8 files changed, 182 insertions, 48 deletions

diff --git a/src/.gdbinit b/src/.gdbinit
index fc8eab6d1df..7cd828733b1 100644
--- a/src/.gdbinit
+++ b/src/.gdbinit
@@ -254,8 +254,8 @@ define pitx
   while ($i < $it->sp && $i < 4)
     set $e = $it->stack[$i]
     printf "stack[%d]: ", $i
-    pitmethod $e->method
-    printf "[%d]", $e->position.charpos
+    pitmethod $e.method
+    printf "[%d]", $e.position.charpos
     printf "\n"
     set $i = $i + 1
   end
@@ -1259,7 +1259,9 @@ end
 
 define xreload
   set $tagmask = (((long)1 << gdb_gctypebits) - 1)
-  set $valmask = gdb_use_lsb ? ~($tagmask) : ((long)1 << gdb_valbits) - 1
+  # The consing_since_gc business widens the 1 to EMACS_INT,
+  # a symbol not directly visible to GDB.
+  set $valmask = gdb_use_lsb ? ~($tagmask) : ((consing_since_gc - consing_since_gc + 1) << gdb_valbits) - 1
 end
 document xreload
   When starting Emacs a second time in the same gdb session under
diff --git a/src/ChangeLog b/src/ChangeLog
index 12b4fa97c33..5a376c4ad5b 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,49 @@
+2012-02-22  Chong Yidong  <cyd@gnu.org>
+
+        * xterm.c (x_draw_image_relief): Add missing type check for
+        Vtool_bar_button_margin (Bug#10743).
+
+2012-02-21  Chong Yidong  <cyd@gnu.org>
+
+        * fileio.c (Vfile_name_handler_alist): Doc fix.
+
+        * buffer.c (Fget_file_buffer): Protect against invalid file
+        handler return value.
+
+2012-02-20  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * .gdbinit (xreload): Don't assume EMACS_INT fits in 'long'
+        when computing $valmask.
+
+        Fix crash due to non-contiguous EMACS_INT (Bug#10780).
+        * lisp.h (VALBITS): Move definition up, so that USE_LSB_TAG can use it.
+        (USE_LSB_TAG): Do not define if UINTPTR_MAX >> VALBITS == 0.
+        It's useless in that case, and it can cause problems on hosts
+        that allocate halves of EMACS_INT values separately.
+        Reported by Dan Horák.  Diagnosed by Andreas Schwab in
+        <http://debbugs.gnu.org/cgi/bugreport.cgi?bug=10780#30>.
+        * mem-limits.h (EXCEEDS_LISP_PTR): Define to 0 on hosts where
+        UINTPTR_MAX >> VALBITS == 0.  This is required by the above change;
+        it avoids undefined behavior on hosts where shifting right by more
+        than the word width has undefined behavior.
+
+2012-02-19  Chong Yidong  <cyd@gnu.org>
+
+        * fileio.c (Ffile_name_directory, Ffile_name_nondirectory)
+        (Funhandled_file_name_directory, Ffile_name_as_directory)
+        (Fdirectory_file_name, Fexpand_file_name)
+        (Fsubstitute_in_file_name): Protect against invalid file handler
+        return values (Bug#10845).
+
+2012-02-18  Eli Zaretskii  <eliz@gnu.org>
+
+        * .gdbinit (pitx): Fix incorrect references to fields of the
+        iterator stack.
+
+2012-02-17  Chong Yidong  <cyd@gnu.org>
+
+        * syntax.c (Fscan_lists): Doc fix (Bug#10833).
+
 2012-02-15  Paul Eggert  <eggert@cs.ucla.edu>
 
         * image.c (MAX_IMAGE_SIZE): Increase from 6.0 to 10.0; see
diff --git a/src/buffer.c b/src/buffer.c
index a6f61a1936a..71a5e199c6f 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -272,7 +272,11 @@ See also `find-buffer-visiting'.  */)
      call the corresponding file handler.  */
   handler = Ffind_file_name_handler (filename, Qget_file_buffer);
   if (!NILP (handler))
-    return call2 (handler, Qget_file_buffer, filename);
+    {
+      Lisp_Object handled_buf = call2 (handler, Qget_file_buffer,
+                                       filename);
+      return BUFFERP (handled_buf) ? handled_buf : Qnil;
+    }
 
   for (tail = Vbuffer_alist; CONSP (tail); tail = XCDR (tail))
     {
diff --git a/src/fileio.c b/src/fileio.c
index 9e940c9a324..839dc07b6ce 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -328,7 +328,11 @@ Given a Unix syntax file name, returns a string ending in slash.  */)
      call the corresponding file handler.  */
   handler = Ffind_file_name_handler (filename, Qfile_name_directory);
   if (!NILP (handler))
-    return call2 (handler, Qfile_name_directory, filename);
+    {
+      Lisp_Object handled_name = call2 (handler, Qfile_name_directory,
+                                        filename);
+      return STRINGP (handled_name) ? handled_name : Qnil;
+    }
 
   filename = FILE_SYSTEM_CASE (filename);
 #ifdef DOS_NT
@@ -397,7 +401,13 @@ or the entire name if it contains no slash.  */)
      call the corresponding file handler.  */
   handler = Ffind_file_name_handler (filename, Qfile_name_nondirectory);
   if (!NILP (handler))
-    return call2 (handler, Qfile_name_nondirectory, filename);
+    {
+      Lisp_Object handled_name = call2 (handler, Qfile_name_nondirectory,
+                                        filename);
+      if (STRINGP (handled_name))
+        return handled_name;
+      error ("Invalid handler in `file-name-handler-alist'");
+    }
 
   beg = SSDATA (filename);
   end = p = beg + SBYTES (filename);
@@ -434,7 +444,11 @@ get a current directory to run processes in.  */)
      call the corresponding file handler.  */
   handler = Ffind_file_name_handler (filename, Qunhandled_file_name_directory);
   if (!NILP (handler))
-    return call2 (handler, Qunhandled_file_name_directory, filename);
+    {
+      Lisp_Object handled_name = call2 (handler, Qunhandled_file_name_directory,
+                                        filename);
+      return STRINGP (handled_name) ? handled_name : Qnil;
+    }
 
   return Ffile_name_directory (filename);
 }
@@ -488,7 +502,13 @@ For a Unix-syntax file name, just appends a slash.  */)
      call the corresponding file handler.  */
   handler = Ffind_file_name_handler (file, Qfile_name_as_directory);
   if (!NILP (handler))
-    return call2 (handler, Qfile_name_as_directory, file);
+    {
+      Lisp_Object handled_name = call2 (handler, Qfile_name_as_directory,
+                                        file);
+      if (STRINGP (handled_name))
+        return handled_name;
+      error ("Invalid handler in `file-name-handler-alist'");
+    }
 
   buf = (char *) alloca (SBYTES (file) + 10);
   file_name_as_directory (buf, SSDATA (file));
@@ -547,7 +567,13 @@ In Unix-syntax, this function just removes the final slash.  */)
      call the corresponding file handler.  */
   handler = Ffind_file_name_handler (directory, Qdirectory_file_name);
   if (!NILP (handler))
-    return call2 (handler, Qdirectory_file_name, directory);
+    {
+      Lisp_Object handled_name = call2 (handler, Qdirectory_file_name,
+                                        directory);
+      if (STRINGP (handled_name))
+        return handled_name;
+      error ("Invalid handler in `file-name-handler-alist'");
+    }
 
   buf = (char *) alloca (SBYTES (directory) + 20);
   directory_file_name (SSDATA (directory), buf);
@@ -747,7 +773,7 @@ filesystem tree, not (expand-file-name ".."  dirname).  */)
   int is_escaped = 0;
 #endif /* DOS_NT */
   ptrdiff_t length;
-  Lisp_Object handler, result;
+  Lisp_Object handler, result, handled_name;
   int multibyte;
   Lisp_Object hdir;
 
@@ -757,7 +783,14 @@ filesystem tree, not (expand-file-name ".."  dirname).  */)
      call the corresponding file handler.  */
   handler = Ffind_file_name_handler (name, Qexpand_file_name);
   if (!NILP (handler))
-    return call3 (handler, Qexpand_file_name, name, default_directory);
+    {
+      handled_name = call3 (handler, Qexpand_file_name,
+                            name, default_directory);
+      if (STRINGP (handled_name))
+        return handled_name;
+      error ("Invalid handler in `file-name-handler-alist'");
+    }
+
 
   /* Use the buffer's default-directory if DEFAULT_DIRECTORY is omitted.  */
   if (NILP (default_directory))
@@ -783,7 +816,13 @@ filesystem tree, not (expand-file-name ".."  dirname).  */)
     {
       handler = Ffind_file_name_handler (default_directory, Qexpand_file_name);
       if (!NILP (handler))
-        return call3 (handler, Qexpand_file_name, name, default_directory);
+        {
+          handled_name = call3 (handler, Qexpand_file_name,
+                                name, default_directory);
+          if (STRINGP (handled_name))
+            return handled_name;
+          error ("Invalid handler in `file-name-handler-alist'");
+        }
     }
 
   {
@@ -1284,7 +1323,13 @@ filesystem tree, not (expand-file-name ".."  dirname).  */)
      to be expanded again. */
   handler = Ffind_file_name_handler (result, Qexpand_file_name);
   if (!NILP (handler))
-    return call3 (handler, Qexpand_file_name, result, default_directory);
+    {
+      handled_name = call3 (handler, Qexpand_file_name,
+                            result, default_directory);
+      if (STRINGP (handled_name))
+        return handled_name;
+      error ("Invalid handler in `file-name-handler-alist'");
+    }
 
   return result;
 }
@@ -1537,7 +1582,13 @@ those `/' is discarded.  */)
      call the corresponding file handler.  */
   handler = Ffind_file_name_handler (filename, Qsubstitute_in_file_name);
   if (!NILP (handler))
-    return call2 (handler, Qsubstitute_in_file_name, filename);
+    {
+      Lisp_Object handled_name = call2 (handler, Qsubstitute_in_file_name,
+                                        filename);
+      if (STRINGP (handled_name))
+        return handled_name;
+      error ("Invalid handler in `file-name-handler-alist'");
+    }
 
   /* Always work on a copy of the string, in case GC happens during
      decode of environment variables, causing the original Lisp_String
@@ -5589,18 +5640,25 @@ of file names regardless of the current language environment.  */);
         make_pure_c_string ("Cannot set file date"));
 
   DEFVAR_LISP ("file-name-handler-alist", Vfile_name_handler_alist,
-               doc: /* *Alist of elements (REGEXP . HANDLER) for file names handled specially.
-If a file name matches REGEXP, then all I/O on that file is done by calling
-HANDLER.
-
-The first argument given to HANDLER is the name of the I/O primitive
-to be handled; the remaining arguments are the arguments that were
-passed to that primitive.  For example, if you do
-    (file-exists-p FILENAME)
-and FILENAME is handled by HANDLER, then HANDLER is called like this:
-    (funcall HANDLER 'file-exists-p FILENAME)
-The function `find-file-name-handler' checks this list for a handler
-for its argument.  */);
+               doc: /* Alist of elements (REGEXP . HANDLER) for file names handled specially.
+If a file name matches REGEXP, all I/O on that file is done by calling
+HANDLER.  If a file name matches more than one handler, the handler
+whose match starts last in the file name gets precedence.  The
+function `find-file-name-handler' checks this list for a handler for
+its argument.
+
+HANDLER should be a function.  The first argument given to it is the
+name of the I/O primitive to be handled; the remaining arguments are
+the arguments that were passed to that primitive.  For example, if you
+do (file-exists-p FILENAME) and FILENAME is handled by HANDLER, then
+HANDLER is called like this:
+
+  (funcall HANDLER 'file-exists-p FILENAME)
+
+Note that HANDLER must be able to handle all I/O primitives; if it has
+nothing special to do for a primitive, it should reinvoke the
+primitive to handle the operation \"the usual way\".
+See Info node `(elisp)Magic File Names' for more details.  */);
   Vfile_name_handler_alist = Qnil;
 
   DEFVAR_LISP ("set-auto-coding-function",
diff --git a/src/lisp.h b/src/lisp.h
index 97981ec5f83..9199c9aabcf 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -168,6 +168,10 @@ extern int suppress_checking EXTERNALLY_VISIBLE;
 #define GCTYPEBITS 3
 #endif
 
+#ifndef VALBITS
+#define VALBITS (BITS_PER_EMACS_INT - GCTYPEBITS)
+#endif
+
 #ifndef NO_DECL_ALIGN
 # ifndef DECL_ALIGN
 #  if HAVE_ATTRIBUTE_ALIGNED
@@ -191,7 +195,15 @@ extern int suppress_checking EXTERNALLY_VISIBLE;
      || defined DARWIN_OS || defined __sun)
 /* We also need to be able to specify mult-of-8 alignment on static vars.  */
 # if defined DECL_ALIGN
-#  define USE_LSB_TAG
+/* mark_maybe_object assumes that EMACS_INT values are contiguous,
+   but this is not true on some hosts where EMACS_INT is wider than a pointer,
+   as they may allocate the halves of an EMACS_INT separately.
+   On these hosts USE_LSB_TAG is not needed because the top bits of an
+   EMACS_INT are unused, so define USE_LSB_TAG only on hosts where it
+   might be useful.  */
+#  if UINTPTR_MAX >> VALBITS != 0
+#   define USE_LSB_TAG
+#  endif
 # endif
 #endif
 
@@ -309,11 +321,6 @@ enum Lisp_Fwd_Type
     Lisp_Fwd_Kboard_Obj,        /* Fwd to a Lisp_Object field of kboards.  */
   };
 
-/* These values are overridden by the m- file on some machines.  */
-#ifndef VALBITS
-#define VALBITS (BITS_PER_EMACS_INT - GCTYPEBITS)
-#endif
-
 #ifdef USE_LISP_UNION_TYPE
 
 #ifndef WORDS_BIGENDIAN
diff --git a/src/mem-limits.h b/src/mem-limits.h
index 472e591b38d..244592a9768 100644
--- a/src/mem-limits.h
+++ b/src/mem-limits.h
@@ -34,7 +34,7 @@ extern int etext;
 #endif
 
 extern char *start_of_data (void);
-#if defined USE_LSB_TAG
+#if defined USE_LSB_TAG || UINTPTR_MAX >> VALBITS == 0
 #define EXCEEDS_LISP_PTR(ptr) 0
 #elif defined DATA_SEG_BITS
 #define EXCEEDS_LISP_PTR(ptr) \
diff --git a/src/syntax.c b/src/syntax.c
index bb473a52b3a..16012d9f88e 100644
--- a/src/syntax.c
+++ b/src/syntax.c
@@ -2844,18 +2844,23 @@ scan_lists (register EMACS_INT from, EMACS_INT count, EMACS_INT depth, int sexpf
 
 DEFUN ("scan-lists", Fscan_lists, Sscan_lists, 3, 3, 0,
        doc: /* Scan from character number FROM by COUNT lists.
-Returns the character number of the position thus found.
+Scan forward if COUNT is positive, backward if COUNT is negative.
+Return the character number of the position thus found.
+
+A \"list", in this context, refers to a balanced parenthetical
+grouping, as determined by the syntax table.
 
-If DEPTH is nonzero, paren depth begins counting from that value,
-only places where the depth in parentheses becomes zero
-are candidates for stopping; COUNT such places are counted.
-Thus, a positive value for DEPTH means go out levels.
+If DEPTH is nonzero, treat that as the nesting depth of the starting
+point (i.e. the starting point is DEPTH parentheses deep).  This
+function scans over parentheses until the depth goes to zero COUNT
+times.  Hence, positive DEPTH moves out that number of levels of
+parentheses, while negative DEPTH moves to a deeper level.
 
 Comments are ignored if `parse-sexp-ignore-comments' is non-nil.
 
-If the beginning or end of (the accessible part of) the buffer is reached
-and the depth is wrong, an error is signaled.
-If the depth is right but the count is not used up, nil is returned.  */)
+If we reach the beginning or end of the accessible part of the buffer
+before we have scanned over COUNT lists, return nil if the depth at
+that point is zero, and signal a error if the depth is nonzero.  */)
   (Lisp_Object from, Lisp_Object count, Lisp_Object depth)
 {
   CHECK_NUMBER (from);
diff --git a/src/xterm.c b/src/xterm.c
index 3581ea61eb2..483676227ea 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -2295,7 +2295,8 @@ x_draw_image_foreground (struct glyph_string *s)
 static void
 x_draw_image_relief (struct glyph_string *s)
 {
-  int x0, y0, x1, y1, thick, raised_p, extra;
+  int x0, y0, x1, y1, thick, raised_p;
+  int extra_x, extra_y;
   XRectangle r;
   int x = s->x;
   int y = s->ybase - image_ascent (s->img, s->face, &s->slice);
@@ -2326,13 +2327,24 @@ x_draw_image_relief (struct glyph_string *s)
       raised_p = s->img->relief > 0;
     }
 
-  extra = s->face->id == TOOL_BAR_FACE_ID
-    ? XINT (Vtool_bar_button_margin) : 0;
+  extra_x = extra_y = 0;
+  if (s->face->id == TOOL_BAR_FACE_ID)
+    {
+      if (CONSP (Vtool_bar_button_margin)
+          && INTEGERP (XCAR (Vtool_bar_button_margin))
+          && INTEGERP (XCDR (Vtool_bar_button_margin)))
+        {
+          extra_x = XINT (XCAR (Vtool_bar_button_margin));
+          extra_y = XINT (XCDR (Vtool_bar_button_margin));
+        }
+      else if (INTEGERP (Vtool_bar_button_margin))
+        extra_x = extra_y = XINT (Vtool_bar_button_margin);
+    }
 
-  x0 = x - thick - extra;
-  y0 = y - thick - extra;
-  x1 = x + s->slice.width + thick - 1 + extra;
-  y1 = y + s->slice.height + thick - 1 + extra;
+  x0 = x - thick - extra_x;
+  y0 = y - thick - extra_y;
+  x1 = x + s->slice.width + thick - 1 + extra_x;
+  y1 = y + s->slice.height + thick - 1 + extra_y;
 
   x_setup_relief_colors (s);
   get_glyph_string_clip_rect (s, &r);