auto upstream

24 files changed, 535 insertions, 408 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index a6fabdccdea..1a91eb0f1a3 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,137 @@
+2012-12-03  Paul Eggert  <eggert@cs.ucla.edu>
+
+        Don't let call-process be a zombie factory (Bug#12980).
+        Fixing this bug required some cleanup of the signal-handling code.
+        As a side effect, this change also fixes a longstanding rare race
+        condition whereby Emacs could mistakenly kill unrelated processes,
+        and it fixes a bug where a second C-g does not kill a recalcitrant
+        synchronous process in GNU/Linux and similar platforms.
+        The patch should also fix the last vestiges of Bug#9488,
+        a bug which has mostly been fixed on the trunk by other changes.
+        * callproc.c, process.h (synch_process_alive, synch_process_death)
+        (synch_process_termsig, sync_process_retcode):
+        Remove.  All uses removed, to simplify analysis and so that
+        less consing is done inside critical sections.
+        * callproc.c (call_process_exited): Remove.  All uses replaced
+        with !synch_process_pid.
+        * callproc.c (synch_process_pid, synch_process_fd): New static vars.
+        These take the role of what used to be in unwind-protect arg.
+        All uses changed.
+        (block_child_signal, unblock_child_signal):
+        New functions, to avoid races that could kill innocent-victim processes.
+        (call_process_kill, call_process_cleanup, Fcall_process): Use them.
+        (call_process_kill): Record killed processes as deleted, so that
+        zombies do not clutter up the system.  Do this inside a critical
+        section, to avoid a race that would allow the clutter.
+        (call_process_cleanup): Fix code so that the second C-g works again
+        on common platforms such as GNU/Linux.
+        (Fcall_process): Create the child process in a critical section,
+        to fix a race condition.  If creating an asynchronous process,
+        record it as deleted so that zombies do not clutter up the system.
+        Do unwind-protect for WINDOWSNT too, as that's simpler in the
+        light of these changes.  Omit unnecessary call to emacs_close
+        before failure, as the unwind-protect code does that.
+        * callproc.c (call_process_cleanup):
+        * w32proc.c (waitpid): Simplify now that synch_process_alive is gone.
+        * process.c (record_deleted_pid): New function, containing
+        code refactored out of Fdelete_process.
+        (Fdelete_process): Use it.
+        (process_status_retrieved): Remove.  All callers changed to use
+        child_status_change.
+        (record_child_status_change): Remove, folding its contents into ...
+        (handle_child_signal): ... this signal handler.  Now, this
+        function is purely a handler for SIGCHLD, and is not called after
+        a synchronous waitpid returns; the synchronous code is moved to
+        wait_for_termination.  There is no need to worry about reaping
+        more than one child now.
+        * sysdep.c (get_child_status, child_status_changed): New functions.
+        (wait_for_termination): Now takes int * status and bool
+        interruptible arguments, too.  Do not record child status change;
+        that's now the caller's responsibility.  All callers changed.
+        Reimplement in terms of get_child_status.
+        (wait_for_termination_1, interruptible_wait_for_termination):
+        Remove.  All callers changed to use wait_for_termination.
+        * syswait.h: Include <stdbool.h>, for bool.
+        (record_child_status_change, interruptible_wait_for_termination):
+        Remove decls.
+        (record_deleted_pid, child_status_changed): New decls.
+        (wait_for_termination): Adjust to API changes noted above.
+
+        * bytecode.c, lisp.h (Qbytecode): Remove.
+        No longer needed after 2012-11-20 interactive-p changes.
+
+2012-12-03  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (redisplay_window): If the cursor is visible, but inside
+        the scroll margin, move point outside the margin.  (Bug#13055)
+
+2012-12-03  Jan Djärv  <jan.h.d@swipnet.se>
+
+        * gtkutil.c (my_log_handler): New function.
+        (xg_set_geometry): Set log handler to my_log_handler (Bug#11177).
+
+2012-12-03  Dmitry Antipov  <dmantipov@yandex.ru>
+
+        * lisp.h (modify_region): Rename to...
+        (modify_region_1): ...new prototype.
+        * textprop.c (modify_region): Now static.  Adjust users.
+        * insdel.c (modify_region): Rename to...
+        (modify_region_1): ...new function to work with current buffer.
+        Adjust comment and users.  Use true and false for booleans.
+
+2012-12-03  Dmitry Antipov  <dmantipov@yandex.ru>
+
+        * alloc.c (free_save_value): New function.
+        (safe_alloca_unwind): Use it.
+        * lisp.h (free_save_value): New prototype.
+        * editfns.c (save_excursion_save): Use Lisp_Misc_Save_Value.
+        Add comment.
+        (save_excursion_restore): Adjust to match saved data structure.
+        Use free_save_value to offload some work from GC.  Drop obsolete
+        #if 0 code.
+
+2012-12-03  Chong Yidong  <cyd@gnu.org>
+
+        * fileio.c (Vauto_save_list_file_name): Doc fix.
+
+2012-12-03  Fabrice Popineau  <fabrice.popineau@gmail.com>
+
+        * w32fns.c: Remove prototype of atof.
+        (syspage_mask): Declared DWORD_PTR, for compatibility with 64-bit
+        builds.
+        (file_dialog_callback): Declared UINT_PTR.
+
+        * w32common.h (syspage_mask): Declare DWORD_PTR, for compatibility
+        with 64-bit builds.
+
+        * w32.c (FILE_DEVICE_FILE_SYSTEM, METHOD_BUFFERED)
+        (FILE_ANY_ACCESS, CTL_CODE) [_MSC_VER]: Define only if not already
+        defined.
+
+2012-12-03  Glenn Morris  <rgm@gnu.org>
+
+        * data.c (Fboundp, Fsymbol_value): Doc fix re lexical-binding.
+
+2012-12-02  Paul Eggert  <eggert@cs.ucla.edu>
+
+        Fix xpalloc confusion after memory is exhausted.
+        * alloc.c (xpalloc): Comment fix.
+        * charset.c (Fdefine_charset_internal): If xpalloc exhausts memory
+        and signals an error, do not clear charset_table_size, as
+        charset_table is still valid.
+        * doprnt.c (evxprintf): Clear *BUF after freeing it.
+
+        Use execve to avoid need to munge environ (Bug#13054).
+        * callproc.c (Fcall_process):
+        * process.c (create_process):
+        Don't save and restore environ; no longer needed.
+        * callproc.c (child_setup):
+        Use execve, not execvp, to preserve environ.
+
+2012-12-01  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * xterm.c (x_draw_image_relief): Remove unused locals (Bug#10500).
+
 2012-12-01  YAMAMOTO Mitsuharu  <mituharu@math.s.chiba-u.ac.jp>
 
         * xterm.c (x_draw_relief_rect, x_draw_image_relief): Fix relief
diff --git a/src/alloc.c b/src/alloc.c
index 28c9b51dab4..0f105f87207 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -761,13 +761,17 @@ xnrealloc (void *pa, ptrdiff_t nitems, ptrdiff_t item_size)
    infinity.
 
    If PA is null, then allocate a new array instead of reallocating
-   the old one.  Thus, to grow an array A without saving its old
-   contents, invoke xfree (A) immediately followed by xgrowalloc (0,
-   &NITEMS, ...).
+   the old one.
 
    Block interrupt input as needed.  If memory exhaustion occurs, set
    *NITEMS to zero if PA is null, and signal an error (i.e., do not
-   return).  */
+   return).
+
+   Thus, to grow an array A without saving its old contents, do
+   { xfree (A); A = NULL; A = xpalloc (NULL, &AITEMS, ...); }.
+   The A = NULL avoids a dangling pointer if xpalloc exhausts memory
+   and signals an error, and later this code is reexecuted and
+   attempts to free A.  */
 
 void *
 xpalloc (void *pa, ptrdiff_t *nitems, ptrdiff_t nitems_incr_min,
@@ -822,12 +826,7 @@ xstrdup (const char *s)
 Lisp_Object
 safe_alloca_unwind (Lisp_Object arg)
 {
-  register struct Lisp_Save_Value *p = XSAVE_VALUE (arg);
-
-  p->dogc = 0;
-  xfree (p->pointer);
-  p->pointer = 0;
-  free_misc (arg);
+  free_save_value (arg);
   return Qnil;
 }
 
@@ -3361,6 +3360,19 @@ make_save_value (void *pointer, ptrdiff_t integer)
   return val;
 }
 
+/* Free a Lisp_Misc_Save_Value object.  */
+
+void
+free_save_value (Lisp_Object save)
+{
+  register struct Lisp_Save_Value *p = XSAVE_VALUE (save);
+
+  p->dogc = 0;
+  xfree (p->pointer);
+  p->pointer = NULL;
+  free_misc (save);
+}
+
 /* Return a Lisp_Misc_Overlay object with specified START, END and PLIST.  */
 
 Lisp_Object
diff --git a/src/bytecode.c b/src/bytecode.c
index 3267c7c8c76..4c5ac151de1 100644
--- a/src/bytecode.c
+++ b/src/bytecode.c
@@ -87,8 +87,6 @@ Lisp_Object Qbyte_code_meter;
 #endif /* BYTE_CODE_METER */
 
 
-Lisp_Object Qbytecode;
-
 /*  Byte codes: */
 
 #define BYTE_CODES                                                      \
@@ -1963,8 +1961,6 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
 void
 syms_of_bytecode (void)
 {
-  DEFSYM (Qbytecode, "byte-code");
-
   defsubr (&Sbyte_code);
 
 #ifdef BYTE_CODE_METER
diff --git a/src/callproc.c b/src/callproc.c
index 167663a45c6..21c52d09e6b 100644
--- a/src/callproc.c
+++ b/src/callproc.c
@@ -67,88 +67,110 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 /* Pattern used by call-process-region to make temp files.  */
 static Lisp_Object Vtemp_file_name_pattern;
 
-/* True if we are about to fork off a synchronous process or if we
-   are waiting for it.  */
-bool synch_process_alive;
-
-/* Nonzero => this is a string explaining death of synchronous subprocess.  */
-const char *synch_process_death;
+/* The next two variables are valid only while record-unwind-protect
+   is in place during call-process for a synchronous subprocess.  At
+   other times, their contents are irrelevant.  Doing this via static
+   C variables is more convenient than putting them into the arguments
+   of record-unwind-protect, as they need to be updated at randomish
+   times in the code, and Lisp cannot always store these values as
+   Emacs integers.  It's safe to use static variables here, as the
+   code is never invoked reentrantly.  */
+
+/* If nonzero, a process-ID that has not been reaped.  */
+static pid_t synch_process_pid;
+
+/* If nonnegative, a file descriptor that has not been closed.  */
+static int synch_process_fd;
+
+/* Block SIGCHLD.  */
 
-/* Nonzero => this is the signal number that terminated the subprocess.  */
-int synch_process_termsig;
+static void
+block_child_signal (void)
+{
+#ifdef SIGCHLD
+  sigset_t blocked;
+  sigemptyset (&blocked);
+  sigaddset (&blocked, SIGCHLD);
+  pthread_sigmask (SIG_BLOCK, &blocked, 0);
+#endif
+}
 
-/* If synch_process_death is zero,
-   this is exit code of synchronous subprocess.  */
-int synch_process_retcode;
+/* Unblock SIGCHLD.  */
 
-
-/* Clean up when exiting Fcall_process.
-   On MSDOS, delete the temporary file on any kind of termination.
-   On Unix, kill the process and any children on termination by signal.  */
+static void
+unblock_child_signal (void)
+{
+#ifdef SIGCHLD
+  pthread_sigmask (SIG_SETMASK, &empty_mask, 0);
+#endif
+}
 
-/* True if this is termination due to exit.  */
-static bool call_process_exited;
+/* Clean up when exiting call_process_cleanup.  */
 
 static Lisp_Object
-call_process_kill (Lisp_Object fdpid)
+call_process_kill (Lisp_Object ignored)
 {
-  int fd;
-  pid_t pid;
-  CONS_TO_INTEGER (Fcar (fdpid), int, fd);
-  CONS_TO_INTEGER (Fcdr (fdpid), pid_t, pid);
-  emacs_close (fd);
-  EMACS_KILLPG (pid, SIGKILL);
-  synch_process_alive = 0;
+  if (0 <= synch_process_fd)
+    emacs_close (synch_process_fd);
+
+  /* If PID is reapable, kill it and record it as a deleted process.
+     Do this in a critical section.  Unless PID is wedged it will be
+     reaped on receipt of the first SIGCHLD after the critical section.  */
+  if (synch_process_pid)
+    {
+      block_child_signal ();
+      record_deleted_pid (synch_process_pid);
+      EMACS_KILLPG (synch_process_pid, SIGKILL);
+      unblock_child_signal ();
+    }
+
   return Qnil;
 }
 
+/* Clean up when exiting Fcall_process.
+   On MSDOS, delete the temporary file on any kind of termination.
+   On Unix, kill the process and any children on termination by signal.  */
+
 static Lisp_Object
 call_process_cleanup (Lisp_Object arg)
 {
-  Lisp_Object fdpid = Fcdr (arg);
-  int fd;
-#if defined (MSDOS)
-  Lisp_Object file;
+#ifdef MSDOS
+  Lisp_Object buffer = Fcar (arg);
+  Lisp_Object file = Fcdr (arg);
 #else
-  pid_t pid;
+  Lisp_Object buffer = arg;
 #endif
 
-  Fset_buffer (Fcar (arg));
-  CONS_TO_INTEGER (Fcar (fdpid), int, fd);
-
-#if defined (MSDOS)
-  /* for MSDOS fdpid is really (fd . tempfile)  */
-  file = Fcdr (fdpid);
-  /* FD is -1 and FILE is "" when we didn't actually create a
-     temporary file in call-process.  */
-  if (fd >= 0)
-    emacs_close (fd);
-  if (!(strcmp (SDATA (file), NULL_DEVICE) == 0 || SREF (file, 0) == '\0'))
-    unlink (SDATA (file));
-#else /* not MSDOS */
-  CONS_TO_INTEGER (Fcdr (fdpid), pid_t, pid);
-
-  if (call_process_exited)
-    {
-      emacs_close (fd);
-      return Qnil;
-    }
+  Fset_buffer (buffer);
 
-  if (EMACS_KILLPG (pid, SIGINT) == 0)
+#ifndef MSDOS
+  /* If the process still exists, kill its process group.  */
+  if (synch_process_pid)
     {
       ptrdiff_t count = SPECPDL_INDEX ();
-      record_unwind_protect (call_process_kill, fdpid);
+      EMACS_KILLPG (synch_process_pid, SIGINT);
+      record_unwind_protect (call_process_kill, make_number (0));
       message1 ("Waiting for process to die...(type C-g again to kill it instantly)");
       immediate_quit = 1;
       QUIT;
-      wait_for_termination (pid);
+      wait_for_termination (synch_process_pid, 0, 1);
+      synch_process_pid = 0;
       immediate_quit = 0;
       specpdl_ptr = specpdl + count; /* Discard the unwind protect.  */
       message1 ("Waiting for process to die...done");
     }
-  synch_process_alive = 0;
-  emacs_close (fd);
-#endif /* not MSDOS */
+#endif
+
+  if (0 <= synch_process_fd)
+    emacs_close (synch_process_fd);
+
+#ifdef MSDOS
+  /* FILE is "" when we didn't actually create a temporary file in
+     call-process.  */
+  if (!(strcmp (SDATA (file), NULL_DEVICE) == 0 || SREF (file, 0) == '\0'))
+    unlink (SDATA (file));
+#endif
+
   return Qnil;
 }
 
@@ -181,9 +203,10 @@ If you quit, the process is killed with SIGINT, or SIGKILL if you quit again.
 usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
   (ptrdiff_t nargs, Lisp_Object *args)
 {
-  Lisp_Object infile, buffer, current_dir, path, cleanup_info_tail;
+  Lisp_Object infile, buffer, current_dir, path;
   bool display_p;
   int fd0, fd1, filefd;
+  int status;
   ptrdiff_t count = SPECPDL_INDEX ();
   USE_SAFE_ALLOCA;
 
@@ -199,7 +222,7 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
 #else
   pid_t pid;
 #endif
-  int vfork_errno;
+  int child_errno;
   int fd_output = -1;
   struct coding_system process_coding; /* coding-system of process output */
   struct coding_system argument_coding; /* coding-system of arguments */
@@ -488,24 +511,11 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
     }
 
   {
-    /* child_setup must clobber environ in systems with true vfork.
-       Protect it from permanent change.  */
-    char **save_environ = environ;
     int fd_error = fd1;
 
     if (fd_output >= 0)
       fd1 = fd_output;
 
-    /* Record that we're about to create a synchronous process.  */
-    synch_process_alive = 1;
-
-    /* These vars record information from process termination.
-       Clear them now before process can possibly terminate,
-       to avoid timing error if process terminates soon.  */
-    synch_process_death = 0;
-    synch_process_retcode = 0;
-    synch_process_termsig = 0;
-
     if (NILP (error_file))
       fd_error = emacs_open (NULL_DEVICE, O_WRONLY, 0);
     else if (STRINGP (error_file))
@@ -538,23 +548,21 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
 
 #ifdef MSDOS /* MW, July 1993 */
     /* Note that on MSDOS `child_setup' actually returns the child process
-       exit status, not its PID, so we assign it to `synch_process_retcode'
-       below.  */
+       exit status, not its PID, so assign it to status below.  */
     pid = child_setup (filefd, outfilefd, fd_error, new_argv, 0, current_dir);
-
-    /* Record that the synchronous process exited and note its
-       termination status.  */
-    synch_process_alive = 0;
-    synch_process_retcode = pid;
-    if (synch_process_retcode < 0)  /* means it couldn't be exec'ed */
-      {
-        synchronize_system_messages_locale ();
-        synch_process_death = strerror (errno);
-      }
+    child_errno = errno;
 
     emacs_close (outfilefd);
     if (fd_error != outfilefd)
       emacs_close (fd_error);
+    if (pid < 0)
+      {
+        synchronize_system_messages_locale ();
+        return
+          code_convert_string_norecord (build_string (strerror (child_errno)),
+                                        Vlocale_coding_system, 0);
+      }
+    status = pid;
     fd1 = -1; /* No harm in closing that one!  */
     if (tempfile)
       {
@@ -572,12 +580,21 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
     else
       fd0 = -1; /* We are not going to read from tempfile.   */
 #else /* not MSDOS */
+
+    /* Do the unwind-protect now, even though the pid is not known, so
+       that no storage allocation is done in the critical section.
+       The actual PID will be filled in during the critical section.  */
+    synch_process_pid = 0;
+    synch_process_fd = fd0;
+    record_unwind_protect (call_process_cleanup, Fcurrent_buffer ());
+
+    block_input ();
+    block_child_signal ();
+
 #ifdef WINDOWSNT
     pid = child_setup (filefd, fd1, fd_error, new_argv, 0, current_dir);
 #else  /* not WINDOWSNT */
 
-    block_input ();
-
     /* vfork, and prevent local vars from being clobbered by the vfork.  */
     {
       Lisp_Object volatile buffer_volatile = buffer;
@@ -594,9 +611,9 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
       ptrdiff_t volatile count_volatile = count;
       ptrdiff_t volatile sa_count_volatile = sa_count;
       char **volatile new_argv_volatile = new_argv;
-      char **volatile new_save_environ = save_environ;
 
       pid = vfork ();
+      child_errno = errno;
 
       buffer = buffer_volatile;
       coding_systems = coding_systems_volatile;
@@ -612,11 +629,12 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
       count = count_volatile;
       sa_count = sa_count_volatile;
       new_argv = new_argv_volatile;
-      save_environ = new_save_environ;
     }
 
     if (pid == 0)
       {
+        unblock_child_signal ();
+
         if (fd0 >= 0)
           emacs_close (fd0);
 
@@ -628,18 +646,26 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
         child_setup (filefd, fd1, fd_error, new_argv, 0, current_dir);
       }
 
-    vfork_errno = errno;
-    unblock_input ();
-
 #endif /* not WINDOWSNT */
 
+    child_errno = errno;
+
+    if (0 < pid)
+      {
+        if (INTEGERP (buffer))
+          record_deleted_pid (pid);
+        else
+          synch_process_pid = pid;
+      }
+
+    unblock_child_signal ();
+    unblock_input ();
+
     /* The MSDOS case did this already.  */
     if (fd_error >= 0)
       emacs_close (fd_error);
 #endif /* not MSDOS */
 
-    environ = save_environ;
-
     /* Close most of our file descriptors, but not fd0
        since we will use that to read input from.  */
     emacs_close (filefd);
@@ -651,9 +677,7 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
 
   if (pid < 0)
     {
-      if (fd0 >= 0)
-        emacs_close (fd0);
-      errno = vfork_errno;
+      errno = child_errno;
       report_file_error ("Doing vfork", Qnil);
     }
 
@@ -664,19 +688,12 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
       return Qnil;
     }
 
-  /* Enable sending signal if user quits below.  */
-  call_process_exited = 0;
-
 #if defined (MSDOS)
   /* MSDOS needs different cleanup information.  */
-  cleanup_info_tail = build_string (tempfile ? tempfile : "");
-#else
-  cleanup_info_tail = INTEGER_TO_CONS (pid);
-#endif /* not MSDOS */
   record_unwind_protect (call_process_cleanup,
                          Fcons (Fcurrent_buffer (),
-                                Fcons (INTEGER_TO_CONS (fd0),
-                                       cleanup_info_tail)));
+                                build_string (tempfile ? tempfile : "")));
+#endif
 
   if (BUFFERP (buffer))
     Fset_buffer (buffer);
@@ -863,38 +880,34 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
 
 #ifndef MSDOS
   /* Wait for it to terminate, unless it already has.  */
-  if (output_to_buffer)
-    wait_for_termination (pid);
-  else
-    interruptible_wait_for_termination (pid);
+  wait_for_termination (pid, &status, !output_to_buffer);
 #endif
 
   immediate_quit = 0;
 
   /* Don't kill any children that the subprocess may have left behind
      when exiting.  */
-  call_process_exited = 1;
+  synch_process_pid = 0;
 
   SAFE_FREE ();
   unbind_to (count, Qnil);
 
-  if (synch_process_termsig)
+  if (WIFSIGNALED (status))
     {
       const char *signame;
 
       synchronize_system_messages_locale ();
-      signame = strsignal (synch_process_termsig);
+      signame = strsignal (WTERMSIG (status));
 
       if (signame == 0)
         signame = "unknown";
 
-      synch_process_death = signame;
+      return code_convert_string_norecord (build_string (signame),
+                                           Vlocale_coding_system, 0);
     }
 
-  if (synch_process_death)
-    return code_convert_string_norecord (build_string (synch_process_death),
-                                         Vlocale_coding_system, 0);
-  return make_number (synch_process_retcode);
+  eassert (WIFEXITED (status));
+  return make_number (WEXITSTATUS (status));
 }
 
 static Lisp_Object
@@ -1092,10 +1105,6 @@ add_env (char **env, char **new_env, char *string)
    Initialize inferior's priority, pgrp, connected dir and environment.
    then exec another program based on new_argv.
 
-   This function may change environ for the superior process.
-   Therefore, the superior process must save and restore the value
-   of environ around the vfork and the call to this function.
-
    If SET_PGRP, put the subprocess into a separate process group.
 
    CURRENT_DIR is an elisp string giving the path of the current
@@ -1298,11 +1307,7 @@ child_setup (int in, int out, int err, char **new_argv, bool set_pgrp,
   setpgid (0, 0);
   tcsetpgrp (0, pid);
 
-  /* execvp does not accept an environment arg so the only way
-     to pass this environment is to set environ.  Our caller
-     is responsible for restoring the ambient value of environ.  */
-  environ = env;
-  execvp (new_argv[0], new_argv);
+  execve (new_argv[0], new_argv, env);
 
   emacs_write (1, "Can't exec program: ", 20);
   emacs_write (1, new_argv[0], strlen (new_argv[0]));
diff --git a/src/casefiddle.c b/src/casefiddle.c
index e3654627576..d9c6a078973 100644
--- a/src/casefiddle.c
+++ b/src/casefiddle.c
@@ -213,7 +213,7 @@ casify_region (enum case_action flag, Lisp_Object b, Lisp_Object e)
   validate_region (&b, &e);
   start = XFASTINT (b);
   end = XFASTINT (e);
-  modify_region (current_buffer, start, end, 0);
+  modify_region_1 (start, end, false);
   record_change (start, end - start);
   start_byte = CHAR_TO_BYTE (start);
 
diff --git a/src/charset.c b/src/charset.c
index c9133c780e8..43be0e9c780 100644
--- a/src/charset.c
+++ b/src/charset.c
@@ -1142,12 +1142,14 @@ usage: (define-charset-internal ...)  */)
              example, the IDs are stuffed into struct
              coding_system.charbuf[i] entries, which are 'int'.  */
           int old_size = charset_table_size;
+          ptrdiff_t new_size = old_size;
           struct charset *new_table =
-            xpalloc (0, &charset_table_size, 1,
+            xpalloc (0, &new_size, 1,
                      min (INT_MAX, MOST_POSITIVE_FIXNUM),
                      sizeof *charset_table);
           memcpy (new_table, charset_table, old_size * sizeof *new_table);
           charset_table = new_table;
+          charset_table_size = new_size;
           /* FIXME: This leaks memory, as the old charset_table becomes
              unreachable.  If the old charset table is charset_table_init
              then this leak is intentional; otherwise, it's unclear.
diff --git a/src/data.c b/src/data.c
index 5fc6afaaa03..a72fa3e2b5f 100644
--- a/src/data.c
+++ b/src/data.c
@@ -506,7 +506,9 @@ DEFUN ("setcdr", Fsetcdr, Ssetcdr, 2, 2, 0,
 /* Extract and set components of symbols.  */
 
 DEFUN ("boundp", Fboundp, Sboundp, 1, 1, 0,
-       doc: /* Return t if SYMBOL's value is not void.  */)
+       doc: /* Return t if SYMBOL's value is not void.
+Note that if `lexical-binding' is in effect, this refers to the
+global value outside of any lexical scope.  */)
   (register Lisp_Object symbol)
 {
   Lisp_Object valcontents;
@@ -1047,7 +1049,9 @@ find_symbol_value (Lisp_Object symbol)
 }
 
 DEFUN ("symbol-value", Fsymbol_value, Ssymbol_value, 1, 1, 0,
-       doc: /* Return SYMBOL's value.  Error if that is void.  */)
+       doc: /* Return SYMBOL's value.  Error if that is void.
+Note that if `lexical-binding' is in effect, this returns the
+global value outside of any lexical scope.  */)
   (Lisp_Object symbol)
 {
   Lisp_Object val;
diff --git a/src/doprnt.c b/src/doprnt.c
index caa56d6ae88..8cab219aafa 100644
--- a/src/doprnt.c
+++ b/src/doprnt.c
@@ -521,7 +521,10 @@ evxprintf (char **buf, ptrdiff_t *bufsize,
       if (nbytes < *bufsize - 1)
         return nbytes;
       if (*buf != nonheapbuf)
-        xfree (*buf);
+        {
+          xfree (*buf);
+          *buf = NULL;
+        }
       *buf = xpalloc (NULL, bufsize, 1, bufsize_max, 1);
     }
 }
diff --git a/src/editfns.c b/src/editfns.c
index 8122ffdd0d4..d60f417e561 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -813,38 +813,43 @@ This function does not move point.  */)
                               Qnil, Qt, Qnil);
 }
 
-
+/* Save current buffer state for `save-excursion' special form.
+   We (ab)use Lisp_Misc_Save_Value to allow explicit free and so
+   offload some work from GC.  */
+
 Lisp_Object
 save_excursion_save (void)
 {
-  bool visible = (XBUFFER (XWINDOW (selected_window)->buffer)
-                  == current_buffer);
+  Lisp_Object save, *data = xmalloc (word_size * 4);
+
+  data[0] = Fpoint_marker ();
   /* Do not copy the mark if it points to nowhere.  */
-  Lisp_Object mark = (XMARKER (BVAR (current_buffer, mark))->buffer
-                      ? Fcopy_marker (BVAR (current_buffer, mark), Qnil)
-                      : Qnil);
-
-  return Fcons (Fpoint_marker (),
-                Fcons (mark,
-                       Fcons (visible ? Qt : Qnil,
-                              Fcons (BVAR (current_buffer, mark_active),
-                                     selected_window))));
+  data[1] = (XMARKER (BVAR (current_buffer, mark))->buffer
+             ? Fcopy_marker (BVAR (current_buffer, mark), Qnil)
+             : Qnil);
+  /* Selected window if current buffer is shown in it, nil otherwise.  */
+  data[2] = ((XBUFFER (XWINDOW (selected_window)->buffer) == current_buffer)
+             ? selected_window : Qnil);
+  data[3] = BVAR (current_buffer, mark_active);
+
+  save = make_save_value (data, 4);
+  XSAVE_VALUE (save)->dogc = 1;
+  return save;
 }
 
+/* Restore saved buffer before leaving `save-excursion' special form.  */
+
 Lisp_Object
 save_excursion_restore (Lisp_Object info)
 {
-  Lisp_Object tem, tem1, omark, nmark;
+  Lisp_Object tem, tem1, omark, nmark, *data = XSAVE_VALUE (info)->pointer;
   struct gcpro gcpro1, gcpro2, gcpro3;
-  bool visible_p;
 
-  tem = Fmarker_buffer (XCAR (info));
-  /* If buffer being returned to is now deleted, avoid error */
-  /* Otherwise could get error here while unwinding to top level
-     and crash */
-  /* In that case, Fmarker_buffer returns nil now.  */
+  tem = Fmarker_buffer (data[0]);
+  /* If we're unwinding to top level, saved buffer may be deleted.  This
+     means that all of its markers are unchained and so tem is nil.  */
   if (NILP (tem))
-    return Qnil;
+    goto out;
 
   omark = nmark = Qnil;
   GCPRO3 (info, omark, nmark);
@@ -852,13 +857,12 @@ save_excursion_restore (Lisp_Object info)
   Fset_buffer (tem);
 
   /* Point marker.  */
-  tem = XCAR (info);
+  tem = data[0];
   Fgoto_char (tem);
   unchain_marker (XMARKER (tem));
 
   /* Mark marker.  */
-  info = XCDR (info);
-  tem = XCAR (info);
+  tem = data[1];
   omark = Fmarker_position (BVAR (current_buffer, mark));
   if (NILP (tem))
     unchain_marker (XMARKER (BVAR (current_buffer, mark)));
@@ -869,23 +873,8 @@ save_excursion_restore (Lisp_Object info)
       unchain_marker (XMARKER (tem));
     }
 
-  /* visible */
-  info = XCDR (info);
-  visible_p = !NILP (XCAR (info));
-
-#if 0 /* We used to make the current buffer visible in the selected window
-         if that was true previously.  That avoids some anomalies.
-         But it creates others, and it wasn't documented, and it is simpler
-         and cleaner never to alter the window/buffer connections.  */
-  tem1 = Fcar (tem);
-  if (!NILP (tem1)
-      && current_buffer != XBUFFER (XWINDOW (selected_window)->buffer))
-    Fswitch_to_buffer (Fcurrent_buffer (), Qnil);
-#endif /* 0 */
-
-  /* Mark active */
-  info = XCDR (info);
-  tem = XCAR (info);
+  /* Mark active.  */
+  tem = data[3];
   tem1 = BVAR (current_buffer, mark_active);
   bset_mark_active (current_buffer, tem);
 
@@ -909,8 +898,8 @@ save_excursion_restore (Lisp_Object info)
   /* If buffer was visible in a window, and a different window was
      selected, and the old selected window is still showing this
      buffer, restore point in that window.  */
-  tem = XCDR (info);
-  if (visible_p
+  tem = data[2];
+  if (WINDOWP (tem)
       && !EQ (tem, selected_window)
       && (tem1 = XWINDOW (tem)->buffer,
           (/* Window is live...  */
@@ -920,6 +909,10 @@ save_excursion_restore (Lisp_Object info)
     Fset_window_point (tem, make_number (PT));
 
   UNGCPRO;
+
+ out:
+
+  free_save_value (info);
   return Qnil;
 }
 
@@ -2929,7 +2922,7 @@ Both characters must have the same length of multi-byte form.  */)
           else if (!changed)
             {
               changed = -1;
-              modify_region (current_buffer, pos, XINT (end), 0);
+              modify_region_1 (pos, XINT (end), false);
 
               if (! NILP (noundo))
                 {
@@ -3105,7 +3098,7 @@ It returns the number of characters changed.  */)
   pos = XINT (start);
   pos_byte = CHAR_TO_BYTE (pos);
   end_pos = XINT (end);
-  modify_region (current_buffer, pos, end_pos, 0);
+  modify_region_1 (pos, end_pos, false);
 
   cnt = 0;
   for (; pos < end_pos; )
@@ -4629,7 +4622,7 @@ Transposing beyond buffer boundaries is an error.  */)
 
   if (end1 == start2)           /* adjacent regions */
     {
-      modify_region (current_buffer, start1, end2, 0);
+      modify_region_1 (start1, end2, false);
       record_change (start1, len1 + len2);
 
       tmp_interval1 = copy_intervals (cur_intv, start1, len1);
@@ -4688,8 +4681,8 @@ Transposing beyond buffer boundaries is an error.  */)
         {
           USE_SAFE_ALLOCA;
 
-          modify_region (current_buffer, start1, end1, 0);
-          modify_region (current_buffer, start2, end2, 0);
+          modify_region_1 (start1, end1, false);
+          modify_region_1 (start2, end2, false);
           record_change (start1, len1);
           record_change (start2, len2);
           tmp_interval1 = copy_intervals (cur_intv, start1, len1);
@@ -4722,7 +4715,7 @@ Transposing beyond buffer boundaries is an error.  */)
         {
           USE_SAFE_ALLOCA;
 
-          modify_region (current_buffer, start1, end2, 0);
+          modify_region_1 (start1, end2, false);
           record_change (start1, (end2 - start1));
           tmp_interval1 = copy_intervals (cur_intv, start1, len1);
           tmp_interval_mid = copy_intervals (cur_intv, end1, len_mid);
@@ -4755,7 +4748,7 @@ Transposing beyond buffer boundaries is an error.  */)
           USE_SAFE_ALLOCA;
 
           record_change (start1, (end2 - start1));
-          modify_region (current_buffer, start1, end2, 0);
+          modify_region_1 (start1, end2, false);
 
           tmp_interval1 = copy_intervals (cur_intv, start1, len1);
           tmp_interval_mid = copy_intervals (cur_intv, end1, len_mid);
diff --git a/src/fileio.c b/src/fileio.c
index 48dbf20b88f..9edd88ca64f 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -5771,7 +5771,7 @@ This applies only to the operation `inhibit-file-name-operation'.  */);
   DEFVAR_LISP ("auto-save-list-file-name", Vauto_save_list_file_name,
                doc: /* File name in which we write a list of all auto save file names.
 This variable is initialized automatically from `auto-save-list-file-prefix'
-shortly after Emacs reads your `.emacs' file, if you have not yet given it
+shortly after Emacs reads your init file, if you have not yet given it
 a non-nil value.  */);
   Vauto_save_list_file_name = Qnil;
 
diff --git a/src/gtkutil.c b/src/gtkutil.c
index 4367b534cb9..52a6c37b0d5 100644
--- a/src/gtkutil.c
+++ b/src/gtkutil.c
@@ -813,6 +813,14 @@ xg_hide_tooltip (FRAME_PTR f)
     General functions for creating widgets, resizing, events, e.t.c.
  ***********************************************************************/
 
+static void
+my_log_handler (const gchar *log_domain, GLogLevelFlags log_level,
+                const gchar *msg, gpointer user_data)
+{
+  if (!strstr (msg, "visible children"))
+    fprintf (stderr, "XX %s-WARNING **: %s\n", log_domain, msg);
+}
+
 /* Make a geometry string and pass that to GTK.  It seems this is the
    only way to get geometry position right if the user explicitly
    asked for a position when starting Emacs.
@@ -828,6 +836,7 @@ xg_set_geometry (FRAME_PTR f)
       int top = f->top_pos;
       int yneg = f->size_hint_flags & YNegative;
       char geom_str[sizeof "=x--" + 4 * INT_STRLEN_BOUND (int)];
+      guint id;
 
       if (xneg)
         left = -left;
@@ -840,9 +849,15 @@ xg_set_geometry (FRAME_PTR f)
                (xneg ? '-' : '+'), left,
                (yneg ? '-' : '+'), top);
 
+      /* Silence warning about visible children.  */
+      id = g_log_set_handler ("Gtk", G_LOG_LEVEL_WARNING | G_LOG_FLAG_FATAL
+                              | G_LOG_FLAG_RECURSION, my_log_handler, NULL);
+
       if (!gtk_window_parse_geometry (GTK_WINDOW (FRAME_GTK_OUTER_WIDGET (f)),
                                       geom_str))
         fprintf (stderr, "Failed to parse: '%s'\n", geom_str);
+
+      g_log_remove_handler ("Gtk", id);
     }
 }
 
diff --git a/src/insdel.c b/src/insdel.c
index 87010cd8251..892ca3d5216 100644
--- a/src/insdel.c
+++ b/src/insdel.c
@@ -1755,9 +1755,9 @@ del_range_2 (ptrdiff_t from, ptrdiff_t from_byte,
 
   return deletion;
 }
-
-/* Call this if you're about to change the region of BUFFER from
-   character positions START to END.  This checks the read-only
+
+/* Call this if you're about to change the region of current buffer
+   from character positions START to END.  This checks the read-only
    properties of the region, calls the necessary modification hooks,
    and warns the next redisplay that it should pay attention to that
    area.
@@ -1766,16 +1766,11 @@ del_range_2 (ptrdiff_t from, ptrdiff_t from_byte,
    Otherwise set CHARS_MODIFF to the new value of MODIFF.  */
 
 void
-modify_region (struct buffer *buffer, ptrdiff_t start, ptrdiff_t end,
-               bool preserve_chars_modiff)
+modify_region_1 (ptrdiff_t start, ptrdiff_t end, bool preserve_chars_modiff)
 {
-  struct buffer *old_buffer = current_buffer;
-
-  set_buffer_internal (buffer);
-
   prepare_to_modify_buffer (start, end, NULL);
 
-  BUF_COMPUTE_UNCHANGED (buffer, start - 1, end);
+  BUF_COMPUTE_UNCHANGED (current_buffer, start - 1, end);
 
   if (MODIFF <= SAVE_MODIFF)
     record_first_change ();
@@ -1783,11 +1778,9 @@ modify_region (struct buffer *buffer, ptrdiff_t start, ptrdiff_t end,
   if (! preserve_chars_modiff)
     CHARS_MODIFF = MODIFF;
 
-  bset_point_before_scroll (buffer, Qnil);
-
-  set_buffer_internal (old_buffer);
+  bset_point_before_scroll (current_buffer, Qnil);
 }
-
+
 /* Check that it is okay to modify the buffer between START and END,
    which are char positions.
 
diff --git a/src/lisp.h b/src/lisp.h
index a5c4f862d37..ad249a2c66b 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -2801,7 +2801,7 @@ extern void del_range_byte (ptrdiff_t, ptrdiff_t, bool);
 extern void del_range_both (ptrdiff_t, ptrdiff_t, ptrdiff_t, ptrdiff_t, bool);
 extern Lisp_Object del_range_2 (ptrdiff_t, ptrdiff_t,
                                 ptrdiff_t, ptrdiff_t, bool);
-extern void modify_region (struct buffer *, ptrdiff_t, ptrdiff_t, bool);
+extern void modify_region_1 (ptrdiff_t, ptrdiff_t, bool);
 extern void prepare_to_modify_buffer (ptrdiff_t, ptrdiff_t, ptrdiff_t *);
 extern void signal_after_change (ptrdiff_t, ptrdiff_t, ptrdiff_t);
 extern void adjust_after_insert (ptrdiff_t, ptrdiff_t, ptrdiff_t,
@@ -2968,6 +2968,7 @@ extern Lisp_Object make_float (double);
 extern void display_malloc_warning (void);
 extern ptrdiff_t inhibit_garbage_collection (void);
 extern Lisp_Object make_save_value (void *, ptrdiff_t);
+extern void free_save_value (Lisp_Object);
 extern Lisp_Object build_overlay (Lisp_Object, Lisp_Object, Lisp_Object);
 extern void free_marker (Lisp_Object);
 extern void free_cons (struct Lisp_Cons *);
@@ -3398,7 +3399,6 @@ extern void syms_of_doc (void);
 extern int read_bytecode_char (bool);
 
 /* Defined in bytecode.c.  */
-extern Lisp_Object Qbytecode;
 extern void syms_of_bytecode (void);
 extern struct byte_stack *byte_stack_list;
 #if BYTE_MARK_STACK
diff --git a/src/process.c b/src/process.c
index b23f06fd025..27009882c99 100644
--- a/src/process.c
+++ b/src/process.c
@@ -777,10 +777,23 @@ get_process (register Lisp_Object name)
 /* Fdelete_process promises to immediately forget about the process, but in
    reality, Emacs needs to remember those processes until they have been
    treated by the SIGCHLD handler and waitpid has been invoked on them;
-   otherwise they might fill up the kernel's process table.  */
+   otherwise they might fill up the kernel's process table.
+
+   Some processes created by call-process are also put onto this list.  */
 static Lisp_Object deleted_pid_list;
 #endif
 
+void
+record_deleted_pid (pid_t pid)
+{
+#ifdef SIGCHLD
+  deleted_pid_list = Fcons (make_fixnum_or_float (pid),
+                            /* GC treated elements set to nil.  */
+                            Fdelq (Qnil, deleted_pid_list));
+
+#endif
+}
+
 DEFUN ("delete-process", Fdelete_process, Sdelete_process, 1, 1, 0,
        doc: /* Delete PROCESS: kill it and forget about it immediately.
 PROCESS may be a process, a buffer, the name of a process or buffer, or
@@ -807,9 +820,7 @@ nil, indicating the current buffer's process.  */)
       pid_t pid = p->pid;
 
       /* No problem storing the pid here, as it is still in Vprocess_alist.  */
-      deleted_pid_list = Fcons (make_fixnum_or_float (pid),
-                                /* GC treated elements set to nil.  */
-                                Fdelq (Qnil, deleted_pid_list));
+      record_deleted_pid (pid);
       /* If the process has already signaled, remove it from the list.  */
       if (p->raw_status_new)
         update_status (p);
@@ -1586,9 +1597,6 @@ create_process (Lisp_Object process, char **new_argv, Lisp_Object current_dir)
   volatile int pty_flag = 0;
   volatile Lisp_Object lisp_pty_name = Qnil;
   volatile Lisp_Object encoded_current_dir;
-#if HAVE_WORKING_VFORK
-  char **volatile save_environ;
-#endif
 
   inchannel = outchannel = -1;
 
@@ -1688,12 +1696,6 @@ create_process (Lisp_Object process, char **new_argv, Lisp_Object current_dir)
   pthread_sigmask (SIG_BLOCK, &blocked, 0);
 #endif
 
-#if HAVE_WORKING_VFORK
-  /* child_setup must clobber environ on systems with true vfork.
-     Protect it from permanent change.  */
-  save_environ = environ;
-#endif
-
 #ifndef WINDOWSNT
   pid = vfork ();
   if (pid == 0)
@@ -1819,10 +1821,6 @@ create_process (Lisp_Object process, char **new_argv, Lisp_Object current_dir)
 
   /* Back in the parent process.  */
 
-#if HAVE_WORKING_VFORK
-  environ = save_environ;
-#endif
-
   XPROCESS (process)->pid = pid;
   if (0 <= pid)
     XPROCESS (process)->alive = 1;
@@ -1874,7 +1872,7 @@ create_process (Lisp_Object process, char **new_argv, Lisp_Object current_dir)
       /* Wait for child_setup to complete in case that vfork is
          actually defined as fork.  The descriptor wait_child_setup[1]
          of a pipe is closed at the child side either by close-on-exec
-         on successful execvp or the _exit call in child_setup.  */
+         on successful execve or the _exit call in child_setup.  */
       {
         char dummy;
 
@@ -6160,35 +6158,37 @@ process has been transmitted to the serial port.  */)
   return process;
 }
 
-/* If the status of the process DESIRED has changed, return true and
-   set *STATUS to its exit status; otherwise, return false.
-   If HAVE is nonnegative, assume that HAVE = waitpid (HAVE, STATUS, ...)
-   has already been invoked, and do not invoke waitpid again.  */
+#ifdef SIGCHLD
 
-static bool
-process_status_retrieved (pid_t desired, pid_t have, int *status)
-{
-  if (have < 0)
-    {
-      /* Invoke waitpid only with a known process ID; do not invoke
-         waitpid with a nonpositive argument.  Otherwise, Emacs might
-         reap an unwanted process by mistake.  For example, invoking
-         waitpid (-1, ...) can mess up glib by reaping glib's subprocesses,
-         so that another thread running glib won't find them.  */
-      do
-        have = waitpid (desired, status, WNOHANG | WUNTRACED);
-      while (have < 0 && errno == EINTR);
-    }
+/* The main Emacs thread records child processes in three places:
 
-  return have == desired;
-}
+   - Vprocess_alist, for asynchronous subprocesses, which are child
+     processes visible to Lisp.
 
-/* If PID is nonnegative, the child process PID with wait status W has
-   changed its status; record this and return true.
+   - deleted_pid_list, for child processes invisible to Lisp,
+     typically because of delete-process.  These are recorded so that
+     the processes can be reaped when they exit, so that the operating
+     system's process table is not cluttered by zombies.
 
-   If PID is negative, ignore W, and look for known child processes
-   of Emacs whose status have changed.  For each one found, record its new
-   status.
+   - the local variable PID in Fcall_process, call_process_cleanup and
+     call_process_kill, for synchronous subprocesses.
+     record_unwind_protect is used to make sure this process is not
+     forgotten: if the user interrupts call-process and the child
+     process refuses to exit immediately even with two C-g's,
+     call_process_kill adds PID's contents to deleted_pid_list before
+     returning.
+
+   The main Emacs thread invokes waitpid only on child processes that
+   it creates and that have not been reaped.  This avoid races on
+   platforms such as GTK, where other threads create their own
+   subprocesses which the main thread should not reap.  For example,
+   if the main thread attempted to reap an already-reaped child, it
+   might inadvertently reap a GTK-created process that happened to
+   have the same process ID.  */
+
+/* Handle a SIGCHLD signal by looking for known child processes of
+   Emacs whose status have changed.  For each one found, record its
+   new status.
 
    All we do is change the status; we do not run sentinels or print
    notifications.  That is saved for the next time keyboard input is
@@ -6211,20 +6211,15 @@ process_status_retrieved (pid_t desired, pid_t have, int *status)
    ** Malloc WARNING: This should never call malloc either directly or
    indirectly; if it does, that is a bug  */
 
-void
-record_child_status_change (pid_t pid, int w)
+static void
+handle_child_signal (int sig)
 {
-#ifdef SIGCHLD
-
-  /* Record at most one child only if we already know one child that
-     has exited.  */
-  bool record_at_most_one_child = 0 <= pid;
-
   Lisp_Object tail;
 
   /* Find the process that signaled us, and record its status.  */
 
-  /* The process can have been deleted by Fdelete_process.  */
+  /* The process can have been deleted by Fdelete_process, or have
+     been started asynchronously by Fcall_process.  */
   for (tail = deleted_pid_list; CONSP (tail); tail = XCDR (tail))
     {
       bool all_pids_are_fixnums
@@ -6238,12 +6233,8 @@ record_child_status_change (pid_t pid, int w)
             deleted_pid = XINT (xpid);
           else
             deleted_pid = XFLOAT_DATA (xpid);
-          if (process_status_retrieved (deleted_pid, pid, &w))
-            {
-              XSETCAR (tail, Qnil);
-              if (record_at_most_one_child)
-                return;
-            }
+          if (child_status_changed (deleted_pid, 0, 0))
+            XSETCAR (tail, Qnil);
         }
     }
 
@@ -6252,15 +6243,17 @@ record_child_status_change (pid_t pid, int w)
     {
       Lisp_Object proc = XCDR (XCAR (tail));
       struct Lisp_Process *p = XPROCESS (proc);
-      if (p->alive && process_status_retrieved (p->pid, pid, &w))
+      int status;
+
+      if (p->alive && child_status_changed (p->pid, &status, WUNTRACED))
         {
           /* Change the status of the process that was found.  */
           p->tick = ++process_tick;
-          p->raw_status = w;
+          p->raw_status = status;
           p->raw_status_new = 1;
 
           /* If process has terminated, stop waiting for its output.  */
-          if (WIFSIGNALED (w) || WIFEXITED (w))
+          if (WIFSIGNALED (status) || WIFEXITED (status))
             {
               int clear_desc_flag = 0;
               p->alive = 0;
@@ -6274,44 +6267,8 @@ record_child_status_change (pid_t pid, int w)
                   FD_CLR (p->infd, &non_keyboard_wait_mask);
                 }
             }
-
-          /* Tell wait_reading_process_output that it needs to wake up and
-             look around.  */
-          if (input_available_clear_time)
-            *input_available_clear_time = make_emacs_time (0, 0);
-
-          if (record_at_most_one_child)
-            return;
         }
     }
-
-  if (0 <= pid)
-    {
-      /* The caller successfully waited for a pid but no asynchronous
-         process was found for it, so this is a synchronous process.  */
-
-      synch_process_alive = 0;
-
-      /* Report the status of the synchronous process.  */
-      if (WIFEXITED (w))
-        synch_process_retcode = WEXITSTATUS (w);
-      else if (WIFSIGNALED (w))
-        synch_process_termsig = WTERMSIG (w);
-
-      /* Tell wait_reading_process_output that it needs to wake up and
-         look around.  */
-      if (input_available_clear_time)
-        *input_available_clear_time = make_emacs_time (0, 0);
-    }
-#endif
-}
-
-#ifdef SIGCHLD
-
-static void
-handle_child_signal (int sig)
-{
-  record_child_status_change (-1, 0);
 }
 
 static void
diff --git a/src/process.h b/src/process.h
index 74d1a124060..4fa22747ca9 100644
--- a/src/process.h
+++ b/src/process.h
@@ -185,23 +185,6 @@ pset_gnutls_cred_type (struct Lisp_Process *p, Lisp_Object val)
 }
 #endif
 
-/* True if we are about to fork off a synchronous process or if we
-   are waiting for it.  */
-extern bool synch_process_alive;
-
-/* Communicate exit status of sync process to from sigchld_handler
-   to Fcall_process.  */
-
-/* Nonzero => this is a string explaining death of synchronous subprocess.  */
-extern const char *synch_process_death;
-
-/* Nonzero => this is the signal number that terminated the subprocess.  */
-extern int synch_process_termsig;
-
-/* If synch_process_death is zero,
-   this is exit code of synchronous subprocess.  */
-extern int synch_process_retcode;
-
 /* Nonzero means don't run process sentinels.  This is used
    when exiting.  */
 extern int inhibit_sentinels;
diff --git a/src/sysdep.c b/src/sysdep.c
index 1a3834f0379..7068a4f0977 100644
--- a/src/sysdep.c
+++ b/src/sysdep.c
@@ -266,45 +266,71 @@ init_baud_rate (int fd)
 
 #ifndef MSDOS
 
-static void
-wait_for_termination_1 (pid_t pid, int interruptible)
+/* Wait for the subprocess with process id CHILD to terminate or change status.
+   CHILD must be a child process that has not been reaped.
+   If STATUS is non-null, store the waitpid-style exit status into *STATUS
+   and tell wait_reading_process_output that it needs to look around.
+   Use waitpid-style OPTIONS when waiting.
+   If INTERRUPTIBLE, this function is interruptible by a signal.
+
+   Return CHILD if successful, 0 if no status is available;
+   the latter is possible only when options & NOHANG.  */
+static pid_t
+get_child_status (pid_t child, int *status, int options, bool interruptible)
 {
-  while (1)
+  pid_t pid;
+
+  /* Invoke waitpid only with a known process ID; do not invoke
+     waitpid with a nonpositive argument.  Otherwise, Emacs might
+     reap an unwanted process by mistake.  For example, invoking
+     waitpid (-1, ...) can mess up glib by reaping glib's subprocesses,
+     so that another thread running glib won't find them.  */
+  eassert (0 < child);
+
+  while ((pid = waitpid (child, status, options)) < 0)
     {
-      int status;
-      int wait_result = waitpid (pid, &status, 0);
-      if (wait_result < 0)
-        {
-          if (errno != EINTR)
-            break;
-        }
-      else
-        {
-          record_child_status_change (wait_result, status);
-          break;
-        }
+      /* CHILD must be a child process that has not been reaped, and
+         STATUS and OPTIONS must be valid.  */
+      eassert (errno == EINTR);
 
       /* Note: the MS-Windows emulation of waitpid calls QUIT
          internally.  */
       if (interruptible)
         QUIT;
     }
-}
 
-/* Wait for subprocess with process id `pid' to terminate and
-   make sure it will get eliminated (not remain forever as a zombie) */
+  /* If successful and status is requested, tell wait_reading_process_output
+     that it needs to wake up and look around.  */
+  if (pid && status && input_available_clear_time)
+    *input_available_clear_time = make_emacs_time (0, 0);
 
+  return pid;
+}
+
+/* Wait for the subprocess with process id CHILD to terminate.
+   CHILD must be a child process that has not been reaped.
+   If STATUS is non-null, store the waitpid-style exit status into *STATUS
+   and tell wait_reading_process_output that it needs to look around.
+   If INTERRUPTIBLE, this function is interruptible by a signal.  */
 void
-wait_for_termination (pid_t pid)
+wait_for_termination (pid_t child, int *status, bool interruptible)
 {
-  wait_for_termination_1 (pid, 0);
+  get_child_status (child, status, 0, interruptible);
 }
 
-/* Like the above, but allow keyboard interruption. */
-void
-interruptible_wait_for_termination (pid_t pid)
+/* Report whether the subprocess with process id CHILD has changed status.
+   Termination counts as a change of status.
+   CHILD must be a child process that has not been reaped.
+   If STATUS is non-null, store the waitpid-style exit status into *STATUS
+   and tell wait_reading_process_output that it needs to look around.
+   Use waitpid-style OPTIONS to check status, but do not wait.
+
+   Return CHILD if successful, 0 if no status is available because
+   the process's state has not changed.  */
+pid_t
+child_status_changed (pid_t child, int *status, int options)
 {
-  wait_for_termination_1 (pid, 1);
+  return get_child_status (child, status, WNOHANG | options, 0);
 }
 
 /*
@@ -454,6 +480,7 @@ sys_subshell (void)
   char oldwd[MAXPATHLEN+1]; /* Fixed length is safe on MSDOS.  */
 #endif
   pid_t pid;
+  int status;
   struct save_signal saved_handlers[5];
   Lisp_Object dir;
   unsigned char *volatile str_volatile = 0;
@@ -491,7 +518,6 @@ sys_subshell (void)
 #ifdef DOS_NT
   pid = 0;
   save_signal_handlers (saved_handlers);
-  synch_process_alive = 1;
 #else
   pid = vfork ();
   if (pid == -1)
@@ -560,14 +586,12 @@ sys_subshell (void)
   /* Do this now if we did not do it before.  */
 #ifndef MSDOS
   save_signal_handlers (saved_handlers);
-  synch_process_alive = 1;
 #endif
 
 #ifndef DOS_NT
-  wait_for_termination (pid);
+  wait_for_termination (pid, &status, 0);
 #endif
   restore_signal_handlers (saved_handlers);
-  synch_process_alive = 0;
 }
 
 static void
diff --git a/src/syswait.h b/src/syswait.h
index aa4c4bcf527..360407d558e 100644
--- a/src/syswait.h
+++ b/src/syswait.h
@@ -23,6 +23,7 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #ifndef EMACS_SYSWAIT_H
 #define EMACS_SYSWAIT_H
 
+#include <stdbool.h>
 #include <sys/types.h>
 
 #ifdef HAVE_SYS_WAIT_H  /* We have sys/wait.h with POSIXoid definitions. */
@@ -52,10 +53,10 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #endif
 
 /* Defined in process.c.  */
-extern void record_child_status_change (pid_t, int);
+extern void record_deleted_pid (pid_t);
 
 /* Defined in sysdep.c.  */
-extern void wait_for_termination (pid_t);
-extern void interruptible_wait_for_termination (pid_t);
+extern void wait_for_termination (pid_t, int *, bool);
+extern pid_t child_status_changed (pid_t, int *, int);
 
 #endif /* EMACS_SYSWAIT_H */
diff --git a/src/textprop.c b/src/textprop.c
index 379eafb73f7..1ce44ad60ac 100644
--- a/src/textprop.c
+++ b/src/textprop.c
@@ -85,8 +85,18 @@ text_read_only (Lisp_Object propval)
   xsignal0 (Qtext_read_only);
 }
 
+/* Prepare to modify the region of BUFFER from START to END.  */
+
+static void
+modify_region (Lisp_Object buffer, Lisp_Object start, Lisp_Object end)
+{
+  struct buffer *buf = XBUFFER (buffer), *old = current_buffer;
+
+  set_buffer_internal (buf);
+  modify_region_1 (XINT (start), XINT (end), true);
+  set_buffer_internal (old);
+}
 
-
 /* Extract the interval at the position pointed to by BEGIN from
    OBJECT, a string or buffer.  Additionally, check that the positions
    pointed to by BEGIN and END are within the bounds of OBJECT, and
@@ -1164,7 +1174,7 @@ Return t if any property value actually changed, nil otherwise.  */)
     }
 
   if (BUFFERP (object))
-    modify_region (XBUFFER (object), XINT (start), XINT (end), 1);
+    modify_region (object, start, end);
 
   /* We are at the beginning of interval I, with LEN chars to scan.  */
   for (;;)
@@ -1302,7 +1312,7 @@ set_text_properties (Lisp_Object start, Lisp_Object end, Lisp_Object properties,
     }
 
   if (BUFFERP (object) && !NILP (coherent_change_p))
-    modify_region (XBUFFER (object), XINT (start), XINT (end), 1);
+    modify_region (object, start, end);
 
   set_text_properties_1 (start, end, properties, object, i);
 
@@ -1451,7 +1461,7 @@ Use `set-text-properties' if you want to remove all text properties.  */)
     }
 
   if (BUFFERP (object))
-    modify_region (XBUFFER (object), XINT (start), XINT (end), 1);
+    modify_region (object, start, end);
 
   /* We are at the beginning of an interval, with len to scan */
   for (;;)
@@ -1565,7 +1575,7 @@ Return t if any property was actually removed, nil otherwise.  */)
           else if (LENGTH (i) == len)
             {
               if (!modified && BUFFERP (object))
-                modify_region (XBUFFER (object), XINT (start), XINT (end), 1);
+                modify_region (object, start, end);
               remove_properties (Qnil, properties, i, object);
               if (BUFFERP (object))
                 signal_after_change (XINT (start), XINT (end) - XINT (start),
@@ -1578,7 +1588,7 @@ Return t if any property was actually removed, nil otherwise.  */)
               i = split_interval_left (i, len);
               copy_properties (unchanged, i);
               if (!modified && BUFFERP (object))
-                modify_region (XBUFFER (object), XINT (start), XINT (end), 1);
+                modify_region (object, start, end);
               remove_properties (Qnil, properties, i, object);
               if (BUFFERP (object))
                 signal_after_change (XINT (start), XINT (end) - XINT (start),
@@ -1589,7 +1599,7 @@ Return t if any property was actually removed, nil otherwise.  */)
       if (interval_has_some_properties_list (properties, i))
         {
           if (!modified && BUFFERP (object))
-            modify_region (XBUFFER (object), XINT (start), XINT (end), 1);
+            modify_region (object, start, end);
           remove_properties (Qnil, properties, i, object);
           modified = 1;
         }
diff --git a/src/w32.c b/src/w32.c
index c8e16dfaa94..e81fc7b4f3e 100644
--- a/src/w32.c
+++ b/src/w32.c
@@ -150,10 +150,18 @@ typedef struct _REPARSE_DATA_BUFFER {
     } DUMMYUNIONNAME;
 } REPARSE_DATA_BUFFER, *PREPARSE_DATA_BUFFER;
 
+#ifndef FILE_DEVICE_FILE_SYSTEM
 #define FILE_DEVICE_FILE_SYSTEM 9
+#endif
+#ifndef METHOD_BUFFERED
 #define METHOD_BUFFERED         0
+#endif
+#ifndef FILE_ANY_ACCESS
 #define FILE_ANY_ACCESS         0x00000000
+#endif
+#ifndef CTL_CODE
 #define CTL_CODE(t,f,m,a)       (((t)<<16)|((a)<<14)|((f)<<2)|(m))
+#endif
 #define FSCTL_GET_REPARSE_POINT \
   CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS)
 #endif
diff --git a/src/w32common.h b/src/w32common.h
index 50724e5553c..5e9b61824ae 100644
--- a/src/w32common.h
+++ b/src/w32common.h
@@ -34,7 +34,7 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.
 
 extern SYSTEM_INFO    sysinfo_cache;
 extern OSVERSIONINFO  osinfo_cache;
-extern unsigned long  syspage_mask;
+extern DWORD_PTR      syspage_mask;
 
 extern int            w32_major_version;
 extern int            w32_minor_version;
diff --git a/src/w32fns.c b/src/w32fns.c
index 90f5b1695ea..044c377f496 100644
--- a/src/w32fns.c
+++ b/src/w32fns.c
@@ -82,7 +82,6 @@ void syms_of_w32fns (void);
 void globals_of_w32fns (void);
 
 extern void free_frame_menubar (struct frame *);
-extern double atof (const char *);
 extern int w32_console_toggle_lock_key (int, Lisp_Object);
 extern void w32_menu_display_help (HWND, HMENU, UINT, UINT);
 extern void w32_free_menu_strings (HWND);
@@ -223,7 +222,7 @@ SYSTEM_INFO sysinfo_cache;
 /* This gives us version, build, and platform identification.  */
 OSVERSIONINFO osinfo_cache;
 
-unsigned long syspage_mask = 0;
+DWORD_PTR syspage_mask = 0;
 
 /* The major and minor versions of NT.  */
 int w32_major_version;
@@ -6035,7 +6034,7 @@ typedef char guichar_t;
    read-only when "Directories" is selected in the filter.  This
    allows us to work around the fact that the standard Open File
    dialog does not support directories.  */
-static UINT CALLBACK
+static UINT_PTR CALLBACK
 file_dialog_callback (HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam)
 {
   if (msg == WM_NOTIFY)
diff --git a/src/w32proc.c b/src/w32proc.c
index 9b111b40e36..87af8682390 100644
--- a/src/w32proc.c
+++ b/src/w32proc.c
@@ -1274,33 +1274,7 @@ waitpid (pid_t pid, int *status, int options)
 #endif
 
   if (status)
-    {
-      *status = retval;
-    }
-  else if (synch_process_alive)
-    {
-      synch_process_alive = 0;
-
-      /* Report the status of the synchronous process.  */
-      if (WIFEXITED (retval))
-        synch_process_retcode = WEXITSTATUS (retval);
-      else if (WIFSIGNALED (retval))
-        {
-          int code = WTERMSIG (retval);
-          const char *signame;
-
-          synchronize_system_messages_locale ();
-          signame = strsignal (code);
-
-          if (signame == 0)
-            signame = "unknown";
-
-          synch_process_death = signame;
-        }
-
-      reap_subprocess (cp);
-    }
-
+    *status = retval;
   reap_subprocess (cp);
 
   return pid;
diff --git a/src/xdisp.c b/src/xdisp.c
index 2f7b0a21f3b..4bab2756e64 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -15778,6 +15778,35 @@ redisplay_window (Lisp_Object window, int just_this_one_p)
              Move it back to a fully-visible line.  */
           new_vpos = window_box_height (w);
         }
+      else if (w->cursor.vpos >=0)
+        {
+          /* Some people insist on not letting point enter the scroll
+             margin, even though this part handles windows that didn't
+             scroll at all.  */
+          struct frame *f = XFRAME (w->frame);
+          int margin = min (scroll_margin, WINDOW_TOTAL_LINES (w) / 4);
+          int pixel_margin = margin * FRAME_LINE_HEIGHT (f);
+          bool header_line = WINDOW_WANTS_HEADER_LINE_P (w);
+
+          /* Note: We add an extra FRAME_LINE_HEIGHT, because the loop
+             below, which finds the row to move point to, advances by
+             the Y coordinate of the _next_ row, see the definition of
+             MATRIX_ROW_BOTTOM_Y.  */
+          if (w->cursor.vpos < margin + header_line)
+            new_vpos
+              = pixel_margin + (header_line
+                                ? CURRENT_HEADER_LINE_HEIGHT (w)
+                                : 0) + FRAME_LINE_HEIGHT (f);
+          else
+            {
+              int window_height = window_box_height (w);
+
+              if (header_line)
+                window_height += CURRENT_HEADER_LINE_HEIGHT (w);
+              if (w->cursor.y >= window_height - pixel_margin)
+                new_vpos = window_height - pixel_margin;
+            }
+        }
 
       /* If we need to move point for either of the above reasons,
          now actually do it.  */
diff --git a/src/xterm.c b/src/xterm.c
index 8f7ed8ef561..68d2dd7c70d 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -2261,7 +2261,6 @@ static void
 x_draw_image_relief (struct glyph_string *s)
 {
   int x1, y1, thick, raised_p, top_p, bot_p, left_p, right_p;
-  int extra_x, extra_y;
   XRectangle r;
   int x = s->x;
   int y = s->ybase - image_ascent (s->img, s->face, &s->slice);
@@ -2292,20 +2291,6 @@ x_draw_image_relief (struct glyph_string *s)
       raised_p = s->img->relief > 0;
     }
 
-  extra_x = extra_y = 0;
-  if (s->face->id == TOOL_BAR_FACE_ID)
-    {
-      if (CONSP (Vtool_bar_button_margin)
-          && INTEGERP (XCAR (Vtool_bar_button_margin))
-          && INTEGERP (XCDR (Vtool_bar_button_margin)))
-        {
-          extra_x = XINT (XCAR (Vtool_bar_button_margin));
-          extra_y = XINT (XCDR (Vtool_bar_button_margin));
-        }
-      else if (INTEGERP (Vtool_bar_button_margin))
-        extra_x = extra_y = XINT (Vtool_bar_button_margin);
-    }
-
   x1 = x + s->slice.width - 1;
   y1 = y + s->slice.height - 1;
   top_p = bot_p = left_p = right_p = 0;