Subject: bug#8344: (substring ...) crashes on large vectors

From: Paul Eggert <[email-masked]>
Date: Sat, 26 Mar 2011 19:18:59 -0700

Here's the full patch for this, which I mentioned earlier,
to give you a feel for what's needed.
It's tedious, but is pretty straightforward.
I'll test it more before committing.
=== modified file 'src/ChangeLog'
--- src/ChangeLog	2011-03-26 04:17:38 +0000
+++ src/ChangeLog	2011-03-27 02:12:36 +0000
@@ -1,3 +1,22 @@
+2011-03-27  Paul Eggert  <[email-masked]>
+
+	Variadic C functions now count arguments with size_t, not int.
+	This avoids an unnecessary limitation on 64-bit machines, which
+	caused (substring ...) to crash on large vectors (Bug#8344).
+	* lisp.h (struct Lisp_Subr.function.aMANY): Now takes size_t, not int.
+	(DEFUN_ARGS_MANY, internal_condition_case_n, safe_call): Likewise.
+	All variadic functions changed accordingly.
+	(struct gcpro.nvars): Now size_t, not int.  All uses changed.
+	* data.c (arith_driver, float_arith_driver): Likewise.
+	* editfns.c (general_insert_function): Likewise.
+	* eval.c (struct backtrace.nargs, interactive_p)
+	(internal_condition_case_n, run_hook_with_args, apply_lambda)
+	(funcall_lambda, mark_backtrace): Likewise.
+	* fns.c (concat): Likewise.
+	* frame.c (x_set_frame_parameters): Likewise.
+	* fns.c (get_key_arg): Now accepts and returns size_t, and returns
+	0 if not found, not -1.  All callers changed.
+
 2011-03-26  Paul Eggert  <[email-masked]>
 
 	* alloc.c (garbage_collect): Don't assume stack size fits in int.

=== modified file 'src/alloc.c'
--- src/alloc.c	2011-03-26 04:17:38 +0000
+++ src/alloc.c	2011-03-27 02:12:36 +0000
@@ -2707,7 +2707,7 @@
        doc: /* Return a newly created list with specified arguments as elements.
 Any number of arguments, even zero arguments, are allowed.
 usage: (list &rest OBJECTS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   register Lisp_Object val;
   val = Qnil;
@@ -2923,10 +2923,10 @@
        doc: /* Return a newly created vector with specified arguments as elements.
 Any number of arguments, even zero arguments, are allowed.
 usage: (vector &rest OBJECTS)  */)
-  (register int nargs, Lisp_Object *args)
+  (register size_t nargs, Lisp_Object *args)
 {
   register Lisp_Object len, val;
-  register int i;
+  register size_t i;
   register struct Lisp_Vector *p;
 
   XSETFASTINT (len, nargs);
@@ -2945,10 +2945,10 @@
 The first four arguments are required; at most six have any
 significance.
 usage: (make-byte-code ARGLIST BYTE-CODE CONSTANTS DEPTH &optional DOCSTRING INTERACTIVE-SPEC &rest ELEMENTS)  */)
-  (register int nargs, Lisp_Object *args)
+  (register size_t nargs, Lisp_Object *args)
 {
   register Lisp_Object len, val;
-  register int i;
+  register size_t i;
   register struct Lisp_Vector *p;
 
   XSETFASTINT (len, nargs);
@@ -4230,7 +4230,7 @@
 check_gcpros (void)
 {
   struct gcpro *p;
-  int i;
+  size_t i;
 
   for (p = gcprolist; p; p = p->next)
     for (i = 0; i < p->nvars; ++i)
@@ -4839,7 +4839,7 @@
 {
   register struct specbinding *bind;
   char stack_top_variable;
-  register int i;
+  register size_t i;
   int message_p;
   Lisp_Object total[8];
   int count = SPECPDL_INDEX ();

=== modified file 'src/callint.c'
--- src/callint.c	2011-03-23 10:06:57 +0000
+++ src/callint.c	2011-03-27 02:12:36 +0000
@@ -265,8 +265,9 @@
      recorded as a call to the function named callint_argfuns[varies[i]].  */
   int *varies;
 
-  register int i, j;
-  int count, foo;
+  register size_t i, j;
+  size_t count;
+  int foo;
   char prompt1[100];
   char *tem1;
   int arg_from_tty = 0;

=== modified file 'src/callproc.c'
--- src/callproc.c	2011-03-18 05:56:46 +0000
+++ src/callproc.c	2011-03-27 02:12:36 +0000
@@ -177,7 +177,7 @@
 If you quit, the process is killed with SIGINT, or SIGKILL if you quit again.
 
 usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object infile, buffer, current_dir, path;
   volatile int display_p_volatile;
@@ -221,7 +221,7 @@
   /* Decide the coding-system for giving arguments.  */
   {
     Lisp_Object val, *args2;
-    int i;
+    size_t i;
 
     /* If arguments are supplied, we may have to encode them.  */
     if (nargs >= 5)
@@ -373,10 +373,10 @@
     path = Fsubstring (path, make_number (2), Qnil);
 
   new_argv_volatile = new_argv = (const unsigned char **)
-    alloca (max (2, nargs - 2) * sizeof (char *));
+    alloca ((nargs > 4 ? nargs - 2 : 2) * sizeof (char *));
   if (nargs > 4)
     {
-      register int i;
+      register size_t i;
       struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
 
       GCPRO5 (infile, buffer, current_dir, path, error_file);
@@ -643,7 +643,7 @@
 	{
 	  if (EQ (coding_systems, Qt))
 	    {
-	      int i;
+	      size_t i;
 
 	      args2 = (Lisp_Object *) alloca ((nargs + 1) * sizeof *args2);
 	      args2[0] = Qcall_process;
@@ -864,7 +864,7 @@
 If you quit, the process is killed with SIGINT, or SIGKILL if you quit again.
 
 usage: (call-process-region START END PROGRAM &optional DELETE BUFFER DISPLAY &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   struct gcpro gcpro1;
   Lisp_Object filename_string;
@@ -873,7 +873,7 @@
   /* Qt denotes we have not yet called Ffind_operation_coding_system.  */
   Lisp_Object coding_systems;
   Lisp_Object val, *args2;
-  int i;
+  size_t i;
   char *tempfile;
   Lisp_Object tmpdir, pattern;

=== modified file 'src/character.c'
--- src/character.c	2011-03-08 07:49:41 +0000
+++ src/character.c	2011-03-27 02:12:36 +0000
@@ -893,9 +893,10 @@
        doc: /*
 Concatenate all the argument characters and make the result a string.
 usage: (string &rest CHARACTERS)  */)
-  (int n, Lisp_Object *args)
+  (size_t n, Lisp_Object *args)
 {
-  int i, c;
+  size_t i;
+  int c;
   unsigned char *buf, *p;
   Lisp_Object str;
   USE_SAFE_ALLOCA;
@@ -918,9 +919,10 @@
 DEFUN ("unibyte-string", Funibyte_string, Sunibyte_string, 0, MANY, 0,
        doc: /* Concatenate all the argument bytes and make the result a unibyte string.
 usage: (unibyte-string &rest BYTES)  */)
-  (int n, Lisp_Object *args)
+  (size_t n, Lisp_Object *args)
 {
-  int i, c;
+  size_t i;
+  int c;
   unsigned char *buf, *p;
   Lisp_Object str;
   USE_SAFE_ALLOCA;

=== modified file 'src/charset.c'
--- src/charset.c	2011-03-08 00:46:23 +0000
+++ src/charset.c	2011-03-27 02:12:36 +0000
@@ -845,7 +845,7 @@
        Sdefine_charset_internal, charset_arg_max, MANY, 0,
        doc: /* For internal use only.
 usage: (define-charset-internal ...)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   /* Charset attr vector.  */
   Lisp_Object attrs;
@@ -2171,11 +2171,12 @@
        1, MANY, 0,
        doc: /* Assign higher priority to the charsets given as arguments.
 usage: (set-charset-priority &rest charsets)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object new_head, old_list, arglist[2];
   Lisp_Object list_2022, list_emacs_mule;
-  int i, id;
+  size_t i;
+  int id;
 
   old_list = Fcopy_sequence (Vcharset_ordered_list);
   new_head = Qnil;

=== modified file 'src/coding.c'
--- src/coding.c	2011-03-22 16:20:45 +0000
+++ src/coding.c	2011-03-27 02:12:36 +0000
@@ -9300,7 +9300,7 @@
 contents of BUFFER instead of reading the file.
 
 usage: (find-operation-coding-system OPERATION ARGUMENTS...)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object operation, target_idx, target, val;
   register Lisp_Object chain;
@@ -9309,17 +9309,17 @@
     error ("Too few arguments");
   operation = args[0];
   if (!SYMBOLP (operation)
-      || !INTEGERP (target_idx = Fget (operation, Qtarget_idx)))
+      || !NATNUMP (target_idx = Fget (operation, Qtarget_idx)))
     error ("Invalid first argument");
-  if (nargs < 1 + XINT (target_idx))
+  if (nargs < 1 + XFASTINT (target_idx))
     error ("Too few arguments for operation: %s",
 	   SDATA (SYMBOL_NAME (operation)));
-  target = args[XINT (target_idx) + 1];
+  target = args[XFASTINT (target_idx) + 1];
   if (!(STRINGP (target)
 	|| (EQ (operation, Qinsert_file_contents) && CONSP (target)
 	    && STRINGP (XCAR (target)) && BUFFERP (XCDR (target)))
 	|| (EQ (operation, Qopen_network_stream) && INTEGERP (target))))
-    error ("Invalid %dth argument", XINT (target_idx) + 1);
+    error ("Invalid %dth argument", XFASTINT (target_idx) + 1);
   if (CONSP (target))
     target = XCAR (target);
 
@@ -9376,9 +9376,9 @@
 all but the first one are ignored.
 
 usage: (set-coding-system-priority &rest coding-systems)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
-  int i, j;
+  size_t i, j;
   int changed[coding_category_max];
   enum coding_category priorities[coding_category_max];
 
@@ -9421,7 +9421,7 @@
 
   /* Update `coding-category-list'.  */
   Vcoding_category_list = Qnil;
-  for (i = coding_category_max - 1; i >= 0; i--)
+  for (i = coding_category_max; i-- > 0; )
     Vcoding_category_list
       = Fcons (AREF (Vcoding_category_table, priorities[i]),
 	       Vcoding_category_list);
@@ -9482,7 +9482,7 @@
        Sdefine_coding_system_internal, coding_arg_max, MANY, 0,
        doc: /* For internal use only.
 usage: (define-coding-system-internal ...)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object name;
   Lisp_Object spec_vec;		/* [ ATTRS ALIASE EOL_TYPE ] */

=== modified file 'src/data.c'
--- src/data.c	2011-03-15 23:22:38 +0000
+++ src/data.c	2011-03-27 02:12:36 +0000
@@ -2474,13 +2474,13 @@
     Amin
   };
 
-static Lisp_Object float_arith_driver (double, int, enum arithop,
-                                       int, Lisp_Object *);
+static Lisp_Object float_arith_driver (double, size_t, enum arithop,
+                                       size_t, Lisp_Object *);
 static Lisp_Object
-arith_driver (enum arithop code, int nargs, register Lisp_Object *args)
+arith_driver (enum arithop code, size_t nargs, register Lisp_Object *args)
 {
   register Lisp_Object val;
-  register int argnum;
+  register size_t argnum;
   register EMACS_INT accum = 0;
   register EMACS_INT next;
 
@@ -2562,7 +2562,8 @@
 #define isnan(x) ((x) != (x))
 
 static Lisp_Object
-float_arith_driver (double accum, register int argnum, enum arithop code, int nargs, register Lisp_Object *args)
+float_arith_driver (double accum, register size_t argnum, enum arithop code,
+		    size_t nargs, register Lisp_Object *args)
 {
   register Lisp_Object val;
   double next;
@@ -2624,7 +2625,7 @@
 DEFUN ("+", Fplus, Splus, 0, MANY, 0,
        doc: /* Return sum of any number of arguments, which are numbers or markers.
 usage: (+ &rest NUMBERS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Aadd, nargs, args);
 }
@@ -2634,7 +2635,7 @@
 With one arg, negates it.  With more than one arg,
 subtracts all but the first from the first.
 usage: (- &optional NUMBER-OR-MARKER &rest MORE-NUMBERS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Asub, nargs, args);
 }
@@ -2642,7 +2643,7 @@
 DEFUN ("*", Ftimes, Stimes, 0, MANY, 0,
        doc: /* Return product of any number of arguments, which are numbers or markers.
 usage: (* &rest NUMBERS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Amult, nargs, args);
 }
@@ -2651,9 +2652,9 @@
        doc: /* Return first argument divided by all the remaining arguments.
 The arguments must be numbers or markers.
 usage: (/ DIVIDEND DIVISOR &rest DIVISORS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
-  int argnum;
+  size_t argnum;
   for (argnum = 2; argnum < nargs; argnum++)
     if (FLOATP (args[argnum]))
       return float_arith_driver (0, 0, Adiv, nargs, args);
@@ -2735,7 +2736,7 @@
        doc: /* Return largest of all the arguments (which must be numbers or markers).
 The value is always a number; markers are converted to numbers.
 usage: (max NUMBER-OR-MARKER &rest NUMBERS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Amax, nargs, args);
 }
@@ -2744,7 +2745,7 @@
        doc: /* Return smallest of all the arguments (which must be numbers or markers).
 The value is always a number; markers are converted to numbers.
 usage: (min NUMBER-OR-MARKER &rest NUMBERS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Amin, nargs, args);
 }
@@ -2753,7 +2754,7 @@
        doc: /* Return bitwise-and of all the arguments.
 Arguments may be integers, or markers converted to integers.
 usage: (logand &rest INTS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Alogand, nargs, args);
 }
@@ -2762,7 +2763,7 @@
        doc: /* Return bitwise-or of all the arguments.
 Arguments may be integers, or markers converted to integers.
 usage: (logior &rest INTS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Alogior, nargs, args);
 }
@@ -2771,7 +2772,7 @@
        doc: /* Return bitwise-exclusive-or of all the arguments.
 Arguments may be integers, or markers converted to integers.
 usage: (logxor &rest INTS-OR-MARKERS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return arith_driver (Alogxor, nargs, args);
 }

=== modified file 'src/dbusbind.c'
--- src/dbusbind.c	2011-03-14 03:25:51 +0000
+++ src/dbusbind.c	2011-03-27 02:12:36 +0000
@@ -1051,7 +1051,7 @@
   => "i686"
 
 usage: (dbus-call-method BUS SERVICE PATH INTERFACE METHOD &optional :timeout TIMEOUT &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, service, path, interface, method;
   Lisp_Object result;
@@ -1063,7 +1063,7 @@
   DBusError derror;
   unsigned int dtype;
   int timeout = -1;
-  int i = 5;
+  size_t i = 5;
   char signature[DBUS_MAXIMUM_SIGNATURE_LENGTH];
 
   /* Check parameters.  */
@@ -1116,7 +1116,7 @@
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i+1]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s %s", (unsigned long) (i-4),
 			    SDATA (format2 ("%s", args[i], Qnil)),
 			    SDATA (format2 ("%s", args[i+1], Qnil)));
 	  ++i;
@@ -1124,7 +1124,7 @@
       else
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s", (unsigned long) (i-4),
 			    SDATA (format2 ("%s", args[i], Qnil)));
 	}
 
@@ -1233,7 +1233,7 @@
   -| i686
 
 usage: (dbus-call-method-asynchronously BUS SERVICE PATH INTERFACE METHOD HANDLER &optional :timeout TIMEOUT &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, service, path, interface, method, handler;
   Lisp_Object result;
@@ -1243,7 +1243,7 @@
   DBusMessageIter iter;
   unsigned int dtype;
   int timeout = -1;
-  int i = 6;
+  size_t i = 6;
   char signature[DBUS_MAXIMUM_SIGNATURE_LENGTH];
 
   /* Check parameters.  */
@@ -1298,7 +1298,7 @@
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i+1]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s %s", (unsigned long) (i-4),
 			    SDATA (format2 ("%s", args[i], Qnil)),
 			    SDATA (format2 ("%s", args[i+1], Qnil)));
 	  ++i;
@@ -1306,7 +1306,7 @@
       else
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s", (unsigned long) (i - 4),
 			    SDATA (format2 ("%s", args[i], Qnil)));
 	}
 
@@ -1357,7 +1357,7 @@
 This is an internal function, it shall not be used outside dbus.el.
 
 usage: (dbus-method-return-internal BUS SERIAL SERVICE &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, serial, service;
   struct gcpro gcpro1, gcpro2, gcpro3;
@@ -1365,7 +1365,7 @@
   DBusMessage *dmessage;
   DBusMessageIter iter;
   unsigned int dtype;
-  int i;
+  size_t i;
   char signature[DBUS_MAXIMUM_SIGNATURE_LENGTH];
 
   /* Check parameters.  */
@@ -1405,7 +1405,7 @@
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i+1]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s %s", i-2,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s %s", (unsigned long) (i-2),
 			    SDATA (format2 ("%s", args[i], Qnil)),
 			    SDATA (format2 ("%s", args[i+1], Qnil)));
 	  ++i;
@@ -1413,7 +1413,7 @@
       else
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s", i-2,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s", (unsigned long) (i-2),
 			    SDATA (format2 ("%s", args[i], Qnil)));
 	}
 
@@ -1445,7 +1445,7 @@
 This is an internal function, it shall not be used outside dbus.el.
 
 usage: (dbus-method-error-internal BUS SERIAL SERVICE &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, serial, service;
   struct gcpro gcpro1, gcpro2, gcpro3;
@@ -1453,7 +1453,7 @@
   DBusMessage *dmessage;
   DBusMessageIter iter;
   unsigned int dtype;
-  int i;
+  size_t i;
   char signature[DBUS_MAXIMUM_SIGNATURE_LENGTH];
 
   /* Check parameters.  */
@@ -1494,7 +1494,7 @@
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i+1]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s %s", i-2,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s %s", (unsigned long) (i-2),
 			    SDATA (format2 ("%s", args[i], Qnil)),
 			    SDATA (format2 ("%s", args[i+1], Qnil)));
 	  ++i;
@@ -1502,7 +1502,7 @@
       else
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s", i-2,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s", (unsigned long) (i-2),
 			    SDATA (format2 ("%s", args[i], Qnil)));
 	}
 
@@ -1557,7 +1557,7 @@
   "org.gnu.Emacs.FileManager" "FileModified" "/home/albinus/.emacs")
 
 usage: (dbus-send-signal BUS SERVICE PATH INTERFACE SIGNAL &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, service, path, interface, signal;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
@@ -1565,7 +1565,7 @@
   DBusMessage *dmessage;
   DBusMessageIter iter;
   unsigned int dtype;
-  int i;
+  size_t i;
   char signature[DBUS_MAXIMUM_SIGNATURE_LENGTH];
 
   /* Check parameters.  */
@@ -1609,7 +1609,7 @@
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i+1]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s %s", (unsigned long) (i-4),
 			    SDATA (format2 ("%s", args[i], Qnil)),
 			    SDATA (format2 ("%s", args[i+1], Qnil)));
 	  ++i;
@@ -1617,7 +1617,7 @@
       else
 	{
 	  XD_DEBUG_VALID_LISP_OBJECT_P (args[i]);
-	  XD_DEBUG_MESSAGE ("Parameter%d %s", i-4,
+	  XD_DEBUG_MESSAGE ("Parameter%lu %s", (unsigned long) (i-4),
 			    SDATA (format2 ("%s", args[i], Qnil)));
 	}
 
@@ -1885,11 +1885,11 @@
   => :already-owner.
 
 usage: (dbus-register-service BUS SERVICE &rest FLAGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, service;
   DBusConnection *connection;
-  unsigned int i;
+  size_t i;
   unsigned int value;
   unsigned int flags = 0;
   int result;
@@ -1985,13 +1985,13 @@
 `dbus-unregister-object' for removing the registration.
 
 usage: (dbus-register-signal BUS SERVICE PATH INTERFACE SIGNAL HANDLER &rest ARGS) */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object bus, service, path, interface, signal, handler;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5, gcpro6;
   Lisp_Object uname, key, key1, value;
   DBusConnection *connection;
-  int i;
+  size_t i;
   char rule[DBUS_MAXIMUM_MATCH_RULE_LENGTH];
   char x[DBUS_MAXIMUM_MATCH_RULE_LENGTH];
   DBusError derror;
@@ -2061,7 +2061,8 @@
 	if (!NILP (args[i]))
 	  {
 	    CHECK_STRING (args[i]);
-	    sprintf (x, ",arg%d='%s'", i-6, SDATA (args[i]));
+	    sprintf (x, ",arg%lu='%s'", (unsigned long) (i-6),
+		     SDATA (args[i]));
 	    strcat (rule, x);
 	  }

=== modified file 'src/editfns.c'
--- src/editfns.c	2011-03-23 10:06:57 +0000
+++ src/editfns.c	2011-03-27 02:12:36 +0000
@@ -101,7 +101,7 @@
 				     void (*) (Lisp_Object, EMACS_INT,
 					       EMACS_INT, EMACS_INT,
 					       EMACS_INT, int),
-				     int, int, Lisp_Object *);
+				     int, size_t, Lisp_Object *);
 static Lisp_Object subst_char_in_region_unwind (Lisp_Object);
 static Lisp_Object subst_char_in_region_unwind_1 (Lisp_Object);
 static void transpose_markers (EMACS_INT, EMACS_INT, EMACS_INT, EMACS_INT,
@@ -1871,7 +1871,7 @@
 year values as low as 1901 do work.
 
 usage: (encode-time SECOND MINUTE HOUR DAY MONTH YEAR &optional ZONE)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   time_t value;
   struct tm tm;
@@ -2207,9 +2207,9 @@
 			 void (*insert_from_string_func)
 			      (Lisp_Object, EMACS_INT, EMACS_INT,
 			       EMACS_INT, EMACS_INT, int),
-			 int inherit, int nargs, Lisp_Object *args)
+			 int inherit, size_t nargs, Lisp_Object *args)
 {
-  register int argnum;
+  register size_t argnum;
   register Lisp_Object val;
 
   for (argnum = 0; argnum < nargs; argnum++)
@@ -2272,7 +2272,7 @@
 and insert the result.
 
 usage: (insert &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   general_insert_function (insert, insert_from_string, 0, nargs, args);
   return Qnil;
@@ -2291,7 +2291,7 @@
 to unibyte for insertion.
 
 usage: (insert-and-inherit &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   general_insert_function (insert_and_inherit, insert_from_string, 1,
 			   nargs, args);
@@ -2308,7 +2308,7 @@
 to unibyte for insertion.
 
 usage: (insert-before-markers &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   general_insert_function (insert_before_markers,
 			   insert_from_string_before_markers, 0,
@@ -2327,7 +2327,7 @@
 to unibyte for insertion.
 
 usage: (insert-before-markers-and-inherit &rest ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   general_insert_function (insert_before_markers_and_inherit,
 			   insert_from_string_before_markers, 1,
@@ -3399,7 +3399,7 @@
 also `current-message'.
 
 usage: (message FORMAT-STRING &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   if (NILP (args[0])
       || (STRINGP (args[0])
@@ -3427,7 +3427,7 @@
 message; let the minibuffer contents show.
 
 usage: (message-box FORMAT-STRING &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   if (NILP (args[0]))
     {
@@ -3484,7 +3484,7 @@
 message; let the minibuffer contents show.
 
 usage: (message-or-box FORMAT-STRING &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
 #ifdef HAVE_MENUS
   if ((NILP (last_nonmenu_event) || CONSP (last_nonmenu_event))
@@ -3508,14 +3508,14 @@
 Remaining arguments form a sequence of PROPERTY VALUE pairs for text
 properties to add to the result.
 usage: (propertize STRING &rest PROPERTIES)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object properties, string;
   struct gcpro gcpro1, gcpro2;
-  int i;
+  size_t i;
 
   /* Number of args must be odd.  */
-  if ((nargs & 1) == 0 || nargs < 1)
+  if ((nargs & 1) == 0)
     error ("Wrong number of arguments");
 
   properties = string = Qnil;
@@ -3590,10 +3590,10 @@
 specifier truncates the string to the given width.
 
 usage: (format STRING &rest OBJECTS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
-  register int n;		/* The number of the next arg to substitute */
-  register EMACS_INT total;	/* An estimate of the final length */
+  register size_t n;		/* The number of the next arg to substitute */
+  register size_t total;	/* An estimate of the final length */
   char *buf, *p;
   register char *format, *end, *format_start;
   int nchars;
@@ -3669,8 +3669,8 @@
 
   /* Allocate the info and discarded tables.  */
   {
-    int nbytes = (nargs+1) * sizeof *info;
-    int i;
+    size_t nbytes = (nargs+1) * sizeof *info;
+    size_t i;
     if (!info)
       info = (struct info *) alloca (nbytes);
     memset (info, 0, nbytes);

=== modified file 'src/eval.c'
--- src/eval.c	2011-03-16 07:44:19 +0000
+++ src/eval.c	2011-03-27 02:12:36 +0000
@@ -38,9 +38,9 @@
   struct backtrace *next;
   Lisp_Object *function;
   Lisp_Object *args;	/* Points to vector of args. */
-  int nargs;		/* Length of vector.
-			   If nargs is UNEVALLED, args points to slot holding
-			   list of unevalled args */
+  size_t nargs;		/* Length of vector.
+			   If nargs is (size_t) UNEVALLED, args points
+			   to slot holding list of unevalled args */
   char evalargs;
   /* Nonzero means call value of debugger when done with this operation. */
   char debug_on_exit;
@@ -111,7 +111,7 @@
 
 int handling_signal;
 
-static Lisp_Object funcall_lambda (Lisp_Object, int, Lisp_Object*);
+static Lisp_Object funcall_lambda (Lisp_Object, size_t, Lisp_Object*);
 static void unwind_to_catch (struct catchtag *, Lisp_Object) NO_RETURN;
 static int interactive_p (int);
 static Lisp_Object apply_lambda (Lisp_Object, Lisp_Object, int);
@@ -553,7 +553,7 @@
      looking at several frames for special forms.  Skip past them.  */
   while (btp
 	 && (EQ (*btp->function, Qbytecode)
-	     || btp->nargs == UNEVALLED))
+	     || btp->nargs == (size_t) UNEVALLED))
     btp = btp->next;
 
   /* btp now points at the frame of the innermost function that isn't
@@ -959,7 +959,7 @@
   Lisp_Object *temps, tem;
   register Lisp_Object elt, varlist;
   int count = SPECPDL_INDEX ();
-  register int argnum;
+  register size_t argnum;
   struct gcpro gcpro1, gcpro2;
   USE_SAFE_ALLOCA;
 
@@ -1511,8 +1511,8 @@
    and ARGS as second argument.  */
 
 Lisp_Object
-internal_condition_case_n (Lisp_Object (*bfun) (int, Lisp_Object*),
-			   int nargs,
+internal_condition_case_n (Lisp_Object (*bfun) (size_t, Lisp_Object *),
+			   size_t nargs,
 			   Lisp_Object *args,
 			   Lisp_Object handlers,
 			   Lisp_Object (*hfun) (Lisp_Object))
@@ -2203,7 +2203,7 @@
 	{
 	  /* Pass a vector of evaluated arguments */
 	  Lisp_Object *vals;
-	  register int argnum = 0;
+	  register size_t argnum = 0;
 	  USE_SAFE_ALLOCA;
 
 	  SAFE_ALLOCA_LISP (vals, XINT (numargs));
@@ -2332,9 +2332,9 @@
 Then return the value FUNCTION returns.
 Thus, (apply '+ 1 2 '(3 4)) returns 10.
 usage: (apply FUNCTION &rest ARGUMENTS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
-  register int i, numargs;
+  register size_t i, numargs;
   register Lisp_Object spread_arg;
   register Lisp_Object *funcall_args;
   Lisp_Object fun, retval;
@@ -2374,7 +2374,7 @@
       if (numargs < XSUBR (fun)->min_args
 	  || (XSUBR (fun)->max_args >= 0 && XSUBR (fun)->max_args < numargs))
 	goto funcall;		/* Let funcall get the error */
-      else if (XSUBR (fun)->max_args > numargs)
+      else if (XSUBR (fun)->max_args >= 0 && XSUBR (fun)->max_args > numargs)
 	{
 	  /* Avoid making funcall cons up a yet another new vector of arguments
 	     by explicitly supplying nil's for optional values */
@@ -2416,7 +2416,7 @@
 /* Run hook variables in various ways.  */
 
 enum run_hooks_condition {to_completion, until_success, until_failure};
-static Lisp_Object run_hook_with_args (int, Lisp_Object *,
+static Lisp_Object run_hook_with_args (size_t, Lisp_Object *,
 				       enum run_hooks_condition);
 
 DEFUN ("run-hooks", Frun_hooks, Srun_hooks, 0, MANY, 0,
@@ -2434,10 +2434,10 @@
 Do not use `make-local-variable' to make a hook variable buffer-local.
 Instead, use `add-hook' and specify t for the LOCAL argument.
 usage: (run-hooks &rest HOOKS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object hook[1];
-  register int i;
+  register size_t i;
 
   for (i = 0; i < nargs; i++)
     {
@@ -2463,7 +2463,7 @@
 Do not use `make-local-variable' to make a hook variable buffer-local.
 Instead, use `add-hook' and specify t for the LOCAL argument.
 usage: (run-hook-with-args HOOK &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return run_hook_with_args (nargs, args, to_completion);
 }
@@ -2483,7 +2483,7 @@
 Do not use `make-local-variable' to make a hook variable buffer-local.
 Instead, use `add-hook' and specify t for the LOCAL argument.
 usage: (run-hook-with-args-until-success HOOK &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return run_hook_with_args (nargs, args, until_success);
 }
@@ -2502,7 +2502,7 @@
 Do not use `make-local-variable' to make a hook variable buffer-local.
 Instead, use `add-hook' and specify t for the LOCAL argument.
 usage: (run-hook-with-args-until-failure HOOK &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return run_hook_with_args (nargs, args, until_failure);
 }
@@ -2516,7 +2516,8 @@
    except that it isn't necessary to gcpro ARGS[0].  */
 
 static Lisp_Object
-run_hook_with_args (int nargs, Lisp_Object *args, enum run_hooks_condition cond)
+run_hook_with_args (size_t nargs, Lisp_Object *args,
+		    enum run_hooks_condition cond)
 {
   Lisp_Object sym, val, ret;
   struct gcpro gcpro1, gcpro2, gcpro3;
@@ -2763,16 +2764,16 @@
 Return the value that function returns.
 Thus, (funcall 'cons 'x 'y) returns (x . y).
 usage: (funcall FUNCTION &rest ARGUMENTS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object fun, original_fun;
   Lisp_Object funcar;
-  int numargs = nargs - 1;
+  size_t numargs = nargs - 1;
   Lisp_Object lisp_numargs;
   Lisp_Object val;
   struct backtrace backtrace;
   register Lisp_Object *internal_args;
-  register int i;
+  register size_t i;
 
   QUIT;
   if ((consing_since_gc > gc_cons_threshold
@@ -2925,21 +2926,21 @@
 apply_lambda (Lisp_Object fun, Lisp_Object args, int eval_flag)
 {
   Lisp_Object args_left;
-  Lisp_Object numargs;
+  size_t numargs;
   register Lisp_Object *arg_vector;
   struct gcpro gcpro1, gcpro2, gcpro3;
-  register int i;
+  register size_t i;
   register Lisp_Object tem;
   USE_SAFE_ALLOCA;
 
-  numargs = Flength (args);
-  SAFE_ALLOCA_LISP (arg_vector, XINT (numargs));
+  numargs = XINT (Flength (args));
+  SAFE_ALLOCA_LISP (arg_vector, numargs);
   args_left = args;
 
   GCPRO3 (*arg_vector, args_left, fun);
   gcpro1.nvars = 0;
 
-  for (i = 0; i < XINT (numargs);)
+  for (i = 0; i < numargs; )
     {
       tem = Fcar (args_left), args_left = Fcdr (args_left);
       if (eval_flag) tem = Feval (tem);
@@ -2955,7 +2956,7 @@
       backtrace_list->nargs = i;
     }
   backtrace_list->evalargs = 0;
-  tem = funcall_lambda (fun, XINT (numargs), arg_vector);
+  tem = funcall_lambda (fun, numargs, arg_vector);
 
   /* Do the debug-on-exit now, while arg_vector still exists.  */
   if (backtrace_list->debug_on_exit)
@@ -2971,11 +2972,13 @@
    FUN must be either a lambda-expression or a compiled-code object.  */
 
 static Lisp_Object
-funcall_lambda (Lisp_Object fun, int nargs, register Lisp_Object *arg_vector)
+funcall_lambda (Lisp_Object fun, size_t nargs,
+		register Lisp_Object *arg_vector)
 {
   Lisp_Object val, syms_left, next;
   int count = SPECPDL_INDEX ();
-  int i, optional, rest;
+  size_t i;
+  int optional, rest;
 
   if (CONSP (fun))
     {
@@ -3310,7 +3313,7 @@
   while (backlist)
     {
       write_string (backlist->debug_on_exit ? "* " : "  ", 2);
-      if (backlist->nargs == UNEVALLED)
+      if (backlist->nargs == (size_t) UNEVALLED)
 	{
 	  Fprin1 (Fcons (*backlist->function, *backlist->args), Qnil);
 	  write_string ("\n", -1);
@@ -3320,7 +3323,7 @@
 	  tem = *backlist->function;
 	  Fprin1 (tem, Qnil);	/* This can QUIT */
 	  write_string ("(", -1);
-	  if (backlist->nargs == MANY)
+	  if (backlist->nargs == (size_t) MANY)
 	    {
 	      for (tail = *backlist->args, i = 0;
 		   !NILP (tail);
@@ -3372,11 +3375,11 @@
 
   if (!backlist)
     return Qnil;
-  if (backlist->nargs == UNEVALLED)
+  if (backlist->nargs == (size_t) UNEVALLED)
     return Fcons (Qnil, Fcons (*backlist->function, *backlist->args));
   else
     {
-      if (backlist->nargs == MANY)
+      if (backlist->nargs == (size_t) MANY)
 	tem = *backlist->args;
       else
 	tem = Flist (backlist->nargs, backlist->args);
@@ -3390,17 +3393,18 @@
 mark_backtrace (void)
 {
   register struct backtrace *backlist;
-  register int i;
+  register size_t i;
 
   for (backlist = backtrace_list; backlist; backlist = backlist->next)
     {
       mark_object (*backlist->function);
 
-      if (backlist->nargs == UNEVALLED || backlist->nargs == MANY)
-	i = 0;
+      if (backlist->nargs == (size_t) UNEVALLED
+	  || backlist->nargs == (size_t) MANY)
+	i = 1;
       else
-	i = backlist->nargs - 1;
-      for (; i >= 0; i--)
+	i = backlist->nargs;
+      while (i--)
 	mark_object (backlist->args[i]);
     }
 }

=== modified file 'src/fns.c'
--- src/fns.c	2011-03-16 07:49:54 +0000
+++ src/fns.c	2011-03-27 02:12:36 +0000
@@ -348,7 +348,7 @@
   return i1 < SCHARS (s2) ? Qt : Qnil;
 }
 
-static Lisp_Object concat (int nargs, Lisp_Object *args,
+static Lisp_Object concat (size_t nargs, Lisp_Object *args,
 			   enum Lisp_Type target_type, int last_special);
 
 /* ARGSUSED */
@@ -378,7 +378,7 @@
 Each argument may be a list, vector or string.
 The last argument is not copied, just used as the tail of the new list.
 usage: (append &rest SEQUENCES)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return concat (nargs, args, Lisp_Cons, 1);
 }
@@ -388,7 +388,7 @@
 The result is a string whose elements are the elements of all the arguments.
 Each argument may be a string or a list or vector of characters (integers).
 usage: (concat &rest SEQUENCES)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return concat (nargs, args, Lisp_String, 0);
 }
@@ -398,7 +398,7 @@
 The result is a vector whose elements are the elements of all the arguments.
 Each argument may be a list, vector or string.
 usage: (vconcat &rest SEQUENCES)   */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   return concat (nargs, args, Lisp_Vectorlike, 0);
 }
@@ -446,7 +446,8 @@
 };
 
 static Lisp_Object
-concat (int nargs, Lisp_Object *args, enum Lisp_Type target_type, int last_special)
+concat (size_t nargs, Lisp_Object *args,
+	enum Lisp_Type target_type, int last_special)
 {
   Lisp_Object val;
   register Lisp_Object tail;
@@ -455,7 +456,7 @@
   EMACS_INT toindex_byte = 0;
   register EMACS_INT result_len;
   register EMACS_INT result_len_byte;
-  register int argnum;
+  register size_t argnum;
   Lisp_Object last_tail;
   Lisp_Object prev;
   int some_multibyte;
@@ -2232,9 +2233,9 @@
        doc: /* Concatenate any number of lists by altering them.
 Only the last argument is not altered, and need not be a list.
 usage: (nconc &rest LISTS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
-  register int argnum;
+  register size_t argnum;
   register Lisp_Object tail, tem, val;
 
   val = tail = Qnil;
@@ -2763,7 +2764,7 @@
        doc: /* Apply the value of WIDGET's PROPERTY to the widget itself.
 ARGS are passed as extra arguments to the function.
 usage: (widget-apply WIDGET PROPERTY &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   /* This function can GC. */
   Lisp_Object newargs[3];
@@ -3367,7 +3368,7 @@
 /* Function prototypes.  */
 
 static struct Lisp_Hash_Table *check_hash_table (Lisp_Object);
-static int get_key_arg (Lisp_Object, int, Lisp_Object *, char *);
+static size_t get_key_arg (Lisp_Object, size_t, Lisp_Object *, char *);
 static void maybe_resize_hash_table (struct Lisp_Hash_Table *);
 static int cmpfn_eql (struct Lisp_Hash_Table *, Lisp_Object, unsigned,
                       Lisp_Object, unsigned);
@@ -3422,27 +3423,23 @@
 /* Find KEY in ARGS which has size NARGS.  Don't consider indices for
    which USED[I] is non-zero.  If found at index I in ARGS, set
    USED[I] and USED[I + 1] to 1, and return I + 1.  Otherwise return
-   -1.  This function is used to extract a keyword/argument pair from
+   0.  This function is used to extract a keyword/argument pair from
    a DEFUN parameter list.  */
 
-static int
-get_key_arg (Lisp_Object key, int nargs, Lisp_Object *args, char *used)
+static size_t
+get_key_arg (Lisp_Object key, size_t nargs, Lisp_Object *args, char *used)
 {
-  int i;
-
-  for (i = 0; i < nargs - 1; ++i)
-    if (!used[i] && EQ (args[i], key))
-      break;
-
-  if (i >= nargs - 1)
-    i = -1;
-  else
-    {
-      used[i++] = 1;
-      used[i] = 1;
-    }
-
-  return i;
+  size_t i;
+
+  for (i = 1; i < nargs; i++)
+    if (!used[i - 1] && EQ (args[i - 1], key))
+      {
+	used[i - 1] = 1;
+	used[i] = 1;
+	return i;
+      }
+
+  return 0;
 }

@@ -4290,12 +4287,12 @@
 is nil.
 
 usage: (make-hash-table &rest KEYWORD-ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object test, size, rehash_size, rehash_threshold, weak;
   Lisp_Object user_test, user_hash;
   char *used;
-  int i;
+  size_t i;
 
   /* The vector `used' is used to keep track of arguments that
      have been consumed.  */
@@ -4304,7 +4301,7 @@
 
   /* See if there's a `:test TEST' among the arguments.  */
   i = get_key_arg (QCtest, nargs, args, used);
-  test = i < 0 ? Qeql : args[i];
+  test = i ? args[i] : Qeql;
   if (!EQ (test, Qeq) && !EQ (test, Qeql) && !EQ (test, Qequal))
     {
       /* See if it is a user-defined test.  */
@@ -4321,7 +4318,7 @@
 
   /* See if there's a `:size SIZE' argument.  */
   i = get_key_arg (QCsize, nargs, args, used);
-  size = i < 0 ? Qnil : args[i];
+  size = i ? args[i] : Qnil;
   if (NILP (size))
     size = make_number (DEFAULT_HASH_SIZE);
   else if (!INTEGERP (size) || XINT (size) < 0)
@@ -4329,7 +4326,7 @@
 
   /* Look for `:rehash-size SIZE'.  */
   i = get_key_arg (QCrehash_size, nargs, args, used);
-  rehash_size = i < 0 ? make_float (DEFAULT_REHASH_SIZE) : args[i];
+  rehash_size = i ? args[i] : make_float (DEFAULT_REHASH_SIZE);
   if (!NUMBERP (rehash_size)
       || (INTEGERP (rehash_size) && XINT (rehash_size) <= 0)
       || XFLOATINT (rehash_size) <= 1.0)
@@ -4337,7 +4334,7 @@
 
   /* Look for `:rehash-threshold THRESHOLD'.  */
   i = get_key_arg (QCrehash_threshold, nargs, args, used);
-  rehash_threshold = i < 0 ? make_float (DEFAULT_REHASH_THRESHOLD) : args[i];
+  rehash_threshold = i ? args[i] : make_float (DEFAULT_REHASH_THRESHOLD);
   if (!FLOATP (rehash_threshold)
       || XFLOATINT (rehash_threshold) <= 0.0
       || XFLOATINT (rehash_threshold) > 1.0)
@@ -4345,7 +4342,7 @@
 
   /* Look for `:weakness WEAK'.  */
   i = get_key_arg (QCweakness, nargs, args, used);
-  weak = i < 0 ? Qnil : args[i];
+  weak = i ? args[i] : Qnil;
   if (EQ (weak, Qt))
     weak = Qkey_and_value;
   if (!NILP (weak)

=== modified file 'src/font.c'
--- src/font.c	2011-03-16 21:23:37 +0000
+++ src/font.c	2011-03-27 02:12:36 +0000
@@ -3831,10 +3831,10 @@
 language system must contain `mark' feature.
 
 usage: (font-spec ARGS...)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object spec = font_make_spec ();
-  int i;
+  size_t i;
 
   for (i = 0; i < nargs; i += 2)
     {

=== modified file 'src/frame.c'
--- src/frame.c	2011-03-23 10:06:57 +0000
+++ src/frame.c	2011-03-27 02:12:36 +0000
@@ -2902,7 +2902,7 @@
   /* Record in these vectors all the parms specified.  */
   Lisp_Object *parms;
   Lisp_Object *values;
-  int i, p;
+  size_t i, p;
   int left_no_change = 0, top_no_change = 0;
   int icon_left_no_change = 0, icon_top_no_change = 0;
   int size_changed = 0;
@@ -2975,7 +2975,7 @@
     }
 
   /* Now process them in reverse of specified order.  */
-  for (i--; i >= 0; i--)
+  while (i-- != 0)
     {
       Lisp_Object prop, val;

=== modified file 'src/lisp.h'
--- src/lisp.h	2011-03-22 09:08:11 +0000
+++ src/lisp.h	2011-03-27 02:12:36 +0000
@@ -964,7 +964,7 @@
       Lisp_Object (*a7) (Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object);
       Lisp_Object (*a8) (Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object);
       Lisp_Object (*aUNEVALLED) (Lisp_Object args);
-      Lisp_Object (*aMANY) (int, Lisp_Object *);
+      Lisp_Object (*aMANY) (size_t, Lisp_Object *);
     } function;
     short min_args, max_args;
     const char *symbol_name;
@@ -1809,7 +1809,7 @@
 
 /* Note that the weird token-substitution semantics of ANSI C makes
    this work for MANY and UNEVALLED.  */
-#define DEFUN_ARGS_MANY		(int, Lisp_Object *)
+#define DEFUN_ARGS_MANY		(size_t, Lisp_Object *)
 #define DEFUN_ARGS_UNEVALLED	(Lisp_Object)
 #define DEFUN_ARGS_0	(void)
 #define DEFUN_ARGS_1	(Lisp_Object)
@@ -2079,7 +2079,7 @@
   volatile Lisp_Object *var;
 
   /* Number of consecutive protected variables.  */
-  int nvars;
+  size_t nvars;
 
 #ifdef DEBUG_GCPRO
   int level;
@@ -2860,7 +2860,7 @@
 extern Lisp_Object internal_condition_case (Lisp_Object (*) (void), Lisp_Object, Lisp_Object (*) (Lisp_Object));
 extern Lisp_Object internal_condition_case_1 (Lisp_Object (*) (Lisp_Object), Lisp_Object, Lisp_Object, Lisp_Object (*) (Lisp_Object));
 extern Lisp_Object internal_condition_case_2 (Lisp_Object (*) (Lisp_Object, Lisp_Object), Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object (*) (Lisp_Object));
-extern Lisp_Object internal_condition_case_n (Lisp_Object (*) (int, Lisp_Object *), int, Lisp_Object *, Lisp_Object, Lisp_Object (*) (Lisp_Object));
+extern Lisp_Object internal_condition_case_n (Lisp_Object (*) (size_t, Lisp_Object *), size_t, Lisp_Object *, Lisp_Object, Lisp_Object (*) (Lisp_Object));
 extern void specbind (Lisp_Object, Lisp_Object);
 extern void record_unwind_protect (Lisp_Object (*) (Lisp_Object), Lisp_Object);
 extern Lisp_Object unbind_to (int, Lisp_Object);
@@ -2870,7 +2870,7 @@
 extern Lisp_Object un_autoload (Lisp_Object);
 EXFUN (Ffetch_bytecode, 1);
 extern void init_eval_once (void);
-extern Lisp_Object safe_call (int, Lisp_Object *);
+extern Lisp_Object safe_call (size_t, Lisp_Object *);
 extern Lisp_Object safe_call1 (Lisp_Object, Lisp_Object);
 extern Lisp_Object safe_call2 (Lisp_Object, Lisp_Object, Lisp_Object);
 extern void init_eval (void);

=== modified file 'src/process.c'
--- src/process.c	2011-03-26 01:23:15 +0000
+++ src/process.c	2011-03-27 02:12:36 +0000
@@ -1512,11 +1512,11 @@
 syntax.
 
 usage: (start-process NAME BUFFER PROGRAM &rest PROGRAM-ARGS)  */)
-  (int nargs, register Lisp_Object *args)
+  (size_t nargs, register Lisp_Object *args)
 {
   Lisp_Object buffer, name, program, proc, current_dir, tem;
   register unsigned char **new_argv;
-  register int i;
+  register size_t i;
   int count = SPECPDL_INDEX ();
 
   buffer = args[1];
@@ -1722,7 +1722,7 @@
       new_argv = (unsigned char **) alloca ((nargs - 1) * sizeof (char *));
       new_argv[nargs - 2] = 0;
 
-      for (i = nargs - 3; i >= 0; i--)
+      for (i = nargs - 2; i-- != 0; )
 	{
 	  new_argv[i] = SDATA (XCAR (tem));
 	  tem = XCDR (tem);
@@ -2681,7 +2681,7 @@
 \(serial-process-configure :port "\\\\.\\COM13" :bytesize 7)
 
 usage: (serial-process-configure &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   struct Lisp_Process *p;
   Lisp_Object contact = Qnil;
@@ -2799,7 +2799,7 @@
 \(make-serial-process :port "/dev/tty.BlueConsole-SPP-1" :speed nil)
 
 usage:  (make-serial-process &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   int fd = -1;
   Lisp_Object proc, contact, port;
@@ -3077,7 +3077,7 @@
 information, is available via the `process-contact' function.
 
 usage: (make-network-process &rest ARGS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object proc;
   Lisp_Object contact;
@@ -3393,7 +3393,8 @@
 
   for (lres = res; lres; lres = lres->ai_next)
     {
-      int optn, optbits;
+      size_t optn;
+      int optbits;
 
 #ifdef WINDOWSNT
     retry_connect:

=== modified file 'src/xdisp.c'
--- src/xdisp.c	2011-03-25 20:00:25 +0000
+++ src/xdisp.c	2011-03-27 02:12:36 +0000
@@ -2181,7 +2181,7 @@
    redisplay during the evaluation.  */
 
 Lisp_Object
-safe_call (int nargs, Lisp_Object *args)
+safe_call (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object val;
 
@@ -16389,7 +16389,7 @@
 DEFUN ("trace-to-stderr", Ftrace_to_stderr, Strace_to_stderr, 1, MANY, "",
        doc: /* Like `format', but print result to stderr.
 usage: (trace-to-stderr STRING &rest OBJECTS)  */)
-  (int nargs, Lisp_Object *args)
+  (size_t nargs, Lisp_Object *args)
 {
   Lisp_Object s = Fformat (nargs, args);
   fprintf (stderr, "%s", SDATA (s));