Fix some integer issues in regex-emacs

Also, remove some duplicate comments related to thread.h.
* src/regex-emacs.h (struct re_registers):
* src/regex-emacs.c (SIGN_EXTEND_CHAR): Remove.
(TALLOC, RETALLOC): Remove.  All uses replaced by usual
allocators, which check for integer overflow.
(extract_number): Redo without using ‘unsigned’.
(CHARSET_RANGE_TABLE_EXISTS_P): Clearly return a boolean.
(print_fastmap, print_partial_compiled_pattern, CHECK_INFINITE_LOOP)
(regex_compile, analyze_first, bcmp_translate, mutually_exclusive_p)
(re_match_2_internal):
Use bool for booleans.
(print_fastmap, regex_compile, execute_charset):
Prefer int to unsigned where either will do.
(print_double_string): Prefer ptrdiff_t to ssize_t, since the
latter can in theory be narrower than the former.  Use fwrite
instead of repeated putchar.
(emacs_re_max_failures, fail_stack_type, compile_stack_type)
(re_wctype_parse, regex_compile, re_search, re_search_2)
(re_match_2, re_match_2_internal, re_compile_pattern):
Prefer ptrdiff_t to size_t where either will do.
(union fail_stack_elt, PUSH_FAILURE_REG, POP_FAILURE_REG_OR_COUNT):
Make the integer an intptr_t, not long.
(GET_BUFFER_SPACE, EXTEND_BUFFER, regex_compile):
Use xpalloc to simplify allocation.
(regex_compile): Check for integer overflow when calculating
register numbers.
* src/regex-emacs.c (re_set_registers, re_match_2_internal):
* src/regex-emacs.h (struct re_registers, struct re_pattern_buffer):
* src/search.c (Freplace_match):
Prefer ptrdiff_t to unsigned where either will do.
* src/regex-emacs.h (struct re_pattern_buffer):
Prefer bool_bf to unsigned where either will do.

6 files changed, 161 insertions, 225 deletions

diff --git a/src/eval.c b/src/eval.c
index 09e8fdf4c2a..49d6460e6e4 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -40,10 +40,6 @@ along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.  */
 # define CACHEABLE /* empty */
 #endif
 
-/* Chain of condition and catch handlers currently in effect.  */
-
-/* struct handler *handlerlist; */
-
 /* Non-nil means record all fset's and provide's, to be undone
    if the file being autoloaded is not fully loaded.
    They are recorded by being consed onto the front of Vautoload_queue:
@@ -248,8 +244,6 @@ init_eval_once_for_pdumper (void)
   specpdl = specpdl_ptr = pdlvec + 1;
 }
 
-/* static struct handler handlerlist_sentinel; */
-
 void
 init_eval (void)
 {
diff --git a/src/lisp.h b/src/lisp.h
index 2508e2b804e..178eebed2a5 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -3233,11 +3233,6 @@ union specbinding
     } bt;
   };
 
-/* These 3 are defined as macros in thread.h.  */
-/* extern union specbinding *specpdl; */
-/* extern union specbinding *specpdl_ptr; */
-/* extern ptrdiff_t specpdl_size; */
-
 INLINE ptrdiff_t
 SPECPDL_INDEX (void)
 {
diff --git a/src/regex-emacs.c b/src/regex-emacs.c
index e7849157c85..7629492bcf8 100644
--- a/src/regex-emacs.c
+++ b/src/regex-emacs.c
@@ -151,8 +151,6 @@
 
 #define ISWORD(c) (SYNTAX (c) == Sword)
 
-#define SIGN_EXTEND_CHAR(c) ((signed char) (c))
-
 /* Use alloca instead of malloc.  This is because using malloc in
    re_search* or re_match* could cause memory leaks when C-g is used
    in Emacs (note that SAFE_ALLOCA could also call malloc, but does so
@@ -182,10 +180,6 @@ ptrdiff_t emacs_re_safe_alloca = MAX_ALLOCA;
 #define FIRST_STRING_P(ptr)                                     \
   (size1 && string1 <= (ptr) && (ptr) <= string1 + size1)
 
-/* (Re)Allocate N items of type T using malloc, or fail.  */
-#define TALLOC(n, t) ((t *) xmalloc ((n) * sizeof (t)))
-#define RETALLOC(addr, n, t) ((addr) = (t *) xrealloc (addr, (n) * sizeof (t)))
-
 #define BYTEWIDTH 8 /* In bits.  */
 
 /* Type of source-pattern and string chars.  */
@@ -193,8 +187,8 @@ typedef const unsigned char re_char;
 
 static void re_compile_fastmap (struct re_pattern_buffer *);
 static ptrdiff_t re_match_2_internal (struct re_pattern_buffer *bufp,
-                                     re_char *string1, size_t size1,
-                                     re_char *string2, size_t size2,
+                                     re_char *string1, ptrdiff_t size1,
+                                     re_char *string2, ptrdiff_t size2,
                                      ptrdiff_t pos,
                                      struct re_registers *regs,
                                      ptrdiff_t stop);
@@ -368,8 +362,8 @@ typedef enum
 static int
 extract_number (re_char *source)
 {
-  unsigned leading_byte = SIGN_EXTEND_CHAR (source[1]);
-  return (leading_byte << 8) + source[0];
+  signed char leading_byte = source[1];
+  return leading_byte * 256 + source[0];
 }
 
 /* Same as EXTRACT_NUMBER, except increment SOURCE to after the number.
@@ -416,7 +410,7 @@ extract_number_and_incr (re_char **source)
 #define CHARSET_BITMAP_SIZE(p) ((p)[1] & 0x7F)
 
 /* Nonzero if charset P has range table.  */
-#define CHARSET_RANGE_TABLE_EXISTS_P(p)  ((p)[1] & 0x80)
+#define CHARSET_RANGE_TABLE_EXISTS_P(p)  (((p)[1] & 0x80) != 0)
 
 /* Return the address of range table of charset P.  But not the start
    of table itself, but the before where the number of ranges is
@@ -460,18 +454,18 @@ static int regex_emacs_debug = -100000;
 static void
 print_fastmap (char *fastmap)
 {
-  unsigned was_a_range = 0;
-  unsigned i = 0;
+  bool was_a_range = false;
+  int i = 0;
 
   while (i < (1 << BYTEWIDTH))
     {
       if (fastmap[i++])
         {
-          was_a_range = 0;
+          was_a_range = false;
           putchar (i - 1);
           while (i < (1 << BYTEWIDTH)  &&  fastmap[i])
             {
-              was_a_range = 1;
+              was_a_range = true;
               i++;
             }
           if (was_a_range)
@@ -545,10 +539,10 @@ print_partial_compiled_pattern (re_char *start, re_char *end)
         case charset:
         case charset_not:
           {
-            register int c, last = -100;
-            register int in_range = 0;
+            int c, last = -100;
+            bool in_range = false;
             int length = CHARSET_BITMAP_SIZE (p - 1);
-            int has_range_table = CHARSET_RANGE_TABLE_EXISTS_P (p - 1);
+            bool has_range_table = CHARSET_RANGE_TABLE_EXISTS_P (p - 1);
 
             fprintf (stderr, "/charset [%s",
                      (re_opcode_t) *(p - 1) == charset_not ? "^" : "");
@@ -564,13 +558,13 @@ print_partial_compiled_pattern (re_char *start, re_char *end)
                   if (last + 1 == c && ! in_range)
                     {
                       fprintf (stderr, "-");
-                      in_range = 1;
+                      in_range = true;
                     }
                   /* Have we broken a range?  */
                   else if (last + 1 != c && in_range)
                     {
                       fprintf (stderr, "%c", last);
-                      in_range = 0;
+                      in_range = false;
                     }
 
                   if (! in_range)
@@ -739,7 +733,7 @@ print_compiled_pattern (struct re_pattern_buffer *bufp)
   re_char *buffer = bufp->buffer;
 
   print_partial_compiled_pattern (buffer, buffer + bufp->used);
-  printf ("%zu bytes used/%zu bytes allocated.\n",
+  printf ("%tu bytes used/%tu bytes allocated.\n",
           bufp->used, bufp->allocated);
 
   if (bufp->fastmap_accurate && bufp->fastmap)
@@ -748,7 +742,7 @@ print_compiled_pattern (struct re_pattern_buffer *bufp)
       print_fastmap (bufp->fastmap);
     }
 
-  printf ("re_nsub: %zu\t", bufp->re_nsub);
+  printf ("re_nsub: %tu\t", bufp->re_nsub);
   printf ("regs_alloc: %d\t", bufp->regs_allocated);
   printf ("can_be_null: %d\t", bufp->can_be_null);
   fflush (stdout);
@@ -757,25 +751,20 @@ print_compiled_pattern (struct re_pattern_buffer *bufp)
 
 
 static void
-print_double_string (re_char *where, re_char *string1, ssize_t size1,
-                     re_char *string2, ssize_t size2)
+print_double_string (re_char *where, re_char *string1, ptrdiff_t size1,
+                     re_char *string2, ptrdiff_t size2)
 {
-  ssize_t this_char;
-
   if (where == NULL)
     printf ("(null)");
   else
     {
       if (FIRST_STRING_P (where))
         {
-          for (this_char = where - string1; this_char < size1; this_char++)
-            putchar (string1[this_char]);
-
+          fwrite_unlocked (where, 1, string1 + size1 - where, stdout);
           where = string2;
         }
 
-      for (this_char = where - string2; this_char < size2; this_char++)
-        putchar (string2[this_char]);
+      fwrite_unlocked (where, 1, string2 + size2 - where, stdout);
     }
 }
 
@@ -872,13 +861,12 @@ enum { RE_NREGS = 30 };
    whose default stack limit is 2mb.  In order for a larger
    value to work reliably, you have to try to make it accord
    with the process stack limit.  */
-size_t emacs_re_max_failures = 40000;
+ptrdiff_t emacs_re_max_failures = 40000;
 
 union fail_stack_elt
 {
   re_char *pointer;
-  /* This should be the biggest 'int' that's no bigger than a pointer.  */
-  long integer;
+  intptr_t integer;
 };
 
 typedef union fail_stack_elt fail_stack_elt_t;
@@ -886,9 +874,9 @@ typedef union fail_stack_elt fail_stack_elt_t;
 typedef struct
 {
   fail_stack_elt_t *stack;
-  size_t size;
-  size_t avail; /* Offset of next open position.  */
-  size_t frame; /* Offset of the cur constructed frame.  */
+  ptrdiff_t size;
+  ptrdiff_t avail;      /* Offset of next open position.  */
+  ptrdiff_t frame;      /* Offset of the cur constructed frame.  */
 } fail_stack_type;
 
 #define FAIL_STACK_EMPTY()     (fail_stack.frame == 0)
@@ -967,17 +955,17 @@ typedef struct
 while (REMAINING_AVAIL_SLOTS <= space) {                                \
   if (!GROW_FAIL_STACK (fail_stack))                                    \
     return -2;                                                          \
-  DEBUG_PRINT ("\n  Doubled stack; size now: %zu\n", (fail_stack).size);\
-  DEBUG_PRINT ("         slots available: %zu\n", REMAINING_AVAIL_SLOTS);\
+  DEBUG_PRINT ("\n  Doubled stack; size now: %tu\n", fail_stack.size);  \
+  DEBUG_PRINT ("         slots available: %tu\n", REMAINING_AVAIL_SLOTS);\
 }
 
 /* Push register NUM onto the stack.  */
 #define PUSH_FAILURE_REG(num)                                           \
 do {                                                                    \
   char *destination;                                                    \
-  long n = num;                                                         \
+  intptr_t n = num;                                                     \
   ENSURE_FAIL_STACK(3);                                                 \
-  DEBUG_PRINT ("    Push reg %ld (spanning %p -> %p)\n",                \
+  DEBUG_PRINT ("    Push reg %"PRIdPTR" (spanning %p -> %p)\n",         \
                n, regstart[n], regend[n]);                              \
   PUSH_FAILURE_POINTER (regstart[n]);                                   \
   PUSH_FAILURE_POINTER (regend[n]);                                     \
@@ -1002,7 +990,7 @@ do {									\
 /* Pop a saved register off the stack.  */
 #define POP_FAILURE_REG_OR_COUNT()                                      \
 do {                                                                    \
-  long pfreg = POP_FAILURE_INT ();                                      \
+  intptr_t pfreg = POP_FAILURE_INT ();                                  \
   if (pfreg == -1)                                                      \
     {                                                                   \
       /* It's a counter.  */                                            \
@@ -1010,7 +998,7 @@ do {									\
       unsigned char *ptr = (unsigned char *) POP_FAILURE_POINTER ();    \
       pfreg = POP_FAILURE_INT ();                                       \
       STORE_NUMBER (ptr, pfreg);                                        \
-      DEBUG_PRINT ("     Pop counter %p = %ld\n", ptr, pfreg);          \
+      DEBUG_PRINT ("     Pop counter %p = %"PRIdPTR"\n", ptr, pfreg);   \
     }                                                                   \
   else                                                                  \
     {                                                                   \
@@ -1034,7 +1022,7 @@ do {									\
                && FAILURE_PAT (failure) <= bufp->buffer + bufp->used);  \
       if (FAILURE_PAT (failure) == pat_cur)                             \
         {                                                               \
-          cycle = 1;                                                    \
+          cycle = true;                                                 \
           break;                                                        \
         }                                                               \
       DEBUG_PRINT ("  Other pattern: %p\n", FAILURE_PAT (failure));     \
@@ -1057,14 +1045,14 @@ do {									\
   char *destination;                                                    \
   DEBUG_STATEMENT (nfailure_points_pushed++);                           \
   DEBUG_PRINT ("\nPUSH_FAILURE_POINT:\n");                              \
-  DEBUG_PRINT ("  Before push, next avail: %zu\n", (fail_stack).avail); \
-  DEBUG_PRINT ("                        size: %zu\n", (fail_stack).size);\
+  DEBUG_PRINT ("  Before push, next avail: %tu\n", fail_stack.avail);   \
+  DEBUG_PRINT ("                        size: %tu\n", fail_stack.size); \
                                                                         \
   ENSURE_FAIL_STACK (NUM_NONREG_ITEMS);                                 \
                                                                         \
   DEBUG_PRINT ("\n");                                                   \
                                                                         \
-  DEBUG_PRINT ("  Push frame index: %zu\n", fail_stack.frame);          \
+  DEBUG_PRINT ("  Push frame index: %tu\n", fail_stack.frame);          \
   PUSH_FAILURE_INT (fail_stack.frame);                                  \
                                                                         \
   DEBUG_PRINT ("  Push string %p: \"", string_place);                   \
@@ -1106,8 +1094,8 @@ do {									\
                                                                         \
   /* Remove failure points and point to how many regs pushed.  */       \
   DEBUG_PRINT ("POP_FAILURE_POINT:\n");                                 \
-  DEBUG_PRINT ("  Before pop, next avail: %zu\n", fail_stack.avail);    \
-  DEBUG_PRINT ("                     size: %zu\n", fail_stack.size);    \
+  DEBUG_PRINT ("  Before pop, next avail: %tu\n", fail_stack.avail);    \
+  DEBUG_PRINT ("                     size: %tu\n", fail_stack.size);    \
                                                                         \
   /* Pop the saved registers.  */                                       \
   while (fail_stack.frame < fail_stack.avail)                           \
@@ -1141,7 +1129,7 @@ do {									\
 
 /* Subroutine declarations and macros for regex_compile.  */
 
-static reg_errcode_t regex_compile (re_char *pattern, size_t size,
+static reg_errcode_t regex_compile (re_char *pattern, ptrdiff_t size,
                                     bool posix_backtracking,
                                     const char *whitespace_regexp,
                                     struct re_pattern_buffer *bufp);
@@ -1155,7 +1143,7 @@ static bool at_begline_loc_p (re_char *pattern, re_char *p);
 static bool at_endline_loc_p (re_char *p, re_char *pend);
 static re_char *skip_one_char (re_char *p);
 static int analyze_first (re_char *p, re_char *pend,
-                          char *fastmap, const int multibyte);
+                          char *fastmap, bool multibyte);
 
 /* Fetch the next character in the uncompiled pattern, with no
    translation.  */
@@ -1178,8 +1166,8 @@ static int analyze_first (re_char *p, re_char *pend,
 
 /* Ensure at least N more bytes of space in buffer.  */
 #define GET_BUFFER_SPACE(n)                                             \
-    while ((size_t) (b - bufp->buffer + (n)) > bufp->allocated)         \
-      EXTEND_BUFFER ()
+    if (bufp->buffer + bufp->allocated - b < (n))                       \
+      EXTEND_BUFFER ((n) - (bufp->buffer + bufp->allocated - b))
 
 /* Ensure one more byte of buffer space and then add C to it.  */
 #define BUF_PUSH(c)                                                     \
@@ -1221,18 +1209,16 @@ static int analyze_first (re_char *p, re_char *pend,
    be too small, many things would have to change.  */
 # define MAX_BUF_SIZE (1 << 15)
 
-/* Extend the buffer by twice its current size via realloc and
+/* Extend the buffer by at least N bytes via realloc and
    reset the pointers that pointed into the old block to point to the
    correct places in the new one.  If extending the buffer results in it
    being larger than MAX_BUF_SIZE, then flag memory exhausted.  */
-#define EXTEND_BUFFER()                                                 \
+#define EXTEND_BUFFER(n)                                                \
   do {                                                                  \
+    ptrdiff_t requested_extension = n;                                  \
     unsigned char *old_buffer = bufp->buffer;                           \
-    if (bufp->allocated == MAX_BUF_SIZE)                                \
+    if (MAX_BUF_SIZE - bufp->allocated < requested_extension)           \
       return REG_ESIZE;                                                 \
-    bufp->allocated <<= 1;                                              \
-    if (bufp->allocated > MAX_BUF_SIZE)                                 \
-      bufp->allocated = MAX_BUF_SIZE;                                   \
     ptrdiff_t b_off = b - old_buffer;                                   \
     ptrdiff_t begalt_off = begalt - old_buffer;                         \
     bool fixup_alt_jump_set = !!fixup_alt_jump;                         \
@@ -1242,7 +1228,8 @@ static int analyze_first (re_char *p, re_char *pend,
     if (fixup_alt_jump_set) fixup_alt_jump_off = fixup_alt_jump - old_buffer; \
     if (laststart_set) laststart_off = laststart - old_buffer;          \
     if (pending_exact_set) pending_exact_off = pending_exact - old_buffer; \
-    RETALLOC (bufp->buffer, bufp->allocated, unsigned char);            \
+    bufp->buffer = xpalloc (bufp->buffer, &bufp->allocated,             \
+                            requested_extension, MAX_BUF_SIZE, 1);      \
     unsigned char *new_buffer = bufp->buffer;                           \
     b = new_buffer + b_off;                                             \
     begalt = new_buffer + begalt_off;                                   \
@@ -1264,9 +1251,8 @@ typedef int regnum_t;
 
 /* Macros for the compile stack.  */
 
-/* Since offsets can go either forwards or backwards, this type needs to
-   be able to hold values from -(MAX_BUF_SIZE - 1) to MAX_BUF_SIZE - 1.  */
 typedef long pattern_offset_t;
+verify (LONG_MIN <= -(MAX_BUF_SIZE - 1) && MAX_BUF_SIZE - 1 <= LONG_MAX);
 
 typedef struct
 {
@@ -1280,8 +1266,8 @@ typedef struct
 typedef struct
 {
   compile_stack_elt_t *stack;
-  size_t size;
-  size_t avail;                 /* Offset of next open position.  */
+  ptrdiff_t size;
+  ptrdiff_t avail;              /* Offset of next open position.  */
 } compile_stack_type;
 
 
@@ -1499,7 +1485,7 @@ struct range_table_work_area
    The function can be used on ASCII and multibyte (UTF-8-encoded) strings.
  */
 re_wctype_t
-re_wctype_parse (const unsigned char **strp, unsigned limit)
+re_wctype_parse (const unsigned char **strp, ptrdiff_t limit)
 {
   const char *beg = (const char *)*strp, *it;
 
@@ -1677,13 +1663,13 @@ do {									\
      'buffer' is the compiled pattern;
      'syntax' is set to SYNTAX;
      'used' is set to the length of the compiled pattern;
-     'fastmap_accurate' is zero;
+     'fastmap_accurate' is false;
      're_nsub' is the number of subexpressions in PATTERN;
 
    The 'fastmap' field is neither examined nor set.  */
 
 static reg_errcode_t
-regex_compile (re_char *pattern, size_t size,
+regex_compile (re_char *pattern, ptrdiff_t size,
                bool posix_backtracking,
                const char *whitespace_regexp,
                struct re_pattern_buffer *bufp)
@@ -1747,16 +1733,15 @@ regex_compile (re_char *pattern, size_t size,
   DEBUG_PRINT ("\nCompiling pattern: ");
   if (regex_emacs_debug > 0)
     {
-      size_t debug_count;
-
-      for (debug_count = 0; debug_count < size; debug_count++)
+      for (ptrdiff_t debug_count = 0; debug_count < size; debug_count++)
         putchar (pattern[debug_count]);
       putchar ('\n');
     }
 #endif
 
   /* Initialize the compile stack.  */
-  compile_stack.stack = TALLOC (INIT_COMPILE_STACK_SIZE, compile_stack_elt_t);
+  compile_stack.stack = xmalloc (INIT_COMPILE_STACK_SIZE
+                                 * sizeof *compile_stack.stack);
   compile_stack.size = INIT_COMPILE_STACK_SIZE;
   compile_stack.avail = 0;
 
@@ -1764,8 +1749,8 @@ regex_compile (re_char *pattern, size_t size,
   range_table_work.allocated = 0;
 
   /* Initialize the pattern buffer.  */
-  bufp->fastmap_accurate = 0;
-  bufp->used_syntax = 0;
+  bufp->fastmap_accurate = false;
+  bufp->used_syntax = false;
 
   /* Set 'used' to zero, so that if we return an error, the pattern
      printer (for debugging) will think there's no pattern.  We reset it
@@ -1776,16 +1761,9 @@ regex_compile (re_char *pattern, size_t size,
 
   if (bufp->allocated == 0)
     {
-      if (bufp->buffer)
-        { /* If zero allocated, but buffer is non-null, try to realloc
-             enough space.  This loses if buffer's address is bogus, but
-             that is the user's responsibility.  */
-          RETALLOC (bufp->buffer, INIT_BUF_SIZE, unsigned char);
-        }
-      else
-        { /* Caller did not allocate a buffer.  Do it for them.  */
-          bufp->buffer = TALLOC (INIT_BUF_SIZE, unsigned char);
-        }
+      /* This loses if BUFP->buffer is bogus, but that is the user's
+         responsibility.  */
+      bufp->buffer = xrealloc (bufp->buffer, INIT_BUF_SIZE);
       bufp->allocated = INIT_BUF_SIZE;
     }
 
@@ -1905,10 +1883,10 @@ regex_compile (re_char *pattern, size_t size,
                 if (many_times_ok)
                   {
                     bool simple = skip_one_char (laststart) == b;
-                    size_t startoffset = 0;
+                    ptrdiff_t startoffset = 0;
                     re_opcode_t ofj =
                       /* Check if the loop can match the empty string.  */
-                      (simple || !analyze_first (laststart, b, NULL, 0))
+                      (simple || !analyze_first (laststart, b, NULL, false))
                       ? on_failure_jump : on_failure_jump_loop;
                     eassert (skip_one_char (laststart) <= b);
 
@@ -1955,7 +1933,7 @@ regex_compile (re_char *pattern, size_t size,
                 GET_BUFFER_SPACE (7); /* We might use less.  */
                 if (many_times_ok)
                   {
-                    bool emptyp = analyze_first (laststart, b, NULL, 0);
+                    bool emptyp = !!analyze_first (laststart, b, NULL, false);
 
                     /* The non-greedy multiple match looks like
                        a repeat..until: we only need a conditional jump
@@ -2073,7 +2051,7 @@ regex_compile (re_char *pattern, size_t size,
                        content of the syntax-table is not hardcoded in the
                        range_table.  SPACE and WORD are the two exceptions.  */
                     if ((1 << cc) & ((1 << RECC_SPACE) | (1 << RECC_WORD)))
-                      bufp->used_syntax = 1;
+                      bufp->used_syntax = true;
 
                     /* Repeat the loop. */
                     continue;
@@ -2180,7 +2158,7 @@ regex_compile (re_char *pattern, size_t size,
             {
             case '(':
               {
-                int shy = 0;
+                bool shy = false;
                 regnum_t regnum = 0;
                 if (p+1 < pend)
                   {
@@ -2193,7 +2171,7 @@ regex_compile (re_char *pattern, size_t size,
                             PATFETCH (c);
                             switch (c)
                               {
-                              case ':': shy = 1; break;
+                              case ':': shy = true; break;
                               case '0':
                                 /* An explicitly specified regnum must start
                                    with non-0. */
@@ -2202,7 +2180,11 @@ regex_compile (re_char *pattern, size_t size,
                                 FALLTHROUGH;
                               case '1': case '2': case '3': case '4':
                               case '5': case '6': case '7': case '8': case '9':
-                                regnum = 10*regnum + (c - '0'); break;
+                                if (INT_MULTIPLY_WRAPV (regnum, 10, &regnum)
+                                    || INT_ADD_WRAPV (regnum, c - '0',
+                                                      &regnum))
+                                  FREE_STACK_RETURN (REG_ESIZE);
+                                break;
                               default:
                                 /* Only (?:...) is supported right now. */
                                 FREE_STACK_RETURN (REG_BADPAT);
@@ -2215,7 +2197,7 @@ regex_compile (re_char *pattern, size_t size,
                   regnum = ++bufp->re_nsub;
                 else if (regnum)
                   { /* It's actually not shy, but explicitly numbered.  */
-                    shy = 0;
+                    shy = false;
                     if (regnum > bufp->re_nsub)
                       bufp->re_nsub = regnum;
                     else if (regnum > bufp->re_nsub
@@ -2232,11 +2214,9 @@ regex_compile (re_char *pattern, size_t size,
                   regnum = - bufp->re_nsub;
 
                 if (COMPILE_STACK_FULL)
-                  {
-                    RETALLOC (compile_stack.stack, compile_stack.size << 1,
-                              compile_stack_elt_t);
-                    compile_stack.size <<= 1;
-                  }
+                  compile_stack.stack
+                    = xpalloc (compile_stack.stack, &compile_stack.size,
+                               1, -1, sizeof *compile_stack.stack);
 
                 /* These are the values to restore when we hit end of this
                    group.  They are all relative offsets, so that if the
@@ -2393,9 +2373,8 @@ regex_compile (re_char *pattern, size_t size,
                 else
                   { /* If the upper bound is > 1, we need to insert
                        more at the end of the loop.  */
-                    unsigned int nbytes = (upper_bound < 0 ? 3
-                                           : upper_bound > 1 ? 5 : 0);
-                    unsigned int startoffset = 0;
+                    int nbytes = upper_bound < 0 ? 3 : upper_bound > 1 ? 5 : 0;
+                    int startoffset = 0;
 
                     GET_BUFFER_SPACE (20); /* We might use less.  */
 
@@ -2799,8 +2778,7 @@ group_in_compile_stack (compile_stack_type compile_stack, regnum_t regnum)
    Return -1 if fastmap was not updated accurately.  */
 
 static int
-analyze_first (re_char *p, re_char *pend, char *fastmap,
-               const int multibyte)
+analyze_first (re_char *p, re_char *pend, char *fastmap, bool multibyte)
 {
   int j, k;
   bool not;
@@ -3102,6 +3080,8 @@ re_compile_fastmap (struct re_pattern_buffer *bufp)
   eassert (fastmap && bufp->buffer);
 
   memset (fastmap, 0, 1 << BYTEWIDTH);  /* Assume nothing's valid.  */
+
+  /* FIXME: Is the following assignment correct even when ANALYSIS < 0?  */
   bufp->fastmap_accurate = 1;       /* It will be when we're done.  */
 
   analysis = analyze_first (bufp->buffer, bufp->buffer + bufp->used,
@@ -3124,7 +3104,7 @@ re_compile_fastmap (struct re_pattern_buffer *bufp)
 
 void
 re_set_registers (struct re_pattern_buffer *bufp, struct re_registers *regs,
-                  unsigned int num_regs, ptrdiff_t *starts, ptrdiff_t *ends)
+                  ptrdiff_t num_regs, ptrdiff_t *starts, ptrdiff_t *ends)
 {
   if (num_regs)
     {
@@ -3147,7 +3127,7 @@ re_set_registers (struct re_pattern_buffer *bufp, struct re_registers *regs,
    doesn't let you say where to stop matching. */
 
 ptrdiff_t
-re_search (struct re_pattern_buffer *bufp, const char *string, size_t size,
+re_search (struct re_pattern_buffer *bufp, const char *string, ptrdiff_t size,
            ptrdiff_t startpos, ptrdiff_t range, struct re_registers *regs)
 {
   return re_search_2 (bufp, NULL, 0, string, size, startpos, range,
@@ -3184,8 +3164,8 @@ re_search (struct re_pattern_buffer *bufp, const char *string, size_t size,
    stack overflow).  */
 
 ptrdiff_t
-re_search_2 (struct re_pattern_buffer *bufp, const char *str1, size_t size1,
-             const char *str2, size_t size2,
+re_search_2 (struct re_pattern_buffer *bufp, const char *str1, ptrdiff_t size1,
+             const char *str2, ptrdiff_t size2,
              ptrdiff_t startpos, ptrdiff_t range,
              struct re_registers *regs, ptrdiff_t stop)
 {
@@ -3194,7 +3174,7 @@ re_search_2 (struct re_pattern_buffer *bufp, const char *str1, size_t size1,
   re_char *string2 = (re_char *) str2;
   char *fastmap = bufp->fastmap;
   Lisp_Object translate = bufp->translate;
-  size_t total_size = size1 + size2;
+  ptrdiff_t total_size = size1 + size2;
   ptrdiff_t endpos = startpos + range;
   bool anchored_start;
   /* Nonzero if we are searching multibyte string.  */
@@ -3418,10 +3398,8 @@ re_search_2 (struct re_pattern_buffer *bufp, const char *str1, size_t size1,
 
 /* Declarations and macros for re_match_2.  */
 
-static int bcmp_translate (re_char *s1, re_char *s2,
-                           ptrdiff_t len,
-                           Lisp_Object translate,
-                           const int multibyte);
+static bool bcmp_translate (re_char *, re_char *, ptrdiff_t,
+                            Lisp_Object, bool);
 
 /* This converts PTR, a pointer into one of the search strings 'string1'
    and 'string2' into an offset from the beginning of that string.  */
@@ -3565,8 +3543,9 @@ skip_noops (re_char *p, re_char *pend)
    character (i.e. without any translations).  UNIBYTE denotes whether c is
    unibyte or multibyte character. */
 static bool
-execute_charset (re_char **pp, unsigned c, unsigned corig, bool unibyte)
+execute_charset (re_char **pp, int c, int corig, bool unibyte)
 {
+  eassume (0 <= c && 0 <= corig);
   re_char *p = *pp, *rtp = NULL;
   bool not = (re_opcode_t) *p == charset_not;
 
@@ -3626,8 +3605,8 @@ execute_charset (re_char **pp, unsigned c, unsigned corig, bool unibyte)
   return not;
 }
 
-/* Non-zero if "p1 matches something" implies "p2 fails".  */
-static int
+/* True if "p1 matches something" implies "p2 fails".  */
+static bool
 mutually_exclusive_p (struct re_pattern_buffer *bufp, re_char *p1,
                       re_char *p2)
 {
@@ -3660,7 +3639,7 @@ mutually_exclusive_p (struct re_pattern_buffer *bufp, re_char *p1,
       if (skip_one_char (p1))
         {
           DEBUG_PRINT ("  End of pattern: fast loop.\n");
-          return 1;
+          return true;
         }
       break;
 
@@ -3676,7 +3655,7 @@ mutually_exclusive_p (struct re_pattern_buffer *bufp, re_char *p1,
             if (c != RE_STRING_CHAR (p1 + 2, multibyte))
               {
                 DEBUG_PRINT ("  '%c' != '%c' => fast loop.\n", c, p1[2]);
-                return 1;
+                return true;
               }
           }
 
@@ -3686,14 +3665,14 @@ mutually_exclusive_p (struct re_pattern_buffer *bufp, re_char *p1,
             if (!execute_charset (&p1, c, c, !multibyte || ASCII_CHAR_P (c)))
               {
                 DEBUG_PRINT ("   No match => fast loop.\n");
-                return 1;
+                return true;
               }
           }
         else if ((re_opcode_t) *p1 == anychar
                  && c == '\n')
           {
             DEBUG_PRINT ("   . != \\n => fast loop.\n");
-            return 1;
+            return true;
           }
       }
       break;
@@ -3736,7 +3715,7 @@ mutually_exclusive_p (struct re_pattern_buffer *bufp, re_char *p1,
                   || idx == CHARSET_BITMAP_SIZE (p1))
                 {
                   DEBUG_PRINT ("         No match => fast loop.\n");
-                  return 1;
+                  return true;
                 }
             }
           else if ((re_opcode_t) *p1 == charset_not)
@@ -3753,7 +3732,7 @@ mutually_exclusive_p (struct re_pattern_buffer *bufp, re_char *p1,
               if (idx == p2[1])
                 {
                   DEBUG_PRINT ("         No match => fast loop.\n");
-                  return 1;
+                  return true;
                 }
               }
           }
@@ -3807,7 +3786,7 @@ mutually_exclusive_p (struct re_pattern_buffer *bufp, re_char *p1,
     }
 
   /* Safe default.  */
-  return 0;
+  return false;
 }
 
 
@@ -3826,9 +3805,10 @@ mutually_exclusive_p (struct re_pattern_buffer *bufp, re_char *p1,
    matched substring.  */
 
 ptrdiff_t
-re_match_2 (struct re_pattern_buffer *bufp, const char *string1,
-            size_t size1, const char *string2, size_t size2, ptrdiff_t pos,
-            struct re_registers *regs, ptrdiff_t stop)
+re_match_2 (struct re_pattern_buffer *bufp,
+            char const *string1, ptrdiff_t size1,
+            char const *string2, ptrdiff_t size2,
+            ptrdiff_t pos, struct re_registers *regs, ptrdiff_t stop)
 {
   ptrdiff_t result;
 
@@ -3847,13 +3827,13 @@ re_match_2 (struct re_pattern_buffer *bufp, const char *string1,
 /* This is a separate function so that we can force an alloca cleanup
    afterwards.  */
 static ptrdiff_t
-re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
-                     size_t size1, re_char *string2, size_t size2,
+re_match_2_internal (struct re_pattern_buffer *bufp,
+                     re_char *string1, ptrdiff_t size1,
+                     re_char *string2, ptrdiff_t size2,
                      ptrdiff_t pos, struct re_registers *regs, ptrdiff_t stop)
 {
   /* General temporaries.  */
   int mcnt;
-  size_t reg;
 
   /* Just past the end of the corresponding string.  */
   re_char *end1, *end2;
@@ -3893,13 +3873,14 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
      scanning the strings.  */
   fail_stack_type fail_stack;
 #ifdef DEBUG_COMPILES_ARGUMENTS
-  unsigned nfailure_points_pushed = 0, nfailure_points_popped = 0;
+  ptrdiff_t nfailure_points_pushed = 0, nfailure_points_popped = 0;
 #endif
 
   /* We fill all the registers internally, independent of what we
      return, for use in backreferences.  The number here includes
      an element for register zero.  */
-  size_t num_regs = bufp->re_nsub + 1;
+  ptrdiff_t num_regs = bufp->re_nsub + 1;
+  eassume (0 < num_regs);
 
   /* Information on the contents of registers. These are pointers into
      the input strings; they record just what was matched (on this
@@ -3914,7 +3895,7 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
      variables when we find a match better than any we've seen before.
      This happens as we backtrack through the failure points, which in
      turn happens only if we have not yet matched the entire string. */
-  unsigned best_regs_set = false;
+  bool best_regs_set = false;
   re_char **best_regstart UNINIT, **best_regend UNINIT;
 
   /* Logically, this is 'best_regend[0]'.  But we don't want to have to
@@ -3929,7 +3910,7 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
 
 #ifdef DEBUG_COMPILES_ARGUMENTS
   /* Counts the total number of registers pushed.  */
-  unsigned num_regs_pushed = 0;
+  ptrdiff_t num_regs_pushed = 0;
 #endif
 
   DEBUG_PRINT ("\n\nEntering re_match_2.\n");
@@ -3961,7 +3942,7 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
   /* Initialize subexpression text positions to -1 to mark ones that no
      start_memory/stop_memory has been seen for. Also initialize the
      register information struct.  */
-  for (reg = 1; reg < num_regs; reg++)
+  for (ptrdiff_t reg = 1; reg < num_regs; reg++)
     regstart[reg] = regend[reg] = NULL;
 
   /* We move 'string1' into 'string2' if the latter's empty -- but not if
@@ -4068,7 +4049,7 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
 
                       DEBUG_PRINT ("\nSAVING match as best so far.\n");
 
-                      for (reg = 1; reg < num_regs; reg++)
+                      for (ptrdiff_t reg = 1; reg < num_regs; reg++)
                         {
                           best_regstart[reg] = regstart[reg];
                           best_regend[reg] = regend[reg];
@@ -4094,7 +4075,7 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
                   dend = ((d >= string1 && d <= end1)
                            ? end_match_1 : end_match_2);
 
-                  for (reg = 1; reg < num_regs; reg++)
+                  for (ptrdiff_t reg = 1; reg < num_regs; reg++)
                     {
                       regstart[reg] = best_regstart[reg];
                       regend[reg] = best_regend[reg];
@@ -4113,9 +4094,10 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
                 { /* No.  So allocate them with malloc.  We need one
                      extra element beyond 'num_regs' for the '-1' marker
                      GNU code uses.  */
-                  regs->num_regs = max (RE_NREGS, num_regs + 1);
-                  regs->start = TALLOC (regs->num_regs, ptrdiff_t);
-                  regs->end = TALLOC (regs->num_regs, ptrdiff_t);
+                  ptrdiff_t n = max (RE_NREGS, num_regs + 1);
+                  regs->start = xnmalloc (n, sizeof *regs->start);
+                  regs->end = xnmalloc (n, sizeof *regs->end);
+                  regs->num_regs = n;
                   bufp->regs_allocated = REGS_REALLOCATE;
                 }
               else if (bufp->regs_allocated == REGS_REALLOCATE)
@@ -4124,9 +4106,11 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
                      leave it alone.  */
                   if (regs->num_regs < num_regs + 1)
                     {
-                      regs->num_regs = num_regs + 1;
-                      RETALLOC (regs->start, regs->num_regs, ptrdiff_t);
-                      RETALLOC (regs->end, regs->num_regs, ptrdiff_t);
+                      ptrdiff_t n = num_regs + 1;
+                      regs->start
+                        = xnrealloc (regs->start, n, sizeof *regs->start);
+                      regs->end = xnrealloc (regs->end, n, sizeof *regs->end);
+                      regs->num_regs = n;
                     }
                 }
               else
@@ -4141,9 +4125,7 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
                   regs->end[0] = POINTER_TO_OFFSET (d);
                 }
 
-              /* Go through the first 'min (num_regs, regs->num_regs)'
-                 registers, since that is all we initialized.  */
-              for (reg = 1; reg < min (num_regs, regs->num_regs); reg++)
+              for (ptrdiff_t reg = 1; reg < num_regs; reg++)
                 {
                   if (REG_UNSET (regstart[reg]) || REG_UNSET (regend[reg]))
                     regs->start[reg] = regs->end[reg] = -1;
@@ -4159,14 +4141,14 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
                  we (re)allocated the registers, this is the case,
                  because we always allocate enough to have at least one
                  -1 at the end.  */
-              for (reg = num_regs; reg < regs->num_regs; reg++)
+              for (ptrdiff_t reg = num_regs; reg < regs->num_regs; reg++)
                 regs->start[reg] = regs->end[reg] = -1;
             }
 
-          DEBUG_PRINT ("%u failure points pushed, %u popped (%u remain).\n",
+          DEBUG_PRINT ("%td failure points pushed, %td popped (%td remain).\n",
                        nfailure_points_pushed, nfailure_points_popped,
                        nfailure_points_pushed - nfailure_points_popped);
-          DEBUG_PRINT ("%u registers pushed.\n", num_regs_pushed);
+          DEBUG_PRINT ("%td registers pushed.\n", num_regs_pushed);
 
           ptrdiff_t dcnt = POINTER_TO_OFFSET (d) - pos;
 
@@ -4291,9 +4273,6 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
         case charset:
         case charset_not:
           {
-            register unsigned int c, corig;
-            int len;
-
             /* Whether matching against a unibyte character.  */
             bool unibyte_char = false;
 
@@ -4301,7 +4280,9 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
                          (re_opcode_t) *(p - 1) == charset_not ? "_not" : "");
 
             PREFETCH ();
-            corig = c = RE_STRING_CHAR_AND_LENGTH (d, len, target_multibyte);
+            int len;
+            int corig = RE_STRING_CHAR_AND_LENGTH (d, len, target_multibyte);
+            int c = corig;
             if (target_multibyte)
               {
                 int c1;
@@ -4369,7 +4350,7 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
           /* Strictly speaking, there should be code such as:
 
                 eassert (REG_UNSET (regend[*p]));
-                PUSH_FAILURE_REGSTOP ((unsigned int)*p);
+                PUSH_FAILURE_REGSTOP (*p);
 
              But the only info to be pushed is regend[*p] and it is known to
              be UNSET, so there really isn't anything to push.
@@ -4548,7 +4529,7 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
 
           eassert ((re_opcode_t)p[-4] == no_op);
           {
-            int cycle = 0;
+            bool cycle = false;
             CHECK_INFINITE_LOOP (p - 4, d);
             if (!cycle)
               /* If there's a cycle, just continue without pushing
@@ -4567,7 +4548,7 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
           DEBUG_PRINT ("EXECUTING on_failure_jump_loop %d (to %p):\n",
                        mcnt, p + mcnt);
           {
-            int cycle = 0;
+            bool cycle = false;
             CHECK_INFINITE_LOOP (p - 3, d);
             if (cycle)
               /* If there's a cycle, get out of the loop, as if the matching
@@ -5025,12 +5006,12 @@ re_match_2_internal (struct re_pattern_buffer *bufp, re_char *string1,
 
 /* Subroutine definitions for re_match_2.  */
 
-/* Return zero if TRANSLATE[S1] and TRANSLATE[S2] are identical for LEN
-   bytes; nonzero otherwise.  */
+/* Return true if TRANSLATE[S1] and TRANSLATE[S2] are not identical
+   for LEN bytes.  */
 
-static int
+static bool
 bcmp_translate (re_char *s1, re_char *s2, ptrdiff_t len,
-                Lisp_Object translate, int target_multibyte)
+                Lisp_Object translate, bool target_multibyte)
 {
   re_char *p1 = s1, *p2 = s2;
   re_char *p1_end = s1 + len;
@@ -5048,15 +5029,12 @@ bcmp_translate (re_char *s1, re_char *s2, ptrdiff_t len,
 
       if (RE_TRANSLATE (translate, p1_ch)
           != RE_TRANSLATE (translate, p2_ch))
-        return 1;
+        return true;
 
       p1 += p1_charlen, p2 += p2_charlen;
     }
 
-  if (p1 != p1_end || p2 != p2_end)
-    return 1;
-
-  return 0;
+  return p1 != p1_end || p2 != p2_end;
 }
 
 /* Entry points for GNU code.  */
@@ -5071,7 +5049,7 @@ bcmp_translate (re_char *s1, re_char *s2, ptrdiff_t len,
    We call regex_compile to do the actual compilation.  */
 
 const char *
-re_compile_pattern (const char *pattern, size_t length,
+re_compile_pattern (const char *pattern, ptrdiff_t length,
                     bool posix_backtracking, const char *whitespace_regexp,
                     struct re_pattern_buffer *bufp)
 {
diff --git a/src/regex-emacs.h b/src/regex-emacs.h
index 5a52135bcda..95f743dc2fb 100644
--- a/src/regex-emacs.h
+++ b/src/regex-emacs.h
@@ -26,7 +26,7 @@
    uses struct re_registers.  */
 struct re_registers
 {
-  unsigned num_regs;
+  ptrdiff_t num_regs;
   ptrdiff_t *start;
   ptrdiff_t *end;
 };
@@ -50,7 +50,7 @@ struct re_registers
 extern Lisp_Object re_match_object;
 
 /* Roughly the maximum number of failure points on the stack.  */
-extern size_t emacs_re_max_failures;
+extern ptrdiff_t emacs_re_max_failures;
 
 /* Amount of memory that we can safely stack allocate.  */
 extern ptrdiff_t emacs_re_safe_alloca;
@@ -69,10 +69,10 @@ struct re_pattern_buffer
   unsigned char *buffer;
 
         /* Number of bytes to which 'buffer' points.  */
-  size_t allocated;
+  ptrdiff_t allocated;
 
         /* Number of bytes actually used in 'buffer'.  */
-  size_t used;
+  ptrdiff_t used;
 
         /* Charset of unibyte characters at compiling time.  */
   int charset_unibyte;
@@ -89,13 +89,13 @@ struct re_pattern_buffer
   Lisp_Object translate;
 
         /* Number of subexpressions found by the compiler.  */
-  size_t re_nsub;
+  ptrdiff_t re_nsub;
 
         /* True if and only if this pattern can match the empty string.
            Well, in truth it's used only in 're_search_2', to see
            whether or not we should use the fastmap, so we don't set
            this absolutely perfectly; see 're_compile_fastmap'.  */
-  unsigned can_be_null : 1;
+  bool_bf can_be_null : 1;
 
         /* If REGS_UNALLOCATED, allocate space in the 'regs' structure
              for 'max (RE_NREGS, re_nsub + 1)' groups.
@@ -105,19 +105,19 @@ struct re_pattern_buffer
 
         /* Set to false when 'regex_compile' compiles a pattern; set to true
            by 're_compile_fastmap' if it updates the fastmap.  */
-  unsigned fastmap_accurate : 1;
+  bool_bf fastmap_accurate : 1;
 
   /* If true, the compilation of the pattern had to look up the syntax table,
      so the compiled pattern is valid for the current syntax table only.  */
-  unsigned used_syntax : 1;
+  bool_bf used_syntax : 1;
 
   /* If true, multi-byte form in the regexp pattern should be
      recognized as a multibyte character.  */
-  unsigned multibyte : 1;
+  bool_bf multibyte : 1;
 
   /* If true, multi-byte form in the target of match should be
      recognized as a multibyte character.  */
-  unsigned target_multibyte : 1;
+  bool_bf target_multibyte : 1;
 };
 
 /* Declarations for routines.  */
@@ -125,7 +125,7 @@ struct re_pattern_buffer
 /* Compile the regular expression PATTERN, with length LENGTH
    and syntax given by the global 're_syntax_options', into the buffer
    BUFFER.  Return NULL if successful, and an error string if not.  */
-extern const char *re_compile_pattern (const char *pattern, size_t length,
+extern const char *re_compile_pattern (const char *pattern, ptrdiff_t length,
                                        bool posix_backtracking,
                                        const char *whitespace_regexp,
                                        struct re_pattern_buffer *buffer);
@@ -137,7 +137,7 @@ extern const char *re_compile_pattern (const char *pattern, size_t length,
    match, or -2 for an internal error.  Also return register
    information in REGS (if REGS is non-null).  */
 extern ptrdiff_t re_search (struct re_pattern_buffer *buffer,
-                           const char *string, size_t length,
+                           const char *string, ptrdiff_t length,
                            ptrdiff_t start, ptrdiff_t range,
                            struct re_registers *regs);
 
@@ -145,8 +145,8 @@ extern ptrdiff_t re_search (struct re_pattern_buffer *buffer,
 /* Like 're_search', but search in the concatenation of STRING1 and
    STRING2.  Also, stop searching at index START + STOP.  */
 extern ptrdiff_t re_search_2 (struct re_pattern_buffer *buffer,
-                             const char *string1, size_t length1,
-                             const char *string2, size_t length2,
+                             const char *string1, ptrdiff_t length1,
+                             const char *string2, ptrdiff_t length2,
                              ptrdiff_t start, ptrdiff_t range,
                              struct re_registers *regs,
                              ptrdiff_t stop);
@@ -155,8 +155,8 @@ extern ptrdiff_t re_search_2 (struct re_pattern_buffer *buffer,
 /* Like 're_search_2', but return how many characters in STRING the regexp
    in BUFFER matched, starting at position START.  */
 extern ptrdiff_t re_match_2 (struct re_pattern_buffer *buffer,
-                            const char *string1, size_t length1,
-                            const char *string2, size_t length2,
+                            const char *string1, ptrdiff_t length1,
+                            const char *string2, ptrdiff_t length2,
                             ptrdiff_t start, struct re_registers *regs,
                             ptrdiff_t stop);
 
@@ -175,7 +175,7 @@ extern ptrdiff_t re_match_2 (struct re_pattern_buffer *buffer,
    freeing the old data.  */
 extern void re_set_registers (struct re_pattern_buffer *buffer,
                               struct re_registers *regs,
-                              unsigned num_regs,
+                              ptrdiff_t num_regs,
                               ptrdiff_t *starts, ptrdiff_t *ends);
 
 /* Character classes.  */
@@ -192,6 +192,6 @@ typedef enum { RECC_ERROR = 0,
 
 extern bool re_iswctype (int ch, re_wctype_t cc);
 extern re_wctype_t re_wctype_parse (const unsigned char **strp,
-                                    unsigned limit);
+                                    ptrdiff_t limit);
 
 #endif /* EMACS_REGEX_H */
diff --git a/src/search.c b/src/search.c
index a1e0b0976ed..e55aa767f11 100644
--- a/src/search.c
+++ b/src/search.c
@@ -59,31 +59,6 @@ static struct regexp_cache searchbufs[REGEXP_CACHE_SIZE];
 /* The head of the linked list; points to the most recently used buffer.  */
 static struct regexp_cache *searchbuf_head;
 
-
-/* Every call to re_search, etc., must pass &search_regs as the regs
-   argument unless you can show it is unnecessary (i.e., if re_search
-   is certainly going to be called again before region-around-match
-   can be called).
-
-   Since the registers are now dynamically allocated, we need to make
-   sure not to refer to the Nth register before checking that it has
-   been allocated by checking search_regs.num_regs.
-
-   The regex code keeps track of whether it has allocated the search
-   buffer using bits in the re_pattern_buffer.  This means that whenever
-   you compile a new pattern, it completely forgets whether it has
-   allocated any registers, and will allocate new registers the next
-   time you call a searching or matching function.  Therefore, we need
-   to call re_set_registers after compiling a new pattern or after
-   setting the match registers, so that the regex functions will be
-   able to free or re-allocate it properly.  */
-/* static struct re_registers search_regs; */
-
-/* The buffer in which the last search was performed, or
-   Qt if the last search was done in a string;
-   Qnil if no searching has been done yet.  */
-/* static Lisp_Object last_thing_searched; */
-
 static void set_search_regs (ptrdiff_t, ptrdiff_t);
 static void save_search_regs (void);
 static EMACS_INT simple_search (EMACS_INT, unsigned char *, ptrdiff_t,
@@ -2763,7 +2738,7 @@ since only regular expressions have distinguished subexpressions.  */)
      error out since otherwise this will result in confusing bugs.  */
   ptrdiff_t sub_start = search_regs.start[sub];
   ptrdiff_t sub_end = search_regs.end[sub];
-  unsigned  num_regs = search_regs.num_regs;
+  ptrdiff_t num_regs = search_regs.num_regs;
   newpoint = search_regs.start[sub] + SCHARS (newtext);
 
   /* Replace the old text with the new in the cleanest possible way.  */
@@ -3079,12 +3054,6 @@ If optional arg RESEAT is non-nil, make markers on LIST point nowhere.  */)
   return Qnil;
 }
 
-/* If true the match data have been saved in saved_search_regs
-   during the execution of a sentinel or filter. */
-/* static bool search_regs_saved; */
-/* static struct re_registers saved_search_regs; */
-/* static Lisp_Object saved_last_thing_searched; */
-
 /* Called from Flooking_at, Fstring_match, search_buffer, Fstore_match_data
    if asynchronous code (filter or sentinel) is running. */
 static void
diff --git a/src/thread.h b/src/thread.h
index cb7e60f21f8..1856fddf4cd 100644
--- a/src/thread.h
+++ b/src/thread.h
@@ -111,8 +111,8 @@ struct thread_state
   struct buffer *m_current_buffer;
 #define current_buffer (current_thread->m_current_buffer)
 
-  /* Every call to re_match_2, etc., must pass &search_regs as the regs
-     argument unless you can show it is unnecessary (i.e., if re_match_2
+  /* Every call to re_search, etc., must pass &search_regs as the regs
+     argument unless you can show it is unnecessary (i.e., if re_search
      is certainly going to be called again before region-around-match
      can be called).