14 files changed, 336 insertions, 128 deletions

diff --git a/src/buffer.c b/src/buffer.c
index 1468e7a2be1..4df77a181d6 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -5630,13 +5630,7 @@ Decimal digits after the % specify field width to which to pad.  */);
                      doc: /* Symbol for current buffer's major mode.
 The default value (normally `fundamental-mode') affects new buffers.
 A value of nil means to use the current buffer's major mode, provided
-it is not marked as "special".
-
-When a mode is used by default, `find-file' switches to it before it
-reads the contents into the buffer and before it finishes setting up
-the buffer.  Thus, the mode and its hooks should not expect certain
-variables such as `buffer-read-only' and `buffer-file-coding-system'
-to be set up.  */);
+it is not marked as "special".  */);
 
   DEFVAR_PER_BUFFER ("mode-name", &BVAR (current_buffer, mode_name),
                      Qnil,
diff --git a/src/conf_post.h b/src/conf_post.h
index 98ff12e5a53..5c332a05a5c 100644
--- a/src/conf_post.h
+++ b/src/conf_post.h
@@ -51,10 +51,21 @@ typedef bool bool_bf;
 #endif
 #endif
 
-/* When not using Clang, assume its attributes and features are absent.  */
+/* Simulate __has_attribute on compilers that lack it.  It is used only
+   on arguments like alloc_size that are handled in this simulation.  */
 #ifndef __has_attribute
-# define __has_attribute(a) false
-#endif
+# define __has_attribute(a) __has_attribute_##a
+# define __has_attribute_alloc_size (4 < __GNUC__ + (3 <= __GNUC_MINOR__))
+# define __has_attribute_cleanup (3 < __GNUC__ + (4 <= __GNUC_MINOR__))
+# define __has_attribute_externally_visible \
+    (4 < __GNUC__ + (1 <= __GNUC_MINOR__))
+# define __has_attribute_no_address_safety_analysis false
+# define __has_attribute_no_sanitize_address \
+    (4 < __GNUC__ + (8 <= __GNUC_MINOR__))
+#endif
+
+/* Simulate __has_feature on compilers that lack it.  It is used only
+   to define ADDRESS_SANITIZER below.  */
 #ifndef __has_feature
 # define __has_feature(a) false
 #endif
@@ -222,9 +233,7 @@ extern int emacs_setenv_TZ (char const *);
 #define NO_INLINE
 #endif
 
-#if (__clang__                                                          \
-     ? __has_attribute (externally_visible)                             \
-     : (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 1)))
+#if __has_attribute (externally_visible)
 #define EXTERNALLY_VISIBLE __attribute__((externally_visible))
 #else
 #define EXTERNALLY_VISIBLE
@@ -253,9 +262,7 @@ extern int emacs_setenv_TZ (char const *);
 # define ATTRIBUTE_MALLOC
 #endif
 
-#if (__clang__                                  \
-     ? __has_attribute (alloc_size)             \
-     : 4 < __GNUC__ + (3 <= __GNUC_MINOR__))
+#if __has_attribute (alloc_size)
 # define ATTRIBUTE_ALLOC_SIZE(args) __attribute__ ((__alloc_size__ args))
 #else
 # define ATTRIBUTE_ALLOC_SIZE(args)
@@ -278,8 +285,7 @@ extern int emacs_setenv_TZ (char const *);
 /* Attribute of functions whose code should not have addresses
    sanitized.  */
 
-#if (__has_attribute (no_sanitize_address) \
-     || 4 < __GNUC__ + (8 <= __GNUC_MINOR__))
+#if __has_attribute (no_sanitize_address)
 # define ATTRIBUTE_NO_SANITIZE_ADDRESS \
     __attribute__ ((no_sanitize_address)) ADDRESS_SANITIZER_WORKAROUND
 #elif __has_attribute (no_address_safety_analysis)
diff --git a/src/emacs-module.c b/src/emacs-module.c
index b5e044e758f..79a077b3cb4 100644
--- a/src/emacs-module.c
+++ b/src/emacs-module.c
@@ -35,8 +35,7 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* Feature tests.  */
 
-/* True if __attribute__ ((cleanup (...))) works, false otherwise.  */
-#ifdef HAVE_VAR_ATTRIBUTE_CLEANUP
+#if __has_attribute (cleanup)
 enum { module_has_cleanup = true };
 #else
 enum { module_has_cleanup = false };
diff --git a/src/fns.c b/src/fns.c
index 977229b97b7..86ad333702e 100644
--- a/src/fns.c
+++ b/src/fns.c
@@ -50,7 +50,8 @@ All integers representable in Lisp, i.e. between `most-negative-fixnum'
 and `most-positive-fixnum', inclusive, are equally likely.
 
 With positive integer LIMIT, return random number in interval [0,LIMIT).
-With argument t, set the random number seed from the current time and pid.
+With argument t, set the random number seed from the system's entropy
+pool if available, otherwise from less-random volatile data such as the time.
 With a string argument, set the seed based on the string's contents.
 Other values of LIMIT are ignored.
 
diff --git a/src/gnutls.c b/src/gnutls.c
index a1d058fcd48..01a5983d3b0 100644
--- a/src/gnutls.c
+++ b/src/gnutls.c
@@ -1112,15 +1112,17 @@ The return value is a property list with top-level keys :warnings and
 /* Initialize global GnuTLS state to defaults.
    Call `gnutls-global-deinit' when GnuTLS usage is no longer needed.
    Return zero on success.  */
-static Lisp_Object
+Lisp_Object
 emacs_gnutls_global_init (void)
 {
   int ret = GNUTLS_E_SUCCESS;
 
   if (!gnutls_global_initialized)
-    ret = gnutls_global_init ();
-
-  gnutls_global_initialized = 1;
+    {
+      ret = gnutls_global_init ();
+      if (ret == GNUTLS_E_SUCCESS)
+        gnutls_global_initialized = 1;
+    }
 
   return gnutls_make_error (ret);
 }
diff --git a/src/gnutls.h b/src/gnutls.h
index c4fe738bfa0..8e879c168bd 100644
--- a/src/gnutls.h
+++ b/src/gnutls.h
@@ -83,6 +83,7 @@ extern ptrdiff_t emacs_gnutls_record_check_pending (gnutls_session_t state);
 extern void emacs_gnutls_transport_set_errno (gnutls_session_t state, int err);
 #endif
 extern Lisp_Object emacs_gnutls_deinit (Lisp_Object);
+extern Lisp_Object emacs_gnutls_global_init (void);
 
 #endif
 
diff --git a/src/keyboard.c b/src/keyboard.c
index c3aa76af518..c8a9728e896 100644
--- a/src/keyboard.c
+++ b/src/keyboard.c
@@ -64,6 +64,8 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #include <unistd.h>
 #include <fcntl.h>
 
+#include <ignore-value.h>
+
 #ifdef HAVE_WINDOW_SYSTEM
 #include TERM_HEADER
 #endif /* HAVE_WINDOW_SYSTEM */
@@ -1234,9 +1236,6 @@ static void adjust_point_for_property (ptrdiff_t, bool);
 Lisp_Object
 command_loop_1 (void)
 {
-  Lisp_Object cmd;
-  Lisp_Object keybuf[30];
-  int i;
   EMACS_INT prev_modiff = 0;
   struct buffer *prev_buffer = NULL;
   bool already_adjusted = 0;
@@ -1280,6 +1279,10 @@ command_loop_1 (void)
 
   while (1)
     {
+      Lisp_Object cmd;
+      Lisp_Object keybuf[30];
+      int i;
+
       if (! FRAME_LIVE_P (XFRAME (selected_frame)))
         Fkill_emacs (Qnil);
 
@@ -10205,6 +10208,21 @@ deliver_interrupt_signal (int sig)
   deliver_process_signal (sig, handle_interrupt_signal);
 }
 
+/* Output MSG directly to standard output, without buffering.  Ignore
+   failures.  This is safe in a signal handler.  */
+static void
+write_stdout (char const *msg)
+{
+  ignore_value (write (STDOUT_FILENO, msg, strlen (msg)));
+}
+
+/* Read a byte from stdin, without buffering.  Safe in signal handlers.  */
+static int
+read_stdin (void)
+{
+  char c;
+  return read (STDIN_FILENO, &c, 1) == 1 ? c : EOF;
+}
 
 /* If Emacs is stuck because `inhibit-quit' is true, then keep track
    of the number of times C-g has been requested.  If C-g is pressed
@@ -10241,9 +10259,9 @@ handle_interrupt (bool in_signal_handler)
           sigemptyset (&blocked);
           sigaddset (&blocked, SIGINT);
           pthread_sigmask (SIG_BLOCK, &blocked, 0);
+          fflush (stdout);
         }
 
-      fflush (stdout);
       reset_all_sys_modes ();
 
 #ifdef SIGTSTP
@@ -10259,8 +10277,9 @@ handle_interrupt (bool in_signal_handler)
       /* Perhaps should really fork an inferior shell?
          But that would not provide any way to get back
          to the original shell, ever.  */
-      printf ("No support for stopping a process on this operating system;\n");
-      printf ("you can continue or abort.\n");
+      write_stdout ("No support for stopping a process"
+                    " on this operating system;\n"
+                    "you can continue or abort.\n");
 #endif /* not SIGTSTP */
 #ifdef MSDOS
       /* We must remain inside the screen area when the internal terminal
@@ -10271,46 +10290,49 @@ handle_interrupt (bool in_signal_handler)
          the code used for auto-saving doesn't cope with the mark bit.  */
       if (!gc_in_progress)
         {
-          printf ("Auto-save? (y or n) ");
-          fflush (stdout);
-          if (((c = getchar ()) & ~040) == 'Y')
+          write_stdout ("Auto-save? (y or n) ");
+          c = read_stdin ();
+          if ((c & 040) == 'Y')
             {
               Fdo_auto_save (Qt, Qnil);
 #ifdef MSDOS
-              printf ("\r\nAuto-save done");
-#else /* not MSDOS */
-              printf ("Auto-save done\n");
-#endif /* not MSDOS */
+              write_stdout ("\r\nAuto-save done");
+#else
+              write_stdout ("Auto-save done\n");
+#endif
             }
-          while (c != '\n') c = getchar ();
+          while (c != '\n')
+            c = read_stdin ();
         }
       else
         {
           /* During GC, it must be safe to reenable quitting again.  */
           Vinhibit_quit = Qnil;
+          write_stdout
+            (
 #ifdef MSDOS
-          printf ("\r\n");
-#endif /* not MSDOS */
-          printf ("Garbage collection in progress; cannot auto-save now\r\n");
-          printf ("but will instead do a real quit after garbage collection ends\r\n");
-          fflush (stdout);
+             "\r\n"
+#endif
+             "Garbage collection in progress; cannot auto-save now\r\n"
+             "but will instead do a real quit"
+             " after garbage collection ends\r\n");
         }
 
 #ifdef MSDOS
-      printf ("\r\nAbort?  (y or n) ");
-#else /* not MSDOS */
-      printf ("Abort (and dump core)? (y or n) ");
-#endif /* not MSDOS */
-      fflush (stdout);
-      if (((c = getchar ()) & ~040) == 'Y')
+      write_stdout ("\r\nAbort?  (y or n) ");
+#else
+      write_stdout ("Abort (and dump core)? (y or n) ");
+#endif
+      c = read_stdin ();
+      if ((c & ~040) == 'Y')
         emacs_abort ();
-      while (c != '\n') c = getchar ();
+      while (c != '\n')
+        c = read_stdin ();
 #ifdef MSDOS
-      printf ("\r\nContinuing...\r\n");
+      write_stdout ("\r\nContinuing...\r\n");
 #else /* not MSDOS */
-      printf ("Continuing...\n");
+      write_stdout ("Continuing...\n");
 #endif /* not MSDOS */
-      fflush (stdout);
       init_all_sys_modes ();
     }
   else
diff --git a/src/sysdep.c b/src/sysdep.c
index e73acec733e..a86b53642f2 100644
--- a/src/sysdep.c
+++ b/src/sysdep.c
@@ -99,6 +99,14 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #include "process.h"
 #include "cm.h"
 
+#include "gnutls.h"
+#if 0x020c00 <= GNUTLS_VERSION_NUMBER && !defined WINDOWSNT
+# include <gnutls/crypto.h>
+#else
+# define emacs_gnutls_global_init() Qnil
+# define gnutls_rnd(level, data, len) (-1)
+#endif
+
 #ifdef WINDOWSNT
 #include <direct.h>
 /* In process.h which conflicts with the local copy.  */
@@ -2071,36 +2079,56 @@ init_signals (bool dumping)
 # endif /* !HAVE_RANDOM */
 #endif /* !RAND_BITS */
 
+#ifdef HAVE_RANDOM
+typedef unsigned int random_seed;
+static void set_random_seed (random_seed arg) { srandom (arg); }
+#elif defined HAVE_LRAND48
+/* Although srand48 uses a long seed, this is unsigned long to avoid
+   undefined behavior on signed integer overflow in init_random.  */
+typedef unsigned long int random_seed;
+static void set_random_seed (random_seed arg) { srand48 (arg); }
+#else
+typedef unsigned int random_seed;
+static void set_random_seed (random_seed arg) { srand (arg); }
+#endif
+
 void
 seed_random (void *seed, ptrdiff_t seed_size)
 {
-#if defined HAVE_RANDOM || ! defined HAVE_LRAND48
-  unsigned int arg = 0;
-#else
-  long int arg = 0;
-#endif
+  random_seed arg = 0;
   unsigned char *argp = (unsigned char *) &arg;
   unsigned char *seedp = seed;
-  ptrdiff_t i;
-  for (i = 0; i < seed_size; i++)
+  for (ptrdiff_t i = 0; i < seed_size; i++)
     argp[i % sizeof arg] ^= seedp[i];
-#ifdef HAVE_RANDOM
-  srandom (arg);
-#else
-# ifdef HAVE_LRAND48
-  srand48 (arg);
-# else
-  srand (arg);
-# endif
-#endif
+  set_random_seed (arg);
 }
 
 void
 init_random (void)
 {
-  struct timespec t = current_timespec ();
-  uintmax_t v = getpid () ^ t.tv_sec ^ t.tv_nsec;
-  seed_random (&v, sizeof v);
+  random_seed v;
+  if (! (EQ (emacs_gnutls_global_init (), Qt)
+         && gnutls_rnd (GNUTLS_RND_NONCE, &v, sizeof v) == 0))
+    {
+      bool success = false;
+#ifndef WINDOWSNT
+      int fd = emacs_open ("/dev/urandom", O_RDONLY | O_BINARY, 0);
+      if (0 <= fd)
+        {
+          success = emacs_read (fd, &v, sizeof v) == sizeof v;
+          emacs_close (fd);
+        }
+#else
+      success = w32_init_random (&v, sizeof v) == 0;
+#endif
+      if (! success)
+        {
+          /* Fall back to current time value + PID.  */
+          struct timespec t = current_timespec ();
+          v = getpid () ^ t.tv_sec ^ t.tv_nsec;
+        }
+    }
+  set_random_seed (v);
 }
 
 /*
diff --git a/src/w32.c b/src/w32.c
index 4770718f5e3..183a4e7e9d9 100644
--- a/src/w32.c
+++ b/src/w32.c
@@ -484,6 +484,7 @@ typedef DWORD (WINAPI *GetAdaptersInfo_Proc) (
 
 int (WINAPI *pMultiByteToWideChar)(UINT,DWORD,LPCSTR,int,LPWSTR,int);
 int (WINAPI *pWideCharToMultiByte)(UINT,DWORD,LPCWSTR,int,LPSTR,int,LPCSTR,LPBOOL);
+DWORD multiByteToWideCharFlags;
 
   /* ** A utility function ** */
 static BOOL
@@ -1550,8 +1551,8 @@ codepage_for_filenames (CPINFO *cp_info)
 int
 filename_to_utf16 (const char *fn_in, wchar_t *fn_out)
 {
-  int result = pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS, fn_in, -1,
-                                     fn_out, MAX_PATH);
+  int result = pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags, fn_in,
+                                     -1, fn_out, MAX_PATH);
 
   if (!result)
     {
@@ -1641,8 +1642,8 @@ filename_from_ansi (const char *fn_in, char *fn_out)
 {
   wchar_t fn_utf16[MAX_PATH];
   int codepage = codepage_for_filenames (NULL);
-  int result = pMultiByteToWideChar (codepage, MB_ERR_INVALID_CHARS, fn_in, -1,
-                                     fn_utf16, MAX_PATH);
+  int result = pMultiByteToWideChar (codepage, multiByteToWideCharFlags, fn_in,
+                                     -1, fn_utf16, MAX_PATH);
 
   if (!result)
     {
@@ -8043,14 +8044,19 @@ pipe2 (int * phandles, int pipe2_flags)
 {
   int rc;
   unsigned flags;
+  unsigned pipe_size = 0;
 
   eassert (pipe2_flags == (O_BINARY | O_CLOEXEC));
 
+  /* Allow Lisp to override the default buffer size of the pipe.  */
+  if (w32_pipe_buffer_size > 0 && w32_pipe_buffer_size < UINT_MAX)
+    pipe_size = w32_pipe_buffer_size;
+
   /* make pipe handles non-inheritable; when we spawn a child, we
      replace the relevant handle with an inheritable one.  Also put
      pipes into binary mode; we will do text mode translation ourselves
      if required.  */
-  rc = _pipe (phandles, 0, _O_NOINHERIT | _O_BINARY);
+  rc = _pipe (phandles, pipe_size, _O_NOINHERIT | _O_BINARY);
 
   if (rc == 0)
     {
@@ -8632,15 +8638,35 @@ sys_write (int fd, const void * buffer, unsigned int count)
          http://thread.gmane.org/gmane.comp.version-control.git/145294
          in the git mailing list.  */
       const unsigned char *p = buffer;
-      const unsigned chunk = 30 * 1024 * 1024;
+      const bool is_pipe = (fd < MAXDESC
+                            && ((fd_info[fd].flags & (FILE_PIPE | FILE_NDELAY))
+                                == (FILE_PIPE | FILE_NDELAY)));
+      /* Some programs, notably Node.js's node.exe, seem to never
+         completely empty the pipe, so writing more than the size of
+         the pipe's buffer always returns ENOSPC, and we loop forever
+         between send_process and here.  As a workaround, write no
+         more than the pipe's buffer can hold.  */
+      DWORD pipe_buffer_size;
+      if (is_pipe)
+        {
+          if (!GetNamedPipeInfo ((HANDLE)_get_osfhandle (fd),
+                                NULL, &pipe_buffer_size, NULL, NULL))
+            {
+              DebPrint (("GetNamedPipeInfo: error %u\n", GetLastError ()));
+              pipe_buffer_size = 4096;
+            }
+        }
+      const unsigned chunk = is_pipe ? pipe_buffer_size : 30 * 1024 * 1024;
 
       nchars = 0;
+      errno = 0;
       while (count > 0)
         {
           unsigned this_chunk = count < chunk ? count : chunk;
           int n = _write (fd, p, this_chunk);
 
-          nchars += n;
+          if (n > 0)
+            nchars += n;
           if (n < 0)
             {
               /* When there's no buffer space in a pipe that is in the
@@ -8654,12 +8680,10 @@ sys_write (int fd, const void * buffer, unsigned int count)
                  avoiding deadlock whereby each side of the pipe is
                  blocked on write, waiting for the other party to read
                  its end of the pipe.  */
-              if (errno == ENOSPC
-                  && fd < MAXDESC
-                  && ((fd_info[fd].flags & (FILE_PIPE | FILE_NDELAY))
-                      == (FILE_PIPE | FILE_NDELAY)))
+              if (errno == ENOSPC && is_pipe)
                 errno = EAGAIN;
-              nchars = n;
+              if (nchars == 0)
+                nchars = -1;
               break;
             }
           else if (n < this_chunk)
@@ -9081,14 +9105,14 @@ check_windows_init_file (void)
                    "not unpacked properly.\nSee the README.W32 file in the "
                    "top-level Emacs directory for more information.",
                    init_file_name, load_path);
-          needed = pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS, buffer,
-                                         -1, NULL, 0);
+          needed = pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags,
+                                         buffer, -1, NULL, 0);
           if (needed > 0)
             {
               wchar_t *msg_w = alloca ((needed + 1) * sizeof (wchar_t));
 
-              pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS, buffer, -1,
-                                    msg_w, needed);
+              pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags, buffer,
+                                    -1, msg_w, needed);
               needed = pWideCharToMultiByte (CP_ACP, 0, msg_w, -1,
                                              NULL, 0, NULL, NULL);
               if (needed > 0)
@@ -9275,6 +9299,7 @@ maybe_load_unicows_dll (void)
             (MultiByteToWideChar_Proc)GetProcAddress (ret, "MultiByteToWideChar");
           pWideCharToMultiByte =
             (WideCharToMultiByte_Proc)GetProcAddress (ret, "WideCharToMultiByte");
+          multiByteToWideCharFlags = MB_ERR_INVALID_CHARS;
           return ret;
         }
       else
@@ -9304,6 +9329,11 @@ maybe_load_unicows_dll (void)
          pointers; no need for the LoadLibrary dance.  */
       pMultiByteToWideChar = MultiByteToWideChar;
       pWideCharToMultiByte = WideCharToMultiByte;
+      /* On NT 4.0, though, MB_ERR_INVALID_CHARS is not supported.  */
+      if (w32_major_version < 5)
+        multiByteToWideCharFlags = 0;
+      else
+        multiByteToWideCharFlags = MB_ERR_INVALID_CHARS;
       return LoadLibrary ("Gdi32.dll");
     }
 }
diff --git a/src/w32.h b/src/w32.h
index 501056d38c6..097241b1b8f 100644
--- a/src/w32.h
+++ b/src/w32.h
@@ -183,6 +183,7 @@ typedef int (WINAPI *MultiByteToWideChar_Proc)(UINT,DWORD,LPCSTR,int,LPWSTR,int)
 typedef int (WINAPI *WideCharToMultiByte_Proc)(UINT,DWORD,LPCWSTR,int,LPSTR,int,LPCSTR,LPBOOL);
 extern MultiByteToWideChar_Proc pMultiByteToWideChar;
 extern WideCharToMultiByte_Proc pWideCharToMultiByte;
+extern DWORD multiByteToWideCharFlags;
 
 extern void init_environment (char **);
 extern void check_windows_init_file (void);
diff --git a/src/w32fns.c b/src/w32fns.c
index f3806a992a0..01f5d6f3ae0 100644
--- a/src/w32fns.c
+++ b/src/w32fns.c
@@ -6984,12 +6984,12 @@ value of DIR as in previous invocations; this is standard Windows behavior.  */)
             if (errno == ENOENT && filename_buf_w[MAX_PATH - 1] != 0)
               report_file_error ("filename too long", default_filename);
           }
-        len = pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS,
+        len = pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags,
                                     SSDATA (prompt), -1, NULL, 0);
         if (len > 32768)
           len = 32768;
         prompt_w = alloca (len * sizeof (wchar_t));
-        pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS,
+        pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags,
                               SSDATA (prompt), -1, prompt_w, len);
       }
     else
@@ -7002,12 +7002,12 @@ value of DIR as in previous invocations; this is standard Windows behavior.  */)
             if (errno == ENOENT && filename_buf_a[MAX_PATH - 1] != 0)
               report_file_error ("filename too long", default_filename);
           }
-        len = pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS,
+        len = pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags,
                                     SSDATA (prompt), -1, NULL, 0);
         if (len > 32768)
           len = 32768;
         prompt_w = alloca (len * sizeof (wchar_t));
-        pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS,
+        pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags,
                               SSDATA (prompt), -1, prompt_w, len);
         len = pWideCharToMultiByte (CP_ACP, 0, prompt_w, -1, NULL, 0, NULL, NULL);
         if (len > 32768)
@@ -7489,10 +7489,10 @@ a ShowWindow flag:
   current_dir = ENCODE_FILE (current_dir);
   /* Cannot use filename_to_utf16/ansi with DOCUMENT, since it could
      be a URL that is not limited to MAX_PATH chararcters.  */
-  doclen = pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS,
+  doclen = pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags,
                                  SSDATA (document), -1, NULL, 0);
   doc_w = xmalloc (doclen * sizeof (wchar_t));
-  pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS,
+  pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags,
                         SSDATA (document), -1, doc_w, doclen);
   if (use_unicode)
     {
@@ -7507,12 +7507,12 @@ a ShowWindow flag:
           int len;
 
           parameters = ENCODE_SYSTEM (parameters);
-          len = pMultiByteToWideChar (CP_ACP, MB_ERR_INVALID_CHARS,
+          len = pMultiByteToWideChar (CP_ACP, multiByteToWideCharFlags,
                                       SSDATA (parameters), -1, NULL, 0);
           if (len > 32768)
             len = 32768;
           params_w = alloca (len * sizeof (wchar_t));
-          pMultiByteToWideChar (CP_ACP, MB_ERR_INVALID_CHARS,
+          pMultiByteToWideChar (CP_ACP, multiByteToWideCharFlags,
                                 SSDATA (parameters), -1, params_w, len);
           params_w[len - 1] = 0;
         }
@@ -8959,7 +8959,7 @@ add_tray_notification (struct frame *f, const char *icon, const char *tip,
          later versions support up to 128.  */
       if (nidw.cbSize == MYNOTIFYICONDATAW_V1_SIZE)
         {
-          tiplen = pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS,
+          tiplen = pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags,
                                          tip, utf8_mbslen_lim (tip, 63),
                                          tipw, 64);
           if (tiplen >= 63)
@@ -8967,7 +8967,7 @@ add_tray_notification (struct frame *f, const char *icon, const char *tip,
         }
       else
         {
-          tiplen = pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS,
+          tiplen = pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags,
                                          tip, utf8_mbslen_lim (tip, 127),
                                          tipw, 128);
           if (tiplen >= 127)
@@ -8986,7 +8986,7 @@ add_tray_notification (struct frame *f, const char *icon, const char *tip,
         {
           int slen;
 
-          slen = pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS,
+          slen = pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags,
                                              msg, utf8_mbslen_lim (msg, 255),
                                              msgw, 256);
           if (slen >= 255)
@@ -8999,7 +8999,7 @@ add_tray_notification (struct frame *f, const char *icon, const char *tip,
             }
           wcscpy (nidw.szInfo, msgw);
           nidw.uTimeout = timeout;
-          slen = pMultiByteToWideChar (CP_UTF8, MB_ERR_INVALID_CHARS,
+          slen = pMultiByteToWideChar (CP_UTF8, multiByteToWideCharFlags,
                                        title, utf8_mbslen_lim (title, 63),
                                        titlew, 64);
           if (slen >= 63)
@@ -9670,6 +9670,12 @@ static PVOID except_addr;
 
 /* Stack overflow recovery.  */
 
+/* MinGW headers don't declare this (should be in malloc.h).  Also,
+   the function is not present pre-W2K, so make the call through
+   a function pointer.  */
+typedef int (__cdecl *_resetstkoflw_proc) (void);
+static _resetstkoflw_proc resetstkoflw;
+
 /* Re-establish the guard page at stack limit.  This is needed because
    when a stack overflow is detected, Windows removes the guard bit
    from the guard page, so if we don't re-establish that protection,
@@ -9677,12 +9683,14 @@ static PVOID except_addr;
 void
 w32_reset_stack_overflow_guard (void)
 {
-  /* MinGW headers don't declare this (should be in malloc.h).  */
-  _CRTIMP int __cdecl _resetstkoflw (void);
-
+  if (resetstkoflw == NULL)
+    resetstkoflw =
+      (_resetstkoflw_proc)GetProcAddress (GetModuleHandle ("msvcrt.dll"),
+                                          "_resetstkoflw");
   /* We ignore the return value.  If _resetstkoflw fails, the next
      stack overflow will crash the program.  */
-  (void)_resetstkoflw ();
+  if (resetstkoflw != NULL)
+    (void)resetstkoflw ();
 }
 
 static void
@@ -9927,6 +9935,8 @@ globals_of_w32fns (void)
 
   after_deadkey = -1;
 
+  resetstkoflw = NULL;
+
   /* MessageBox does not work without this when linked to comctl32.dll 6.0.  */
   InitCommonControls ();
 
diff --git a/src/w32heap.c b/src/w32heap.c
index 54646bfbe3e..3d1c5ff50a2 100644
--- a/src/w32heap.c
+++ b/src/w32heap.c
@@ -258,9 +258,18 @@ init_heap (void)
         }
 #endif
 
-      the_malloc_fn = malloc_after_dump;
-      the_realloc_fn = realloc_after_dump;
-      the_free_fn = free_after_dump;
+      if (os_subtype == OS_9X)
+        {
+          the_malloc_fn = malloc_after_dump_9x;
+          the_realloc_fn = realloc_after_dump_9x;
+          the_free_fn = free_after_dump_9x;
+        }
+      else
+        {
+          the_malloc_fn = malloc_after_dump;
+          the_realloc_fn = realloc_after_dump;
+          the_free_fn = free_after_dump;
+        }
     }
   else
     {
@@ -291,9 +300,18 @@ init_heap (void)
           exit (-1);
         }
       heap = s_pfn_Rtl_Create_Heap (0, data_region_base, 0, 0, NULL, &params);
-      the_malloc_fn = malloc_before_dump;
-      the_realloc_fn = realloc_before_dump;
-      the_free_fn = free_before_dump;
+
+      if (os_subtype == OS_9X)
+        {
+          fprintf (stderr, "Cannot dump Emacs on Windows 9X; exiting.\n");
+          exit (-1);
+        }
+      else
+        {
+          the_malloc_fn = malloc_before_dump;
+          the_realloc_fn = realloc_before_dump;
+          the_free_fn = free_before_dump;
+        }
     }
 
   /* Update system version information to match current system.  */
@@ -504,6 +522,65 @@ free_before_dump (void *ptr)
     }
 }
 
+/* On Windows 9X, HeapAlloc may return pointers that are not aligned
+   on 8-byte boundary, alignment which is required by the Lisp memory
+   management.  To circumvent this problem, manually enforce alignment
+   on Windows 9X.  */
+
+void *
+malloc_after_dump_9x (size_t size)
+{
+  void *p = malloc_after_dump (size + 8);
+  void *pa;
+  if (p == NULL)
+    return p;
+  pa = (void*)(((intptr_t)p + 8) & ~7);
+  *((void**)pa-1) = p;
+  return pa;
+}
+
+void *
+realloc_after_dump_9x (void *ptr, size_t size)
+{
+  if (FREEABLE_P (ptr))
+    {
+      void *po = *((void**)ptr-1);
+      void *p;
+      void *pa;
+      p = realloc_after_dump (po, size + 8);
+      if (p == NULL)
+        return p;
+      pa = (void*)(((intptr_t)p + 8) & ~7);
+      if (ptr != NULL &&
+          (char*)pa - (char*)p != (char*)ptr - (char*)po)
+        {
+          /* Handle the case where alignment in pre-realloc and
+             post-realloc blocks does not match.  */
+          MoveMemory (pa, (void*)((char*)p + ((char*)ptr - (char*)po)), size);
+        }
+      *((void**)pa-1) = p;
+      return pa;
+    }
+  else
+    {
+      /* Non-freeable pointers have no alignment-enforcing header
+         (since dumping is not allowed on Windows 9X).  */
+      void* p = malloc_after_dump_9x (size);
+      if (p != NULL)
+        CopyMemory (p, ptr, size);
+      return p;
+    }
+}
+
+void
+free_after_dump_9x (void *ptr)
+{
+  if (FREEABLE_P (ptr))
+    {
+      free_after_dump (*((void**)ptr-1));
+    }
+}
+
 #ifdef ENABLE_CHECKING
 void
 report_temacs_memory_usage (void)
diff --git a/src/w32proc.c b/src/w32proc.c
index a65f085fb3d..a89a9850466 100644
--- a/src/w32proc.c
+++ b/src/w32proc.c
@@ -3702,6 +3702,13 @@ of time slices to wait (effectively boosting the priority of the child
 process temporarily).  A value of zero disables waiting entirely.  */);
   w32_pipe_read_delay = 50;
 
+  DEFVAR_INT ("w32-pipe-buffer-size", w32_pipe_buffer_size,
+              doc: /* Size of buffer for pipes created to communicate with subprocesses.
+The size is in bytes, and must be non-negative.  The default is zero,
+which lets the OS use its default size, usually 4KB (4096 bytes).
+Any negative value means to use the default value of zero.  */);
+  w32_pipe_buffer_size = 0;
+
   DEFVAR_LISP ("w32-downcase-file-names", Vw32_downcase_file_names,
                doc: /* Non-nil means convert all-upper case file names to lower case.
 This applies when performing completions and file name expansion.
diff --git a/src/window.c b/src/window.c
index bb414e7d311..4aeb8b39a70 100644
--- a/src/window.c
+++ b/src/window.c
@@ -4979,27 +4979,34 @@ window_scroll_pixel_based (Lisp_Object window, int n, bool whole, bool noerror)
 
   if (n > 0)
     {
+      int last_y = it.last_visible_y - this_scroll_margin - 1;
+
       /* We moved the window start towards ZV, so PT may be now
          in the scroll margin at the top.  */
       move_it_to (&it, PT, -1, -1, -1, MOVE_TO_POS);
-      if (IT_CHARPOS (it) == PT && it.current_y >= this_scroll_margin
+      if (IT_CHARPOS (it) == PT
+          && it.current_y >= this_scroll_margin
+          && it.current_y <= last_y - WINDOW_HEADER_LINE_HEIGHT (w)
           && (NILP (Vscroll_preserve_screen_position)
               || EQ (Vscroll_preserve_screen_position, Qt)))
         /* We found PT at a legitimate height.  Leave it alone.  */
         ;
-      else if (window_scroll_pixel_based_preserve_y >= 0)
-        {
-          /* If we have a header line, take account of it.
-             This is necessary because we set it.current_y to 0, above.  */
-          move_it_to (&it, -1,
-                      window_scroll_pixel_based_preserve_x,
-                      (window_scroll_pixel_based_preserve_y
-                       - WINDOW_WANTS_HEADER_LINE_P (w)),
-                      -1, MOVE_TO_Y | MOVE_TO_X);
-          SET_PT_BOTH (IT_CHARPOS (it), IT_BYTEPOS (it));
-        }
       else
         {
+          if (window_scroll_pixel_based_preserve_y >= 0)
+            {
+              /* Don't enter the scroll margin at the end of the window.  */
+              int goal_y = min (last_y, window_scroll_pixel_based_preserve_y);
+
+              /* If we have a header line, take account of it.  This
+                 is necessary because we set it.current_y to 0, above.  */
+              move_it_to (&it, -1,
+                          window_scroll_pixel_based_preserve_x,
+                          goal_y - WINDOW_HEADER_LINE_HEIGHT (w),
+                          -1, MOVE_TO_Y | MOVE_TO_X);
+            }
+
+          /* Get out of the scroll margin at the top of the window.  */
           while (it.current_y < this_scroll_margin)
             {
               int prev = it.current_y;
@@ -5023,7 +5030,7 @@ window_scroll_pixel_based (Lisp_Object window, int n, bool whole, bool noerror)
       /* We moved the window start towards BEGV, so PT may be now
          in the scroll margin at the bottom.  */
       move_it_to (&it, PT, -1,
-                  (it.last_visible_y - CURRENT_HEADER_LINE_HEIGHT (w)
+                  (it.last_visible_y - WINDOW_HEADER_LINE_HEIGHT (w)
                    - this_scroll_margin - 1),
                   -1,
                   MOVE_TO_POS | MOVE_TO_Y);
@@ -5074,14 +5081,20 @@ window_scroll_pixel_based (Lisp_Object window, int n, bool whole, bool noerror)
         ;
       else if (window_scroll_pixel_based_preserve_y >= 0)
         {
+          int goal_y = min (it.last_visible_y - this_scroll_margin - 1,
+                            window_scroll_pixel_based_preserve_y);
+
+          /* Don't let the preserved screen Y coordinate put us inside
+             any of the two margins.  */
+          if (goal_y < this_scroll_margin)
+            goal_y = this_scroll_margin;
           SET_TEXT_POS_FROM_MARKER (start, w->start);
           start_display (&it, w, start);
           /* It would be wrong to subtract CURRENT_HEADER_LINE_HEIGHT
              here because we called start_display again and did not
              alter it.current_y this time.  */
           move_it_to (&it, -1, window_scroll_pixel_based_preserve_x,
-                      window_scroll_pixel_based_preserve_y, -1,
-                      MOVE_TO_Y | MOVE_TO_X);
+                      goal_y, -1, MOVE_TO_Y | MOVE_TO_X);
           SET_PT_BOTH (IT_CHARPOS (it), IT_BYTEPOS (it));
         }
       else
@@ -5197,6 +5210,7 @@ window_scroll_line_based (Lisp_Object window, int n, bool whole, bool noerror)
       w->force_start = true;
 
       if (!NILP (Vscroll_preserve_screen_position)
+          && this_scroll_margin == 0
           && (whole || !EQ (Vscroll_preserve_screen_position, Qt)))
         {
           SET_PT_BOTH (pos, pos_byte);
@@ -5222,8 +5236,16 @@ window_scroll_line_based (Lisp_Object window, int n, bool whole, bool noerror)
                          marker_byte_position (opoint_marker));
           else if (!NILP (Vscroll_preserve_screen_position))
             {
+              int nlines = window_scroll_preserve_vpos;
+
               SET_PT_BOTH (pos, pos_byte);
-              Fvertical_motion (original_pos, window, Qnil);
+              if (window_scroll_preserve_vpos < this_scroll_margin)
+                nlines = this_scroll_margin;
+              else if (window_scroll_preserve_vpos
+                       >= w->total_lines - this_scroll_margin)
+                nlines = w->total_lines - this_scroll_margin - 1;
+              Fvertical_motion (Fcons (make_number (window_scroll_preserve_hpos),
+                                       make_number (nlines)), window, Qnil);
             }
           else
             SET_PT (top_margin);
@@ -5249,8 +5271,16 @@ window_scroll_line_based (Lisp_Object window, int n, bool whole, bool noerror)
             {
               if (!NILP (Vscroll_preserve_screen_position))
                 {
+                  int nlines = window_scroll_preserve_vpos;
+
                   SET_PT_BOTH (pos, pos_byte);
-                  Fvertical_motion (original_pos, window, Qnil);
+                  if (window_scroll_preserve_vpos < this_scroll_margin)
+                    nlines = this_scroll_margin;
+                  else if (window_scroll_preserve_vpos
+                           >= ht - this_scroll_margin)
+                    nlines = ht - this_scroll_margin - 1;
+                  Fvertical_motion (Fcons (make_number (window_scroll_preserve_hpos),
+                                           make_number (nlines)), window, Qnil);
                 }
               else
                 Fvertical_motion (make_number (-1), window, Qnil);