenu_show): Likewise.
+        * xterm.c (XTmouse_position, x_scroll_bar_report_motion): Likewise.
+        * systime.h (Time): New decl.  Pull it in from <X11/X.h> if
+        HAVE_X_WINDOWS, otherwise define it as unsigned long, which is
+        what it was before.
+        * menu.h, termhooks.h: Include "systime.h", for Time.
+
+        * keyboard.c (make_lispy_event): Fix problem in integer overflow.
+        Don't assume that the difference between two unsigned long values
+        can fit into an integer.  At this point, we know button_down_time
+        <= event->timestamp, so the difference must be nonnegative, so
+        there's no need to cast the result if double-click-time is
+        nonnegative, as it should be; check that it's nonnegative, just in
+        case.  This bug is triggered when events are more than 2**31 ms
+        apart (about 25 days).  (Bug#8664)
+
+        * xselect.c (last_event_timestamp): Remove duplicate decl.
+        (x_own_selection): Remove needless cast to unsigned long.
+
+        * xmenu.c (set_frame_menubar): Use int, not EMACS_UINT, for indexes
+        that always fit in int.  Use a sentinel instead of a counter, to
+        avoid a temp and to allay GCC's concerns about possible int overflow.
+        * frame.h (struct frame): Use int for menu_bar_items_used
+        instead of EMACS_INT, since it always fits in int.
+
+        * menu.c (grow_menu_items): Check for int overflow.
+
+        * xmenu.c (set_frame_menubar): Don't mishandle vectors with no nils.
+
+        * xterm.c: Use EMACS_INT for Emacs modifiers, and int for X modifiers.
+        Before, the code was not consistent.  These values cannot exceed
+        2**31 - 1 so there's no need to make them unsigned.
+        (x_x_to_emacs_modifiers): Accept int and return EMACS_INT.
+        (x_emacs_to_x_modifiers): Accept EMACS_INT and return int.
+        (x_x_to_emacs_modifiers, x_emacs_to_x_modifiers): Reject non-integers
+        as modifiers.
+        * xterm.h (x_x_to_emacs_modifiers): Adjust to signature change.
+
+        * lisp.h (XINT) [USE_LISP_UNION_TYPE]: Cast to EMACS_INT.
+        (XUINT) [USE_LISP_UNION_TYPE]: Cast to EMACS_UINT.
+        Otherwise, GCC 4.6.0 warns about printf (pI, XINT (...)),
+        presumably because the widths might not match.
+
+        * window.c (size_window): Avoid needless test at loop start.
+
+2011-05-18  Courtney Bane  <emacs-bugs-7626@cbane.org>  (tiny change)
+
+        * term.c (Fresume_tty): Restore hooks before reinitializing (bug#8687).
+
 2011-05-12  Drew Adams  <drew.adams@oracle.com>
 
         * textprop.c (Fprevious_single_char_property_change): Doc fix (bug#8655).
@@ -14,8 +122,8 @@
         `width' to `bar_area_x' and `bar_area_width', respectively.
         (x_scroll_run): Take account of fringe background extension.
 
-        * xterm.c (x_draw_fringe_bitmap) [USE_TOOLKIT_SCROLL_BARS]: Rename
-        local vars `left' and `width' to `bar_area_x' and
+        * xterm.c (x_draw_fringe_bitmap) [USE_TOOLKIT_SCROLL_BARS]:
+        Rename local vars `left' and `width' to `bar_area_x' and
         `bar_area_width', respectively.
         (x_scroll_run) [USE_TOOLKIT_SCROLL_BARS]: Take account of fringe
         background extension.
@@ -132,8 +240,8 @@
         * dbusbind.c: Do not use XPNTR on a value that may be an integer.
         Reported by Stefan Monnier in
         <http://lists.gnu.org/archive/html/emacs-devel/2011-04/msg00919.html>.
-        (xd_remove_watch, Fdbus_init_bus, xd_read_queued_messages): Use
-        SYMBOLP-guarded XSYMBOL, not XPNTR.
+        (xd_remove_watch, Fdbus_init_bus, xd_read_queued_messages):
+        Use SYMBOLP-guarded XSYMBOL, not XPNTR.
 
         * lisp.h (EMACS_INTPTR): Remove.  All uses changed to intptr_t.
         (EMACS_UINTPTR): Likewise, with uintptr_t.
@@ -319,8 +427,8 @@
         * callproc.c: Indentation fixup.
 
         * sysdep.c (wait_for_termination_1): Make static.
-        (wait_for_termination, interruptible_wait_for_termination): Move
-        after wait_for_termination_1.
+        (wait_for_termination, interruptible_wait_for_termination):
+        Move after wait_for_termination_1.
 
 2011-05-01  Lars Magne Ingebrigtsen  <larsi@gnus.org>
 
@@ -436,8 +544,8 @@
         (emacs_gnutls_write): Don't use uninitialized rtnval if nbyte <= 0.
 
         * lisp.h: Fix a problem with aliasing and vector headers.  (Bug#8546)
-        GCC 4.6.0 optimizes based on type-based alias analysis.  For
-        example, if b is of type struct buffer * and v of type struct
+        GCC 4.6.0 optimizes based on type-based alias analysis.
+        For example, if b is of type struct buffer * and v of type struct
         Lisp_Vector *, then gcc -O2 was incorrectly assuming that &b->size
         != &v->size, and therefore "v->size = 1; b->size = 2; return
         v->size;" must therefore return 1.  This assumption is incorrect
@@ -457,8 +565,8 @@
         (XSETPSEUDOVECTOR): Rewrite in terms of XSETTYPED_PSEUDOVECTOR.
         (XSETSUBR): Rewrite in terms of XSETTYPED_PSEUDOVECTOR and XSIZE,
         since Lisp_Subr is a special case (no "next" field).
-        (ASIZE): Now uses header.size rather than size.  All
-        previous uses of XVECTOR (foo)->size replaced to use this macro,
+        (ASIZE): Now uses header.size rather than size.
+        All previous uses of XVECTOR (foo)->size replaced to use this macro,
         to avoid the hassle of writing XVECTOR (foo)->header.size.
         (struct vectorlike_header): New type.
         (TYPED_PSEUDOVECTORP): New macro, also specifying the C type of the
@@ -507,7 +615,7 @@
         Break out the floating-point parsing into a new
         function string_to_number, so that Fstring_to_number parses
         floating point numbers consistently with the Lisp reader.
-        (digit_to_number): Moved here from data.c.  Make it static inline.
+        (digit_to_number): Move here from data.c.  Make it static inline.
         (E_CHAR, EXP_INT): Remove, replacing with ...
         (E_EXP): New macro, to solve the "1.0e+" problem mentioned below.
         (string_to_number): New function, replacing isfloat_string.
@@ -744,8 +852,8 @@
         Fix doprnt so it could be used again safely in `verror'.  (Bug#8435)
         * doprnt.c: Include limits.h.
         (SIZE_MAX): New macro.
-        (doprnt): Return a size_t value.  2nd arg is now size_t.  Many
-        local variables are now size_t instead of int or unsigned.
+        (doprnt): Return a size_t value.  2nd arg is now size_t.
+        Many local variables are now size_t instead of int or unsigned.
         Improve overflow protection.  Support `l' modifier for integer
         conversions.  Support %l conversion.  Don't assume an EMACS_INT
         argument for integer conversions and for %c.
@@ -946,8 +1054,8 @@
 
         * syntax.c (update_syntax_table): Declare 2nd argument EMACS_INT.
 
-        * textprop.c (verify_interval_modification, interval_of): Declare
-        arguments EMACS_INT.
+        * textprop.c (verify_interval_modification, interval_of):
+        Declare arguments EMACS_INT.
 
         * intervals.c (adjust_intervals_for_insertion): Declare arguments
         EMACS_INT.
@@ -1198,8 +1306,8 @@
         (free_realized_fontset) #if-0 the body, which does nothing.
         (face_suitable_for_char_p): #if-0, as it's never called.
         * fontset.h (face_suitable_for_char_p): Remove decl.
-        * xfaces.c (face_at_string_position): Use
-        FACE_SUITABLE_FOR_ASCII_CHAR_P, not FACE_SUITABLE_FOR_CHAR_P,
+        * xfaces.c (face_at_string_position):
+        Use FACE_SUITABLE_FOR_ASCII_CHAR_P, not FACE_SUITABLE_FOR_CHAR_P,
         since 0 is always ASCII.
 
         * fns.c (weak_hash_tables): Now static.
@@ -1308,8 +1416,8 @@
         (last_point_position_window): Remove decls.
         * keyboard.c: Make these variables static.
 
-        * coding.h (coding, code_convert_region, encode_coding_gap): Remove
-        decls.
+        * coding.h (coding, code_convert_region, encode_coding_gap):
+        Remove decls.
         * coding.c (Vsjis_coding_system, Vbig5_coding_system):
         (iso_code_class, detect_coding, code_convert_region): Now static.
         (encode_coding_gap): Remove; unused.
@@ -1340,7 +1448,7 @@
         exported only to the debugger.
 
         * atimer.c (alarm_signal_handler, run_all_atimers): Now static.
-        * atimer.h (run_all_atimers): Removed; not exported.
+        * atimer.h (run_all_atimers): Remove; not exported.
 
         font.c: Make copy_font_spec and merge_font_spec ordinary C functions.
         * font.c (copy_font_spec): Rename from Fcopy_font_spec, since it
@@ -1595,8 +1703,8 @@
 
 2011-04-09  Chong Yidong  <cyd@stupidchicken.com>
 
-        * ftfont.c (get_adstyle_property, ftfont_pattern_entity): Use
-        unsigned char, to match FcChar8 type definition.
+        * ftfont.c (get_adstyle_property, ftfont_pattern_entity):
+        Use unsigned char, to match FcChar8 type definition.
 
         * xterm.c (handle_one_xevent):
         * xmenu.c (create_and_show_popup_menu):
@@ -1669,8 +1777,8 @@
 
 2011-04-06  Chong Yidong  <cyd@stupidchicken.com>
 
-        * process.c (Flist_processes): Removed to Lisp.
-        (list_processes_1): Deleted.
+        * process.c (Flist_processes): Remove to Lisp.
+        (list_processes_1): Delete.
 
 2011-04-06  Eli Zaretskii  <eliz@gnu.org>
 
@@ -1928,8 +2036,8 @@
         * callint.c (Fcall_interactively): Preserve lexical-binding mode for
         interactive spec.
 
-        * bytecode.c (Bstack_ref, Bstack_set, Bstack_set2, BdiscardN): New
-        byte-codes.
+        * bytecode.c (Bstack_ref, Bstack_set, Bstack_set2, BdiscardN):
+        New byte-codes.
         (exec_byte_code): New function extracted from Fbyte_code to handle new
         calling convention for byte-code-functions.  Add new byte-codes.
 
@@ -1944,8 +2052,8 @@
 2011-03-31  Eli Zaretskii  <eliz@gnu.org>
 
         * xdisp.c (SCROLL_LIMIT): New macro.
-        (try_scrolling): Use it when setting scroll_limit.  Limit
-        scrolling to 100 screen lines.
+        (try_scrolling): Use it when setting scroll_limit.
+        Limit scrolling to 100 screen lines.
         (redisplay_window): Even when falling back on "recentering",
         position point in the window according to scroll-conservatively,
         scroll-margin, and scroll-*-aggressively variables.  (Bug#6671)
diff --git a/src/alloc.c b/src/alloc.c
index 0bce83bfae7..71ab54bcab5 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -2174,6 +2174,11 @@ compact_small_strings (void)
   current_sblock = tb;
 }
 
+void
+string_overflow (void)
+{
+  error ("Maximum string size exceeded");
+}
 
 DEFUN ("make-string", Fmake_string, Smake_string, 2, 2, 0,
        doc: /* Return a newly created string of length LENGTH, with INIT in each element.
@@ -2206,7 +2211,7 @@ INIT must be an integer that represents a character.  */)
       EMACS_INT string_len = XINT (length);
 
       if (string_len > MOST_POSITIVE_FIXNUM / len)
-        error ("Maximum string size exceeded");
+        string_overflow ();
       nbytes = len * string_len;
       val = make_uninit_multibyte_string (string_len, nbytes);
       p = SDATA (val);
diff --git a/src/character.c b/src/character.c
index 64ea2625abb..b9595f97ec7 100644
--- a/src/character.c
+++ b/src/character.c
@@ -35,6 +35,7 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 
 #include <sys/types.h>
 #include <setjmp.h>
+#include <intprops.h>
 #include "lisp.h"
 #include "character.h"
 #include "buffer.h"
@@ -404,7 +405,7 @@ strwidth (const char *str, EMACS_INT len)
    in *NCHARS and *NBYTES respectively.  */
 
 EMACS_INT
-lisp_string_width (Lisp_Object string, int precision,
+lisp_string_width (Lisp_Object string, EMACS_INT precision,
                    EMACS_INT *nchars, EMACS_INT *nbytes)
 {
   EMACS_INT len = SCHARS (string);
@@ -419,7 +420,7 @@ lisp_string_width (Lisp_Object string, int precision,
 
   while (i < len)
     {
-      int chars, bytes, thiswidth;
+      EMACS_INT chars, bytes, thiswidth;
       Lisp_Object val;
       int cmp_id;
       EMACS_INT ignore, end;
@@ -437,7 +438,11 @@ lisp_string_width (Lisp_Object string, int precision,
           int c;
 
           if (multibyte)
-            c = STRING_CHAR_AND_LENGTH (str + i_byte, bytes);
+            {
+              int cbytes;
+              c = STRING_CHAR_AND_LENGTH (str + i_byte, cbytes);
+              bytes = cbytes;
+            }
           else
             c = str[i_byte], bytes = 1;
           chars = 1;
@@ -455,8 +460,14 @@ lisp_string_width (Lisp_Object string, int precision,
             }
         }
 
-      if (precision > 0
-          && (width + thiswidth > precision))
+      if (precision <= 0)
+        {
+#ifdef emacs
+          if (INT_ADD_OVERFLOW (width, thiswidth))
+            string_overflow ();
+#endif
+        }
+      else if (precision - width < thiswidth)
         {
           *nchars = i;
           *nbytes = i_byte;
@@ -465,7 +476,7 @@ lisp_string_width (Lisp_Object string, int precision,
       i += chars;
       i_byte += bytes;
       width += thiswidth;
-  }
+    }
 
   if (precision > 0)
     {
@@ -672,7 +683,7 @@ parse_str_to_multibyte (const unsigned char *str, EMACS_INT len)
 }
 
 
-/* Convert unibyte text at STR of NBYTES bytes to a multibyte text
+/* Convert unibyte text at STR of BYTES bytes to a multibyte text
    that contains the same single-byte characters.  It actually
    converts all 8-bit characters to multibyte forms.  It is assured
    that we can use LEN bytes at STR as a work area and that is
@@ -823,7 +834,7 @@ string_escape_byte8 (Lisp_Object string)
     {
       if ((MOST_POSITIVE_FIXNUM - nchars) / 3 < byte8_count
           || (MOST_POSITIVE_FIXNUM - nbytes) / 2 < byte8_count)
-        error ("Maximum string size exceeded");
+        string_overflow ();
 
       /* Convert 2-byte sequence of byte8 chars to 4-byte octal.  */
       val = make_uninit_multibyte_string (nchars + byte8_count * 3,
@@ -832,7 +843,8 @@ string_escape_byte8 (Lisp_Object string)
   else
     {
       if ((MOST_POSITIVE_FIXNUM - nchars) / 3 < byte8_count)
-        error ("Maximum string size exceeded");
+        string_overflow ();
+
       /* Convert 1-byte sequence of byte8 chars to 4-byte octal.  */
       val = make_uninit_string (nbytes + byte8_count * 3);
     }
diff --git a/src/character.h b/src/character.h
index 864882db7f6..5877d145d9e 100644
--- a/src/character.h
+++ b/src/character.h
@@ -612,7 +612,7 @@ extern EMACS_INT str_to_unibyte (const unsigned char *, unsigned char *,
 extern EMACS_INT strwidth (const char *, EMACS_INT);
 extern EMACS_INT c_string_width (const unsigned char *, EMACS_INT, int,
                                  EMACS_INT *, EMACS_INT *);
-extern EMACS_INT lisp_string_width (Lisp_Object, int,
+extern EMACS_INT lisp_string_width (Lisp_Object, EMACS_INT,
                                     EMACS_INT *, EMACS_INT *);
 
 extern Lisp_Object Qcharacterp;
diff --git a/src/dispextern.h b/src/dispextern.h
index 72e23e6642a..77c45cf2fc6 100644
--- a/src/dispextern.h
+++ b/src/dispextern.h
@@ -2709,7 +2709,7 @@ struct image
 {
   /* The time in seconds at which the image was last displayed.  Set
      in prepare_image_for_display.  */
-  unsigned long timestamp;
+  time_t timestamp;
 
   /* Pixmaps of the image.  */
   Pixmap pixmap, mask;
diff --git a/src/fns.c b/src/fns.c
index 47ded456c6e..16dc0fe0de2 100644
--- a/src/fns.c
+++ b/src/fns.c
@@ -457,10 +457,10 @@ concat (size_t nargs, Lisp_Object *args,
   Lisp_Object prev;
   int some_multibyte;
   /* When we make a multibyte string, we can't copy text properties
-     while concatinating each string because the length of resulting
-     string can't be decided until we finish the whole concatination.
+     while concatenating each string because the length of resulting
+     string can't be decided until we finish the whole concatenation.
      So, we record strings that have text properties to be copied
-     here, and copy the text properties after the concatination.  */
+     here, and copy the text properties after the concatenation.  */
   struct textprop_rec  *textprops = NULL;
   /* Number of elements in textprops.  */
   int num_textprops = 0;
@@ -704,7 +704,7 @@ concat (size_t nargs, Lisp_Object *args,
                                       make_number (0),
                                       make_number (SCHARS (this)),
                                       Qnil);
-          /* If successive arguments have properites, be sure that the
+          /* If successive arguments have properties, be sure that the
              value of `composition' property be the copy.  */
           if (last_to_end == textprops[argnum].to)
             make_composition_value_copy (props);
@@ -2076,7 +2076,7 @@ internal_equal (register Lisp_Object o1, register Lisp_Object o2, int depth, int
           return compare_window_configurations (o1, o2, 0);
 
         /* Aside from them, only true vectors, char-tables, compiled
-           functions, and fonts (font-spec, font-entity, font-ojbect)
+           functions, and fonts (font-spec, font-entity, font-object)
            are sensible to compare, so eliminate the others now.  */
         if (size & PSEUDOVECTOR_FLAG)
           {
@@ -2782,7 +2782,7 @@ ITEM should be one of the following:
 `months', returning a 12-element vector of month names (locale items MON_n);
 
 `paper', returning a list (WIDTH HEIGHT) for the default paper size,
-  both measured in milimeters (locale items PAPER_WIDTH, PAPER_HEIGHT).
+  both measured in millimeters (locale items PAPER_WIDTH, PAPER_HEIGHT).
 
 If the system can't provide such information through a call to
 `nl_langinfo', or if ITEM isn't from the list above, return nil.
diff --git a/src/frame.c b/src/frame.c
index b106c568e48..ce92a83b86c 100644
--- a/src/frame.c
+++ b/src/frame.c
@@ -1631,7 +1631,7 @@ and returns whatever that function returns.  */)
   enum scroll_bar_part party_dummy;
   Lisp_Object x, y, retval;
   int col, row;
-  unsigned long long_dummy;
+  Time long_dummy;
   struct gcpro gcpro1;
 
   f = SELECTED_FRAME ();
@@ -1676,7 +1676,7 @@ and nil for X and Y.  */)
   Lisp_Object lispy_dummy;
   enum scroll_bar_part party_dummy;
   Lisp_Object x, y;
-  unsigned long long_dummy;
+  Time long_dummy;
 
   f = SELECTED_FRAME ();
   x = y = Qnil;
diff --git a/src/frame.h b/src/frame.h
index e73370340f1..db57b1be980 100644
--- a/src/frame.h
+++ b/src/frame.h
@@ -192,7 +192,7 @@ struct frame
   struct face_cache *face_cache;
 
   /* Number of elements in `menu_bar_vector' that have meaningful data.  */
-  EMACS_INT menu_bar_items_used;
+  int menu_bar_items_used;
 
   /* A buffer to hold the frame's name.  We can't use the Lisp
      string's pointer (`name', above) because it might get relocated.  */
diff --git a/src/image.c b/src/image.c
index 23da03b6264..2562d79a782 100644
--- a/src/image.c
+++ b/src/image.c
@@ -1523,7 +1523,7 @@ clear_image_cache (struct frame *f, Lisp_Object filter)
         {
           /* Free cache based on timestamp.  */
           EMACS_TIME t;
-          unsigned long old;
+          time_t old;
           int delay, nimages = 0;
 
           for (i = 0; i < c->used; ++i)
diff --git a/src/insdel.c b/src/insdel.c
index 2662858c2a1..de9e8aa570a 100644
--- a/src/insdel.c
+++ b/src/insdel.c
@@ -20,6 +20,9 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 
 #include <config.h>
 #include <setjmp.h>
+
+#include <intprops.h>
+
 #include "lisp.h"
 #include "intervals.h"
 #include "buffer.h"
@@ -581,14 +584,19 @@ count_size_as_multibyte (const unsigned char *ptr, EMACS_INT nbytes)
   for (i = 0; i < nbytes; i++)
     {
       unsigned int c = *ptr++;
+      int n;
 
       if (ASCII_CHAR_P (c))
-        outgoing_nbytes++;
+        n = 1;
       else
         {
           c = BYTE8_TO_CHAR (c);
-          outgoing_nbytes += CHAR_BYTES (c);
+          n = CHAR_BYTES (c);
         }
+
+      if (INT_ADD_OVERFLOW (outgoing_nbytes, n))
+        string_overflow ();
+      outgoing_nbytes += n;
     }
 
   return outgoing_nbytes;
diff --git a/src/keyboard.c b/src/keyboard.c
index a94456fce2e..c471a91ebfb 100644
--- a/src/keyboard.c
+++ b/src/keyboard.c
@@ -238,7 +238,7 @@ Lisp_Object internal_last_event_frame;
 
 /* The timestamp of the last input event we received from the X server.
    X Windows wants this for selection ownership.  */
-unsigned long last_event_timestamp;
+Time last_event_timestamp;
 
 static Lisp_Object Qx_set_selection, Qhandle_switch_frame;
 Lisp_Object QPRIMARY;
@@ -4085,7 +4085,7 @@ kbd_buffer_get_event (KBOARD **kbp,
       Lisp_Object bar_window;
       enum scroll_bar_part part;
       Lisp_Object x, y;
-      unsigned long t;
+      Time t;
 
       *kbp = current_kboard;
       /* Note that this uses F to determine which terminal to look at.
@@ -5088,7 +5088,7 @@ static Lisp_Object button_down_location;
 static int last_mouse_button;
 static int last_mouse_x;
 static int last_mouse_y;
-static unsigned long button_down_time;
+static Time button_down_time;
 
 /* The number of clicks in this multiple-click. */
 
@@ -5099,7 +5099,7 @@ static int double_click_count;
 
 static Lisp_Object
 make_lispy_position (struct frame *f, Lisp_Object x, Lisp_Object y,
-                     unsigned long t)
+                     Time t)
 {
   enum window_part part;
   Lisp_Object posn = Qnil;
@@ -5556,9 +5556,9 @@ make_lispy_event (struct input_event *event)
                        && (eabs (XINT (event->y) - last_mouse_y) <= fuzz)
                        && button_down_time != 0
                        && (EQ (Vdouble_click_time, Qt)
-                           || (INTEGERP (Vdouble_click_time)
-                               && ((int)(event->timestamp - button_down_time)
-                                   < XINT (Vdouble_click_time)))));
+                           || (NATNUMP (Vdouble_click_time)
+                               && (event->timestamp - button_down_time
+                                   < XFASTINT (Vdouble_click_time)))));
         }
 
         last_mouse_button = button;
@@ -5742,9 +5742,9 @@ make_lispy_event (struct input_event *event)
                        && (eabs (XINT (event->y) - last_mouse_y) <= fuzz)
                        && button_down_time != 0
                        && (EQ (Vdouble_click_time, Qt)
-                           || (INTEGERP (Vdouble_click_time)
-                               && ((int)(event->timestamp - button_down_time)
-                                   < XINT (Vdouble_click_time)))));
+                           || (NATNUMP (Vdouble_click_time)
+                               && (event->timestamp - button_down_time
+                                   < XFASTINT (Vdouble_click_time)))));
           if (is_double)
             {
               double_click_count++;
@@ -5987,7 +5987,7 @@ make_lispy_event (struct input_event *event)
 
 static Lisp_Object
 make_lispy_movement (FRAME_PTR frame, Lisp_Object bar_window, enum scroll_bar_part part,
-                     Lisp_Object x, Lisp_Object y, unsigned long t)
+                     Lisp_Object x, Lisp_Object y, Time t)
 {
   /* Is it a scroll bar movement?  */
   if (frame && ! NILP (bar_window))
diff --git a/src/keyboard.h b/src/keyboard.h
index 1f5cbd23639..802c99edb5e 100644
--- a/src/keyboard.h
+++ b/src/keyboard.h
@@ -16,7 +16,7 @@ GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 
-#include "systime.h"            /* for EMACS_TIME */
+#include "systime.h"            /* for EMACS_TIME, Time */
 #include "coding.h"             /* for ENCODE_UTF_8 and ENCODE_SYSTEM */
 
 /* Lisp fields in struct keyboard are hidden from most code and accessed
@@ -459,7 +459,7 @@ extern Lisp_Object Qevent_symbol_element_mask;
 
 /* The timestamp of the last input event we received from the X server.
    X Windows wants this for selection ownership.  */
-extern unsigned long last_event_timestamp;
+extern Time last_event_timestamp;
 
 extern int quit_char;
 
diff --git a/src/lisp.h b/src/lisp.h
index 66f5c962be8..b6bf2bdb502 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -470,8 +470,8 @@ enum pvec_type
 
 #define XHASH(a) ((a).i)
 #define XTYPE(a) ((enum Lisp_Type) (a).u.type)
-#define XINT(a) ((a).s.val)
-#define XUINT(a) ((a).u.val)
+#define XINT(a) ((EMACS_INT) (a).s.val)
+#define XUINT(a) ((EMACS_UINT) (a).u.val)
 
 #ifdef USE_LSB_TAG
 
@@ -2710,6 +2710,7 @@ EXFUN (Fmake_vector, 2);
 EXFUN (Fvector, MANY);
 EXFUN (Fmake_symbol, 1);
 EXFUN (Fmake_marker, 0);
+extern void string_overflow (void) NO_RETURN;
 EXFUN (Fmake_string, 2);
 extern Lisp_Object build_string (const char *);
 extern Lisp_Object make_string (const char *, EMACS_INT);
diff --git a/src/makefile.w32-in b/src/makefile.w32-in
index e19a19645f9..71c4fa4c0ac 100644
--- a/src/makefile.w32-in
+++ b/src/makefile.w32-in
@@ -397,6 +397,7 @@ PROCESS_H  = $(SRC)/process.h \
 $(BLD)/alloc.$(O) : \
         $(SRC)/alloc.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(PROCESS_H) \
@@ -432,12 +433,14 @@ $(BLD)/atimer.$(O) : \
 $(BLD)/bidi.$(O) : \
         $(SRC)/bidi.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(SRC)/bidimirror.h \
         $(SRC)/biditype.h \
         $(SRC)/buffer.h \
         $(SRC)/character.h \
         $(SRC)/dispextern.h \
+        $(SRC)/systime.h \
         $(SRC)/w32gui.h
 
 $(BLD)/buffer.$(O) : \
@@ -468,11 +471,13 @@ $(BLD)/buffer.$(O) : \
 $(BLD)/bytecode.$(O) : \
         $(SRC)/bytecode.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(SRC)/buffer.h \
         $(SRC)/character.h \
         $(SRC)/dispextern.h \
         $(SRC)/syntax.h \
+        $(SRC)/systime.h \
         $(SRC)/w32gui.h \
         $(SRC)/window.h
 
@@ -496,6 +501,7 @@ $(BLD)/callint.$(O) : \
 $(BLD)/callproc.$(O) : \
         $(SRC)/callproc.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/sys/file.h \
         $(EMACS_ROOT)/nt/inc/sys/ioctl.h \
         $(EMACS_ROOT)/nt/inc/sys/time.h \
@@ -560,6 +566,7 @@ $(BLD)/ccl.$(O) : \
 $(BLD)/character.$(O) : \
         $(SRC)/character.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/lib/intprops.h \
         $(LISP_H) \
         $(SRC)/buffer.h \
         $(SRC)/character.h \
@@ -609,6 +616,7 @@ $(BLD)/cmds.$(O) : \
 $(BLD)/coding.$(O) : \
         $(SRC)/coding.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(SRC)/buffer.h \
         $(SRC)/ccl.h \
@@ -618,6 +626,7 @@ $(BLD)/coding.$(O) : \
         $(SRC)/composite.h \
         $(SRC)/dispextern.h \
         $(SRC)/frame.h \
+        $(SRC)/systime.h \
         $(SRC)/termhooks.h \
         $(SRC)/w32gui.h \
         $(SRC)/window.h
@@ -625,6 +634,7 @@ $(BLD)/coding.$(O) : \
 $(BLD)/composite.$(O) : \
         $(SRC)/composite.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(SRC)/buffer.h \
         $(SRC)/ccl.h \
@@ -635,6 +645,7 @@ $(BLD)/composite.$(O) : \
         $(SRC)/font.h \
         $(SRC)/frame.h \
         $(SRC)/intervals.h \
+        $(SRC)/systime.h \
         $(SRC)/termhooks.h \
         $(SRC)/w32gui.h \
         $(SRC)/window.h
@@ -684,6 +695,7 @@ $(BLD)/dired.$(O) : \
 $(BLD)/dispnew.$(O) : \
         $(SRC)/dispnew.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(PROCESS_H) \
@@ -758,6 +770,7 @@ $(BLD)/editfns.$(O) : \
 $(BLD)/emacs.$(O) : \
         $(SRC)/emacs.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/sys/file.h \
         $(EMACS_ROOT)/nt/inc/sys/ioctl.h \
         $(EMACS_ROOT)/nt/inc/sys/time.h \
@@ -873,6 +886,7 @@ $(BLD)/fns.$(O) : \
 $(BLD)/font.$(O) : \
         $(SRC)/font.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(SRC)/buffer.h \
         $(SRC)/ccl.h \
@@ -883,6 +897,7 @@ $(BLD)/font.$(O) : \
         $(SRC)/font.h \
         $(SRC)/fontset.h \
         $(SRC)/frame.h \
+        $(SRC)/systime.h \
         $(SRC)/w32gui.h \
         $(SRC)/w32term.h \
         $(SRC)/window.h
@@ -961,6 +976,7 @@ $(BLD)/gmalloc.$(O) : \
 $(BLD)/gnutls.$(O) : \
         $(SRC)/gnutls.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(LISP_H) \
         $(PROCESS_H) \
         $(SRC)/w32.h
@@ -1015,6 +1031,7 @@ $(BLD)/insdel.$(O) : \
         $(SRC)/insdel.c \
         $(CONFIG_H) \
         $(EMACS_ROOT)/nt/inc/sys/time.h \
+        $(EMACS_ROOT)/lib/intprops.h \
         $(LISP_H) \
         $(SRC)/atimer.h \
         $(SRC)/blockinput.h \
@@ -1048,6 +1065,7 @@ $(BLD)/intervals.$(O) : \
 $(BLD)/keyboard.$(O) : \
         $(SRC)/keyboard.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/sys/ioctl.h \
         $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
@@ -1198,6 +1216,7 @@ $(BLD)/w32.$(O) : \
         $(CONFIG_H) \
         $(EMACS_ROOT)/nt/inc/grp.h \
         $(EMACS_ROOT)/nt/inc/pwd.h \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/sys/file.h \
         $(EMACS_ROOT)/nt/inc/sys/socket.h \
         $(EMACS_ROOT)/nt/inc/sys/time.h \
@@ -1243,6 +1262,7 @@ $(BLD)/w32proc.$(O) : \
         $(CONFIG_H) \
         $(EMACS_ROOT)/nt/inc/langinfo.h \
         $(EMACS_ROOT)/nt/inc/nl_types.h \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/sys/file.h \
         $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
@@ -1262,6 +1282,7 @@ $(BLD)/w32proc.$(O) : \
 $(BLD)/w32console.$(O) : \
         $(SRC)/w32console.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(SRC)/character.h \
         $(SRC)/coding.h \
@@ -1269,6 +1290,7 @@ $(BLD)/w32console.$(O) : \
         $(SRC)/dispextern.h \
         $(SRC)/disptab.h \
         $(SRC)/frame.h \
+        $(SRC)/systime.h \
         $(SRC)/termchar.h \
         $(SRC)/termhooks.h \
         $(SRC)/w32gui.h \
@@ -1277,6 +1299,7 @@ $(BLD)/w32console.$(O) : \
 $(BLD)/print.$(O) : \
         $(SRC)/print.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(EMACS_ROOT)/lib/ftoastr.h \
         $(EMACS_ROOT)/lib/intprops.h \
@@ -1305,6 +1328,7 @@ $(BLD)/process.$(O) : \
         $(SRC)/process.c \
         $(CONFIG_H) \
         $(EMACS_ROOT)/nt/inc/netdb.h \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/arpa/inet.h \
         $(EMACS_ROOT)/nt/inc/netinet/in.h \
         $(EMACS_ROOT)/nt/inc/sys/file.h \
@@ -1414,6 +1438,7 @@ $(BLD)/sound.$(O) : \
 $(BLD)/syntax.$(O) : \
         $(SRC)/syntax.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(SRC)/buffer.h \
         $(SRC)/category.h \
@@ -1425,6 +1450,7 @@ $(BLD)/syntax.$(O) : \
         $(SRC)/keymap.h \
         $(SRC)/regex.h \
         $(SRC)/syntax.h \
+        $(SRC)/systime.h \
         $(SRC)/w32gui.h
 
 $(BLD)/sysdep.$(O) : \
@@ -1433,6 +1459,7 @@ $(BLD)/sysdep.$(O) : \
         $(EMACS_ROOT)/nt/inc/grp.h \
         $(EMACS_ROOT)/nt/inc/netdb.h \
         $(EMACS_ROOT)/nt/inc/pwd.h \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/sys/file.h \
         $(EMACS_ROOT)/nt/inc/sys/ioctl.h \
         $(EMACS_ROOT)/nt/inc/sys/socket.h \
@@ -1513,11 +1540,13 @@ $(BLD)/terminal.$(O) : \
 $(BLD)/textprop.$(O) : \
         $(SRC)/textprop.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(SRC)/buffer.h \
         $(SRC)/composite.h \
         $(SRC)/dispextern.h \
         $(SRC)/intervals.h \
+        $(SRC)/systime.h \
         $(SRC)/w32gui.h \
         $(SRC)/window.h
 
@@ -1530,10 +1559,12 @@ $(BLD)/tparam.$(O) : \
 $(BLD)/undo.$(O) : \
         $(SRC)/undo.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(SRC)/buffer.h \
         $(SRC)/commands.h \
         $(SRC)/dispextern.h \
+        $(SRC)/systime.h \
         $(SRC)/w32gui.h \
         $(SRC)/window.h
 
@@ -1577,6 +1608,7 @@ $(BLD)/window.$(O) : \
 $(BLD)/xdisp.$(O) : \
         $(SRC)/xdisp.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(PROCESS_H) \
@@ -1689,6 +1721,7 @@ $(BLD)/w32menu.$(O) : \
 $(BLD)/w32term.$(O) : \
         $(SRC)/w32term.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/unistd.h \
         $(EMACS_ROOT)/nt/inc/sys/ioctl.h \
         $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
@@ -1768,6 +1801,7 @@ $(BLD)/w32xfns.$(O) : \
 $(BLD)/w32font.$(O) : \
         $(SRC)/w32font.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(SRC)/ccl.h \
         $(SRC)/character.h \
@@ -1778,6 +1812,7 @@ $(BLD)/w32font.$(O) : \
         $(SRC)/font.h \
         $(SRC)/fontset.h \
         $(SRC)/frame.h \
+        $(SRC)/systime.h \
         $(SRC)/w32font.h \
         $(SRC)/w32gui.h \
         $(SRC)/w32term.h
@@ -1785,6 +1820,7 @@ $(BLD)/w32font.$(O) : \
 $(BLD)/w32uniscribe.$(O) : \
         $(SRC)/w32uniscribe.c \
         $(CONFIG_H) \
+        $(EMACS_ROOT)/nt/inc/sys/time.h \
         $(LISP_H) \
         $(SRC)/ccl.h \
         $(SRC)/character.h \
@@ -1794,6 +1830,7 @@ $(BLD)/w32uniscribe.$(O) : \
         $(SRC)/font.h \
         $(SRC)/fontset.h \
         $(SRC)/frame.h \
+        $(SRC)/systime.h \
         $(SRC)/w32font.h \
         $(SRC)/w32gui.h \
         $(SRC)/w32term.h
diff --git a/src/menu.c b/src/menu.c
index 7a3edcb6f4f..e4338f349f6 100644
--- a/src/menu.c
+++ b/src/menu.c
@@ -21,6 +21,7 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #include <config.h>
 #include <stdio.h>
 #include <setjmp.h>
+#include <limits.h> /* for INT_MAX */
 
 #include "lisp.h"
 #include "keyboard.h"
@@ -176,6 +177,8 @@ save_menu_items (void)
 static void
 grow_menu_items (void)
 {
+  if ((INT_MAX - MENU_ITEMS_PANE_LENGTH) / 2 < menu_items_allocated)
+    memory_full ();
   menu_items_allocated *= 2;
   menu_items = larger_vector (menu_items, menu_items_allocated, Qnil);
 }
@@ -1145,13 +1148,13 @@ no quit occurs and `x-popup-menu' returns nil.  */)
 #else /* not HAVE_X_WINDOWS */
         Lisp_Object bar_window;
         enum scroll_bar_part part;
-        unsigned long time;
+        Time time;
         void (*mouse_position_hook) (struct frame **, int,
                                      Lisp_Object *,
                                      enum scroll_bar_part *,
                                      Lisp_Object *,
                                      Lisp_Object *,
-                                     unsigned long *) =
+                                     Time *) =
           FRAME_TERMINAL (new_f)->mouse_position_hook;
 
         if (mouse_position_hook)
diff --git a/src/menu.h b/src/menu.h
index c3978dae8eb..451401b42d5 100644
--- a/src/menu.h
+++ b/src/menu.h
@@ -19,6 +19,8 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #ifndef MENU_H
 #define MENU_H
 
+#include "systime.h" /* for Time */
+
 extern void x_set_menu_bar_lines (struct frame *f,
                                   Lisp_Object value,
                                   Lisp_Object oldval);
@@ -48,6 +50,5 @@ extern Lisp_Object w32_menu_show (FRAME_PTR, int, int, int, int,
 extern Lisp_Object ns_menu_show (FRAME_PTR, int, int, int, int,
                                  Lisp_Object, const char **);
 extern Lisp_Object xmenu_show (FRAME_PTR, int, int, int, int,
-                               Lisp_Object, const char **, EMACS_UINT);
+                               Lisp_Object, const char **, Time);
 #endif /* MENU_H */
-
diff --git a/src/msdos.c b/src/msdos.c
index 3dc586e42f5..73804df55cc 100644
--- a/src/msdos.c
+++ b/src/msdos.c
@@ -287,7 +287,7 @@ mouse_button_depressed (int b, int *xp, int *yp)
 void
 mouse_get_pos (FRAME_PTR *f, int insist, Lisp_Object *bar_window,
                enum scroll_bar_part *part, Lisp_Object *x, Lisp_Object *y,
-               unsigned long *time)
+               Time *time)
 {
   int ix, iy;
   Lisp_Object frame, tail;
diff --git a/src/nsterm.m b/src/nsterm.m
index c4756dc83cd..ac9c44a57a9 100644
--- a/src/nsterm.m
+++ b/src/nsterm.m
@@ -158,7 +158,7 @@ long context_menu_value = 0;
 /* display update */
 NSPoint last_mouse_motion_position;
 static NSRect last_mouse_glyph;
-static unsigned long last_mouse_movement_time = 0;
+static Time last_mouse_movement_time = 0;
 static Lisp_Object last_mouse_motion_frame;
 static EmacsScroller *last_mouse_scroll_bar = nil;
 static struct frame *ns_updating_frame;
@@ -1789,7 +1789,7 @@ note_mouse_movement (struct frame *frame, float x, float y)
 static void
 ns_mouse_position (struct frame **fp, int insist, Lisp_Object *bar_window,
                    enum scroll_bar_part *part, Lisp_Object *x, Lisp_Object *y,
-                   unsigned long *time)
+                   Time *time)
 /* --------------------------------------------------------------------------
     External (hook): inform emacs about mouse position and hit parts.
     If a scrollbar is being dragged, set bar_window, part, x, y, time.
@@ -6531,5 +6531,3 @@ baseline level.  The default value is nil.  */);
   /* Tell emacs about this window system. */
   Fprovide (intern ("ns"), Qnil);
 }
-
-
diff --git a/src/systime.h b/src/systime.h
index cb1ea230f7d..db43b26dc5e 100644
--- a/src/systime.h
+++ b/src/systime.h
@@ -30,6 +30,12 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #endif
 #endif
 
+#ifdef HAVE_X_WINDOWS
+# include <X11/X.h>
+#else
+typedef unsigned long Time;
+#endif
+
 #ifdef HAVE_TZNAME
 #ifndef tzname          /* For SGI.  */
 extern char *tzname[];  /* RS6000 and others want it this way.  */
diff --git a/src/term.c b/src/term.c
index c68228cc51a..9205719b5f4 100644
--- a/src/term.c
+++ b/src/term.c
@@ -2595,6 +2595,7 @@ frame's terminal). */)
           FRAME_SET_VISIBLE (XFRAME (t->display_info.tty->top_frame), 1);
         }
 
+      set_tty_hooks (t);
       init_sys_modes (t->display_info.tty);
 
       {
@@ -2698,9 +2699,10 @@ term_mouse_movement (FRAME_PTR frame, Gpm_Event *event)
 static void
 term_mouse_position (FRAME_PTR *fp, int insist, Lisp_Object *bar_window,
                      enum scroll_bar_part *part, Lisp_Object *x,
-                     Lisp_Object *y, unsigned long *timeptr)
+                     Lisp_Object *y, Time *timeptr)
 {
   struct timeval now;
+  Time sec, usec;
 
   *fp = SELECTED_FRAME ();
   (*fp)->mouse_moved = 0;
@@ -2711,7 +2713,9 @@ term_mouse_position (FRAME_PTR *fp, int insist, Lisp_Object *bar_window,
   XSETINT (*x, last_mouse_x);
   XSETINT (*y, last_mouse_y);
   gettimeofday(&now, 0);
-  *timeptr = (now.tv_sec * 1000) + (now.tv_usec / 1000);
+  sec = now.tv_sec;
+  usec = now.tv_usec;
+  *timeptr = (sec * 1000) + (usec / 1000);
 }
 
 /* Prepare a mouse-event in *RESULT for placement in the input queue.
diff --git a/src/termhooks.h b/src/termhooks.h
index 3a49b49aede..34e1364effd 100644
--- a/src/termhooks.h
+++ b/src/termhooks.h
@@ -20,6 +20,8 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* Miscellanea.   */
 
+#include "systime.h" /* for Time */
+
 struct glyph;
 struct frame;
 
@@ -233,7 +235,7 @@ struct input_event
   int modifiers;                /* See enum below for interpretation.  */
 
   Lisp_Object x, y;
-  unsigned long timestamp;
+  Time timestamp;
 
   /* This is padding just to put the frame_or_window field
      past the size of struct selection_input_event.  */
@@ -463,7 +465,7 @@ struct terminal
                                enum scroll_bar_part *part,
                                Lisp_Object *x,
                                Lisp_Object *y,
-                               unsigned long *);
+                               Time *);
 
   /* The window system handling code should set this if the mouse has
      moved since the last call to the mouse_position_hook.  Calling that
diff --git a/src/w32gui.h b/src/w32gui.h
index 936709af181..2ba9cb53e22 100644
--- a/src/w32gui.h
+++ b/src/w32gui.h
@@ -20,6 +20,8 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #define EMACS_W32GUI_H
 #include <windows.h>
 
+#include "systime.h" /* for Time */
+
 /* Local memory management for menus.  */
 #define local_heap (GetProcessHeap ())
 #define local_alloc(n) (HeapAlloc (local_heap, HEAP_ZERO_MEMORY, (n)))
@@ -47,7 +49,6 @@ typedef char * XrmDatabase;
 
 typedef XGCValues * GC;
 typedef COLORREF Color;
-typedef DWORD Time;
 typedef HWND Window;
 typedef HDC Display;  /* HDC so it doesn't conflict with xpm lib.  */
 typedef HCURSOR Cursor;
@@ -147,4 +148,3 @@ typedef struct {
 
 
 #endif /* EMACS_W32GUI_H */
-
diff --git a/src/w32inevt.c b/src/w32inevt.c
index 465f5ccb70f..fddde61663f 100644
--- a/src/w32inevt.c
+++ b/src/w32inevt.c
@@ -45,7 +45,7 @@ extern HANDLE keyboard_handle;
 
 /* Info for last mouse motion */
 static COORD movement_pos;
-static DWORD movement_time;
+static Time movement_time;
 
 /* from w32fns.c */
 extern unsigned int map_keypad_keys (unsigned int, unsigned int);
@@ -544,7 +544,7 @@ w32_console_mouse_position (FRAME_PTR *f,
                             enum scroll_bar_part *part,
                             Lisp_Object *x,
                             Lisp_Object *y,
-                            unsigned long *time)
+                            Time *time)
 {
   BLOCK_INPUT;
 
@@ -756,4 +756,3 @@ w32_console_read_socket (struct terminal *terminal,
   UNBLOCK_INPUT;
   return ret;
 }
-
diff --git a/src/w32menu.c b/src/w32menu.c
index ca763b553cf..e2f6de7f0c8 100644
--- a/src/w32menu.c
+++ b/src/w32menu.c
@@ -146,7 +146,7 @@ otherwise it is "Question". */)
       FRAME_PTR new_f = SELECTED_FRAME ();
       Lisp_Object bar_window;
       enum scroll_bar_part part;
-      unsigned long time;
+      Time time;
       Lisp_Object x, y;
 
       (*mouse_position_hook) (&new_f, 1, &bar_window, &part, &x, &y, &time);
diff --git a/src/window.c b/src/window.c
index 4dbee41c5f4..bc9f31e03e8 100644
--- a/src/window.c
+++ b/src/window.c
@@ -3094,11 +3094,14 @@ size_window (Lisp_Object window, int size, int width_p, int nodelete_p, int firs
       Lisp_Object last_child;
       int child_size;
 
-      for (child = *forward; !NILP (child); child = c->next)
+      child = *forward;
+      do
         {
           c = XWINDOW (child);
           last_child = child;
+          child = c->next;
         }
+      while (!NILP (child));
 
       child_size = WINDOW_TOTAL_SIZE (c, width_p);
       size_window (last_child, size - old_size + child_size,
diff --git a/src/xmenu.c b/src/xmenu.c
index 2a4359fa84a..7d7515a8f25 100644
--- a/src/xmenu.c
+++ b/src/xmenu.c
@@ -240,7 +240,7 @@ for instance using the window manager, then this produces a quit and
       FRAME_PTR new_f = SELECTED_FRAME ();
       Lisp_Object bar_window;
       enum scroll_bar_part part;
-      unsigned long time;
+      Time time;
       Lisp_Object x, y;
 
       (*mouse_position_hook) (&new_f, 1, &bar_window, &part, &x, &y, &time);
@@ -922,7 +922,7 @@ set_frame_menubar (FRAME_PTR f, int first_time, int deep_p)
 #endif
   Lisp_Object items;
   widget_value *wv, *first_wv, *prev_wv = 0;
-  EMACS_UINT i, last_i = 0;
+  int i;
   int *submenu_start, *submenu_end;
   int *submenu_top_level_items, *submenu_n_panes;
 
@@ -966,7 +966,7 @@ set_frame_menubar (FRAME_PTR f, int first_time, int deep_p)
       Lisp_Object *previous_items
         = (Lisp_Object *) alloca (previous_menu_items_used
                                   * sizeof (Lisp_Object));
-      EMACS_UINT subitems;
+      int subitems;
 
       /* If we are making a new widget, its contents are empty,
          do always reinitialize them.  */
@@ -1012,7 +1012,7 @@ set_frame_menubar (FRAME_PTR f, int first_time, int deep_p)
       menu_items = f->menu_bar_vector;
       menu_items_allocated = VECTORP (menu_items) ? ASIZE (menu_items) : 0;
       subitems = ASIZE (items) / 4;
-      submenu_start = (int *) alloca (subitems * sizeof (int));
+      submenu_start = (int *) alloca ((subitems + 1) * sizeof (int));
       submenu_end = (int *) alloca (subitems * sizeof (int));
       submenu_n_panes = (int *) alloca (subitems * sizeof (int));
       submenu_top_level_items = (int *) alloca (subitems * sizeof (int));
@@ -1021,8 +1021,6 @@ set_frame_menubar (FRAME_PTR f, int first_time, int deep_p)
         {
           Lisp_Object key, string, maps;
 
-          last_i = i;
-
           key = XVECTOR (items)->contents[4 * i];
           string = XVECTOR (items)->contents[4 * i + 1];
           maps = XVECTOR (items)->contents[4 * i + 2];
@@ -1039,6 +1037,7 @@ set_frame_menubar (FRAME_PTR f, int first_time, int deep_p)
           submenu_end[i] = menu_items_used;
         }
 
+      submenu_start[i] = -1;
       finish_menu_items ();
 
       /* Convert menu_items into widget_value trees
@@ -1052,7 +1051,7 @@ set_frame_menubar (FRAME_PTR f, int first_time, int deep_p)
       wv->help = Qnil;
       first_wv = wv;
 
-      for (i = 0; i < last_i; i++)
+      for (i = 0; 0 <= submenu_start[i]; i++)
         {
           menu_items_n_panes = submenu_n_panes[i];
           wv = digest_single_submenu (submenu_start[i], submenu_end[i],
@@ -1421,7 +1420,8 @@ pop_down_menu (Lisp_Object arg)
    menu pops down.
    menu_item_selection will be set to the selection.  */
 static void
-create_and_show_popup_menu (FRAME_PTR f, widget_value *first_wv, int x, int y, int for_click, EMACS_UINT timestamp)
+create_and_show_popup_menu (FRAME_PTR f, widget_value *first_wv, int x, int y,
+                            int for_click, Time timestamp)
 {
   int i;
   GtkWidget *menu;
@@ -1465,7 +1465,7 @@ create_and_show_popup_menu (FRAME_PTR f, widget_value *first_wv, int x, int y, i
   gtk_widget_show_all (menu);
 
   gtk_menu_popup (GTK_MENU (menu), 0, 0, pos_func, &popup_x_y, i,
-                  timestamp > 0 ? timestamp : gtk_get_current_event_time());
+                  timestamp ? timestamp : gtk_get_current_event_time ());
 
   record_unwind_protect (pop_down_menu, make_save_value (menu, 0));
 
@@ -1525,7 +1525,7 @@ pop_down_menu (Lisp_Object arg)
    menu_item_selection will be set to the selection.  */
 static void
 create_and_show_popup_menu (FRAME_PTR f, widget_value *first_wv,
-                            int x, int y, int for_click, EMACS_UINT timestamp)
+                            int x, int y, int for_click, Time timestamp)
 {
   int i;
   Arg av[2];
@@ -1599,7 +1599,7 @@ create_and_show_popup_menu (FRAME_PTR f, widget_value *first_wv,
 
 Lisp_Object
 xmenu_show (FRAME_PTR f, int x, int y, int for_click, int keymaps,
-            Lisp_Object title, const char **error_name, EMACS_UINT timestamp)
+            Lisp_Object title, const char **error_name, Time timestamp)
 {
   int i;
   widget_value *wv, *save_wv = 0, *first_wv = 0, *prev_wv = 0;
@@ -2242,7 +2242,7 @@ pop_down_menu (Lisp_Object arg)
 
 Lisp_Object
 xmenu_show (FRAME_PTR f, int x, int y, int for_click, int keymaps,
-            Lisp_Object title, const char **error_name, EMACS_UINT timestamp)
+            Lisp_Object title, const char **error_name, Time timestamp)
 {
   Window root;
   XMenu *menu;
diff --git a/src/xselect.c b/src/xselect.c
index f11fc40fce8..3ddd4c54b49 100644
--- a/src/xselect.c
+++ b/src/xselect.c
@@ -121,10 +121,6 @@ static Lisp_Object Qforeign_selection;
 
 #define SELECTION_QUANTUM(dpy) ((XMaxRequestSize(dpy) << 2) - 100)
 
-/* The timestamp of the last input event Emacs received from the X server.  */
-/* Defined in keyboard.c.  */
-extern unsigned long last_event_timestamp;
-
 /* This is an association list whose elements are of the form
      ( SELECTION-NAME SELECTION-VALUE SELECTION-TIMESTAMP FRAME)
    SELECTION-NAME is a lisp symbol, whose name is the name of an X Atom.
@@ -356,7 +352,7 @@ x_own_selection (Lisp_Object selection_name, Lisp_Object selection_value)
     Lisp_Object selection_data;
     Lisp_Object prev_value;
 
-    selection_time = long_to_cons ((unsigned long) timestamp);
+    selection_time = long_to_cons (timestamp);
     selection_data = list4 (selection_name, selection_value,
                             selection_time, selected_frame);
     prev_value = assq_no_quit (selection_name, Vselection_alist);
diff --git a/src/xterm.c b/src/xterm.c
index 2352f51cfb7..64030a3151d 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -342,7 +342,7 @@ static struct scroll_bar *x_window_to_scroll_bar (Display *, Window);
 static void x_scroll_bar_report_motion (struct frame **, Lisp_Object *,
                                         enum scroll_bar_part *,
                                         Lisp_Object *, Lisp_Object *,
-                                        unsigned long *);
+                                        Time *);
 static void x_handle_net_wm_state (struct frame *, XPropertyEvent *);
 static void x_check_fullscreen (struct frame *);
 static void x_check_expected_move (struct frame *, int, int);
@@ -3637,23 +3637,23 @@ x_find_modifier_meanings (struct x_display_info *dpyinfo)
 /* Convert between the modifier bits X uses and the modifier bits
    Emacs uses.  */
 
-unsigned int
-x_x_to_emacs_modifiers (struct x_display_info *dpyinfo, unsigned int state)
+EMACS_INT
+x_x_to_emacs_modifiers (struct x_display_info *dpyinfo, int state)
 {
-  EMACS_UINT mod_meta = meta_modifier;
-  EMACS_UINT mod_alt  = alt_modifier;
-  EMACS_UINT mod_hyper = hyper_modifier;
-  EMACS_UINT mod_super = super_modifier;
+  EMACS_INT mod_meta = meta_modifier;
+  EMACS_INT mod_alt  = alt_modifier;
+  EMACS_INT mod_hyper = hyper_modifier;
+  EMACS_INT mod_super = super_modifier;
   Lisp_Object tem;
 
   tem = Fget (Vx_alt_keysym, Qmodifier_value);
-  if (! EQ (tem, Qnil)) mod_alt = XUINT (tem);
+  if (INTEGERP (tem)) mod_alt = XINT (tem);
   tem = Fget (Vx_meta_keysym, Qmodifier_value);
-  if (! EQ (tem, Qnil)) mod_meta = XUINT (tem);
+  if (INTEGERP (tem)) mod_meta = XINT (tem);
   tem = Fget (Vx_hyper_keysym, Qmodifier_value);
-  if (! EQ (tem, Qnil)) mod_hyper = XUINT (tem);
+  if (INTEGERP (tem)) mod_hyper = XINT (tem);
   tem = Fget (Vx_super_keysym, Qmodifier_value);
-  if (! EQ (tem, Qnil)) mod_super = XUINT (tem);
+  if (INTEGERP (tem)) mod_super = XINT (tem);
 
 
   return (  ((state & (ShiftMask | dpyinfo->shift_lock_mask)) ? shift_modifier : 0)
@@ -3664,24 +3664,24 @@ x_x_to_emacs_modifiers (struct x_display_info *dpyinfo, unsigned int state)
             | ((state & dpyinfo->hyper_mod_mask)        ? mod_hyper     : 0));
 }
 
-static unsigned int
-x_emacs_to_x_modifiers (struct x_display_info *dpyinfo, unsigned int state)
+static int
+x_emacs_to_x_modifiers (struct x_display_info *dpyinfo, EMACS_INT state)
 {
-  EMACS_UINT mod_meta = meta_modifier;
-  EMACS_UINT mod_alt  = alt_modifier;
-  EMACS_UINT mod_hyper = hyper_modifier;
-  EMACS_UINT mod_super = super_modifier;
+  int mod_meta = meta_modifier;
+  int mod_alt  = alt_modifier;
+  int mod_hyper = hyper_modifier;
+  int mod_super = super_modifier;
 
   Lisp_Object tem;
 
   tem = Fget (Vx_alt_keysym, Qmodifier_value);
-  if (! EQ (tem, Qnil)) mod_alt = XUINT (tem);
+  if (INTEGERP (tem)) mod_alt = XINT (tem);
   tem = Fget (Vx_meta_keysym, Qmodifier_value);
-  if (! EQ (tem, Qnil)) mod_meta = XUINT (tem);
+  if (INTEGERP (tem)) mod_meta = XINT (tem);
   tem = Fget (Vx_hyper_keysym, Qmodifier_value);
-  if (! EQ (tem, Qnil)) mod_hyper = XUINT (tem);
+  if (INTEGERP (tem)) mod_hyper = XINT (tem);
   tem = Fget (Vx_super_keysym, Qmodifier_value);
-  if (! EQ (tem, Qnil)) mod_super = XUINT (tem);
+  if (INTEGERP (tem)) mod_super = XINT (tem);
 
 
   return (  ((state & mod_alt)          ? dpyinfo->alt_mod_mask   : 0)
@@ -3827,7 +3827,7 @@ redo_mouse_highlight (void)
 static void
 XTmouse_position (FRAME_PTR *fp, int insist, Lisp_Object *bar_window,
                   enum scroll_bar_part *part, Lisp_Object *x, Lisp_Object *y,
-                  long unsigned int *timestamp)
+                  Time *timestamp)
 {
   FRAME_PTR f1;
 
@@ -5562,7 +5562,7 @@ x_scroll_bar_note_movement (struct scroll_bar *bar, XEvent *event)
 static void
 x_scroll_bar_report_motion (FRAME_PTR *fp, Lisp_Object *bar_window,
                             enum scroll_bar_part *part, Lisp_Object *x,
-                            Lisp_Object *y, long unsigned int *timestamp)
+                            Lisp_Object *y, Time *timestamp)
 {
   struct scroll_bar *bar = XSCROLL_BAR (last_mouse_scroll_bar);
   Window w = bar->x_window;
diff --git a/src/xterm.h b/src/xterm.h
index fbd638fe73b..1b90b6d8ff4 100644
--- a/src/xterm.h
+++ b/src/xterm.h
@@ -989,8 +989,7 @@ extern void x_mouse_leave (struct x_display_info *);
 #ifdef USE_X_TOOLKIT
 extern int x_dispatch_event (XEvent *, Display *);
 #endif
-extern unsigned int x_x_to_emacs_modifiers (struct x_display_info *,
-                                            unsigned);
+extern EMACS_INT x_x_to_emacs_modifiers (struct x_display_info *, int);
 extern int x_display_pixel_height (struct x_display_info *);
 extern int x_display_pixel_width (struct x_display_info *);