5 files changed, 42 insertions, 29 deletions

diff --git a/src/conf_post.h b/src/conf_post.h
index 2f8d19fdca8..eb8fb18c00c 100644
--- a/src/conf_post.h
+++ b/src/conf_post.h
@@ -78,6 +78,7 @@ typedef bool bool_bf;
 # define __has_attribute_no_address_safety_analysis false
 # define __has_attribute_no_sanitize_address GNUC_PREREQ (4, 8, 0)
 # define __has_attribute_no_sanitize_undefined GNUC_PREREQ (4, 9, 0)
+# define __has_attribute_returns_nonnull GNUC_PREREQ (4, 9, 0)
 # define __has_attribute_warn_unused_result GNUC_PREREQ (3, 4, 0)
 #endif
 
@@ -321,6 +322,12 @@ extern int emacs_setenv_TZ (char const *);
 
 #define ATTRIBUTE_MALLOC_SIZE(args) ATTRIBUTE_MALLOC ATTRIBUTE_ALLOC_SIZE (args)
 
+#if __has_attribute (returns_nonnull)
+# define ATTRIBUTE_RETURNS_NONNULL __attribute__ ((returns_nonnull))
+#else
+# define ATTRIBUTE_RETURNS_NONNULL
+#endif
+
 /* Work around GCC bug 59600: when a function is inlined, the inlined
    code may have its addresses sanitized even if the function has the
    no_sanitize_address attribute.  This bug is fixed in GCC 4.9.0 and
diff --git a/src/editfns.c b/src/editfns.c
index ddf190b1752..eb15566fb48 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -1262,14 +1262,17 @@ name, or nil if there is no such user.  */)
   if (q)
     {
       Lisp_Object login = Fuser_login_name (INT_TO_INTEGER (pw->pw_uid));
-      USE_SAFE_ALLOCA;
-      char *r = SAFE_ALLOCA (strlen (p) + SBYTES (login) + 1);
-      memcpy (r, p, q - p);
-      char *s = lispstpcpy (&r[q - p], login);
-      r[q - p] = upcase ((unsigned char) r[q - p]);
-      strcpy (s, q + 1);
-      full = build_string (r);
-      SAFE_FREE ();
+      if (!NILP (login))
+        {
+          USE_SAFE_ALLOCA;
+          char *r = SAFE_ALLOCA (strlen (p) + SBYTES (login) + 1);
+          memcpy (r, p, q - p);
+          char *s = lispstpcpy (&r[q - p], login);
+          r[q - p] = upcase ((unsigned char) r[q - p]);
+          strcpy (s, q + 1);
+          full = build_string (r);
+          SAFE_FREE ();
+        }
     }
 #endif /* AMPERSAND_FULL_NAME */
 
diff --git a/src/intervals.c b/src/intervals.c
index a66594ceea2..594d8924ebc 100644
--- a/src/intervals.c
+++ b/src/intervals.c
@@ -298,7 +298,7 @@ rotate_right (INTERVAL A)
     set_interval_parent (c, A);
 
   /* A's total length is decreased by the length of B and its left child.  */
-  A->total_length -= B->total_length - TOTAL_LENGTH (c);
+  A->total_length -= TOTAL_LENGTH (B) - TOTAL_LENGTH0 (c);
   eassert (TOTAL_LENGTH (A) > 0);
   eassert (LENGTH (A) > 0);
 
@@ -349,7 +349,7 @@ rotate_left (INTERVAL A)
     set_interval_parent (c, A);
 
   /* A's total length is decreased by the length of B and its right child.  */
-  A->total_length -= B->total_length - TOTAL_LENGTH (c);
+  A->total_length -= TOTAL_LENGTH (B) - TOTAL_LENGTH0 (c);
   eassert (TOTAL_LENGTH (A) > 0);
   eassert (LENGTH (A) > 0);
 
@@ -723,13 +723,13 @@ previous_interval (register INTERVAL interval)
       i->position - LEFT_TOTAL_LENGTH (i)                       \
       - LENGTH (INTERVAL_PARENT (i))
 
-/* Find the interval containing POS, given some non-NULL INTERVAL in
+/* Find the interval containing POS, given some interval I in
    the same tree.  Note that we update interval->position in each
    interval we traverse, assuming it is already correctly set for the
    argument I.  We don't assume that any other interval already has a
    correctly set ->position.  */
 INTERVAL
-update_interval (register INTERVAL i, ptrdiff_t pos)
+update_interval (INTERVAL i, ptrdiff_t pos)
 {
   if (!i)
     return NULL;
@@ -739,7 +739,7 @@ update_interval (register INTERVAL i, ptrdiff_t pos)
       if (pos < i->position)
         {
           /* Move left.  */
-          if (pos >= i->position - TOTAL_LENGTH (i->left))
+          if (pos >= i->position - LEFT_TOTAL_LENGTH (i))
             {
               i->left->position = i->position - TOTAL_LENGTH (i->left)
                 + LEFT_TOTAL_LENGTH (i->left);
@@ -757,7 +757,7 @@ update_interval (register INTERVAL i, ptrdiff_t pos)
       else if (pos >= INTERVAL_LAST_POS (i))
         {
           /* Move right.  */
-          if (pos < INTERVAL_LAST_POS (i) + TOTAL_LENGTH (i->right))
+          if (pos < INTERVAL_LAST_POS (i) + RIGHT_TOTAL_LENGTH (i))
             {
               i->right->position = INTERVAL_LAST_POS (i)
                 + LEFT_TOTAL_LENGTH (i->right);
diff --git a/src/intervals.h b/src/intervals.h
index a93b10e9fff..9a7ba910a10 100644
--- a/src/intervals.h
+++ b/src/intervals.h
@@ -96,24 +96,27 @@ struct interval
 /* True if this interval has both left and right children.  */
 #define BOTH_KIDS_P(i) ((i)->left != NULL && (i)->right != NULL)
 
-/* The total size of all text represented by this interval and all its
-   children in the tree.   This is zero if the interval is null.  */
-#define TOTAL_LENGTH(i) ((i) == NULL ? 0 : (i)->total_length)
+/* The total size of all text represented by the nonnull interval I
+   and all its children in the tree.  */
+#define TOTAL_LENGTH(i) ((i)->total_length)
+
+/* Likewise, but also defined to be zero if I is null.  */
+#define TOTAL_LENGTH0(i) ((i) ? TOTAL_LENGTH (i) : 0)
 
 /* The size of text represented by this interval alone.  */
-#define LENGTH(i) ((i)->total_length                    \
-                   - TOTAL_LENGTH ((i)->right)          \
-                   - TOTAL_LENGTH ((i)->left))
+#define LENGTH(i) (TOTAL_LENGTH (i)             \
+                   - RIGHT_TOTAL_LENGTH (i)     \
+                   - LEFT_TOTAL_LENGTH (i))
 
 /* The position of the character just past the end of I.  Note that
    the position cache i->position must be valid for this to work.  */
 #define INTERVAL_LAST_POS(i) ((i)->position + LENGTH (i))
 
 /* The total size of the left subtree of this interval.  */
-#define LEFT_TOTAL_LENGTH(i) ((i)->left ? (i)->left->total_length : 0)
+#define LEFT_TOTAL_LENGTH(i) TOTAL_LENGTH0 ((i)->left)
 
 /* The total size of the right subtree of this interval.  */
-#define RIGHT_TOTAL_LENGTH(i) ((i)->right ? (i)->right->total_length : 0)
+#define RIGHT_TOTAL_LENGTH(i) TOTAL_LENGTH0 ((i)->right)
 
 /* These macros are for dealing with the interval properties.  */
 
@@ -234,7 +237,7 @@ set_interval_plist (INTERVAL i, Lisp_Object plist)
 
 /* Declared in alloc.c.  */
 
-extern INTERVAL make_interval (void);
+extern INTERVAL make_interval (void) ATTRIBUTE_RETURNS_NONNULL;
 
 /* Declared in intervals.c.  */
 
@@ -246,7 +249,8 @@ extern void traverse_intervals (INTERVAL, ptrdiff_t,
                                 Lisp_Object);
 extern void traverse_intervals_noorder (INTERVAL,
                                         void (*) (INTERVAL, void *), void *);
-extern INTERVAL split_interval_right (INTERVAL, ptrdiff_t);
+extern INTERVAL split_interval_right (INTERVAL, ptrdiff_t)
+  ATTRIBUTE_RETURNS_NONNULL;
 extern INTERVAL split_interval_left (INTERVAL, ptrdiff_t);
 extern INTERVAL find_interval (INTERVAL, ptrdiff_t);
 extern INTERVAL next_interval (INTERVAL);
diff --git a/src/pdumper.c b/src/pdumper.c
index 4d81203f46f..e52163cdae2 100644
--- a/src/pdumper.c
+++ b/src/pdumper.c
@@ -3604,14 +3604,12 @@ dump_unwind_cleanup (void *data)
   Vprocess_environment = ctx->old_process_environment;
 }
 
-/* Return DUMP_OFFSET, making sure it is within the heap.  */
-static dump_off
+/* Check that DUMP_OFFSET is within the heap.  */
+static void
 dump_check_dump_off (struct dump_context *ctx, dump_off dump_offset)
 {
   eassert (dump_offset > 0);
-  if (ctx)
-    eassert (dump_offset < ctx->end_heap);
-  return dump_offset;
+  eassert (!ctx || dump_offset < ctx->end_heap);
 }
 
 static void
@@ -3734,6 +3732,7 @@ decode_emacs_reloc (struct dump_context *ctx, Lisp_Object lreloc)
           }
         else
           {
+            eassume (ctx); /* Pacify GCC 9.2.1 -O3 -Wnull-dereference.  */
             eassert (!dump_object_emacs_ptr (target_value));
             reloc.u.dump_offset = dump_recall_object (ctx, target_value);
             if (reloc.u.dump_offset <= 0)