11 files changed, 332 insertions, 66 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 7f90c576fb1..9d7834fd053 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,6 +1,6 @@
-2011-08-06  Paul Eggert  <eggert@cs.ucla.edu>
+2011-08-14  Paul Eggert  <eggert@cs.ucla.edu>
 
-        Integer and memory overflow issues.
+        Integer and memory overflow issues (Bug#9196).
 
         * charset.c (charset_table_size)
         (struct charset_sort_data.priority): Now ptrdiff_t.
@@ -409,6 +409,87 @@
         (gs_load): Use printmax_t to print the widest integers possible.
         Check for integer overflow when computing image height and width.
 
+2011-08-14  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * xfaces.c (Qframe_set_background_mode): Now static.
+        * dispextern.h (Qframe_set_background_mode): Remove decl.
+
+        * process.c (Fnetwork_interface_info): Declare local only if needed.
+
+2011-08-13  Jan Djärv  <jan.h.d@swipnet.se>
+
+        * process.c: Include ifaddrs.h and net/if_dl.h if available (Bug#8477).
+        (Fnetwork_interface_list): Allocate in increments of bytes instead
+        of sizeof (struct ifreq).  Iterate over ifconf.ifc_req by counting
+        bytes (Bug#8477).  Count bytes correctly when ifr_addr is a struct
+        sockaddr.
+        (struct ifflag_def): notrailers is smart on OSX.
+        (Fnetwork_interface_info): Handle case when ifr_flags is negative.
+        Get hardware address with getifaddrs if available.
+
+2011-08-12  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (iterate_out_of_display_property): xassert that
+        IT->position is set to within IT->object's boundaries.  Break from
+        the loop as soon as EOB is reached; avoids infloops in redisplay
+        when IT->position is set up wrongly due to some bug.  Set
+        IT->current to match the bidi iterator unconditionally.
+        (push_display_prop): Allow GET_FROM_STRING as IT->method on
+        entry.  Force push_it to save on the stack the current
+        buffer/string position, to be restored by pop_it.  Fix flags in
+        the iterator structure wrt the object coming from a display
+        property, as `line-prefix' and `wrap-prefix' are not ``replacing''
+        properties.  (Bug#9284)
+
+2011-08-09  Andreas Schwab  <schwab@linux-m68k.org>
+
+        * fontset.c (fontset_get_font_group): Add proper type checks.
+        (Bug#9172)
+
+2011-08-09  YAMAMOTO Mitsuharu  <mituharu@math.s.chiba-u.ac.jp>
+
+        * unexmacosx.c (print_load_command_name): Add cases LC_FUNCTION_STARTS
+        and LC_VERSION_MIN_MACOSX.
+        (copy_linkedit_data) [LC_FUNCTION_STARTS]: New function.
+        (dump_it) [LC_FUNCTION_STARTS]: Use it.
+
+2011-08-08  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (forward_to_next_line_start): Allow to use the
+        no-display-properties-and-no-overlays under bidi display.  Set
+        disp_pos in the bidi iterator to avoid searches for display
+        properties and overlays.
+
+2011-08-08  Chong Yidong  <cyd@stupidchicken.com>
+
+        * editfns.c (Fset_time_zone_rule): Document relationship with the
+        setenv function.
+
+        * ftfont.c (ftfont_pattern_entity): Copy the extras argument to
+        the font entity extracted from the cache (Bug#8109).
+
+2011-08-07  Chong Yidong  <cyd@stupidchicken.com>
+
+        * composite.c (autocmp_chars): Don't reset point.  That is done by
+        restore_point_unwind (Bug#5984).
+
+2011-08-07  Juri Linkov  <juri@jurta.org>
+
+        * editfns.c (Fformat_time_string): Doc fix, add tag `usage:'
+        to show the arg `TIME' instead of `TIMEVAL'.
+
+2011-08-06  Eli Zaretskii  <eliz@gnu.org>
+
+        * xdisp.c (set_cursor_from_row): Fix cursor positioning when a
+        display property strides EOL and includes a newline, as in
+        longlines-mode.  (Bug#9254)
+        (move_it_in_display_line_to): Fix vertical-motion in a buffer with
+        word-wrap under bidirectional display.  (Bug#9224)
+
+        * bidi.c (bidi_unshelve_cache): Don't reset the cache if JUST_FREE
+        is non-zero, even if the data buffer is NULL.  Fixes a crash in
+        vertical-motion with longlines-mode.  (Bug#9254)
+
 2011-08-05  Eli Zaretskii  <eliz@gnu.org>
 
         * bidi.c <bidi_cache_total_alloc>: Now static.
diff --git a/src/bidi.c b/src/bidi.c
index f6ad22f8ea2..767af02a78a 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -669,7 +669,11 @@ bidi_shelve_cache (void)
   return databuf;
 }
 
-/* Restore the cache state from a copy stashed away by bidi_shelve_cache.  */
+/* Restore the cache state from a copy stashed away by
+   bidi_shelve_cache, and free the buffer used to stash that copy.
+   JUST_FREE non-zero means free the buffer, but don't restore the
+   cache; used when the corresponding iterator is discarded instead of
+   being restored.  */
 void
 bidi_unshelve_cache (void *databuf, int just_free)
 {
@@ -677,10 +681,13 @@ bidi_unshelve_cache (void *databuf, int just_free)
 
   if (!p)
     {
-      /* A NULL pointer means an empty cache.  */
-      bidi_cache_start = 0;
-      bidi_cache_sp = 0;
-      bidi_cache_reset ();
+      if (!just_free)
+        {
+          /* A NULL pointer means an empty cache.  */
+          bidi_cache_start = 0;
+          bidi_cache_sp = 0;
+          bidi_cache_reset ();
+        }
     }
   else
     {
diff --git a/src/composite.c b/src/composite.c
index 738fcd3774c..2a3fbe29552 100644
--- a/src/composite.c
+++ b/src/composite.c
@@ -965,8 +965,6 @@ autocmp_chars (Lisp_Object rule, EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT
       args[4] = font_object;
       args[5] = string;
       lgstring = safe_call (6, args);
-      if (NILP (string))
-        TEMP_SET_PT_BOTH (pt, pt_byte);
     }
   return unbind_to (count, lgstring);
 }
diff --git a/src/dispextern.h b/src/dispextern.h
index 02d1089e3e7..83c3ba713b6 100644
--- a/src/dispextern.h
+++ b/src/dispextern.h
@@ -3203,7 +3203,6 @@ int merge_faces (struct frame *, Lisp_Object, EMACS_INT, int);
 int compute_char_face (struct frame *, int, Lisp_Object);
 void free_all_realized_faces (Lisp_Object);
 extern Lisp_Object Qforeground_color, Qbackground_color;
-extern Lisp_Object Qframe_set_background_mode;
 extern char unspecified_fg[], unspecified_bg[];
 
 /* Defined in xfns.c  */
diff --git a/src/editfns.c b/src/editfns.c
index 4e1b46b82c3..90b559dfdd5 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -1695,7 +1695,9 @@ The modifiers are `E' and `O'.  For certain characters X,
 %EX is a locale's alternative version of %X;
 %OX is like %X, but uses the locale's number symbols.
 
-For example, to produce full ISO 8601 format, use "%Y-%m-%dT%T%z".  */)
+For example, to produce full ISO 8601 format, use "%Y-%m-%dT%T%z".
+
+usage: (format-time-string FORMAT-STRING &optional TIME UNIVERSAL)  */)
   (Lisp_Object format_string, Lisp_Object timeval, Lisp_Object universal)
 {
   time_t value;
@@ -2051,7 +2053,12 @@ static char *initial_tz;
 DEFUN ("set-time-zone-rule", Fset_time_zone_rule, Sset_time_zone_rule, 1, 1, 0,
        doc: /* Set the local time zone using TZ, a string specifying a time zone rule.
 If TZ is nil, use implementation-defined default time zone information.
-If TZ is t, use Universal Time.  */)
+If TZ is t, use Universal Time.
+
+Instead of calling this function, you typically want (setenv "TZ" TZ).
+That changes both the environment of the Emacs process and the
+variable `process-environment', whereas `set-time-zone-rule' affects
+only the former.  */)
   (Lisp_Object tz)
 {
   const char *tzstring;
diff --git a/src/fontset.c b/src/fontset.c
index 74eb61d2665..c8ae1e74848 100644
--- a/src/fontset.c
+++ b/src/fontset.c
@@ -447,7 +447,7 @@ reorder_font_vector (Lisp_Object font_group, struct font *font)
 /* Return a font-group (actually a cons (-1 . FONT-GROUP-VECTOR)) for
    character C in FONTSET.  If C is -1, return a fallback font-group.
    If C is not -1, the value may be Qt (FONTSET doesn't have a font
-   for C even in the fallback group, or 0 (a font for C may be found
+   for C even in the fallback group), or 0 (a font for C may be found
    only in the fallback group).  */
 
 static Lisp_Object
@@ -465,7 +465,9 @@ fontset_get_font_group (Lisp_Object fontset, int c)
   if (! NILP (font_group))
     return font_group;
   base_fontset = FONTSET_BASE (fontset);
-  if (c >= 0)
+  if (NILP (base_fontset))
+    font_group = Qnil;
+  else if (c >= 0)
     font_group = char_table_ref_and_range (base_fontset, c, &from, &to);
   else
     font_group = FONTSET_FALLBACK (base_fontset);
@@ -476,6 +478,8 @@ fontset_get_font_group (Lisp_Object fontset, int c)
         char_table_set_range (fontset, from, to, font_group);
       return font_group;
     }
+  if (!VECTORP (font_group))
+    return font_group;
   font_group = Fcopy_sequence (font_group);
   for (i = 0; i < ASIZE (font_group); i++)
     if (! NILP (AREF (font_group, i)))
diff --git a/src/ftfont.c b/src/ftfont.c
index 5b95e2b2f08..7858a31be21 100644
--- a/src/ftfont.c
+++ b/src/ftfont.c
@@ -214,6 +214,10 @@ ftfont_pattern_entity (FcPattern *p, Lisp_Object extra)
 
       for (i = 0; i < FONT_OBJLIST_INDEX; i++)
         ASET (val, i, AREF (entity, i));
+
+      ASET (val, FONT_EXTRA_INDEX, Fcopy_sequence (extra));
+      font_put_extra (val, QCfont_entity, key);
+
       return val;
     }
   entity = font_make_entity ();
diff --git a/src/process.c b/src/process.c
index f2c2bfd81c5..887090df26c 100644
--- a/src/process.c
+++ b/src/process.c
@@ -58,6 +58,17 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #include <net/if.h>
 #endif /* HAVE_NET_IF_H */
 
+#if defined(HAVE_IFADDRS_H)
+/* Must be after net/if.h */
+#include <ifaddrs.h>
+
+/* We only use structs from this header when we use getifaddrs.  */
+#if defined(HAVE_NET_IF_DL_H)
+#include <net/if_dl.h>
+#endif
+
+#endif
+
 #ifdef NEED_BSDTTY
 #include <bsdtty.h>
 #endif
@@ -3557,9 +3568,10 @@ format; see the description of ADDRESS in `make-network-process'.  */)
   (void)
 {
   struct ifconf ifconf;
-  struct ifreq *ifreqs = NULL;
-  ptrdiff_t ifaces = 0;
-  int buf_size, s;
+  struct ifreq *ifreq;
+  void *buf = NULL;
+  ptrdiff_t buf_size = 512;
+  int s, i;
   Lisp_Object res;
 
   s = socket (AF_INET, SOCK_STREAM, 0);
@@ -3567,14 +3579,14 @@ format; see the description of ADDRESS in `make-network-process'.  */)
     return Qnil;
 
  again:
-  ifreqs = xpalloc (ifreqs, &ifaces, 25,
-                    INT_MAX / sizeof *ifreqs, sizeof *ifreqs);
-  buf_size = ifaces * sizeof (ifreqs[0]);
+
+  buf = xpalloc (buf, &buf_size, sizeof *ifreq, INT_MAX, 1);
+  ifconf.ifc_buf = buf;
   ifconf.ifc_len = buf_size;
-  ifconf.ifc_req = ifreqs;
   if (ioctl (s, SIOCGIFCONF, &ifconf))
     {
       close (s);
+      xfree (buf);
       return Qnil;
     }
 
@@ -3582,15 +3594,29 @@ format; see the description of ADDRESS in `make-network-process'.  */)
     goto again;
 
   close (s);
-  ifaces = ifconf.ifc_len / sizeof (ifreqs[0]);
 
   res = Qnil;
-  while (--ifaces >= 0)
+  for (ifreq = ifconf.ifc_req;
+       (char *) ifreq < (char *) (ifconf.ifc_req) + ifconf.ifc_len;
+       )
     {
-      struct ifreq *ifq = &ifreqs[ifaces];
+      struct ifreq *ifq = ifreq;
+#ifdef HAVE_STRUCT_IFREQ_IFR_ADDR_SA_LEN
+#define SIZEOF_IFREQ(sif)                                               \
+      ((sif)->ifr_addr.sa_len < sizeof(struct sockaddr) ?               \
+       sizeof((*sif)) : sizeof ((sif)->ifr_name) + sif->ifr_addr.sa_len)
+
+      int len = SIZEOF_IFREQ (ifq);
+#else
+      int len = sizeof (*ifreq);
+#endif
       char namebuf[sizeof (ifq->ifr_name) + 1];
+      i += len;
+      ifreq = (struct ifreq*) ((char*) ifreq + len);
+
       if (ifq->ifr_addr.sa_family != AF_INET)
         continue;
+
       memcpy (namebuf, ifq->ifr_name, sizeof (ifq->ifr_name));
       namebuf[sizeof (ifq->ifr_name)] = 0;
       res = Fcons (Fcons (build_string (namebuf),
@@ -3599,6 +3625,7 @@ format; see the description of ADDRESS in `make-network-process'.  */)
                    res);
     }
 
+  xfree (buf);
   return res;
 }
 #endif /* SIOCGIFCONF */
@@ -3636,8 +3663,13 @@ static const struct ifflag_def ifflag_table[] = {
   { IFF_PROMISC,        "promisc" },
 #endif
 #ifdef IFF_NOTRAILERS
+#ifdef NS_IMPL_COCOA
+  /* Really means smart, notrailers is obsolete */
+  { IFF_NOTRAILERS,     "smart" },
+#else
   { IFF_NOTRAILERS,     "notrailers" },
 #endif
+#endif
 #ifdef IFF_ALLMULTI
   { IFF_ALLMULTI,       "allmulti" },
 #endif
@@ -3690,6 +3722,10 @@ FLAGS is the current flags of the interface.  */)
   Lisp_Object elt;
   int s;
   int any = 0;
+#if (! (defined SIOCGIFHWADDR && defined HAVE_STRUCT_IFREQ_IFR_HWADDR)  \
+     && defined HAVE_GETIFADDRS && defined LLADDR)
+  struct ifaddrs *ifap;
+#endif
 
   CHECK_STRING (ifname);
 
@@ -3708,6 +3744,12 @@ FLAGS is the current flags of the interface.  */)
       const struct ifflag_def *fp;
       int fnum;
 
+      /* If flags is smaller than int (i.e. short) it may have the high bit set
+         due to IFF_MULTICAST.  In that case, sign extending it into
+         an int is wrong.  */
+      if (flags < 0 && sizeof (rq.ifr_flags) < sizeof (flags))
+        flags = (unsigned short) rq.ifr_flags;
+
       any = 1;
       for (fp = ifflag_table; flags != 0 && fp->flag_sym; fp++)
         {
@@ -3741,7 +3783,38 @@ FLAGS is the current flags of the interface.  */)
         p->contents[n] = make_number (((unsigned char *)&rq.ifr_hwaddr.sa_data[0])[n]);
       elt = Fcons (make_number (rq.ifr_hwaddr.sa_family), hwaddr);
     }
+#elif defined(HAVE_GETIFADDRS) && defined(LLADDR)
+  if (getifaddrs (&ifap) != -1)
+    {
+      Lisp_Object hwaddr = Fmake_vector (make_number (6), Qnil);
+      register struct Lisp_Vector *p = XVECTOR (hwaddr);
+      struct ifaddrs *it;
+
+      for (it = ifap; it != NULL; it = it->ifa_next)
+        {
+          struct sockaddr_dl *sdl = (struct sockaddr_dl*) it->ifa_addr;
+          unsigned char linkaddr[6];
+          int n;
+
+          if (it->ifa_addr->sa_family != AF_LINK
+              || strcmp (it->ifa_name, SSDATA (ifname)) != 0
+              || sdl->sdl_alen != 6)
+            continue;
+
+          memcpy (linkaddr, LLADDR(sdl), sdl->sdl_alen);
+          for (n = 0; n < 6; n++)
+            p->contents[n] = make_number (linkaddr[n]);
+
+          elt = Fcons (make_number (it->ifa_addr->sa_family), hwaddr);
+          break;
+        }
+    }
+#ifdef HAVE_FREEIFADDRS
+  freeifaddrs (ifap);
 #endif
+
+#endif /* HAVE_GETIFADDRS && LLADDR */
+
   res = Fcons (elt, res);
 
   elt = Qnil;
diff --git a/src/unexmacosx.c b/src/unexmacosx.c
index 04e3edf463e..0751eeacb9b 100644
--- a/src/unexmacosx.c
+++ b/src/unexmacosx.c
@@ -599,6 +599,16 @@ print_load_command_name (int lc)
       printf ("LC_DYLD_INFO_ONLY");
       break;
 #endif
+#ifdef LC_VERSION_MIN_MACOSX
+    case LC_VERSION_MIN_MACOSX:
+      printf ("LC_VERSION_MIN_MACOSX");
+      break;
+#endif
+#ifdef LC_FUNCTION_STARTS
+    case LC_FUNCTION_STARTS:
+      printf ("LC_FUNCTION_STARTS");
+      break;
+#endif
     default:
       printf ("unknown          ");
     }
@@ -1135,6 +1145,28 @@ copy_dyld_info (struct load_command *lc, long delta)
 }
 #endif
 
+#ifdef LC_FUNCTION_STARTS
+/* Copy a LC_FUNCTION_STARTS load command from the input file to the
+   output file, adjusting the data offset field.  */
+static void
+copy_linkedit_data (struct load_command *lc, long delta)
+{
+  struct linkedit_data_command *ldp = (struct linkedit_data_command *) lc;
+
+  if (ldp->dataoff > 0)
+    ldp->dataoff += delta;
+
+  printf ("Writing ");
+  print_load_command_name (lc->cmd);
+  printf (" command\n");
+
+  if (!unexec_write (curr_header_offset, lc, lc->cmdsize))
+    unexec_error ("cannot write linkedit data command to header");
+
+  curr_header_offset += lc->cmdsize;
+}
+#endif
+
 /* Copy other kinds of load commands from the input file to the output
    file, ones that do not require adjustments of file offsets.  */
 static void
@@ -1207,6 +1239,11 @@ dump_it (void)
         copy_dyld_info (lca[i], linkedit_delta);
         break;
 #endif
+#ifdef LC_FUNCTION_STARTS
+      case LC_FUNCTION_STARTS:
+        copy_linkedit_data (lca[i], linkedit_delta);
+        break;
+#endif
       default:
         copy_other (lca[i]);
         break;
diff --git a/src/xdisp.c b/src/xdisp.c
index 481dd35c5d0..98bd25d1e4f 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -5323,6 +5323,8 @@ iterate_out_of_display_property (struct it *it)
   EMACS_INT eob = (buffer_p ? ZV : it->end_charpos);
   EMACS_INT bob = (buffer_p ? BEGV : 0);
 
+  xassert (eob >= CHARPOS (it->position) && CHARPOS (it->position) >= bob);
+
   /* Maybe initialize paragraph direction.  If we are at the beginning
      of a new paragraph, next_element_from_buffer may not have a
      chance to do that.  */
@@ -5331,7 +5333,8 @@ iterate_out_of_display_property (struct it *it)
   /* prev_stop can be zero, so check against BEGV as well.  */
   while (it->bidi_it.charpos >= bob
          && it->prev_stop <= it->bidi_it.charpos
-         && it->bidi_it.charpos < CHARPOS (it->position))
+         && it->bidi_it.charpos < CHARPOS (it->position)
+         && it->bidi_it.charpos < eob)
     bidi_move_to_visually_next (&it->bidi_it);
   /* Record the stop_pos we just crossed, for when we cross it
      back, maybe.  */
@@ -5340,14 +5343,11 @@ iterate_out_of_display_property (struct it *it)
   /* If we ended up not where pop_it put us, resync IT's
      positional members with the bidi iterator. */
   if (it->bidi_it.charpos != CHARPOS (it->position))
-    {
-      SET_TEXT_POS (it->position,
-                    it->bidi_it.charpos, it->bidi_it.bytepos);
-      if (buffer_p)
-        it->current.pos = it->position;
-      else
-        it->current.string_pos = it->position;
-    }
+    SET_TEXT_POS (it->position, it->bidi_it.charpos, it->bidi_it.bytepos);
+  if (buffer_p)
+    it->current.pos = it->position;
+  else
+    it->current.string_pos = it->position;
 }
 
 /* Restore IT's settings from IT->stack.  Called, for example, when no
@@ -5529,19 +5529,42 @@ forward_to_next_line_start (struct it *it, int *skipped_p,
 
       xassert (!STRINGP (it->string));
 
-      /* If we are not bidi-reordering, and there isn't any `display'
-         property in sight, and no overlays, we can just use the
-         position of the newline in buffer text.  */
-      if (!it->bidi_p
-          && (it->stop_charpos >= limit
-              || ((pos = Fnext_single_property_change (make_number (start),
-                                                       Qdisplay, Qnil,
-                                                       make_number (limit)),
-                   NILP (pos))
-                  && next_overlay_change (start) == ZV)))
-        {
-          IT_CHARPOS (*it) = limit;
-          IT_BYTEPOS (*it) = CHAR_TO_BYTE (limit);
+      /* If there isn't any `display' property in sight, and no
+         overlays, we can just use the position of the newline in
+         buffer text.  */
+      if (it->stop_charpos >= limit
+          || ((pos = Fnext_single_property_change (make_number (start),
+                                                   Qdisplay, Qnil,
+                                                   make_number (limit)),
+               NILP (pos))
+              && next_overlay_change (start) == ZV))
+        {
+          if (!it->bidi_p)
+            {
+              IT_CHARPOS (*it) = limit;
+              IT_BYTEPOS (*it) = CHAR_TO_BYTE (limit);
+            }
+          else
+            {
+              struct bidi_it bprev;
+
+              /* Help bidi.c avoid expensive searches for display
+                 properties and overlays, by telling it that there are
+                 none up to `limit'.  */
+              if (it->bidi_it.disp_pos < limit)
+                {
+                  it->bidi_it.disp_pos = limit;
+                  it->bidi_it.disp_prop_p = 0;
+                }
+              do {
+                bprev = it->bidi_it;
+                bidi_move_to_visually_next (&it->bidi_it);
+              } while (it->bidi_it.charpos != limit);
+              IT_CHARPOS (*it) = limit;
+              IT_BYTEPOS (*it) = it->bidi_it.bytepos;
+              if (bidi_it_prev)
+                *bidi_it_prev = bprev;
+            }
           *skipped_p = newline_found_p = 1;
         }
       else
@@ -8006,13 +8029,19 @@ move_it_in_display_line_to (struct it *it,
              positions smaller than TO_CHARPOS, return
              MOVE_POS_MATCH_OR_ZV, like the unidirectional display
              did.  */
-          if (it->bidi_p && (op & MOVE_TO_POS) != 0
-              && !saw_smaller_pos
-              && IT_CHARPOS (*it) > to_charpos)
+          if (it->bidi_p && (op & MOVE_TO_POS) != 0)
             {
-              if (IT_CHARPOS (ppos_it) < ZV)
-                RESTORE_IT (it, &ppos_it, ppos_data);
-              goto buffer_pos_reached;
+              if (!saw_smaller_pos && IT_CHARPOS (*it) > to_charpos)
+                {
+                  if (IT_CHARPOS (ppos_it) < ZV)
+                    RESTORE_IT (it, &ppos_it, ppos_data);
+                  goto buffer_pos_reached;
+                }
+              else if (it->line_wrap == WORD_WRAP && atpos_it.sp >= 0
+                       && IT_CHARPOS (*it) > to_charpos)
+                goto buffer_pos_reached;
+              else
+                result = MOVE_NEWLINE_OR_CR;
             }
           else
             result = MOVE_NEWLINE_OR_CR;
@@ -13283,6 +13312,9 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
   /* Last buffer position covered by an overlay string with an integer
      `cursor' property.  */
   EMACS_INT bpos_covered = 0;
+  /* Non-zero means the display string on which to display the cursor
+     comes from a text property, not from an overlay.  */
+  int string_from_text_prop = 0;
 
   /* Skip over glyphs not having an object at the start and the end of
      the row.  These are special glyphs like truncation marks on
@@ -13601,9 +13633,14 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
                 {
                   Lisp_Object str;
                   EMACS_INT tem;
+                  /* If the display property covers the newline, we
+                     need to search for it one position farther.  */
+                  EMACS_INT lim = pos_after
+                    + (pos_after == MATRIX_ROW_END_CHARPOS (row) + delta);
 
+                  string_from_text_prop = 0;
                   str = glyph->object;
-                  tem = string_buffer_position_lim (str, pos, pos_after, 0);
+                  tem = string_buffer_position_lim (str, pos, lim, 0);
                   if (tem == 0  /* from overlay */
                       || pos <= tem)
                     {
@@ -13627,7 +13664,10 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
                           EMACS_INT strpos = glyph->charpos;
 
                           if (tem)
-                            cursor = glyph;
+                            {
+                              cursor = glyph;
+                              string_from_text_prop = 1;
+                            }
                           for ( ;
                                (row->reversed_p ? glyph > stop : glyph < stop)
                                  && EQ (glyph->object, str);
@@ -13728,8 +13768,17 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
               /* previous candidate is a glyph from a string that has
                  a non-nil `cursor' property */
               || (STRINGP (g1->object)
-                  && !NILP (Fget_char_property (make_number (g1->charpos),
-                                                Qcursor, g1->object)))))
+                  && (!NILP (Fget_char_property (make_number (g1->charpos),
+                                                Qcursor, g1->object))
+                      /* pevious candidate is from the same display
+                         string as this one, and the display string
+                         came from a text property */
+                      || (EQ (g1->object, glyph->object)
+                          && string_from_text_prop)
+                      /* this candidate is from newline and its
+                         position is not an exact match */
+                      || (INTEGERP (glyph->object)
+                          && glyph->charpos != pt_old)))))
         return 0;
       /* If this candidate gives an exact match, use that.  */
       if (!(BUFFERP (glyph->object) && glyph->charpos == pt_old)
@@ -18005,16 +18054,25 @@ cursor_row_p (struct glyph_row *row)
 
 
 
-/* Push the display property PROP so that it will be rendered at the
-   current position in IT.  Return 1 if PROP was successfully pushed,
-   0 otherwise.  */
+/* Push the property PROP so that it will be rendered at the current
+   position in IT.  Return 1 if PROP was successfully pushed, 0
+   otherwise.  Called from handle_line_prefix to handle the
+   `line-prefix' and `wrap-prefix' properties.  */
 
 static int
 push_display_prop (struct it *it, Lisp_Object prop)
 {
-  xassert (it->method == GET_FROM_BUFFER);
+  struct text_pos pos =
+    (it->method == GET_FROM_STRING) ? it->current.string_pos : it->current.pos;
 
-  push_it (it, NULL);
+  xassert (it->method == GET_FROM_BUFFER
+           || it->method == GET_FROM_STRING);
+
+  /* We need to save the current buffer/string position, so it will be
+     restored by pop_it, because iterate_out_of_display_property
+     depends on that being set correctly, but some situations leave
+     it->position not yet set when this function is called.  */
+  push_it (it, &pos);
 
   if (STRINGP (prop))
     {
@@ -18033,11 +18091,9 @@ push_display_prop (struct it *it, Lisp_Object prop)
       it->stop_charpos = 0;
       it->prev_stop = 0;
       it->base_level_stop = 0;
-      it->string_from_display_prop_p = 1;
-      it->from_disp_prop_p = 1;
 
       /* Force paragraph direction to be that of the parent
-         buffer.  */
+         buffer/string.  */
       if (it->bidi_p && it->bidi_it.paragraph_dir == R2L)
         it->paragraph_embedding = it->bidi_it.paragraph_dir;
       else
@@ -18050,7 +18106,7 @@ push_display_prop (struct it *it, Lisp_Object prop)
           it->bidi_it.string.s = NULL;
           it->bidi_it.string.schars = it->end_charpos;
           it->bidi_it.string.bufpos = IT_CHARPOS (*it);
-          it->bidi_it.string.from_disp_str = 1;
+          it->bidi_it.string.from_disp_str = it->string_from_display_prop_p;
           it->bidi_it.string.unibyte = !it->multibyte_p;
           bidi_init_it (0, 0, FRAME_WINDOW_P (it->f), &it->bidi_it);
         }
diff --git a/src/xfaces.c b/src/xfaces.c
index 53b30a5c1c2..df40a6999f7 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -339,7 +339,7 @@ char unspecified_fg[] = "unspecified-fg", unspecified_bg[] = "unspecified-bg";
 /* The name of the function to call when the background of the frame
    has changed, frame_set_background_mode.  */
 
-Lisp_Object Qframe_set_background_mode;
+static Lisp_Object Qframe_set_background_mode;
 
 /* Names of basic faces.  */