1 files changed, 12 insertions, 3 deletions

diff --git a/src/alloc.c b/src/alloc.c
index 055f5d82347..0b80fd5d9e7 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -155,6 +155,7 @@ int malloc_sbrk_unused;
 
 EMACS_INT undo_limit;
 EMACS_INT undo_strong_limit;
+EMACS_INT undo_outer_limit;
 
 /* Number of live and free conses etc.  */
 
@@ -4383,7 +4384,7 @@ returns nil, because real GC can't be done.  */)
         if (! EQ (nextb->undo_list, Qt))
           nextb->undo_list
             = truncate_undo_list (nextb->undo_list, undo_limit,
-                                  undo_strong_limit);
+                                  undo_strong_limit, undo_outer_limit);
 
         /* Shrink buffer gaps, but skip indirect and dead buffers.  */
         if (nextb->base_buffer == 0 && !NILP (nextb->name))
@@ -5669,12 +5670,20 @@ which includes both saved text and other data.  */);
 
   DEFVAR_INT ("undo-strong-limit", &undo_strong_limit,
               doc: /* Don't keep more than this much size of undo information.
-A command which pushes past this size is itself forgotten.
-This limit is applied when garbage collection happens.
+A previous command which pushes the undo list past this size
+is entirely forgotten when GC happens.
 The size is counted as the number of bytes occupied,
 which includes both saved text and other data.  */);
   undo_strong_limit = 30000;
 
+  DEFVAR_INT ("undo-outer-limit", &undo_outer_limit,
+              doc: /* Don't keep more than this much size of undo information.
+If the current command has produced more than this much undo information,
+GC discards it.  This is a last-ditch limit to prevent memory overflow.
+The size is counted as the number of bytes occupied,
+which includes both saved text and other data.  */);
+  undo_outer_limit = 300000;
+
   DEFVAR_BOOL ("garbage-collection-messages", &garbage_collection_messages,
                doc: /* Non-nil means display messages at start and end of garbage collection.  */);
   garbage_collection_messages = 0;