Merge from trunk.

5 files changed, 81 insertions, 26 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 71ddf053dac..d477d0574b3 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,4 +1,4 @@
-2012-02-25  Paul Eggert  <eggert@cs.ucla.edu>
+2012-03-02  Paul Eggert  <eggert@cs.ucla.edu>
 
         Fix integer width and related bugs (Bug#9874).
         * alloc.c (pure_bytes_used_lisp, pure_bytes_used_non_lisp):
@@ -788,8 +788,30 @@
         rather than rolling our own approximation.
         (SCROLL_BAR_VEC_SIZE): Remove; not used.
 
+2012-02-29  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (get_overlay_strings_1): Under bidi redisplay, call
+        push_it before setting up the iterator for the first overlay
+        string, even if we have an empty string loaded.
+        (next_overlay_string): If there's an empty string on the iterator
+        stack, pop the stack.  (Bug#10903)
+
+2012-02-25  Paul Eggert  <eggert@cs.ucla.edu>
+
+        Generalize fix for crash due to non-contiguous EMACS_INT (Bug#10780).
+        Suggested by Stefan Monnier in
+        <http://lists.gnu.org/archive/html/emacs-devel/2012-02/msg00692.html>.
+        * alloc.c (widen_to_Lisp_Object): New static function.
+        (mark_memory): Also mark Lisp_Objects by fetching pointer words
+        and widening them to Lisp_Objects.  This would work even if
+        USE_LSB_TAG is defined and wide integers are used, which might
+        happen in a future version of Emacs.
+
 2012-02-25  Chong Yidong  <cyd@gnu.org>
 
+        * fileio.c (Ffile_selinux_context, Fset_file_selinux_context):
+        Doc fix.
+
         * xselect.c (Fx_selection_exists_p): Doc fix.
         (x_clipboard_manager_save_all): Print an informative message
         before saving to clipboard manager.
diff --git a/src/alloc.c b/src/alloc.c
index c4db234aba5..6e4cfa07fa0 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -1582,6 +1582,21 @@ make_number (EMACS_INT n)
 }
 #endif
 
+/* Convert the pointer-sized word P to EMACS_INT while preserving its
+   type and ptr fields.  */
+static Lisp_Object
+widen_to_Lisp_Object (void *p)
+{
+  intptr_t i = (intptr_t) p;
+#ifdef USE_LISP_UNION_TYPE
+  Lisp_Object obj;
+  obj.i = i;
+  return obj;
+#else
+  return i;
+#endif
+}
+
 /***********************************************************************
                           String Allocation
  ***********************************************************************/
@@ -4294,7 +4309,19 @@ mark_memory (void *start, void *end)
 
   for (pp = start; (void *) pp < end; pp++)
     for (i = 0; i < sizeof *pp; i += GC_POINTER_ALIGNMENT)
-      mark_maybe_pointer (*(void **) ((char *) pp + i));
+      {
+        void *w = *(void **) ((char *) pp + i);
+        mark_maybe_pointer (w);
+
+#ifdef USE_LSB_TAG
+        /* A host where a Lisp_Object is wider than a pointer might
+           allocate a Lisp_Object in non-adjacent halves.  If
+           USE_LSB_TAG, the bottom half is not a valid pointer, so
+           widen it to to a Lisp_Object and check it that way.  */
+        if (sizeof w < sizeof (Lisp_Object))
+          mark_maybe_object (widen_to_Lisp_Object (w));
+#endif
+      }
 }
 
 /* setjmp will work with GCC unless NON_SAVING_SETJMP is defined in
diff --git a/src/fileio.c b/src/fileio.c
index b5a4aac6217..3cd44df012b 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -2798,9 +2798,13 @@ See `file-symlink-p' to distinguish symlinks.  */)
 
 DEFUN ("file-selinux-context", Ffile_selinux_context,
        Sfile_selinux_context, 1, 1, 0,
-       doc: /* Return SELinux context of file named FILENAME,
-as a list ("user", "role", "type", "range"). Return (nil, nil, nil, nil)
-if file does not exist, is not accessible, or SELinux is disabled */)
+       doc: /* Return SELinux context of file named FILENAME.
+The return value is a list (USER ROLE TYPE RANGE), where the list
+elements are strings naming the user, role, type, and range of the
+file's SELinux security context.
+
+Return (nil nil nil nil) if the file is nonexistent or inaccessible,
+or if SELinux is disabled, or if Emacs lacks SELinux support.  */)
   (Lisp_Object filename)
 {
   Lisp_Object absname;
@@ -2853,9 +2857,12 @@ if file does not exist, is not accessible, or SELinux is disabled */)
 
 DEFUN ("set-file-selinux-context", Fset_file_selinux_context,
        Sset_file_selinux_context, 2, 2, 0,
-       doc: /* Set SELinux context of file named FILENAME to CONTEXT
-as a list ("user", "role", "type", "range"). Has no effect if SELinux
-is disabled. */)
+       doc: /* Set SELinux context of file named FILENAME to CONTEXT.
+CONTEXT should be a list (USER ROLE TYPE RANGE), where the list
+elements are strings naming the components of a SELinux context.
+
+This function does nothing if SELinux is disabled, or if Emacs was not
+compiled with SELinux support.  */)
   (Lisp_Object filename, Lisp_Object context)
 {
   Lisp_Object absname;
diff --git a/src/lisp.h b/src/lisp.h
index 8c274cddb56..47570ebee74 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -197,22 +197,8 @@ extern int suppress_checking EXTERNALLY_VISIBLE;
 # if defined DECL_ALIGN
 /* On hosts where VALBITS is greater than the pointer width in bits,
    USE_LSB_TAG is:
-
-    a. unnecessary, because the top bits of an EMACS_INT are unused,
-
-    b. slower, because it typically requires extra masking, and
-
-    c. harmful, because it can create Lisp_Object values that are so scrambled
-       that mark_maybe_object cannot decipher them.  mark_maybe_object assumes
-       that EMACS_INT values are contiguous, but a host where EMACS_INT is
-       wider than a pointer might allocate the top half of an EMACS_INT in
-       (say) a 32-bit word on the stack, putting the bottom half in a 32-bit
-       register that is saved elsewhere in a jmp_buf.  When this happens,
-       since USE_LSB_TAG is not defined the bottom half alone is a valid
-       pointer that mark_maybe_pointer can follow; but if USE_LSB_TAG were
-       defined, the bottom half would not be a valid pointer and neither
-       mark_maybe_object nor mark_maybe_pointer would follow it.
-
+    a. unnecessary, because the top bits of an EMACS_INT are unused, and
+    b. slower, because it typically requires extra masking.
    So, define USE_LSB_TAG only on hosts where it might be useful.  */
 #  if UINTPTR_MAX >> VALBITS != 0
 #   define USE_LSB_TAG
diff --git a/src/xdisp.c b/src/xdisp.c
index caf977633d8..c3403031650 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -5159,6 +5159,12 @@ next_overlay_string (struct it *it)
       it->current.overlay_string_index = -1;
       it->n_overlay_strings = 0;
       it->overlay_strings_charpos = -1;
+      /* If there's an empty display string on the stack, pop the
+         stack, to resync the bidi iterator with IT's position.  Such
+         empty strings are pushed onto the stack in
+         get_overlay_strings_1.  */
+      if (it->sp > 0 && STRINGP (it->string) && !SCHARS (it->string))
+        pop_it (it);
 
       /* If we're at the end of the buffer, record that we have
          processed the overlay strings there already, so that
@@ -5461,8 +5467,15 @@ get_overlay_strings_1 (struct it *it, ptrdiff_t charpos, int compute_stop_p)
       xassert (!compute_stop_p || it->sp == 0);
 
       /* When called from handle_stop, there might be an empty display
-         string loaded.  In that case, don't bother saving it.  */
-      if (!STRINGP (it->string) || SCHARS (it->string))
+         string loaded.  In that case, don't bother saving it.  But
+         don't use this optimization with the bidi iterator, since we
+         need the corresponding pop_it call to resync the bidi
+         iterator's position with IT's position, after we are done
+         with the overlay strings.  (The corresponding call to pop_it
+         in case of an empty display string is in
+         next_overlay_string.)  */
+      if (!(!it->bidi_p
+            && STRINGP (it->string) && !SCHARS (it->string)))
         push_it (it, NULL);
 
       /* Set up IT to deliver display elements from the first overlay