* alloc.c (pure_bytes_used_lisp, pure_bytes_used_non_lisp):

(allocate_vectorlike, buffer_memory_full, struct sdata, SDATA_SIZE)
(string_bytes, check_sblock, allocate_string_data):
(compact_small_strings, Fmake_bool_vector, make_string)
(make_unibyte_string, make_multibyte_string)
(make_string_from_bytes, make_specified_string)
(allocate_vectorlike, Fmake_vector, find_string_data_in_pure)
(make_pure_string, make_pure_c_string, make_pure_vector, Fpurecopy)
(mark_vectorlike):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(allocate_pseudovector):
Use int, not EMACS_INT, where int is wide enough.
(inhibit_garbage_collection, Fgarbage_collect):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* bidi.c (bidi_mirror_char): Use EMACS_INT, not int, where
int might not be wide enough.
(bidi_cache_search, bidi_cache_find, bidi_init_it)
(bidi_count_bytes, bidi_char_at_pos, bidi_fetch_char)
(bidi_at_paragraph_end, bidi_find_paragraph_start)
(bidi_paragraph_init, bidi_resolve_explicit, bidi_resolve_weak)
(bidi_level_of_next_char, bidi_move_to_visually_next):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
* buffer.c (copy_overlays, Fgenerate_new_buffer_name)
(Fkill_buffer, Fset_buffer_major_mode)
(advance_to_char_boundary, Fbuffer_swap_text)
(Fset_buffer_multibyte, overlays_at, overlays_in)
(overlay_touches_p, struct sortvec, record_overlay_string)
(overlay_strings, recenter_overlay_lists)
(adjust_overlays_for_insert, adjust_overlays_for_delete)
(fix_start_end_in_overlays, fix_overlays_before, modify_overlay)
(Fmove_overlay, Fnext_overlay_change, Fprevious_overlay_change)
(Foverlay_recenter, last_overlay_modification_hooks_used)
(report_overlay_modification, evaporate_overlays, enlarge_buffer_text):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(validate_region): Omit unnecessary test for b <= e, since
that's guaranteed by the previous test.
(adjust_overlays_for_delete): Avoid pos + length overflow.
(Fmove_overlay, Fdelete_overlay, add_overlay_mod_hooklist)
(report_overlay_modification):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(Foverlays_at, Fnext_overlay_change, Fprevious_overlay_change):
Omit pointer cast, which isn't needed anyway, and doesn't work
after the EMACS_INT -> ptrdiff_t change.
* buffer.h: Adjust decls to match defn changes elsewhere.
(struct buffer_text, struct buffer):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
Use EMACS_INT, not int, where int might not be wide enough.
* bytecode.c (exec_byte_code): Use ptrdiff_t, not int, to avoid
needless 32-bit limit on 64-bit hosts.  Remove unnecessary
memory-full test.  Use EMACS_INT, not ptrdiff_t or int, where
ptrdiff_t or int might not be wide enough.
* callint.c (Fcall_interactively):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* callproc.c (call_process_kill, Fcall_process):
Don't assume pid_t fits into an Emacs fixnum.
(call_process_cleanup, Fcall_process, child_setup):
Don't assume pid_t fits into int.
(call_process_cleanup, Fcall_process, delete_temp_file)
(Fcall_process_region):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(Fcall_process): Simplify handling of volatile integers.
Use int, not EMACS_INT, where int will do.
* casefiddle.c (casify_object, casify_region, operate_on_word)
(Fupcase_word, Fdowncase_word, Fcapitalize_word):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(casify_object): Avoid integer overflow when overallocating buffer.
* casetab.c (set_identity, shuffle): Prefer int to unsigned when
either works.
* category.c (Fchar_category_set): Don't assume fixnum fits in int.
* category.h (CATEGORYP): Don't assume arg is nonnegative.
* ccl.c (GET_CCL_INT): Remove; no longer needed, since the
integers are now checked earlier.  All uses replaced with XINT.
(ccl_driver):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
For CCL_MapSingle, check that content and value are in int range.
(resolve_symbol_ccl_program): Check that vector header is in range.
Always copy the vector, so that we can check its contents reliably
now rather than having to recheck each instruction as it's being
executed.  Check that vector words fit in 'int'.
(ccl_get_compiled_code, Fregister_ccl_program)
(Fregister_code_conversion_map): Use ptrdiff_t, not int, for
program indexes, to avoid needless 32-bit limit on 64-bit hosts.
(Fccl_execute, Fccl_execute_on_string): Check that initial reg
contents are in range.
(Fccl_execute_on_string): Check that status is in range.
* ccl.h (struct ccl_program.idx): Now ptrdiff_t, not int.
* character.c (char_resolve_modifier_mask, Fchar_resolve_modifiers):
Accept and return EMACS_INT, not int, because callers can pass values
out of 'int' range.
(c_string_width, strwidth, lisp_string_width, chars_in_text)
(multibyte_chars_in_text, parse_str_as_multibyte)
(str_as_multibyte, count_size_as_multibyte, str_to_multibyte)
(str_as_unibyte, str_to_unibyte, string_count_byte8)
(string_escape_byte8, Fget_byte):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Funibyte_string): Use CHECK_CHARACTER, not CHECK_NATNUM, to
avoid mishandling large integers.
* character.h: Adjust decls to match defn changes elsewhere.
* charset.c (load_charset_map_from_file, find_charsets_in_text)
(Ffind_charset_region):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(load_charset_map_from_file): Redo idx calculation to avoid overflow.
(load_charset_map_from_vector, Fdefine_charset_internal):
Don't assume fixnum fits in int or unsigned int.
(load_charset_map_from_vector, Fmap_charset_chars):
Remove now-unnecessary CHECK_NATNUMs.
(Fdefine_charset_internal): Check ranges here, more carefully.
* chartab.c (Fmake_char_table, Fset_char_table_range)
(uniprop_get_decoder, uniprop_get_encoder):
Don't assume fixnum fits in int.
* cmds.c (move_point): New function, that does the gist of
Fforward_char and Fbackward_char, but does so while checking
for integer overflow more accurately.
(Fforward_char, Fbackward_char, internal_self_insert): Use it.
(Fforward_line, Fend_of_line, internal_self_insert)
(internal_self_insert):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
Fix a FIXME, by checking for integer overflow when calculating
target_clm and actual_clm.
* coding.c (detect_coding_XXX, encode_coding_XXX, CODING_DECODE_CHAR)
(ASSURE_DESTINATION, coding_alloc_by_realloc)
(coding_alloc_by_making_gap, alloc_destination)
(detect_coding_utf_8, encode_coding_utf_8, decode_coding_utf_16)
(encode_coding_utf_16, detect_coding_emacs_mule)
(decode_coding_emacs_mule, encode_coding_emacs_mule)
(detect_coding_iso_2022, decode_coding_iso_2022)
(encode_invocation_designation, encode_designation_at_bol)
(encode_coding_iso_2022, detect_coding_sjis, detect_coding_big5)
(decode_coding_sjis, decode_coding_big5, encode_coding_sjis)
(encode_coding_big5, detect_coding_ccl, decode_coding_ccl)
(encode_coding_ccl, encode_coding_raw_text)
(detect_coding_charset, decode_coding_charset)
(encode_coding_charset, detect_eol, decode_eol, produce_chars)
(produce_composition, produce_charset, produce_annotation)
(decode_coding, handle_composition_annotation)
(handle_charset_annotation, consume_chars, decode_coding_gap)
(decode_coding_object, encode_coding_object, detect_coding_system)
(Ffind_coding_systems_region_internal, Fcheck_coding_systems_region)
(code_convert_region, code_convert_string)
(Fdefine_coding_system_internal):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(setup_iso_safe_charsets, consume_chars, Funencodable_char_position)
(Fdefine_coding_system_internal):
Don't assume fixnums fit in int.
(decode_coding_gap, decode_coding_object, encode_coding_object)
(Fread_coding_system, Fdetect_coding_region, Funencodable_char_position)
(Fcheck_coding_systems_region):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(Ffind_operation_coding_system): NATNUMP can eval its arg twice.
(Fdefine_coding_system_internal): Check for charset-id overflow.
* coding.h: Adjust decls to match defn changes elsewhere.
(struct coding_system):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
* composite.c (get_composition_id, find_composition)
(run_composition_function, update_compositions)
(compose_text, composition_gstring_put_cache)
(composition_gstring_p, composition_gstring_width)
(fill_gstring_header, fill_gstring_body, autocmp_chars)
(composition_compute_stop_pos, composition_reseat_it)
(composition_update_it, struct position_record)
(find_automatic_composition, composition_adjust_point)
(Fcomposition_get_gstring, Ffind_composition_internal):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(update_compositions):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* composite.h: Adjust decls to match defn changes elsewhere.
(struct composition):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
* data.c (let_shadows_buffer_binding_p, let_shadows_global_binding_p):
Do not attempt to compute the address of the object just before a
buffer; this is not portable.
(Faref, Faset):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Faset): Use int, not EMACS_INT, where int is wide enough.
(Fstring_to_number): Don't assume fixnums fit in int.
(Frem): Don't assume arg is nonnegative.
* dbusbind.c (xd_append_arg): Check for integers out of range.
(Fdbus_call_method): Don't overflow the timeout int.
* dired.c (directory_files_internal, file_name_completion, scmp)
(file_name_completion_stat):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(file_name_completion): Don't overflow matchcount.
(file_name_completion_stat): Use SAFE_ALLOCA, not alloca.
* dispextern.h: Adjust decls to match defn changes elsewhere.
(struct text_pos, struct glyph, struct bidi_saved_info)
(struct bidi_string_data, struct bidi_it, struct composition_it)
(struct it):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(struct display_pos, struct composition_it, struct it):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* dispnew.c (increment_matrix_positions)
(increment_row_positions, mode_line_string)
(marginal_area_string):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(change_frame_size_1, Fredisplay):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(duration_to_sec_usec): New function, to check for overflow better.
(Fsleep_for, sit_for): Use it.
* doc.c (get_doc_string, store_function_docstring):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(get_doc_string, Fsnarf_documentation):
Use int, not EMACS_INT, where int is wide enough.
(get_doc_string):
Use SAFE_ALLOCA, not alloca.
Check for overflow when converting EMACS_INT to off_t.
* doprnt.c (doprnt):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
* editfns.c (init_editfns, Fuser_uid, Fuser_real_uid):
Don't assume uid_t fits into fixnum.
(buildmark, Fgoto_char, overlays_around, find_field, Fdelete_field)
(Ffield_string, Ffield_string_no_properties, Ffield_beginning)
(Ffield_end, Fconstrain_to_field, Fline_beginning_position)
(Fline_end_position, Fprevious_char, Fchar_after, Fchar_before)
(general_insert_function)
(Finsert_char, make_buffer_string, make_buffer_string_both)
(update_buffer_properties, Fbuffer_substring)
(Fbuffer_substring_no_properties, Fcompare_buffer_substrings)
(Fsubst_char_in_region, check_translation)
(Ftranslate_region_internal, save_restriction_restore, Fformat)
(transpose_markers, Ftranspose_regions):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(clip_to_bounds): Move to lisp.h as an inline function).
(Fconstrain_to_field): Don't assume integers are nonnegative.
(Fline_beginning_position, Fsave_excursion, Fsave_current_buffer):
(Fsubst_char_in_region, Fsave_restriction):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(Femacs_pid): Don't assume pid_t fits into fixnum.
(lo_time): Use int, not EMACS_INT, when int suffices.
(lisp_time_argument): Check for usec out of range.
(Fencode_time): Don't assume fixnum fits in int.
* emacs.c (gdb_valbits, gdb_gctypebits): Now int, not EMACS_INT.
(gdb_data_seg_bits): Now uintptr_t, not EMACS_INT.
(PVEC_FLAG, gdb_array_mark_flag): Now ptrdiff_t, not EMACS_INT.
(init_cmdargs, Fdump_emacs):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(Fkill_emacs): Don't assume fixnum fits in int; instead, take just
the bottom (typically) 32 bits of the fixnum.
* eval.c (specpdl_size, call_debugger):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(when_entered_debugger, Fbacktrace_debug):
Don't assume fixnum can fit in int.
(Fdefvaralias, Fdefvar): Do not attempt to compute the address of
the object just before a buffer; this is not portable.
(FletX, Flet, Funwind_protect, do_autoload, Feval, funcall_lambda)
(grow_specpdl, unbind_to):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(Fapply, apply_lambda): Don't assume ptrdiff_t can hold fixnum.
(grow_specpdl): Simplify allocation by using xpalloc.
* fileio.c (Ffind_file_name_handler, Fcopy_file, Frename_file)
(Finsert_file_contents, Fwrite_region, Fdo_auto_save):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(Ffind_file_name_handler, non_regular_inserted, Finsert_file_contents)
(a_write, e_write):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Fcopy_file, non_regular_nbytes, read_non_regular)
(Finsert_file_contents):
Use int, not EMACS_INT, where int is wide enough.
(READ_BUF_SIZE): Verify that it fits in int.
(Finsert_file_contents): Check that counts are in proper range,
rather than assuming fixnums fit into ptrdiff_t etc.
Don't assume fixnums fit into int.
(Fdo_auto_save, Fset_buffer_auto_saved)
(Fclear_buffer_auto_save_failure):
Don't assume time_t is signed, or that it fits in int.
* fns.c (Fcompare_strings, Fstring_lessp, struct textprop_rec)
(concat, string_char_byte_cache_charpos, string_char_byte_cache_bytepos)
(string_char_to_byte, string_byte_to_char)
(string_make_multibyte, string_to_multibyte)
(string_make_unibyte, Fstring_as_unibyte, Fstring_as_multibyte)
(Fstring_to_unibyte, Fsubstring, Fsubstring_no_properties)
(substring_both, Fdelete, internal_equal, Ffillarray)
(Fclear_string, mapcar1)
(Fbase64_encode_region, Fbase64_encode_string, base64_encode_1)
(Fbase64_decode_region, Fbase64_decode_string, base64_decode_1)
(larger_vector, make_hash_table, maybe_resize_hash_table)
(hash_lookup, hash_remove_from_table, hash_clear, sweep_weak_table)
(Fmaphash, secure_hash):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(concat): Check for string index and length overflow.
(Fmapconcat): Don't assume fixnums fit into ptrdiff_t.
(Frequire):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(larger_vector): New API (vec, incr_min, size_max) replaces old
one (vec, new_size, init).  This catches size overflow.
INIT was removed because it was always Qnil.
All callers changed.
(INDEX_SIZE_BOUND): New macro, which calculates more precisely
the upper bound on a hash table index size.
(make_hash_table, maybe_resize_hash_table): Use it.
(secure_hash): Computer start_byte and end_byte only after
they're known to be in ptrdiff_t range.
* font.c (font_intern_prop, font_at, font_range, Ffont_shape_gstring)
(Ffont_get_glyphs, Ffont_at):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(font_style_to_value, font_prop_validate_style, font_expand_wildcards)
(Flist_fonts, Fopen_font):
Don't assume fixnum can fit in int.
(check_gstring): Don't assume index can fit in int.
(font_match_p): Check that fixnum is a character, not a nonnegative
fixnum, since the later code needs to stuff it into an int.
(font_find_for_lface): Use SAFE_ALLOCA_LISP, not alloca.
(font_fill_lglyph_metrics): Use unsigned, not EMACS_INT, to avoid
conversion overflow issues.
(Fopen_font): Check for integer out of  range.
(Ffont_get_glyphs): Don't assume index can fit in int.
* font.h: Adjust decls to match defn changes elsewhere.
* fontset.c (reorder_font_vector): Redo score calculation to avoid
integer overflow.
(num_auto_fontsets, fontset_from_font): Use ptrdiff_t, not
printmax_t, where ptrdiff_t is wide enough.
(Finternal_char_font):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
* frame.c (Fset_mouse_position, Fset_mouse_pixel_position)
(Fset_frame_height, Fset_frame_width, Fset_frame_size)
(Fset_frame_position, x_set_frame_parameters)
(x_set_line_spacing, x_set_border_width)
(x_set_internal_border_width, x_set_alpha, x_figure_window_size):
Check that fixnums are in proper range for system types.
(frame_name_fnn_p, Fframe_parameter, Fmodify_frame_parameters):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Fmodify_frame_parameters): Don't assume fixnum fits in int.
Use SAFE_ALLOCA_LISP, not alloca.
* frame.h (struct frame): Use intptr_t, not EMACS_INT, where
intptr_t is wide enough.
* fringe.c (lookup_fringe_bitmap, get_logical_fringe_bitmap)
(Fdefine_fringe_bitmap): Don't assume fixnum fits in int.
(Ffringe_bitmaps_at_pos): Don't assume index fits in int.
Check for fixnum out of range.
* ftfont.c (ftfont_list): Don't assume index fits in int.
Check that fixnums are in proper range for system types.
(ftfont_shape_by_flt):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
Remove no-longer-needed lint_assume.
* gnutls.c (emacs_gnutls_write, emacs_gnutls_read):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Fgnutls_error_fatalp, Fgnutls_error_string, Fgnutls_boot):
Check that fixnums are in proper range for system types.
* gnutls.h: Adjust decls to match defn changes elsewhere.
* gtkutil.c (xg_dialog_run):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(update_frame_tool_bar):
Check that fixnums are in proper range for system types.
* image.c (parse_image_spec): Redo count calculation to avoid overflow.
(lookup_image): Check that fixnums are in proper range for system types.
* indent.c (last_known_column, last_known_column_point):
(current_column_bol_cache):
(skip_invisible, current_column, check_display_width):
(check_display_width, scan_for_column, current_column_1)
(Findent_to, Fcurrent_indentation, position_indentation)
(indented_beyond_p, Fmove_to_column, compute_motion):
(Fcompute_motion, Fvertical_motion):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(last_known_column_modified): Use EMACS_INT, not int.
(check_display_width):
(Fcompute_motion):
Check that fixnums and floats are in proper range for system types.
(compute_motion): Don't assume index or fixnum fits in int.
(compute_motion, Fcompute_motion):
Use int, not EMACS_INT, when it is wide enough.
(vmotion): Omit local var start_hpos that is always 0; that way
we don't need to worry about overflow in expressions involving it.
* indent.h: Adjust decls to match defn changes elsewhere.
(struct position):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
Use int, not EMACS_INT, where int is wide enough.
Remove unused members ovstring_chars_done and tab_offset;
all uses removed.
* insdel.c (move_gap, move_gap_both, gap_left, gap_right)
(adjust_markers_for_delete, adjust_markers_for_insert, adjust_point)
(adjust_markers_for_replace, make_gap_larger, make_gap_smaller)
(make_gap, copy_text, insert, insert_and_inherit)
(insert_before_markers, insert_before_markers_and_inherit)
(insert_1, count_combining_before, count_combining_after)
(insert_1_both, insert_from_string)
(insert_from_string_before_markers, insert_from_string_1)
(insert_from_gap, insert_from_buffer, insert_from_buffer_1)
(adjust_after_replace, adjust_after_insert, replace_range)
(replace_range_2, del_range, del_range_1, del_range_byte)
(del_range_both, del_range_2, modify_region)
(prepare_to_modify_buffer, signal_before_change)
(signal_after_change, Fcombine_after_change_execute):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
* intervals.c (traverse_intervals, rotate_right, rotate_left)
(balance_an_interval, split_interval_right, split_interval_left)
(find_interval, next_interval, update_interval)
(adjust_intervals_for_insertion, delete_node, delete_interval)
(interval_deletion_adjustment, adjust_intervals_for_deletion)
(static_offset_intervals, offset_intervals)
(merge_interval_right, merge_interval_left, make_new_interval)
(graft_intervals_into_buffer, temp_set_point_both)
(temp_set_point, set_point, adjust_for_invis_intang)
(set_point_both, move_if_not_intangible, get_property_and_range)
(get_local_map, copy_intervals, copy_intervals_to_string)
(compare_string_intervals, set_intervals_multibyte_1):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
* intervals.h: Adjust decls to match defn changes elsewhere.
(struct interval):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
* keyboard.c (this_command_key_count, this_single_command_key_start)
(before_command_key_count, before_command_echo_length, echo_now)
(echo_length, recursive_edit_1, Frecursive_edit, Ftrack_mouse)
(command_loop_1, safe_run_hooks, read_char, timer_check_2)
(menu_item_eval_property, read_key_sequence, Fread_key_sequence)
(Fread_key_sequence_vector, Fexecute_extended_command, Fsuspend_emacs):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(last_non_minibuf_size, last_point_position, echo_truncate)
(command_loop_1, adjust_point_for_property, read_char, gen_help_event)
(make_lispy_position, make_lispy_event, parse_modifiers_uncached)
(parse_modifiers, modify_event_symbol, Fexecute_extended_command)
(stuff_buffered_input):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(last_auto_save, command_loop_1, read_char):
Use EMACS_INT, not int, to avoid integer overflow.
(record_char): Avoid overflow in total_keys computation.
(parse_modifiers_uncached): Redo index calculation to avoid overflow.
* keyboard.h: Adjust decls to match defn changes elsewhere.
* keymap.c (Fdefine_key, Fcurrent_active_maps, accessible_keymaps_1)
(Fkey_description, Fdescribe_vector, Flookup_key):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(click_position): New function, to check that positions are in range.
(Fcurrent_active_maps):
(describe_command):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Faccessible_keymaps, Fkey_description):
(preferred_sequence_p):
Don't assume fixnum can fit into int.
(Fkey_description): Use SAFE_ALLOCA_LISP, not alloca.
Check for integer overflow in size calculations.
(Ftext_char_description): Use CHECK_CHARACTER, not CHECK_NUMBER, to
avoid mishandling large integers.
* lisp.h: Adjust decls to match defn changes elsewhere.
(ARRAY_MARK_FLAG, PSEUDOVECTOR_FLAG, struct Lisp_String)
(struct vectorlike_header, struct Lisp_Subr, struct Lisp_Hash_Table)
(struct Lisp_Marker):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(clip_to_bounds): Now an inline function, moved here from editfns.c.
(XSETSUBR): Use size of 0 since the actual size doesn't matter,
and using 0 avoids overflow.
(GLYPH_CODE_P): Check for overflow in system types, subsuming the
need for GLYPH_CODE_CHAR_VALID_P and doing proper checking ourselves.
All callers changed.
(GLYPH_CODE_CHAR, GLYPH_CODE_FACE):
Assume the arg has valid form, since it always does.
(TYPE_RANGED_INTEGERP): Avoid bug when checking against a wide
unsigned integer system type.
(CHECK_RANGED_INTEGER, CHECK_TYPE_RANGED_INTEGER): New macros.
(struct catchtag, specpdl_size, SPECPDL_INDEX, USE_SAFE_ALLOCA):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(struct catchtag): Use EMACS_INT, not int, since it may be a fixnum.
(duration_to_sec_usec): New decl.
* lread.c (read_from_string_index, read_from_string_index_byte)
(read_from_string_limit, readchar, unreadchar, openp)
(read_internal_start, read1, oblookup):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Fload, readevalloop, Feval_buffer, Feval_region):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(openp): Check for out-of-range argument to 'access'.
(read1): Use int, not EMACS_INT, where int is wide enough.
Don't assume fixnum fits into int.
* macros.c (Fstart_kbd_macro): Use xpalloc to check for overflow
in size calculation.
(Fexecute_kbd_macro):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* marker.c (cached_charpos, cached_bytepos, CONSIDER)
(byte_char_debug_check, buf_charpos_to_bytepos, verify_bytepos)
(buf_bytepos_to_charpos, Fset_marker, set_marker_restricted)
(set_marker_both, set_marker_restricted_both, marker_position)
(marker_byte_position, Fbuffer_has_markers_at):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Fset_marker, set_marker_restricted): Don't assume fixnum fits in int.
* menu.c (ensure_menu_items): Renamed from grow_menu_items.
It now merely ensures that the menu is large enough, without
necessarily growing it, as this avoids some integer overflow issues.
All callers changed.
(keymap_panes, parse_single_submenu, Fx_popup_menu):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(parse_single_submenu, Fx_popup_menu): Don't assume fixnum fits in int.
Use SAFE_ALLOCA_LISP, not alloca.
(find_and_return_menu_selection): Avoid unnecessary casts of pointers
to EMACS_INT.  Check that fixnums are in proper range for system types.
* minibuf.c (minibuf_prompt_width, string_to_object)
(Fminibuffer_contents, Fminibuffer_contents_no_properties)
(Fminibuffer_completion_contents, Ftry_completion, Fall_completions):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(get_minibuffer, read_minibuf_unwind):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(read_minibuf): Omit unnecessary arg BACKUP_N, which is always nil;
this simplifies overflow checking.  All callers changed.
(read_minibuf, Fread_buffer, Ftry_completion, Fall_completions)
(Ftest_completion):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* nsfns.m (check_ns_display_info): Don't assume fixnum fits in long.
(x_set_menu_bar_lines, x_set_tool_bar_lines, Fx_create_frame):
Check that fixnums are in proper range for system types.
(Fx_create_frame, Fx_show_tip):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* nsfont.m (ns_findfonts, nsfont_list_family):
Don't assume fixnum fits in long.
* nsmenu.m (ns_update_menubar, ns_menu_show, ns_popup_dialog):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(ns_update_menubar): Use intptr_t, not EMACS_INT, when intptr_t is
wide enough.
* nsselect.m (ns_get_local_selection):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* print.c (print_buffer_size, print_buffer_pos, print_buffer_pos_byte)
(PRINTDECLARE, PRINTPREPARE):
(strout, print_string):
(print, print_preprocess, print_check_string_charset_prop)
(print_object):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(PRINTDECLARE):
(temp_output_buffer_setup, Fprin1_to_string, print_object):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(PRINTPREPARE): Use int, not ptrdiff_t, where int is wide enough.
(PRINTFINISH): Use SAFE_ALLOCA, not alloca.
(printchar, strout): Use xpalloc to catch size calculation overflow.
(Fexternal_debugging_output): Use CHECK_CHARACTER, not CHECK_NUMBER,
to avoid mishandling large integers.
(print_error_message): Use SAFE_ALLOCA, not alloca.
(print_object): Use int, not EMACS_INT, where int is wide enough.
* process.c (Fdelete_process): Don't assume pid fits into EMACS_INT.
(Fset_process_window_size, Fformat_network_address)
(get_lisp_to_sockaddr_size, set_socket_option, Fmake_network_process)
(Fsignal_process, sigchld_handler):
Check that fixnums are in proper range for system types.
(Fformat_network_address, read_process_output, send_process)
(Fprocess_send_region, status_notify):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Fformat_network_address, Fmake_serial_process, Fmake_network_process)
(wait_reading_process_output, read_process_output, exec_sentinel):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(conv_lisp_to_sockaddr): Don't assume fixnums fit into int.
(Faccept_process_output): Use duration_to_sec_usec to do proper
overflow checking on durations.
* scroll.c (calculate_scrolling, calculate_direct_scrolling)
(line_ins_del): Use int, not EMACS_INT, where int is wide enough.
* search.c (looking_at_1, string_match_1):
(fast_string_match, fast_c_string_match_ignore_case)
(fast_string_match_ignore_case, fast_looking_at, scan_buffer)
(scan_newline, find_before_next_newline, search_command)
(trivial_regexp_p, search_buffer, simple_search, boyer_moore)
(set_search_regs, wordify):
(Freplace_match):
(Fmatch_data):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(string_match_1, search_buffer, set_search_regs):
(Fmatch_data):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(wordify): Check for overflow in size calculation.
(Freplace_match): Avoid potential buffer overflow in search_regs.start.
(Fset_match_data): Don't assume fixnum fits in ptrdiff_t.
Check that fixnums are in proper range for system types.
* sound.c (struct sound_device)
(wav_play, au_play, vox_write, alsa_period_size, alsa_write):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Fplay_sound_internal):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* syntax.c (ST_COMMENT_STYLE, ST_STRING_STYLE):
In definitions, make it clearer that these values must be out of range
for the respective integer ranges.  This fixes a bug with ST_STRING_STYLE
and non-ASCII characters.
(struct lisp_parse_state, find_start_modiff)
(Finternal_describe_syntax_value, scan_lists, scan_sexps_forward):
(Fparse_partial_sexp):
Don't assume fixnums can fit in int.
(struct lisp_parse_state, find_start_pos, find_start_value)
(find_start_value_byte, find_start_begv)
(update_syntax_table, char_quoted, dec_bytepos)
(find_defun_start, prev_char_comend_first, back_comment):
(scan_words, skip_chars, skip_syntaxes, forw_comment, Fforward_comment)
(scan_lists, Fbackward_prefix_chars, scan_sexps_forward):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Finternal_describe_syntax_value): Check that match_lisp is a
character, not an integer, since the code stuffs it into int.
(scan_words, scan_sexps_forward):
Check that fixnums are in proper range for system types.
(Fforward_word):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(scan_sexps_forward):
Use CHARACTERP, not INTEGERP, since the value must fit into int.
(Fparse_partial_sexp): Fix doc; element 8 is not ignored.
* syntax.h: Adjust decls to match defn changes elsewhere.
(struct gl_state_s):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
* sysdep.c (wait_for_termination_1, wait_for_termination)
(interruptible_wait_for_termination, mkdir):
Don't assume pid_t fits in int; on 64-bit AIX pid_t is 64-bit.
(emacs_read, emacs_write):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(system_process_attributes): Don't assume uid_t, gid_t, and
double all fit in int or even EMACS_INT.
* term.c (set_tty_color_mode):
Check that fixnums are in proper range for system types.
* termhooks.h (struct input_event):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
* textprop.c (validate_interval_range, interval_of)
(Fadd_text_properties, set_text_properties_1)
(Fremove_text_properties, Fremove_list_of_text_properties)
(Ftext_property_any, Ftext_property_not_all)
(copy_text_properties, text_property_list, extend_property_ranges)
(verify_interval_modification):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Fnext_single_char_property_change)
(Fprevious_single_char_property_change):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(copy_text_properties): Check for integer overflow in index calculation.
* undo.c (last_boundary_position, record_point, record_insert)
(record_delete, record_marker_adjustment, record_change)
(record_property_change):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(truncate_undo_list, Fprimitive_undo): Don't assume fixnum fits in int.
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* w32fns.c (Fx_create_frame, x_create_tip_frame, Fx_show_tip)
(Fx_hide_tip, Fx_file_dialog):
* w32menu.c (set_frame_menubar):
Use ptrdiff_t, not int, for consistency with rest of code.
* window.c (window_scroll_preserve_hpos, window_scroll_preserve_vpos)
(select_window, Fdelete_other_windows_internal)
(window_scroll_pixel_based, window_scroll_line_based)
(Frecenter, Fset_window_configuration):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(Fset_window_hscroll, run_window_configuration_change_hook)
(set_window_buffer, temp_output_buffer_show, scroll_command)
(Fscroll_other_window):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(Fwindow_line_height, window_scroll, Fscroll_left, Fscroll_right):
Don't assume fixnum fits in int.
(Fset_window_scroll_bars):
Check that fixnums are in proper range for system types.
* xdisp.c (help_echo_pos, pos_visible_p, string_pos_nchars_ahead)
(string_pos, c_string_pos, number_of_chars, init_iterator)
(in_ellipses_for_invisible_text_p, init_from_display_pos)
(compute_stop_pos, next_overlay_change, compute_display_string_pos)
(compute_display_string_end, handle_face_prop)
(face_before_or_after_it_pos, handle_invisible_prop, handle_display_prop)
(handle_display_spec, handle_single_display_spec)
(display_prop_intangible_p, string_buffer_position_lim)
(string_buffer_position, handle_composition_prop, load_overlay_strings)
(get_overlay_strings_1, get_overlay_strings)
(iterate_out_of_display_property, forward_to_next_line_start)
(back_to_previous_visible_line_start, reseat, reseat_to_string)
(get_next_display_element, set_iterator_to_next)
(get_visually_first_element, compute_stop_pos_backwards)
(handle_stop_backwards, next_element_from_buffer)
(move_it_in_display_line_to, move_it_in_display_line)
(move_it_to, move_it_vertically_backward, move_it_by_lines)
(add_to_log, message_dolog, message_log_check_duplicate)
(message2, message2_nolog, message3, message3_nolog
(with_echo_area_buffer, display_echo_area_1, resize_mini_window_1)
(current_message_1, truncate_echo_area, truncate_message_1)
(set_message, set_message_1, store_mode_line_noprop)
(hscroll_window_tree, debug_delta, debug_delta_bytes, debug_end_vpos)
(text_outside_line_unchanged_p, check_point_in_composition)
(reconsider_clip_changes)
(redisplay_internal, set_cursor_from_row, try_scrolling)
(try_cursor_movement, set_vertical_scroll_bar, redisplay_window)
(redisplay_window, find_last_unchanged_at_beg_row)
(find_first_unchanged_at_end_row, row_containing_pos, try_window_id)
(trailing_whitespace_p, find_row_edges, display_line)
(RECORD_MAX_MIN_POS, Fcurrent_bidi_paragraph_direction)
(display_mode_element, store_mode_line_string)
(pint2str, pint2hrstr, decode_mode_spec)
(display_count_lines, display_string, draw_glyphs)
(x_produce_glyphs, x_insert_glyphs)
(rows_from_pos_range, mouse_face_from_buffer_pos)
(fast_find_string_pos, mouse_face_from_string_pos)
(note_mode_line_or_margin_highlight, note_mouse_highlight):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(safe_call, init_from_display_pos, handle_fontified_prop)
(handle_single_display_spec, load_overlay_strings)
(with_echo_area_buffer, setup_echo_area_for_printing)
(display_echo_area, echo_area_display)
(x_consider_frame_title, prepare_menu_bars, update_menu_bar)
(update_tool_bar, hscroll_window_tree, redisplay_internal)
(redisplay_window, dump_glyph_row, display_mode_line, Fformat_mode_line)
(decode_mode_spec, on_hot_spot_p):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(handle_single_display_spec, build_desired_tool_bar_string)
(redisplay_tool_bar, scroll_window_tree, Fdump_glyph_matrix)
(get_specified_cursor_type):
Check that fixnums are in proper range for system types.
(struct overlay_entry, resize_mini_window, Fdump_glyph_row)
(Flookup_image_map):
Don't assume fixnums fit in int.
(compare_overlay_entries):
Avoid mishandling comparisons due to subtraction overflow.
(load_overlay_strings): Use SAFE_NALLOCA, not alloca.
(last_escape_glyph_face_id, last_glyphless_glyph_face_id):
(handle_tool_bar_click):
Use int, not unsigned, since we prefer signed and the signedness
doesn't matter here.
(get_next_display_element, next_element_from_display_vector):
Use int, not EMACS_INT, when int is wide enough.
(start_hourglass): Use duration_to_sec_usec to do proper
overflow checking on durations.
* xfaces.c (Fbitmap_spec_p):
Check that fixnums are in proper range for system types.
(compare_fonts_by_sort_order):
Avoid mishandling comparisons due to subtraction overflow.
(Fx_family_fonts, realize_basic_faces):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(Fx_family_fonts):
Don't assume fixnum fits in int.
Use SAFE_ALLOCA_LISP, not alloca.
(merge_face_heights): Remove unnecessary cast to EMACS_INT.
(Finternal_make_lisp_face): Don't allocate more than MAX_FACE_ID.
(face_at_buffer_position, face_for_overlay_string)
(face_at_string_position):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
(merge_faces): Use int, not EMACS_INT, where int is wide enough.
* xfns.c (x_set_menu_bar_lines, x_set_tool_bar_lines, x_icon_verify)
(Fx_show_tip):
Check that fixnums are in proper range for system types.
(Fx_create_frame, x_create_tip_frame, Fx_show_tip)
(Fx_hide_tip, Fx_file_dialog, Fx_select_font):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(Fx_change_window_property): Don't assume fixnums fit in int.
* xfont.c (xfont_chars_supported):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* xmenu.c (Fx_popup_dialog, set_frame_menubar)
(create_and_show_popup_menu, create_and_show_dialog, xmenu_show):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* xml.c (parse_region):
* xrdb.c (magic_file_p):
Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
* xselect.c (TRACE1): Don't assume pid_t promotes to int.
(x_get_local_selection, x_reply_selection_request)
(x_handle_selection_request, wait_for_property_change):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
(selection_data_to_lisp_data): Use short, not EMACS_INT, where
short is wide enough.
(x_send_client_event): Don't assume fixnum fits in int.
* xterm.c (x_x_to_emacs_modifiers):
Don't assume EMACS_INT overflows nicely into int.
(x_emacs_to_x_modifiers): Use EMACS_INT, not int, because values
may come from Lisp.
(handle_one_xevent): NATNUMP can eval its arg twice.
(x_connection_closed):
Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
* xterm.h: Adjust decls to match defn changes elsewhere.
(struct scroll_bar): Use struct vectorlike_header
rather than rolling our own approximation.
(SCROLL_BAR_VEC_SIZE): Remove; not used.

89 files changed, 3814 insertions, 3000 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 0ea45aed1a3..1f8fd4f6b50 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,749 @@
+2011-09-21  Paul Eggert  <eggert@cs.ucla.edu>
+
+	* alloc.c (pure_bytes_used_lisp, pure_bytes_used_non_lisp):
+	(allocate_vectorlike, buffer_memory_full, struct sdata, SDATA_SIZE)
+	(string_bytes, check_sblock, allocate_string_data):
+	(compact_small_strings, Fmake_bool_vector, make_string)
+	(make_unibyte_string, make_multibyte_string)
+	(make_string_from_bytes, make_specified_string)
+	(allocate_vectorlike, Fmake_vector, find_string_data_in_pure)
+	(make_pure_string, make_pure_c_string, make_pure_vector, Fpurecopy)
+	(mark_vectorlike):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(allocate_pseudovector):
+	Use int, not EMACS_INT, where int is wide enough.
+	(inhibit_garbage_collection, Fgarbage_collect):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* bidi.c (bidi_mirror_char): Use EMACS_INT, not int, where
+	int might not be wide enough.
+	(bidi_cache_search, bidi_cache_find, bidi_init_it)
+	(bidi_count_bytes, bidi_char_at_pos, bidi_fetch_char)
+	(bidi_at_paragraph_end, bidi_find_paragraph_start)
+	(bidi_paragraph_init, bidi_resolve_explicit, bidi_resolve_weak)
+	(bidi_level_of_next_char, bidi_move_to_visually_next):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	* buffer.c (copy_overlays, Fgenerate_new_buffer_name)
+	(Fkill_buffer, Fset_buffer_major_mode)
+	(advance_to_char_boundary, Fbuffer_swap_text)
+	(Fset_buffer_multibyte, overlays_at, overlays_in)
+	(overlay_touches_p, struct sortvec, record_overlay_string)
+	(overlay_strings, recenter_overlay_lists)
+	(adjust_overlays_for_insert, adjust_overlays_for_delete)
+	(fix_start_end_in_overlays, fix_overlays_before, modify_overlay)
+	(Fmove_overlay, Fnext_overlay_change, Fprevious_overlay_change)
+	(Foverlay_recenter, last_overlay_modification_hooks_used)
+	(report_overlay_modification, evaporate_overlays, enlarge_buffer_text):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(validate_region): Omit unnecessary test for b <= e, since
+	that's guaranteed by the previous test.
+	(adjust_overlays_for_delete): Avoid pos + length overflow.
+	(Fmove_overlay, Fdelete_overlay, add_overlay_mod_hooklist)
+	(report_overlay_modification):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(Foverlays_at, Fnext_overlay_change, Fprevious_overlay_change):
+	Omit pointer cast, which isn't needed anyway, and doesn't work
+	after the EMACS_INT -> ptrdiff_t change.
+	* buffer.h: Adjust decls to match defn changes elsewhere.
+	(struct buffer_text, struct buffer):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	Use EMACS_INT, not int, where int might not be wide enough.
+	* bytecode.c (exec_byte_code): Use ptrdiff_t, not int, to avoid
+	needless 32-bit limit on 64-bit hosts.  Remove unnecessary
+	memory-full test.  Use EMACS_INT, not ptrdiff_t or int, where
+	ptrdiff_t or int might not be wide enough.
+	* callint.c (Fcall_interactively):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* callproc.c (call_process_kill, Fcall_process):
+	Don't assume pid_t fits into an Emacs fixnum.
+	(call_process_cleanup, Fcall_process, child_setup):
+	Don't assume pid_t fits into int.
+	(call_process_cleanup, Fcall_process, delete_temp_file)
+	(Fcall_process_region):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(Fcall_process): Simplify handling of volatile integers.
+	Use int, not EMACS_INT, where int will do.
+	* casefiddle.c (casify_object, casify_region, operate_on_word)
+	(Fupcase_word, Fdowncase_word, Fcapitalize_word):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(casify_object): Avoid integer overflow when overallocating buffer.
+	* casetab.c (set_identity, shuffle): Prefer int to unsigned when
+	either works.
+	* category.c (Fchar_category_set): Don't assume fixnum fits in int.
+	* category.h (CATEGORYP): Don't assume arg is nonnegative.
+	* ccl.c (GET_CCL_INT): Remove; no longer needed, since the
+	integers are now checked earlier.  All uses replaced with XINT.
+	(ccl_driver):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	For CCL_MapSingle, check that content and value are in int range.
+	(resolve_symbol_ccl_program): Check that vector header is in range.
+	Always copy the vector, so that we can check its contents reliably
+	now rather than having to recheck each instruction as it's being
+	executed.  Check that vector words fit in 'int'.
+	(ccl_get_compiled_code, Fregister_ccl_program)
+	(Fregister_code_conversion_map): Use ptrdiff_t, not int, for
+	program indexes, to avoid needless 32-bit limit on 64-bit hosts.
+	(Fccl_execute, Fccl_execute_on_string): Check that initial reg
+	contents are in range.
+	(Fccl_execute_on_string): Check that status is in range.
+	* ccl.h (struct ccl_program.idx): Now ptrdiff_t, not int.
+	* character.c (char_resolve_modifier_mask, Fchar_resolve_modifiers):
+	Accept and return EMACS_INT, not int, because callers can pass values
+	out of 'int' range.
+	(c_string_width, strwidth, lisp_string_width, chars_in_text)
+	(multibyte_chars_in_text, parse_str_as_multibyte)
+	(str_as_multibyte, count_size_as_multibyte, str_to_multibyte)
+	(str_as_unibyte, str_to_unibyte, string_count_byte8)
+	(string_escape_byte8, Fget_byte):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Funibyte_string): Use CHECK_CHARACTER, not CHECK_NATNUM, to
+	avoid mishandling large integers.
+	* character.h: Adjust decls to match defn changes elsewhere.
+	* charset.c (load_charset_map_from_file, find_charsets_in_text)
+	(Ffind_charset_region):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(load_charset_map_from_file): Redo idx calculation to avoid overflow.
+	(load_charset_map_from_vector, Fdefine_charset_internal):
+	Don't assume fixnum fits in int or unsigned int.
+	(load_charset_map_from_vector, Fmap_charset_chars):
+	Remove now-unnecessary CHECK_NATNUMs.
+	(Fdefine_charset_internal): Check ranges here, more carefully.
+	* chartab.c (Fmake_char_table, Fset_char_table_range)
+	(uniprop_get_decoder, uniprop_get_encoder):
+	Don't assume fixnum fits in int.
+	* cmds.c (move_point): New function, that does the gist of
+	Fforward_char and Fbackward_char, but does so while checking
+	for integer overflow more accurately.
+	(Fforward_char, Fbackward_char, internal_self_insert): Use it.
+	(Fforward_line, Fend_of_line, internal_self_insert)
+	(internal_self_insert):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	Fix a FIXME, by checking for integer overflow when calculating
+	target_clm and actual_clm.
+	* coding.c (detect_coding_XXX, encode_coding_XXX, CODING_DECODE_CHAR)
+	(ASSURE_DESTINATION, coding_alloc_by_realloc)
+	(coding_alloc_by_making_gap, alloc_destination)
+	(detect_coding_utf_8, encode_coding_utf_8, decode_coding_utf_16)
+	(encode_coding_utf_16, detect_coding_emacs_mule)
+	(decode_coding_emacs_mule, encode_coding_emacs_mule)
+	(detect_coding_iso_2022, decode_coding_iso_2022)
+	(encode_invocation_designation, encode_designation_at_bol)
+	(encode_coding_iso_2022, detect_coding_sjis, detect_coding_big5)
+	(decode_coding_sjis, decode_coding_big5, encode_coding_sjis)
+	(encode_coding_big5, detect_coding_ccl, decode_coding_ccl)
+	(encode_coding_ccl, encode_coding_raw_text)
+	(detect_coding_charset, decode_coding_charset)
+	(encode_coding_charset, detect_eol, decode_eol, produce_chars)
+	(produce_composition, produce_charset, produce_annotation)
+	(decode_coding, handle_composition_annotation)
+	(handle_charset_annotation, consume_chars, decode_coding_gap)
+	(decode_coding_object, encode_coding_object, detect_coding_system)
+	(Ffind_coding_systems_region_internal, Fcheck_coding_systems_region)
+	(code_convert_region, code_convert_string)
+	(Fdefine_coding_system_internal):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(setup_iso_safe_charsets, consume_chars, Funencodable_char_position)
+	(Fdefine_coding_system_internal):
+	Don't assume fixnums fit in int.
+	(decode_coding_gap, decode_coding_object, encode_coding_object)
+	(Fread_coding_system, Fdetect_coding_region, Funencodable_char_position)
+	(Fcheck_coding_systems_region):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(Ffind_operation_coding_system): NATNUMP can eval its arg twice.
+	(Fdefine_coding_system_internal): Check for charset-id overflow.
+	* coding.h: Adjust decls to match defn changes elsewhere.
+	(struct coding_system):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	* composite.c (get_composition_id, find_composition)
+	(run_composition_function, update_compositions)
+	(compose_text, composition_gstring_put_cache)
+	(composition_gstring_p, composition_gstring_width)
+	(fill_gstring_header, fill_gstring_body, autocmp_chars)
+	(composition_compute_stop_pos, composition_reseat_it)
+	(composition_update_it, struct position_record)
+	(find_automatic_composition, composition_adjust_point)
+	(Fcomposition_get_gstring, Ffind_composition_internal):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(update_compositions):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* composite.h: Adjust decls to match defn changes elsewhere.
+	(struct composition):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	* data.c (let_shadows_buffer_binding_p, let_shadows_global_binding_p):
+	Do not attempt to compute the address of the object just before a
+	buffer; this is not portable.
+	(Faref, Faset):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Faset): Use int, not EMACS_INT, where int is wide enough.
+	(Fstring_to_number): Don't assume fixnums fit in int.
+	(Frem): Don't assume arg is nonnegative.
+	* dbusbind.c (xd_append_arg): Check for integers out of range.
+	(Fdbus_call_method): Don't overflow the timeout int.
+	* dired.c (directory_files_internal, file_name_completion, scmp)
+	(file_name_completion_stat):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(file_name_completion): Don't overflow matchcount.
+	(file_name_completion_stat): Use SAFE_ALLOCA, not alloca.
+	* dispextern.h: Adjust decls to match defn changes elsewhere.
+	(struct text_pos, struct glyph, struct bidi_saved_info)
+	(struct bidi_string_data, struct bidi_it, struct composition_it)
+	(struct it):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(struct display_pos, struct composition_it, struct it):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* dispnew.c (increment_matrix_positions)
+	(increment_row_positions, mode_line_string)
+	(marginal_area_string):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(change_frame_size_1, Fredisplay):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(duration_to_sec_usec): New function, to check for overflow better.
+	(Fsleep_for, sit_for): Use it.
+	* doc.c (get_doc_string, store_function_docstring):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(get_doc_string, Fsnarf_documentation):
+	Use int, not EMACS_INT, where int is wide enough.
+	(get_doc_string):
+	Use SAFE_ALLOCA, not alloca.
+	Check for overflow when converting EMACS_INT to off_t.
+	* doprnt.c (doprnt):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	* editfns.c (init_editfns, Fuser_uid, Fuser_real_uid):
+	Don't assume uid_t fits into fixnum.
+	(buildmark, Fgoto_char, overlays_around, find_field, Fdelete_field)
+	(Ffield_string, Ffield_string_no_properties, Ffield_beginning)
+	(Ffield_end, Fconstrain_to_field, Fline_beginning_position)
+	(Fline_end_position, Fprevious_char, Fchar_after, Fchar_before)
+	(general_insert_function)
+	(Finsert_char, make_buffer_string, make_buffer_string_both)
+	(update_buffer_properties, Fbuffer_substring)
+	(Fbuffer_substring_no_properties, Fcompare_buffer_substrings)
+	(Fsubst_char_in_region, check_translation)
+	(Ftranslate_region_internal, save_restriction_restore, Fformat)
+	(transpose_markers, Ftranspose_regions):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(clip_to_bounds): Move to lisp.h as an inline function).
+	(Fconstrain_to_field): Don't assume integers are nonnegative.
+	(Fline_beginning_position, Fsave_excursion, Fsave_current_buffer):
+	(Fsubst_char_in_region, Fsave_restriction):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(Femacs_pid): Don't assume pid_t fits into fixnum.
+	(lo_time): Use int, not EMACS_INT, when int suffices.
+	(lisp_time_argument): Check for usec out of range.
+	(Fencode_time): Don't assume fixnum fits in int.
+	* emacs.c (gdb_valbits, gdb_gctypebits): Now int, not EMACS_INT.
+	(gdb_data_seg_bits): Now uintptr_t, not EMACS_INT.
+	(PVEC_FLAG, gdb_array_mark_flag): Now ptrdiff_t, not EMACS_INT.
+	(init_cmdargs, Fdump_emacs):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(Fkill_emacs): Don't assume fixnum fits in int; instead, take just
+	the bottom (typically) 32 bits of the fixnum.
+	* eval.c (specpdl_size, call_debugger):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(when_entered_debugger, Fbacktrace_debug):
+	Don't assume fixnum can fit in int.
+	(Fdefvaralias, Fdefvar): Do not attempt to compute the address of
+	the object just before a buffer; this is not portable.
+	(FletX, Flet, Funwind_protect, do_autoload, Feval, funcall_lambda)
+	(grow_specpdl, unbind_to):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(Fapply, apply_lambda): Don't assume ptrdiff_t can hold fixnum.
+	(grow_specpdl): Simplify allocation by using xpalloc.
+	* fileio.c (Ffind_file_name_handler, Fcopy_file, Frename_file)
+	(Finsert_file_contents, Fwrite_region, Fdo_auto_save):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(Ffind_file_name_handler, non_regular_inserted, Finsert_file_contents)
+	(a_write, e_write):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Fcopy_file, non_regular_nbytes, read_non_regular)
+	(Finsert_file_contents):
+	Use int, not EMACS_INT, where int is wide enough.
+	(READ_BUF_SIZE): Verify that it fits in int.
+	(Finsert_file_contents): Check that counts are in proper range,
+	rather than assuming fixnums fit into ptrdiff_t etc.
+	Don't assume fixnums fit into int.
+	(Fdo_auto_save, Fset_buffer_auto_saved)
+	(Fclear_buffer_auto_save_failure):
+	Don't assume time_t is signed, or that it fits in int.
+	* fns.c (Fcompare_strings, Fstring_lessp, struct textprop_rec)
+	(concat, string_char_byte_cache_charpos, string_char_byte_cache_bytepos)
+	(string_char_to_byte, string_byte_to_char)
+	(string_make_multibyte, string_to_multibyte)
+	(string_make_unibyte, Fstring_as_unibyte, Fstring_as_multibyte)
+	(Fstring_to_unibyte, Fsubstring, Fsubstring_no_properties)
+	(substring_both, Fdelete, internal_equal, Ffillarray)
+	(Fclear_string, mapcar1)
+	(Fbase64_encode_region, Fbase64_encode_string, base64_encode_1)
+	(Fbase64_decode_region, Fbase64_decode_string, base64_decode_1)
+	(larger_vector, make_hash_table, maybe_resize_hash_table)
+	(hash_lookup, hash_remove_from_table, hash_clear, sweep_weak_table)
+	(Fmaphash, secure_hash):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(concat): Check for string index and length overflow.
+	(Fmapconcat): Don't assume fixnums fit into ptrdiff_t.
+	(Frequire):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(larger_vector): New API (vec, incr_min, size_max) replaces old
+	one (vec, new_size, init).  This catches size overflow.
+	INIT was removed because it was always Qnil.
+	All callers changed.
+	(INDEX_SIZE_BOUND): New macro, which calculates more precisely
+	the upper bound on a hash table index size.
+	(make_hash_table, maybe_resize_hash_table): Use it.
+	(secure_hash): Computer start_byte and end_byte only after
+	they're known to be in ptrdiff_t range.
+	* font.c (font_intern_prop, font_at, font_range, Ffont_shape_gstring)
+	(Ffont_get_glyphs, Ffont_at):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(font_style_to_value, font_prop_validate_style, font_expand_wildcards)
+	(Flist_fonts, Fopen_font):
+	Don't assume fixnum can fit in int.
+	(check_gstring): Don't assume index can fit in int.
+	(font_match_p): Check that fixnum is a character, not a nonnegative
+	fixnum, since the later code needs to stuff it into an int.
+	(font_find_for_lface): Use SAFE_ALLOCA_LISP, not alloca.
+	(font_fill_lglyph_metrics): Use unsigned, not EMACS_INT, to avoid
+	conversion overflow issues.
+	(Fopen_font): Check for integer out of  range.
+	(Ffont_get_glyphs): Don't assume index can fit in int.
+	* font.h: Adjust decls to match defn changes elsewhere.
+	* fontset.c (reorder_font_vector): Redo score calculation to avoid
+	integer overflow.
+	(num_auto_fontsets, fontset_from_font): Use ptrdiff_t, not
+	printmax_t, where ptrdiff_t is wide enough.
+	(Finternal_char_font):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	* frame.c (Fset_mouse_position, Fset_mouse_pixel_position)
+	(Fset_frame_height, Fset_frame_width, Fset_frame_size)
+	(Fset_frame_position, x_set_frame_parameters)
+	(x_set_line_spacing, x_set_border_width)
+	(x_set_internal_border_width, x_set_alpha, x_figure_window_size):
+	Check that fixnums are in proper range for system types.
+	(frame_name_fnn_p, Fframe_parameter, Fmodify_frame_parameters):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Fmodify_frame_parameters): Don't assume fixnum fits in int.
+	Use SAFE_ALLOCA_LISP, not alloca.
+	* frame.h (struct frame): Use intptr_t, not EMACS_INT, where
+	intptr_t is wide enough.
+	* fringe.c (lookup_fringe_bitmap, get_logical_fringe_bitmap)
+	(Fdefine_fringe_bitmap): Don't assume fixnum fits in int.
+	(Ffringe_bitmaps_at_pos): Don't assume index fits in int.
+	Check for fixnum out of range.
+	* ftfont.c (ftfont_list): Don't assume index fits in int.
+	Check that fixnums are in proper range for system types.
+	(ftfont_shape_by_flt):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	Remove no-longer-needed lint_assume.
+	* gnutls.c (emacs_gnutls_write, emacs_gnutls_read):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Fgnutls_error_fatalp, Fgnutls_error_string, Fgnutls_boot):
+	Check that fixnums are in proper range for system types.
+	* gnutls.h: Adjust decls to match defn changes elsewhere.
+	* gtkutil.c (xg_dialog_run):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(update_frame_tool_bar):
+	Check that fixnums are in proper range for system types.
+	* image.c (parse_image_spec): Redo count calculation to avoid overflow.
+	(lookup_image): Check that fixnums are in proper range for system types.
+	* indent.c (last_known_column, last_known_column_point):
+	(current_column_bol_cache):
+	(skip_invisible, current_column, check_display_width):
+	(check_display_width, scan_for_column, current_column_1)
+	(Findent_to, Fcurrent_indentation, position_indentation)
+	(indented_beyond_p, Fmove_to_column, compute_motion):
+	(Fcompute_motion, Fvertical_motion):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(last_known_column_modified): Use EMACS_INT, not int.
+	(check_display_width):
+	(Fcompute_motion):
+	Check that fixnums and floats are in proper range for system types.
+	(compute_motion): Don't assume index or fixnum fits in int.
+	(compute_motion, Fcompute_motion):
+	Use int, not EMACS_INT, when it is wide enough.
+	(vmotion): Omit local var start_hpos that is always 0; that way
+	we don't need to worry about overflow in expressions involving it.
+	* indent.h: Adjust decls to match defn changes elsewhere.
+	(struct position):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	Use int, not EMACS_INT, where int is wide enough.
+	Remove unused members ovstring_chars_done and tab_offset;
+	all uses removed.
+	* insdel.c (move_gap, move_gap_both, gap_left, gap_right)
+	(adjust_markers_for_delete, adjust_markers_for_insert, adjust_point)
+	(adjust_markers_for_replace, make_gap_larger, make_gap_smaller)
+	(make_gap, copy_text, insert, insert_and_inherit)
+	(insert_before_markers, insert_before_markers_and_inherit)
+	(insert_1, count_combining_before, count_combining_after)
+	(insert_1_both, insert_from_string)
+	(insert_from_string_before_markers, insert_from_string_1)
+	(insert_from_gap, insert_from_buffer, insert_from_buffer_1)
+	(adjust_after_replace, adjust_after_insert, replace_range)
+	(replace_range_2, del_range, del_range_1, del_range_byte)
+	(del_range_both, del_range_2, modify_region)
+	(prepare_to_modify_buffer, signal_before_change)
+	(signal_after_change, Fcombine_after_change_execute):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	* intervals.c (traverse_intervals, rotate_right, rotate_left)
+	(balance_an_interval, split_interval_right, split_interval_left)
+	(find_interval, next_interval, update_interval)
+	(adjust_intervals_for_insertion, delete_node, delete_interval)
+	(interval_deletion_adjustment, adjust_intervals_for_deletion)
+	(static_offset_intervals, offset_intervals)
+	(merge_interval_right, merge_interval_left, make_new_interval)
+	(graft_intervals_into_buffer, temp_set_point_both)
+	(temp_set_point, set_point, adjust_for_invis_intang)
+	(set_point_both, move_if_not_intangible, get_property_and_range)
+	(get_local_map, copy_intervals, copy_intervals_to_string)
+	(compare_string_intervals, set_intervals_multibyte_1):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	* intervals.h: Adjust decls to match defn changes elsewhere.
+	(struct interval):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	* keyboard.c (this_command_key_count, this_single_command_key_start)
+	(before_command_key_count, before_command_echo_length, echo_now)
+	(echo_length, recursive_edit_1, Frecursive_edit, Ftrack_mouse)
+	(command_loop_1, safe_run_hooks, read_char, timer_check_2)
+	(menu_item_eval_property, read_key_sequence, Fread_key_sequence)
+	(Fread_key_sequence_vector, Fexecute_extended_command, Fsuspend_emacs):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(last_non_minibuf_size, last_point_position, echo_truncate)
+	(command_loop_1, adjust_point_for_property, read_char, gen_help_event)
+	(make_lispy_position, make_lispy_event, parse_modifiers_uncached)
+	(parse_modifiers, modify_event_symbol, Fexecute_extended_command)
+	(stuff_buffered_input):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(last_auto_save, command_loop_1, read_char):
+	Use EMACS_INT, not int, to avoid integer overflow.
+	(record_char): Avoid overflow in total_keys computation.
+	(parse_modifiers_uncached): Redo index calculation to avoid overflow.
+	* keyboard.h: Adjust decls to match defn changes elsewhere.
+	* keymap.c (Fdefine_key, Fcurrent_active_maps, accessible_keymaps_1)
+	(Fkey_description, Fdescribe_vector, Flookup_key):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(click_position): New function, to check that positions are in range.
+	(Fcurrent_active_maps):
+	(describe_command):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Faccessible_keymaps, Fkey_description):
+	(preferred_sequence_p):
+	Don't assume fixnum can fit into int.
+	(Fkey_description): Use SAFE_ALLOCA_LISP, not alloca.
+	Check for integer overflow in size calculations.
+	(Ftext_char_description): Use CHECK_CHARACTER, not CHECK_NUMBER, to
+	avoid mishandling large integers.
+	* lisp.h: Adjust decls to match defn changes elsewhere.
+	(ARRAY_MARK_FLAG, PSEUDOVECTOR_FLAG, struct Lisp_String)
+	(struct vectorlike_header, struct Lisp_Subr, struct Lisp_Hash_Table)
+	(struct Lisp_Marker):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(clip_to_bounds): Now an inline function, moved here from editfns.c.
+	(XSETSUBR): Use size of 0 since the actual size doesn't matter,
+	and using 0 avoids overflow.
+	(GLYPH_CODE_P): Check for overflow in system types, subsuming the
+	need for GLYPH_CODE_CHAR_VALID_P and doing proper checking ourselves.
+	All callers changed.
+	(GLYPH_CODE_CHAR, GLYPH_CODE_FACE):
+	Assume the arg has valid form, since it always does.
+	(TYPE_RANGED_INTEGERP): Avoid bug when checking against a wide
+	unsigned integer system type.
+	(CHECK_RANGED_INTEGER, CHECK_TYPE_RANGED_INTEGER): New macros.
+	(struct catchtag, specpdl_size, SPECPDL_INDEX, USE_SAFE_ALLOCA):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(struct catchtag): Use EMACS_INT, not int, since it may be a fixnum.
+	(duration_to_sec_usec): New decl.
+	* lread.c (read_from_string_index, read_from_string_index_byte)
+	(read_from_string_limit, readchar, unreadchar, openp)
+	(read_internal_start, read1, oblookup):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Fload, readevalloop, Feval_buffer, Feval_region):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(openp): Check for out-of-range argument to 'access'.
+	(read1): Use int, not EMACS_INT, where int is wide enough.
+	Don't assume fixnum fits into int.
+	* macros.c (Fstart_kbd_macro): Use xpalloc to check for overflow
+	in size calculation.
+	(Fexecute_kbd_macro):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* marker.c (cached_charpos, cached_bytepos, CONSIDER)
+	(byte_char_debug_check, buf_charpos_to_bytepos, verify_bytepos)
+	(buf_bytepos_to_charpos, Fset_marker, set_marker_restricted)
+	(set_marker_both, set_marker_restricted_both, marker_position)
+	(marker_byte_position, Fbuffer_has_markers_at):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Fset_marker, set_marker_restricted): Don't assume fixnum fits in int.
+	* menu.c (ensure_menu_items): Renamed from grow_menu_items.
+	It now merely ensures that the menu is large enough, without
+	necessarily growing it, as this avoids some integer overflow issues.
+	All callers changed.
+	(keymap_panes, parse_single_submenu, Fx_popup_menu):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(parse_single_submenu, Fx_popup_menu): Don't assume fixnum fits in int.
+	Use SAFE_ALLOCA_LISP, not alloca.
+	(find_and_return_menu_selection): Avoid unnecessary casts of pointers
+	to EMACS_INT.  Check that fixnums are in proper range for system types.
+	* minibuf.c (minibuf_prompt_width, string_to_object)
+	(Fminibuffer_contents, Fminibuffer_contents_no_properties)
+	(Fminibuffer_completion_contents, Ftry_completion, Fall_completions):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(get_minibuffer, read_minibuf_unwind):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(read_minibuf): Omit unnecessary arg BACKUP_N, which is always nil;
+	this simplifies overflow checking.  All callers changed.
+	(read_minibuf, Fread_buffer, Ftry_completion, Fall_completions)
+	(Ftest_completion):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* nsfns.m (check_ns_display_info): Don't assume fixnum fits in long.
+	(x_set_menu_bar_lines, x_set_tool_bar_lines, Fx_create_frame):
+	Check that fixnums are in proper range for system types.
+	(Fx_create_frame, Fx_show_tip):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* nsfont.m (ns_findfonts, nsfont_list_family):
+	Don't assume fixnum fits in long.
+	* nsmenu.m (ns_update_menubar, ns_menu_show, ns_popup_dialog):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(ns_update_menubar): Use intptr_t, not EMACS_INT, when intptr_t is
+	wide enough.
+	* nsselect.m (ns_get_local_selection):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* print.c (print_buffer_size, print_buffer_pos, print_buffer_pos_byte)
+	(PRINTDECLARE, PRINTPREPARE):
+	(strout, print_string):
+	(print, print_preprocess, print_check_string_charset_prop)
+	(print_object):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(PRINTDECLARE):
+	(temp_output_buffer_setup, Fprin1_to_string, print_object):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(PRINTPREPARE): Use int, not ptrdiff_t, where int is wide enough.
+	(PRINTFINISH): Use SAFE_ALLOCA, not alloca.
+	(printchar, strout): Use xpalloc to catch size calculation overflow.
+	(Fexternal_debugging_output): Use CHECK_CHARACTER, not CHECK_NUMBER,
+	to avoid mishandling large integers.
+	(print_error_message): Use SAFE_ALLOCA, not alloca.
+	(print_object): Use int, not EMACS_INT, where int is wide enough.
+	* process.c (Fdelete_process): Don't assume pid fits into EMACS_INT.
+	(Fset_process_window_size, Fformat_network_address)
+	(get_lisp_to_sockaddr_size, set_socket_option, Fmake_network_process)
+	(Fsignal_process, sigchld_handler):
+	Check that fixnums are in proper range for system types.
+	(Fformat_network_address, read_process_output, send_process)
+	(Fprocess_send_region, status_notify):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Fformat_network_address, Fmake_serial_process, Fmake_network_process)
+	(wait_reading_process_output, read_process_output, exec_sentinel):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(conv_lisp_to_sockaddr): Don't assume fixnums fit into int.
+	(Faccept_process_output): Use duration_to_sec_usec to do proper
+	overflow checking on durations.
+	* scroll.c (calculate_scrolling, calculate_direct_scrolling)
+	(line_ins_del): Use int, not EMACS_INT, where int is wide enough.
+	* search.c (looking_at_1, string_match_1):
+	(fast_string_match, fast_c_string_match_ignore_case)
+	(fast_string_match_ignore_case, fast_looking_at, scan_buffer)
+	(scan_newline, find_before_next_newline, search_command)
+	(trivial_regexp_p, search_buffer, simple_search, boyer_moore)
+	(set_search_regs, wordify):
+	(Freplace_match):
+	(Fmatch_data):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(string_match_1, search_buffer, set_search_regs):
+	(Fmatch_data):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(wordify): Check for overflow in size calculation.
+	(Freplace_match): Avoid potential buffer overflow in search_regs.start.
+	(Fset_match_data): Don't assume fixnum fits in ptrdiff_t.
+	Check that fixnums are in proper range for system types.
+	* sound.c (struct sound_device)
+	(wav_play, au_play, vox_write, alsa_period_size, alsa_write):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Fplay_sound_internal):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* syntax.c (ST_COMMENT_STYLE, ST_STRING_STYLE):
+	In definitions, make it clearer that these values must be out of range
+	for the respective integer ranges.  This fixes a bug with ST_STRING_STYLE
+	and non-ASCII characters.
+	(struct lisp_parse_state, find_start_modiff)
+	(Finternal_describe_syntax_value, scan_lists, scan_sexps_forward):
+	(Fparse_partial_sexp):
+	Don't assume fixnums can fit in int.
+	(struct lisp_parse_state, find_start_pos, find_start_value)
+	(find_start_value_byte, find_start_begv)
+	(update_syntax_table, char_quoted, dec_bytepos)
+	(find_defun_start, prev_char_comend_first, back_comment):
+	(scan_words, skip_chars, skip_syntaxes, forw_comment, Fforward_comment)
+	(scan_lists, Fbackward_prefix_chars, scan_sexps_forward):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Finternal_describe_syntax_value): Check that match_lisp is a
+	character, not an integer, since the code stuffs it into int.
+	(scan_words, scan_sexps_forward):
+	Check that fixnums are in proper range for system types.
+	(Fforward_word):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(scan_sexps_forward):
+	Use CHARACTERP, not INTEGERP, since the value must fit into int.
+	(Fparse_partial_sexp): Fix doc; element 8 is not ignored.
+	* syntax.h: Adjust decls to match defn changes elsewhere.
+	(struct gl_state_s):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	* sysdep.c (wait_for_termination_1, wait_for_termination)
+	(interruptible_wait_for_termination, mkdir):
+	Don't assume pid_t fits in int; on 64-bit AIX pid_t is 64-bit.
+	(emacs_read, emacs_write):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(system_process_attributes): Don't assume uid_t, gid_t, and
+	double all fit in int or even EMACS_INT.
+	* term.c (set_tty_color_mode):
+	Check that fixnums are in proper range for system types.
+	* termhooks.h (struct input_event):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	* textprop.c (validate_interval_range, interval_of)
+	(Fadd_text_properties, set_text_properties_1)
+	(Fremove_text_properties, Fremove_list_of_text_properties)
+	(Ftext_property_any, Ftext_property_not_all)
+	(copy_text_properties, text_property_list, extend_property_ranges)
+	(verify_interval_modification):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Fnext_single_char_property_change)
+	(Fprevious_single_char_property_change):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(copy_text_properties): Check for integer overflow in index calculation.
+	* undo.c (last_boundary_position, record_point, record_insert)
+	(record_delete, record_marker_adjustment, record_change)
+	(record_property_change):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(truncate_undo_list, Fprimitive_undo): Don't assume fixnum fits in int.
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* w32fns.c (Fx_create_frame, x_create_tip_frame, Fx_show_tip)
+	(Fx_hide_tip, Fx_file_dialog):
+	* w32menu.c (set_frame_menubar):
+	Use ptrdiff_t, not int, for consistency with rest of code.
+	* window.c (window_scroll_preserve_hpos, window_scroll_preserve_vpos)
+	(select_window, Fdelete_other_windows_internal)
+	(window_scroll_pixel_based, window_scroll_line_based)
+	(Frecenter, Fset_window_configuration):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(Fset_window_hscroll, run_window_configuration_change_hook)
+	(set_window_buffer, temp_output_buffer_show, scroll_command)
+	(Fscroll_other_window):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(Fwindow_line_height, window_scroll, Fscroll_left, Fscroll_right):
+	Don't assume fixnum fits in int.
+	(Fset_window_scroll_bars):
+	Check that fixnums are in proper range for system types.
+	* xdisp.c (help_echo_pos, pos_visible_p, string_pos_nchars_ahead)
+	(string_pos, c_string_pos, number_of_chars, init_iterator)
+	(in_ellipses_for_invisible_text_p, init_from_display_pos)
+	(compute_stop_pos, next_overlay_change, compute_display_string_pos)
+	(compute_display_string_end, handle_face_prop)
+	(face_before_or_after_it_pos, handle_invisible_prop, handle_display_prop)
+	(handle_display_spec, handle_single_display_spec)
+	(display_prop_intangible_p, string_buffer_position_lim)
+	(string_buffer_position, handle_composition_prop, load_overlay_strings)
+	(get_overlay_strings_1, get_overlay_strings)
+	(iterate_out_of_display_property, forward_to_next_line_start)
+	(back_to_previous_visible_line_start, reseat, reseat_to_string)
+	(get_next_display_element, set_iterator_to_next)
+	(get_visually_first_element, compute_stop_pos_backwards)
+	(handle_stop_backwards, next_element_from_buffer)
+	(move_it_in_display_line_to, move_it_in_display_line)
+	(move_it_to, move_it_vertically_backward, move_it_by_lines)
+	(add_to_log, message_dolog, message_log_check_duplicate)
+	(message2, message2_nolog, message3, message3_nolog
+	(with_echo_area_buffer, display_echo_area_1, resize_mini_window_1)
+	(current_message_1, truncate_echo_area, truncate_message_1)
+	(set_message, set_message_1, store_mode_line_noprop)
+	(hscroll_window_tree, debug_delta, debug_delta_bytes, debug_end_vpos)
+	(text_outside_line_unchanged_p, check_point_in_composition)
+	(reconsider_clip_changes)
+	(redisplay_internal, set_cursor_from_row, try_scrolling)
+	(try_cursor_movement, set_vertical_scroll_bar, redisplay_window)
+	(redisplay_window, find_last_unchanged_at_beg_row)
+	(find_first_unchanged_at_end_row, row_containing_pos, try_window_id)
+	(trailing_whitespace_p, find_row_edges, display_line)
+	(RECORD_MAX_MIN_POS, Fcurrent_bidi_paragraph_direction)
+	(display_mode_element, store_mode_line_string)
+	(pint2str, pint2hrstr, decode_mode_spec)
+	(display_count_lines, display_string, draw_glyphs)
+	(x_produce_glyphs, x_insert_glyphs)
+	(rows_from_pos_range, mouse_face_from_buffer_pos)
+	(fast_find_string_pos, mouse_face_from_string_pos)
+	(note_mode_line_or_margin_highlight, note_mouse_highlight):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(safe_call, init_from_display_pos, handle_fontified_prop)
+	(handle_single_display_spec, load_overlay_strings)
+	(with_echo_area_buffer, setup_echo_area_for_printing)
+	(display_echo_area, echo_area_display)
+	(x_consider_frame_title, prepare_menu_bars, update_menu_bar)
+	(update_tool_bar, hscroll_window_tree, redisplay_internal)
+	(redisplay_window, dump_glyph_row, display_mode_line, Fformat_mode_line)
+	(decode_mode_spec, on_hot_spot_p):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(handle_single_display_spec, build_desired_tool_bar_string)
+	(redisplay_tool_bar, scroll_window_tree, Fdump_glyph_matrix)
+	(get_specified_cursor_type):
+	Check that fixnums are in proper range for system types.
+	(struct overlay_entry, resize_mini_window, Fdump_glyph_row)
+	(Flookup_image_map):
+	Don't assume fixnums fit in int.
+	(compare_overlay_entries):
+	Avoid mishandling comparisons due to subtraction overflow.
+	(load_overlay_strings): Use SAFE_NALLOCA, not alloca.
+	(last_escape_glyph_face_id, last_glyphless_glyph_face_id):
+	(handle_tool_bar_click):
+	Use int, not unsigned, since we prefer signed and the signedness
+	doesn't matter here.
+	(get_next_display_element, next_element_from_display_vector):
+	Use int, not EMACS_INT, when int is wide enough.
+	(start_hourglass): Use duration_to_sec_usec to do proper
+	overflow checking on durations.
+	* xfaces.c (Fbitmap_spec_p):
+	Check that fixnums are in proper range for system types.
+	(compare_fonts_by_sort_order):
+	Avoid mishandling comparisons due to subtraction overflow.
+	(Fx_family_fonts, realize_basic_faces):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(Fx_family_fonts):
+	Don't assume fixnum fits in int.
+	Use SAFE_ALLOCA_LISP, not alloca.
+	(merge_face_heights): Remove unnecessary cast to EMACS_INT.
+	(Finternal_make_lisp_face): Don't allocate more than MAX_FACE_ID.
+	(face_at_buffer_position, face_for_overlay_string)
+	(face_at_string_position):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	(merge_faces): Use int, not EMACS_INT, where int is wide enough.
+	* xfns.c (x_set_menu_bar_lines, x_set_tool_bar_lines, x_icon_verify)
+	(Fx_show_tip):
+	Check that fixnums are in proper range for system types.
+	(Fx_create_frame, x_create_tip_frame, Fx_show_tip)
+	(Fx_hide_tip, Fx_file_dialog, Fx_select_font):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(Fx_change_window_property): Don't assume fixnums fit in int.
+	* xfont.c (xfont_chars_supported):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* xmenu.c (Fx_popup_dialog, set_frame_menubar)
+	(create_and_show_popup_menu, create_and_show_dialog, xmenu_show):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* xml.c (parse_region):
+	* xrdb.c (magic_file_p):
+	Use ptrdiff_t, not EMACS_INT, where ptrdiff_t is wide enough.
+	* xselect.c (TRACE1): Don't assume pid_t promotes to int.
+	(x_get_local_selection, x_reply_selection_request)
+	(x_handle_selection_request, wait_for_property_change):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	(selection_data_to_lisp_data): Use short, not EMACS_INT, where
+	short is wide enough.
+	(x_send_client_event): Don't assume fixnum fits in int.
+	* xterm.c (x_x_to_emacs_modifiers):
+	Don't assume EMACS_INT overflows nicely into int.
+	(x_emacs_to_x_modifiers): Use EMACS_INT, not int, because values
+	may come from Lisp.
+	(handle_one_xevent): NATNUMP can eval its arg twice.
+	(x_connection_closed):
+	Use ptrdiff_t, not int, to avoid needless 32-bit limit on 64-bit hosts.
+	* xterm.h: Adjust decls to match defn changes elsewhere.
+	(struct scroll_bar): Use struct vectorlike_header
+	rather than rolling our own approximation.
+	(SCROLL_BAR_VEC_SIZE): Remove; not used.
+
 2011-09-16  Paul Eggert  <eggert@cs.ucla.edu>
 
 	* xselect.c: Relax test for outgoing X longs (Bug#9498).
diff --git a/src/alloc.c b/src/alloc.c
index ad1741e308f..6bcb216bb5e 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -229,11 +229,11 @@ static ptrdiff_t pure_bytes_used_before_overflow;
 
 /* Index in pure at which next pure Lisp object will be allocated.. */
 
-static EMACS_INT pure_bytes_used_lisp;
+static ptrdiff_t pure_bytes_used_lisp;
 
 /* Number of bytes allocated for non-Lisp objects in pure storage.  */
 
-static EMACS_INT pure_bytes_used_non_lisp;
+static ptrdiff_t pure_bytes_used_non_lisp;
 
 /* If nonzero, this is a warning delivered by malloc and not yet
    displayed.  */
@@ -382,7 +382,7 @@ static void *min_heap_address, *max_heap_address;
 static struct mem_node mem_z;
 #define MEM_NIL &mem_z
 
-static struct Lisp_Vector *allocate_vectorlike (EMACS_INT);
+static struct Lisp_Vector *allocate_vectorlike (ptrdiff_t);
 static void lisp_free (POINTER_TYPE *);
 static void mark_stack (void);
 static int live_vector_p (struct mem_node *, void *);
@@ -464,7 +464,7 @@ display_malloc_warning (void)
 /* Called if we can't allocate relocatable space for a buffer.  */
 
 void
-buffer_memory_full (EMACS_INT nbytes)
+buffer_memory_full (ptrdiff_t nbytes)
 {
   /* If buffers use the relocating allocator, no need to free
      spare_memory, because we may have plenty of malloc space left
@@ -1608,7 +1608,7 @@ struct sdata
 
 #ifdef GC_CHECK_STRING_BYTES
 
-  EMACS_INT nbytes;
+  ptrdiff_t nbytes;
   unsigned char data[1];
 
 #define SDATA_NBYTES(S)	(S)->nbytes
@@ -1623,7 +1623,7 @@ struct sdata
     unsigned char data[1];
 
     /* When STRING is null.  */
-    EMACS_INT nbytes;
+    ptrdiff_t nbytes;
   } u;
 
 #define SDATA_NBYTES(S)	(S)->u.nbytes
@@ -1733,24 +1733,24 @@ static char const string_overrun_cookie[GC_STRING_OVERRUN_COOKIE_SIZE] =
 #define SDATA_SIZE(NBYTES)			\
      ((SDATA_DATA_OFFSET			\
        + (NBYTES) + 1				\
-       + sizeof (EMACS_INT) - 1)		\
-      & ~(sizeof (EMACS_INT) - 1))
+       + sizeof (ptrdiff_t) - 1)		\
+      & ~(sizeof (ptrdiff_t) - 1))
 
 #else /* not GC_CHECK_STRING_BYTES */
 
 /* The 'max' reserves space for the nbytes union member even when NBYTES + 1 is
    less than the size of that member.  The 'max' is not needed when
-   SDATA_DATA_OFFSET is a multiple of sizeof (EMACS_INT), because then the
+   SDATA_DATA_OFFSET is a multiple of sizeof (ptrdiff_t), because then the
    alignment code reserves enough space.  */
 
 #define SDATA_SIZE(NBYTES)				      \
      ((SDATA_DATA_OFFSET				      \
-       + (SDATA_DATA_OFFSET % sizeof (EMACS_INT) == 0	      \
+       + (SDATA_DATA_OFFSET % sizeof (ptrdiff_t) == 0	      \
 	  ? NBYTES					      \
-	  : max (NBYTES, sizeof (EMACS_INT) - 1))	      \
+	  : max (NBYTES, sizeof (ptrdiff_t) - 1))	      \
        + 1						      \
-       + sizeof (EMACS_INT) - 1)			      \
-      & ~(sizeof (EMACS_INT) - 1))
+       + sizeof (ptrdiff_t) - 1)			      \
+      & ~(sizeof (ptrdiff_t) - 1))
 
 #endif /* not GC_CHECK_STRING_BYTES */
 
@@ -1794,10 +1794,10 @@ static int check_string_bytes_count;
 
 /* Like GC_STRING_BYTES, but with debugging check.  */
 
-EMACS_INT
+ptrdiff_t
 string_bytes (struct Lisp_String *s)
 {
-  EMACS_INT nbytes =
+  ptrdiff_t nbytes =
     (s->size_byte < 0 ? s->size & ~ARRAY_MARK_FLAG : s->size_byte);
 
   if (!PURE_POINTER_P (s)
@@ -1820,7 +1820,7 @@ check_sblock (struct sblock *b)
     {
       /* Compute the next FROM here because copying below may
 	 overwrite data we need to compute it.  */
-      EMACS_INT nbytes;
+      ptrdiff_t nbytes;
 
       /* Check that the string size recorded in the string is the
 	 same as the one recorded in the sdata structure. */
@@ -1966,7 +1966,7 @@ allocate_string_data (struct Lisp_String *s,
 {
   struct sdata *data, *old_data;
   struct sblock *b;
-  EMACS_INT needed, old_nbytes;
+  ptrdiff_t needed, old_nbytes;
 
   if (STRING_BYTES_MAX < nbytes)
     string_overflow ();
@@ -2211,7 +2211,7 @@ compact_small_strings (void)
 	{
 	  /* Compute the next FROM here because copying below may
 	     overwrite data we need to compute it.  */
-	  EMACS_INT nbytes;
+	  ptrdiff_t nbytes;
 
 #ifdef GC_CHECK_STRING_BYTES
 	  /* Check that the string size recorded in the string is the
@@ -2341,7 +2341,8 @@ LENGTH must be a number.  INIT matters only in whether it is t or nil.  */)
 {
   register Lisp_Object val;
   struct Lisp_Bool_Vector *p;
-  EMACS_INT length_in_chars, length_in_elts;
+  ptrdiff_t length_in_chars;
+  EMACS_INT length_in_elts;
   int bits_per_value;
 
   CHECK_NATNUM (length);
@@ -2349,8 +2350,6 @@ LENGTH must be a number.  INIT matters only in whether it is t or nil.  */)
   bits_per_value = sizeof (EMACS_INT) * BOOL_VECTOR_BITS_PER_CHAR;
 
   length_in_elts = (XFASTINT (length) + bits_per_value - 1) / bits_per_value;
-  length_in_chars = ((XFASTINT (length) + BOOL_VECTOR_BITS_PER_CHAR - 1)
-		     / BOOL_VECTOR_BITS_PER_CHAR);
 
   /* We must allocate one more elements than LENGTH_IN_ELTS for the
      slot `size' of the struct Lisp_Bool_Vector.  */
@@ -2362,6 +2361,8 @@ LENGTH must be a number.  INIT matters only in whether it is t or nil.  */)
   p = XBOOL_VECTOR (val);
   p->size = XFASTINT (length);
 
+  length_in_chars = ((XFASTINT (length) + BOOL_VECTOR_BITS_PER_CHAR - 1)
+		     / BOOL_VECTOR_BITS_PER_CHAR);
   if (length_in_chars)
     {
       memset (p->data, ! NILP (init) ? -1 : 0, length_in_chars);
@@ -2380,10 +2381,10 @@ LENGTH must be a number.  INIT matters only in whether it is t or nil.  */)
    multibyte, depending on the contents.  */
 
 Lisp_Object
-make_string (const char *contents, EMACS_INT nbytes)
+make_string (const char *contents, ptrdiff_t nbytes)
 {
   register Lisp_Object val;
-  EMACS_INT nchars, multibyte_nbytes;
+  ptrdiff_t nchars, multibyte_nbytes;
 
   parse_str_as_multibyte ((const unsigned char *) contents, nbytes,
 			  &nchars, &multibyte_nbytes);
@@ -2400,7 +2401,7 @@ make_string (const char *contents, EMACS_INT nbytes)
 /* Make an unibyte string from LENGTH bytes at CONTENTS.  */
 
 Lisp_Object
-make_unibyte_string (const char *contents, EMACS_INT length)
+make_unibyte_string (const char *contents, ptrdiff_t length)
 {
   register Lisp_Object val;
   val = make_uninit_string (length);
@@ -2414,7 +2415,7 @@ make_unibyte_string (const char *contents, EMACS_INT length)
 
 Lisp_Object
 make_multibyte_string (const char *contents,
-		       EMACS_INT nchars, EMACS_INT nbytes)
+		       ptrdiff_t nchars, ptrdiff_t nbytes)
 {
   register Lisp_Object val;
   val = make_uninit_multibyte_string (nchars, nbytes);
@@ -2428,7 +2429,7 @@ make_multibyte_string (const char *contents,
 
 Lisp_Object
 make_string_from_bytes (const char *contents,
-			EMACS_INT nchars, EMACS_INT nbytes)
+			ptrdiff_t nchars, ptrdiff_t nbytes)
 {
   register Lisp_Object val;
   val = make_uninit_multibyte_string (nchars, nbytes);
@@ -2446,7 +2447,7 @@ make_string_from_bytes (const char *contents,
 
 Lisp_Object
 make_specified_string (const char *contents,
-		       EMACS_INT nchars, EMACS_INT nbytes, int multibyte)
+		       ptrdiff_t nchars, ptrdiff_t nbytes, int multibyte)
 {
   register Lisp_Object val;
 
@@ -2885,7 +2886,7 @@ enum
    with room for LEN Lisp_Objects.  */
 
 static struct Lisp_Vector *
-allocate_vectorlike (EMACS_INT len)
+allocate_vectorlike (ptrdiff_t len)
 {
   struct Lisp_Vector *p;
   size_t nbytes;
@@ -2941,7 +2942,7 @@ allocate_vector (EMACS_INT len)
 /* Allocate other vector-like structures.  */
 
 struct Lisp_Vector *
-allocate_pseudovector (int memlen, int lisplen, EMACS_INT tag)
+allocate_pseudovector (int memlen, int lisplen, int tag)
 {
   struct Lisp_Vector *v = allocate_vectorlike (memlen);
   int i;
@@ -3005,14 +3006,14 @@ See also the function `vector'.  */)
   (register Lisp_Object length, Lisp_Object init)
 {
   Lisp_Object vector;
-  register EMACS_INT sizei;
-  register EMACS_INT i;
+  register ptrdiff_t sizei;
+  register ptrdiff_t i;
   register struct Lisp_Vector *p;
 
   CHECK_NATNUM (length);
-  sizei = XFASTINT (length);
 
-  p = allocate_vector (sizei);
+  p = allocate_vector (XFASTINT (length));
+  sizei = XFASTINT (length);
   for (i = 0; i < sizei; i++)
     p->contents[i] = init;
 
@@ -4696,14 +4697,14 @@ check_pure_size (void)
    address.  Return NULL if not found.  */
 
 static char *
-find_string_data_in_pure (const char *data, EMACS_INT nbytes)
+find_string_data_in_pure (const char *data, ptrdiff_t nbytes)
 {
   int i;
-  EMACS_INT skip, bm_skip[256], last_char_skip, infinity, start, start_max;
+  ptrdiff_t skip, bm_skip[256], last_char_skip, infinity, start, start_max;
   const unsigned char *p;
   char *non_lisp_beg;
 
-  if (pure_bytes_used_non_lisp < nbytes + 1)
+  if (pure_bytes_used_non_lisp <= nbytes)
     return NULL;
 
   /* Set up the Boyer-Moore table.  */
@@ -4767,7 +4768,7 @@ find_string_data_in_pure (const char *data, EMACS_INT nbytes)
 
 Lisp_Object
 make_pure_string (const char *data,
-		  EMACS_INT nchars, EMACS_INT nbytes, int multibyte)
+		  ptrdiff_t nchars, ptrdiff_t nbytes, int multibyte)
 {
   Lisp_Object string;
   struct Lisp_String *s;
@@ -4795,7 +4796,7 @@ make_pure_c_string (const char *data)
 {
   Lisp_Object string;
   struct Lisp_String *s;
-  EMACS_INT nchars = strlen (data);
+  ptrdiff_t nchars = strlen (data);
 
   s = (struct Lisp_String *) pure_alloc (sizeof *s, Lisp_String);
   s->size = nchars;
@@ -4842,7 +4843,7 @@ make_pure_float (double num)
    pure space.  */
 
 Lisp_Object
-make_pure_vector (EMACS_INT len)
+make_pure_vector (ptrdiff_t len)
 {
   Lisp_Object new;
   struct Lisp_Vector *p;
@@ -4886,8 +4887,8 @@ Does not copy symbols.  Copies strings without text properties.  */)
   else if (COMPILEDP (obj) || VECTORP (obj))
     {
       register struct Lisp_Vector *vec;
-      register EMACS_INT i;
-      EMACS_INT size;
+      register ptrdiff_t i;
+      ptrdiff_t size;
 
       size = ASIZE (obj);
       if (size & PSEUDOVECTOR_FLAG)
@@ -4939,10 +4940,10 @@ staticpro (Lisp_Object *varaddress)
 
 /* Temporarily prevent garbage collection.  */
 
-int
+ptrdiff_t
 inhibit_garbage_collection (void)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   specbind (Qgc_cons_threshold, make_number (MOST_POSITIVE_FIXNUM));
   return count;
@@ -4967,7 +4968,7 @@ returns nil, because real GC can't be done.  */)
   ptrdiff_t i;
   int message_p;
   Lisp_Object total[8];
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   EMACS_TIME t1, t2, t3;
 
   if (abort_on_gc)
@@ -5262,7 +5263,7 @@ returns nil, because real GC can't be done.  */)
 
   if (!NILP (Vpost_gc_hook))
     {
-      int gc_count = inhibit_garbage_collection ();
+      ptrdiff_t gc_count = inhibit_garbage_collection ();
       safe_run_hooks (Qpost_gc_hook);
       unbind_to (gc_count, Qnil);
     }
@@ -5347,8 +5348,8 @@ ptrdiff_t mark_object_loop_halt EXTERNALLY_VISIBLE;
 static void
 mark_vectorlike (struct Lisp_Vector *ptr)
 {
-  EMACS_INT size = ptr->header.size;
-  EMACS_INT i;
+  ptrdiff_t size = ptr->header.size;
+  ptrdiff_t i;
 
   eassert (!VECTOR_MARKED_P (ptr));
   VECTOR_MARK (ptr);		/* Else mark it */
diff --git a/src/bidi.c b/src/bidi.c
index bb29647ea88..11013edc70d 100644
--- a/src/bidi.c
+++ b/src/bidi.c
@@ -204,7 +204,7 @@ bidi_mirror_char (int c)
   val = CHAR_TABLE_REF (bidi_mirror_table, c);
   if (INTEGERP (val))
     {
-      int v = XINT (val);
+      EMACS_INT v = XINT (val);
 
       if (v < 0 || v > MAX_CHAR)
 	abort ();
@@ -378,7 +378,7 @@ bidi_cache_fetch_state (ptrdiff_t idx, struct bidi_it *bidi_it)
    resolved levels in cached states.  DIR, if non-zero, means search
    in that direction from the last cache hit.  */
 static inline ptrdiff_t
-bidi_cache_search (EMACS_INT charpos, int level, int dir)
+bidi_cache_search (ptrdiff_t charpos, int level, int dir)
 {
   ptrdiff_t i, i_start;
 
@@ -562,7 +562,7 @@ bidi_cache_iterator_state (struct bidi_it *bidi_it, int resolved)
 }
 
 static inline bidi_type_t
-bidi_cache_find (EMACS_INT charpos, int level, struct bidi_it *bidi_it)
+bidi_cache_find (ptrdiff_t charpos, int level, struct bidi_it *bidi_it)
 {
   ptrdiff_t i = bidi_cache_search (charpos, level, bidi_it->scan_dir);
 
@@ -794,7 +794,7 @@ bidi_set_paragraph_end (struct bidi_it *bidi_it)
 
 /* Initialize the bidi iterator from buffer/string position CHARPOS.  */
 void
-bidi_init_it (EMACS_INT charpos, EMACS_INT bytepos, int frame_window_p,
+bidi_init_it (ptrdiff_t charpos, ptrdiff_t bytepos, int frame_window_p,
 	      struct bidi_it *bidi_it)
 {
   if (! bidi_initialized)
@@ -863,11 +863,11 @@ bidi_line_init (struct bidi_it *bidi_it)
    are zero-based character positions in S, BEGBYTE is byte position
    corresponding to BEG.  UNIBYTE, if non-zero, means S is a unibyte
    string.  */
-static inline EMACS_INT
-bidi_count_bytes (const unsigned char *s, const EMACS_INT beg,
-		  const EMACS_INT begbyte, const EMACS_INT end, int unibyte)
+static inline ptrdiff_t
+bidi_count_bytes (const unsigned char *s, const ptrdiff_t beg,
+		  const ptrdiff_t begbyte, const ptrdiff_t end, int unibyte)
 {
-  EMACS_INT pos = beg;
+  ptrdiff_t pos = beg;
   const unsigned char *p = s + begbyte, *start = p;
 
   if (unibyte)
@@ -892,7 +892,7 @@ bidi_count_bytes (const unsigned char *s, const EMACS_INT beg,
    character from the current buffer.  UNIBYTE non-zero means S is a
    unibyte string.  */
 static inline int
-bidi_char_at_pos (EMACS_INT bytepos, const unsigned char *s, int unibyte)
+bidi_char_at_pos (ptrdiff_t bytepos, const unsigned char *s, int unibyte)
 {
   if (s)
     {
@@ -920,12 +920,12 @@ bidi_char_at_pos (EMACS_INT bytepos, const unsigned char *s, int unibyte)
    string to iterate, or NULL if iterating over a buffer or a Lisp
    string; in the latter case, STRING->lstring is the Lisp string.  */
 static inline int
-bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
+bidi_fetch_char (ptrdiff_t bytepos, ptrdiff_t charpos, ptrdiff_t *disp_pos,
 		 int *disp_prop, struct bidi_string_data *string,
-		 int frame_window_p, EMACS_INT *ch_len, EMACS_INT *nchars)
+		 int frame_window_p, ptrdiff_t *ch_len, ptrdiff_t *nchars)
 {
   int ch;
-  EMACS_INT endpos =
+  ptrdiff_t endpos =
     (string->s || STRINGP (string->lstring)) ? string->schars : ZV;
   struct text_pos pos;
 
@@ -949,7 +949,7 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
     }
   else if (charpos >= *disp_pos && *disp_prop)
     {
-      EMACS_INT disp_end_pos;
+      ptrdiff_t disp_end_pos;
 
       /* We don't expect to find ourselves in the middle of a display
 	 property.  Hopefully, it will never be needed.  */
@@ -1049,12 +1049,12 @@ bidi_fetch_char (EMACS_INT bytepos, EMACS_INT charpos, EMACS_INT *disp_pos,
    following the buffer position, -1 if position is at the beginning
    of a new paragraph, or -2 if position is neither at beginning nor
    at end of a paragraph.  */
-static EMACS_INT
-bidi_at_paragraph_end (EMACS_INT charpos, EMACS_INT bytepos)
+static ptrdiff_t
+bidi_at_paragraph_end (ptrdiff_t charpos, ptrdiff_t bytepos)
 {
   Lisp_Object sep_re;
   Lisp_Object start_re;
-  EMACS_INT val;
+  ptrdiff_t val;
 
   sep_re = paragraph_separate_re;
   start_re = paragraph_start_re;
@@ -1073,11 +1073,11 @@ bidi_at_paragraph_end (EMACS_INT charpos, EMACS_INT bytepos)
 
 /* Find the beginning of this paragraph by looking back in the buffer.
    Value is the byte position of the paragraph's beginning.  */
-static EMACS_INT
-bidi_find_paragraph_start (EMACS_INT pos, EMACS_INT pos_byte)
+static ptrdiff_t
+bidi_find_paragraph_start (ptrdiff_t pos, ptrdiff_t pos_byte)
 {
   Lisp_Object re = paragraph_start_re;
-  EMACS_INT limit = ZV, limit_byte = ZV_BYTE;
+  ptrdiff_t limit = ZV, limit_byte = ZV_BYTE;
 
   while (pos_byte > BEGV_BYTE
 	 && fast_looking_at (re, pos, pos_byte, limit, limit_byte, Qnil) < 0)
@@ -1110,14 +1110,14 @@ bidi_find_paragraph_start (EMACS_INT pos, EMACS_INT pos_byte)
 void
 bidi_paragraph_init (bidi_dir_t dir, struct bidi_it *bidi_it, int no_default_p)
 {
-  EMACS_INT bytepos = bidi_it->bytepos;
+  ptrdiff_t bytepos = bidi_it->bytepos;
   int string_p = bidi_it->string.s != NULL || STRINGP (bidi_it->string.lstring);
-  EMACS_INT pstartbyte;
+  ptrdiff_t pstartbyte;
   /* Note that begbyte is a byte position, while end is a character
      position.  Yes, this is ugly, but we are trying to avoid costly
      calls to BYTE_TO_CHAR and its ilk.  */
-  EMACS_INT begbyte = string_p ? 0 : BEGV_BYTE;
-  EMACS_INT end = string_p ? bidi_it->string.schars : ZV;
+  ptrdiff_t begbyte = string_p ? 0 : BEGV_BYTE;
+  ptrdiff_t end = string_p ? bidi_it->string.schars : ZV;
 
   /* Special case for an empty buffer. */
   if (bytepos == begbyte && bidi_it->charpos == end)
@@ -1139,8 +1139,8 @@ bidi_paragraph_init (bidi_dir_t dir, struct bidi_it *bidi_it, int no_default_p)
   else if (dir == NEUTRAL_DIR)	/* P2 */
     {
       int ch;
-      EMACS_INT ch_len, nchars;
-      EMACS_INT pos, disp_pos = -1;
+      ptrdiff_t ch_len, nchars;
+      ptrdiff_t pos, disp_pos = -1;
       int disp_prop = 0;
       bidi_type_t type;
       const unsigned char *s;
@@ -1235,8 +1235,8 @@ bidi_paragraph_init (bidi_dir_t dir, struct bidi_it *bidi_it, int no_default_p)
 	      bidi_it->paragraph_dir = L2R; /* P3 and HL1 */
 	    else
 	      {
-		EMACS_INT prevpbyte = pstartbyte;
-		EMACS_INT p = BYTE_TO_CHAR (pstartbyte), pbyte = pstartbyte;
+		ptrdiff_t prevpbyte = pstartbyte;
+		ptrdiff_t p = BYTE_TO_CHAR (pstartbyte), pbyte = pstartbyte;
 
 		/* Find the beginning of the previous paragraph, if any.  */
 		while (pbyte > BEGV_BYTE && prevpbyte >= pstartbyte)
@@ -1496,7 +1496,7 @@ bidi_resolve_explicit (struct bidi_it *bidi_it)
 {
   int prev_level = bidi_it->level_stack[bidi_it->stack_idx].level;
   int new_level  = bidi_resolve_explicit_1 (bidi_it);
-  EMACS_INT eob = bidi_it->string.s ? bidi_it->string.schars : ZV;
+  ptrdiff_t eob = bidi_it->string.s ? bidi_it->string.schars : ZV;
   const unsigned char *s = STRINGP (bidi_it->string.lstring)
     ? SDATA (bidi_it->string.lstring) : bidi_it->string.s;
 
@@ -1582,7 +1582,7 @@ bidi_resolve_weak (struct bidi_it *bidi_it)
   int next_char;
   bidi_type_t type_of_next;
   struct bidi_it saved_it;
-  EMACS_INT eob =
+  ptrdiff_t eob =
     (STRINGP (bidi_it->string.lstring) || bidi_it->string.s)
     ? bidi_it->string.schars : ZV;
 
@@ -1707,7 +1707,7 @@ bidi_resolve_weak (struct bidi_it *bidi_it)
 	    type = WEAK_EN;
 	  else			/* W5: ET/BN with EN after it.  */
 	    {
-	      EMACS_INT en_pos = bidi_it->charpos + bidi_it->nchars;
+	      ptrdiff_t en_pos = bidi_it->charpos + bidi_it->nchars;
 	      const unsigned char *s =
 		STRINGP (bidi_it->string.lstring)
 		? SDATA (bidi_it->string.lstring) : bidi_it->string.s;
@@ -1955,11 +1955,11 @@ bidi_level_of_next_char (struct bidi_it *bidi_it)
   bidi_type_t type;
   int level, prev_level = -1;
   struct bidi_saved_info next_for_neutral;
-  EMACS_INT next_char_pos = -2;
+  ptrdiff_t next_char_pos = -2;
 
   if (bidi_it->scan_dir == 1)
     {
-      EMACS_INT eob =
+      ptrdiff_t eob =
 	(bidi_it->string.s || STRINGP (bidi_it->string.lstring))
 	? bidi_it->string.schars : ZV;
 
@@ -2086,11 +2086,11 @@ bidi_level_of_next_char (struct bidi_it *bidi_it)
       && bidi_it->next_for_ws.type == UNKNOWN_BT)
     {
       int ch;
-      EMACS_INT clen = bidi_it->ch_len;
-      EMACS_INT bpos = bidi_it->bytepos;
-      EMACS_INT cpos = bidi_it->charpos;
-      EMACS_INT disp_pos = bidi_it->disp_pos;
-      EMACS_INT nc = bidi_it->nchars;
+      ptrdiff_t clen = bidi_it->ch_len;
+      ptrdiff_t bpos = bidi_it->bytepos;
+      ptrdiff_t cpos = bidi_it->charpos;
+      ptrdiff_t disp_pos = bidi_it->disp_pos;
+      ptrdiff_t nc = bidi_it->nchars;
       struct bidi_string_data bs = bidi_it->string;
       bidi_type_t chtype;
       int fwp = bidi_it->frame_window_p;
@@ -2331,7 +2331,7 @@ bidi_move_to_visually_next (struct bidi_it *bidi_it)
 	bidi_it->separator_limit = bidi_it->string.schars;
       else if (bidi_it->bytepos < ZV_BYTE)
 	{
-	  EMACS_INT sep_len =
+	  ptrdiff_t sep_len =
 	    bidi_at_paragraph_end (bidi_it->charpos + bidi_it->nchars,
 				   bidi_it->bytepos + bidi_it->ch_len);
 	  if (bidi_it->nchars <= 0)
diff --git a/src/buffer.c b/src/buffer.c
index 37d2975c8c7..564dab689cd 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -155,7 +155,7 @@ Lisp_Object Qinsert_behind_hooks;
 static void alloc_buffer_text (struct buffer *, ptrdiff_t);
 static void free_buffer_text (struct buffer *b);
 static struct Lisp_Overlay * copy_overlays (struct buffer *, struct Lisp_Overlay *);
-static void modify_overlay (struct buffer *, EMACS_INT, EMACS_INT);
+static void modify_overlay (struct buffer *, ptrdiff_t, ptrdiff_t);
 static Lisp_Object buffer_lisp_local_variables (struct buffer *);
 
 /* For debugging; temporary.  See set_buffer_internal.  */
@@ -423,7 +423,7 @@ copy_overlays (struct buffer *b, struct Lisp_Overlay *list)
   for (; list; list = list->next)
     {
       Lisp_Object overlay, start, end, old_overlay;
-      EMACS_INT charpos;
+      ptrdiff_t charpos;
 
       XSETMISC (old_overlay, list);
       charpos = marker_position (OVERLAY_START (old_overlay));
@@ -724,7 +724,7 @@ reset_buffer (register struct buffer *b)
   b->prevent_redisplay_optimizations_p = 1;
   BVAR (b, backed_up) = Qnil;
   BUF_AUTOSAVE_MODIFF (b) = 0;
-  b->auto_save_failure_time = -1;
+  b->auto_save_failure_time = 0;
   BVAR (b, auto_save_file_name) = Qnil;
   BVAR (b, read_only) = Qnil;
   b->overlays_before = NULL;
@@ -858,8 +858,8 @@ it is in the sequence to be tried) even if a buffer with that name exists.  */)
   (register Lisp_Object name, Lisp_Object ignore)
 {
   register Lisp_Object gentemp, tem;
-  EMACS_INT count;
-  char number[INT_BUFSIZE_BOUND (EMACS_INT) + sizeof "<>"];
+  ptrdiff_t count;
+  char number[INT_BUFSIZE_BOUND (ptrdiff_t) + sizeof "<>"];
 
   CHECK_STRING (name);
 
@@ -873,7 +873,7 @@ it is in the sequence to be tried) even if a buffer with that name exists.  */)
   count = 1;
   while (1)
     {
-      sprintf (number, "<%"pI"d>", ++count);
+      sprintf (number, "<%"pD"d>", ++count);
       gentemp = concat2 (name, build_string (number));
       tem = Fstring_equal (gentemp, ignore);
       if (!NILP (tem))
@@ -1475,7 +1475,7 @@ with SIGHUP.  */)
 
   /* Run hooks with the buffer to be killed the current buffer.  */
   {
-    int count = SPECPDL_INDEX ();
+    ptrdiff_t count = SPECPDL_INDEX ();
     Lisp_Object arglist[1];
 
     record_unwind_protect (save_excursion_restore, save_excursion_save ());
@@ -1746,7 +1746,7 @@ Use this function before selecting the buffer, since it may need to inspect
 the current buffer's major mode.  */)
   (Lisp_Object buffer)
 {
-  int count;
+  ptrdiff_t count;
   Lisp_Object function;
 
   CHECK_BUFFER (buffer);
@@ -1958,16 +1958,15 @@ validate_region (register Lisp_Object *b, register Lisp_Object *e)
       tem = *b;  *b = *e;  *e = tem;
     }
 
-  if (!(BEGV <= XINT (*b) && XINT (*b) <= XINT (*e)
-        && XINT (*e) <= ZV))
+  if (! (BEGV <= XINT (*b) && XINT (*e) <= ZV))
     args_out_of_range (*b, *e);
 }
 
 /* Advance BYTE_POS up to a character boundary
    and return the adjusted position.  */
 
-static EMACS_INT
-advance_to_char_boundary (EMACS_INT byte_pos)
+static ptrdiff_t
+advance_to_char_boundary (ptrdiff_t byte_pos)
 {
   int c;
 
@@ -1980,7 +1979,7 @@ advance_to_char_boundary (EMACS_INT byte_pos)
     {
       /* We should advance BYTE_POS only when C is a constituent of a
          multibyte sequence.  */
-      EMACS_INT orig_byte_pos = byte_pos;
+      ptrdiff_t orig_byte_pos = byte_pos;
 
       do
 	{
@@ -2056,12 +2055,12 @@ DEFUN ("buffer-swap-text", Fbuffer_swap_text, Sbuffer_swap_text,
 			  (POINTER_TYPE **) &current_buffer->own_text.beg);
 #endif /* REL_ALLOC */
 
-  swapfield (pt, EMACS_INT);
-  swapfield (pt_byte, EMACS_INT);
-  swapfield (begv, EMACS_INT);
-  swapfield (begv_byte, EMACS_INT);
-  swapfield (zv, EMACS_INT);
-  swapfield (zv_byte, EMACS_INT);
+  swapfield (pt, ptrdiff_t);
+  swapfield (pt_byte, ptrdiff_t);
+  swapfield (begv, ptrdiff_t);
+  swapfield (begv_byte, ptrdiff_t);
+  swapfield (zv, ptrdiff_t);
+  swapfield (zv_byte, ptrdiff_t);
   eassert (!current_buffer->base_buffer);
   eassert (!other_buffer->base_buffer);
   current_buffer->clip_changed = 1;	other_buffer->clip_changed = 1;
@@ -2071,7 +2070,7 @@ DEFUN ("buffer-swap-text", Fbuffer_swap_text, Sbuffer_swap_text,
   other_buffer->prevent_redisplay_optimizations_p = 1;
   swapfield (overlays_before, struct Lisp_Overlay *);
   swapfield (overlays_after, struct Lisp_Overlay *);
-  swapfield (overlay_center, EMACS_INT);
+  swapfield (overlay_center, ptrdiff_t);
   swapfield_ (undo_list, Lisp_Object);
   swapfield_ (mark, Lisp_Object);
   swapfield_ (enable_multibyte_characters, Lisp_Object);
@@ -2154,7 +2153,7 @@ current buffer is cleared.  */)
 {
   struct Lisp_Marker *tail, *markers;
   struct buffer *other;
-  EMACS_INT begv, zv;
+  ptrdiff_t begv, zv;
   int narrowed = (BEG != BEGV || Z != ZV);
   int modified_p = !NILP (Fbuffer_modified_p (Qnil));
   Lisp_Object old_undo = BVAR (current_buffer, undo_list);
@@ -2186,7 +2185,7 @@ current buffer is cleared.  */)
 
   if (NILP (flag))
     {
-      EMACS_INT pos, stop;
+      ptrdiff_t pos, stop;
       unsigned char *p;
 
       /* Do this first, so it can use CHAR_TO_BYTE
@@ -2250,8 +2249,8 @@ current buffer is cleared.  */)
     }
   else
     {
-      EMACS_INT pt = PT;
-      EMACS_INT pos, stop;
+      ptrdiff_t pt = PT;
+      ptrdiff_t pos, stop;
       unsigned char *p, *pend;
 
       /* Be sure not to have a multibyte sequence striding over the GAP.
@@ -2267,7 +2266,7 @@ current buffer is cleared.  */)
 	  while (! CHAR_HEAD_P (*q) && q > BEG_ADDR) q--;
 	  if (LEADING_CODE_P (*q))
 	    {
-	      EMACS_INT new_gpt = GPT_BYTE - (GPT_ADDR - q);
+	      ptrdiff_t new_gpt = GPT_BYTE - (GPT_ADDR - q);
 
 	      move_gap_both (new_gpt, new_gpt);
 	    }
@@ -2351,8 +2350,8 @@ current buffer is cleared.  */)
 	ZV = chars_in_text (BEG_ADDR, ZV_BYTE - BEG_BYTE) + BEG;
 
       {
-	EMACS_INT byte = advance_to_char_boundary (PT_BYTE);
-	EMACS_INT position;
+	ptrdiff_t byte = advance_to_char_boundary (PT_BYTE);
+	ptrdiff_t position;
 
 	if (byte > GPT_BYTE)
 	  position = chars_in_text (GAP_END_ADDR, byte - GPT_BYTE) + GPT;
@@ -2516,20 +2515,20 @@ swap_out_buffer_local_variables (struct buffer *b)
 ptrdiff_t
 overlays_at (EMACS_INT pos, int extend, Lisp_Object **vec_ptr,
 	     ptrdiff_t *len_ptr,
-	     EMACS_INT *next_ptr, EMACS_INT *prev_ptr, int change_req)
+	     ptrdiff_t *next_ptr, ptrdiff_t *prev_ptr, int change_req)
 {
   Lisp_Object overlay, start, end;
   struct Lisp_Overlay *tail;
   ptrdiff_t idx = 0;
   ptrdiff_t len = *len_ptr;
   Lisp_Object *vec = *vec_ptr;
-  EMACS_INT next = ZV;
-  EMACS_INT prev = BEGV;
+  ptrdiff_t next = ZV;
+  ptrdiff_t prev = BEGV;
   int inhibit_storing = 0;
 
   for (tail = current_buffer->overlays_before; tail; tail = tail->next)
     {
-      EMACS_INT startpos, endpos;
+      ptrdiff_t startpos, endpos;
 
       XSETMISC (overlay, tail);
 
@@ -2577,7 +2576,7 @@ overlays_at (EMACS_INT pos, int extend, Lisp_Object **vec_ptr,
 
   for (tail = current_buffer->overlays_after; tail; tail = tail->next)
     {
-      EMACS_INT startpos, endpos;
+      ptrdiff_t startpos, endpos;
 
       XSETMISC (overlay, tail);
 
@@ -2650,21 +2649,21 @@ overlays_at (EMACS_INT pos, int extend, Lisp_Object **vec_ptr,
 static ptrdiff_t
 overlays_in (EMACS_INT beg, EMACS_INT end, int extend,
 	     Lisp_Object **vec_ptr, ptrdiff_t *len_ptr,
-	     EMACS_INT *next_ptr, EMACS_INT *prev_ptr)
+	     ptrdiff_t *next_ptr, ptrdiff_t *prev_ptr)
 {
   Lisp_Object overlay, ostart, oend;
   struct Lisp_Overlay *tail;
   ptrdiff_t idx = 0;
   ptrdiff_t len = *len_ptr;
   Lisp_Object *vec = *vec_ptr;
-  EMACS_INT next = ZV;
-  EMACS_INT prev = BEGV;
+  ptrdiff_t next = ZV;
+  ptrdiff_t prev = BEGV;
   int inhibit_storing = 0;
   int end_is_Z = end == Z;
 
   for (tail = current_buffer->overlays_before; tail; tail = tail->next)
     {
-      EMACS_INT startpos, endpos;
+      ptrdiff_t startpos, endpos;
 
       XSETMISC (overlay, tail);
 
@@ -2711,7 +2710,7 @@ overlays_in (EMACS_INT beg, EMACS_INT end, int extend,
 
   for (tail = current_buffer->overlays_after; tail; tail = tail->next)
     {
-      EMACS_INT startpos, endpos;
+      ptrdiff_t startpos, endpos;
 
       XSETMISC (overlay, tail);
 
@@ -2767,8 +2766,8 @@ overlays_in (EMACS_INT beg, EMACS_INT end, int extend,
 int
 mouse_face_overlay_overlaps (Lisp_Object overlay)
 {
-  EMACS_INT start = OVERLAY_POSITION (OVERLAY_START (overlay));
-  EMACS_INT end = OVERLAY_POSITION (OVERLAY_END (overlay));
+  ptrdiff_t start = OVERLAY_POSITION (OVERLAY_START (overlay));
+  ptrdiff_t end = OVERLAY_POSITION (OVERLAY_END (overlay));
   ptrdiff_t n, i, size;
   Lisp_Object *v, tem;
 
@@ -2794,14 +2793,14 @@ mouse_face_overlay_overlaps (Lisp_Object overlay)
 
 /* Fast function to just test if we're at an overlay boundary.  */
 int
-overlay_touches_p (EMACS_INT pos)
+overlay_touches_p (ptrdiff_t pos)
 {
   Lisp_Object overlay;
   struct Lisp_Overlay *tail;
 
   for (tail = current_buffer->overlays_before; tail; tail = tail->next)
     {
-      EMACS_INT endpos;
+      ptrdiff_t endpos;
 
       XSETMISC (overlay ,tail);
       if (!OVERLAYP (overlay))
@@ -2816,7 +2815,7 @@ overlay_touches_p (EMACS_INT pos)
 
   for (tail = current_buffer->overlays_after; tail; tail = tail->next)
     {
-      EMACS_INT startpos;
+      ptrdiff_t startpos;
 
       XSETMISC (overlay, tail);
       if (!OVERLAYP (overlay))
@@ -2834,7 +2833,7 @@ overlay_touches_p (EMACS_INT pos)
 struct sortvec
 {
   Lisp_Object overlay;
-  EMACS_INT beg, end;
+  ptrdiff_t beg, end;
   EMACS_INT priority;
 };
 
@@ -2951,7 +2950,7 @@ static void
 record_overlay_string (struct sortstrlist *ssl, Lisp_Object str,
 		       Lisp_Object str2, Lisp_Object pri, ptrdiff_t size)
 {
-  EMACS_INT nbytes;
+  ptrdiff_t nbytes;
 
   if (ssl->used == ssl->size)
     ssl->buf = xpalloc (ssl->buf, &ssl->size, 5, -1, sizeof *ssl->buf);
@@ -3001,12 +3000,12 @@ record_overlay_string (struct sortstrlist *ssl, Lisp_Object str,
    PSTR, if that variable is non-null.  The string may be overwritten by
    subsequent calls.  */
 
-EMACS_INT
-overlay_strings (EMACS_INT pos, struct window *w, unsigned char **pstr)
+ptrdiff_t
+overlay_strings (ptrdiff_t pos, struct window *w, unsigned char **pstr)
 {
   Lisp_Object overlay, window, str;
   struct Lisp_Overlay *ov;
-  EMACS_INT startpos, endpos;
+  ptrdiff_t startpos, endpos;
   int multibyte = ! NILP (BVAR (current_buffer, enable_multibyte_characters));
 
   overlay_heads.used = overlay_heads.bytes = 0;
@@ -3076,7 +3075,7 @@ overlay_strings (EMACS_INT pos, struct window *w, unsigned char **pstr)
   if (overlay_heads.bytes || overlay_tails.bytes)
     {
       Lisp_Object tem;
-      EMACS_INT i;
+      ptrdiff_t i;
       unsigned char *p;
       ptrdiff_t total;
 
@@ -3090,7 +3089,7 @@ overlay_strings (EMACS_INT pos, struct window *w, unsigned char **pstr)
       p = overlay_str_buf;
       for (i = overlay_tails.used; --i >= 0;)
 	{
-	  EMACS_INT nbytes;
+	  ptrdiff_t nbytes;
 	  tem = overlay_tails.buf[i].string;
 	  nbytes = copy_text (SDATA (tem), p,
 			      SBYTES (tem),
@@ -3099,7 +3098,7 @@ overlay_strings (EMACS_INT pos, struct window *w, unsigned char **pstr)
 	}
       for (i = 0; i < overlay_heads.used; ++i)
 	{
-	  EMACS_INT nbytes;
+	  ptrdiff_t nbytes;
 	  tem = overlay_heads.buf[i].string;
 	  nbytes = copy_text (SDATA (tem), p,
 			      SBYTES (tem),
@@ -3126,7 +3125,7 @@ overlay_strings (EMACS_INT pos, struct window *w, unsigned char **pstr)
 /* Shift overlays in BUF's overlay lists, to center the lists at POS.  */
 
 void
-recenter_overlay_lists (struct buffer *buf, EMACS_INT pos)
+recenter_overlay_lists (struct buffer *buf, ptrdiff_t pos)
 {
   Lisp_Object overlay, beg, end;
   struct Lisp_Overlay *prev, *tail, *next;
@@ -3164,7 +3163,7 @@ recenter_overlay_lists (struct buffer *buf, EMACS_INT pos)
       if (OVERLAY_POSITION (end) > pos)
 	{
 	  /* OVERLAY needs to be moved.  */
-	  EMACS_INT where = OVERLAY_POSITION (beg);
+	  ptrdiff_t where = OVERLAY_POSITION (beg);
 	  struct Lisp_Overlay *other, *other_prev;
 
 	  /* Splice the cons cell TAIL out of overlays_before.  */
@@ -3237,7 +3236,7 @@ recenter_overlay_lists (struct buffer *buf, EMACS_INT pos)
       if (OVERLAY_POSITION (end) <= pos)
 	{
 	  /* OVERLAY needs to be moved.  */
-	  EMACS_INT where = OVERLAY_POSITION (end);
+	  ptrdiff_t where = OVERLAY_POSITION (end);
 	  struct Lisp_Overlay *other, *other_prev;
 
 	  /* Splice the cons cell TAIL out of overlays_after.  */
@@ -3275,7 +3274,7 @@ recenter_overlay_lists (struct buffer *buf, EMACS_INT pos)
 }
 
 void
-adjust_overlays_for_insert (EMACS_INT pos, EMACS_INT length)
+adjust_overlays_for_insert (ptrdiff_t pos, ptrdiff_t length)
 {
   /* After an insertion, the lists are still sorted properly,
      but we may need to update the value of the overlay center.  */
@@ -3284,13 +3283,13 @@ adjust_overlays_for_insert (EMACS_INT pos, EMACS_INT length)
 }
 
 void
-adjust_overlays_for_delete (EMACS_INT pos, EMACS_INT length)
+adjust_overlays_for_delete (ptrdiff_t pos, ptrdiff_t length)
 {
   if (current_buffer->overlay_center < pos)
     /* The deletion was to our right.  No change needed; the before- and
        after-lists are still consistent.  */
     ;
-  else if (current_buffer->overlay_center > pos + length)
+  else if (current_buffer->overlay_center - pos > length)
     /* The deletion was to our left.  We need to adjust the center value
        to account for the change in position, but the lists are consistent
        given the new value.  */
@@ -3309,7 +3308,7 @@ adjust_overlays_for_delete (EMACS_INT pos, EMACS_INT length)
    Such an overlay might even have negative size at this point.
    If so, we'll make the overlay empty. */
 void
-fix_start_end_in_overlays (register EMACS_INT start, register EMACS_INT end)
+fix_start_end_in_overlays (register ptrdiff_t start, register ptrdiff_t end)
 {
   Lisp_Object overlay;
   struct Lisp_Overlay *before_list IF_LINT (= NULL);
@@ -3322,7 +3321,7 @@ fix_start_end_in_overlays (register EMACS_INT start, register EMACS_INT end)
      current_buffer->overlays_before or overlays_after, depending
      which loop we're in.  */
   struct Lisp_Overlay *tail, *parent;
-  EMACS_INT startpos, endpos;
+  ptrdiff_t startpos, endpos;
 
   /* This algorithm shifts links around instead of consing and GCing.
      The loop invariant is that before_list (resp. after_list) is a
@@ -3456,12 +3455,12 @@ fix_start_end_in_overlays (register EMACS_INT start, register EMACS_INT end)
    was at PREV, and now is at POS.  */
 
 void
-fix_overlays_before (struct buffer *bp, EMACS_INT prev, EMACS_INT pos)
+fix_overlays_before (struct buffer *bp, ptrdiff_t prev, ptrdiff_t pos)
 {
   /* If parent is nil, replace overlays_before; otherwise, parent->next.  */
   struct Lisp_Overlay *tail = bp->overlays_before, *parent = NULL, *right_pair;
   Lisp_Object tem;
-  EMACS_INT end IF_LINT (= 0);
+  ptrdiff_t end IF_LINT (= 0);
 
   /* After the insertion, the several overlays may be in incorrect
      order.  The possibility is that, in the list `overlays_before',
@@ -3619,11 +3618,11 @@ for the rear of the overlay advance when text is inserted there
 /* Mark a section of BUF as needing redisplay because of overlays changes.  */
 
 static void
-modify_overlay (struct buffer *buf, EMACS_INT start, EMACS_INT end)
+modify_overlay (struct buffer *buf, ptrdiff_t start, ptrdiff_t end)
 {
   if (start > end)
     {
-      EMACS_INT temp = start;
+      ptrdiff_t temp = start;
       start = end;
       end = temp;
     }
@@ -3672,7 +3671,7 @@ buffer.  */)
 {
   struct buffer *b, *ob;
   Lisp_Object obuffer;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   CHECK_OVERLAY (overlay);
   if (NILP (buffer))
@@ -3691,19 +3690,22 @@ buffer.  */)
   CHECK_NUMBER_COERCE_MARKER (beg);
   CHECK_NUMBER_COERCE_MARKER (end);
 
-  if (XINT (beg) == XINT (end) && ! NILP (Foverlay_get (overlay, Qevaporate)))
-    return Fdelete_overlay (overlay);
-
   if (XINT (beg) > XINT (end))
     {
       Lisp_Object temp;
       temp = beg; beg = end; end = temp;
     }
 
+  b = XBUFFER (buffer);
+  if (! (BUF_BEGV (b) <= XINT (beg) && XINT (end) <= BUF_ZV (b)))
+    args_out_of_range (beg, end);
+
+  if (XINT (beg) == XINT (end) && ! NILP (Foverlay_get (overlay, Qevaporate)))
+    return Fdelete_overlay (overlay);
+
   specbind (Qinhibit_quit, Qt);
 
   obuffer = Fmarker_buffer (OVERLAY_START (overlay));
-  b = XBUFFER (buffer);
   ob = BUFFERP (obuffer) ? XBUFFER (obuffer) : (struct buffer *) 0;
 
   /* If the overlay has changed buffers, do a thorough redisplay.  */
@@ -3712,8 +3714,8 @@ buffer.  */)
       /* Redisplay where the overlay was.  */
       if (!NILP (obuffer))
 	{
-	  EMACS_INT o_beg;
-	  EMACS_INT o_end;
+	  ptrdiff_t o_beg;
+	  ptrdiff_t o_end;
 
 	  o_beg = OVERLAY_POSITION (OVERLAY_START (overlay));
 	  o_end = OVERLAY_POSITION (OVERLAY_END (overlay));
@@ -3727,7 +3729,7 @@ buffer.  */)
   else
     /* Redisplay the area the overlay has just left, or just enclosed.  */
     {
-      EMACS_INT o_beg, o_end;
+      ptrdiff_t o_beg, o_end;
 
       o_beg = OVERLAY_POSITION (OVERLAY_START (overlay));
       o_end = OVERLAY_POSITION (OVERLAY_END (overlay));
@@ -3781,7 +3783,7 @@ DEFUN ("delete-overlay", Fdelete_overlay, Sdelete_overlay, 1, 1, 0,
 {
   Lisp_Object buffer;
   struct buffer *b;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   CHECK_OVERLAY (overlay);
 
@@ -3872,7 +3874,7 @@ DEFUN ("overlays-at", Foverlays_at, Soverlays_at, 1, 1, 0,
   /* Put all the overlays we want in a vector in overlay_vec.
      Store the length in len.  */
   noverlays = overlays_at (XINT (pos), 1, &overlay_vec, &len,
-			   (EMACS_INT *) 0, (EMACS_INT *) 0, 0);
+			   0, 0, 0);
 
   /* Make a list of them all.  */
   result = Flist (noverlays, overlay_vec);
@@ -3920,7 +3922,7 @@ the value is (point-max).  */)
   (Lisp_Object pos)
 {
   ptrdiff_t i, len, noverlays;
-  EMACS_INT endpos;
+  ptrdiff_t endpos;
   Lisp_Object *overlay_vec;
 
   CHECK_NUMBER_COERCE_MARKER (pos);
@@ -3932,14 +3934,14 @@ the value is (point-max).  */)
      Store the length in len.
      endpos gets the position where the next overlay starts.  */
   noverlays = overlays_at (XINT (pos), 1, &overlay_vec, &len,
-			   &endpos, (EMACS_INT *) 0, 1);
+			   &endpos, 0, 1);
 
   /* If any of these overlays ends before endpos,
      use its ending point instead.  */
   for (i = 0; i < noverlays; i++)
     {
       Lisp_Object oend;
-      EMACS_INT oendpos;
+      ptrdiff_t oendpos;
 
       oend = OVERLAY_END (overlay_vec[i]);
       oendpos = OVERLAY_POSITION (oend);
@@ -3958,7 +3960,7 @@ If there are no overlay boundaries from (point-min) to POS,
 the value is (point-min).  */)
   (Lisp_Object pos)
 {
-  EMACS_INT prevpos;
+  ptrdiff_t prevpos;
   Lisp_Object *overlay_vec;
   ptrdiff_t len;
 
@@ -3976,7 +3978,7 @@ the value is (point-min).  */)
      Store the length in len.
      prevpos gets the position of the previous change.  */
   overlays_at (XINT (pos), 1, &overlay_vec, &len,
-	       (EMACS_INT *) 0, &prevpos, 1);
+	       0, &prevpos, 1);
 
   xfree (overlay_vec);
   return make_number (prevpos);
@@ -4014,9 +4016,11 @@ That makes overlay lookup faster for positions near POS (but perhaps slower
 for positions far away from POS).  */)
   (Lisp_Object pos)
 {
+  ptrdiff_t p;
   CHECK_NUMBER_COERCE_MARKER (pos);
 
-  recenter_overlay_lists (current_buffer, XINT (pos));
+  p = clip_to_bounds (PTRDIFF_MIN, XINT (pos), PTRDIFF_MAX);
+  recenter_overlay_lists (current_buffer, p);
   return Qnil;
 }
 
@@ -4083,7 +4087,7 @@ VALUE will be returned.*/)
 static Lisp_Object last_overlay_modification_hooks;
 
 /* Number of elements actually used in last_overlay_modification_hooks.  */
-static int last_overlay_modification_hooks_used;
+static ptrdiff_t last_overlay_modification_hooks_used;
 
 /* Add one functionlist/overlay pair
    to the end of last_overlay_modification_hooks.  */
@@ -4091,11 +4095,11 @@ static int last_overlay_modification_hooks_used;
 static void
 add_overlay_mod_hooklist (Lisp_Object functionlist, Lisp_Object overlay)
 {
-  int oldsize = ASIZE (last_overlay_modification_hooks);
+  ptrdiff_t oldsize = ASIZE (last_overlay_modification_hooks);
 
-  if (last_overlay_modification_hooks_used == oldsize)
-    last_overlay_modification_hooks = larger_vector
-      (last_overlay_modification_hooks, oldsize * 2, Qnil);
+  if (oldsize - 1 <= last_overlay_modification_hooks_used)
+    last_overlay_modification_hooks =
+      larger_vector (last_overlay_modification_hooks, 2, -1);
   ASET (last_overlay_modification_hooks, last_overlay_modification_hooks_used,
 	functionlist); last_overlay_modification_hooks_used++;
   ASET (last_overlay_modification_hooks, last_overlay_modification_hooks_used,
@@ -4144,7 +4148,7 @@ report_overlay_modification (Lisp_Object start, Lisp_Object end, int after,
       last_overlay_modification_hooks_used = 0;
       for (tail = current_buffer->overlays_before; tail; tail = tail->next)
 	{
-	  EMACS_INT startpos, endpos;
+	  ptrdiff_t startpos, endpos;
 	  Lisp_Object ostart, oend;
 
 	  XSETMISC (overlay, tail);
@@ -4181,7 +4185,7 @@ report_overlay_modification (Lisp_Object start, Lisp_Object end, int after,
 
       for (tail = current_buffer->overlays_after; tail; tail = tail->next)
 	{
-	  EMACS_INT startpos, endpos;
+	  ptrdiff_t startpos, endpos;
 	  Lisp_Object ostart, oend;
 
 	  XSETMISC (overlay, tail);
@@ -4222,9 +4226,9 @@ report_overlay_modification (Lisp_Object start, Lisp_Object end, int after,
     /* Call the functions recorded in last_overlay_modification_hooks.
        First copy the vector contents, in case some of these hooks
        do subsequent modification of the buffer.  */
-    int size = last_overlay_modification_hooks_used;
+    ptrdiff_t size = last_overlay_modification_hooks_used;
     Lisp_Object *copy = (Lisp_Object *) alloca (size * sizeof (Lisp_Object));
-    int i;
+    ptrdiff_t i;
 
     memcpy (copy, XVECTOR (last_overlay_modification_hooks)->contents,
 	    size * sizeof (Lisp_Object));
@@ -4264,7 +4268,7 @@ call_overlay_mod_hooks (Lisp_Object list, Lisp_Object overlay, int after,
 /* Delete any zero-sized overlays at position POS, if the `evaporate'
    property is set.  */
 void
-evaporate_overlays (EMACS_INT pos)
+evaporate_overlays (ptrdiff_t pos)
 {
   Lisp_Object overlay, hit_list;
   struct Lisp_Overlay *tail;
@@ -4273,7 +4277,7 @@ evaporate_overlays (EMACS_INT pos)
   if (pos <= current_buffer->overlay_center)
     for (tail = current_buffer->overlays_before; tail; tail = tail->next)
       {
-	EMACS_INT endpos;
+	ptrdiff_t endpos;
 	XSETMISC (overlay, tail);
 	endpos = OVERLAY_POSITION (OVERLAY_END (overlay));
 	if (endpos < pos)
@@ -4285,7 +4289,7 @@ evaporate_overlays (EMACS_INT pos)
   else
     for (tail = current_buffer->overlays_after; tail; tail = tail->next)
       {
-	EMACS_INT startpos;
+	ptrdiff_t startpos;
 	XSETMISC (overlay, tail);
 	startpos = OVERLAY_POSITION (OVERLAY_START (overlay));
 	if (startpos > pos)
@@ -4795,7 +4799,7 @@ alloc_buffer_text (struct buffer *b, ptrdiff_t nbytes)
    shrink it.  */
 
 void
-enlarge_buffer_text (struct buffer *b, EMACS_INT delta)
+enlarge_buffer_text (struct buffer *b, ptrdiff_t delta)
 {
   POINTER_TYPE *p;
   ptrdiff_t nbytes = (BUF_Z_BYTE (b) - BUF_BEG_BYTE (b) + BUF_GAP_SIZE (b) + 1
diff --git a/src/buffer.h b/src/buffer.h
index 73628fe6dfc..323c85a0c77 100644
--- a/src/buffer.h
+++ b/src/buffer.h
@@ -245,12 +245,12 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #define BUF_TEMP_SET_PT(buffer, position) \
   (temp_set_point ((buffer), (position)))
 
-extern void set_point (EMACS_INT);
-extern void temp_set_point (struct buffer *, EMACS_INT);
-extern void set_point_both (EMACS_INT, EMACS_INT);
+extern void set_point (ptrdiff_t);
+extern void temp_set_point (struct buffer *, ptrdiff_t);
+extern void set_point_both (ptrdiff_t, ptrdiff_t);
 extern void temp_set_point_both (struct buffer *,
-				 EMACS_INT, EMACS_INT);
-extern void enlarge_buffer_text (struct buffer *, EMACS_INT);
+				 ptrdiff_t, ptrdiff_t);
+extern void enlarge_buffer_text (struct buffer *, ptrdiff_t);
 
 
 /* Macros for setting the BEGV, ZV or PT of a given buffer.
@@ -438,38 +438,38 @@ struct buffer_text
        into a buffer's text to functions that malloc.  */
     unsigned char *beg;
 
-    EMACS_INT gpt;		/* Char pos of gap in buffer.  */
-    EMACS_INT z;		/* Char pos of end of buffer.  */
-    EMACS_INT gpt_byte;		/* Byte pos of gap in buffer.  */
-    EMACS_INT z_byte;		/* Byte pos of end of buffer.  */
-    EMACS_INT gap_size;		/* Size of buffer's gap.  */
-    int modiff;			/* This counts buffer-modification events
+    ptrdiff_t gpt;		/* Char pos of gap in buffer.  */
+    ptrdiff_t z;		/* Char pos of end of buffer.  */
+    ptrdiff_t gpt_byte;		/* Byte pos of gap in buffer.  */
+    ptrdiff_t z_byte;		/* Byte pos of end of buffer.  */
+    ptrdiff_t gap_size;		/* Size of buffer's gap.  */
+    EMACS_INT modiff;		/* This counts buffer-modification events
 				   for this buffer.  It is incremented for
 				   each such event, and never otherwise
 				   changed.  */
-    int chars_modiff;           /* This is modified with character change
+    EMACS_INT chars_modiff;	/* This is modified with character change
 				   events for this buffer.  It is set to
 				   modiff for each such event, and never
 				   otherwise changed.  */
-    int save_modiff;		/* Previous value of modiff, as of last
+    EMACS_INT save_modiff;	/* Previous value of modiff, as of last
 				   time buffer visited or saved a file.  */
 
-    int overlay_modiff;		/* Counts modifications to overlays.  */
+    EMACS_INT overlay_modiff;	/* Counts modifications to overlays.  */
 
     /* Minimum value of GPT - BEG since last redisplay that finished.  */
-    EMACS_INT beg_unchanged;
+    ptrdiff_t beg_unchanged;
 
     /* Minimum value of Z - GPT since last redisplay that finished.  */
-    EMACS_INT end_unchanged;
+    ptrdiff_t end_unchanged;
 
     /* MODIFF as of last redisplay that finished; if it matches MODIFF,
        beg_unchanged and end_unchanged contain no useful information.  */
-    int unchanged_modified;
+    EMACS_INT unchanged_modified;
 
     /* BUF_OVERLAY_MODIFF of current buffer, as of last redisplay that
        finished; if it matches BUF_OVERLAY_MODIFF, beg_unchanged and
        end_unchanged contain no useful information.  */
-    int overlay_unchanged_modified;
+    EMACS_INT overlay_unchanged_modified;
 
     /* Properties of this buffer's text.  */
     INTERVAL intervals;
@@ -525,17 +525,17 @@ struct buffer
   struct buffer_text *text;
 
   /* Char position of point in buffer.  */
-  EMACS_INT pt;
+  ptrdiff_t pt;
   /* Byte position of point in buffer.  */
-  EMACS_INT pt_byte;
+  ptrdiff_t pt_byte;
   /* Char position of beginning of accessible range.  */
-  EMACS_INT begv;
+  ptrdiff_t begv;
   /* Byte position of beginning of accessible range.  */
-  EMACS_INT begv_byte;
+  ptrdiff_t begv_byte;
   /* Char position of end of accessible range.  */
-  EMACS_INT zv;
+  ptrdiff_t zv;
   /* Byte position of end of accessible range.  */
-  EMACS_INT zv_byte;
+  ptrdiff_t zv_byte;
 
   /* In an indirect buffer, this points to the base buffer.
      In an ordinary buffer, it is 0.  */
@@ -561,16 +561,16 @@ struct buffer
      modtime is actually set.  */
   off_t modtime_size;
   /* The value of text->modiff at the last auto-save.  */
-  int auto_save_modified;
+  EMACS_INT auto_save_modified;
   /* The value of text->modiff at the last display error.
      Redisplay of this buffer is inhibited until it changes again.  */
-  int display_error_modiff;
+  EMACS_INT display_error_modiff;
   /* The time at which we detected a failure to auto-save,
-     Or -1 if we didn't have a failure.  */
-  int auto_save_failure_time;
+     Or 0 if we didn't have a failure.  */
+  time_t auto_save_failure_time;
   /* Position in buffer at which display started
      the last time this buffer was displayed.  */
-  EMACS_INT last_window_start;
+  ptrdiff_t last_window_start;
 
   /* Set nonzero whenever the narrowing is changed in this buffer.  */
   int clip_changed;
@@ -607,7 +607,7 @@ struct buffer
   struct Lisp_Overlay *overlays_after;
 
   /* Position where the overlay lists are centered.  */
-  EMACS_INT overlay_center;
+  ptrdiff_t overlay_center;
 
   /* Everything from here down must be a Lisp_Object.  */
   /* buffer-local Lisp variables start at `undo_list',
@@ -890,20 +890,20 @@ extern struct buffer buffer_local_symbols;
 
 extern void delete_all_overlays (struct buffer *);
 extern void reset_buffer (struct buffer *);
-extern void evaporate_overlays (EMACS_INT);
+extern void evaporate_overlays (ptrdiff_t);
 extern ptrdiff_t overlays_at (EMACS_INT pos, int extend, Lisp_Object **vec_ptr,
-			      ptrdiff_t *len_ptr, EMACS_INT *next_ptr,
-			      EMACS_INT *prev_ptr, int change_req);
+			      ptrdiff_t *len_ptr, ptrdiff_t *next_ptr,
+			      ptrdiff_t *prev_ptr, int change_req);
 extern ptrdiff_t sort_overlays (Lisp_Object *, ptrdiff_t, struct window *);
-extern void recenter_overlay_lists (struct buffer *, EMACS_INT);
-extern EMACS_INT overlay_strings (EMACS_INT, struct window *, unsigned char **);
+extern void recenter_overlay_lists (struct buffer *, ptrdiff_t);
+extern ptrdiff_t overlay_strings (ptrdiff_t, struct window *, unsigned char **);
 extern void validate_region (Lisp_Object *, Lisp_Object *);
 extern void set_buffer_internal (struct buffer *);
 extern void set_buffer_internal_1 (struct buffer *);
 extern void set_buffer_temp (struct buffer *);
 extern void record_buffer (Lisp_Object);
 extern void buffer_slot_type_mismatch (Lisp_Object, int) NO_RETURN;
-extern void fix_overlays_before (struct buffer *, EMACS_INT, EMACS_INT);
+extern void fix_overlays_before (struct buffer *, ptrdiff_t, ptrdiff_t);
 extern void mmap_set_vars (int);
 
 /* Get overlays at POSN into array OVERLAYS with NOVERLAYS elements.
diff --git a/src/bytecode.c b/src/bytecode.c
index 9ed29e94b54..b6ac6c51bed 100644
--- a/src/bytecode.c
+++ b/src/bytecode.c
@@ -435,7 +435,7 @@ Lisp_Object
 exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
 		Lisp_Object args_template, ptrdiff_t nargs, Lisp_Object *args)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 #ifdef BYTE_CODE_METER
   int this_op = 0;
   int prev_op;
@@ -486,8 +486,6 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
   stack.byte_string = bytestr;
   stack.pc = stack.byte_string_start = SDATA (bytestr);
   stack.constants = vector;
-  if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (Lisp_Object) < XFASTINT (maxdepth))
-    memory_full (SIZE_MAX);
   top = (Lisp_Object *) alloca (XFASTINT (maxdepth)
                                          * sizeof (Lisp_Object));
 #if BYTE_MAINTAIN_TOP
@@ -504,14 +502,14 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
 
   if (INTEGERP (args_template))
     {
-      ptrdiff_t at = XINT (args_template);
+      EMACS_INT at = XINT (args_template);
       int rest = at & 128;
       int mandatory = at & 127;
-      ptrdiff_t nonrest = at >> 8;
+      EMACS_INT nonrest = at >> 8;
       eassert (mandatory <= nonrest);
       if (nargs <= nonrest)
 	{
-	  ptrdiff_t i;
+	  EMACS_INT i;
 	  for (i = 0 ; i < nargs; i++, args++)
 	    PUSH (*args);
 	  if (nargs < mandatory)
@@ -943,7 +941,7 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
 
 	case Bsave_window_excursion: /* Obsolete since 24.1.  */
 	  {
-	    register int count1 = SPECPDL_INDEX ();
+	    register ptrdiff_t count1 = SPECPDL_INDEX ();
 	    record_unwind_protect (Fset_window_configuration,
 				   Fcurrent_window_configuration (Qnil));
 	    BEFORE_POTENTIAL_GC ();
@@ -1007,13 +1005,14 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
 	case Bnth:
 	  {
 	    Lisp_Object v1, v2;
+	    EMACS_INT n;
 	    BEFORE_POTENTIAL_GC ();
 	    v1 = POP;
 	    v2 = TOP;
 	    CHECK_NUMBER (v2);
-	    op = XINT (v2);
+	    n = XINT (v2);
 	    immediate_quit = 1;
-	    while (--op >= 0 && CONSP (v1))
+	    while (--n >= 0 && CONSP (v1))
 	      v1 = XCDR (v1);
 	    immediate_quit = 0;
 	    TOP = CAR (v1);
@@ -1640,14 +1639,15 @@ exec_byte_code (Lisp_Object bytestr, Lisp_Object vector, Lisp_Object maxdepth,
 	    if (CONSP (TOP))
 	      {
 		/* Exchange args and then do nth.  */
+		EMACS_INT n;
 		BEFORE_POTENTIAL_GC ();
 		v2 = POP;
 		v1 = TOP;
 		CHECK_NUMBER (v2);
 		AFTER_POTENTIAL_GC ();
-		op = XINT (v2);
+		n = XINT (v2);
 		immediate_quit = 1;
-		while (--op >= 0 && CONSP (v1))
+		while (--n >= 0 && CONSP (v1))
 		  v1 = XCDR (v1);
 		immediate_quit = 0;
 		TOP = CAR (v1);
diff --git a/src/callint.c b/src/callint.c
index 5cf99495671..c2a43f0f8f9 100644
--- a/src/callint.c
+++ b/src/callint.c
@@ -257,11 +257,11 @@ invoke it.  If KEYS is omitted or nil, the return value of
   Lisp_Object teml;
   Lisp_Object up_event;
   Lisp_Object enable;
-  int speccount = SPECPDL_INDEX ();
+  ptrdiff_t speccount = SPECPDL_INDEX ();
 
   /* The index of the next element of this_command_keys to examine for
      the 'e' interactive code.  */
-  int next_event;
+  ptrdiff_t next_event;
 
   Lisp_Object prefix_arg;
   char *string;
@@ -278,7 +278,7 @@ invoke it.  If KEYS is omitted or nil, the return value of
   char *tem1;
   int arg_from_tty = 0;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
-  int key_count;
+  ptrdiff_t key_count;
   int record_then_fail = 0;
 
   Lisp_Object save_this_command, save_last_command;
@@ -582,7 +582,7 @@ invoke it.  If KEYS is omitted or nil, the return value of
 
 	case 'k':		/* Key sequence. */
 	  {
-	    int speccount1 = SPECPDL_INDEX ();
+	    ptrdiff_t speccount1 = SPECPDL_INDEX ();
 	    specbind (Qcursor_in_echo_area, Qt);
 	    /* Prompt in `minibuffer-prompt' face.  */
 	    Fput_text_property (make_number (0),
@@ -614,7 +614,7 @@ invoke it.  If KEYS is omitted or nil, the return value of
 
 	case 'K':		/* Key sequence to be defined. */
 	  {
-	    int speccount1 = SPECPDL_INDEX ();
+	    ptrdiff_t speccount1 = SPECPDL_INDEX ();
 	    specbind (Qcursor_in_echo_area, Qt);
 	    /* Prompt in `minibuffer-prompt' face.  */
 	    Fput_text_property (make_number (0),
diff --git a/src/callproc.c b/src/callproc.c
index 97531f73848..4eb83824b83 100644
--- a/src/callproc.c
+++ b/src/callproc.c
@@ -102,8 +102,12 @@ static Lisp_Object Fgetenv_internal (Lisp_Object, Lisp_Object);
 static Lisp_Object
 call_process_kill (Lisp_Object fdpid)
 {
-  emacs_close (XFASTINT (Fcar (fdpid)));
-  EMACS_KILLPG (XFASTINT (Fcdr (fdpid)), SIGKILL);
+  int fd;
+  pid_t pid;
+  CONS_TO_INTEGER (Fcar (fdpid), int, fd);
+  CONS_TO_INTEGER (Fcdr (fdpid), pid_t, pid);
+  emacs_close (fd);
+  EMACS_KILLPG (pid, SIGKILL);
   synch_process_alive = 0;
   return Qnil;
 }
@@ -112,18 +116,18 @@ static Lisp_Object
 call_process_cleanup (Lisp_Object arg)
 {
   Lisp_Object fdpid = Fcdr (arg);
+  int fd;
 #if defined (MSDOS)
   Lisp_Object file;
-  int fd;
 #else
-  int pid;
+  pid_t pid;
 #endif
 
   Fset_buffer (Fcar (arg));
+  CONS_TO_INTEGER (Fcar (fdpid), int, fd);
 
 #if defined (MSDOS)
   /* for MSDOS fdpid is really (fd . tempfile)  */
-  fd = XFASTINT (Fcar (fdpid));
   file = Fcdr (fdpid);
   /* FD is -1 and FILE is "" when we didn't actually create a
      temporary file in call-process.  */
@@ -132,17 +136,17 @@ call_process_cleanup (Lisp_Object arg)
   if (!(strcmp (SDATA (file), NULL_DEVICE) == 0 || SREF (file, 0) == '\0'))
     unlink (SDATA (file));
 #else /* not MSDOS */
-  pid = XFASTINT (Fcdr (fdpid));
+  CONS_TO_INTEGER (Fcdr (fdpid), pid_t, pid);
 
   if (call_process_exited)
     {
-      emacs_close (XFASTINT (Fcar (fdpid)));
+      emacs_close (fd);
       return Qnil;
     }
 
   if (EMACS_KILLPG (pid, SIGINT) == 0)
     {
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
       record_unwind_protect (call_process_kill, fdpid);
       message1 ("Waiting for process to die...(type C-g again to kill it instantly)");
       immediate_quit = 1;
@@ -153,7 +157,7 @@ call_process_cleanup (Lisp_Object arg)
       message1 ("Waiting for process to die...done");
     }
   synch_process_alive = 0;
-  emacs_close (XFASTINT (Fcar (fdpid)));
+  emacs_close (fd);
 #endif /* not MSDOS */
   return Qnil;
 }
@@ -186,17 +190,16 @@ If you quit, the process is killed with SIGINT, or SIGKILL if you quit again.
 usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
   (ptrdiff_t nargs, Lisp_Object *args)
 {
-  Lisp_Object infile, buffer, current_dir, path;
-  volatile int display_p_volatile;
+  Lisp_Object infile, buffer, current_dir, path, cleanup_info_tail;
+  int display_p;
   int fd[2];
   int filefd;
-  register int pid;
 #define CALLPROC_BUFFER_SIZE_MIN (16 * 1024)
 #define CALLPROC_BUFFER_SIZE_MAX (4 * CALLPROC_BUFFER_SIZE_MIN)
   char buf[CALLPROC_BUFFER_SIZE_MAX];
   int bufsize = CALLPROC_BUFFER_SIZE_MIN;
-  int count = SPECPDL_INDEX ();
-  volatile USE_SAFE_ALLOCA;
+  ptrdiff_t count = SPECPDL_INDEX ();
+  USE_SAFE_ALLOCA;
 
   register const unsigned char **new_argv;
   /* File to use for stderr in the child.
@@ -206,6 +209,9 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
 #ifdef MSDOS	/* Demacs 1.1.1 91/10/16 HIRANO Satoshi */
   char *outf, *tempfile = NULL;
   int outfilefd;
+  int pid;
+#else
+  pid_t pid;
 #endif
   int fd_output = -1;
   struct coding_system process_coding; /* coding-system of process output */
@@ -370,7 +376,7 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
     UNGCPRO;
   }
 
-  display_p_volatile = INTERACTIVE && nargs >= 4 && !NILP (args[3]);
+  display_p = INTERACTIVE && nargs >= 4 && !NILP (args[3]);
 
   filefd = emacs_open (SSDATA (infile), O_RDONLY, 0);
   if (filefd < 0)
@@ -606,10 +612,13 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
       Lisp_Object volatile buffer_volatile = buffer;
       Lisp_Object volatile coding_systems_volatile = coding_systems;
       Lisp_Object volatile current_dir_volatile = current_dir;
+      int volatile display_p_volatile = display_p;
       int volatile fd1_volatile = fd1;
       int volatile fd_error_volatile = fd_error;
       int volatile fd_output_volatile = fd_output;
       int volatile output_to_buffer_volatile = output_to_buffer;
+      int volatile sa_must_free_volatile = sa_must_free;
+      ptrdiff_t volatile sa_count_volatile = sa_count;
       unsigned char const **volatile new_argv_volatile = new_argv;
 
       pid = vfork ();
@@ -617,10 +626,13 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
       buffer = buffer_volatile;
       coding_systems = coding_systems_volatile;
       current_dir = current_dir_volatile;
+      display_p = display_p_volatile;
       fd1 = fd1_volatile;
       fd_error = fd_error_volatile;
       fd_output = fd_output_volatile;
       output_to_buffer = output_to_buffer_volatile;
+      sa_must_free_volatile = sa_must_free;
+      sa_count = sa_count_volatile;
       new_argv = new_argv_volatile;
     }
 
@@ -693,16 +705,14 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
 
 #if defined (MSDOS)
   /* MSDOS needs different cleanup information.  */
-  record_unwind_protect (call_process_cleanup,
-			 Fcons (Fcurrent_buffer (),
-				Fcons (make_number (fd[0]),
-				       build_string (tempfile ? tempfile : ""))));
+  cleanup_info_tail = build_string (tempfile ? tempfile : "");
 #else
+  cleanup_info_tail = INTEGER_TO_CONS (pid);
+#endif /* not MSDOS */
   record_unwind_protect (call_process_cleanup,
 			 Fcons (Fcurrent_buffer (),
-				Fcons (make_number (fd[0]), make_number (pid))));
-#endif /* not MSDOS */
-
+				Fcons (INTEGER_TO_CONS (fd[0]),
+				       cleanup_info_tail)));
 
   if (BUFFERP (buffer))
     Fset_buffer (buffer);
@@ -754,11 +764,10 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
 
   if (output_to_buffer)
     {
-      register EMACS_INT nread;
+      register int nread;
       int first = 1;
       EMACS_INT total_read = 0;
       int carryover = 0;
-      int display_p = display_p_volatile;
       int display_on_the_fly = display_p;
       struct coding_system saved_coding;
 
@@ -801,7 +810,7 @@ usage: (call-process PROGRAM &optional INFILE BUFFER DISPLAY &rest ARGS)  */)
 	      else
 		{			/* We have to decode the input.  */
 		  Lisp_Object curbuf;
-		  int count1 = SPECPDL_INDEX ();
+		  ptrdiff_t count1 = SPECPDL_INDEX ();
 
 		  XSETBUFFER (curbuf, current_buffer);
 		  /* We cannot allow after-change-functions be run
@@ -920,7 +929,7 @@ static Lisp_Object
 delete_temp_file (Lisp_Object name)
 {
   /* Suppress jka-compr handling, etc.  */
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   specbind (intern ("file-name-handler-alist"), Qnil);
   internal_delete_file (name);
   unbind_to (count, Qnil);
@@ -957,7 +966,7 @@ usage: (call-process-region START END PROGRAM &optional DELETE BUFFER DISPLAY &r
   struct gcpro gcpro1;
   Lisp_Object filename_string;
   register Lisp_Object start, end;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   /* Qt denotes we have not yet called Ffind_operation_coding_system.  */
   Lisp_Object coding_systems;
   Lisp_Object val, *args2;
@@ -1034,7 +1043,7 @@ usage: (call-process-region START END PROGRAM &optional DELETE BUFFER DISPLAY &r
   val = complement_process_encoding_system (val);
 
   {
-    int count1 = SPECPDL_INDEX ();
+    ptrdiff_t count1 = SPECPDL_INDEX ();
 
     specbind (intern ("coding-system-for-write"), val);
     /* POSIX lets mk[s]temp use "."; don't invoke jka-compr if we
@@ -1134,7 +1143,7 @@ child_setup (int in, int out, int err, register char **new_argv, int set_pgrp, L
   HANDLE handles[3];
 #endif /* WINDOWSNT */
 
-  int pid = getpid ();
+  pid_t pid = getpid ();
 
   /* Close Emacs's descriptors that this process should not have.  */
   close_process_descs ();
diff --git a/src/casefiddle.c b/src/casefiddle.c
index 77222c9e0a3..05d689a9eef 100644
--- a/src/casefiddle.c
+++ b/src/casefiddle.c
@@ -82,8 +82,8 @@ casify_object (enum case_action flag, Lisp_Object obj)
     wrong_type_argument (Qchar_or_string_p, obj);
   else if (!STRING_MULTIBYTE (obj))
     {
-      EMACS_INT i;
-      EMACS_INT size = SCHARS (obj);
+      ptrdiff_t i;
+      ptrdiff_t size = SCHARS (obj);
 
       obj = Fcopy_sequence (obj);
       for (i = 0; i < size; i++)
@@ -111,26 +111,20 @@ casify_object (enum case_action flag, Lisp_Object obj)
     }
   else
     {
-      EMACS_INT i, i_byte, size = SCHARS (obj);
+      ptrdiff_t i, i_byte, size = SCHARS (obj);
       int len;
       USE_SAFE_ALLOCA;
       unsigned char *dst, *o;
-      /* Over-allocate by 12%: this is a minor overhead, but should be
-	 sufficient in 99.999% of the cases to avoid a reallocation.  */
-      EMACS_INT o_size = SBYTES (obj) + SBYTES (obj) / 8 + MAX_MULTIBYTE_LENGTH;
+      ptrdiff_t o_size = (size < STRING_BYTES_BOUND / MAX_MULTIBYTE_LENGTH
+			  ? size * MAX_MULTIBYTE_LENGTH
+			  : STRING_BYTES_BOUND);
       SAFE_ALLOCA (dst, void *, o_size);
       o = dst;
 
       for (i = i_byte = 0; i < size; i++, i_byte += len)
 	{
-	  if ((o - dst) + MAX_MULTIBYTE_LENGTH > o_size)
-	    { /* Not enough space for the next char: grow the destination.  */
-	      unsigned char *old_dst = dst;
-	      o_size += o_size;	/* Probably overkill, but extremely rare.  */
-	      SAFE_ALLOCA (dst, void *, o_size);
-	      memcpy (dst, old_dst, o - old_dst);
-	      o = dst + (o - old_dst);
-	    }
+	  if (o_size - (o - dst) < MAX_MULTIBYTE_LENGTH)
+	    string_overflow ();
 	  c = STRING_CHAR_AND_LENGTH (SDATA (obj) + i_byte, len);
 	  if (inword && flag != CASE_CAPITALIZE_UP)
 	    c = downcase (c);
@@ -199,14 +193,14 @@ casify_region (enum case_action flag, Lisp_Object b, Lisp_Object e)
   register int c;
   register int inword = flag == CASE_DOWN;
   register int multibyte = !NILP (BVAR (current_buffer, enable_multibyte_characters));
-  EMACS_INT start, end;
-  EMACS_INT start_byte;
+  ptrdiff_t start, end;
+  ptrdiff_t start_byte;
 
   /* Position of first and last changes.  */
-  EMACS_INT first = -1, last IF_LINT (= 0);
+  ptrdiff_t first = -1, last IF_LINT (= 0);
 
-  EMACS_INT opoint = PT;
-  EMACS_INT opoint_byte = PT_BYTE;
+  ptrdiff_t opoint = PT;
+  ptrdiff_t opoint_byte = PT_BYTE;
 
   if (EQ (b, e))
     /* Not modifying because nothing marked */
@@ -351,10 +345,10 @@ character positions to operate on.  */)
 }
 
 static Lisp_Object
-operate_on_word (Lisp_Object arg, EMACS_INT *newpoint)
+operate_on_word (Lisp_Object arg, ptrdiff_t *newpoint)
 {
   Lisp_Object val;
-  EMACS_INT farend;
+  ptrdiff_t farend;
   EMACS_INT iarg;
 
   CHECK_NUMBER (arg);
@@ -376,7 +370,7 @@ See also `capitalize-word'.  */)
   (Lisp_Object arg)
 {
   Lisp_Object beg, end;
-  EMACS_INT newpoint;
+  ptrdiff_t newpoint;
   XSETFASTINT (beg, PT);
   end = operate_on_word (arg, &newpoint);
   casify_region (CASE_UP, beg, end);
@@ -390,7 +384,7 @@ With negative argument, convert previous words but do not move.  */)
   (Lisp_Object arg)
 {
   Lisp_Object beg, end;
-  EMACS_INT newpoint;
+  ptrdiff_t newpoint;
   XSETFASTINT (beg, PT);
   end = operate_on_word (arg, &newpoint);
   casify_region (CASE_DOWN, beg, end);
@@ -406,7 +400,7 @@ With negative argument, capitalize previous words but do not move.  */)
   (Lisp_Object arg)
 {
   Lisp_Object beg, end;
-  EMACS_INT newpoint;
+  ptrdiff_t newpoint;
   XSETFASTINT (beg, PT);
   end = operate_on_word (arg, &newpoint);
   casify_region (CASE_CAPITALIZE, beg, end);
diff --git a/src/casetab.c b/src/casetab.c
index 3433b313c03..6b639147b7b 100644
--- a/src/casetab.c
+++ b/src/casetab.c
@@ -195,7 +195,7 @@ set_identity (Lisp_Object table, Lisp_Object c, Lisp_Object elt)
   if (NATNUMP (elt))
     {
       int from;
-      unsigned to;
+      int to;
 
       if (CONSP (c))
 	{
@@ -204,7 +204,7 @@ set_identity (Lisp_Object table, Lisp_Object c, Lisp_Object elt)
 	}
       else
 	from = to = XINT (c);
-      for (to++; from < to; from++)
+      for (; from <= to; from++)
 	CHAR_TABLE_SET (table, from, make_number (from));
     }
 }
@@ -219,8 +219,7 @@ shuffle (Lisp_Object table, Lisp_Object c, Lisp_Object elt)
 {
   if (NATNUMP (elt))
     {
-      int from;
-      unsigned to;
+      int from, to;
 
       if (CONSP (c))
 	{
@@ -230,7 +229,7 @@ shuffle (Lisp_Object table, Lisp_Object c, Lisp_Object elt)
       else
 	from = to = XINT (c);
 
-      for (to++; from < to; from++)
+      for (; from <= to; from++)
 	{
 	  Lisp_Object tem = Faref (table, elt);
 	  Faset (table, elt, make_number (from));
diff --git a/src/category.c b/src/category.c
index a822bb654b0..0ab2a70f8a4 100644
--- a/src/category.c
+++ b/src/category.c
@@ -304,7 +304,7 @@ DEFUN ("char-category-set", Fchar_category_set, Schar_category_set, 1, 1, 0,
 usage: (char-category-set CHAR)  */)
   (Lisp_Object ch)
 {
-  CHECK_NUMBER (ch);
+  CHECK_CHARACTER (ch);
   return CATEGORY_SET (XFASTINT (ch));
 }
 
diff --git a/src/category.h b/src/category.h
index 737198cc964..423270100b3 100644
--- a/src/category.h
+++ b/src/category.h
@@ -53,8 +53,7 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
    The second extra slot is a version number of the category table.
    But, for the moment, we are not using this slot.  */
 
-#define CATEGORYP(x) \
-  (INTEGERP ((x)) && XFASTINT ((x)) >= 0x20 && XFASTINT ((x)) <= 0x7E)
+#define CATEGORYP(x) RANGED_INTEGERP (0x20, x, 0x7E)
 
 #define CHECK_CATEGORY(x) \
   CHECK_TYPE (CATEGORYP (x), Qcategoryp, x)
diff --git a/src/ccl.c b/src/ccl.c
index cb96eece5ee..ffd412bba3e 100644
--- a/src/ccl.c
+++ b/src/ccl.c
@@ -762,9 +762,6 @@ while (0)
 #define GET_CCL_CODE(code, ccl_prog, ic)			\
   GET_CCL_RANGE (code, ccl_prog, ic, CCL_CODE_MIN, CCL_CODE_MAX)
 
-#define GET_CCL_INT(var, ccl_prog, ic)				\
-  GET_CCL_RANGE (var, ccl_prog, ic, INT_MIN, INT_MAX)
-
 #define IN_INT_RANGE(val) ASCENDING_ORDER (INT_MIN, val, INT_MAX)
 
 /* Encode one character CH to multibyte form and write to the current
@@ -945,14 +942,14 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 	  break;
 
 	case CCL_SetConst:	/* 00000000000000000000rrrXXXXX */
-	  GET_CCL_INT (reg[rrr], ccl_prog, ic++);
+	  reg[rrr] = XINT (ccl_prog[ic++]);
 	  break;
 
 	case CCL_SetArray:	/* CCCCCCCCCCCCCCCCCCCCRRRrrrXXXXX */
 	  i = reg[RRR];
 	  j = field1 >> 3;
 	  if (0 <= i && i < j)
-	    GET_CCL_INT (reg[rrr], ccl_prog, ic + i);
+	    reg[rrr] = XINT (ccl_prog[ic + i]);
 	  ic += j;
 	  break;
 
@@ -980,13 +977,13 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 	  break;
 
 	case CCL_WriteConstJump: /* A--D--D--R--E--S--S-000XXXXX */
-	  GET_CCL_INT (i, ccl_prog, ic);
+	  i = XINT (ccl_prog[ic]);
 	  CCL_WRITE_CHAR (i);
 	  ic += ADDR;
 	  break;
 
 	case CCL_WriteConstReadJump: /* A--D--D--R--E--S--S-rrrXXXXX */
-	  GET_CCL_INT (i, ccl_prog, ic);
+	  i = XINT (ccl_prog[ic]);
 	  CCL_WRITE_CHAR (i);
 	  ic++;
 	  CCL_READ_CHAR (reg[rrr]);
@@ -994,17 +991,17 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 	  break;
 
 	case CCL_WriteStringJump: /* A--D--D--R--E--S--S-000XXXXX */
-	  GET_CCL_INT (j, ccl_prog, ic++);
+	  j = XINT (ccl_prog[ic++]);
 	  CCL_WRITE_STRING (j);
 	  ic += ADDR - 1;
 	  break;
 
 	case CCL_WriteArrayReadJump: /* A--D--D--R--E--S--S-rrrXXXXX */
 	  i = reg[rrr];
-	  GET_CCL_INT (j, ccl_prog, ic);
+	  j = XINT (ccl_prog[ic]);
 	  if (0 <= i && i < j)
 	    {
-	      GET_CCL_INT (i, ccl_prog, ic + 1 + i);
+	      i = XINT (ccl_prog[ic + 1 + i]);
 	      CCL_WRITE_CHAR (i);
 	    }
 	  ic += j + 2;
@@ -1022,11 +1019,8 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 	  /* fall through ... */
 	case CCL_Branch:	/* CCCCCCCCCCCCCCCCCCCCrrrXXXXX */
 	{
-	  int incr;
-	  GET_CCL_INT (incr, ccl_prog,
-		       ic + (0 <= reg[rrr] && reg[rrr] < field1
-			     ? reg[rrr]
-			     : field1));
+	  int ioff = 0 <= reg[rrr] && reg[rrr] < field1 ? reg[rrr] : field1;
+	  int incr = XINT (ccl_prog[ic + ioff]);
 	  ic += incr;
 	}
 	  break;
@@ -1045,7 +1039,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 	case CCL_WriteExprConst:  /* 1:00000OPERATION000RRR000XXXXX */
 	  rrr = 7;
 	  i = reg[RRR];
-	  GET_CCL_INT (j, ccl_prog, ic);
+	  j = XINT (ccl_prog[ic]);
 	  op = field1 >> 6;
 	  jump_address = ic + 1;
 	  goto ccl_set_expr;
@@ -1078,7 +1072,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 	    /* If FFF is nonzero, the CCL program ID is in the
                following code.  */
 	    if (rrr)
-	      GET_CCL_INT (prog_id, ccl_prog, ic++);
+	      prog_id = XINT (ccl_prog[ic++]);
 	    else
 	      prog_id = field1;
 
@@ -1121,7 +1115,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 	  i = reg[rrr];
 	  if (0 <= i && i < field1)
 	    {
-	      GET_CCL_INT (j, ccl_prog, ic + i);
+	      j = XINT (ccl_prog[ic + i]);
 	      CCL_WRITE_CHAR (j);
 	    }
 	  ic += field1;
@@ -1146,7 +1140,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 	  CCL_SUCCESS;
 
 	case CCL_ExprSelfConst: /* 00000OPERATION000000rrrXXXXX */
-	  GET_CCL_INT (i, ccl_prog, ic++);
+	  i = XINT (ccl_prog[ic++]);
 	  op = field1 >> 6;
 	  goto ccl_expr_self;
 
@@ -1182,7 +1176,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 
 	case CCL_SetExprConst:	/* 00000OPERATION000RRRrrrXXXXX */
 	  i = reg[RRR];
-	  GET_CCL_INT (j, ccl_prog, ic++);
+	  j = XINT (ccl_prog[ic++]);
 	  op = field1 >> 6;
 	  jump_address = ic;
 	  goto ccl_set_expr;
@@ -1199,8 +1193,8 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 	case CCL_JumpCondExprConst: /* A--D--D--R--E--S--S-rrrXXXXX */
 	  i = reg[rrr];
 	  jump_address = ic + ADDR;
-	  GET_CCL_INT (op, ccl_prog, ic++);
-	  GET_CCL_INT (j, ccl_prog, ic++);
+	  op = XINT (ccl_prog[ic++]);
+	  j = XINT (ccl_prog[ic++]);
 	  rrr = 7;
 	  goto ccl_set_expr;
 
@@ -1209,7 +1203,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 	case CCL_JumpCondExprReg:
 	  i = reg[rrr];
 	  jump_address = ic + ADDR;
-	  GET_CCL_INT (op, ccl_prog, ic++);
+	  op = XINT (ccl_prog[ic++]);
 	  GET_CCL_RANGE (j, ccl_prog, ic++, 0, 7);
 	  j = reg[j];
 	  rrr = 7;
@@ -1290,7 +1284,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 
 	    case CCL_TranslateCharacterConstTbl:
 	      {
-		EMACS_INT eop;
+		ptrdiff_t eop;
 		GET_CCL_RANGE (eop, ccl_prog, ic++, 0,
 			       (VECTORP (Vtranslation_table_vector)
 				? ASIZE (Vtranslation_table_vector)
@@ -1356,10 +1350,11 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 	    case CCL_IterateMultipleMap:
 	      {
 		Lisp_Object map, content, attrib, value;
-		EMACS_INT point, size;
+		EMACS_INT point;
+		ptrdiff_t size;
 		int fin_ic;
 
-		GET_CCL_INT (j, ccl_prog, ic++); /* number of maps. */
+		j = XINT (ccl_prog[ic++]); /* number of maps. */
 		fin_ic = ic + j;
 		op = reg[rrr];
 		if ((j > reg[RRR]) && (j >= 0))
@@ -1471,7 +1466,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 		stack_idx_of_map_multiple = 0;
 
 		/* Get number of maps and separators.  */
-		GET_CCL_INT (map_set_rest_length, ccl_prog, ic++);
+		map_set_rest_length = XINT (ccl_prog[ic++]);
 
 		fin_ic = ic + map_set_rest_length;
 		op = reg[rrr];
@@ -1540,7 +1535,7 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 		do {
 		  for (;map_set_rest_length > 0;i++, ic++, map_set_rest_length--)
 		    {
-		      GET_CCL_INT (point, ccl_prog, ic);
+		      point = XINT (ccl_prog[ic]);
 		      if (point < 0)
 			{
 			  /* +1 is for including separator. */
@@ -1677,20 +1672,20 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
 		    reg[RRR] = -1;
 		    break;
 		  }
-		point = XINT (AREF (map, 0));
-		point = op - point + 1;
+		point = op - XINT (AREF (map, 0)) + 1;
 		reg[RRR] = 0;
 		content = AREF (map, point);
 		if (NILP (content))
 		  reg[RRR] = -1;
-		else if (INTEGERP (content))
+		else if (TYPE_RANGED_INTEGERP (int, content))
 		  reg[rrr] = XINT (content);
 		else if (EQ (content, Qt));
 		else if (CONSP (content))
 		  {
 		    attrib = XCAR (content);
 		    value = XCDR (content);
-		    if (!INTEGERP (attrib) || !INTEGERP (value))
+		    if (!INTEGERP (attrib)
+			|| !TYPE_RANGED_INTEGERP (int, value))
 		      continue;
 		    reg[rrr] = XINT (value);
 		    break;
@@ -1810,8 +1805,8 @@ ccl_driver (struct ccl_program *ccl, int *source, int *destination, int src_size
    function converts symbols of code conversion maps and character
    translation tables embeded in the CCL code into their ID numbers.
 
-   The return value is a vector (CCL itself or a new vector in which
-   all symbols are resolved), Qt if resolving of some symbol failed,
+   The return value is a new vector in which all symbols are resolved,
+   Qt if resolving of some symbol failed,
    or nil if CCL contains invalid data.  */
 
 static Lisp_Object
@@ -1820,13 +1815,15 @@ resolve_symbol_ccl_program (Lisp_Object ccl)
   int i, veclen, unresolved = 0;
   Lisp_Object result, contents, val;
 
-  result = ccl;
+  if (! (CCL_HEADER_MAIN < ASIZE (ccl) && ASIZE (ccl) <= INT_MAX))
+    return Qnil;
+  result = Fcopy_sequence (ccl);
   veclen = ASIZE (result);
 
   for (i = 0; i < veclen; i++)
     {
       contents = AREF (result, i);
-      if (INTEGERP (contents))
+      if (TYPE_RANGED_INTEGERP (int, contents))
 	continue;
       else if (CONSP (contents)
 	       && SYMBOLP (XCAR (contents))
@@ -1835,12 +1832,8 @@ resolve_symbol_ccl_program (Lisp_Object ccl)
 	  /* This is the new style for embedding symbols.  The form is
 	     (SYMBOL . PROPERTY).  (get SYMBOL PROPERTY) should give
 	     an index number.  */
-
-	  if (EQ (result, ccl))
-	    result =  Fcopy_sequence (ccl);
-
 	  val = Fget (XCAR (contents), XCDR (contents));
-	  if (NATNUMP (val))
+	  if (RANGED_INTEGERP (0, val, INT_MAX))
 	    ASET (result, i, val);
 	  else
 	    unresolved = 1;
@@ -1851,21 +1844,18 @@ resolve_symbol_ccl_program (Lisp_Object ccl)
 	  /* This is the old style for embedding symbols.  This style
              may lead to a bug if, for instance, a translation table
              and a code conversion map have the same name.  */
-	  if (EQ (result, ccl))
-	    result = Fcopy_sequence (ccl);
-
 	  val = Fget (contents, Qtranslation_table_id);
-	  if (NATNUMP (val))
+	  if (RANGED_INTEGERP (0, val, INT_MAX))
 	    ASET (result, i, val);
 	  else
 	    {
 	      val = Fget (contents, Qcode_conversion_map_id);
-	      if (NATNUMP (val))
+	      if (RANGED_INTEGERP (0, val, INT_MAX))
 		ASET (result, i, val);
 	      else
 		{
 		  val = Fget (contents, Qccl_program_idx);
-		  if (NATNUMP (val))
+		  if (RANGED_INTEGERP (0, val, INT_MAX))
 		    ASET (result, i, val);
 		  else
 		    unresolved = 1;
@@ -1876,6 +1866,11 @@ resolve_symbol_ccl_program (Lisp_Object ccl)
       return Qnil;
     }
 
+  if (! (0 <= XINT (AREF (result, CCL_HEADER_BUF_MAG))
+	 && ASCENDING_ORDER (0, XINT (AREF (result, CCL_HEADER_EOF)),
+			     ASIZE (ccl))))
+    return Qnil;
+
   return (unresolved ? Qt : result);
 }
 
@@ -1886,7 +1881,7 @@ resolve_symbol_ccl_program (Lisp_Object ccl)
    symbols, return Qnil.  */
 
 static Lisp_Object
-ccl_get_compiled_code (Lisp_Object ccl_prog, int *idx)
+ccl_get_compiled_code (Lisp_Object ccl_prog, ptrdiff_t *idx)
 {
   Lisp_Object val, slot;
 
@@ -2015,7 +2010,7 @@ programs.  */)
     error ("Length of vector REGISTERS is not 8");
 
   for (i = 0; i < 8; i++)
-    ccl.reg[i] = (INTEGERP (AREF (reg, i))
+    ccl.reg[i] = (TYPE_RANGED_INTEGERP (int, AREF (reg, i))
 		  ? XINT (AREF (reg, i))
 		  : 0);
 
@@ -2084,7 +2079,7 @@ usage: (ccl-execute-on-string CCL-PROGRAM STATUS STRING &optional CONTINUE UNIBY
     {
       if (NILP (AREF (status, i)))
 	ASET (status, i, make_number (0));
-      if (INTEGERP (AREF (status, i)))
+      if (TYPE_RANGED_INTEGERP (int, AREF (status, i)))
 	ccl.reg[i] = XINT (AREF (status, i));
     }
   if (INTEGERP (AREF (status, i)))
@@ -2187,8 +2182,8 @@ If it is nil, just reserve NAME as a CCL program name.
 Return index number of the registered CCL program.  */)
      (Lisp_Object name, Lisp_Object ccl_prog)
 {
-  int len = ASIZE (Vccl_program_table);
-  int idx;
+  ptrdiff_t len = ASIZE (Vccl_program_table);
+  ptrdiff_t idx;
   Lisp_Object resolved;
 
   CHECK_SYMBOL (name);
@@ -2229,7 +2224,7 @@ Return index number of the registered CCL program.  */)
 
   if (idx == len)
     /* Extend the table.  */
-    Vccl_program_table = larger_vector (Vccl_program_table, len * 2, Qnil);
+    Vccl_program_table = larger_vector (Vccl_program_table, 1, -1);
 
   {
     Lisp_Object elt;
@@ -2262,8 +2257,8 @@ DEFUN ("register-code-conversion-map", Fregister_code_conversion_map,
 Return index number of the registered map.  */)
   (Lisp_Object symbol, Lisp_Object map)
 {
-  int len = ASIZE (Vcode_conversion_map_vector);
-  int i;
+  ptrdiff_t len = ASIZE (Vcode_conversion_map_vector);
+  ptrdiff_t i;
   Lisp_Object idx;
 
   CHECK_SYMBOL (symbol);
@@ -2288,7 +2283,7 @@ Return index number of the registered map.  */)
 
   if (i == len)
     Vcode_conversion_map_vector = larger_vector (Vcode_conversion_map_vector,
-						 len * 2, Qnil);
+						 1, -1);
 
   idx = make_number (i);
   Fput (symbol, Qcode_conversion_map, map);
diff --git a/src/ccl.h b/src/ccl.h
index e86154352a3..f55b295027e 100644
--- a/src/ccl.h
+++ b/src/ccl.h
@@ -37,7 +37,7 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 /* Structure to hold information about running CCL code.  Read
    comments in the file ccl.c for the detail of each field.  */
 struct ccl_program {
-  int idx;			/* Index number of the CCL program.
+  ptrdiff_t idx;		/* Index number of the CCL program.
 				   -1 means that the program was given
 				   by a vector, not by a program
 				   name.  */
diff --git a/src/character.c b/src/character.c
index fb9b8a9b93e..1e8c75d2597 100644
--- a/src/character.c
+++ b/src/character.c
@@ -67,8 +67,8 @@ static Lisp_Object Qchar_script_table;
 /* If character code C has modifier masks, reflect them to the
    character code if possible.  Return the resulting code.  */
 
-int
-char_resolve_modifier_mask (int c)
+EMACS_INT
+char_resolve_modifier_mask (EMACS_INT c)
 {
   /* A non-ASCII character can't reflect modifier bits to the code.  */
   if (! ASCII_CHAR_P ((c & ~CHAR_MODIFIER_MASK)))
@@ -340,12 +340,12 @@ usage: (char-width CHAR)  */)
    characters and bytes of the substring in *NCHARS and *NBYTES
    respectively.  */
 
-EMACS_INT
-c_string_width (const unsigned char *str, EMACS_INT len, int precision,
-		EMACS_INT *nchars, EMACS_INT *nbytes)
+ptrdiff_t
+c_string_width (const unsigned char *str, ptrdiff_t len, int precision,
+		ptrdiff_t *nchars, ptrdiff_t *nbytes)
 {
-  EMACS_INT i = 0, i_byte = 0;
-  EMACS_INT width = 0;
+  ptrdiff_t i = 0, i_byte = 0;
+  ptrdiff_t width = 0;
   struct Lisp_Char_Table *dp = buffer_display_table ();
 
   while (i_byte < len)
@@ -392,8 +392,8 @@ c_string_width (const unsigned char *str, EMACS_INT len, int precision,
    current buffer.  The width is measured by how many columns it
    occupies on the screen.  */
 
-EMACS_INT
-strwidth (const char *str, EMACS_INT len)
+ptrdiff_t
+strwidth (const char *str, ptrdiff_t len)
 {
   return c_string_width ((const unsigned char *) str, len, -1, NULL, NULL);
 }
@@ -405,26 +405,26 @@ strwidth (const char *str, EMACS_INT len)
    PRECISION, and set number of characters and bytes of the substring
    in *NCHARS and *NBYTES respectively.  */
 
-EMACS_INT
-lisp_string_width (Lisp_Object string, EMACS_INT precision,
-		   EMACS_INT *nchars, EMACS_INT *nbytes)
+ptrdiff_t
+lisp_string_width (Lisp_Object string, ptrdiff_t precision,
+		   ptrdiff_t *nchars, ptrdiff_t *nbytes)
 {
-  EMACS_INT len = SCHARS (string);
+  ptrdiff_t len = SCHARS (string);
   /* This set multibyte to 0 even if STRING is multibyte when it
      contains only ascii and eight-bit-graphic, but that's
      intentional.  */
   int multibyte = len < SBYTES (string);
   unsigned char *str = SDATA (string);
-  EMACS_INT i = 0, i_byte = 0;
-  EMACS_INT width = 0;
+  ptrdiff_t i = 0, i_byte = 0;
+  ptrdiff_t width = 0;
   struct Lisp_Char_Table *dp = buffer_display_table ();
 
   while (i < len)
     {
-      EMACS_INT chars, bytes, thiswidth;
+      ptrdiff_t chars, bytes, thiswidth;
       Lisp_Object val;
       ptrdiff_t cmp_id;
-      EMACS_INT ignore, end;
+      ptrdiff_t ignore, end;
 
       if (find_composition (i, -1, &ignore, &end, &val, string)
 	  && ((cmp_id = get_composition_id (i, i_byte, end - i, val, string))
@@ -511,8 +511,8 @@ usage: (string-width STRING)  */)
    However, if the current buffer has enable-multibyte-characters =
    nil, we treat each byte as a character.  */
 
-EMACS_INT
-chars_in_text (const unsigned char *ptr, EMACS_INT nbytes)
+ptrdiff_t
+chars_in_text (const unsigned char *ptr, ptrdiff_t nbytes)
 {
   /* current_buffer is null at early stages of Emacs initialization.  */
   if (current_buffer == 0
@@ -527,15 +527,15 @@ chars_in_text (const unsigned char *ptr, EMACS_INT nbytes)
    sequences while assuming that there's no invalid sequence.  It
    ignores enable-multibyte-characters.  */
 
-EMACS_INT
-multibyte_chars_in_text (const unsigned char *ptr, EMACS_INT nbytes)
+ptrdiff_t
+multibyte_chars_in_text (const unsigned char *ptr, ptrdiff_t nbytes)
 {
   const unsigned char *endp = ptr + nbytes;
-  EMACS_INT chars = 0;
+  ptrdiff_t chars = 0;
 
   while (ptr < endp)
     {
-      EMACS_INT len = MULTIBYTE_LENGTH (ptr, endp);
+      int len = MULTIBYTE_LENGTH (ptr, endp);
 
       if (len == 0)
 	abort ();
@@ -553,11 +553,12 @@ multibyte_chars_in_text (const unsigned char *ptr, EMACS_INT nbytes)
    represented by 2-byte in a multibyte text.  */
 
 void
-parse_str_as_multibyte (const unsigned char *str, EMACS_INT len,
-			EMACS_INT *nchars, EMACS_INT *nbytes)
+parse_str_as_multibyte (const unsigned char *str, ptrdiff_t len,
+			ptrdiff_t *nchars, ptrdiff_t *nbytes)
 {
   const unsigned char *endp = str + len;
-  EMACS_INT n, chars = 0, bytes = 0;
+  int n;
+  ptrdiff_t chars = 0, bytes = 0;
 
   if (len >= MAX_MULTIBYTE_LENGTH)
     {
@@ -595,13 +596,13 @@ parse_str_as_multibyte (const unsigned char *str, EMACS_INT len,
    area and that is enough.  Return the number of bytes of the
    resulting text.  */
 
-EMACS_INT
-str_as_multibyte (unsigned char *str, EMACS_INT len, EMACS_INT nbytes,
-		  EMACS_INT *nchars)
+ptrdiff_t
+str_as_multibyte (unsigned char *str, ptrdiff_t len, ptrdiff_t nbytes,
+		  ptrdiff_t *nchars)
 {
   unsigned char *p = str, *endp = str + nbytes;
   unsigned char *to;
-  EMACS_INT chars = 0;
+  ptrdiff_t chars = 0;
   int n;
 
   if (nbytes >= MAX_MULTIBYTE_LENGTH)
@@ -672,11 +673,11 @@ str_as_multibyte (unsigned char *str, EMACS_INT len, EMACS_INT nbytes,
    bytes it may ocupy when converted to multibyte string by
    `str_to_multibyte'.  */
 
-EMACS_INT
-count_size_as_multibyte (const unsigned char *str, EMACS_INT len)
+ptrdiff_t
+count_size_as_multibyte (const unsigned char *str, ptrdiff_t len)
 {
   const unsigned char *endp = str + len;
-  EMACS_INT bytes;
+  ptrdiff_t bytes;
 
   for (bytes = 0; str < endp; str++)
     {
@@ -695,8 +696,8 @@ count_size_as_multibyte (const unsigned char *str, EMACS_INT len)
    that we can use LEN bytes at STR as a work area and that is
    enough.  */
 
-EMACS_INT
-str_to_multibyte (unsigned char *str, EMACS_INT len, EMACS_INT bytes)
+ptrdiff_t
+str_to_multibyte (unsigned char *str, ptrdiff_t len, ptrdiff_t bytes)
 {
   unsigned char *p = str, *endp = str + bytes;
   unsigned char *to;
@@ -724,8 +725,8 @@ str_to_multibyte (unsigned char *str, EMACS_INT len, EMACS_INT bytes)
    actually converts characters in the range 0x80..0xFF to
    unibyte.  */
 
-EMACS_INT
-str_as_unibyte (unsigned char *str, EMACS_INT bytes)
+ptrdiff_t
+str_as_unibyte (unsigned char *str, ptrdiff_t bytes)
 {
   const unsigned char *p = str, *endp = str + bytes;
   unsigned char *to;
@@ -766,10 +767,10 @@ str_as_unibyte (unsigned char *str, EMACS_INT bytes)
    of that character code.
    Note: Currently the arg ACCEPT_LATIN_1 is not used.  */
 
-EMACS_INT
-str_to_unibyte (const unsigned char *src, unsigned char *dst, EMACS_INT chars, int accept_latin_1)
+ptrdiff_t
+str_to_unibyte (const unsigned char *src, unsigned char *dst, ptrdiff_t chars, int accept_latin_1)
 {
-  EMACS_INT i;
+  ptrdiff_t i;
 
   for (i = 0; i < chars; i++)
     {
@@ -786,14 +787,14 @@ str_to_unibyte (const unsigned char *src, unsigned char *dst, EMACS_INT chars, i
 }
 
 
-static EMACS_INT
+static ptrdiff_t
 string_count_byte8 (Lisp_Object string)
 {
   int multibyte = STRING_MULTIBYTE (string);
-  EMACS_INT nbytes = SBYTES (string);
+  ptrdiff_t nbytes = SBYTES (string);
   unsigned char *p = SDATA (string);
   unsigned char *pend = p + nbytes;
-  EMACS_INT count = 0;
+  ptrdiff_t count = 0;
   int c, len;
 
   if (multibyte)
@@ -819,10 +820,10 @@ string_count_byte8 (Lisp_Object string)
 Lisp_Object
 string_escape_byte8 (Lisp_Object string)
 {
-  EMACS_INT nchars = SCHARS (string);
-  EMACS_INT nbytes = SBYTES (string);
+  ptrdiff_t nchars = SCHARS (string);
+  ptrdiff_t nbytes = SBYTES (string);
   int multibyte = STRING_MULTIBYTE (string);
-  EMACS_INT byte8_count;
+  ptrdiff_t byte8_count;
   const unsigned char *src, *src_end;
   unsigned char *dst;
   Lisp_Object val;
@@ -933,7 +934,7 @@ usage: (unibyte-string &rest BYTES)  */)
 
   for (i = 0; i < n; i++)
     {
-      CHECK_NATNUM (args[i]);
+      CHECK_CHARACTER (args[i]);
       c = XFASTINT (args[i]);
       if (c >= 256)
 	args_out_of_range_3 (args[i], make_number (0), make_number (255));
@@ -953,7 +954,7 @@ code.  Unresolved modifiers are kept in the value.
 usage: (char-resolve-modifiers CHAR)  */)
   (Lisp_Object character)
 {
-  int c;
+  EMACS_INT c;
 
   CHECK_NUMBER (character);
   c = XINT (character);
@@ -973,7 +974,7 @@ character is not ASCII nor 8-bit character, an error is signalled.  */)
   (Lisp_Object position, Lisp_Object string)
 {
   int c;
-  EMACS_INT pos;
+  ptrdiff_t pos;
   unsigned char *p;
 
   if (NILP (string))
diff --git a/src/character.h b/src/character.h
index 09bcf17ab96..2e1372eaf94 100644
--- a/src/character.h
+++ b/src/character.h
@@ -655,7 +655,7 @@ typedef enum {
   UNICODE_CATEGORY_Cn
 } unicode_category_t;
 
-extern int char_resolve_modifier_mask (int);
+extern EMACS_INT char_resolve_modifier_mask (EMACS_INT);
 extern int char_string (unsigned, unsigned char *);
 extern int string_char (const unsigned char *,
                         const unsigned char **, int *);
@@ -663,19 +663,19 @@ extern int string_char (const unsigned char *,
 extern int translate_char (Lisp_Object, int c);
 extern int char_printable_p (int c);
 extern void parse_str_as_multibyte (const unsigned char *,
-				    EMACS_INT, EMACS_INT *, EMACS_INT *);
-extern EMACS_INT count_size_as_multibyte (const unsigned char *, EMACS_INT);
-extern EMACS_INT str_as_multibyte (unsigned char *, EMACS_INT, EMACS_INT,
-			     EMACS_INT *);
-extern EMACS_INT str_to_multibyte (unsigned char *, EMACS_INT, EMACS_INT);
-extern EMACS_INT str_as_unibyte (unsigned char *, EMACS_INT);
-extern EMACS_INT str_to_unibyte (const unsigned char *, unsigned char *,
-                                 EMACS_INT, int);
-extern EMACS_INT strwidth (const char *, EMACS_INT);
-extern EMACS_INT c_string_width (const unsigned char *, EMACS_INT, int,
-				 EMACS_INT *, EMACS_INT *);
-extern EMACS_INT lisp_string_width (Lisp_Object, EMACS_INT,
-				    EMACS_INT *, EMACS_INT *);
+				    ptrdiff_t, ptrdiff_t *, ptrdiff_t *);
+extern ptrdiff_t count_size_as_multibyte (const unsigned char *, ptrdiff_t);
+extern ptrdiff_t str_as_multibyte (unsigned char *, ptrdiff_t, ptrdiff_t,
+				   ptrdiff_t *);
+extern ptrdiff_t str_to_multibyte (unsigned char *, ptrdiff_t, ptrdiff_t);
+extern ptrdiff_t str_as_unibyte (unsigned char *, ptrdiff_t);
+extern ptrdiff_t str_to_unibyte (const unsigned char *, unsigned char *,
+                                 ptrdiff_t, int);
+extern ptrdiff_t strwidth (const char *, ptrdiff_t);
+extern ptrdiff_t c_string_width (const unsigned char *, ptrdiff_t, int,
+				 ptrdiff_t *, ptrdiff_t *);
+extern ptrdiff_t lisp_string_width (Lisp_Object, ptrdiff_t,
+				    ptrdiff_t *, ptrdiff_t *);
 
 extern Lisp_Object Qcharacterp;
 extern Lisp_Object Vchar_unify_table;
diff --git a/src/charset.c b/src/charset.c
index 6967b9df611..9d58d29d05c 100644
--- a/src/charset.c
+++ b/src/charset.c
@@ -482,7 +482,8 @@ load_charset_map_from_file (struct charset *charset, Lisp_Object mapfile, int co
   FILE *fp;
   Lisp_Object suffixes;
   struct charset_map_entries *head, *entries;
-  int n_entries, count;
+  int n_entries;
+  ptrdiff_t count;
   USE_SAFE_ALLOCA;
 
   suffixes = Fcons (build_string (".map"),
@@ -534,8 +535,9 @@ load_charset_map_from_file (struct charset *charset, Lisp_Object mapfile, int co
 		       sizeof (struct charset_map_entries));
 	  entries = entries->next;
 	  memset (entries, 0, sizeof (struct charset_map_entries));
+	  n_entries = 0;
 	}
-      idx = n_entries % 0x10000;
+      idx = n_entries;
       entries->entry[idx].from = from;
       entries->entry[idx].to = to;
       entries->entry[idx].c = c;
@@ -576,7 +578,7 @@ load_charset_map_from_vector (struct charset *charset, Lisp_Object vec, int cont
     {
       Lisp_Object val, val2;
       unsigned from, to;
-      int c;
+      EMACS_INT c;
       int idx;
 
       val = AREF (vec, i);
@@ -584,16 +586,11 @@ load_charset_map_from_vector (struct charset *charset, Lisp_Object vec, int cont
 	{
 	  val2 = XCDR (val);
 	  val = XCAR (val);
-	  CHECK_NATNUM (val);
-	  CHECK_NATNUM (val2);
 	  from = XFASTINT (val);
 	  to = XFASTINT (val2);
 	}
       else
-	{
-	  CHECK_NATNUM (val);
-	  from = to = XFASTINT (val);
-	}
+	from = to = XFASTINT (val);
       val = AREF (vec, i + 1);
       CHECK_NATNUM (val);
       c = XFASTINT (val);
@@ -821,7 +818,6 @@ range of code points (in CHARSET) of target characters.  */)
     from = CHARSET_MIN_CODE (cs);
   else
     {
-      CHECK_NATNUM (from_code);
       from = XINT (from_code);
       if (from < CHARSET_MIN_CODE (cs))
 	from = CHARSET_MIN_CODE (cs);
@@ -830,7 +826,6 @@ range of code points (in CHARSET) of target characters.  */)
     to = CHARSET_MAX_CODE (cs);
   else
     {
-      CHECK_NATNUM (to_code);
       to = XINT (to_code);
       if (to > CHARSET_MAX_CODE (cs))
 	to = CHARSET_MAX_CODE (cs);
@@ -876,12 +871,15 @@ usage: (define-charset-internal ...)  */)
   val = args[charset_arg_code_space];
   for (i = 0, dimension = 0, nchars = 1; ; i++)
     {
+      Lisp_Object min_byte_obj, max_byte_obj;
       int min_byte, max_byte;
 
-      min_byte = XINT (Faref (val, make_number (i * 2)));
-      max_byte = XINT (Faref (val, make_number (i * 2 + 1)));
-      if (min_byte < 0 || min_byte > max_byte || max_byte >= 256)
-	error ("Invalid :code-space value");
+      min_byte_obj = Faref (val, make_number (i * 2));
+      max_byte_obj = Faref (val, make_number (i * 2 + 1));
+      CHECK_RANGED_INTEGER (0, min_byte_obj, 255);
+      min_byte = XINT (min_byte_obj);
+      CHECK_RANGED_INTEGER (min_byte, max_byte_obj, 255);
+      max_byte = XINT (max_byte_obj);
       charset.code_space[i * 4] = min_byte;
       charset.code_space[i * 4 + 1] = max_byte;
       charset.code_space[i * 4 + 2] = max_byte - min_byte + 1;
@@ -898,10 +896,8 @@ usage: (define-charset-internal ...)  */)
     charset.dimension = dimension;
   else
     {
-      CHECK_NATNUM (val);
+      CHECK_RANGED_INTEGER (1, val, 4);
       charset.dimension = XINT (val);
-      if (charset.dimension < 1 || charset.dimension > 4)
-	args_out_of_range_3 (val, make_number (1), make_number (4));
     }
 
   charset.code_linear_p
@@ -968,18 +964,14 @@ usage: (define-charset-internal ...)  */)
 	charset.invalid_code = 0;
       else
 	{
-	  XSETINT (val, charset.max_code + 1);
-	  if (XINT (val) == charset.max_code + 1)
+	  if (charset.max_code < min (UINT_MAX, MOST_POSITIVE_FIXNUM))
 	    charset.invalid_code = charset.max_code + 1;
 	  else
 	    error ("Attribute :invalid-code must be specified");
 	}
     }
   else
-    {
-      CHECK_NATNUM (val);
-      charset.invalid_code = XFASTINT (val);
-    }
+    charset.invalid_code = XFASTINT (val);
 
   val = args[charset_arg_iso_final];
   if (NILP (val))
@@ -997,9 +989,7 @@ usage: (define-charset-internal ...)  */)
     charset.iso_revision = -1;
   else
     {
-      CHECK_NUMBER (val);
-      if (XINT (val) > 63)
-	args_out_of_range (make_number (63), val);
+      CHECK_RANGED_INTEGER (-1, val, 63);
       charset.iso_revision = XINT (val);
     }
 
@@ -1025,7 +1015,7 @@ usage: (define-charset-internal ...)  */)
   if (! NILP (args[charset_arg_code_offset]))
     {
       val = args[charset_arg_code_offset];
-      CHECK_NUMBER (val);
+      CHECK_TYPE_RANGED_INTEGER (int, val);
 
       charset.method = CHARSET_METHOD_OFFSET;
       charset.code_offset = XINT (val);
@@ -1106,7 +1096,7 @@ usage: (define-charset-internal ...)  */)
 	      car_part = XCAR (elt);
 	      cdr_part = XCDR (elt);
 	      CHECK_CHARSET_GET_ID (car_part, this_id);
-	      CHECK_NUMBER (cdr_part);
+	      CHECK_TYPE_RANGED_INTEGER (int, cdr_part);
 	      offset = XINT (cdr_part);
 	    }
 	  else
@@ -1511,7 +1501,7 @@ string_xstring_p (Lisp_Object string)
    It may lookup a translation table TABLE if supplied.  */
 
 static void
-find_charsets_in_text (const unsigned char *ptr, EMACS_INT nchars, EMACS_INT nbytes, Lisp_Object charsets, Lisp_Object table, int multibyte)
+find_charsets_in_text (const unsigned char *ptr, ptrdiff_t nchars, ptrdiff_t nbytes, Lisp_Object charsets, Lisp_Object table, int multibyte)
 {
   const unsigned char *pend = ptr + nbytes;
 
@@ -1558,7 +1548,7 @@ only `ascii', `eight-bit-control', and `eight-bit-graphic'.  */)
   (Lisp_Object beg, Lisp_Object end, Lisp_Object table)
 {
   Lisp_Object charsets;
-  EMACS_INT from, from_byte, to, stop, stop_byte;
+  ptrdiff_t from, from_byte, to, stop, stop_byte;
   int i;
   Lisp_Object val;
   int multibyte = ! NILP (BVAR (current_buffer, enable_multibyte_characters));
diff --git a/src/chartab.c b/src/chartab.c
index 1d4ac04312a..06def16e795 100644
--- a/src/chartab.c
+++ b/src/chartab.c
@@ -107,9 +107,9 @@ the char-table has no extra slot.  */)
   else
     {
       CHECK_NATNUM (n);
-      n_extras = XINT (n);
-      if (n_extras > 10)
+      if (XINT (n) > 10)
 	args_out_of_range (n, Qnil);
+      n_extras = XINT (n);
     }
 
   size = VECSIZE (struct Lisp_Char_Table) - 1 + n_extras;
@@ -646,7 +646,7 @@ or a character code.  Return VALUE.  */)
     }
   else if (EQ (range, Qnil))
     XCHAR_TABLE (char_table)->defalt = value;
-  else if (INTEGERP (range))
+  else if (CHARACTERP (range))
     char_table_set (char_table, XINT (range), value);
   else if (CONSP (range))
     {
@@ -1223,7 +1223,7 @@ static int uniprop_decoder_count
 static uniprop_decoder_t
 uniprop_get_decoder (Lisp_Object table)
 {
-  int i;
+  EMACS_INT i;
 
   if (! INTEGERP (XCHAR_TABLE (table)->extras[1]))
     return NULL;
@@ -1303,7 +1303,7 @@ static int uniprop_encoder_count
 static uniprop_decoder_t
 uniprop_get_encoder (Lisp_Object table)
 {
-  int i;
+  EMACS_INT i;
 
   if (! INTEGERP (XCHAR_TABLE (table)->extras[2]))
     return NULL;
diff --git a/src/cmds.c b/src/cmds.c
index 5a155ac77a5..ed5bf5d282e 100644
--- a/src/cmds.c
+++ b/src/cmds.c
@@ -47,6 +47,41 @@ DEFUN ("forward-point", Fforward_point, Sforward_point, 1, 1, 0,
   return make_number (PT + XINT (n));
 }
 
+/* Add N to point; or subtract N if FORWARD is zero.  N defaults to 1.
+   Validate the new location.  Return nil.  */
+static Lisp_Object
+move_point (Lisp_Object n, int forward)
+{
+  /* This used to just set point to point + XINT (n), and then check
+     to see if it was within boundaries.  But now that SET_PT can
+     potentially do a lot of stuff (calling entering and exiting
+     hooks, etcetera), that's not a good approach.  So we validate the
+     proposed position, then set point.  */
+
+  EMACS_INT new_point;
+
+  if (NILP (n))
+    XSETFASTINT (n, 1);
+  else
+    CHECK_NUMBER (n);
+
+  new_point = PT + (forward ? XINT (n) : - XINT (n));
+
+  if (new_point < BEGV)
+    {
+      SET_PT (BEGV);
+      xsignal0 (Qbeginning_of_buffer);
+    }
+  if (new_point > ZV)
+    {
+      SET_PT (ZV);
+      xsignal0 (Qend_of_buffer);
+    }
+
+  SET_PT (new_point);
+  return Qnil;
+}
+
 DEFUN ("forward-char", Fforward_char, Sforward_char, 0, 1, "^p",
        doc: /* Move point N characters forward (backward if N is negative).
 On reaching end or beginning of buffer, stop and signal error.
@@ -56,34 +91,7 @@ right or to the left on the screen.  This is in contrast with
 \\[right-char], which see.  */)
   (Lisp_Object n)
 {
-  if (NILP (n))
-    XSETFASTINT (n, 1);
-  else
-    CHECK_NUMBER (n);
-
-  /* This used to just set point to point + XINT (n), and then check
-     to see if it was within boundaries.  But now that SET_PT can
-     potentially do a lot of stuff (calling entering and exiting
-     hooks, etcetera), that's not a good approach.  So we validate the
-     proposed position, then set point.  */
-  {
-    EMACS_INT new_point = PT + XINT (n);
-
-    if (new_point < BEGV)
-      {
-	SET_PT (BEGV);
-	xsignal0 (Qbeginning_of_buffer);
-      }
-    if (new_point > ZV)
-      {
-	SET_PT (ZV);
-	xsignal0 (Qend_of_buffer);
-      }
-
-    SET_PT (new_point);
-  }
-
-  return Qnil;
+  return move_point (n, 1);
 }
 
 DEFUN ("backward-char", Fbackward_char, Sbackward_char, 0, 1, "^p",
@@ -95,13 +103,7 @@ right or to the left on the screen.  This is in contrast with
 \\[left-char], which see.  */)
   (Lisp_Object n)
 {
-  if (NILP (n))
-    XSETFASTINT (n, 1);
-  else
-    CHECK_NUMBER (n);
-
-  XSETINT (n, - XINT (n));
-  return Fforward_char (n);
+  return move_point (n, 0);
 }
 
 DEFUN ("forward-line", Fforward_line, Sforward_line, 0, 1, "^p",
@@ -115,8 +117,8 @@ With positive N, a non-empty line at the end counts as one line
 successfully moved (for the return value).  */)
   (Lisp_Object n)
 {
-  EMACS_INT opoint = PT, opoint_byte = PT_BYTE;
-  EMACS_INT pos, pos_byte;
+  ptrdiff_t opoint = PT, opoint_byte = PT_BYTE;
+  ptrdiff_t pos, pos_byte;
   EMACS_INT count, shortage;
 
   if (NILP (n))
@@ -187,7 +189,7 @@ not move.  To ignore field boundaries bind `inhibit-field-text-motion'
 to t.  */)
   (Lisp_Object n)
 {
-  EMACS_INT newpos;
+  ptrdiff_t newpos;
 
   if (NILP (n))
     XSETFASTINT (n, 1);
@@ -303,7 +305,7 @@ At the end, it runs `post-self-insert-hook'.  */)
     bitch_at_user ();
   {
     int character = translate_char (Vtranslation_table_for_input,
-				    (int) XINT (last_command_event));
+				    XINT (last_command_event));
     int val = internal_self_insert (character, XFASTINT (n));
     if (val == 2)
       nonundocount = 0;
@@ -333,8 +335,8 @@ internal_self_insert (int c, EMACS_INT n)
   int len;
   /* Working buffer and pointer for multi-byte form of C.  */
   unsigned char str[MAX_MULTIBYTE_LENGTH];
-  EMACS_INT chars_to_delete = 0;
-  EMACS_INT spaces_to_insert = 0;
+  ptrdiff_t chars_to_delete = 0;
+  ptrdiff_t spaces_to_insert = 0;
 
   overwrite = BVAR (current_buffer, overwrite_mode);
   if (!NILP (Vbefore_change_functions) || !NILP (Vafter_change_functions))
@@ -371,50 +373,53 @@ internal_self_insert (int c, EMACS_INT n)
       /* This is the character after point.  */
       int c2 = FETCH_CHAR (PT_BYTE);
 
+      int cwidth;
+
       /* Overwriting in binary-mode always replaces C2 by C.
 	 Overwriting in textual-mode doesn't always do that.
 	 It inserts newlines in the usual way,
 	 and inserts any character at end of line
 	 or before a tab if it doesn't use the whole width of the tab.  */
       if (EQ (overwrite, Qoverwrite_mode_binary))
-	chars_to_delete = n;
-      else if (c != '\n' && c2 != '\n')
+	chars_to_delete = min (n, PTRDIFF_MAX);
+      else if (c != '\n' && c2 != '\n'
+	       && (cwidth = XFASTINT (Fchar_width (make_number (c)))) != 0)
 	{
-	  EMACS_INT pos = PT;
-	  EMACS_INT pos_byte = PT_BYTE;
+	  ptrdiff_t pos = PT;
+	  ptrdiff_t pos_byte = PT_BYTE;
+	  ptrdiff_t curcol = current_column ();
 
-	  /* FIXME: Check for integer overflow when calculating
-	     target_clm and actual_clm.  */
-
-	  /* Column the cursor should be placed at after this insertion.
-	     The correct value should be calculated only when necessary.  */
-	  EMACS_INT target_clm = (current_column ()
-				  + n * XINT (Fchar_width (make_number (c))));
-
-	  /* The actual cursor position after the trial of moving
-	     to column TARGET_CLM.  It is greater than TARGET_CLM
-	     if the TARGET_CLM is middle of multi-column
-	     character.  In that case, the new point is set after
-	     that character.  */
-	  EMACS_INT actual_clm
-	    = XFASTINT (Fmove_to_column (make_number (target_clm), Qnil));
-
-	  chars_to_delete = PT - pos;
-
-	  if (actual_clm > target_clm)
+	  if (n <= (min (MOST_POSITIVE_FIXNUM, PTRDIFF_MAX) - curcol) / cwidth)
 	    {
-	      /* We will delete too many columns.  Let's fill columns
-		 by spaces so that the remaining text won't move.  */
-	      EMACS_INT actual = PT_BYTE;
-	      DEC_POS (actual);
-	      if (FETCH_CHAR (actual) == '\t')
-		/* Rather than add spaces, let's just keep the tab. */
-		chars_to_delete--;
-	      else
-		spaces_to_insert = actual_clm - target_clm;
+	      /* Column the cursor should be placed at after this insertion.
+		 The value should be calculated only when necessary.  */
+	      ptrdiff_t target_clm = curcol + n * cwidth;
+
+	      /* The actual cursor position after the trial of moving
+		 to column TARGET_CLM.  It is greater than TARGET_CLM
+		 if the TARGET_CLM is middle of multi-column
+		 character.  In that case, the new point is set after
+		 that character.  */
+	      ptrdiff_t actual_clm
+		= XFASTINT (Fmove_to_column (make_number (target_clm), Qnil));
+
+	      chars_to_delete = PT - pos;
+
+	      if (actual_clm > target_clm)
+		{
+		  /* We will delete too many columns.  Let's fill columns
+		     by spaces so that the remaining text won't move.  */
+		  ptrdiff_t actual = PT_BYTE;
+		  DEC_POS (actual);
+		  if (FETCH_CHAR (actual) == '\t')
+		    /* Rather than add spaces, let's just keep the tab. */
+		    chars_to_delete--;
+		  else
+		    spaces_to_insert = actual_clm - target_clm;
+		}
+
+	      SET_PT_BOTH (pos, pos_byte);
 	    }
-
-	  SET_PT_BOTH (pos, pos_byte);
 	}
       hairy = 2;
     }
@@ -466,7 +471,7 @@ internal_self_insert (int c, EMACS_INT n)
 	}
 
       replace_range (PT, PT + chars_to_delete, string, 1, 1, 1);
-      Fforward_char (make_number (n + spaces_to_insert));
+      move_point (n + spaces_to_insert, 1);
     }
   else if (n > 1)
     {
diff --git a/src/coding.c b/src/coding.c
index 5fd59d394d9..704d26f3f9b 100644
--- a/src/coding.c
+++ b/src/coding.c
@@ -159,7 +159,7 @@ detect_coding_XXX (struct coding_system *coding,
   const unsigned char *src = coding->source;
   const unsigned char *src_end = coding->source + coding->src_bytes;
   int multibytep = coding->src_multibyte;
-  EMACS_INT consumed_chars = 0;
+  ptrdiff_t consumed_chars = 0;
   int found = 0;
   ...;
 
@@ -266,7 +266,7 @@ encode_coding_XXX (struct coding_system *coding)
   unsigned char *dst = coding->destination + coding->produced;
   unsigned char *dst_end = coding->destination + coding->dst_bytes;
   unsigned char *adjusted_dst_end = dst_end - _MAX_BYTES_PRODUCED_IN_LOOP_;
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced_chars = 0;
 
   for (; charbuf < charbuf_end && dst < adjusted_dst_end; charbuf++)
     {
@@ -849,31 +849,31 @@ static int encode_coding_raw_text (struct coding_system *);
 
 static void coding_set_source (struct coding_system *);
 static void coding_set_destination (struct coding_system *);
-static void coding_alloc_by_realloc (struct coding_system *, EMACS_INT);
+static void coding_alloc_by_realloc (struct coding_system *, ptrdiff_t);
 static void coding_alloc_by_making_gap (struct coding_system *,
-                                        EMACS_INT, EMACS_INT);
+                                        ptrdiff_t, ptrdiff_t);
 static unsigned char *alloc_destination (struct coding_system *,
-                                         EMACS_INT, unsigned char *);
+                                         ptrdiff_t, unsigned char *);
 static void setup_iso_safe_charsets (Lisp_Object);
 static unsigned char *encode_designation_at_bol (struct coding_system *,
                                                  int *, unsigned char *);
 static int detect_eol (const unsigned char *,
-                       EMACS_INT, enum coding_category);
+                       ptrdiff_t, enum coding_category);
 static Lisp_Object adjust_coding_eol_type (struct coding_system *, int);
 static void decode_eol (struct coding_system *);
 static Lisp_Object get_translation_table (Lisp_Object, int, int *);
 static Lisp_Object get_translation (Lisp_Object, int *, int *);
 static int produce_chars (struct coding_system *, Lisp_Object, int);
 static inline void produce_charset (struct coding_system *, int *,
-                                    EMACS_INT);
-static void produce_annotation (struct coding_system *, EMACS_INT);
+                                    ptrdiff_t);
+static void produce_annotation (struct coding_system *, ptrdiff_t);
 static int decode_coding (struct coding_system *);
-static inline int *handle_composition_annotation (EMACS_INT, EMACS_INT,
+static inline int *handle_composition_annotation (ptrdiff_t, ptrdiff_t,
                                                   struct coding_system *,
-                                                  int *, EMACS_INT *);
-static inline int *handle_charset_annotation (EMACS_INT, EMACS_INT,
+                                                  int *, ptrdiff_t *);
+static inline int *handle_charset_annotation (ptrdiff_t, ptrdiff_t,
                                               struct coding_system *,
-                                              int *, EMACS_INT *);
+                                              int *, ptrdiff_t *);
 static void consume_chars (struct coding_system *, Lisp_Object, int);
 static int encode_coding (struct coding_system *);
 static Lisp_Object make_conversion_work_buffer (int);
@@ -926,7 +926,7 @@ record_conversion_result (struct coding_system *coding,
     if (charset_map_loaded)						     \
       {									     \
 	const unsigned char *orig = coding->source;			     \
-	EMACS_INT offset;						     \
+	ptrdiff_t offset;						     \
 									     \
 	coding_set_source (coding);					     \
 	offset = coding->source - orig;					     \
@@ -946,7 +946,7 @@ record_conversion_result (struct coding_system *coding,
   do {								\
     if (dst + (bytes) >= dst_end)				\
       {								\
-	EMACS_INT more_bytes = charbuf_end - charbuf + (bytes);	\
+	ptrdiff_t more_bytes = charbuf_end - charbuf + (bytes);	\
 								\
 	dst = alloc_destination (coding, more_bytes, dst);	\
 	dst_end = coding->destination + coding->dst_bytes;	\
@@ -1069,7 +1069,7 @@ coding_set_destination (struct coding_system *coding)
 
 
 static void
-coding_alloc_by_realloc (struct coding_system *coding, EMACS_INT bytes)
+coding_alloc_by_realloc (struct coding_system *coding, ptrdiff_t bytes)
 {
   if (STRING_BYTES_BOUND - coding->dst_bytes < bytes)
     string_overflow ();
@@ -1080,7 +1080,7 @@ coding_alloc_by_realloc (struct coding_system *coding, EMACS_INT bytes)
 
 static void
 coding_alloc_by_making_gap (struct coding_system *coding,
-			    EMACS_INT gap_head_used, EMACS_INT bytes)
+			    ptrdiff_t gap_head_used, ptrdiff_t bytes)
 {
   if (EQ (coding->src_object, coding->dst_object))
     {
@@ -1088,7 +1088,7 @@ coding_alloc_by_making_gap (struct coding_system *coding,
 	 consumed data at the tail.  To preserve those data, we at
 	 first make the gap size to zero, then increase the gap
 	 size.  */
-      EMACS_INT add = GAP_SIZE;
+      ptrdiff_t add = GAP_SIZE;
 
       GPT += gap_head_used, GPT_BYTE += gap_head_used;
       GAP_SIZE = 0; ZV += add; Z += add; ZV_BYTE += add; Z_BYTE += add;
@@ -1109,10 +1109,10 @@ coding_alloc_by_making_gap (struct coding_system *coding,
 
 
 static unsigned char *
-alloc_destination (struct coding_system *coding, EMACS_INT nbytes,
+alloc_destination (struct coding_system *coding, ptrdiff_t nbytes,
 		   unsigned char *dst)
 {
-  EMACS_INT offset = dst - coding->destination;
+  ptrdiff_t offset = dst - coding->destination;
 
   if (BUFFERP (coding->dst_object))
     {
@@ -1213,7 +1213,7 @@ detect_coding_utf_8 (struct coding_system *coding,
   const unsigned char *src = coding->source, *src_base;
   const unsigned char *src_end = coding->source + coding->src_bytes;
   int multibytep = coding->src_multibyte;
-  EMACS_INT consumed_chars = 0;
+  ptrdiff_t consumed_chars = 0;
   int bom_found = 0;
   int found = 0;
 
@@ -1298,7 +1298,7 @@ decode_coding_utf_8 (struct coding_system *coding)
   const unsigned char *src_base;
   int *charbuf = coding->charbuf + coding->charbuf_used;
   int *charbuf_end = coding->charbuf + coding->charbuf_size;
-  EMACS_INT consumed_chars = 0, consumed_chars_base = 0;
+  ptrdiff_t consumed_chars = 0, consumed_chars_base = 0;
   int multibytep = coding->src_multibyte;
   enum utf_bom_type bom = CODING_UTF_8_BOM (coding);
   int eol_dos =
@@ -1449,7 +1449,7 @@ encode_coding_utf_8 (struct coding_system *coding)
   int *charbuf_end = charbuf + coding->charbuf_used;
   unsigned char *dst = coding->destination + coding->produced;
   unsigned char *dst_end = coding->destination + coding->dst_bytes;
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced_chars = 0;
   int c;
 
   if (CODING_UTF_8_BOM (coding) == utf_with_bom)
@@ -1607,7 +1607,7 @@ decode_coding_utf_16 (struct coding_system *coding)
   int *charbuf = coding->charbuf + coding->charbuf_used;
   /* We may produces at most 3 chars in one loop.  */
   int *charbuf_end = coding->charbuf + coding->charbuf_size - 2;
-  EMACS_INT consumed_chars = 0, consumed_chars_base = 0;
+  ptrdiff_t consumed_chars = 0, consumed_chars_base = 0;
   int multibytep = coding->src_multibyte;
   enum utf_bom_type bom = CODING_UTF_16_BOM (coding);
   enum utf_16_endian_type endian = CODING_UTF_16_ENDIAN (coding);
@@ -1734,7 +1734,7 @@ encode_coding_utf_16 (struct coding_system *coding)
   int safe_room = 8;
   enum utf_bom_type bom = CODING_UTF_16_BOM (coding);
   int big_endian = CODING_UTF_16_ENDIAN (coding) == utf_16_big_endian;
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced_chars = 0;
   int c;
 
   if (bom != utf_without_bom)
@@ -1868,7 +1868,7 @@ detect_coding_emacs_mule (struct coding_system *coding,
   const unsigned char *src = coding->source, *src_base;
   const unsigned char *src_end = coding->source + coding->src_bytes;
   int multibytep = coding->src_multibyte;
-  EMACS_INT consumed_chars = 0;
+  ptrdiff_t consumed_chars = 0;
   int c;
   int found = 0;
 
@@ -2338,10 +2338,10 @@ decode_coding_emacs_mule (struct coding_system *coding)
     = coding->charbuf + coding->charbuf_size - (MAX_ANNOTATION_LENGTH * 3)
       /* We can produce up to 2 characters in a loop.  */
       - 1;
-  EMACS_INT consumed_chars = 0, consumed_chars_base;
+  ptrdiff_t consumed_chars = 0, consumed_chars_base;
   int multibytep = coding->src_multibyte;
-  EMACS_INT char_offset = coding->produced_char;
-  EMACS_INT last_offset = char_offset;
+  ptrdiff_t char_offset = coding->produced_char;
+  ptrdiff_t last_offset = char_offset;
   int last_id = charset_ascii;
   int eol_dos =
     !inhibit_eol_conversion && EQ (CODING_ID_EOL_TYPE (coding->id), Qdos);
@@ -2413,7 +2413,7 @@ decode_coding_emacs_mule (struct coding_system *coding)
 	     original pointer to buffer text, and fix up all related
 	     pointers after the call.  */
 	  const unsigned char *orig = coding->source;
-	  EMACS_INT offset;
+	  ptrdiff_t offset;
 
 	  c = emacs_mule_char (coding, src_base, &nbytes, &nchars, &id,
 			       cmp_status);
@@ -2594,7 +2594,7 @@ encode_coding_emacs_mule (struct coding_system *coding)
   unsigned char *dst = coding->destination + coding->produced;
   unsigned char *dst_end = coding->destination + coding->dst_bytes;
   int safe_room = 8;
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced_chars = 0;
   Lisp_Object attrs, charset_list;
   int c;
   int preferred_charset_id = -1;
@@ -2881,7 +2881,7 @@ setup_iso_safe_charsets (Lisp_Object attrs)
   Lisp_Object request;
   Lisp_Object reg_usage;
   Lisp_Object tail;
-  int reg94, reg96;
+  EMACS_INT reg94, reg96;
   int flags = XINT (AREF (attrs, coding_attr_iso_flags));
   int max_charset_id;
 
@@ -2952,7 +2952,7 @@ detect_coding_iso_2022 (struct coding_system *coding,
   int single_shifting = 0;
   int id;
   int c, c1;
-  EMACS_INT consumed_chars = 0;
+  ptrdiff_t consumed_chars = 0;
   int i;
   int rejected = 0;
   int found = 0;
@@ -3462,7 +3462,7 @@ decode_coding_iso_2022 (struct coding_system *coding)
      loop and one more charset annotation at the end.  */
   int *charbuf_end
     = coding->charbuf + coding->charbuf_size - (MAX_ANNOTATION_LENGTH * 3);
-  EMACS_INT consumed_chars = 0, consumed_chars_base;
+  ptrdiff_t consumed_chars = 0, consumed_chars_base;
   int multibytep = coding->src_multibyte;
   /* Charsets invoked to graphic plane 0 and 1 respectively.  */
   int charset_id_0 = CODING_ISO_INVOKED_CHARSET (coding, 0);
@@ -3472,8 +3472,8 @@ decode_coding_iso_2022 (struct coding_system *coding)
   int c;
   struct composition_status *cmp_status = CODING_ISO_CMP_STATUS (coding);
   Lisp_Object attrs = CODING_ID_ATTRS (coding->id);
-  EMACS_INT char_offset = coding->produced_char;
-  EMACS_INT last_offset = char_offset;
+  ptrdiff_t char_offset = coding->produced_char;
+  ptrdiff_t last_offset = char_offset;
   int last_id = charset_ascii;
   int eol_dos =
     !inhibit_eol_conversion && EQ (CODING_ID_EOL_TYPE (coding->id), Qdos);
@@ -4201,10 +4201,10 @@ decode_coding_iso_2022 (struct coding_system *coding)
 static unsigned char *
 encode_invocation_designation (struct charset *charset,
 			       struct coding_system *coding,
-			       unsigned char *dst, EMACS_INT *p_nchars)
+			       unsigned char *dst, ptrdiff_t *p_nchars)
 {
   int multibytep = coding->dst_multibyte;
-  EMACS_INT produced_chars = *p_nchars;
+  ptrdiff_t produced_chars = *p_nchars;
   int reg;			/* graphic register number */
   int id = CHARSET_ID (charset);
 
@@ -4296,7 +4296,7 @@ encode_designation_at_bol (struct coding_system *coding, int *charbuf,
   /* Table of charsets to be designated to each graphic register.  */
   int r[4];
   int c, found = 0, reg;
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced_chars = 0;
   int multibytep = coding->dst_multibyte;
   Lisp_Object attrs;
   Lisp_Object charset_list;
@@ -4351,7 +4351,7 @@ encode_coding_iso_2022 (struct coding_system *coding)
   int bol_designation
     = (CODING_ISO_FLAGS (coding) & CODING_ISO_FLAG_DESIGNATE_AT_BOL
        && CODING_ISO_BOL (coding));
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced_chars = 0;
   Lisp_Object attrs, eol_type, charset_list;
   int ascii_compatible;
   int c;
@@ -4539,7 +4539,7 @@ detect_coding_sjis (struct coding_system *coding,
   const unsigned char *src = coding->source, *src_base;
   const unsigned char *src_end = coding->source + coding->src_bytes;
   int multibytep = coding->src_multibyte;
-  EMACS_INT consumed_chars = 0;
+  ptrdiff_t consumed_chars = 0;
   int found = 0;
   int c;
   Lisp_Object attrs, charset_list;
@@ -4596,7 +4596,7 @@ detect_coding_big5 (struct coding_system *coding,
   const unsigned char *src = coding->source, *src_base;
   const unsigned char *src_end = coding->source + coding->src_bytes;
   int multibytep = coding->src_multibyte;
-  EMACS_INT consumed_chars = 0;
+  ptrdiff_t consumed_chars = 0;
   int found = 0;
   int c;
 
@@ -4647,13 +4647,13 @@ decode_coding_sjis (struct coding_system *coding)
      the end.  */
   int *charbuf_end
     = coding->charbuf + coding->charbuf_size - (MAX_ANNOTATION_LENGTH * 2);
-  EMACS_INT consumed_chars = 0, consumed_chars_base;
+  ptrdiff_t consumed_chars = 0, consumed_chars_base;
   int multibytep = coding->src_multibyte;
   struct charset *charset_roman, *charset_kanji, *charset_kana;
   struct charset *charset_kanji2;
   Lisp_Object attrs, charset_list, val;
-  EMACS_INT char_offset = coding->produced_char;
-  EMACS_INT last_offset = char_offset;
+  ptrdiff_t char_offset = coding->produced_char;
+  ptrdiff_t last_offset = char_offset;
   int last_id = charset_ascii;
   int eol_dos =
     !inhibit_eol_conversion && EQ (CODING_ID_EOL_TYPE (coding->id), Qdos);
@@ -4765,12 +4765,12 @@ decode_coding_big5 (struct coding_system *coding)
      the end.  */
   int *charbuf_end
     = coding->charbuf + coding->charbuf_size - (MAX_ANNOTATION_LENGTH * 2);
-  EMACS_INT consumed_chars = 0, consumed_chars_base;
+  ptrdiff_t consumed_chars = 0, consumed_chars_base;
   int multibytep = coding->src_multibyte;
   struct charset *charset_roman, *charset_big5;
   Lisp_Object attrs, charset_list, val;
-  EMACS_INT char_offset = coding->produced_char;
-  EMACS_INT last_offset = char_offset;
+  ptrdiff_t char_offset = coding->produced_char;
+  ptrdiff_t last_offset = char_offset;
   int last_id = charset_ascii;
   int eol_dos =
     !inhibit_eol_conversion && EQ (CODING_ID_EOL_TYPE (coding->id), Qdos);
@@ -4867,7 +4867,7 @@ encode_coding_sjis (struct coding_system *coding)
   unsigned char *dst = coding->destination + coding->produced;
   unsigned char *dst_end = coding->destination + coding->dst_bytes;
   int safe_room = 4;
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced_chars = 0;
   Lisp_Object attrs, charset_list, val;
   int ascii_compatible;
   struct charset *charset_kanji, *charset_kana;
@@ -4958,7 +4958,7 @@ encode_coding_big5 (struct coding_system *coding)
   unsigned char *dst = coding->destination + coding->produced;
   unsigned char *dst_end = coding->destination + coding->dst_bytes;
   int safe_room = 4;
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced_chars = 0;
   Lisp_Object attrs, charset_list, val;
   int ascii_compatible;
   struct charset *charset_big5;
@@ -5033,10 +5033,10 @@ detect_coding_ccl (struct coding_system *coding,
   const unsigned char *src = coding->source, *src_base;
   const unsigned char *src_end = coding->source + coding->src_bytes;
   int multibytep = coding->src_multibyte;
-  EMACS_INT consumed_chars = 0;
+  ptrdiff_t consumed_chars = 0;
   int found = 0;
   unsigned char *valids;
-  EMACS_INT head_ascii = coding->head_ascii;
+  ptrdiff_t head_ascii = coding->head_ascii;
   Lisp_Object attrs;
 
   detect_info->checked |= CATEGORY_MASK_CCL;
@@ -5073,7 +5073,7 @@ decode_coding_ccl (struct coding_system *coding)
   const unsigned char *src_end = coding->source + coding->src_bytes;
   int *charbuf = coding->charbuf + coding->charbuf_used;
   int *charbuf_end = coding->charbuf + coding->charbuf_size;
-  EMACS_INT consumed_chars = 0;
+  ptrdiff_t consumed_chars = 0;
   int multibytep = coding->src_multibyte;
   struct ccl_program *ccl = &coding->spec.ccl->ccl;
   int source_charbuf[1024];
@@ -5145,7 +5145,7 @@ encode_coding_ccl (struct coding_system *coding)
   unsigned char *dst = coding->destination + coding->produced;
   unsigned char *dst_end = coding->destination + coding->dst_bytes;
   int destination_charbuf[1024];
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced_chars = 0;
   int i;
   Lisp_Object attrs, charset_list;
 
@@ -5232,7 +5232,7 @@ encode_coding_raw_text (struct coding_system *coding)
   int *charbuf_end = coding->charbuf + coding->charbuf_used;
   unsigned char *dst = coding->destination + coding->produced;
   unsigned char *dst_end = coding->destination + coding->dst_bytes;
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced_chars = 0;
   int c;
 
   if (multibytep)
@@ -5315,10 +5315,10 @@ detect_coding_charset (struct coding_system *coding,
   const unsigned char *src = coding->source, *src_base;
   const unsigned char *src_end = coding->source + coding->src_bytes;
   int multibytep = coding->src_multibyte;
-  EMACS_INT consumed_chars = 0;
+  ptrdiff_t consumed_chars = 0;
   Lisp_Object attrs, valids, name;
   int found = 0;
-  EMACS_INT head_ascii = coding->head_ascii;
+  ptrdiff_t head_ascii = coding->head_ascii;
   int check_latin_extra = 0;
 
   detect_info->checked |= CATEGORY_MASK_CHARSET;
@@ -5422,12 +5422,12 @@ decode_coding_charset (struct coding_system *coding)
      the end.  */
   int *charbuf_end
     = coding->charbuf + coding->charbuf_size - (MAX_ANNOTATION_LENGTH * 2);
-  EMACS_INT consumed_chars = 0, consumed_chars_base;
+  ptrdiff_t consumed_chars = 0, consumed_chars_base;
   int multibytep = coding->src_multibyte;
   Lisp_Object attrs = CODING_ID_ATTRS (coding->id);
   Lisp_Object valids;
-  EMACS_INT char_offset = coding->produced_char;
-  EMACS_INT last_offset = char_offset;
+  ptrdiff_t char_offset = coding->produced_char;
+  ptrdiff_t last_offset = char_offset;
   int last_id = charset_ascii;
   int eol_dos =
     !inhibit_eol_conversion && EQ (CODING_ID_EOL_TYPE (coding->id), Qdos);
@@ -5548,7 +5548,7 @@ encode_coding_charset (struct coding_system *coding)
   unsigned char *dst = coding->destination + coding->produced;
   unsigned char *dst_end = coding->destination + coding->dst_bytes;
   int safe_room = MAX_MULTIBYTE_LENGTH;
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced_chars = 0;
   Lisp_Object attrs, charset_list;
   int ascii_compatible;
   int c;
@@ -6095,7 +6095,7 @@ complement_process_encoding_system (Lisp_Object coding_system)
 #define MAX_EOL_CHECK_COUNT 3
 
 static int
-detect_eol (const unsigned char *source, EMACS_INT src_bytes,
+detect_eol (const unsigned char *source, ptrdiff_t src_bytes,
 	    enum coding_category category)
 {
   const unsigned char *src = source, *src_end = src + src_bytes;
@@ -6456,7 +6456,7 @@ decode_eol (struct coding_system *coding)
     }
   else if (EQ (eol_type, Qdos))
     {
-      EMACS_INT n = 0;
+      ptrdiff_t n = 0;
 
       if (NILP (coding->dst_object))
 	{
@@ -6471,9 +6471,9 @@ decode_eol (struct coding_system *coding)
 	}
       else
 	{
-	  EMACS_INT pos_byte = coding->dst_pos_byte;
-	  EMACS_INT pos = coding->dst_pos;
-	  EMACS_INT pos_end = pos + coding->produced_char - 1;
+	  ptrdiff_t pos_byte = coding->dst_pos_byte;
+	  ptrdiff_t pos = coding->dst_pos;
+	  ptrdiff_t pos_end = pos + coding->produced_char - 1;
 
 	  while (pos < pos_end)
 	    {
@@ -6636,8 +6636,8 @@ produce_chars (struct coding_system *coding, Lisp_Object translation_table,
 {
   unsigned char *dst = coding->destination + coding->produced;
   unsigned char *dst_end = coding->destination + coding->dst_bytes;
-  EMACS_INT produced;
-  EMACS_INT produced_chars = 0;
+  ptrdiff_t produced;
+  ptrdiff_t produced_chars = 0;
   int carryover = 0;
 
   if (! coding->chars_at_source)
@@ -6658,7 +6658,7 @@ produce_chars (struct coding_system *coding, Lisp_Object translation_table,
 
 	  if (c >= 0)
 	    {
-	      EMACS_INT from_nchars = 1, to_nchars = 1;
+	      ptrdiff_t from_nchars = 1, to_nchars = 1;
 	      Lisp_Object trans = Qnil;
 
 	      LOOKUP_TRANSLATION_TABLE (translation_table, c, trans);
@@ -6735,7 +6735,7 @@ produce_chars (struct coding_system *coding, Lisp_Object translation_table,
 	  if (coding->src_multibyte)
 	    {
 	      int multibytep = 1;
-	      EMACS_INT consumed_chars = 0;
+	      ptrdiff_t consumed_chars = 0;
 
 	      while (1)
 		{
@@ -6749,7 +6749,7 @@ produce_chars (struct coding_system *coding, Lisp_Object translation_table,
 			dst_end = (unsigned char *) src;
 		      if (dst == dst_end)
 			{
-			  EMACS_INT offset = src - coding->source;
+			  ptrdiff_t offset = src - coding->source;
 
 			  dst = alloc_destination (coding, src_end - src + 1,
 						   dst);
@@ -6779,8 +6779,8 @@ produce_chars (struct coding_system *coding, Lisp_Object translation_table,
 		      dst_end = (unsigned char *) src;
 		    if (dst >= dst_end - 1)
 		      {
-			EMACS_INT offset = src - coding->source;
-			EMACS_INT more_bytes;
+			ptrdiff_t offset = src - coding->source;
+			ptrdiff_t more_bytes;
 
 			if (EQ (coding->src_object, coding->dst_object))
 			  more_bytes = ((src_end - src) / 2) + 2;
@@ -6802,11 +6802,11 @@ produce_chars (struct coding_system *coding, Lisp_Object translation_table,
 	{
 	  if (!EQ (coding->src_object, coding->dst_object))
 	    {
-	      EMACS_INT require = coding->src_bytes - coding->dst_bytes;
+	      ptrdiff_t require = coding->src_bytes - coding->dst_bytes;
 
 	      if (require > 0)
 		{
-		  EMACS_INT offset = src - coding->source;
+		  ptrdiff_t offset = src - coding->source;
 
 		  dst = alloc_destination (coding, require, dst);
 		  coding_set_source (coding);
@@ -6834,10 +6834,10 @@ produce_chars (struct coding_system *coding, Lisp_Object translation_table,
  */
 
 static inline void
-produce_composition (struct coding_system *coding, int *charbuf, EMACS_INT pos)
+produce_composition (struct coding_system *coding, int *charbuf, ptrdiff_t pos)
 {
   int len;
-  EMACS_INT to;
+  ptrdiff_t to;
   enum composition_method method;
   Lisp_Object components;
 
@@ -6878,9 +6878,9 @@ produce_composition (struct coding_system *coding, int *charbuf, EMACS_INT pos)
  */
 
 static inline void
-produce_charset (struct coding_system *coding, int *charbuf, EMACS_INT pos)
+produce_charset (struct coding_system *coding, int *charbuf, ptrdiff_t pos)
 {
-  EMACS_INT from = pos - charbuf[2];
+  ptrdiff_t from = pos - charbuf[2];
   struct charset *charset = CHARSET_FROM_ID (charbuf[3]);
 
   Fput_text_property (make_number (from), make_number (pos),
@@ -6913,7 +6913,7 @@ produce_charset (struct coding_system *coding, int *charbuf, EMACS_INT pos)
 
 
 static void
-produce_annotation (struct coding_system *coding, EMACS_INT pos)
+produce_annotation (struct coding_system *coding, ptrdiff_t pos)
 {
   int *charbuf = coding->charbuf;
   int *charbuf_end = charbuf + coding->charbuf_used;
@@ -7013,7 +7013,7 @@ decode_coding (struct coding_system *coding)
     }
   do
     {
-      EMACS_INT pos = coding->dst_pos + coding->produced_char;
+      ptrdiff_t pos = coding->dst_pos + coding->produced_char;
 
       coding_set_source (coding);
       coding->annotated = 0;
@@ -7106,11 +7106,11 @@ decode_coding (struct coding_system *coding)
    return BUF.  */
 
 static inline int *
-handle_composition_annotation (EMACS_INT pos, EMACS_INT limit,
+handle_composition_annotation (ptrdiff_t pos, ptrdiff_t limit,
 			       struct coding_system *coding, int *buf,
-			       EMACS_INT *stop)
+			       ptrdiff_t *stop)
 {
-  EMACS_INT start, end;
+  ptrdiff_t start, end;
   Lisp_Object prop;
 
   if (! find_composition (pos, limit, &start, &end, &prop, coding->src_object)
@@ -7189,9 +7189,9 @@ handle_composition_annotation (EMACS_INT pos, EMACS_INT limit,
    property value is non-nil (limiting by LIMIT), and return BUF.  */
 
 static inline int *
-handle_charset_annotation (EMACS_INT pos, EMACS_INT limit,
+handle_charset_annotation (ptrdiff_t pos, ptrdiff_t limit,
 			   struct coding_system *coding, int *buf,
-			   EMACS_INT *stop)
+			   ptrdiff_t *stop)
 {
   Lisp_Object val, next;
   int id;
@@ -7218,12 +7218,12 @@ consume_chars (struct coding_system *coding, Lisp_Object translation_table,
   int *buf_end = coding->charbuf + coding->charbuf_size;
   const unsigned char *src = coding->source + coding->consumed;
   const unsigned char *src_end = coding->source + coding->src_bytes;
-  EMACS_INT pos = coding->src_pos + coding->consumed_char;
-  EMACS_INT end_pos = coding->src_pos + coding->src_chars;
+  ptrdiff_t pos = coding->src_pos + coding->consumed_char;
+  ptrdiff_t end_pos = coding->src_pos + coding->src_chars;
   int multibytep = coding->src_multibyte;
   Lisp_Object eol_type;
   int c;
-  EMACS_INT stop, stop_composition, stop_charset;
+  ptrdiff_t stop, stop_composition, stop_charset;
   int *lookup_buf = NULL;
 
   if (! NILP (translation_table))
@@ -7272,7 +7272,7 @@ consume_chars (struct coding_system *coding, Lisp_Object translation_table,
 
       if (! multibytep)
 	{
-	  EMACS_INT bytes;
+	  int bytes;
 
 	  if (coding->encoder == encode_coding_raw_text
 	      || coding->encoder == encode_coding_ccl)
@@ -7498,9 +7498,9 @@ code_conversion_save (int with_work_buf, int multibyte)
 
 int
 decode_coding_gap (struct coding_system *coding,
-		   EMACS_INT chars, EMACS_INT bytes)
+		   ptrdiff_t chars, ptrdiff_t bytes)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object attrs;
 
   code_conversion_save (0, 0);
@@ -7527,7 +7527,7 @@ decode_coding_gap (struct coding_system *coding,
   attrs = CODING_ID_ATTRS (coding->id);
   if (! NILP (CODING_ATTR_POST_READ (attrs)))
     {
-      EMACS_INT prev_Z = Z, prev_Z_BYTE = Z_BYTE;
+      ptrdiff_t prev_Z = Z, prev_Z_BYTE = Z_BYTE;
       Lisp_Object val;
 
       TEMP_SET_PT_BOTH (coding->dst_pos, coding->dst_pos_byte);
@@ -7575,15 +7575,15 @@ decode_coding_gap (struct coding_system *coding,
 void
 decode_coding_object (struct coding_system *coding,
 		      Lisp_Object src_object,
-		      EMACS_INT from, EMACS_INT from_byte,
-		      EMACS_INT to, EMACS_INT to_byte,
+		      ptrdiff_t from, ptrdiff_t from_byte,
+		      ptrdiff_t to, ptrdiff_t to_byte,
 		      Lisp_Object dst_object)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   unsigned char *destination IF_LINT (= NULL);
-  EMACS_INT dst_bytes IF_LINT (= 0);
-  EMACS_INT chars = to - from;
-  EMACS_INT bytes = to_byte - from_byte;
+  ptrdiff_t dst_bytes IF_LINT (= 0);
+  ptrdiff_t chars = to - from;
+  ptrdiff_t bytes = to_byte - from_byte;
   Lisp_Object attrs;
   int saved_pt = -1, saved_pt_byte IF_LINT (= 0);
   int need_marker_adjustment = 0;
@@ -7676,7 +7676,7 @@ decode_coding_object (struct coding_system *coding,
   if (! NILP (CODING_ATTR_POST_READ (attrs)))
     {
       struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
-      EMACS_INT prev_Z = Z, prev_Z_BYTE = Z_BYTE;
+      ptrdiff_t prev_Z = Z, prev_Z_BYTE = Z_BYTE;
       Lisp_Object val;
 
       TEMP_SET_PT_BOTH (coding->dst_pos, coding->dst_pos_byte);
@@ -7765,13 +7765,13 @@ decode_coding_object (struct coding_system *coding,
 void
 encode_coding_object (struct coding_system *coding,
 		      Lisp_Object src_object,
-		      EMACS_INT from, EMACS_INT from_byte,
-		      EMACS_INT to, EMACS_INT to_byte,
+		      ptrdiff_t from, ptrdiff_t from_byte,
+		      ptrdiff_t to, ptrdiff_t to_byte,
 		      Lisp_Object dst_object)
 {
-  int count = SPECPDL_INDEX ();
-  EMACS_INT chars = to - from;
-  EMACS_INT bytes = to_byte - from_byte;
+  ptrdiff_t count = SPECPDL_INDEX ();
+  ptrdiff_t chars = to - from;
+  ptrdiff_t bytes = to_byte - from_byte;
   Lisp_Object attrs;
   int saved_pt = -1, saved_pt_byte IF_LINT (= 0);
   int need_marker_adjustment = 0;
@@ -8019,7 +8019,7 @@ are lower-case).  */)
   (Lisp_Object prompt, Lisp_Object default_coding_system)
 {
   Lisp_Object val;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   if (SYMBOLP (default_coding_system))
     default_coding_system = SYMBOL_NAME (default_coding_system);
@@ -8071,7 +8071,7 @@ function `define-coding-system'.  */)
 
 Lisp_Object
 detect_coding_system (const unsigned char *src,
-		      EMACS_INT src_chars, EMACS_INT src_bytes,
+		      ptrdiff_t src_chars, ptrdiff_t src_bytes,
 		      int highest, int multibytep,
 		      Lisp_Object coding_system)
 {
@@ -8391,8 +8391,8 @@ If optional argument HIGHEST is non-nil, return the coding system of
 highest priority.  */)
   (Lisp_Object start, Lisp_Object end, Lisp_Object highest)
 {
-  int from, to;
-  int from_byte, to_byte;
+  ptrdiff_t from, to;
+  ptrdiff_t from_byte, to_byte;
 
   CHECK_NUMBER_COERCE_MARKER (start);
   CHECK_NUMBER_COERCE_MARKER (end);
@@ -8472,7 +8472,7 @@ DEFUN ("find-coding-systems-region-internal",
   (Lisp_Object start, Lisp_Object end, Lisp_Object exclude)
 {
   Lisp_Object coding_attrs_list, safe_codings;
-  EMACS_INT start_byte, end_byte;
+  ptrdiff_t start_byte, end_byte;
   const unsigned char *p, *pbeg, *pend;
   int c;
   Lisp_Object tail, elt, work_table;
@@ -8566,7 +8566,7 @@ DEFUN ("find-coding-systems-region-internal",
 	    }
 	  if (charset_map_loaded)
 	    {
-	      EMACS_INT p_offset = p - pbeg, pend_offset = pend - pbeg;
+	      ptrdiff_t p_offset = p - pbeg, pend_offset = pend - pbeg;
 
 	      if (STRINGP (start))
 		pbeg = SDATA (start);
@@ -8604,11 +8604,11 @@ for un-encodable characters.  In that case, START and END are indexes
 to the string.  */)
   (Lisp_Object start, Lisp_Object end, Lisp_Object coding_system, Lisp_Object count, Lisp_Object string)
 {
-  int n;
+  EMACS_INT n;
   struct coding_system coding;
   Lisp_Object attrs, charset_list, translation_table;
   Lisp_Object positions;
-  int from, to;
+  ptrdiff_t from, to;
   const unsigned char *p, *stop, *pend;
   int ascii_compatible;
 
@@ -8641,11 +8641,10 @@ to the string.  */)
       CHECK_STRING (string);
       CHECK_NATNUM (start);
       CHECK_NATNUM (end);
+      if (! (XINT (start) <= XINT (end) && XINT (end) <= SCHARS (string)))
+	args_out_of_range_3 (string, start, end);
       from = XINT (start);
       to = XINT (end);
-      if (from > to
-	  || to > SCHARS (string))
-	args_out_of_range_3 (string, start, end);
       if (! STRING_MULTIBYTE (string))
 	return Qnil;
       p = SDATA (string) + string_char_to_byte (string, from);
@@ -8720,8 +8719,8 @@ is nil.  */)
   (Lisp_Object start, Lisp_Object end, Lisp_Object coding_system_list)
 {
   Lisp_Object list;
-  EMACS_INT start_byte, end_byte;
-  int pos;
+  ptrdiff_t start_byte, end_byte;
+  ptrdiff_t pos;
   const unsigned char *p, *pbeg, *pend;
   int c;
   Lisp_Object tail, elt, attrs;
@@ -8794,7 +8793,7 @@ is nil.  */)
 	    }
 	  if (charset_map_loaded)
 	    {
-	      EMACS_INT p_offset = p - pbeg, pend_offset = pend - pbeg;
+	      ptrdiff_t p_offset = p - pbeg, pend_offset = pend - pbeg;
 
 	      if (STRINGP (start))
 		pbeg = SDATA (start);
@@ -8827,7 +8826,7 @@ code_convert_region (Lisp_Object start, Lisp_Object end,
 		     int encodep, int norecord)
 {
   struct coding_system coding;
-  EMACS_INT from, from_byte, to, to_byte;
+  ptrdiff_t from, from_byte, to, to_byte;
   Lisp_Object src_object;
 
   CHECK_NUMBER_COERCE_MARKER (start);
@@ -8915,7 +8914,7 @@ code_convert_string (Lisp_Object string, Lisp_Object coding_system,
 		     Lisp_Object dst_object, int encodep, int nocopy, int norecord)
 {
   struct coding_system coding;
-  EMACS_INT chars, bytes;
+  ptrdiff_t chars, bytes;
 
   CHECK_STRING (string);
   if (NILP (coding_system))
@@ -9290,7 +9289,7 @@ usage: (find-operation-coding-system OPERATION ARGUMENTS...)  */)
     error ("Too few arguments");
   operation = args[0];
   if (!SYMBOLP (operation)
-      || !NATNUMP (target_idx = Fget (operation, Qtarget_idx)))
+      || (target_idx = Fget (operation, Qtarget_idx), !NATNUMP (target_idx)))
     error ("Invalid first argument");
   if (nargs < 1 + XFASTINT (target_idx))
     error ("Too few arguments for operation `%s'",
@@ -9511,8 +9510,12 @@ usage: (define-coding-system-internal ...)  */)
 	  charset_list = Vemacs_mule_charset_list;
 	}
       for (tail = charset_list; CONSP (tail); tail = XCDR (tail))
-	if (max_charset_id < XFASTINT (XCAR (tail)))
-	  max_charset_id = XFASTINT (XCAR (tail));
+	{
+	  if (! RANGED_INTEGERP (0, XCAR (tail), INT_MAX - 1))
+	    error ("Invalid charset-list");
+	  if (max_charset_id < XFASTINT (XCAR (tail)))
+	    max_charset_id = XFASTINT (XCAR (tail));
+	}
     }
   else
     {
@@ -9672,23 +9675,23 @@ usage: (define-coding-system-internal ...)  */)
 	  val = Fcar (tail);
 	  if (INTEGERP (val))
 	    {
-	      from = to = XINT (val);
-	      if (from < 0 || from > 255)
+	      if (! (0 <= XINT (val) && XINT (val) <= 255))
 		args_out_of_range_3 (val, make_number (0), make_number (255));
+	      from = to = XINT (val);
 	    }
 	  else
 	    {
 	      CHECK_CONS (val);
 	      CHECK_NATNUM_CAR (val);
-	      CHECK_NATNUM_CDR (val);
-	      from = XINT (XCAR (val));
-	      if (from > 255)
+	      CHECK_NUMBER_CDR (val);
+	      if (XINT (XCAR (val)) > 255)
 		args_out_of_range_3 (XCAR (val),
 				     make_number (0), make_number (255));
-	      to = XINT (XCDR (val));
-	      if (to < from || to > 255)
+	      from = XINT (XCAR (val));
+	      if (! (from <= XINT (XCDR (val)) && XINT (XCDR (val)) <= 255))
 		args_out_of_range_3 (XCDR (val),
 				     XCAR (val), make_number (255));
+	      to = XINT (XCDR (val));
 	    }
 	  for (i = from; i <= to; i++)
 	    SSET (valids, i, 1);
@@ -9783,9 +9786,10 @@ usage: (define-coding-system-internal ...)  */)
 
       flags = args[coding_arg_iso2022_flags];
       CHECK_NATNUM (flags);
-      i = XINT (flags);
+      i = XINT (flags) & INT_MAX;
       if (EQ (args[coding_arg_charset_list], Qiso_2022))
-	flags = make_number (i | CODING_ISO_FLAG_FULL_SUPPORT);
+	i |= CODING_ISO_FLAG_FULL_SUPPORT;
+      flags = make_number (i);
 
       ASET (attrs, coding_attr_iso_initial, initial);
       ASET (attrs, coding_attr_iso_usage, reg_usage);
diff --git a/src/coding.h b/src/coding.h
index fdf9b762e75..3cf28fb2458 100644
--- a/src/coding.h
+++ b/src/coding.h
@@ -449,25 +449,25 @@ struct coding_system
      -1 in setup_coding_system, and updated by detect_coding.  So,
      when this is equal to the byte length of the text being
      converted, we can skip the actual conversion process.  */
-  EMACS_INT head_ascii;
+  ptrdiff_t head_ascii;
 
   /* The following members are set by encoding/decoding routine.  */
-  EMACS_INT produced, produced_char, consumed, consumed_char;
+  ptrdiff_t produced, produced_char, consumed, consumed_char;
 
   /* Number of error source data found in a decoding routine.  */
   int errors;
 
   /* Store the positions of error source data. */
-  EMACS_INT *error_positions;
+  ptrdiff_t *error_positions;
 
   /* Finish status of code conversion.  */
   enum coding_result_code result;
 
-  EMACS_INT src_pos, src_pos_byte, src_chars, src_bytes;
+  ptrdiff_t src_pos, src_pos_byte, src_chars, src_bytes;
   Lisp_Object src_object;
   const unsigned char *source;
 
-  EMACS_INT dst_pos, dst_pos_byte, dst_bytes;
+  ptrdiff_t dst_pos, dst_pos_byte, dst_bytes;
   Lisp_Object dst_object;
   unsigned char *destination;
 
@@ -704,13 +704,13 @@ extern Lisp_Object coding_inherit_eol_type (Lisp_Object, Lisp_Object);
 extern Lisp_Object complement_process_encoding_system (Lisp_Object);
 
 extern int decode_coding_gap (struct coding_system *,
-                              EMACS_INT, EMACS_INT);
+                              ptrdiff_t, ptrdiff_t);
 extern void decode_coding_object (struct coding_system *,
-                                  Lisp_Object, EMACS_INT, EMACS_INT,
-                                  EMACS_INT, EMACS_INT, Lisp_Object);
+                                  Lisp_Object, ptrdiff_t, ptrdiff_t,
+                                  ptrdiff_t, ptrdiff_t, Lisp_Object);
 extern void encode_coding_object (struct coding_system *,
-                                  Lisp_Object, EMACS_INT, EMACS_INT,
-                                  EMACS_INT, EMACS_INT, Lisp_Object);
+                                  Lisp_Object, ptrdiff_t, ptrdiff_t,
+                                  ptrdiff_t, ptrdiff_t, Lisp_Object);
 
 /* Macros for backward compatibility.  */
 
diff --git a/src/composite.c b/src/composite.c
index c8e4dd082ae..90a239281fe 100644
--- a/src/composite.c
+++ b/src/composite.c
@@ -173,7 +173,7 @@ Lisp_Object composition_temp;
    If the composition is invalid, return -1.  */
 
 ptrdiff_t
-get_composition_id (EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT nchars,
+get_composition_id (ptrdiff_t charpos, ptrdiff_t bytepos, ptrdiff_t nchars,
 		    Lisp_Object prop, Lisp_Object string)
 {
   Lisp_Object id, length, components, key, *key_contents;
@@ -183,7 +183,7 @@ get_composition_id (EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT nchars,
   EMACS_UINT hash_code;
   enum composition_method method;
   struct composition *cmp;
-  EMACS_INT i;
+  ptrdiff_t i;
   int ch;
 
   /* Maximum length of a string of glyphs.  XftGlyphExtents limits
@@ -284,7 +284,7 @@ get_composition_id (EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT nchars,
       && VECTORP (AREF (components, 0)))
     {
       /* COMPONENTS is a glyph-string.  */
-      EMACS_INT len = ASIZE (key);
+      ptrdiff_t len = ASIZE (key);
 
       for (i = 1; i < len; i++)
 	if (! VECTORP (AREF (key, i)))
@@ -292,7 +292,7 @@ get_composition_id (EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT nchars,
     }
   else if (VECTORP (components) || CONSP (components))
     {
-      EMACS_INT len = ASIZE (key);
+      ptrdiff_t len = ASIZE (key);
 
       /* The number of elements should be odd.  */
       if ((len % 2) == 0)
@@ -429,8 +429,8 @@ get_composition_id (EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT nchars,
    This doesn't check the validity of composition.  */
 
 int
-find_composition (EMACS_INT pos, EMACS_INT limit,
-		  EMACS_INT *start, EMACS_INT *end,
+find_composition (ptrdiff_t pos, ptrdiff_t limit,
+		  ptrdiff_t *start, ptrdiff_t *end,
 		  Lisp_Object *prop, Lisp_Object object)
 {
   Lisp_Object val;
@@ -469,10 +469,10 @@ find_composition (EMACS_INT pos, EMACS_INT limit,
    FROM and TO with property PROP.  */
 
 static void
-run_composition_function (EMACS_INT from, EMACS_INT to, Lisp_Object prop)
+run_composition_function (ptrdiff_t from, ptrdiff_t to, Lisp_Object prop)
 {
   Lisp_Object func;
-  EMACS_INT start, end;
+  ptrdiff_t start, end;
 
   func = COMPOSITION_MODIFICATION_FUNC (prop);
   /* If an invalid composition precedes or follows, try to make them
@@ -501,13 +501,13 @@ run_composition_function (EMACS_INT from, EMACS_INT to, Lisp_Object prop)
    change is deletion, FROM == TO.  Otherwise, FROM < TO.  */
 
 void
-update_compositions (EMACS_INT from, EMACS_INT to, int check_mask)
+update_compositions (ptrdiff_t from, ptrdiff_t to, int check_mask)
 {
   Lisp_Object prop;
-  EMACS_INT start, end;
+  ptrdiff_t start, end;
   /* The beginning and end of the region to set the property
      `auto-composed' to nil.  */
-  EMACS_INT min_pos = from, max_pos = to;
+  ptrdiff_t min_pos = from, max_pos = to;
 
   if (inhibit_modification_hooks)
     return;
@@ -589,7 +589,7 @@ update_compositions (EMACS_INT from, EMACS_INT to, int check_mask)
     }
   if (min_pos < max_pos)
     {
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
 
       specbind (Qinhibit_read_only, Qt);
       specbind (Qinhibit_modification_hooks, Qt);
@@ -632,7 +632,7 @@ make_composition_value_copy (Lisp_Object list)
    indices START and END in STRING.  */
 
 void
-compose_text (EMACS_INT start, EMACS_INT end, Lisp_Object components,
+compose_text (ptrdiff_t start, ptrdiff_t end, Lisp_Object components,
 	      Lisp_Object modification_func, Lisp_Object string)
 {
   Lisp_Object prop;
@@ -644,8 +644,8 @@ compose_text (EMACS_INT start, EMACS_INT end, Lisp_Object components,
 }
 
 
-static Lisp_Object autocmp_chars (Lisp_Object, EMACS_INT, EMACS_INT,
-                                  EMACS_INT, struct window *,
+static Lisp_Object autocmp_chars (Lisp_Object, ptrdiff_t, ptrdiff_t,
+                                  ptrdiff_t, struct window *,
                                   struct face *, Lisp_Object);
 
 
@@ -669,25 +669,25 @@ gstring_lookup_cache (Lisp_Object header)
 }
 
 Lisp_Object
-composition_gstring_put_cache (Lisp_Object gstring, EMACS_INT len)
+composition_gstring_put_cache (Lisp_Object gstring, ptrdiff_t len)
 {
   struct Lisp_Hash_Table *h = XHASH_TABLE (gstring_hash_table);
   EMACS_UINT hash;
   Lisp_Object header, copy;
-  EMACS_INT i;
+  ptrdiff_t i;
 
   header = LGSTRING_HEADER (gstring);
   hash = h->hashfn (h, header);
   if (len < 0)
     {
-      EMACS_INT j, glyph_len = LGSTRING_GLYPH_LEN (gstring);
+      ptrdiff_t j, glyph_len = LGSTRING_GLYPH_LEN (gstring);
       for (j = 0; j < glyph_len; j++)
 	if (NILP (LGSTRING_GLYPH (gstring, j)))
 	  break;
       len = j;
     }
 
-  lint_assume (len <= TYPE_MAXIMUM (EMACS_INT) - 2);
+  lint_assume (len <= TYPE_MAXIMUM (ptrdiff_t) - 2);
   copy = Fmake_vector (make_number (len + 2), Qnil);
   LGSTRING_SET_HEADER (copy, Fcopy_sequence (header));
   for (i = 0; i < len; i++)
@@ -713,7 +713,7 @@ int
 composition_gstring_p (Lisp_Object gstring)
 {
   Lisp_Object header;
-  EMACS_INT i;
+  ptrdiff_t i;
 
   if (! VECTORP (gstring) || ASIZE (gstring) < 2)
     return 0;
@@ -741,7 +741,7 @@ composition_gstring_p (Lisp_Object gstring)
 }
 
 int
-composition_gstring_width (Lisp_Object gstring, EMACS_INT from, EMACS_INT to,
+composition_gstring_width (Lisp_Object gstring, ptrdiff_t from, ptrdiff_t to,
 			   struct font_metrics *metrics)
 {
   Lisp_Object *glyph;
@@ -800,8 +800,8 @@ static Lisp_Object gstring_work_headers;
 static Lisp_Object
 fill_gstring_header (Lisp_Object header, Lisp_Object start, Lisp_Object end, Lisp_Object font_object, Lisp_Object string)
 {
-  EMACS_INT from, to, from_byte;
-  EMACS_INT len, i;
+  ptrdiff_t from, to, from_byte;
+  ptrdiff_t len, i;
 
   if (NILP (string))
     {
@@ -817,11 +817,11 @@ fill_gstring_header (Lisp_Object header, Lisp_Object start, Lisp_Object end, Lis
       CHECK_STRING (string);
       if (! STRING_MULTIBYTE (string))
 	error ("Attempt to shape unibyte text");
-      /* FROM and TO are checked by the caller.  */
+      /* The caller checks that START and END are nonnegative integers.  */
+      if (! (XINT (start) <= XINT (end) && XINT (end) <= SCHARS (string)))
+	args_out_of_range_3 (string, start, end);
       from = XINT (start);
       to = XINT (end);
-      if (from < 0 || from > to || to > SCHARS (string))
-	args_out_of_range_3 (string, start, end);
       from_byte = string_char_to_byte (string, from);
     }
 
@@ -860,8 +860,8 @@ fill_gstring_body (Lisp_Object gstring)
 {
   Lisp_Object font_object = LGSTRING_FONT (gstring);
   Lisp_Object header = AREF (gstring, 0);
-  EMACS_INT len = LGSTRING_CHAR_LEN (gstring);
-  EMACS_INT i;
+  ptrdiff_t len = LGSTRING_CHAR_LEN (gstring);
+  ptrdiff_t i;
 
   for (i = 0; i < len; i++)
     {
@@ -906,15 +906,15 @@ fill_gstring_body (Lisp_Object gstring)
    object.  Otherwise return nil.  */
 
 static Lisp_Object
-autocmp_chars (Lisp_Object rule, EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT limit, struct window *win, struct face *face, Lisp_Object string)
+autocmp_chars (Lisp_Object rule, ptrdiff_t charpos, ptrdiff_t bytepos, ptrdiff_t limit, struct window *win, struct face *face, Lisp_Object string)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   FRAME_PTR f = XFRAME (win->frame);
   Lisp_Object pos = make_number (charpos);
-  EMACS_INT to;
-  EMACS_INT pt = PT, pt_byte = PT_BYTE;
+  ptrdiff_t to;
+  ptrdiff_t pt = PT, pt_byte = PT_BYTE;
   Lisp_Object re, font_object, lgstring;
-  EMACS_INT len;
+  ptrdiff_t len;
 
   record_unwind_save_match_data ();
   re = AREF (rule, 0);
@@ -997,9 +997,9 @@ static Lisp_Object _work_val;
    composition.  */
 
 void
-composition_compute_stop_pos (struct composition_it *cmp_it, EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT endpos, Lisp_Object string)
+composition_compute_stop_pos (struct composition_it *cmp_it, ptrdiff_t charpos, ptrdiff_t bytepos, ptrdiff_t endpos, Lisp_Object string)
 {
-  EMACS_INT start, end;
+  ptrdiff_t start, end;
   int c;
   Lisp_Object prop, val;
   /* This is from forward_to_next_line_start in xdisp.c.  */
@@ -1109,7 +1109,7 @@ composition_compute_stop_pos (struct composition_it *cmp_it, EMACS_INT charpos,
       int len;
       /* Limit byte position used in fast_looking_at.  This is the
 	 byte position of the character after START. */
-      EMACS_INT limit;
+      ptrdiff_t limit;
 
       if (NILP (string))
 	p = BYTE_POS_ADDR (bytepos);
@@ -1123,16 +1123,17 @@ composition_compute_stop_pos (struct composition_it *cmp_it, EMACS_INT charpos,
 	  if (! NILP (val))
 	    {
 	      Lisp_Object elt;
-	      int ridx, back, blen;
+	      int ridx, blen;
 
 	      for (ridx = 0; CONSP (val); val = XCDR (val), ridx++)
 		{
 		  elt = XCAR (val);
 		  if (VECTORP (elt) && ASIZE (elt) == 3
 		      && NATNUMP (AREF (elt, 1))
-		      && charpos - (back = XFASTINT (AREF (elt, 1))) > endpos)
+		      && charpos - XFASTINT (AREF (elt, 1)) > endpos)
 		    {
-		      EMACS_INT cpos = charpos - back, bpos;
+		      ptrdiff_t back = XFASTINT (AREF (elt, 1));
+		      ptrdiff_t cpos = charpos - back, bpos;
 
 		      if (back == 0)
 			bpos = bytepos;
@@ -1226,7 +1227,7 @@ composition_compute_stop_pos (struct composition_it *cmp_it, EMACS_INT charpos,
    CMP_IT->stop_pos, and return 0.  */
 
 int
-composition_reseat_it (struct composition_it *cmp_it, EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT endpos, struct window *w, struct face *face, Lisp_Object string)
+composition_reseat_it (struct composition_it *cmp_it, ptrdiff_t charpos, ptrdiff_t bytepos, ptrdiff_t endpos, struct window *w, struct face *face, Lisp_Object string)
 {
   if (endpos < 0)
     endpos = NILP (string) ? BEGV : 0;
@@ -1242,7 +1243,7 @@ composition_reseat_it (struct composition_it *cmp_it, EMACS_INT charpos, EMACS_I
   if (cmp_it->ch < 0)
     {
       /* We are looking at a static composition.  */
-      EMACS_INT start, end;
+      ptrdiff_t start, end;
       Lisp_Object prop;
 
       find_composition (charpos, -1, &start, &end, &prop, string);
@@ -1257,7 +1258,7 @@ composition_reseat_it (struct composition_it *cmp_it, EMACS_INT charpos, EMACS_I
     {
       Lisp_Object lgstring = Qnil;
       Lisp_Object val, elt;
-      EMACS_INT i;
+      ptrdiff_t i;
 
       val = CHAR_TABLE_REF (Vcomposition_function_table, cmp_it->ch);
       for (i = 0; i < cmp_it->rule_idx; i++, val = XCDR (val));
@@ -1284,7 +1285,7 @@ composition_reseat_it (struct composition_it *cmp_it, EMACS_INT charpos, EMACS_I
 	}
       else
 	{
-	  EMACS_INT cpos = charpos, bpos = bytepos;
+	  ptrdiff_t cpos = charpos, bpos = bytepos;
 
 	  while (1)
 	    {
@@ -1370,7 +1371,7 @@ composition_reseat_it (struct composition_it *cmp_it, EMACS_INT charpos, EMACS_I
    the cluster, or -1 if the composition is somehow broken.  */
 
 int
-composition_update_it (struct composition_it *cmp_it, EMACS_INT charpos, EMACS_INT bytepos, Lisp_Object string)
+composition_update_it (struct composition_it *cmp_it, ptrdiff_t charpos, ptrdiff_t bytepos, Lisp_Object string)
 {
   int i, c IF_LINT (= 0);
 
@@ -1405,7 +1406,7 @@ composition_update_it (struct composition_it *cmp_it, EMACS_INT charpos, EMACS_I
       /* automatic composition */
       Lisp_Object gstring = composition_gstring_from_id (cmp_it->id);
       Lisp_Object glyph;
-      EMACS_INT from;
+      ptrdiff_t from;
 
       if (cmp_it->nglyphs == 0)
 	{
@@ -1457,7 +1458,7 @@ composition_update_it (struct composition_it *cmp_it, EMACS_INT charpos, EMACS_I
 
 struct position_record
 {
-  EMACS_INT pos, pos_byte;
+  ptrdiff_t pos, pos_byte;
   unsigned char *p;
 };
 
@@ -1496,14 +1497,14 @@ struct position_record
    Qnil, and return 0.  */
 
 static int
-find_automatic_composition (EMACS_INT pos, EMACS_INT limit,
-			    EMACS_INT *start, EMACS_INT *end,
+find_automatic_composition (ptrdiff_t pos, ptrdiff_t limit,
+			    ptrdiff_t *start, ptrdiff_t *end,
 			    Lisp_Object *gstring, Lisp_Object string)
 {
-  EMACS_INT head, tail, stop;
+  ptrdiff_t head, tail, stop;
   /* Forward limit position of checking a composition taking a
      looking-back count into account.  */
-  EMACS_INT fore_check_limit;
+  ptrdiff_t fore_check_limit;
   struct position_record cur, prev;
   int c;
   Lisp_Object window;
@@ -1688,10 +1689,10 @@ find_automatic_composition (EMACS_INT pos, EMACS_INT limit,
 /* Return the adjusted point provided that point is moved from LAST_PT
    to NEW_PT.  */
 
-EMACS_INT
-composition_adjust_point (EMACS_INT last_pt, EMACS_INT new_pt)
+ptrdiff_t
+composition_adjust_point (ptrdiff_t last_pt, ptrdiff_t new_pt)
 {
-  EMACS_INT i, beg, end;
+  ptrdiff_t i, beg, end;
   Lisp_Object val;
 
   if (new_pt == BEGV || new_pt == ZV)
@@ -1712,7 +1713,7 @@ composition_adjust_point (EMACS_INT last_pt, EMACS_INT new_pt)
     return new_pt;
 
   /* Next check the automatic composition.  */
-  if (! find_automatic_composition (new_pt, (EMACS_INT) -1, &beg, &end, &val,
+  if (! find_automatic_composition (new_pt, (ptrdiff_t) -1, &beg, &end, &val,
 				    Qnil)
       || beg == new_pt)
     return new_pt;
@@ -1773,7 +1774,7 @@ should be ignored.  */)
   (Lisp_Object from, Lisp_Object to, Lisp_Object font_object, Lisp_Object string)
 {
   Lisp_Object gstring, header;
-  EMACS_INT frompos, topos;
+  ptrdiff_t frompos, topos;
 
   CHECK_NATNUM (from);
   CHECK_NATNUM (to);
@@ -1857,15 +1858,14 @@ See `find-composition' for more details.  */)
   (Lisp_Object pos, Lisp_Object limit, Lisp_Object string, Lisp_Object detail_p)
 {
   Lisp_Object prop, tail, gstring;
-  EMACS_INT start, end, from, to;
+  ptrdiff_t start, end, from, to;
   int id;
 
   CHECK_NUMBER_COERCE_MARKER (pos);
-  from = XINT (pos);
   if (!NILP (limit))
     {
       CHECK_NUMBER_COERCE_MARKER (limit);
-      to = XINT (limit);
+      to = min (XINT (limit), ZV);
     }
   else
     to = -1;
@@ -1881,6 +1881,7 @@ See `find-composition' for more details.  */)
       if (XINT (pos) < BEGV || XINT (pos) > ZV)
 	args_out_of_range (Fcurrent_buffer (), pos);
     }
+  from = XINT (pos);
 
   if (!find_composition (from, to, &start, &end, &prop, string))
     {
@@ -1893,7 +1894,7 @@ See `find-composition' for more details.  */)
     }
   if ((end <= XINT (pos) || start > XINT (pos)))
     {
-      EMACS_INT s, e;
+      ptrdiff_t s, e;
 
       if (find_automatic_composition (from, to, &s, &e, &gstring, string)
 	  && (e <= XINT (pos) ? e > end : s < start))
@@ -1910,7 +1911,7 @@ See `find-composition' for more details.  */)
     id = COMPOSITION_ID (prop);
   else
     {
-      EMACS_INT start_byte = (NILP (string)
+      ptrdiff_t start_byte = (NILP (string)
 			      ? CHAR_TO_BYTE (start)
 			      : string_char_to_byte (string, start));
       id = get_composition_id (start, start_byte, end - start, prop, string);
diff --git a/src/composite.h b/src/composite.h
index c57e2a0e9b3..b21994e5e3c 100644
--- a/src/composite.h
+++ b/src/composite.h
@@ -186,7 +186,7 @@ struct composition {
   enum composition_method method;
 
   /* Index to the composition hash table.  */
-  EMACS_INT hash_index;
+  ptrdiff_t hash_index;
 
   /* For which font we have calculated the remaining members.  The
      actual type is device dependent.  */
@@ -216,16 +216,16 @@ extern ptrdiff_t n_compositions;
 
 extern Lisp_Object Qcomposition;
 extern Lisp_Object composition_hash_table;
-extern ptrdiff_t get_composition_id (EMACS_INT, EMACS_INT, EMACS_INT,
+extern ptrdiff_t get_composition_id (ptrdiff_t, ptrdiff_t, ptrdiff_t,
 				     Lisp_Object, Lisp_Object);
-extern int find_composition (EMACS_INT, EMACS_INT, EMACS_INT *, EMACS_INT *,
+extern int find_composition (ptrdiff_t, ptrdiff_t, ptrdiff_t *, ptrdiff_t *,
 			     Lisp_Object *, Lisp_Object);
-extern void update_compositions (EMACS_INT, EMACS_INT, int);
+extern void update_compositions (ptrdiff_t, ptrdiff_t, int);
 extern void make_composition_value_copy (Lisp_Object);
 extern void compose_region (int, int, Lisp_Object, Lisp_Object,
                             Lisp_Object);
 extern void syms_of_composite (void);
-extern void compose_text (EMACS_INT, EMACS_INT, Lisp_Object, Lisp_Object,
+extern void compose_text (ptrdiff_t, ptrdiff_t, Lisp_Object, Lisp_Object,
                           Lisp_Object);
 
 /* Macros for lispy glyph-string.  This is completely different from
@@ -298,22 +298,22 @@ struct composition_it;
 struct face;
 struct font_metrics;
 
-extern Lisp_Object composition_gstring_put_cache (Lisp_Object, EMACS_INT);
+extern Lisp_Object composition_gstring_put_cache (Lisp_Object, ptrdiff_t);
 extern Lisp_Object composition_gstring_from_id (ptrdiff_t);
 extern int composition_gstring_p (Lisp_Object);
-extern int composition_gstring_width (Lisp_Object, EMACS_INT, EMACS_INT,
+extern int composition_gstring_width (Lisp_Object, ptrdiff_t, ptrdiff_t,
                                       struct font_metrics *);
 
 extern void composition_compute_stop_pos (struct composition_it *,
-                                          EMACS_INT, EMACS_INT, EMACS_INT,
+                                          ptrdiff_t, ptrdiff_t, ptrdiff_t,
                                           Lisp_Object);
 extern int composition_reseat_it (struct composition_it *,
-                                  EMACS_INT, EMACS_INT, EMACS_INT,
+                                  ptrdiff_t, ptrdiff_t, ptrdiff_t,
                                   struct window *, struct face *,
                                   Lisp_Object);
 extern int composition_update_it (struct composition_it *,
-                                  EMACS_INT, EMACS_INT, Lisp_Object);
+                                  ptrdiff_t, ptrdiff_t, Lisp_Object);
 
-extern EMACS_INT composition_adjust_point (EMACS_INT, EMACS_INT);
+extern ptrdiff_t composition_adjust_point (ptrdiff_t, ptrdiff_t);
 
 #endif /* not EMACS_COMPOSITE_H */
diff --git a/src/data.c b/src/data.c
index 76a54547a5d..211a64661ac 100644
--- a/src/data.c
+++ b/src/data.c
@@ -1075,18 +1075,18 @@ let_shadows_buffer_binding_p (struct Lisp_Symbol *symbol)
 {
   struct specbinding *p;
 
-  for (p = specpdl_ptr - 1; p >= specpdl; p--)
-    if (p->func == NULL
+  for (p = specpdl_ptr; p > specpdl; )
+    if ((--p)->func == NULL
 	&& CONSP (p->symbol))
       {
 	struct Lisp_Symbol *let_bound_symbol = XSYMBOL (XCAR (p->symbol));
 	eassert (let_bound_symbol->redirect != SYMBOL_VARALIAS);
 	if (symbol == let_bound_symbol
 	    && XBUFFER (XCDR (XCDR (p->symbol))) == current_buffer)
-	  break;
+	  return 1;
       }
 
-  return p >= specpdl;
+  return 0;
 }
 
 static int
@@ -1094,11 +1094,11 @@ let_shadows_global_binding_p (Lisp_Object symbol)
 {
   struct specbinding *p;
 
-  for (p = specpdl_ptr - 1; p >= specpdl; p--)
-    if (p->func == NULL && EQ (p->symbol, symbol))
-      break;
+  for (p = specpdl_ptr; p > specpdl; p)
+    if ((--p)->func == NULL && EQ (p->symbol, symbol))
+      return 1;
 
-  return p >= specpdl;
+  return 0;
 }
 
 /* Store the value NEWVAL into SYMBOL.
@@ -2064,7 +2064,7 @@ or a byte-code object.  IDX starts at 0.  */)
   if (STRINGP (array))
     {
       int c;
-      EMACS_INT idxval_byte;
+      ptrdiff_t idxval_byte;
 
       if (idxval < 0 || idxval >= SCHARS (array))
 	args_out_of_range (array, idx);
@@ -2156,7 +2156,8 @@ bool-vector.  IDX starts at 0.  */)
 
       if (STRING_MULTIBYTE (array))
 	{
-	  EMACS_INT idxval_byte, prev_bytes, new_bytes, nbytes;
+	  ptrdiff_t idxval_byte, nbytes;
+	  int prev_bytes, new_bytes;
 	  unsigned char workbuf[MAX_MULTIBYTE_LENGTH], *p0 = workbuf, *p1;
 
 	  nbytes = SBYTES (array);
@@ -2167,7 +2168,7 @@ bool-vector.  IDX starts at 0.  */)
 	  if (prev_bytes != new_bytes)
 	    {
 	      /* We must relocate the string data.  */
-	      EMACS_INT nchars = SCHARS (array);
+	      ptrdiff_t nchars = SCHARS (array);
 	      unsigned char *str;
 	      USE_SAFE_ALLOCA;
 
@@ -2474,9 +2475,9 @@ If the base used is not 10, STRING is always parsed as integer.  */)
   else
     {
       CHECK_NUMBER (base);
-      b = XINT (base);
-      if (b < 2 || b > 16)
+      if (! (2 <= XINT (base) && XINT (base) <= 16))
 	xsignal1 (Qargs_out_of_range, base);
+      b = XINT (base);
     }
 
   p = SSDATA (string);
@@ -2724,7 +2725,7 @@ Both must be integers or markers.  */)
   CHECK_NUMBER_COERCE_MARKER (x);
   CHECK_NUMBER_COERCE_MARKER (y);
 
-  if (XFASTINT (y) == 0)
+  if (XINT (y) == 0)
     xsignal0 (Qarith_error);
 
   XSETINT (val, XINT (x) % XINT (y));
diff --git a/src/dbusbind.c b/src/dbusbind.c
index 227d4e647e9..72cef0cbc86 100644
--- a/src/dbusbind.c
+++ b/src/dbusbind.c
@@ -485,7 +485,7 @@ xd_append_arg (unsigned int dtype, Lisp_Object object, DBusMessageIter *iter)
 	}
 
       case DBUS_TYPE_INT16:
-	CHECK_NUMBER (object);
+	CHECK_TYPE_RANGED_INTEGER (dbus_int16_t, object);
 	{
 	  dbus_int16_t val = XINT (object);
 	  XD_DEBUG_MESSAGE ("%c %d", dtype, (int) val);
@@ -495,7 +495,7 @@ xd_append_arg (unsigned int dtype, Lisp_Object object, DBusMessageIter *iter)
 	}
 
       case DBUS_TYPE_UINT16:
-	CHECK_NATNUM (object);
+	CHECK_TYPE_RANGED_INTEGER (dbus_uint16_t, object);
 	{
 	  dbus_uint16_t val = XFASTINT (object);
 	  XD_DEBUG_MESSAGE ("%c %u", dtype, (unsigned int) val);
@@ -505,7 +505,7 @@ xd_append_arg (unsigned int dtype, Lisp_Object object, DBusMessageIter *iter)
 	}
 
       case DBUS_TYPE_INT32:
-	CHECK_NUMBER (object);
+	CHECK_TYPE_RANGED_INTEGER (dbus_int32_t, object);
 	{
 	  dbus_int32_t val = XINT (object);
 	  XD_DEBUG_MESSAGE ("%c %d", dtype, val);
@@ -518,7 +518,7 @@ xd_append_arg (unsigned int dtype, Lisp_Object object, DBusMessageIter *iter)
 #ifdef DBUS_TYPE_UNIX_FD
       case DBUS_TYPE_UNIX_FD:
 #endif
-	CHECK_NATNUM (object);
+	CHECK_TYPE_RANGED_INTEGER (dbus_uint32_t, object);
 	{
 	  dbus_uint32_t val = XFASTINT (object);
 	  XD_DEBUG_MESSAGE ("%c %u", dtype, val);
@@ -528,7 +528,7 @@ xd_append_arg (unsigned int dtype, Lisp_Object object, DBusMessageIter *iter)
 	}
 
       case DBUS_TYPE_INT64:
-	CHECK_NUMBER (object);
+	CHECK_TYPE_RANGED_INTEGER (dbus_int64_t, object);
 	{
 	  dbus_int64_t val = XINT (object);
 	  XD_DEBUG_MESSAGE ("%c %d", dtype, (int) val);
@@ -538,7 +538,7 @@ xd_append_arg (unsigned int dtype, Lisp_Object object, DBusMessageIter *iter)
 	}
 
       case DBUS_TYPE_UINT64:
-	CHECK_NATNUM (object);
+	CHECK_TYPE_RANGED_INTEGER (dbus_uint64_t, object);
 	{
 	  dbus_uint64_t val = XFASTINT (object);
 	  XD_DEBUG_MESSAGE ("%c %"pI"d", dtype, XFASTINT (object));
@@ -1145,7 +1145,7 @@ usage: (dbus-call-method BUS SERVICE PATH INTERFACE METHOD &optional :timeout TI
   if ((i+2 <= nargs) && (EQ ((args[i]), QCdbus_timeout)))
     {
       CHECK_NATNUM (args[i+1]);
-      timeout = XFASTINT (args[i+1]);
+      timeout = min (XFASTINT (args[i+1]), INT_MAX);
       i = i+2;
     }
 
@@ -1328,7 +1328,7 @@ usage: (dbus-call-method-asynchronously BUS SERVICE PATH INTERFACE METHOD HANDLE
   if ((i+2 <= nargs) && (EQ ((args[i]), QCdbus_timeout)))
     {
       CHECK_NATNUM (args[i+1]);
-      timeout = XFASTINT (args[i+1]);
+      timeout = min (XFASTINT (args[i+1]), INT_MAX);
       i = i+2;
     }
 
diff --git a/src/dired.c b/src/dired.c
index be94b16cf75..d1b4d410428 100644
--- a/src/dired.c
+++ b/src/dired.c
@@ -86,7 +86,7 @@ static Lisp_Object Qfile_name_all_completions;
 static Lisp_Object Qfile_attributes;
 static Lisp_Object Qfile_attributes_lessp;
 
-static int scmp (const char *, const char *, int);
+static ptrdiff_t scmp (const char *, const char *, ptrdiff_t);
 static Lisp_Object Ffile_attributes (Lisp_Object, Lisp_Object);
 
 #ifdef WINDOWSNT
@@ -117,11 +117,11 @@ Lisp_Object
 directory_files_internal (Lisp_Object directory, Lisp_Object full, Lisp_Object match, Lisp_Object nosort, int attrs, Lisp_Object id_format)
 {
   DIR *d;
-  int directory_nbytes;
+  ptrdiff_t directory_nbytes;
   Lisp_Object list, dirfilename, encoded_directory;
   struct re_pattern_buffer *bufp = NULL;
   int needsep = 0;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
   DIRENTRY *dp;
 #ifdef WINDOWSNT
@@ -226,7 +226,7 @@ directory_files_internal (Lisp_Object directory, Lisp_Object full, Lisp_Object m
 
       if (DIRENTRY_NONEMPTY (dp))
 	{
-	  int len;
+	  ptrdiff_t len;
 	  int wanted = 0;
 	  Lisp_Object name, finalname;
 	  struct gcpro inner_gcpro1, inner_gcpro2;
@@ -256,8 +256,8 @@ directory_files_internal (Lisp_Object directory, Lisp_Object full, Lisp_Object m
 	      if (!NILP (full))
 		{
 		  Lisp_Object fullname;
-		  int nbytes = len + directory_nbytes + needsep;
-		  int nchars;
+		  ptrdiff_t nbytes = len + directory_nbytes + needsep;
+		  ptrdiff_t nchars;
 
 		  fullname = make_uninit_multibyte_string (nbytes, nbytes);
 		  memcpy (SDATA (fullname), SDATA (directory),
@@ -447,7 +447,7 @@ static Lisp_Object
 file_name_completion (Lisp_Object file, Lisp_Object dirname, int all_flag, int ver_flag, Lisp_Object predicate)
 {
   DIR *d;
-  int bestmatchsize = 0;
+  ptrdiff_t bestmatchsize = 0;
   int matchcount = 0;
   /* If ALL_FLAG is 1, BESTMATCH is the list of all matches, decoded.
      If ALL_FLAG is 0, BESTMATCH is either nil
@@ -461,7 +461,7 @@ file_name_completion (Lisp_Object file, Lisp_Object dirname, int all_flag, int v
      well as "." and "..".  Until shown otherwise, assume we can't exclude
      anything.  */
   int includeall = 1;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
 
   elt = Qnil;
@@ -501,7 +501,7 @@ file_name_completion (Lisp_Object file, Lisp_Object dirname, int all_flag, int v
   while (1)
     {
       DIRENTRY *dp;
-      int len;
+      ptrdiff_t len;
       int canexclude = 0;
 
       errno = 0;
@@ -537,7 +537,7 @@ file_name_completion (Lisp_Object file, Lisp_Object dirname, int all_flag, int v
 	 completions when making a list of them.  */
       if (!all_flag)
 	{
-	  int skip;
+	  ptrdiff_t skip;
 
 #if 0 /* FIXME: The `scmp' call compares an encoded and a decoded string. */
 	  /* If this entry matches the current bestmatch, the only
@@ -567,7 +567,7 @@ file_name_completion (Lisp_Object file, Lisp_Object dirname, int all_flag, int v
 		for (tem = Vcompletion_ignored_extensions;
 		     CONSP (tem); tem = XCDR (tem))
 		  {
-		    int elt_len;
+		    ptrdiff_t elt_len;
 		    char *p1;
 
 		    elt = XCAR (tem);
@@ -684,7 +684,7 @@ file_name_completion (Lisp_Object file, Lisp_Object dirname, int all_flag, int v
 
       /* Suitably record this match.  */
 
-      matchcount++;
+      matchcount += matchcount <= 1;
 
       if (all_flag)
 	bestmatch = Fcons (name, bestmatch);
@@ -697,14 +697,14 @@ file_name_completion (Lisp_Object file, Lisp_Object dirname, int all_flag, int v
 	{
 	  Lisp_Object zero = make_number (0);
 	  /* FIXME: This is a copy of the code in Ftry_completion.  */
-	  int compare = min (bestmatchsize, SCHARS (name));
+	  ptrdiff_t compare = min (bestmatchsize, SCHARS (name));
 	  Lisp_Object cmp
 	    = Fcompare_strings (bestmatch, zero,
 				make_number (compare),
 				name, zero,
 				make_number (compare),
 				completion_ignore_case ? Qt : Qnil);
-	  int matchsize
+	  ptrdiff_t matchsize
 	    = (EQ (cmp, Qt)     ? compare
 	       : XINT (cmp) < 0 ? - XINT (cmp) - 1
 	       :                  XINT (cmp) - 1);
@@ -783,10 +783,10 @@ file_name_completion (Lisp_Object file, Lisp_Object dirname, int all_flag, int v
    Return -1 if strings match,
    else number of chars that match at the beginning.  */
 
-static int
-scmp (const char *s1, const char *s2, int len)
+static ptrdiff_t
+scmp (const char *s1, const char *s2, ptrdiff_t len)
 {
-  register int l = len;
+  register ptrdiff_t l = len;
 
   if (completion_ignore_case)
     {
@@ -809,10 +809,12 @@ scmp (const char *s1, const char *s2, int len)
 static int
 file_name_completion_stat (Lisp_Object dirname, DIRENTRY *dp, struct stat *st_addr)
 {
-  int len = NAMLEN (dp);
-  int pos = SCHARS (dirname);
+  ptrdiff_t len = NAMLEN (dp);
+  ptrdiff_t pos = SCHARS (dirname);
   int value;
-  char *fullname = (char *) alloca (len + pos + 2);
+  char *fullname;
+  USE_SAFE_ALLOCA;
+  SAFE_ALLOCA (fullname, char *, len + pos + 2);
 
 #ifdef MSDOS
   /* Some fields of struct stat are *very* expensive to compute on MS-DOS,
@@ -841,6 +843,7 @@ file_name_completion_stat (Lisp_Object dirname, DIRENTRY *dp, struct stat *st_ad
 #ifdef MSDOS
   _djstat_flags = save_djstat_flags;
 #endif /* MSDOS */
+  SAFE_FREE ();
   return value;
 }
 
diff --git a/src/dispextern.h b/src/dispextern.h
index 65284121588..76f3686c37a 100644
--- a/src/dispextern.h
+++ b/src/dispextern.h
@@ -179,10 +179,10 @@ extern int trace_redisplay_p EXTERNALLY_VISIBLE;
 struct text_pos
 {
   /* Character position.  */
-  EMACS_INT charpos;
+  ptrdiff_t charpos;
 
   /* Corresponding byte position.  */
-  EMACS_INT bytepos;
+  ptrdiff_t bytepos;
 };
 
 /* Access character and byte position of POS in a functional form.  */
@@ -253,7 +253,7 @@ struct display_pos
      is the index of that overlay string in the sequence of overlay
      strings at `pos' in the order redisplay processes them.  A value
      < 0 means that this is not a position in an overlay string.  */
-  int overlay_string_index;
+  ptrdiff_t overlay_string_index;
 
   /* If this is a position in an overlay string, string_pos is the
      position within that string.  */
@@ -320,7 +320,7 @@ struct glyph
      buffer, this is a position in that buffer.  A value of -1
      together with a null object means glyph is a truncation glyph at
      the start of a row.  */
-  EMACS_INT charpos;
+  ptrdiff_t charpos;
 
   /* Lisp object source of this glyph.  Currently either a buffer or
      a string, if the glyph was produced from characters which came from
@@ -1808,7 +1808,7 @@ typedef enum { NEUTRAL_DIR, L2R, R2L } bidi_dir_t;
 /* Data type for storing information about characters we need to
    remember.  */
 struct bidi_saved_info {
-  EMACS_INT bytepos, charpos;	/* character's buffer position */
+  ptrdiff_t bytepos, charpos;	/* character's buffer position */
   bidi_type_t type;		/* character's resolved bidi type */
   bidi_type_t type_after_w1;	/* original type of the character, after W1 */
   bidi_type_t orig_type;	/* type as we found it in the buffer */
@@ -1825,9 +1825,9 @@ struct bidi_stack {
 struct bidi_string_data {
   Lisp_Object lstring;		/* Lisp string to reorder, or nil */
   const unsigned char *s;	/* string data, or NULL if reordering buffer */
-  EMACS_INT schars;		/* the number of characters in the string,
+  ptrdiff_t schars;		/* the number of characters in the string,
 				   excluding the terminating null */
-  EMACS_INT bufpos;		/* buffer position of lstring, or 0 if N/A */
+  ptrdiff_t bufpos;		/* buffer position of lstring, or 0 if N/A */
   unsigned from_disp_str : 1;	/* 1 means the string comes from a
 				   display property */
   unsigned unibyte : 1;		/* 1 means the string is unibyte */
@@ -1835,14 +1835,14 @@ struct bidi_string_data {
 
 /* Data type for reordering bidirectional text.  */
 struct bidi_it {
-  EMACS_INT bytepos;		/* iterator's position in buffer/string */
-  EMACS_INT charpos;
+  ptrdiff_t bytepos;		/* iterator's position in buffer/string */
+  ptrdiff_t charpos;
   int ch;			/* character at that position, or u+FFFC
 				   ("object replacement character") for a run
 				   of characters covered by a display string */
-  EMACS_INT nchars;		/* its "length", usually 1; it's > 1 for a run
+  ptrdiff_t nchars;		/* its "length", usually 1; it's > 1 for a run
 				   of characters covered by a display string */
-  EMACS_INT ch_len;		/* its length in bytes */
+  ptrdiff_t ch_len;		/* its length in bytes */
   bidi_type_t type;		/* bidi type of this character, after
 				   resolving weak and neutral types */
   bidi_type_t type_after_w1;	/* original type, after overrides and W1 */
@@ -1856,11 +1856,11 @@ struct bidi_it {
   struct bidi_saved_info next_for_neutral; /* surrounding characters for... */
   struct bidi_saved_info prev_for_neutral; /* ...resolving neutrals */
   struct bidi_saved_info next_for_ws; /* character after sequence of ws */
-  EMACS_INT next_en_pos;	/* position of next EN char for ET */
-  EMACS_INT ignore_bn_limit;	/* position until which to ignore BNs */
+  ptrdiff_t next_en_pos;	/* position of next EN char for ET */
+  ptrdiff_t ignore_bn_limit;	/* position until which to ignore BNs */
   bidi_dir_t sor;		/* direction of start-of-run in effect */
   int scan_dir;			/* direction of text scan, 1: forw, -1: back */
-  EMACS_INT disp_pos;		/* position of display string after ch */
+  ptrdiff_t disp_pos;		/* position of display string after ch */
   int disp_prop;		/* if non-zero, there really is a
 				   `display' property/string at disp_pos;
 				   if 2, the property is a `space' spec */
@@ -1871,7 +1871,7 @@ struct bidi_it {
   struct bidi_stack level_stack[BIDI_MAXLEVEL]; /* stack of embedding levels */
   struct bidi_string_data string;	/* string to reorder */
   bidi_dir_t paragraph_dir;	/* current paragraph direction */
-  EMACS_INT separator_limit;	/* where paragraph separator should end */
+  ptrdiff_t separator_limit;	/* where paragraph separator should end */
   unsigned first_elt : 1;	/* if non-zero, examine current char first */
   unsigned new_paragraph : 1;	/* if non-zero, we expect a new paragraph */
   unsigned frame_window_p : 1;	/* non-zero if displaying on a GUI frame */
@@ -2057,7 +2057,7 @@ enum it_method {
 struct composition_it
 {
   /* Next position at which to check the composition.  */
-  EMACS_INT stop_pos;
+  ptrdiff_t stop_pos;
   /* ID number of the composition or glyph-string.  If negative, we
      are not iterating over a composition now.  */
   ptrdiff_t id;
@@ -2075,7 +2075,7 @@ struct composition_it
   /* If this is an automatic composition, how many characters to look
      back from the position where a character triggering the
      composition exists.  */
-  int lookback;
+  ptrdiff_t lookback;
   /* If non-negative, number of glyphs of the glyph-string.  */
   int nglyphs;
   /* Nonzero iff the composition is created while buffer is scanned in
@@ -2086,7 +2086,7 @@ struct composition_it
   /** The following members contain information about the current
       grapheme cluster.  */
   /* Position of the first character of the current grapheme cluster.  */
-  EMACS_INT charpos;
+  ptrdiff_t charpos;
   /* Number of characters and bytes of the current grapheme cluster.  */
   int nchars, nbytes;
   /* Indices of the glyphs for the current grapheme cluster.  */
@@ -2111,19 +2111,19 @@ struct it
 
   /* The next position at which to check for face changes, invisible
      text, overlay strings, end of text etc., which see.  */
-  EMACS_INT stop_charpos;
+  ptrdiff_t stop_charpos;
 
   /* Previous stop position, i.e. the last one before the current
      iterator position in `current'.  */
-  EMACS_INT prev_stop;
+  ptrdiff_t prev_stop;
 
   /* Last stop position iterated across whose bidi embedding level is
      equal to the current paragraph's base embedding level.  */
-  EMACS_INT base_level_stop;
+  ptrdiff_t base_level_stop;
 
   /* Maximum string or buffer position + 1.  ZV when iterating over
      current_buffer.  */
-  EMACS_INT end_charpos;
+  ptrdiff_t end_charpos;
 
   /* C string to iterate over.  Non-null means get characters from
      this string, otherwise characters are read from current_buffer
@@ -2132,14 +2132,14 @@ struct it
 
   /* Number of characters in the string (s, or it->string) we iterate
      over.  */
-  EMACS_INT string_nchars;
+  ptrdiff_t string_nchars;
 
   /* Start and end of a visible region; -1 if the region is not
      visible in the window.  */
-  EMACS_INT region_beg_charpos, region_end_charpos;
+  ptrdiff_t region_beg_charpos, region_end_charpos;
 
   /* Position at which redisplay end trigger functions should be run.  */
-  EMACS_INT redisplay_end_trigger_charpos;
+  ptrdiff_t redisplay_end_trigger_charpos;
 
   /* 1 means multibyte characters are enabled.  */
   unsigned multibyte_p : 1;
@@ -2204,13 +2204,13 @@ struct it
 
   /* Total number of overlay strings to process.  This can be >
      OVERLAY_STRING_CHUNK_SIZE.  */
-  int n_overlay_strings;
+  ptrdiff_t n_overlay_strings;
 
   /* The charpos where n_overlay_strings was calculated.  This should
      be set at the same time as n_overlay_strings.  It is needed
      because we show before-strings at the start of invisible text;
      see handle_invisible_prop in xdisp.c.  */
-  EMACS_INT overlay_strings_charpos;
+  ptrdiff_t overlay_strings_charpos;
 
   /* Vector of overlays to process.  Overlay strings are processed
      OVERLAY_STRING_CHUNK_SIZE at a time.  */
@@ -2237,10 +2237,10 @@ struct it
   {
     Lisp_Object string;
     int string_nchars;
-    EMACS_INT end_charpos;
-    EMACS_INT stop_charpos;
-    EMACS_INT prev_stop;
-    EMACS_INT base_level_stop;
+    ptrdiff_t end_charpos;
+    ptrdiff_t stop_charpos;
+    ptrdiff_t prev_stop;
+    ptrdiff_t base_level_stop;
     struct composition_it cmp_it;
     int face_id;
 
@@ -2289,7 +2289,7 @@ struct it
 
   /* -1 means selective display hides everything between a \r and the
      next newline; > 0 means hide lines indented more than that value.  */
-  EMACS_INT selective;
+  ptrdiff_t selective;
 
   /* An enumeration describing what the next display element is
      after a call to get_next_display_element.  */
@@ -2973,7 +2973,7 @@ enum tool_bar_item_image
 
 /* Defined in bidi.c */
 
-extern void bidi_init_it (EMACS_INT, EMACS_INT, int, struct bidi_it *);
+extern void bidi_init_it (ptrdiff_t, ptrdiff_t, int, struct bidi_it *);
 extern void bidi_move_to_visually_next (struct bidi_it *);
 extern void bidi_paragraph_init (bidi_dir_t, struct bidi_it *, int);
 extern int  bidi_mirror_char (int);
@@ -2984,11 +2984,11 @@ extern void bidi_unshelve_cache (void *, int);
 
 /* Defined in xdisp.c */
 
-struct glyph_row *row_containing_pos (struct window *, EMACS_INT,
+struct glyph_row *row_containing_pos (struct window *, ptrdiff_t,
                                       struct glyph_row *,
                                       struct glyph_row *, int);
 int line_bottom_y (struct it *);
-int display_prop_intangible_p (Lisp_Object, Lisp_Object, EMACS_INT, EMACS_INT);
+int display_prop_intangible_p (Lisp_Object, Lisp_Object, ptrdiff_t, ptrdiff_t);
 void resize_echo_area_exactly (void);
 int resize_mini_window (struct window *, int);
 #if defined USE_TOOLKIT_SCROLL_BARS && !defined USE_GTK
@@ -3010,18 +3010,18 @@ void remember_mouse_glyph (struct frame *, int, int, NativeRectangle *);
 
 void mark_window_display_accurate (Lisp_Object, int);
 void redisplay_preserve_echo_area (int);
-void init_iterator (struct it *, struct window *, EMACS_INT,
-                    EMACS_INT, struct glyph_row *, enum face_id);
+void init_iterator (struct it *, struct window *, ptrdiff_t,
+                    ptrdiff_t, struct glyph_row *, enum face_id);
 void init_iterator_to_row_start (struct it *, struct window *,
                                  struct glyph_row *);
 void start_display (struct it *, struct window *, struct text_pos);
-void move_it_to (struct it *, EMACS_INT, int, int, int, int);
+void move_it_to (struct it *, ptrdiff_t, int, int, int, int);
 void move_it_vertically (struct it *, int);
 void move_it_vertically_backward (struct it *, int);
-void move_it_by_lines (struct it *, int);
+void move_it_by_lines (struct it *, ptrdiff_t);
 void move_it_past_eol (struct it *);
 void move_it_in_display_line (struct it *it,
-			      EMACS_INT to_charpos, int to_x,
+			      ptrdiff_t to_charpos, int to_x,
 			      enum move_operation_enum op);
 int in_display_vector_p (struct it *);
 int frame_mode_line_height (struct frame *);
@@ -3031,15 +3031,15 @@ extern int help_echo_showing_p;
 extern int current_mode_line_height, current_header_line_height;
 extern Lisp_Object help_echo_string, help_echo_window;
 extern Lisp_Object help_echo_object, previous_help_echo_string;
-extern EMACS_INT help_echo_pos;
+extern ptrdiff_t help_echo_pos;
 extern struct frame *last_mouse_frame;
 extern int last_tool_bar_item;
 extern void reseat_at_previous_visible_line_start (struct it *);
 extern Lisp_Object lookup_glyphless_char_display (int, struct it *);
-extern EMACS_INT compute_display_string_pos (struct text_pos *,
+extern ptrdiff_t compute_display_string_pos (struct text_pos *,
 					     struct bidi_string_data *,
 					     int, int *);
-extern EMACS_INT compute_display_string_end (EMACS_INT,
+extern ptrdiff_t compute_display_string_end (ptrdiff_t,
 					     struct bidi_string_data *);
 extern void produce_stretch_glyph (struct it *);
 
@@ -3085,7 +3085,7 @@ extern void get_glyph_string_clip_rect (struct glyph_string *,
 extern Lisp_Object find_hot_spot (Lisp_Object, int, int);
 
 extern void handle_tool_bar_click (struct frame *,
-                                   int, int, int, unsigned int);
+                                   int, int, int, int);
 
 extern void expose_frame (struct frame *, int, int, int, int);
 extern int x_intersect_rectangles (XRectangle *, XRectangle *,
@@ -3188,19 +3188,19 @@ int lookup_derived_face (struct frame *, Lisp_Object, int, int);
 void init_frame_faces (struct frame *);
 void free_frame_faces (struct frame *);
 void recompute_basic_faces (struct frame *);
-int face_at_buffer_position (struct window *w, EMACS_INT pos,
-                             EMACS_INT region_beg, EMACS_INT region_end,
-                             EMACS_INT *endptr, EMACS_INT limit,
+int face_at_buffer_position (struct window *w, ptrdiff_t pos,
+                             ptrdiff_t region_beg, ptrdiff_t region_end,
+                             ptrdiff_t *endptr, ptrdiff_t limit,
                              int mouse, int base_face_id);
-int face_for_overlay_string (struct window *w, EMACS_INT pos,
-                             EMACS_INT region_beg, EMACS_INT region_end,
-                             EMACS_INT *endptr, EMACS_INT limit,
+int face_for_overlay_string (struct window *w, ptrdiff_t pos,
+                             ptrdiff_t region_beg, ptrdiff_t region_end,
+                             ptrdiff_t *endptr, ptrdiff_t limit,
                              int mouse, Lisp_Object overlay);
 int face_at_string_position (struct window *w, Lisp_Object string,
-                             EMACS_INT pos, EMACS_INT bufpos,
-                             EMACS_INT region_beg, EMACS_INT region_end,
-                             EMACS_INT *endptr, enum face_id, int mouse);
-int merge_faces (struct frame *, Lisp_Object, EMACS_INT, int);
+                             ptrdiff_t pos, ptrdiff_t bufpos,
+                             ptrdiff_t region_beg, ptrdiff_t region_end,
+                             ptrdiff_t *endptr, enum face_id, int mouse);
+int merge_faces (struct frame *, Lisp_Object, int, int);
 int compute_char_face (struct frame *, int, Lisp_Object);
 void free_all_realized_faces (Lisp_Object);
 extern Lisp_Object Qforeground_color, Qbackground_color;
@@ -3266,11 +3266,11 @@ extern Lisp_Object buffer_posn_from_coords (struct window *,
                                             Lisp_Object *,
                                             int *, int *, int *, int *);
 extern Lisp_Object mode_line_string (struct window *, enum window_part,
-                                     int *, int *, EMACS_INT *,
+                                     int *, int *, ptrdiff_t *,
                                      Lisp_Object *,
                                      int *, int *, int *, int *);
 extern Lisp_Object marginal_area_string (struct window *, enum window_part,
-                                         int *, int *, EMACS_INT *,
+                                         int *, int *, ptrdiff_t *,
                                          Lisp_Object *,
                                          int *, int *, int *, int *);
 extern void redraw_frame (struct frame *);
@@ -3290,7 +3290,7 @@ void shift_glyph_matrix (struct window *, struct glyph_matrix *,
                          int, int, int);
 void rotate_matrix (struct glyph_matrix *, int, int, int);
 void increment_matrix_positions (struct glyph_matrix *,
-                                 int, int, EMACS_INT, EMACS_INT);
+                                 int, int, ptrdiff_t, ptrdiff_t);
 void blank_row (struct window *, struct glyph_row *, int);
 void enable_glyph_matrix_rows (struct glyph_matrix *, int, int, int);
 void clear_glyph_row (struct glyph_row *);
diff --git a/src/dispnew.c b/src/dispnew.c
index 958420d3081..7e1273ac34b 100644
--- a/src/dispnew.c
+++ b/src/dispnew.c
@@ -108,7 +108,7 @@ static int required_matrix_height (struct window *);
 static int required_matrix_width (struct window *);
 static void adjust_frame_glyphs (struct frame *);
 static void change_frame_size_1 (struct frame *, int, int, int, int, int);
-static void increment_row_positions (struct glyph_row *, EMACS_INT, EMACS_INT);
+static void increment_row_positions (struct glyph_row *, ptrdiff_t, ptrdiff_t);
 static void fill_up_frame_row_with_spaces (struct glyph_row *, int);
 static void build_frame_matrix_from_window_tree (struct glyph_matrix *,
                                                  struct window *);
@@ -750,7 +750,7 @@ rotate_matrix (struct glyph_matrix *matrix, int first, int last, int by)
 
 void
 increment_matrix_positions (struct glyph_matrix *matrix, int start, int end,
-			    EMACS_INT delta, EMACS_INT delta_bytes)
+			    ptrdiff_t delta, ptrdiff_t delta_bytes)
 {
   /* Check that START and END are reasonable values.  */
   xassert (start >= 0 && start <= matrix->nrows);
@@ -992,7 +992,7 @@ blank_row (struct window *w, struct glyph_row *row, int y)
 
 static void
 increment_row_positions (struct glyph_row *row,
-			 EMACS_INT delta, EMACS_INT delta_bytes)
+			 ptrdiff_t delta, ptrdiff_t delta_bytes)
 {
   int area, i;
 
@@ -2513,8 +2513,7 @@ build_frame_matrix_from_leaf_window (struct glyph_matrix *frame_matrix, struct w
 
 	  SET_GLYPH_FROM_CHAR (right_border_glyph, '|');
 	  if (dp
-	      && (gc = DISP_BORDER_GLYPH (dp), GLYPH_CODE_P (gc))
-	      && GLYPH_CODE_CHAR_VALID_P (gc))
+	      && (gc = DISP_BORDER_GLYPH (dp), GLYPH_CODE_P (gc)))
 	    {
 	      SET_GLYPH_FROM_GLYPH_CODE (right_border_glyph, gc);
 	      spec_glyph_lookup_face (w, &right_border_glyph);
@@ -5381,7 +5380,7 @@ buffer_posn_from_coords (struct window *w, int *x, int *y, struct display_pos *p
 
 Lisp_Object
 mode_line_string (struct window *w, enum window_part part,
-		  int *x, int *y, EMACS_INT *charpos, Lisp_Object *object,
+		  int *x, int *y, ptrdiff_t *charpos, Lisp_Object *object,
 		  int *dx, int *dy, int *width, int *height)
 {
   struct glyph_row *row;
@@ -5450,7 +5449,7 @@ mode_line_string (struct window *w, enum window_part part,
 
 Lisp_Object
 marginal_area_string (struct window *w, enum window_part part,
-		      int *x, int *y, EMACS_INT *charpos, Lisp_Object *object,
+		      int *x, int *y, ptrdiff_t *charpos, Lisp_Object *object,
 		      int *dx, int *dy, int *width, int *height)
 {
   struct glyph_row *row = w->current_matrix->rows;
@@ -5647,7 +5646,7 @@ static void
 change_frame_size_1 (register struct frame *f, int newheight, int newwidth, int pretend, int delay, int safe)
 {
   int new_frame_total_cols;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   /* If we can't deal with the change now, queue it for later.  */
   if (delay || (redisplaying_p && !safe))
@@ -5865,6 +5864,38 @@ bitch_at_user (void)
 			  Sleeping, Waiting
  ***********************************************************************/
 
+/* Convert a positive value DURATION to a seconds count *PSEC plus a
+   microseconds count *PUSEC, rounding up.  On overflow return the
+   maximal value.  */
+void
+duration_to_sec_usec (double duration, int *psec, int *pusec)
+{
+  int MILLION = 1000000;
+  int sec = INT_MAX, usec = MILLION - 1;
+
+  if (duration < INT_MAX + 1.0)
+    {
+      int s = duration;
+      double usdouble = (duration - s) * MILLION;
+      int usfloor = usdouble;
+      int usceil = usfloor + (usfloor < usdouble);
+
+      if (usceil < MILLION)
+	{
+	  sec = s;
+	  usec = usceil;
+	}
+      else if (sec < INT_MAX)
+	{
+	  sec = s + 1;
+	  usec = 0;
+	}
+    }
+
+  *psec = sec;
+  *pusec = usec;
+}
+
 DEFUN ("sleep-for", Fsleep_for, Ssleep_for, 1, 2, 0,
        doc: /* Pause, without updating display, for SECONDS seconds.
 SECONDS may be a floating-point value, meaning that you can wait for a
@@ -5875,39 +5906,24 @@ Emacs was built without floating point support.
   (Lisp_Object seconds, Lisp_Object milliseconds)
 {
   int sec, usec;
+  double duration = extract_float (seconds);
 
-  if (NILP (milliseconds))
-    XSETINT (milliseconds, 0);
-  else
-    CHECK_NUMBER (milliseconds);
-  usec = XINT (milliseconds) * 1000;
+  if (!NILP (milliseconds))
+    {
+      CHECK_NUMBER (milliseconds);
+      duration += XINT (milliseconds) / 1000.0;
+    }
 
-  {
-    double duration = extract_float (seconds);
-    sec = (int) duration;
-    usec += (duration - sec) * 1000000;
-  }
+  if (! (0 < duration))
+    return Qnil;
+
+  duration_to_sec_usec (duration, &sec, &usec);
 
 #ifndef EMACS_HAS_USECS
   if (sec == 0 && usec != 0)
     error ("Millisecond `sleep-for' not supported on %s", SYSTEM_TYPE);
 #endif
 
-  /* Assure that 0 <= usec < 1000000.  */
-  if (usec < 0)
-    {
-      /* We can't rely on the rounding being correct if usec is negative.  */
-      if (-1000000 < usec)
-	sec--, usec += 1000000;
-      else
-	sec -= -usec / 1000000, usec = 1000000 - (-usec % 1000000);
-    }
-  else
-    sec += usec / 1000000, usec %= 1000000;
-
-  if (sec < 0 || (sec == 0 && usec == 0))
-    return Qnil;
-
   wait_reading_process_output (sec, usec, 0, 0, Qnil, NULL, 0);
 
   return Qnil;
@@ -5938,27 +5954,20 @@ sit_for (Lisp_Object timeout, int reading, int do_display)
   if (do_display >= 2)
     redisplay_preserve_echo_area (2);
 
-  if (INTEGERP (timeout))
-    {
-      sec = XINT (timeout);
-      usec = 0;
-    }
-  else if (FLOATP (timeout))
-    {
-      double seconds = XFLOAT_DATA (timeout);
-      sec = (int) seconds;
-      usec = (int) ((seconds - sec) * 1000000);
-    }
-  else if (EQ (timeout, Qt))
+  if (EQ (timeout, Qt))
     {
       sec = 0;
       usec = 0;
     }
   else
-    wrong_type_argument (Qnumberp, timeout);
+    {
+      double duration = extract_float (timeout);
 
-  if (sec == 0 && usec == 0 && !EQ (timeout, Qt))
-    return Qt;
+      if (! (0 < duration))
+	return Qt;
+
+      duration_to_sec_usec (duration, &sec, &usec);
+    }
 
 #ifdef SIGIO
   gobble_input (0);
@@ -5978,7 +5987,7 @@ perform a full redisplay even if input is available.
 Return t if redisplay was performed, nil otherwise.  */)
   (Lisp_Object force)
 {
-  int count;
+  ptrdiff_t count;
 
   swallow_events (1);
   if ((detect_input_pending_run_timers (1)
diff --git a/src/doc.c b/src/doc.c
index 83e943c42b8..9fbeb0b5ed5 100644
--- a/src/doc.c
+++ b/src/doc.c
@@ -86,9 +86,11 @@ get_doc_string (Lisp_Object filepos, int unibyte, int definition)
   register int fd;
   register char *name;
   register char *p, *p1;
-  EMACS_INT minsize;
-  EMACS_INT offset, position;
+  ptrdiff_t minsize;
+  int offset;
+  EMACS_INT position;
   Lisp_Object file, tem;
+  USE_SAFE_ALLOCA;
 
   if (INTEGERP (filepos))
     {
@@ -122,7 +124,7 @@ get_doc_string (Lisp_Object filepos, int unibyte, int definition)
       /* sizeof ("../etc/") == 8 */
       if (minsize < 8)
 	minsize = 8;
-      name = (char *) alloca (minsize + SCHARS (file) + 8);
+      SAFE_ALLOCA (name, char *, minsize + SCHARS (file) + 8);
       strcpy (name, SSDATA (Vdoc_directory));
       strcat (name, SSDATA (file));
     }
@@ -153,13 +155,16 @@ get_doc_string (Lisp_Object filepos, int unibyte, int definition)
   /* Make sure we read at least 1024 bytes before `position'
      so we can check the leading text for consistency.  */
   offset = min (position, max (1024, position % (8 * 1024)));
-  if (0 > lseek (fd, position - offset, 0))
+  if (TYPE_MAXIMUM (off_t) < position
+      || lseek (fd, position - offset, 0) < 0)
     {
       emacs_close (fd);
       error ("Position %"pI"d out of range in doc string file \"%s\"",
 	     position, name);
     }
 
+  SAFE_FREE ();
+
   /* Read the doc string into get_doc_string_buffer.
      P points beyond the data just read.  */
 
@@ -277,7 +282,7 @@ Invalid data in documentation file -- %c followed by code %03o",
   else
     {
       /* The data determines whether the string is multibyte.  */
-      EMACS_INT nchars =
+      ptrdiff_t nchars =
 	multibyte_chars_in_text (((unsigned char *) get_doc_string_buffer
 				  + offset),
 				 to - (get_doc_string_buffer + offset));
@@ -500,8 +505,7 @@ aren't strings.  */)
 /* Scanning the DOC files and placing docstring offsets into functions.  */
 
 static void
-store_function_docstring (Lisp_Object fun, EMACS_INT offset)
-/* Use EMACS_INT because we get offset from pointer subtraction.  */
+store_function_docstring (Lisp_Object fun, ptrdiff_t offset)
 {
   fun = indirect_function (fun);
 
@@ -556,7 +560,7 @@ the same file name is found in the `doc-directory'.  */)
 {
   int fd;
   char buf[1024 + 1];
-  register EMACS_INT filled;
+  register int filled;
   register EMACS_INT pos;
   register char *p;
   Lisp_Object sym;
@@ -591,7 +595,7 @@ the same file name is found in the `doc-directory'.  */)
 
     for (beg = buildobj; *beg; beg = end)
       {
-        EMACS_INT len;
+        ptrdiff_t len;
 
         while (*beg && isspace (*beg)) ++beg;
 
@@ -639,7 +643,7 @@ the same file name is found in the `doc-directory'.  */)
               if (end - p > 4 && end[-2] == '.'
                   && (end[-1] == 'o' || end[-1] == 'c'))
                 {
-                  EMACS_INT len = end - p - 2;
+                  ptrdiff_t len = end - p - 2;
                   char *fromfile = alloca (len + 1);
                   strncpy (fromfile, &p[2], len);
                   fromfile[len] = 0;
diff --git a/src/doprnt.c b/src/doprnt.c
index b4d13c59137..b7c1e4e68e2 100644
--- a/src/doprnt.c
+++ b/src/doprnt.c
@@ -174,7 +174,7 @@ doprnt (char *buffer, ptrdiff_t bufsize, const char *format,
       if (*fmt == '%')	/* Check for a '%' character */
 	{
 	  ptrdiff_t size_bound = 0;
-	  EMACS_INT width;  /* Columns occupied by STRING on display.  */
+	  ptrdiff_t width;  /* Columns occupied by STRING on display.  */
 	  enum {
 	    pDlen = sizeof pD - 1,
 	    pIlen = sizeof pI - 1,
diff --git a/src/editfns.c b/src/editfns.c
index 3dd58377ada..ac9c20ced65 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -86,7 +86,7 @@ extern Lisp_Object w32_get_internal_run_time (void);
 
 static void time_overflow (void) NO_RETURN;
 static int tm_diff (struct tm *, struct tm *);
-static void update_buffer_properties (EMACS_INT, EMACS_INT);
+static void update_buffer_properties (ptrdiff_t, ptrdiff_t);
 
 static Lisp_Object Qbuffer_access_fontify_functions;
 static Lisp_Object Fuser_full_name (Lisp_Object);
@@ -146,8 +146,14 @@ init_editfns (void)
   /* If the user name claimed in the environment vars differs from
      the real uid, use the claimed name to find the full name.  */
   tem = Fstring_equal (Vuser_login_name, Vuser_real_login_name);
-  Vuser_full_name = Fuser_full_name (NILP (tem)? make_number (geteuid ())
-				     : Vuser_login_name);
+  if (! NILP (tem))
+    tem = Vuser_login_name;
+  else
+    {
+      uid_t euid = geteuid ();
+      tem = make_fixnum_or_float (euid);
+    }
+  Vuser_full_name = Fuser_full_name (tem);
 
   p = getenv ("NAME");
   if (p)
@@ -212,7 +218,7 @@ DEFUN ("string-to-char", Fstring_to_char, Sstring_to_char, 1, 1, 0,
 }
 
 static Lisp_Object
-buildmark (EMACS_INT charpos, EMACS_INT bytepos)
+buildmark (ptrdiff_t charpos, ptrdiff_t bytepos)
 {
   register Lisp_Object mark;
   mark = Fmake_marker ();
@@ -237,17 +243,6 @@ DEFUN ("point-marker", Fpoint_marker, Spoint_marker, 0, 0, 0,
   return buildmark (PT, PT_BYTE);
 }
 
-EMACS_INT
-clip_to_bounds (EMACS_INT lower, EMACS_INT num, EMACS_INT upper)
-{
-  if (num < lower)
-    return lower;
-  else if (num > upper)
-    return upper;
-  else
-    return num;
-}
-
 DEFUN ("goto-char", Fgoto_char, Sgoto_char, 1, 1, "NGoto char: ",
        doc: /* Set point to POSITION, a number or marker.
 Beginning of buffer is position (point-min), end is (point-max).
@@ -255,7 +250,7 @@ Beginning of buffer is position (point-min), end is (point-max).
 The return value is POSITION.  */)
   (register Lisp_Object position)
 {
-  EMACS_INT pos;
+  ptrdiff_t pos;
 
   if (MARKERP (position)
       && current_buffer == XMARKER (position)->buffer)
@@ -335,7 +330,7 @@ overlays_around (EMACS_INT pos, Lisp_Object *vec, ptrdiff_t len)
 {
   Lisp_Object overlay, start, end;
   struct Lisp_Overlay *tail;
-  EMACS_INT startpos, endpos;
+  ptrdiff_t startpos, endpos;
   ptrdiff_t idx = 0;
 
   for (tail = current_buffer->overlays_before; tail; tail = tail->next)
@@ -484,7 +479,7 @@ get_pos_property (Lisp_Object position, register Lisp_Object prop, Lisp_Object o
 static void
 find_field (Lisp_Object pos, Lisp_Object merge_at_boundary,
 	    Lisp_Object beg_limit,
-	    EMACS_INT *beg, Lisp_Object end_limit, EMACS_INT *end)
+	    ptrdiff_t *beg, Lisp_Object end_limit, ptrdiff_t *end)
 {
   /* Fields right before and after the point.  */
   Lisp_Object before_field, after_field;
@@ -600,7 +595,7 @@ A field is a region of text with the same `field' property.
 If POS is nil, the value of point is used for POS.  */)
   (Lisp_Object pos)
 {
-  EMACS_INT beg, end;
+  ptrdiff_t beg, end;
   find_field (pos, Qnil, Qnil, &beg, Qnil, &end);
   if (beg != end)
     del_range (beg, end);
@@ -613,7 +608,7 @@ A field is a region of text with the same `field' property.
 If POS is nil, the value of point is used for POS.  */)
   (Lisp_Object pos)
 {
-  EMACS_INT beg, end;
+  ptrdiff_t beg, end;
   find_field (pos, Qnil, Qnil, &beg, Qnil, &end);
   return make_buffer_string (beg, end, 1);
 }
@@ -624,7 +619,7 @@ A field is a region of text with the same `field' property.
 If POS is nil, the value of point is used for POS.  */)
   (Lisp_Object pos)
 {
-  EMACS_INT beg, end;
+  ptrdiff_t beg, end;
   find_field (pos, Qnil, Qnil, &beg, Qnil, &end);
   return make_buffer_string (beg, end, 0);
 }
@@ -639,7 +634,7 @@ If LIMIT is non-nil, it is a buffer position; if the beginning of the field
 is before LIMIT, then LIMIT will be returned instead.  */)
   (Lisp_Object pos, Lisp_Object escape_from_edge, Lisp_Object limit)
 {
-  EMACS_INT beg;
+  ptrdiff_t beg;
   find_field (pos, escape_from_edge, limit, &beg, Qnil, 0);
   return make_number (beg);
 }
@@ -654,7 +649,7 @@ If LIMIT is non-nil, it is a buffer position; if the end of the field
 is after LIMIT, then LIMIT will be returned instead.  */)
   (Lisp_Object pos, Lisp_Object escape_from_edge, Lisp_Object limit)
 {
-  EMACS_INT end;
+  ptrdiff_t end;
   find_field (pos, escape_from_edge, Qnil, 0, limit, &end);
   return make_number (end);
 }
@@ -689,7 +684,7 @@ Field boundaries are not noticed if `inhibit-field-text-motion' is non-nil.  */)
   (Lisp_Object new_pos, Lisp_Object old_pos, Lisp_Object escape_from_edge, Lisp_Object only_in_line, Lisp_Object inhibit_capture_property)
 {
   /* If non-zero, then the original point, before re-positioning.  */
-  EMACS_INT orig_point = 0;
+  ptrdiff_t orig_point = 0;
   int fwd;
   Lisp_Object prev_old, prev_new;
 
@@ -703,10 +698,10 @@ Field boundaries are not noticed if `inhibit-field-text-motion' is non-nil.  */)
   CHECK_NUMBER_COERCE_MARKER (new_pos);
   CHECK_NUMBER_COERCE_MARKER (old_pos);
 
-  fwd = (XFASTINT (new_pos) > XFASTINT (old_pos));
+  fwd = (XINT (new_pos) > XINT (old_pos));
 
-  prev_old = make_number (XFASTINT (old_pos) - 1);
-  prev_new = make_number (XFASTINT (new_pos) - 1);
+  prev_old = make_number (XINT (old_pos) - 1);
+  prev_new = make_number (XINT (new_pos) - 1);
 
   if (NILP (Vinhibit_field_text_motion)
       && !EQ (new_pos, old_pos)
@@ -731,7 +726,7 @@ Field boundaries are not noticed if `inhibit-field-text-motion' is non-nil.  */)
     /* It is possible that NEW_POS is not within the same field as
        OLD_POS; try to move NEW_POS so that it is.  */
     {
-      EMACS_INT shortage;
+      ptrdiff_t shortage;
       Lisp_Object field_bound;
 
       if (fwd)
@@ -786,8 +781,8 @@ boundaries bind `inhibit-field-text-motion' to t.
 This function does not move point.  */)
   (Lisp_Object n)
 {
-  EMACS_INT orig, orig_byte, end;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t orig, orig_byte, end;
+  ptrdiff_t count = SPECPDL_INDEX ();
   specbind (Qinhibit_point_motion_hooks, Qt);
 
   if (NILP (n))
@@ -827,15 +822,17 @@ boundaries bind `inhibit-field-text-motion' to t.
 This function does not move point.  */)
   (Lisp_Object n)
 {
-  EMACS_INT end_pos;
-  EMACS_INT orig = PT;
+  ptrdiff_t clipped_n;
+  ptrdiff_t end_pos;
+  ptrdiff_t orig = PT;
 
   if (NILP (n))
     XSETFASTINT (n, 1);
   else
     CHECK_NUMBER (n);
 
-  end_pos = find_before_next_newline (orig, 0, XINT (n) - (XINT (n) <= 0));
+  clipped_n = clip_to_bounds (PTRDIFF_MIN + 1, XINT (n), PTRDIFF_MAX);
+  end_pos = find_before_next_newline (orig, 0, clipped_n - (clipped_n <= 0));
 
   /* Return END_POS constrained to the current input field.  */
   return Fconstrain_to_field (make_number (end_pos), make_number (orig),
@@ -962,7 +959,7 @@ usage: (save-excursion &rest BODY)  */)
   (Lisp_Object args)
 {
   register Lisp_Object val;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   record_unwind_protect (save_excursion_restore, save_excursion_save ());
 
@@ -977,7 +974,7 @@ usage: (save-current-buffer &rest BODY)  */)
   (Lisp_Object args)
 {
   Lisp_Object val;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   record_unwind_protect (set_buffer_if_live, Fcurrent_buffer ());
 
@@ -1103,7 +1100,7 @@ At the beginning of the buffer or accessible region, return 0.  */)
     XSETFASTINT (temp, 0);
   else if (!NILP (BVAR (current_buffer, enable_multibyte_characters)))
     {
-      EMACS_INT pos = PT_BYTE;
+      ptrdiff_t pos = PT_BYTE;
       DEC_POS (pos);
       XSETFASTINT (temp, FETCH_CHAR (pos));
     }
@@ -1157,7 +1154,7 @@ POS is an integer or a marker and defaults to point.
 If POS is out of range, the value is nil.  */)
   (Lisp_Object pos)
 {
-  register EMACS_INT pos_byte;
+  register ptrdiff_t pos_byte;
 
   if (NILP (pos))
     {
@@ -1190,7 +1187,7 @@ If POS is out of range, the value is nil.  */)
   (Lisp_Object pos)
 {
   register Lisp_Object val;
-  register EMACS_INT pos_byte;
+  register ptrdiff_t pos_byte;
 
   if (NILP (pos))
     {
@@ -1277,14 +1274,7 @@ DEFUN ("user-uid", Fuser_uid, Suser_uid, 0, 0, 0,
 Value is an integer or a float, depending on the value.  */)
   (void)
 {
-  /* Assignment to EMACS_INT stops GCC whining about limited range of
-     data type.  */
-  EMACS_INT euid = geteuid ();
-
-  /* Make sure we don't produce a negative UID due to signed integer
-     overflow.  */
-  if (euid < 0)
-    return make_float (geteuid ());
+  uid_t euid = geteuid ();
   return make_fixnum_or_float (euid);
 }
 
@@ -1293,14 +1283,7 @@ DEFUN ("user-real-uid", Fuser_real_uid, Suser_real_uid, 0, 0, 0,
 Value is an integer or a float, depending on the value.  */)
   (void)
 {
-  /* Assignment to EMACS_INT stops GCC whining about limited range of
-     data type.  */
-  EMACS_INT uid = getuid ();
-
-  /* Make sure we don't produce a negative UID due to signed integer
-     overflow.  */
-  if (uid < 0)
-    return make_float (getuid ());
+  uid_t uid = getuid ();
   return make_fixnum_or_float (uid);
 }
 
@@ -1385,10 +1368,11 @@ get_system_name (void)
 }
 
 DEFUN ("emacs-pid", Femacs_pid, Semacs_pid, 0, 0, 0,
-       doc: /* Return the process ID of Emacs, as an integer.  */)
+       doc: /* Return the process ID of Emacs, as a number.  */)
   (void)
 {
-  return make_number (getpid ());
+  pid_t pid = getpid ();
+  return make_fixnum_or_float (pid);
 }
 
 
@@ -1428,7 +1412,7 @@ hi_time (time_t t)
 }
 
 /* Return the bottom 16 bits of the time T.  */
-static EMACS_INT
+static int
 lo_time (time_t t)
 {
   return t & ((1 << 16) - 1);
@@ -1546,6 +1530,8 @@ lisp_time_argument (Lisp_Object specified_time, time_t *result, int *usec)
               else
                 {
                   CHECK_NUMBER (usec_l);
+		  if (! (0 <= XINT (usec_l) && XINT (usec_l) < 1000000))
+		    return 0;
                   *usec = XINT (usec_l);
                 }
             }
@@ -1883,9 +1869,12 @@ usage: (encode-time SECOND MINUTE HOUR DAY MONTH YEAR &optional ZONE)  */)
 	tzstring = SSDATA (zone);
       else if (INTEGERP (zone))
 	{
-	  int abszone = eabs (XINT (zone));
-	  sprintf (tzbuf, "XXX%s%d:%02d:%02d", "-" + (XINT (zone) < 0),
-		   abszone / (60*60), (abszone/60) % 60, abszone % 60);
+	  EMACS_INT abszone = eabs (XINT (zone));
+	  EMACS_INT zone_hr = abszone / (60*60);
+	  int zone_min = (abszone/60) % 60;
+	  int zone_sec = abszone % 60;
+	  sprintf (tzbuf, "XXX%s%"pI"d:%02d:%02d", "-" + (XINT (zone) < 0),
+		   zone_hr, zone_min, zone_sec);
 	  tzstring = tzbuf;
 	}
       else
@@ -2187,10 +2176,10 @@ set_time_zone_rule (const char *tzstring)
 
 static void
 general_insert_function (void (*insert_func)
-			      (const char *, EMACS_INT),
+			      (const char *, ptrdiff_t),
 			 void (*insert_from_string_func)
-			      (Lisp_Object, EMACS_INT, EMACS_INT,
-			       EMACS_INT, EMACS_INT, int),
+			      (Lisp_Object, ptrdiff_t, ptrdiff_t,
+			       ptrdiff_t, ptrdiff_t, int),
 			 int inherit, ptrdiff_t nargs, Lisp_Object *args)
 {
   ptrdiff_t argnum;
@@ -2326,7 +2315,7 @@ from adjoining text, if those properties are sticky.  */)
   (Lisp_Object character, Lisp_Object count, Lisp_Object inherit)
 {
   int i, stringlen;
-  register EMACS_INT n;
+  register ptrdiff_t n;
   int c, len;
   unsigned char str[MAX_MULTIBYTE_LENGTH];
   char string[4000];
@@ -2402,10 +2391,10 @@ from adjoining text, if those properties are sticky.  */)
    buffer substrings.  */
 
 Lisp_Object
-make_buffer_string (EMACS_INT start, EMACS_INT end, int props)
+make_buffer_string (ptrdiff_t start, ptrdiff_t end, int props)
 {
-  EMACS_INT start_byte = CHAR_TO_BYTE (start);
-  EMACS_INT end_byte = CHAR_TO_BYTE (end);
+  ptrdiff_t start_byte = CHAR_TO_BYTE (start);
+  ptrdiff_t end_byte = CHAR_TO_BYTE (end);
 
   return make_buffer_string_both (start, start_byte, end, end_byte, props);
 }
@@ -2426,8 +2415,8 @@ make_buffer_string (EMACS_INT start, EMACS_INT end, int props)
    buffer substrings.  */
 
 Lisp_Object
-make_buffer_string_both (EMACS_INT start, EMACS_INT start_byte,
-			 EMACS_INT end, EMACS_INT end_byte, int props)
+make_buffer_string_both (ptrdiff_t start, ptrdiff_t start_byte,
+			 ptrdiff_t end, ptrdiff_t end_byte, int props)
 {
   Lisp_Object result, tem, tem1;
 
@@ -2460,7 +2449,7 @@ make_buffer_string_both (EMACS_INT start, EMACS_INT start_byte,
    in the current buffer, if necessary.  */
 
 static void
-update_buffer_properties (EMACS_INT start, EMACS_INT end)
+update_buffer_properties (ptrdiff_t start, ptrdiff_t end)
 {
   /* If this buffer has some access functions,
      call them, specifying the range of the buffer being accessed.  */
@@ -2499,7 +2488,7 @@ into the result string; if you don't want the text properties,
 use `buffer-substring-no-properties' instead.  */)
   (Lisp_Object start, Lisp_Object end)
 {
-  register EMACS_INT b, e;
+  register ptrdiff_t b, e;
 
   validate_region (&start, &end);
   b = XINT (start);
@@ -2515,7 +2504,7 @@ The two arguments START and END are character positions;
 they can be in either order.  */)
   (Lisp_Object start, Lisp_Object end)
 {
-  register EMACS_INT b, e;
+  register ptrdiff_t b, e;
 
   validate_region (&start, &end);
   b = XINT (start);
@@ -2599,8 +2588,8 @@ determines whether case is significant or ignored.  */)
   register Lisp_Object trt
     = (!NILP (BVAR (current_buffer, case_fold_search))
        ? BVAR (current_buffer, case_canon_table) : Qnil);
-  EMACS_INT chars = 0;
-  EMACS_INT i1, i2, i1_byte, i2_byte;
+  ptrdiff_t chars = 0;
+  ptrdiff_t i1, i2, i1_byte, i2_byte;
 
   /* Find the first buffer and its substring.  */
 
@@ -2761,21 +2750,21 @@ and don't mark the buffer as really changed.
 Both characters must have the same length of multi-byte form.  */)
   (Lisp_Object start, Lisp_Object end, Lisp_Object fromchar, Lisp_Object tochar, Lisp_Object noundo)
 {
-  register EMACS_INT pos, pos_byte, stop, i, len, end_byte;
+  register ptrdiff_t pos, pos_byte, stop, i, len, end_byte;
   /* Keep track of the first change in the buffer:
      if 0 we haven't found it yet.
      if < 0 we've found it and we've run the before-change-function.
      if > 0 we've actually performed it and the value is its position.  */
-  EMACS_INT changed = 0;
+  ptrdiff_t changed = 0;
   unsigned char fromstr[MAX_MULTIBYTE_LENGTH], tostr[MAX_MULTIBYTE_LENGTH];
   unsigned char *p;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 #define COMBINING_NO	 0
 #define COMBINING_BEFORE 1
 #define COMBINING_AFTER  2
 #define COMBINING_BOTH (COMBINING_BEFORE | COMBINING_AFTER)
   int maybe_byte_combining = COMBINING_NO;
-  EMACS_INT last_changed = 0;
+  ptrdiff_t last_changed = 0;
   int multibyte_p = !NILP (BVAR (current_buffer, enable_multibyte_characters));
   int fromc, toc;
 
@@ -2835,7 +2824,7 @@ Both characters must have the same length of multi-byte form.  */)
     stop = min (stop, GPT_BYTE);
   while (1)
     {
-      EMACS_INT pos_byte_next = pos_byte;
+      ptrdiff_t pos_byte_next = pos_byte;
 
       if (pos_byte >= stop)
 	{
@@ -2938,7 +2927,7 @@ Both characters must have the same length of multi-byte form.  */)
 }
 
 
-static Lisp_Object check_translation (EMACS_INT, EMACS_INT, EMACS_INT,
+static Lisp_Object check_translation (ptrdiff_t, ptrdiff_t, ptrdiff_t,
 				      Lisp_Object);
 
 /* Helper function for Ftranslate_region_internal.
@@ -2948,7 +2937,7 @@ static Lisp_Object check_translation (EMACS_INT, EMACS_INT, EMACS_INT,
    element is found, return it.  Otherwise return Qnil.  */
 
 static Lisp_Object
-check_translation (EMACS_INT pos, EMACS_INT pos_byte, EMACS_INT end,
+check_translation (ptrdiff_t pos, ptrdiff_t pos_byte, ptrdiff_t end,
 		   Lisp_Object val)
 {
   int buf_size = 16, buf_used = 0;
@@ -2957,7 +2946,7 @@ check_translation (EMACS_INT pos, EMACS_INT pos_byte, EMACS_INT end,
   for (; CONSP (val); val = XCDR (val))
     {
       Lisp_Object elt;
-      EMACS_INT len, i;
+      ptrdiff_t len, i;
 
       elt = XCAR (val);
       if (! CONSP (elt))
@@ -3010,8 +2999,8 @@ It returns the number of characters changed.  */)
   register unsigned char *tt;	/* Trans table. */
   register int nc;		/* New character. */
   int cnt;			/* Number of changes made. */
-  EMACS_INT size;		/* Size of translate table. */
-  EMACS_INT pos, pos_byte, end_pos;
+  ptrdiff_t size;		/* Size of translate table. */
+  ptrdiff_t pos, pos_byte, end_pos;
   int multibyte = !NILP (BVAR (current_buffer, enable_multibyte_characters));
   int string_multibyte IF_LINT (= 0);
 
@@ -3289,7 +3278,7 @@ save_restriction_restore (Lisp_Object data)
 	/* The restriction has changed from the saved one, so restore
 	   the saved restriction.  */
 	{
-	  EMACS_INT pt = BUF_PT (buf);
+	  ptrdiff_t pt = BUF_PT (buf);
 
 	  SET_BUF_BEGV_BOTH (buf, beg->charpos, beg->bytepos);
 	  SET_BUF_ZV_BOTH (buf, end->charpos, end->bytepos);
@@ -3347,7 +3336,7 @@ usage: (save-restriction &rest BODY)  */)
   (Lisp_Object body)
 {
   register Lisp_Object val;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   record_unwind_protect (save_restriction_restore, save_restriction_save ());
   val = Fprogn (body);
@@ -3565,12 +3554,12 @@ usage: (format STRING &rest OBJECTS)  */)
   ptrdiff_t n;		/* The number of the next arg to substitute */
   char initial_buffer[4000];
   char *buf = initial_buffer;
-  EMACS_INT bufsize = sizeof initial_buffer;
-  EMACS_INT max_bufsize = STRING_BYTES_BOUND + 1;
+  ptrdiff_t bufsize = sizeof initial_buffer;
+  ptrdiff_t max_bufsize = STRING_BYTES_BOUND + 1;
   char *p;
   Lisp_Object buf_save_value IF_LINT (= {0});
   register char *format, *end, *format_start;
-  EMACS_INT formatlen, nchars;
+  ptrdiff_t formatlen, nchars;
   /* Nonzero if the format is multibyte.  */
   int multibyte_format = 0;
   /* Nonzero if the output should be a multibyte string,
@@ -3597,7 +3586,7 @@ usage: (format STRING &rest OBJECTS)  */)
      info[0] is unused.  Unused elements have -1 for start.  */
   struct info
   {
-    EMACS_INT start, end;
+    ptrdiff_t start, end;
     int converted_to_string;
     int intervals;
   } *info = 0;
@@ -3654,7 +3643,7 @@ usage: (format STRING &rest OBJECTS)  */)
       char *format0 = format;
 
       /* Bytes needed to represent the output of this conversion.  */
-      EMACS_INT convbytes;
+      ptrdiff_t convbytes;
 
       if (*format == '%')
 	{
@@ -3681,7 +3670,7 @@ usage: (format STRING &rest OBJECTS)  */)
 	  int space_flag = 0;
 	  int sharp_flag = 0;
 	  int  zero_flag = 0;
-	  EMACS_INT field_width;
+	  ptrdiff_t field_width;
 	  int precision_given;
 	  uintmax_t precision = UINTMAX_MAX;
 	  char *num_end;
@@ -3788,11 +3777,11 @@ usage: (format STRING &rest OBJECTS)  */)
 	    {
 	      /* handle case (precision[n] >= 0) */
 
-	      EMACS_INT width, padding, nbytes;
-	      EMACS_INT nchars_string;
+	      ptrdiff_t width, padding, nbytes;
+	      ptrdiff_t nchars_string;
 
-	      EMACS_INT prec = -1;
-	      if (precision_given && precision <= TYPE_MAXIMUM (EMACS_INT))
+	      ptrdiff_t prec = -1;
+	      if (precision_given && precision <= TYPE_MAXIMUM (ptrdiff_t))
 		prec = precision;
 
 	      /* lisp_string_width ignores a precision of 0, but GNU
@@ -3805,7 +3794,7 @@ usage: (format STRING &rest OBJECTS)  */)
 		width = nchars_string = nbytes = 0;
 	      else
 		{
-		  EMACS_INT nch, nby;
+		  ptrdiff_t nch, nby;
 		  width = lisp_string_width (args[n], prec, &nch, &nby);
 		  if (prec < 0)
 		    {
@@ -3902,7 +3891,7 @@ usage: (format STRING &rest OBJECTS)  */)
 	      verify (0 < USEFUL_PRECISION_MAX);
 
 	      int prec;
-	      EMACS_INT padding, sprintf_bytes;
+	      ptrdiff_t padding, sprintf_bytes;
 	      uintmax_t excess_precision, numwidth;
 	      uintmax_t leading_zeros = 0, trailing_zeros = 0;
 
@@ -4217,8 +4206,8 @@ usage: (format STRING &rest OBJECTS)  */)
 
       if (CONSP (props))
 	{
-	  EMACS_INT bytepos = 0, position = 0, translated = 0;
-	  EMACS_INT argn = 1;
+	  ptrdiff_t bytepos = 0, position = 0, translated = 0;
+	  ptrdiff_t argn = 1;
 	  Lisp_Object list;
 
 	  /* Adjust the bounds of each text property
@@ -4236,7 +4225,7 @@ usage: (format STRING &rest OBJECTS)  */)
 	  for (list = props; CONSP (list); list = XCDR (list))
 	    {
 	      Lisp_Object item;
-	      EMACS_INT pos;
+	      ptrdiff_t pos;
 
 	      item = XCAR (list);
 
@@ -4367,12 +4356,12 @@ Case is ignored if `case-fold-search' is non-nil in the current buffer.  */)
    It's the caller's job to ensure that START1 <= END1 <= START2 <= END2.  */
 
 static void
-transpose_markers (EMACS_INT start1, EMACS_INT end1,
-		   EMACS_INT start2, EMACS_INT end2,
-		   EMACS_INT start1_byte, EMACS_INT end1_byte,
-		   EMACS_INT start2_byte, EMACS_INT end2_byte)
+transpose_markers (ptrdiff_t start1, ptrdiff_t end1,
+		   ptrdiff_t start2, ptrdiff_t end2,
+		   ptrdiff_t start1_byte, ptrdiff_t end1_byte,
+		   ptrdiff_t start2_byte, ptrdiff_t end2_byte)
 {
-  register EMACS_INT amt1, amt1_byte, amt2, amt2_byte, diff, diff_byte, mpos;
+  register ptrdiff_t amt1, amt1_byte, amt2, amt2_byte, diff, diff_byte, mpos;
   register struct Lisp_Marker *marker;
 
   /* Update point as if it were a marker.  */
@@ -4446,9 +4435,9 @@ any markers that happen to be located in the regions.
 Transposing beyond buffer boundaries is an error.  */)
   (Lisp_Object startr1, Lisp_Object endr1, Lisp_Object startr2, Lisp_Object endr2, Lisp_Object leave_markers)
 {
-  register EMACS_INT start1, end1, start2, end2;
-  EMACS_INT start1_byte, start2_byte, len1_byte, len2_byte;
-  EMACS_INT gap, len1, len_mid, len2;
+  register ptrdiff_t start1, end1, start2, end2;
+  ptrdiff_t start1_byte, start2_byte, len1_byte, len2_byte;
+  ptrdiff_t gap, len1, len_mid, len2;
   unsigned char *start1_addr, *start2_addr, *temp;
 
   INTERVAL cur_intv, tmp_interval1, tmp_interval_mid, tmp_interval2, tmp_interval3;
@@ -4469,7 +4458,7 @@ Transposing beyond buffer boundaries is an error.  */)
   /* Swap the regions if they're reversed.  */
   if (start2 < end1)
     {
-      register EMACS_INT glumph = start1;
+      register ptrdiff_t glumph = start1;
       start1 = start2;
       start2 = glumph;
       glumph = end1;
diff --git a/src/emacs.c b/src/emacs.c
index 321e7919c93..d9b60b27129 100644
--- a/src/emacs.c
+++ b/src/emacs.c
@@ -112,15 +112,15 @@ int gdb_use_union EXTERNALLY_VISIBLE  = 0;
 #else
 int gdb_use_union EXTERNALLY_VISIBLE = 1;
 #endif
-EMACS_INT gdb_valbits EXTERNALLY_VISIBLE = VALBITS;
-EMACS_INT gdb_gctypebits EXTERNALLY_VISIBLE = GCTYPEBITS;
+int gdb_valbits EXTERNALLY_VISIBLE = VALBITS;
+int gdb_gctypebits EXTERNALLY_VISIBLE = GCTYPEBITS;
 #if defined (DATA_SEG_BITS) && ! defined (USE_LSB_TAG)
-EMACS_INT gdb_data_seg_bits EXTERNALLY_VISIBLE = DATA_SEG_BITS;
+uintptr_t gdb_data_seg_bits EXTERNALLY_VISIBLE = DATA_SEG_BITS;
 #else
-EMACS_INT gdb_data_seg_bits EXTERNALLY_VISIBLE = 0;
+uintptr_t gdb_data_seg_bits EXTERNALLY_VISIBLE = 0;
 #endif
-EMACS_INT PVEC_FLAG EXTERNALLY_VISIBLE = PSEUDOVECTOR_FLAG;
-EMACS_INT gdb_array_mark_flag EXTERNALLY_VISIBLE = ARRAY_MARK_FLAG;
+ptrdiff_t PVEC_FLAG EXTERNALLY_VISIBLE = PSEUDOVECTOR_FLAG;
+ptrdiff_t gdb_array_mark_flag EXTERNALLY_VISIBLE = ARRAY_MARK_FLAG;
 /* GDB might say "No enum type named pvec_type" if we don't have at
    least one symbol with that type, and then xbacktrace could fail.  */
 enum pvec_type gdb_pvec_type EXTERNALLY_VISIBLE = PVEC_TYPE_MASK;
@@ -397,7 +397,7 @@ init_cmdargs (int argc, char **argv, int skip_args)
 {
   register int i;
   Lisp_Object name, dir, handler;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object raw_name;
 
   initial_argv = argv;
@@ -1993,6 +1993,7 @@ all of which are called before Emacs is actually killed.  */)
 {
   struct gcpro gcpro1;
   Lisp_Object hook;
+  int status;
 
   GCPRO1 (arg);
 
@@ -2017,7 +2018,13 @@ all of which are called before Emacs is actually killed.  */)
   if (STRINGP (Vauto_save_list_file_name))
     unlink (SSDATA (Vauto_save_list_file_name));
 
-  exit (INTEGERP (arg) ? XINT (arg) : EXIT_SUCCESS);
+  if (! INTEGERP (arg))
+    status = EXIT_SUCCESS;
+  else if (XINT (arg) < 0)
+    status = XINT (arg) | INT_MIN;
+  else
+    status = XINT (arg) & INT_MAX;
+  exit (status);
 }
 
 
@@ -2127,7 +2134,7 @@ You must run Emacs in batch mode in order to dump it.  */)
 {
   Lisp_Object tem;
   Lisp_Object symbol;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   check_pure_size ();
 
diff --git a/src/eval.c b/src/eval.c
index 32b9d366fc3..5fa9a945ef5 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -90,7 +90,7 @@ Lisp_Object Vautoload_queue;
 
 /* Current number of specbindings allocated in specpdl.  */
 
-EMACS_INT specpdl_size;
+ptrdiff_t specpdl_size;
 
 /* Pointer to beginning of specpdl.  */
 
@@ -111,7 +111,7 @@ static EMACS_INT lisp_eval_depth;
    signal the error instead of entering an infinite loop of debugger
    invocations.  */
 
-static int when_entered_debugger;
+static EMACS_INT when_entered_debugger;
 
 /* The function from which the last `signal' was called.  Set in
    Fsignal.  */
@@ -177,7 +177,7 @@ static Lisp_Object
 call_debugger (Lisp_Object arg)
 {
   int debug_while_redisplaying;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object val;
   EMACS_INT old_max = max_specpdl_size;
 
@@ -758,8 +758,8 @@ The return value is BASE-VARIABLE.  */)
   {
     struct specbinding *p;
 
-    for (p = specpdl_ptr - 1; p >= specpdl; p--)
-      if (p->func == NULL
+    for (p = specpdl_ptr; p > specpdl; p)
+      if ((--p)->func == NULL
 	  && (EQ (new_alias,
 		  CONSP (p->symbol) ? XCAR (p->symbol) : p->symbol)))
 	error ("Don't know how to make a let-bound variable an alias");
@@ -833,9 +833,9 @@ usage: (defvar SYMBOL &optional INITVALUE DOCSTRING)  */)
 	{ /* Check if there is really a global binding rather than just a let
 	     binding that shadows the global unboundness of the var.  */
 	  volatile struct specbinding *pdl = specpdl_ptr;
-	  while (--pdl >= specpdl)
+	  while (pdl > specpdl)
 	    {
-	      if (EQ (pdl->symbol, sym) && !pdl->func
+	      if (EQ ((--pdl)->symbol, sym) && !pdl->func
 		  && EQ (pdl->old_value, Qunbound))
 		{
 		  message_with_string ("Warning: defvar ignored because %s is let-bound",
@@ -983,7 +983,7 @@ usage: (let* VARLIST BODY...)  */)
   (Lisp_Object args)
 {
   Lisp_Object varlist, var, val, elt, lexenv;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3;
 
   GCPRO3 (args, elt, varlist);
@@ -1046,7 +1046,7 @@ usage: (let VARLIST BODY...)  */)
 {
   Lisp_Object *temps, tem, lexenv;
   register Lisp_Object elt, varlist;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   ptrdiff_t argnum;
   struct gcpro gcpro1, gcpro2;
   USE_SAFE_ALLOCA;
@@ -1349,7 +1349,7 @@ usage: (unwind-protect BODYFORM UNWINDFORMS...)  */)
   (Lisp_Object args)
 {
   Lisp_Object val;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   record_unwind_protect (Fprogn, Fcdr (args));
   val = eval_sub (Fcar (args));
@@ -2123,7 +2123,7 @@ un_autoload (Lisp_Object oldqueue)
 void
 do_autoload (Lisp_Object fundef, Lisp_Object funname)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object fun;
   struct gcpro gcpro1, gcpro2, gcpro3;
 
@@ -2170,7 +2170,7 @@ DEFUN ("eval", Feval, Seval, 1, 2, 0,
 If LEXICAL is t, evaluate using lexical scoping.  */)
   (Lisp_Object form, Lisp_Object lexical)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   specbind (Qinternal_interpreter_environment,
 	    NILP (lexical) ? Qnil : Fcons (Qt, Qnil));
   return unbind_to (count, eval_sub (form));
@@ -2404,7 +2404,8 @@ Thus, (apply '+ 1 2 '(3 4)) returns 10.
 usage: (apply FUNCTION &rest ARGUMENTS)  */)
   (ptrdiff_t nargs, Lisp_Object *args)
 {
-  ptrdiff_t i, numargs;
+  ptrdiff_t i;
+  EMACS_INT numargs;
   register Lisp_Object spread_arg;
   register Lisp_Object *funcall_args;
   Lisp_Object fun, retval;
@@ -3054,7 +3055,8 @@ static Lisp_Object
 apply_lambda (Lisp_Object fun, Lisp_Object args)
 {
   Lisp_Object args_left;
-  ptrdiff_t i, numargs;
+  ptrdiff_t i;
+  EMACS_INT numargs;
   register Lisp_Object *arg_vector;
   struct gcpro gcpro1, gcpro2, gcpro3;
   register Lisp_Object tem;
@@ -3099,7 +3101,7 @@ funcall_lambda (Lisp_Object fun, ptrdiff_t nargs,
 		register Lisp_Object *arg_vector)
 {
   Lisp_Object val, syms_left, next, lexenv;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   ptrdiff_t i;
   int optional, rest;
 
@@ -3238,12 +3240,8 @@ DEFUN ("fetch-bytecode", Ffetch_bytecode, Sfetch_bytecode,
 static void
 grow_specpdl (void)
 {
-  register int count = SPECPDL_INDEX ();
-  int max_size =
-    min (max_specpdl_size,
-	 min (max (PTRDIFF_MAX, SIZE_MAX) / sizeof (struct specbinding),
-	      INT_MAX));
-  int size;
+  register ptrdiff_t count = SPECPDL_INDEX ();
+  ptrdiff_t max_size = min (max_specpdl_size, PTRDIFF_MAX);
   if (max_size <= specpdl_size)
     {
       if (max_specpdl_size < 400)
@@ -3251,9 +3249,7 @@ grow_specpdl (void)
       if (max_size <= specpdl_size)
 	signal_error ("Variable binding depth exceeds max-specpdl-size", Qnil);
     }
-  size = specpdl_size < max_size / 2 ? 2 * specpdl_size : max_size;
-  specpdl = xnrealloc (specpdl, size, sizeof *specpdl);
-  specpdl_size = size;
+  specpdl = xpalloc (specpdl, &specpdl_size, 1, max_size, sizeof *specpdl);
   specpdl_ptr = specpdl + count;
 }
 
@@ -3383,7 +3379,7 @@ record_unwind_protect (Lisp_Object (*function) (Lisp_Object), Lisp_Object arg)
 }
 
 Lisp_Object
-unbind_to (int count, Lisp_Object value)
+unbind_to (ptrdiff_t count, Lisp_Object value)
 {
   Lisp_Object quitf = Vquit_flag;
   struct gcpro gcpro1, gcpro2;
@@ -3463,7 +3459,7 @@ The debugger is entered when that frame exits, if the flag is non-nil.  */)
   (Lisp_Object level, Lisp_Object flag)
 {
   register struct backtrace *backlist = backtrace_list;
-  register int i;
+  register EMACS_INT i;
 
   CHECK_NUMBER (level);
 
diff --git a/src/fileio.c b/src/fileio.c
index 08be41f9fe4..486c3d4c175 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -145,9 +145,9 @@ Lisp_Object Qfile_name_history;
 static Lisp_Object Qcar_less_than_car;
 
 static Lisp_Object Fmake_symbolic_link (Lisp_Object, Lisp_Object, Lisp_Object);
-static int a_write (int, Lisp_Object, EMACS_INT, EMACS_INT,
+static int a_write (int, Lisp_Object, ptrdiff_t, ptrdiff_t,
                     Lisp_Object *, struct coding_system *);
-static int e_write (int, Lisp_Object, EMACS_INT, EMACS_INT,
+static int e_write (int, Lisp_Object, ptrdiff_t, ptrdiff_t,
 		    struct coding_system *);
 
 
@@ -257,7 +257,7 @@ use the standard functions without calling themselves recursively.  */)
 {
   /* This function must not munge the match data.  */
   Lisp_Object chain, inhibited_handlers, result;
-  int pos = -1;
+  ptrdiff_t pos = -1;
 
   result = Qnil;
   CHECK_STRING (filename);
@@ -275,7 +275,7 @@ use the standard functions without calling themselves recursively.  */)
       if (CONSP (elt))
 	{
 	  Lisp_Object string = XCAR (elt);
-	  EMACS_INT match_pos;
+	  ptrdiff_t match_pos;
 	  Lisp_Object handler = XCDR (elt);
 	  Lisp_Object operations = Qnil;
 
@@ -1813,12 +1813,12 @@ on the system, we copy the SELinux context of FILE to NEWNAME.  */)
   (Lisp_Object file, Lisp_Object newname, Lisp_Object ok_if_already_exists, Lisp_Object keep_time, Lisp_Object preserve_uid_gid, Lisp_Object preserve_selinux_context)
 {
   int ifd, ofd;
-  EMACS_INT n;
+  int n;
   char buf[16 * 1024];
   struct stat st, out_st;
   Lisp_Object handler;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   int input_file_statable_p;
   Lisp_Object encoded_file, encoded_newname;
 #if HAVE_LIBSELINUX
@@ -2210,7 +2210,7 @@ This is what happens in interactive use with M-x.  */)
     {
       if (errno == EXDEV)
 	{
-          int count;
+          ptrdiff_t count;
           symlink_target = Ffile_symlink_p (file);
           if (! NILP (symlink_target))
             Fmake_symbolic_link (symlink_target, newname,
@@ -3055,6 +3055,8 @@ otherwise, if FILE2 does not exist, the answer is t.  */)
 #ifndef READ_BUF_SIZE
 #define READ_BUF_SIZE (64 << 10)
 #endif
+/* Some buffer offsets are stored in 'int' variables.  */
+verify (READ_BUF_SIZE <= INT_MAX);
 
 /* This function is called after Lisp functions to decide a coding
    system are called, or when they cause an error.  Before they are
@@ -3099,8 +3101,8 @@ decide_coding_unwind (Lisp_Object unwind_data)
 /* Used to pass values from insert-file-contents to read_non_regular.  */
 
 static int non_regular_fd;
-static EMACS_INT non_regular_inserted;
-static EMACS_INT non_regular_nbytes;
+static ptrdiff_t non_regular_inserted;
+static int non_regular_nbytes;
 
 
 /* Read from a non-regular file.
@@ -3111,7 +3113,7 @@ static EMACS_INT non_regular_nbytes;
 static Lisp_Object
 read_non_regular (Lisp_Object ignore)
 {
-  EMACS_INT nbytes;
+  int nbytes;
 
   immediate_quit = 1;
   QUIT;
@@ -3176,16 +3178,16 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 {
   struct stat st;
   register int fd;
-  EMACS_INT inserted = 0;
+  ptrdiff_t inserted = 0;
   int nochange = 0;
-  register EMACS_INT how_much;
+  register ptrdiff_t how_much;
   off_t beg_offset, end_offset;
-  register EMACS_INT unprocessed;
-  int count = SPECPDL_INDEX ();
+  register int unprocessed;
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
   Lisp_Object handler, val, insval, orig_filename, old_undo;
   Lisp_Object p;
-  EMACS_INT total = 0;
+  ptrdiff_t total = 0;
   int not_regular = 0;
   char read_buf[READ_BUF_SIZE];
   struct coding_system coding;
@@ -3225,7 +3227,8 @@ variable `last-coding-system-used' to the coding system actually used.  */)
     {
       val = call6 (handler, Qinsert_file_contents, filename,
 		   visit, beg, end, replace);
-      if (CONSP (val) && CONSP (XCDR (val)))
+      if (CONSP (val) && CONSP (XCDR (val))
+	  && RANGED_INTEGERP (0, XCAR (XCDR (val)), ZV - PT))
 	inserted = XINT (XCAR (XCDR (val)));
       goto handled;
     }
@@ -3378,7 +3381,7 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 		 We assume that the 1K-byte and 3K-byte for heading
 		 and tailing respectively are sufficient for this
 		 purpose.  */
-	      EMACS_INT nread;
+	      int nread;
 
 	      if (st.st_size <= (1024 * 4))
 		nread = emacs_read (fd, read_buf, 1024 * 4);
@@ -3488,9 +3491,9 @@ variable `last-coding-system-used' to the coding system actually used.  */)
       /* same_at_start and same_at_end count bytes,
 	 because file access counts bytes
 	 and BEG and END count bytes.  */
-      EMACS_INT same_at_start = BEGV_BYTE;
-      EMACS_INT same_at_end = ZV_BYTE;
-      EMACS_INT overlap;
+      ptrdiff_t same_at_start = BEGV_BYTE;
+      ptrdiff_t same_at_end = ZV_BYTE;
+      ptrdiff_t overlap;
       /* There is still a possibility we will find the need to do code
 	 conversion.  If that happens, we set this variable to 1 to
 	 give up on handling REPLACE in the optimized way.  */
@@ -3509,7 +3512,7 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 	 match the text at the beginning of the buffer.  */
       while (1)
 	{
-	  EMACS_INT nread, bufpos;
+	  int nread, bufpos;
 
 	  nread = emacs_read (fd, buffer, sizeof buffer);
 	  if (nread < 0)
@@ -3618,7 +3621,7 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 
       if (! giveup_match_end)
 	{
-	  EMACS_INT temp;
+	  ptrdiff_t temp;
 
 	  /* We win!  We can handle REPLACE the optimized way.  */
 
@@ -3672,16 +3675,16 @@ variable `last-coding-system-used' to the coding system actually used.  */)
      in a more optimized way.  */
   if (!NILP (replace) && ! replace_handled && BEGV < ZV)
     {
-      EMACS_INT same_at_start = BEGV_BYTE;
-      EMACS_INT same_at_end = ZV_BYTE;
-      EMACS_INT same_at_start_charpos;
-      EMACS_INT inserted_chars;
-      EMACS_INT overlap;
-      EMACS_INT bufpos;
+      ptrdiff_t same_at_start = BEGV_BYTE;
+      ptrdiff_t same_at_end = ZV_BYTE;
+      ptrdiff_t same_at_start_charpos;
+      ptrdiff_t inserted_chars;
+      ptrdiff_t overlap;
+      ptrdiff_t bufpos;
       unsigned char *decoded;
-      EMACS_INT temp;
-      EMACS_INT this = 0;
-      int this_count = SPECPDL_INDEX ();
+      ptrdiff_t temp;
+      ptrdiff_t this = 0;
+      ptrdiff_t this_count = SPECPDL_INDEX ();
       int multibyte = ! NILP (BVAR (current_buffer, enable_multibyte_characters));
       Lisp_Object conversion_buffer;
 
@@ -3705,8 +3708,7 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 	  /* We read one bunch by one (READ_BUF_SIZE bytes) to allow
 	     quitting while reading a huge while.  */
 	  /* try is reserved in some compilers (Microsoft C) */
-	  EMACS_INT trytry = min (total - how_much,
-				  READ_BUF_SIZE - unprocessed);
+	  int trytry = min (total - how_much, READ_BUF_SIZE - unprocessed);
 
 	  /* Allow quitting out of the actual I/O.  */
 	  immediate_quit = 1;
@@ -3897,13 +3899,13 @@ variable `last-coding-system-used' to the coding system actually used.  */)
   /* Here, we don't do code conversion in the loop.  It is done by
      decode_coding_gap after all data are read into the buffer.  */
   {
-    EMACS_INT gap_size = GAP_SIZE;
+    ptrdiff_t gap_size = GAP_SIZE;
 
     while (how_much < total)
       {
 	/* try is reserved in some compilers (Microsoft C) */
-	EMACS_INT trytry = min (total - how_much, READ_BUF_SIZE);
-	EMACS_INT this;
+	int trytry = min (total - how_much, READ_BUF_SIZE);
+	ptrdiff_t this;
 
 	if (not_regular)
 	  {
@@ -4022,7 +4024,7 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 	     care of marker adjustment.  By this way, we can run Lisp
 	     program safely before decoding the inserted text.  */
 	  Lisp_Object unwind_data;
-	  int count1 = SPECPDL_INDEX ();
+	  ptrdiff_t count1 = SPECPDL_INDEX ();
 
 	  unwind_data = Fcons (BVAR (current_buffer, enable_multibyte_characters),
 			       Fcons (BVAR (current_buffer, undo_list),
@@ -4143,7 +4145,8 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 		      visit);
       if (! NILP (insval))
 	{
-	  CHECK_NUMBER (insval);
+	  if (! RANGED_INTEGERP (0, insval, ZV - PT))
+	    wrong_type_argument (intern ("inserted-chars"), insval);
 	  inserted = XFASTINT (insval);
 	}
     }
@@ -4152,8 +4155,8 @@ variable `last-coding-system-used' to the coding system actually used.  */)
   if (inserted > 0)
     {
       /* Don't run point motion or modification hooks when decoding.  */
-      int count1 = SPECPDL_INDEX ();
-      EMACS_INT old_inserted = inserted;
+      ptrdiff_t count1 = SPECPDL_INDEX ();
+      ptrdiff_t old_inserted = inserted;
       specbind (Qinhibit_point_motion_hooks, Qt);
       specbind (Qinhibit_modification_hooks, Qt);
 
@@ -4165,7 +4168,8 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 	{
 	  insval = call3 (Qformat_decode,
 			  Qnil, make_number (inserted), visit);
-	  CHECK_NUMBER (insval);
+	  if (! RANGED_INTEGERP (0, insval, ZV - PT))
+	    wrong_type_argument (intern ("inserted-chars"), insval);
 	  inserted = XFASTINT (insval);
 	}
       else
@@ -4179,15 +4183,16 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 	     Hence we temporarily save `point' and `inserted' here and
 	     restore `point' iff format-decode did not insert or delete
 	     any text.  Otherwise we leave `point' at point-min.  */
-	  EMACS_INT opoint = PT;
-	  EMACS_INT opoint_byte = PT_BYTE;
-	  EMACS_INT oinserted = ZV - BEGV;
-	  int ochars_modiff = CHARS_MODIFF;
+	  ptrdiff_t opoint = PT;
+	  ptrdiff_t opoint_byte = PT_BYTE;
+	  ptrdiff_t oinserted = ZV - BEGV;
+	  EMACS_INT ochars_modiff = CHARS_MODIFF;
 
 	  TEMP_SET_PT_BOTH (BEGV, BEGV_BYTE);
 	  insval = call3 (Qformat_decode,
 			  Qnil, make_number (oinserted), visit);
-	  CHECK_NUMBER (insval);
+	  if (! RANGED_INTEGERP (0, insval, ZV - PT))
+	    wrong_type_argument (intern ("inserted-chars"), insval);
 	  if (ochars_modiff == CHARS_MODIFF)
 	    /* format_decode didn't modify buffer's characters => move
 	       point back to position before inserted text and leave
@@ -4209,7 +4214,8 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 	      insval = call1 (XCAR (p), make_number (inserted));
 	      if (!NILP (insval))
 		{
-		  CHECK_NUMBER (insval);
+		  if (! RANGED_INTEGERP (0, insval, ZV - PT))
+		    wrong_type_argument (intern ("inserted-chars"), insval);
 		  inserted = XFASTINT (insval);
 		}
 	    }
@@ -4217,16 +4223,17 @@ variable `last-coding-system-used' to the coding system actually used.  */)
 	    {
 	      /* For the rationale of this see the comment on
 		 format-decode above.  */
-	      EMACS_INT opoint = PT;
-	      EMACS_INT opoint_byte = PT_BYTE;
-	      EMACS_INT oinserted = ZV - BEGV;
-	      int ochars_modiff = CHARS_MODIFF;
+	      ptrdiff_t opoint = PT;
+	      ptrdiff_t opoint_byte = PT_BYTE;
+	      ptrdiff_t oinserted = ZV - BEGV;
+	      EMACS_INT ochars_modiff = CHARS_MODIFF;
 
 	      TEMP_SET_PT_BOTH (BEGV, BEGV_BYTE);
 	      insval = call1 (XCAR (p), make_number (oinserted));
 	      if (!NILP (insval))
 		{
-		  CHECK_NUMBER (insval);
+		  if (! RANGED_INTEGERP (0, insval, ZV - PT))
+		    wrong_type_argument (intern ("inserted-chars"), insval);
 		  if (ochars_modiff == CHARS_MODIFF)
 		    /* after_insert_file_functions didn't modify
 		       buffer's characters => move point back to
@@ -4458,7 +4465,7 @@ This calls `write-region-annotate-functions' at the start, and
   int save_errno = 0;
   const char *fn;
   struct stat st;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   int count1;
   Lisp_Object handler;
   Lisp_Object visit_file;
@@ -4856,13 +4863,13 @@ build_annotations (Lisp_Object start, Lisp_Object end)
    The return value is negative in case of system call failure.  */
 
 static int
-a_write (int desc, Lisp_Object string, EMACS_INT pos,
-	 register EMACS_INT nchars, Lisp_Object *annot,
+a_write (int desc, Lisp_Object string, ptrdiff_t pos,
+	 register ptrdiff_t nchars, Lisp_Object *annot,
 	 struct coding_system *coding)
 {
   Lisp_Object tem;
-  EMACS_INT nextpos;
-  EMACS_INT lastpos = pos + nchars;
+  ptrdiff_t nextpos;
+  ptrdiff_t lastpos = pos + nchars;
 
   while (NILP (*annot) || CONSP (*annot))
     {
@@ -4902,7 +4909,7 @@ a_write (int desc, Lisp_Object string, EMACS_INT pos,
    are indexes to the string STRING.  */
 
 static int
-e_write (int desc, Lisp_Object string, EMACS_INT start, EMACS_INT end,
+e_write (int desc, Lisp_Object string, ptrdiff_t start, ptrdiff_t end,
 	 struct coding_system *coding)
 {
   if (STRINGP (string))
@@ -4934,8 +4941,8 @@ e_write (int desc, Lisp_Object string, EMACS_INT start, EMACS_INT end,
 	}
       else
 	{
-	  EMACS_INT start_byte = CHAR_TO_BYTE (start);
-	  EMACS_INT end_byte = CHAR_TO_BYTE (end);
+	  ptrdiff_t start_byte = CHAR_TO_BYTE (start);
+	  ptrdiff_t end_byte = CHAR_TO_BYTE (end);
 
 	  coding->src_multibyte = (end - start) < (end_byte - start_byte);
 	  if (CODING_REQUIRE_ENCODING (coding))
@@ -5219,7 +5226,7 @@ A non-nil CURRENT-ONLY argument means save only current buffer.  */)
   int do_handled_files;
   Lisp_Object oquit;
   FILE *stream = NULL;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   int orig_minibuffer_auto_raise = minibuffer_auto_raise;
   int old_message_p = 0;
   struct gcpro gcpro1, gcpro2;
@@ -5339,7 +5346,7 @@ A non-nil CURRENT-ONLY argument means save only current buffer.  */)
 	    EMACS_GET_TIME (before_time);
 
 	    /* If we had a failure, don't try again for 20 minutes.  */
-	    if (b->auto_save_failure_time >= 0
+	    if (b->auto_save_failure_time > 0
 		&& EMACS_SECS (before_time) - b->auto_save_failure_time < 1200)
 	      continue;
 
@@ -5418,7 +5425,7 @@ No auto-save file will be written until the buffer changes again.  */)
      they're not autosaved.  */
   BUF_AUTOSAVE_MODIFF (current_buffer) = MODIFF;
   XSETFASTINT (BVAR (current_buffer, save_length), Z - BEG);
-  current_buffer->auto_save_failure_time = -1;
+  current_buffer->auto_save_failure_time = 0;
   return Qnil;
 }
 
@@ -5427,7 +5434,7 @@ DEFUN ("clear-buffer-auto-save-failure", Fclear_buffer_auto_save_failure,
        doc: /* Clear any record of a recent auto-save failure in the current buffer.  */)
   (void)
 {
-  current_buffer->auto_save_failure_time = -1;
+  current_buffer->auto_save_failure_time = 0;
   return Qnil;
 }
 
diff --git a/src/fns.c b/src/fns.c
index 392f447a6d8..5d75c42aea0 100644
--- a/src/fns.c
+++ b/src/fns.c
@@ -250,8 +250,8 @@ If string STR1 is greater, the value is a positive number N;
   N - 1 is the number of characters that match at the beginning.  */)
   (Lisp_Object str1, Lisp_Object start1, Lisp_Object end1, Lisp_Object str2, Lisp_Object start2, Lisp_Object end2, Lisp_Object ignore_case)
 {
-  register EMACS_INT end1_char, end2_char;
-  register EMACS_INT i1, i1_byte, i2, i2_byte;
+  register ptrdiff_t end1_char, end2_char;
+  register ptrdiff_t i1, i1_byte, i2, i2_byte;
 
   CHECK_STRING (str1);
   CHECK_STRING (str2);
@@ -266,19 +266,23 @@ If string STR1 is greater, the value is a positive number N;
   if (! NILP (end2))
     CHECK_NATNUM (end2);
 
-  i1 = XINT (start1);
-  i2 = XINT (start2);
-
-  i1_byte = string_char_to_byte (str1, i1);
-  i2_byte = string_char_to_byte (str2, i2);
-
   end1_char = SCHARS (str1);
   if (! NILP (end1) && end1_char > XINT (end1))
     end1_char = XINT (end1);
+  if (end1_char < XINT (start1))
+    args_out_of_range (str1, start1);
 
   end2_char = SCHARS (str2);
   if (! NILP (end2) && end2_char > XINT (end2))
     end2_char = XINT (end2);
+  if (end2_char < XINT (start2))
+    args_out_of_range (str2, start2);
+
+  i1 = XINT (start1);
+  i2 = XINT (start2);
+
+  i1_byte = string_char_to_byte (str1, i1);
+  i2_byte = string_char_to_byte (str2, i2);
 
   while (i1 < end1_char && i2 < end2_char)
     {
@@ -341,8 +345,8 @@ Case is significant.
 Symbols are also allowed; their print names are used instead.  */)
   (register Lisp_Object s1, Lisp_Object s2)
 {
-  register EMACS_INT end;
-  register EMACS_INT i1, i1_byte, i2, i2_byte;
+  register ptrdiff_t end;
+  register ptrdiff_t i1, i1_byte, i2, i2_byte;
 
   if (SYMBOLP (s1))
     s1 = SYMBOL_NAME (s1);
@@ -465,8 +469,8 @@ with the original.  */)
 struct textprop_rec
 {
   ptrdiff_t argnum;		/* refer to ARGS (arguments of `concat') */
-  EMACS_INT from;		/* refer to ARGS[argnum] (argument string) */
-  EMACS_INT to;			/* refer to VAL (the target string) */
+  ptrdiff_t from;		/* refer to ARGS[argnum] (argument string) */
+  ptrdiff_t to;			/* refer to VAL (the target string) */
 };
 
 static Lisp_Object
@@ -476,8 +480,8 @@ concat (ptrdiff_t nargs, Lisp_Object *args,
   Lisp_Object val;
   register Lisp_Object tail;
   register Lisp_Object this;
-  EMACS_INT toindex;
-  EMACS_INT toindex_byte = 0;
+  ptrdiff_t toindex;
+  ptrdiff_t toindex_byte = 0;
   register EMACS_INT result_len;
   register EMACS_INT result_len_byte;
   ptrdiff_t argnum;
@@ -530,10 +534,10 @@ concat (ptrdiff_t nargs, Lisp_Object *args,
 	{
 	  /* We must count the number of bytes needed in the string
 	     as well as the number of characters.  */
-	  EMACS_INT i;
+	  ptrdiff_t i;
 	  Lisp_Object ch;
 	  int c;
-	  EMACS_INT this_len_byte;
+	  ptrdiff_t this_len_byte;
 
 	  if (VECTORP (this) || COMPILEDP (this))
 	    for (i = 0; i < len; i++)
@@ -542,6 +546,8 @@ concat (ptrdiff_t nargs, Lisp_Object *args,
 		CHECK_CHARACTER (ch);
 		c = XFASTINT (ch);
 		this_len_byte = CHAR_BYTES (c);
+		if (STRING_BYTES_BOUND - result_len_byte < this_len_byte)
+		  string_overflow ();
 		result_len_byte += this_len_byte;
 		if (! ASCII_CHAR_P (c) && ! CHAR_BYTE8_P (c))
 		  some_multibyte = 1;
@@ -555,6 +561,8 @@ concat (ptrdiff_t nargs, Lisp_Object *args,
 		CHECK_CHARACTER (ch);
 		c = XFASTINT (ch);
 		this_len_byte = CHAR_BYTES (c);
+		if (STRING_BYTES_BOUND - result_len_byte < this_len_byte)
+		  string_overflow ();
 		result_len_byte += this_len_byte;
 		if (! ASCII_CHAR_P (c) && ! CHAR_BYTE8_P (c))
 		  some_multibyte = 1;
@@ -564,17 +572,20 @@ concat (ptrdiff_t nargs, Lisp_Object *args,
 	      if (STRING_MULTIBYTE (this))
 		{
 		  some_multibyte = 1;
-		  result_len_byte += SBYTES (this);
+		  this_len_byte = SBYTES (this);
 		}
 	      else
-		result_len_byte += count_size_as_multibyte (SDATA (this),
-							    SCHARS (this));
+		this_len_byte = count_size_as_multibyte (SDATA (this),
+							 SCHARS (this));
+	      if (STRING_BYTES_BOUND - result_len_byte < this_len_byte)
+		string_overflow ();
+	      result_len_byte += this_len_byte;
 	    }
 	}
 
       result_len += len;
-      if (STRING_BYTES_BOUND < result_len)
-	string_overflow ();
+      if (MOST_POSITIVE_FIXNUM < result_len)
+	memory_full (SIZE_MAX);
     }
 
   if (! some_multibyte)
@@ -607,9 +618,9 @@ concat (ptrdiff_t nargs, Lisp_Object *args,
   for (argnum = 0; argnum < nargs; argnum++)
     {
       Lisp_Object thislen;
-      EMACS_INT thisleni = 0;
-      register EMACS_INT thisindex = 0;
-      register EMACS_INT thisindex_byte = 0;
+      ptrdiff_t thisleni = 0;
+      register ptrdiff_t thisindex = 0;
+      register ptrdiff_t thisindex_byte = 0;
 
       this = args[argnum];
       if (!CONSP (this))
@@ -619,7 +630,7 @@ concat (ptrdiff_t nargs, Lisp_Object *args,
       if (STRINGP (this) && STRINGP (val)
 	  && STRING_MULTIBYTE (this) == some_multibyte)
 	{
-	  EMACS_INT thislen_byte = SBYTES (this);
+	  ptrdiff_t thislen_byte = SBYTES (this);
 
 	  memcpy (SDATA (val) + toindex_byte, SDATA (this), SBYTES (this));
 	  if (! NULL_INTERVAL_P (STRING_INTERVALS (this)))
@@ -720,7 +731,7 @@ concat (ptrdiff_t nargs, Lisp_Object *args,
   if (num_textprops > 0)
     {
       Lisp_Object props;
-      EMACS_INT last_to_end = -1;
+      ptrdiff_t last_to_end = -1;
 
       for (argnum = 0; argnum < num_textprops; argnum++)
 	{
@@ -744,8 +755,8 @@ concat (ptrdiff_t nargs, Lisp_Object *args,
 }
 
 static Lisp_Object string_char_byte_cache_string;
-static EMACS_INT string_char_byte_cache_charpos;
-static EMACS_INT string_char_byte_cache_bytepos;
+static ptrdiff_t string_char_byte_cache_charpos;
+static ptrdiff_t string_char_byte_cache_bytepos;
 
 void
 clear_string_char_byte_cache (void)
@@ -755,12 +766,12 @@ clear_string_char_byte_cache (void)
 
 /* Return the byte index corresponding to CHAR_INDEX in STRING.  */
 
-EMACS_INT
-string_char_to_byte (Lisp_Object string, EMACS_INT char_index)
+ptrdiff_t
+string_char_to_byte (Lisp_Object string, ptrdiff_t char_index)
 {
-  EMACS_INT i_byte;
-  EMACS_INT best_below, best_below_byte;
-  EMACS_INT best_above, best_above_byte;
+  ptrdiff_t i_byte;
+  ptrdiff_t best_below, best_below_byte;
+  ptrdiff_t best_above, best_above_byte;
 
   best_below = best_below_byte = 0;
   best_above = SCHARS (string);
@@ -815,12 +826,12 @@ string_char_to_byte (Lisp_Object string, EMACS_INT char_index)
 
 /* Return the character index corresponding to BYTE_INDEX in STRING.  */
 
-EMACS_INT
-string_byte_to_char (Lisp_Object string, EMACS_INT byte_index)
+ptrdiff_t
+string_byte_to_char (Lisp_Object string, ptrdiff_t byte_index)
 {
-  EMACS_INT i, i_byte;
-  EMACS_INT best_below, best_below_byte;
-  EMACS_INT best_above, best_above_byte;
+  ptrdiff_t i, i_byte;
+  ptrdiff_t best_below, best_below_byte;
+  ptrdiff_t best_above, best_above_byte;
 
   best_below = best_below_byte = 0;
   best_above = SCHARS (string);
@@ -883,7 +894,7 @@ static Lisp_Object
 string_make_multibyte (Lisp_Object string)
 {
   unsigned char *buf;
-  EMACS_INT nbytes;
+  ptrdiff_t nbytes;
   Lisp_Object ret;
   USE_SAFE_ALLOCA;
 
@@ -916,7 +927,7 @@ Lisp_Object
 string_to_multibyte (Lisp_Object string)
 {
   unsigned char *buf;
-  EMACS_INT nbytes;
+  ptrdiff_t nbytes;
   Lisp_Object ret;
   USE_SAFE_ALLOCA;
 
@@ -945,7 +956,7 @@ string_to_multibyte (Lisp_Object string)
 Lisp_Object
 string_make_unibyte (Lisp_Object string)
 {
-  EMACS_INT nchars;
+  ptrdiff_t nchars;
   unsigned char *buf;
   Lisp_Object ret;
   USE_SAFE_ALLOCA;
@@ -1010,7 +1021,7 @@ If STRING is multibyte and contains a character of charset
 
   if (STRING_MULTIBYTE (string))
     {
-      EMACS_INT bytes = SBYTES (string);
+      ptrdiff_t bytes = SBYTES (string);
       unsigned char *str = (unsigned char *) xmalloc (bytes);
 
       memcpy (str, SDATA (string), bytes);
@@ -1043,7 +1054,7 @@ If you're not sure, whether to use `string-as-multibyte' or
   if (! STRING_MULTIBYTE (string))
     {
       Lisp_Object new_string;
-      EMACS_INT nchars, nbytes;
+      ptrdiff_t nchars, nbytes;
 
       parse_str_as_multibyte (SDATA (string),
 			      SBYTES (string),
@@ -1092,9 +1103,9 @@ an error is signaled.  */)
 
   if (STRING_MULTIBYTE (string))
     {
-      EMACS_INT chars = SCHARS (string);
+      ptrdiff_t chars = SCHARS (string);
       unsigned char *str = (unsigned char *) xmalloc (chars);
-      EMACS_INT converted = str_to_unibyte (SDATA (string), str, chars, 0);
+      ptrdiff_t converted = str_to_unibyte (SDATA (string), str, chars, 0);
 
       if (converted < chars)
 	error ("Can't convert the %"pI"dth character to unibyte", converted);
@@ -1145,27 +1156,19 @@ value is a new vector that contains the elements between index FROM
   (Lisp_Object string, register Lisp_Object from, Lisp_Object to)
 {
   Lisp_Object res;
-  EMACS_INT size;
-  EMACS_INT size_byte = 0;
+  ptrdiff_t size;
   EMACS_INT from_char, to_char;
-  EMACS_INT from_byte = 0, to_byte = 0;
 
   CHECK_VECTOR_OR_STRING (string);
   CHECK_NUMBER (from);
 
   if (STRINGP (string))
-    {
-      size = SCHARS (string);
-      size_byte = SBYTES (string);
-    }
+    size = SCHARS (string);
   else
     size = ASIZE (string);
 
   if (NILP (to))
-    {
-      to_char = size;
-      to_byte = size_byte;
-    }
+    to_char = size;
   else
     {
       CHECK_NUMBER (to);
@@ -1173,23 +1176,19 @@ value is a new vector that contains the elements between index FROM
       to_char = XINT (to);
       if (to_char < 0)
 	to_char += size;
-
-      if (STRINGP (string))
-	to_byte = string_char_to_byte (string, to_char);
     }
 
   from_char = XINT (from);
   if (from_char < 0)
     from_char += size;
-  if (STRINGP (string))
-    from_byte = string_char_to_byte (string, from_char);
-
   if (!(0 <= from_char && from_char <= to_char && to_char <= size))
     args_out_of_range_3 (string, make_number (from_char),
 			 make_number (to_char));
-
   if (STRINGP (string))
     {
+      ptrdiff_t to_byte =
+	(NILP (to) ? SBYTES (string) : string_char_to_byte (string, to_char));
+      ptrdiff_t from_byte = string_char_to_byte (string, from_char);
       res = make_specified_string (SSDATA (string) + from_byte,
 				   to_char - from_char, to_byte - from_byte,
 				   STRING_MULTIBYTE (string));
@@ -1213,47 +1212,41 @@ If FROM or TO is negative, it counts from the end.
 With one argument, just copy STRING without its properties.  */)
   (Lisp_Object string, register Lisp_Object from, Lisp_Object to)
 {
-  EMACS_INT size, size_byte;
+  ptrdiff_t size;
   EMACS_INT from_char, to_char;
-  EMACS_INT from_byte, to_byte;
+  ptrdiff_t from_byte, to_byte;
 
   CHECK_STRING (string);
 
   size = SCHARS (string);
-  size_byte = SBYTES (string);
 
   if (NILP (from))
-    from_char = from_byte = 0;
+    from_char = 0;
   else
     {
       CHECK_NUMBER (from);
       from_char = XINT (from);
       if (from_char < 0)
 	from_char += size;
-
-      from_byte = string_char_to_byte (string, from_char);
     }
 
   if (NILP (to))
-    {
-      to_char = size;
-      to_byte = size_byte;
-    }
+    to_char = size;
   else
     {
       CHECK_NUMBER (to);
-
       to_char = XINT (to);
       if (to_char < 0)
 	to_char += size;
-
-      to_byte = string_char_to_byte (string, to_char);
     }
 
   if (!(0 <= from_char && from_char <= to_char && to_char <= size))
     args_out_of_range_3 (string, make_number (from_char),
 			 make_number (to_char));
 
+  from_byte = NILP (from) ? 0 : string_char_to_byte (string, from_char);
+  to_byte =
+    NILP (to) ? SBYTES (string) : string_char_to_byte (string, to_char);
   return make_specified_string (SSDATA (string) + from_byte,
 				to_char - from_char, to_byte - from_byte,
 				STRING_MULTIBYTE (string));
@@ -1263,11 +1256,11 @@ With one argument, just copy STRING without its properties.  */)
    both in characters and in bytes.  */
 
 Lisp_Object
-substring_both (Lisp_Object string, EMACS_INT from, EMACS_INT from_byte,
-		EMACS_INT to, EMACS_INT to_byte)
+substring_both (Lisp_Object string, ptrdiff_t from, ptrdiff_t from_byte,
+		ptrdiff_t to, ptrdiff_t to_byte)
 {
   Lisp_Object res;
-  EMACS_INT size;
+  ptrdiff_t size;
 
   CHECK_VECTOR_OR_STRING (string);
 
@@ -1601,7 +1594,7 @@ to be sure of changing the value of `foo'.  */)
 {
   if (VECTORP (seq))
     {
-      EMACS_INT i, n;
+      ptrdiff_t i, n;
 
       for (i = n = 0; i < ASIZE (seq); ++i)
 	if (NILP (Fequal (AREF (seq, i), elt)))
@@ -1620,7 +1613,7 @@ to be sure of changing the value of `foo'.  */)
     }
   else if (STRINGP (seq))
     {
-      EMACS_INT i, ibyte, nchars, nbytes, cbytes;
+      ptrdiff_t i, ibyte, nchars, nbytes, cbytes;
       int c;
 
       for (i = nchars = nbytes = ibyte = 0;
@@ -1672,7 +1665,7 @@ to be sure of changing the value of `foo'.  */)
 		{
 		  unsigned char *from = SDATA (seq) + ibyte;
 		  unsigned char *to   = SDATA (tem) + nbytes;
-		  EMACS_INT n;
+		  ptrdiff_t n;
 
 		  ++nchars;
 		  nbytes += cbytes;
@@ -2079,7 +2072,7 @@ internal_equal (register Lisp_Object o1, register Lisp_Object o2, int depth, int
     case Lisp_Vectorlike:
       {
 	register int i;
-	EMACS_INT size = ASIZE (o1);
+	ptrdiff_t size = ASIZE (o1);
 	/* Pseudovectors have the type encoded in the size field, so this test
 	   actually checks that the objects have the same type as well as the
 	   same size.  */
@@ -2146,7 +2139,7 @@ DEFUN ("fillarray", Ffillarray, Sfillarray, 2, 2, 0,
 ARRAY is a vector, string, char-table, or bool-vector.  */)
   (Lisp_Object array, Lisp_Object item)
 {
-  register EMACS_INT size, idx;
+  register ptrdiff_t size, idx;
 
   if (VECTORP (array))
     {
@@ -2174,7 +2167,7 @@ ARRAY is a vector, string, char-table, or bool-vector.  */)
 	{
 	  unsigned char str[MAX_MULTIBYTE_LENGTH];
 	  int len = CHAR_STRING (charval, str);
-	  EMACS_INT size_byte = SBYTES (array);
+	  ptrdiff_t size_byte = SBYTES (array);
 
 	  if (INT_MULTIPLY_OVERFLOW (SCHARS (array), len)
 	      || SCHARS (array) * len != size_byte)
@@ -2189,18 +2182,16 @@ ARRAY is a vector, string, char-table, or bool-vector.  */)
   else if (BOOL_VECTOR_P (array))
     {
       register unsigned char *p = XBOOL_VECTOR (array)->data;
-      EMACS_INT size_in_chars;
-      size = XBOOL_VECTOR (array)->size;
-      size_in_chars
-	= ((size + BOOL_VECTOR_BITS_PER_CHAR - 1)
-	   / BOOL_VECTOR_BITS_PER_CHAR);
+      size =
+	((XBOOL_VECTOR (array)->size + BOOL_VECTOR_BITS_PER_CHAR - 1)
+	 / BOOL_VECTOR_BITS_PER_CHAR);
 
-      if (size_in_chars)
+      if (size)
 	{
-	  memset (p, ! NILP (item) ? -1 : 0, size_in_chars);
+	  memset (p, ! NILP (item) ? -1 : 0, size);
 
 	  /* Clear any extraneous bits in the last byte.  */
-	  p[size_in_chars - 1] &= (1 << (size % BOOL_VECTOR_BITS_PER_CHAR)) - 1;
+	  p[size - 1] &= (1 << (size % BOOL_VECTOR_BITS_PER_CHAR)) - 1;
 	}
     }
   else
@@ -2214,7 +2205,7 @@ DEFUN ("clear-string", Fclear_string, Sclear_string,
 This makes STRING unibyte and may change its length.  */)
   (Lisp_Object string)
 {
-  EMACS_INT len;
+  ptrdiff_t len;
   CHECK_STRING (string);
   len = SBYTES (string);
   memset (SDATA (string), 0, len);
@@ -2324,12 +2315,12 @@ mapcar1 (EMACS_INT leni, Lisp_Object *vals, Lisp_Object fn, Lisp_Object seq)
     }
   else if (STRINGP (seq))
     {
-      EMACS_INT i_byte;
+      ptrdiff_t i_byte;
 
       for (i = 0, i_byte = 0; i < leni;)
 	{
 	  int c;
-	  EMACS_INT i_before = i;
+	  ptrdiff_t i_before = i;
 
 	  FETCH_STRING_CHAR_ADVANCE (c, seq, i, i_byte);
 	  XSETFASTINT (dummy, c);
@@ -2362,7 +2353,8 @@ SEQUENCE may be a list, a vector, a bool-vector, or a string.  */)
 {
   Lisp_Object len;
   register EMACS_INT leni;
-  ptrdiff_t i, nargs;
+  EMACS_INT nargs;
+  ptrdiff_t i;
   register Lisp_Object *args;
   struct gcpro gcpro1;
   Lisp_Object ret;
@@ -2649,7 +2641,7 @@ The normal messages at start and end of loading FILENAME are suppressed.  */)
 
   if (NILP (tem))
     {
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
       int nesting = 0;
 
       /* This is to make sure that loadup.el gives a clear picture
@@ -2952,9 +2944,9 @@ static const short base64_char_to_value[128] =
    base64 characters.  */
 
 
-static EMACS_INT base64_encode_1 (const char *, char *, EMACS_INT, int, int);
-static EMACS_INT base64_decode_1 (const char *, char *, EMACS_INT, int,
-				  EMACS_INT *);
+static ptrdiff_t base64_encode_1 (const char *, char *, ptrdiff_t, int, int);
+static ptrdiff_t base64_decode_1 (const char *, char *, ptrdiff_t, int,
+				  ptrdiff_t *);
 
 DEFUN ("base64-encode-region", Fbase64_encode_region, Sbase64_encode_region,
        2, 3, "r",
@@ -2965,9 +2957,9 @@ into shorter lines.  */)
   (Lisp_Object beg, Lisp_Object end, Lisp_Object no_line_break)
 {
   char *encoded;
-  EMACS_INT allength, length;
-  EMACS_INT ibeg, iend, encoded_length;
-  EMACS_INT old_pos = PT;
+  ptrdiff_t allength, length;
+  ptrdiff_t ibeg, iend, encoded_length;
+  ptrdiff_t old_pos = PT;
   USE_SAFE_ALLOCA;
 
   validate_region (&beg, &end);
@@ -3023,7 +3015,7 @@ Optional second argument NO-LINE-BREAK means do not break long lines
 into shorter lines.  */)
   (Lisp_Object string, Lisp_Object no_line_break)
 {
-  EMACS_INT allength, length, encoded_length;
+  ptrdiff_t allength, length, encoded_length;
   char *encoded;
   Lisp_Object encoded_string;
   USE_SAFE_ALLOCA;
@@ -3059,12 +3051,12 @@ into shorter lines.  */)
   return encoded_string;
 }
 
-static EMACS_INT
-base64_encode_1 (const char *from, char *to, EMACS_INT length,
+static ptrdiff_t
+base64_encode_1 (const char *from, char *to, ptrdiff_t length,
 		 int line_break, int multibyte)
 {
   int counter = 0;
-  EMACS_INT i = 0;
+  ptrdiff_t i = 0;
   char *e = to;
   int c;
   unsigned int value;
@@ -3163,11 +3155,11 @@ Return the length of the decoded text.
 If the region can't be decoded, signal an error and don't modify the buffer.  */)
   (Lisp_Object beg, Lisp_Object end)
 {
-  EMACS_INT ibeg, iend, length, allength;
+  ptrdiff_t ibeg, iend, length, allength;
   char *decoded;
-  EMACS_INT old_pos = PT;
-  EMACS_INT decoded_length;
-  EMACS_INT inserted_chars;
+  ptrdiff_t old_pos = PT;
+  ptrdiff_t decoded_length;
+  ptrdiff_t inserted_chars;
   int multibyte = !NILP (BVAR (current_buffer, enable_multibyte_characters));
   USE_SAFE_ALLOCA;
 
@@ -3225,7 +3217,7 @@ DEFUN ("base64-decode-string", Fbase64_decode_string, Sbase64_decode_string,
   (Lisp_Object string)
 {
   char *decoded;
-  EMACS_INT length, decoded_length;
+  ptrdiff_t length, decoded_length;
   Lisp_Object decoded_string;
   USE_SAFE_ALLOCA;
 
@@ -3257,15 +3249,15 @@ DEFUN ("base64-decode-string", Fbase64_decode_string, Sbase64_decode_string,
    form.  If NCHARS_RETRUN is not NULL, store the number of produced
    characters in *NCHARS_RETURN.  */
 
-static EMACS_INT
-base64_decode_1 (const char *from, char *to, EMACS_INT length,
-		 int multibyte, EMACS_INT *nchars_return)
+static ptrdiff_t
+base64_decode_1 (const char *from, char *to, ptrdiff_t length,
+		 int multibyte, ptrdiff_t *nchars_return)
 {
-  EMACS_INT i = 0;		/* Used inside READ_QUADRUPLET_BYTE */
+  ptrdiff_t i = 0;		/* Used inside READ_QUADRUPLET_BYTE */
   char *e = to;
   unsigned char c;
   unsigned long value;
-  EMACS_INT nchars = 0;
+  ptrdiff_t nchars = 0;
 
   while (1)
     {
@@ -3432,23 +3424,31 @@ get_key_arg (Lisp_Object key, ptrdiff_t nargs, Lisp_Object *args, char *used)
 
 
 /* Return a Lisp vector which has the same contents as VEC but has
-   size NEW_SIZE, NEW_SIZE >= VEC->size.  Entries in the resulting
-   vector that are not copied from VEC are set to INIT.  */
+   at least INCR_MIN more entries, where INCR_MIN is positive.
+   If NITEMS_MAX is not -1, do not grow the vector to be any larger
+   than NITEMS_MAX.  Entries in the resulting
+   vector that are not copied from VEC are set to nil.  */
 
 Lisp_Object
-larger_vector (Lisp_Object vec, EMACS_INT new_size, Lisp_Object init)
+larger_vector (Lisp_Object vec, ptrdiff_t incr_min, ptrdiff_t size_max)
 {
   struct Lisp_Vector *v;
-  EMACS_INT i, old_size;
-
+  ptrdiff_t i, incr, incr_max, old_size, new_size;
+  ptrdiff_t C_language_max = min (PTRDIFF_MAX, SIZE_MAX) / sizeof *v->contents;
+  ptrdiff_t n_max = (0 <= size_max && size_max < C_language_max
+		     ? size_max : C_language_max);
   xassert (VECTORP (vec));
+  xassert (0 < incr_min && -1 <= size_max);
   old_size = ASIZE (vec);
-  xassert (new_size >= old_size);
-
+  incr_max = n_max - old_size;
+  incr = max (incr_min, min (old_size >> 1, incr_max));
+  if (incr_max < incr)
+    memory_full (SIZE_MAX);
+  new_size = old_size + incr;
   v = allocate_vector (new_size);
   memcpy (v->contents, XVECTOR (vec)->contents, old_size * sizeof *v->contents);
   for (i = old_size; i < new_size; ++i)
-    v->contents[i] = init;
+    v->contents[i] = Qnil;
   XSETVECTOR (vec, v);
   return vec;
 }
@@ -3569,6 +3569,10 @@ hashfn_user_defined (struct Lisp_Hash_Table *h, Lisp_Object key)
   return XUINT (hash);
 }
 
+/* An upper bound on the size of a hash table index.  It must fit in
+   ptrdiff_t and be a valid Emacs fixnum.  */
+#define INDEX_SIZE_BOUND \
+  ((ptrdiff_t) min (MOST_POSITIVE_FIXNUM, PTRDIFF_MAX / sizeof (Lisp_Object)))
 
 /* Create and initialize a new hash table.
 
@@ -3599,7 +3603,8 @@ make_hash_table (Lisp_Object test, Lisp_Object size, Lisp_Object rehash_size,
 {
   struct Lisp_Hash_Table *h;
   Lisp_Object table;
-  EMACS_INT index_size, i, sz;
+  EMACS_INT index_size, sz;
+  ptrdiff_t i;
   double index_float;
 
   /* Preconditions.  */
@@ -3616,10 +3621,10 @@ make_hash_table (Lisp_Object test, Lisp_Object size, Lisp_Object rehash_size,
 
   sz = XFASTINT (size);
   index_float = sz / XFLOAT_DATA (rehash_threshold);
-  index_size = (index_float < MOST_POSITIVE_FIXNUM + 1
+  index_size = (index_float < INDEX_SIZE_BOUND + 1
 		? next_almost_prime (index_float)
-		: MOST_POSITIVE_FIXNUM + 1);
-  if (MOST_POSITIVE_FIXNUM < max (index_size, 2 * sz))
+		: INDEX_SIZE_BOUND + 1);
+  if (INDEX_SIZE_BOUND < max (index_size, 2 * sz))
     error ("Hash table too large");
 
   /* Allocate a table and initialize it.  */
@@ -3720,9 +3725,9 @@ maybe_resize_hash_table (struct Lisp_Hash_Table *h)
 {
   if (NILP (h->next_free))
     {
-      EMACS_INT old_size = HASH_TABLE_SIZE (h);
-      EMACS_INT i, new_size, index_size;
-      EMACS_INT nsize;
+      ptrdiff_t old_size = HASH_TABLE_SIZE (h);
+      EMACS_INT new_size, index_size, nsize;
+      ptrdiff_t i;
       double index_float;
 
       if (INTEGERP (h->rehash_size))
@@ -3730,26 +3735,27 @@ maybe_resize_hash_table (struct Lisp_Hash_Table *h)
       else
 	{
 	  double float_new_size = old_size * XFLOAT_DATA (h->rehash_size);
-	  if (float_new_size < MOST_POSITIVE_FIXNUM + 1)
+	  if (float_new_size < INDEX_SIZE_BOUND + 1)
 	    {
 	      new_size = float_new_size;
 	      if (new_size <= old_size)
 		new_size = old_size + 1;
 	    }
 	  else
-	    new_size = MOST_POSITIVE_FIXNUM + 1;
+	    new_size = INDEX_SIZE_BOUND + 1;
 	}
       index_float = new_size / XFLOAT_DATA (h->rehash_threshold);
-      index_size = (index_float < MOST_POSITIVE_FIXNUM + 1
+      index_size = (index_float < INDEX_SIZE_BOUND + 1
 		    ? next_almost_prime (index_float)
-		    : MOST_POSITIVE_FIXNUM + 1);
+		    : INDEX_SIZE_BOUND + 1);
       nsize = max (index_size, 2 * new_size);
-      if (nsize > MOST_POSITIVE_FIXNUM)
+      if (INDEX_SIZE_BOUND < nsize)
 	error ("Hash table too large to resize");
 
-      h->key_and_value = larger_vector (h->key_and_value, 2 * new_size, Qnil);
-      h->next = larger_vector (h->next, new_size, Qnil);
-      h->hash = larger_vector (h->hash, new_size, Qnil);
+      h->key_and_value = larger_vector (h->key_and_value,
+					2 * (new_size - old_size), -1);
+      h->next = larger_vector (h->next, new_size - old_size, -1);
+      h->hash = larger_vector (h->hash, new_size - old_size, -1);
       h->index = Fmake_vector (make_number (index_size), Qnil);
 
       /* Update the free list.  Do it so that new entries are added at
@@ -3777,7 +3783,7 @@ maybe_resize_hash_table (struct Lisp_Hash_Table *h)
 	if (!NILP (HASH_HASH (h, i)))
 	  {
 	    EMACS_UINT hash_code = XUINT (HASH_HASH (h, i));
-	    EMACS_INT start_of_bucket = hash_code % ASIZE (h->index);
+	    ptrdiff_t start_of_bucket = hash_code % ASIZE (h->index);
 	    HASH_NEXT (h, i) = HASH_INDEX (h, start_of_bucket);
 	    HASH_INDEX (h, start_of_bucket) = make_number (i);
 	  }
@@ -3806,7 +3812,7 @@ hash_lookup (struct Lisp_Hash_Table *h, Lisp_Object key, EMACS_UINT *hash)
   /* We need not gcpro idx since it's either an integer or nil.  */
   while (!NILP (idx))
     {
-      EMACS_INT i = XFASTINT (idx);
+      ptrdiff_t i = XFASTINT (idx);
       if (EQ (key, HASH_KEY (h, i))
 	  || (h->cmpfn
 	      && h->cmpfn (h, key, hash_code,
@@ -3858,7 +3864,7 @@ static void
 hash_remove_from_table (struct Lisp_Hash_Table *h, Lisp_Object key)
 {
   EMACS_UINT hash_code;
-  EMACS_INT start_of_bucket;
+  ptrdiff_t start_of_bucket;
   Lisp_Object idx, prev;
 
   hash_code = h->hashfn (h, key);
@@ -3869,7 +3875,7 @@ hash_remove_from_table (struct Lisp_Hash_Table *h, Lisp_Object key)
   /* We need not gcpro idx, prev since they're either integers or nil.  */
   while (!NILP (idx))
     {
-      EMACS_INT i = XFASTINT (idx);
+      ptrdiff_t i = XFASTINT (idx);
 
       if (EQ (key, HASH_KEY (h, i))
 	  || (h->cmpfn
@@ -3907,7 +3913,7 @@ hash_clear (struct Lisp_Hash_Table *h)
 {
   if (h->count > 0)
     {
-      EMACS_INT i, size = HASH_TABLE_SIZE (h);
+      ptrdiff_t i, size = HASH_TABLE_SIZE (h);
 
       for (i = 0; i < size; ++i)
 	{
@@ -3945,7 +3951,7 @@ init_weak_hash_tables (void)
 static int
 sweep_weak_table (struct Lisp_Hash_Table *h, int remove_entries_p)
 {
-  EMACS_INT bucket, n;
+  ptrdiff_t bucket, n;
   int marked;
 
   n = ASIZE (h->index) & ~ARRAY_MARK_FLAG;
@@ -3960,7 +3966,7 @@ sweep_weak_table (struct Lisp_Hash_Table *h, int remove_entries_p)
       prev = Qnil;
       for (idx = HASH_INDEX (h, bucket); !NILP (idx); idx = next)
 	{
-	  EMACS_INT i = XFASTINT (idx);
+	  ptrdiff_t i = XFASTINT (idx);
 	  int key_known_to_survive_p = survives_gc_p (HASH_KEY (h, i));
 	  int value_known_to_survive_p = survives_gc_p (HASH_VALUE (h, i));
 	  int remove_p;
@@ -4526,7 +4532,7 @@ FUNCTION is called with two arguments, KEY and VALUE.  */)
 {
   struct Lisp_Hash_Table *h = check_hash_table (table);
   Lisp_Object args[3];
-  EMACS_INT i;
+  ptrdiff_t i;
 
   for (i = 0; i < HASH_TABLE_SIZE (h); ++i)
     if (!NILP (HASH_HASH (h, i)))
@@ -4575,10 +4581,9 @@ static Lisp_Object
 secure_hash (Lisp_Object algorithm, Lisp_Object object, Lisp_Object start, Lisp_Object end, Lisp_Object coding_system, Lisp_Object noerror, Lisp_Object binary)
 {
   int i;
-  EMACS_INT size;
-  EMACS_INT size_byte = 0;
+  ptrdiff_t size;
   EMACS_INT start_char = 0, end_char = 0;
-  EMACS_INT start_byte = 0, end_byte = 0;
+  ptrdiff_t start_byte, end_byte;
   register EMACS_INT b, e;
   register struct buffer *bp;
   EMACS_INT temp;
@@ -4615,7 +4620,6 @@ secure_hash (Lisp_Object algorithm, Lisp_Object object, Lisp_Object start, Lisp_
 	object = code_convert_string (object, coding_system, Qnil, 1, 0, 1);
 
       size = SCHARS (object);
-      size_byte = SBYTES (object);
 
       if (!NILP (start))
 	{
@@ -4625,15 +4629,10 @@ secure_hash (Lisp_Object algorithm, Lisp_Object object, Lisp_Object start, Lisp_
 
 	  if (start_char < 0)
 	    start_char += size;
-
-	  start_byte = string_char_to_byte (object, start_char);
 	}
 
       if (NILP (end))
-	{
-	  end_char = size;
-	  end_byte = size_byte;
-	}
+	end_char = size;
       else
 	{
 	  CHECK_NUMBER (end);
@@ -4642,13 +4641,15 @@ secure_hash (Lisp_Object algorithm, Lisp_Object object, Lisp_Object start, Lisp_
 
 	  if (end_char < 0)
 	    end_char += size;
-
-	  end_byte = string_char_to_byte (object, end_char);
 	}
 
       if (!(0 <= start_char && start_char <= end_char && end_char <= size))
 	args_out_of_range_3 (object, make_number (start_char),
 			     make_number (end_char));
+
+      start_byte = NILP (start) ? 0 : string_char_to_byte (object, start_char);
+      end_byte =
+	NILP (end) ? SBYTES (object) : string_char_to_byte (object, end_char);
     }
   else
     {
@@ -4755,6 +4756,8 @@ secure_hash (Lisp_Object algorithm, Lisp_Object object, Lisp_Object start, Lisp_
 
       if (STRING_MULTIBYTE (object))
 	object = code_convert_string (object, coding_system, Qnil, 1, 0, 0);
+      start_byte = 0;
+      end_byte = SBYTES (object);
     }
 
   if (EQ (algorithm, Qmd5))
@@ -4795,7 +4798,7 @@ secure_hash (Lisp_Object algorithm, Lisp_Object object, Lisp_Object start, Lisp_
   digest = make_uninit_string (digest_size * 2);
 
   hash_func (SSDATA (object) + start_byte,
-	     SBYTES (object) - (size_byte - end_byte),
+	     end_byte - start_byte,
 	     SSDATA (digest));
 
   if (NILP (binary))
diff --git a/src/font.c b/src/font.c
index 1a4742ba959..30c39771fd6 100644
--- a/src/font.c
+++ b/src/font.c
@@ -238,7 +238,7 @@ font_intern_prop (const char *str, ptrdiff_t len, int force_symbol)
   ptrdiff_t i;
   Lisp_Object tem;
   Lisp_Object obarray;
-  EMACS_INT nbytes, nchars;
+  ptrdiff_t nbytes, nchars;
 
   if (len == 1 && *str == '*')
     return Qnil;
@@ -364,7 +364,7 @@ font_style_to_value (enum font_property_index prop, Lisp_Object val, int noerror
   else
     {
       int i, last_n;
-      int numeric = XINT (val);
+      EMACS_INT numeric = XINT (val);
 
       for (i = 0, last_n = -1; i < len; i++)
 	{
@@ -518,7 +518,7 @@ font_prop_validate_style (Lisp_Object style, Lisp_Object val)
 				   : FONT_WIDTH_INDEX);
   if (INTEGERP (val))
     {
-      int n = XINT (val);
+      EMACS_INT n = XINT (val);
       if (((n >> 4) & 0xF)
 	  >= ASIZE (AREF (font_style_table, prop - FONT_WEIGHT_INDEX)))
 	val = Qerror;
@@ -848,7 +848,7 @@ font_expand_wildcards (Lisp_Object *field, int n)
 
 	  if (INTEGERP (val))
 	    {
-	      int numeric = XINT (val);
+	      EMACS_INT numeric = XINT (val);
 
 	      if (i + 1 == n)
 		from = to = XLFD_ENCODING_INDEX,
@@ -1740,7 +1740,8 @@ static int
 check_gstring (Lisp_Object gstring)
 {
   Lisp_Object val;
-  int i, j;
+  ptrdiff_t i;
+  int j;
 
   CHECK_VECTOR (gstring);
   val = AREF (gstring, 0);
@@ -2433,7 +2434,7 @@ font_match_p (Lisp_Object spec, Lisp_Object font)
 		  /* All characters in the list must be supported.  */
 		  for (; CONSP (val2); val2 = XCDR (val2))
 		    {
-		      if (! NATNUMP (XCAR (val2)))
+		      if (! CHARACTERP (XCAR (val2)))
 			continue;
 		      if (font_encode_char (font, XFASTINT (XCAR (val2)))
 			  == FONT_INVALID_CODE)
@@ -2445,7 +2446,7 @@ font_match_p (Lisp_Object spec, Lisp_Object font)
 		  /* At most one character in the vector must be supported.  */
 		  for (i = 0; i < ASIZE (val2); i++)
 		    {
-		      if (! NATNUMP (AREF (val2, i)))
+		      if (! CHARACTERP (AREF (val2, i)))
 			continue;
 		      if (font_encode_char (font, XFASTINT (AREF (val2, i)))
 			  != FONT_INVALID_CODE)
@@ -3076,6 +3077,7 @@ font_find_for_lface (FRAME_PTR f, Lisp_Object *attrs, Lisp_Object spec, int c)
   Lisp_Object foundry[3], *family, registry[3], adstyle[3];
   int pixel_size;
   int i, j, k, l;
+  USE_SAFE_ALLOCA;
 
   registry[0] = AREF (spec, FONT_REGISTRY_INDEX);
   if (NILP (registry[0]))
@@ -3171,7 +3173,8 @@ font_find_for_lface (FRAME_PTR f, Lisp_Object *attrs, Lisp_Object spec, int c)
 
       if (! NILP (alters))
 	{
-	  family = alloca ((sizeof family[0]) * (XINT (Flength (alters)) + 2));
+	  EMACS_INT alterslen = XFASTINT (Flength (alters));
+	  SAFE_ALLOCA_LISP (family, alterslen + 2);
 	  for (i = 0; CONSP (alters); i++, alters = XCDR (alters))
 	    family[i] = XCAR (alters);
 	  if (NILP (AREF (spec, FONT_FAMILY_INDEX)))
@@ -3213,6 +3216,8 @@ font_find_for_lface (FRAME_PTR f, Lisp_Object *attrs, Lisp_Object spec, int c)
 	    }
 	}
     }
+
+  SAFE_FREE ();
   return Qnil;
 }
 
@@ -3611,7 +3616,7 @@ font_filter_properties (Lisp_Object font,
    STRING.  */
 
 static Lisp_Object
-font_at (int c, EMACS_INT pos, struct face *face, struct window *w,
+font_at (int c, ptrdiff_t pos, struct face *face, struct window *w,
 	 Lisp_Object string)
 {
   FRAME_PTR f;
@@ -3627,7 +3632,7 @@ font_at (int c, EMACS_INT pos, struct face *face, struct window *w,
 	{
 	  if (multibyte)
 	    {
-	      EMACS_INT pos_byte = CHAR_TO_BYTE (pos);
+	      ptrdiff_t pos_byte = CHAR_TO_BYTE (pos);
 
 	      c = FETCH_CHAR (pos_byte);
 	    }
@@ -3641,7 +3646,7 @@ font_at (int c, EMACS_INT pos, struct face *face, struct window *w,
 	  multibyte = STRING_MULTIBYTE (string);
 	  if (multibyte)
 	    {
-	      EMACS_INT pos_byte = string_char_to_byte (string, pos);
+	      ptrdiff_t pos_byte = string_char_to_byte (string, pos);
 
 	      str = SDATA (string) + pos_byte;
 	      c = STRING_CHAR (str);
@@ -3657,7 +3662,7 @@ font_at (int c, EMACS_INT pos, struct face *face, struct window *w,
   if (! face)
     {
       int face_id;
-      EMACS_INT endptr;
+      ptrdiff_t endptr;
 
       if (STRINGP (string))
 	face_id = face_at_string_position (w, string, pos, 0, -1, -1, &endptr,
@@ -3694,9 +3699,9 @@ font_at (int c, EMACS_INT pos, struct face *face, struct window *w,
    It is assured that the current buffer (or STRING) is multibyte.  */
 
 Lisp_Object
-font_range (EMACS_INT pos, EMACS_INT *limit, struct window *w, struct face *face, Lisp_Object string)
+font_range (ptrdiff_t pos, ptrdiff_t *limit, struct window *w, struct face *face, Lisp_Object string)
 {
-  EMACS_INT pos_byte, ignore;
+  ptrdiff_t pos_byte, ignore;
   int c;
   Lisp_Object font_object = Qnil;
 
@@ -4102,7 +4107,7 @@ how close they are to PREFER.  */)
   (Lisp_Object font_spec, Lisp_Object frame, Lisp_Object num, Lisp_Object prefer)
 {
   Lisp_Object vec, list;
-  int n = 0;
+  EMACS_INT n = 0;
 
   if (NILP (frame))
     frame = selected_frame;
@@ -4269,13 +4274,10 @@ void
 font_fill_lglyph_metrics (Lisp_Object glyph, Lisp_Object font_object)
 {
   struct font *font = XFONT_OBJECT (font_object);
-  unsigned code;
-  /* ecode used in LGLYPH_SET_CODE to avoid compiler warnings.  */
-  EMACS_INT ecode = font->driver->encode_char (font, LGLYPH_CHAR (glyph));
+  unsigned code = font->driver->encode_char (font, LGLYPH_CHAR (glyph));
   struct font_metrics metrics;
 
-  LGLYPH_SET_CODE (glyph, ecode);
-  code = ecode;
+  LGLYPH_SET_CODE (glyph, code);
   font->driver->text_extents (font, &code, 1, &metrics);
   LGLYPH_SET_LBEARING (glyph, metrics.lbearing);
   LGLYPH_SET_RBEARING (glyph, metrics.rbearing);
@@ -4297,7 +4299,7 @@ created glyph-string.  Otherwise, the value is nil.  */)
 {
   struct font *font;
   Lisp_Object font_object, n, glyph;
-  EMACS_INT i, j, from, to;
+  ptrdiff_t i, j, from, to;
 
   if (! composition_gstring_p (gstring))
     signal_error ("Invalid glyph-string: ", gstring);
@@ -4316,8 +4318,7 @@ created glyph-string.  Otherwise, the value is nil.  */)
       if (INTEGERP (n))
 	break;
       gstring = larger_vector (gstring,
-			       ASIZE (gstring) + LGSTRING_GLYPH_LEN (gstring),
-			       Qnil);
+			       LGSTRING_GLYPH_LEN (gstring), -1);
     }
   if (i == 3 || XINT (n) == 0)
     return Qnil;
@@ -4525,7 +4526,7 @@ DEFUN ("open-font", Fopen_font, Sopen_font, 1, 3, 0,
        doc: /* Open FONT-ENTITY.  */)
   (Lisp_Object font_entity, Lisp_Object size, Lisp_Object frame)
 {
-  int isize;
+  EMACS_INT isize;
 
   CHECK_FONT_ENTITY (font_entity);
   if (NILP (frame))
@@ -4541,6 +4542,8 @@ DEFUN ("open-font", Fopen_font, Sopen_font, 1, 3, 0,
 	isize = POINT_TO_PIXEL (XFLOAT_DATA (size), XFRAME (frame)->resy);
       else
 	isize = XINT (size);
+      if (! (INT_MIN <= isize && isize <= INT_MAX))
+	args_out_of_range (font_entity, size);
       if (isize == 0)
 	isize = 120;
     }
@@ -4644,14 +4647,14 @@ the corresponding element is nil.  */)
    Lisp_Object object)
 {
   struct font *font;
-  int i, len;
+  ptrdiff_t i, len;
   Lisp_Object *chars, vec;
   USE_SAFE_ALLOCA;
 
   CHECK_FONT_GET_OBJECT (font_object, font);
   if (NILP (object))
     {
-      EMACS_INT charpos, bytepos;
+      ptrdiff_t charpos, bytepos;
 
       validate_region (&from, &to);
       if (EQ (from, to))
@@ -4757,22 +4760,22 @@ the current buffer.  It defaults to the currently selected window.  */)
   (Lisp_Object position, Lisp_Object window, Lisp_Object string)
 {
   struct window *w;
-  EMACS_INT pos;
+  ptrdiff_t pos;
 
   if (NILP (string))
     {
       CHECK_NUMBER_COERCE_MARKER (position);
-      pos = XINT (position);
-      if (pos < BEGV || pos >= ZV)
+      if (! (BEGV <= XINT (position) && XINT (position) < ZV))
 	args_out_of_range_3 (position, make_number (BEGV), make_number (ZV));
+      pos = XINT (position);
     }
   else
     {
       CHECK_NUMBER (position);
       CHECK_STRING (string);
-      pos = XINT (position);
-      if (pos < 0 || pos >= SCHARS (string))
+      if (! (0 < XINT (position) && XINT (position) < SCHARS (string)))
 	args_out_of_range (string, position);
+      pos = XINT (position);
     }
   if (NILP (window))
     window = selected_window;
diff --git a/src/font.h b/src/font.h
index e50eaff9a1f..775c02b000f 100644
--- a/src/font.h
+++ b/src/font.h
@@ -793,7 +793,7 @@ extern int font_unparse_fcname (Lisp_Object font, int pixel_size,
 extern void register_font_driver (struct font_driver *driver, FRAME_PTR f);
 extern void free_font_driver_list (FRAME_PTR f);
 extern Lisp_Object font_update_drivers (FRAME_PTR f, Lisp_Object list);
-extern Lisp_Object font_range (EMACS_INT, EMACS_INT *,
+extern Lisp_Object font_range (ptrdiff_t, ptrdiff_t *,
 			       struct window *, struct face *,
 			       Lisp_Object);
 extern void font_fill_lglyph_metrics (Lisp_Object, Lisp_Object);
diff --git a/src/fontset.c b/src/fontset.c
index 74a25a1ca04..7730f2e4fa9 100644
--- a/src/fontset.c
+++ b/src/fontset.c
@@ -416,9 +416,11 @@ reorder_font_vector (Lisp_Object font_group, struct font *font)
 
 	      for (tail = Vcharset_ordered_list;
 		   ! EQ (tail, Vcharset_non_preferred_head) && CONSP (tail);
-		   score += 0x100, tail = XCDR (tail))
+		   tail = XCDR (tail))
 		if (EQ (encoding, XCAR (tail)))
 		  break;
+		else if (score <= MIN (INT_MAX, MOST_POSITIVE_FIXNUM) - 0x100)
+		  score += 0x100;
 	    }
 	  else
 	    {
@@ -787,7 +789,7 @@ make_fontset (Lisp_Object frame, Lisp_Object name, Lisp_Object base)
   while (!NILP (AREF (Vfontset_table, id))) id++;
 
   if (id + 1 == size)
-    Vfontset_table = larger_vector (Vfontset_table, size + 32, Qnil);
+    Vfontset_table = larger_vector (Vfontset_table, 1, -1);
 
   fontset = Fmake_char_table (Qfontset, Qnil);
 
@@ -1700,7 +1702,7 @@ FONT-SPEC is a vector, a cons, or a string.  See the documentation of
 static Lisp_Object auto_fontset_alist;
 
 /* Number of automatically created fontsets.  */
-static printmax_t num_auto_fontsets;
+static ptrdiff_t num_auto_fontsets;
 
 /* Retun a fontset synthesized from FONT-OBJECT.  This is called from
    x_new_font when FONT-OBJECT is used for the default ASCII font of a
@@ -1727,9 +1729,9 @@ fontset_from_font (Lisp_Object font_object)
     alias = intern ("fontset-startup");
   else
     {
-      char temp[sizeof "fontset-auto" + INT_STRLEN_BOUND (printmax_t)];
+      char temp[sizeof "fontset-auto" + INT_STRLEN_BOUND (ptrdiff_t)];
 
-      sprintf (temp, "fontset-auto%"pMd, num_auto_fontsets - 1);
+      sprintf (temp, "fontset-auto%"pD"d", num_auto_fontsets - 1);
       alias = intern (temp);
     }
   fontset_spec = copy_font_spec (font_spec);
@@ -1816,7 +1818,7 @@ DEFUN ("internal-char-font", Finternal_char_font, Sinternal_char_font, 1, 2, 0,
        doc: /* For internal use only.  */)
   (Lisp_Object position, Lisp_Object ch)
 {
-  EMACS_INT pos, pos_byte, dummy;
+  ptrdiff_t pos, pos_byte, dummy;
   int face_id;
   int c;
   struct frame *f;
@@ -1836,9 +1838,9 @@ DEFUN ("internal-char-font", Finternal_char_font, Sinternal_char_font, 1, 2, 0,
       struct window *w;
 
       CHECK_NUMBER_COERCE_MARKER (position);
-      pos = XINT (position);
-      if (pos < BEGV || pos >= ZV)
+      if (! (BEGV <= XINT (position) && XINT (position) < ZV))
 	args_out_of_range_3 (position, make_number (BEGV), make_number (ZV));
+      pos = XINT (position);
       pos_byte = CHAR_TO_BYTE (pos);
       if (NILP (ch))
 	c = FETCH_CHAR (pos_byte);
diff --git a/src/frame.c b/src/frame.c
index 112f102a1f2..1b29bd8f085 100644
--- a/src/frame.c
+++ b/src/frame.c
@@ -1605,8 +1605,8 @@ before calling this function on it, like this.
   (Lisp_Object frame, Lisp_Object x, Lisp_Object y)
 {
   CHECK_LIVE_FRAME (frame);
-  CHECK_NUMBER (x);
-  CHECK_NUMBER (y);
+  CHECK_TYPE_RANGED_INTEGER (int, x);
+  CHECK_TYPE_RANGED_INTEGER (int, y);
 
   /* I think this should be done with a hook.  */
 #ifdef HAVE_WINDOW_SYSTEM
@@ -1646,8 +1646,8 @@ before calling this function on it, like this.
   (Lisp_Object frame, Lisp_Object x, Lisp_Object y)
 {
   CHECK_LIVE_FRAME (frame);
-  CHECK_NUMBER (x);
-  CHECK_NUMBER (y);
+  CHECK_TYPE_RANGED_INTEGER (int, x);
+  CHECK_TYPE_RANGED_INTEGER (int, y);
 
   /* I think this should be done with a hook.  */
 #ifdef HAVE_WINDOW_SYSTEM
@@ -2039,7 +2039,7 @@ store_in_alist (Lisp_Object *alistptr, Lisp_Object prop, Lisp_Object val)
 }
 
 static int
-frame_name_fnn_p (char *str, EMACS_INT len)
+frame_name_fnn_p (char *str, ptrdiff_t len)
 {
   if (len > 1 && str[0] == 'F' && '0' <= str[1] && str[1] <= '9')
     {
@@ -2323,7 +2323,7 @@ If FRAME is nil, describe the currently selected frame.  */)
 	      if (STRINGP (value) && !FRAME_WINDOW_P (f))
 		{
 		  const char *color_name;
-		  EMACS_INT csz;
+		  ptrdiff_t csz;
 
 		  if (EQ (parameter, Qbackground_color))
 		    {
@@ -2399,12 +2399,13 @@ use is not recommended.  Explicitly check for a frame-parameter instead.  */)
 #endif
 
     {
-      int length = XINT (Flength (alist));
-      int i;
-      Lisp_Object *parms
-	= (Lisp_Object *) alloca (length * sizeof (Lisp_Object));
-      Lisp_Object *values
-	= (Lisp_Object *) alloca (length * sizeof (Lisp_Object));
+      EMACS_INT length = XFASTINT (Flength (alist));
+      ptrdiff_t i;
+      Lisp_Object *parms;
+      Lisp_Object *values;
+      USE_SAFE_ALLOCA;
+      SAFE_ALLOCA_LISP (parms, 2 * length);
+      values = parms + length;
 
       /* Extract parm names and values into those vectors.  */
 
@@ -2430,6 +2431,8 @@ use is not recommended.  Explicitly check for a frame-parameter instead.  */)
 	      || EQ (prop, Qbackground_color))
 	    update_face_from_frame_parameter (f, prop, val);
 	}
+
+      SAFE_FREE ();
     }
   return Qnil;
 }
@@ -2568,7 +2571,7 @@ but that the idea of the actual height of the frame should not be changed.  */)
 {
   register struct frame *f;
 
-  CHECK_NUMBER (lines);
+  CHECK_TYPE_RANGED_INTEGER (int, lines);
   if (NILP (frame))
     frame = selected_frame;
   CHECK_LIVE_FRAME (frame);
@@ -2595,7 +2598,7 @@ but that the idea of the actual width of the frame should not be changed.  */)
   (Lisp_Object frame, Lisp_Object cols, Lisp_Object pretend)
 {
   register struct frame *f;
-  CHECK_NUMBER (cols);
+  CHECK_TYPE_RANGED_INTEGER (int, cols);
   if (NILP (frame))
     frame = selected_frame;
   CHECK_LIVE_FRAME (frame);
@@ -2622,8 +2625,8 @@ DEFUN ("set-frame-size", Fset_frame_size, Sset_frame_size, 3, 3, 0,
   register struct frame *f;
 
   CHECK_LIVE_FRAME (frame);
-  CHECK_NUMBER (cols);
-  CHECK_NUMBER (rows);
+  CHECK_TYPE_RANGED_INTEGER (int, cols);
+  CHECK_TYPE_RANGED_INTEGER (int, rows);
   f = XFRAME (frame);
 
   /* I think this should be done with a hook.  */
@@ -2654,8 +2657,8 @@ the rightmost or bottommost possible position (that stays within the screen).  *
   register struct frame *f;
 
   CHECK_LIVE_FRAME (frame);
-  CHECK_NUMBER (xoffset);
-  CHECK_NUMBER (yoffset);
+  CHECK_TYPE_RANGED_INTEGER (int, xoffset);
+  CHECK_TYPE_RANGED_INTEGER (int, yoffset);
   f = XFRAME (frame);
 
   /* I think this should be done with a hook.  */
@@ -2874,12 +2877,12 @@ x_set_frame_parameters (FRAME_PTR f, Lisp_Object alist)
       prop = parms[i];
       val = values[i];
 
-      if (EQ (prop, Qwidth) && NATNUMP (val))
+      if (EQ (prop, Qwidth) && RANGED_INTEGERP (0, val, INT_MAX))
         {
           size_changed = 1;
           width = XFASTINT (val);
         }
-      else if (EQ (prop, Qheight) && NATNUMP (val))
+      else if (EQ (prop, Qheight) && RANGED_INTEGERP (0, val, INT_MAX))
         {
           size_changed = 1;
           height = XFASTINT (val);
@@ -2915,7 +2918,7 @@ x_set_frame_parameters (FRAME_PTR f, Lisp_Object alist)
     }
 
   /* Don't die if just one of these was set.  */
-  if (EQ (left, Qunbound))
+  if (! TYPE_RANGED_INTEGERP (int, left))
     {
       left_no_change = 1;
       if (f->left_pos < 0)
@@ -2923,7 +2926,7 @@ x_set_frame_parameters (FRAME_PTR f, Lisp_Object alist)
       else
 	XSETINT (left, f->left_pos);
     }
-  if (EQ (top, Qunbound))
+  if (! TYPE_RANGED_INTEGERP (int, top))
     {
       top_no_change = 1;
       if (f->top_pos < 0)
@@ -2933,14 +2936,14 @@ x_set_frame_parameters (FRAME_PTR f, Lisp_Object alist)
     }
 
   /* If one of the icon positions was not set, preserve or default it.  */
-  if (EQ (icon_left, Qunbound) || ! INTEGERP (icon_left))
+  if (! TYPE_RANGED_INTEGERP (int, icon_left))
     {
       icon_left_no_change = 1;
       icon_left = Fcdr (Fassq (Qicon_left, f->param_alist));
       if (NILP (icon_left))
 	XSETINT (icon_left, 0);
     }
-  if (EQ (icon_top, Qunbound) || ! INTEGERP (icon_top))
+  if (! TYPE_RANGED_INTEGERP (int, icon_top))
     {
       icon_top_no_change = 1;
       icon_top = Fcdr (Fassq (Qicon_top, f->param_alist));
@@ -3155,7 +3158,7 @@ x_set_line_spacing (struct frame *f, Lisp_Object new_value, Lisp_Object old_valu
 {
   if (NILP (new_value))
     f->extra_line_spacing = 0;
-  else if (NATNUMP (new_value))
+  else if (RANGED_INTEGERP (0, new_value, INT_MAX))
     f->extra_line_spacing = XFASTINT (new_value);
   else
     signal_error ("Invalid line-spacing", new_value);
@@ -3364,7 +3367,7 @@ x_set_fringe_width (struct frame *f, Lisp_Object new_value, Lisp_Object old_valu
 void
 x_set_border_width (struct frame *f, Lisp_Object arg, Lisp_Object oldval)
 {
-  CHECK_NUMBER (arg);
+  CHECK_TYPE_RANGED_INTEGER (int, arg);
 
   if (XINT (arg) == f->border_width)
     return;
@@ -3380,7 +3383,7 @@ x_set_internal_border_width (struct frame *f, Lisp_Object arg, Lisp_Object oldva
 {
   int old = FRAME_INTERNAL_BORDER_WIDTH (f);
 
-  CHECK_NUMBER (arg);
+  CHECK_TYPE_RANGED_INTEGER (int, arg);
   FRAME_INTERNAL_BORDER_WIDTH (f) = XINT (arg);
   if (FRAME_INTERNAL_BORDER_WIDTH (f) < 0)
     FRAME_INTERNAL_BORDER_WIDTH (f) = 0;
@@ -4117,7 +4120,7 @@ x_figure_window_size (struct frame *f, Lisp_Object parms, int toolbar_p)
 	f->top_pos = 0;
       else
 	{
-	  CHECK_NUMBER (tem0);
+	  CHECK_TYPE_RANGED_INTEGER (int, tem0);
 	  f->top_pos = XINT (tem0);
 	  if (f->top_pos < 0)
 	    window_prompting |= YNegative;
@@ -4145,7 +4148,7 @@ x_figure_window_size (struct frame *f, Lisp_Object parms, int toolbar_p)
 	f->left_pos = 0;
       else
 	{
-	  CHECK_NUMBER (tem1);
+	  CHECK_TYPE_RANGED_INTEGER (int, tem1);
 	  f->left_pos = XINT (tem1);
 	  if (f->left_pos < 0)
 	    window_prompting |= XNegative;
diff --git a/src/frame.h b/src/frame.h
index 3775403810f..3d2b8208ddd 100644
--- a/src/frame.h
+++ b/src/frame.h
@@ -322,7 +322,7 @@ struct frame
     struct x_output *x;         /* xterm.h */
     struct w32_output *w32;     /* w32term.h */
     struct ns_output *ns;       /* nsterm.h */
-    EMACS_INT nothing;
+    intptr_t nothing;
   }
   output_data;
 
diff --git a/src/fringe.c b/src/fringe.c
index 25fecca2334..727547b1ab7 100644
--- a/src/fringe.c
+++ b/src/fringe.c
@@ -474,7 +474,7 @@ int max_used_fringe_bitmap = MAX_STANDARD_FRINGE_BITMAPS;
 int
 lookup_fringe_bitmap (Lisp_Object bitmap)
 {
-  int bn;
+  EMACS_INT bn;
 
   bitmap = Fget (bitmap, Qfringe);
   if (!INTEGERP (bitmap))
@@ -696,7 +696,7 @@ static int
 get_logical_fringe_bitmap (struct window *w, Lisp_Object bitmap, int right_p, int partial_p)
 {
   Lisp_Object cmap, bm1 = Qnil, bm2 = Qnil, bm;
-  int ln1 = 0, ln2 = 0;
+  EMACS_INT ln1 = 0, ln2 = 0;
   int ix1 = right_p;
   int ix2 = ix1 + (partial_p ? 2 : 0);
 
@@ -1555,7 +1555,7 @@ If BITMAP already exists, the existing definition is replaced.  */)
   else
     {
       CHECK_NUMBER (height);
-      fb.height = min (XINT (height), 255);
+      fb.height = max (0, min (XINT (height), 255));
       if (fb.height > h)
 	{
 	  fill1 = (fb.height - h) / 2;
@@ -1568,7 +1568,7 @@ If BITMAP already exists, the existing definition is replaced.  */)
   else
     {
       CHECK_NUMBER (width);
-      fb.width = min (XINT (width), 255);
+      fb.width = max (0, min (XINT (width), 255));
     }
 
   fb.period = 0;
@@ -1704,7 +1704,7 @@ Return nil if POS is not visible in WINDOW.  */)
 {
   struct window *w;
   struct glyph_row *row;
-  int textpos;
+  ptrdiff_t textpos;
 
   if (NILP (window))
     window = selected_window;
@@ -1714,6 +1714,8 @@ Return nil if POS is not visible in WINDOW.  */)
   if (!NILP (pos))
     {
       CHECK_NUMBER_COERCE_MARKER (pos);
+      if (! (BEGV <= XINT (pos) && XINT (pos) <= ZV))
+	args_out_of_range (window, pos);
       textpos = XINT (pos);
     }
   else if (w == XWINDOW (selected_window))
diff --git a/src/ftfont.c b/src/ftfont.c
index 7858a31be21..5f8dbb4d455 100644
--- a/src/ftfont.c
+++ b/src/ftfont.c
@@ -1026,13 +1026,13 @@ ftfont_list (Lisp_Object frame, Lisp_Object spec)
 #endif	/* HAVE_LIBOTF */
       if (VECTORP (chars))
 	{
-	  int j;
+	  ptrdiff_t j;
 
 	  if (FcPatternGetCharSet (fontset->fonts[i], FC_CHARSET, 0, &charset)
 	      != FcResultMatch)
 	    continue;
 	  for (j = 0; j < ASIZE (chars); j++)
-	    if (NATNUMP (AREF (chars, j))
+	    if (TYPE_RANGED_INTEGERP (FcChar32, AREF (chars, j))
 		&& FcCharSetHasChar (charset, XFASTINT (AREF (chars, j))))
 	      break;
 	  if (j == ASIZE (chars))
@@ -2387,8 +2387,8 @@ static Lisp_Object
 ftfont_shape_by_flt (Lisp_Object lgstring, struct font *font,
 		     FT_Face ft_face, OTF *otf, FT_Matrix *matrix)
 {
-  EMACS_INT len = LGSTRING_GLYPH_LEN (lgstring);
-  EMACS_INT i;
+  ptrdiff_t len = LGSTRING_GLYPH_LEN (lgstring);
+  ptrdiff_t i;
   struct MFLTFontFT flt_font_ft;
   MFLT *flt = NULL;
   int with_variation_selector = 0;
@@ -2416,7 +2416,6 @@ ftfont_shape_by_flt (Lisp_Object lgstring, struct font *font,
     }
 
   len = i;
-  lint_assume (len <= TYPE_MAXIMUM (EMACS_INT) - 2);
 
   if (with_variation_selector)
     {
diff --git a/src/gnutls.c b/src/gnutls.c
index 0743ef3f4ee..f01a74dbf31 100644
--- a/src/gnutls.c
+++ b/src/gnutls.c
@@ -328,11 +328,11 @@ emacs_gnutls_transport_set_errno (gnutls_session_t state, int err)
   fn_gnutls_transport_set_errno (state, err);
 }
 
-EMACS_INT
-emacs_gnutls_write (struct Lisp_Process *proc, const char *buf, EMACS_INT nbyte)
+ptrdiff_t
+emacs_gnutls_write (struct Lisp_Process *proc, const char *buf, ptrdiff_t nbyte)
 {
   ssize_t rtnval = 0;
-  EMACS_INT bytes_written;
+  ptrdiff_t bytes_written;
   gnutls_session_t state = proc->gnutls_state;
 
   if (proc->gnutls_initstage != GNUTLS_STAGE_READY) {
@@ -368,8 +368,8 @@ emacs_gnutls_write (struct Lisp_Process *proc, const char *buf, EMACS_INT nbyte)
   return (bytes_written);
 }
 
-EMACS_INT
-emacs_gnutls_read (struct Lisp_Process *proc, char *buf, EMACS_INT nbyte)
+ptrdiff_t
+emacs_gnutls_read (struct Lisp_Process *proc, char *buf, ptrdiff_t nbyte)
 {
   ssize_t rtnval;
   gnutls_session_t state = proc->gnutls_state;
@@ -508,7 +508,7 @@ usage: (gnutls-error-fatalp ERROR)  */)
 	}
     }
 
-  if (!NUMBERP (err))
+  if (! TYPE_RANGED_INTEGERP (int, err))
     error ("Not an error symbol or code");
 
   if (0 == fn_gnutls_error_is_fatal (XINT (err)))
@@ -540,7 +540,7 @@ usage: (gnutls-error-string ERROR)  */)
 	}
     }
 
-  if (!NUMBERP (err))
+  if (! TYPE_RANGED_INTEGERP (int, err))
     return build_string ("Not an error symbol or code");
 
   return build_string (fn_gnutls_strerror (XINT (err)));
@@ -736,7 +736,7 @@ one trustfile (usually a CA bundle).  */)
   state = XPROCESS (proc)->gnutls_state;
   XPROCESS (proc)->gnutls_p = 1;
 
-  if (NUMBERP (loglevel))
+  if (TYPE_RANGED_INTEGERP (int, loglevel))
     {
       fn_gnutls_global_set_log_function (gnutls_log_function);
       fn_gnutls_global_set_log_level (XINT (loglevel));
diff --git a/src/gnutls.h b/src/gnutls.h
index e2a9bc9eaea..83eeb7247eb 100644
--- a/src/gnutls.h
+++ b/src/gnutls.h
@@ -53,10 +53,10 @@ typedef enum
 
 #define GNUTLS_LOG2(level, max, string, extra) if (level <= max) { gnutls_log_function2 (level, "(Emacs) " string, extra); }
 
-extern EMACS_INT
-emacs_gnutls_write (struct Lisp_Process *proc, const char *buf, EMACS_INT nbyte);
-extern EMACS_INT
-emacs_gnutls_read (struct Lisp_Process *proc, char *buf, EMACS_INT nbyte);
+extern ptrdiff_t
+emacs_gnutls_write (struct Lisp_Process *proc, const char *buf, ptrdiff_t nbyte);
+extern ptrdiff_t
+emacs_gnutls_read (struct Lisp_Process *proc, char *buf, ptrdiff_t nbyte);
 
 extern int emacs_gnutls_record_check_pending (gnutls_session_t state);
 extern void emacs_gnutls_transport_set_errno (gnutls_session_t state, int err);
diff --git a/src/gtkutil.c b/src/gtkutil.c
index 3cac8084dea..2712297a5b2 100644
--- a/src/gtkutil.c
+++ b/src/gtkutil.c
@@ -1620,7 +1620,7 @@ xg_maybe_add_timer (gpointer data)
 static int
 xg_dialog_run (FRAME_PTR f, GtkWidget *w)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct xg_dialog_data dd;
 
   xg_set_screen (w, f);
@@ -4273,7 +4273,6 @@ xg_make_tool_item (FRAME_PTR f,
          rather than the GtkButton specific signals "enter" and
          "leave", so we can have only one callback.  The event
          will tell us what kind of event it is.  */
-      /* The EMACS_INT cast avoids a warning. */
       g_signal_connect (G_OBJECT (weventbox),
                         "enter-notify-event",
                         G_CALLBACK (xg_tool_bar_help_callback),
@@ -4399,20 +4398,17 @@ update_frame_tool_bar (FRAME_PTR f)
 
   BLOCK_INPUT;
 
-  if (INTEGERP (Vtool_bar_button_margin)
-      && XINT (Vtool_bar_button_margin) > 0)
+  if (RANGED_INTEGERP (1, Vtool_bar_button_margin, INT_MAX))
     {
       hmargin = XFASTINT (Vtool_bar_button_margin);
       vmargin = XFASTINT (Vtool_bar_button_margin);
     }
   else if (CONSP (Vtool_bar_button_margin))
     {
-      if (INTEGERP (XCAR (Vtool_bar_button_margin))
-          && XINT (XCAR (Vtool_bar_button_margin)) > 0)
+      if (RANGED_INTEGERP (1, XCAR (Vtool_bar_button_margin), INT_MAX))
         hmargin = XFASTINT (XCAR (Vtool_bar_button_margin));
 
-      if (INTEGERP (XCDR (Vtool_bar_button_margin))
-          && XINT (XCDR (Vtool_bar_button_margin)) > 0)
+      if (RANGED_INTEGERP (1, XCDR (Vtool_bar_button_margin), INT_MAX))
         vmargin = XFASTINT (XCDR (Vtool_bar_button_margin));
     }
 
diff --git a/src/image.c b/src/image.c
index ef72745a72f..8eb51942675 100644
--- a/src/image.c
+++ b/src/image.c
@@ -771,10 +771,9 @@ parse_image_spec (Lisp_Object spec, struct image_keyword *keywords,
       /* Record that we recognized the keyword.  If a keywords
 	 was found more than once, it's an error.  */
       keywords[i].value = value;
-      ++keywords[i].count;
-
       if (keywords[i].count > 1)
 	return 0;
+      ++keywords[i].count;
 
       /* Check type of value against allowed type.  */
       switch (keywords[i].type)
@@ -1754,6 +1753,7 @@ lookup_image (struct frame *f, Lisp_Object spec)
 	     `:ascent ASCENT', `:margin MARGIN', `:relief RELIEF',
 	     `:background COLOR'.  */
 	  Lisp_Object ascent, margin, relief, bg;
+	  int relief_bound;
 
 	  ascent = image_spec_value (spec, QCascent, NULL);
 	  if (INTEGERP (ascent))
@@ -1771,7 +1771,8 @@ lookup_image (struct frame *f, Lisp_Object spec)
 	    }
 
 	  relief = image_spec_value (spec, QCrelief, NULL);
-	  if (INTEGERP (relief))
+	  relief_bound = INT_MAX - max (img->hmargin, img->vmargin);
+	  if (RANGED_INTEGERP (- relief_bound, relief, relief_bound))
 	    {
 	      img->relief = XINT (relief);
 	      img->hmargin += eabs (img->relief);
diff --git a/src/indent.c b/src/indent.c
index e00d2152577..96b6ea4fa18 100644
--- a/src/indent.c
+++ b/src/indent.c
@@ -45,23 +45,23 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
    Some things in set last_known_column_point to -1
    to mark the memorized value as invalid.  */
 
-static EMACS_INT last_known_column;
+static ptrdiff_t last_known_column;
 
 /* Value of point when current_column was called.  */
 
-EMACS_INT last_known_column_point;
+ptrdiff_t last_known_column_point;
 
 /* Value of MODIFF when current_column was called.  */
 
-static int last_known_column_modified;
+static EMACS_INT last_known_column_modified;
 
-static EMACS_INT current_column_1 (void);
-static EMACS_INT position_indentation (ptrdiff_t);
+static ptrdiff_t current_column_1 (void);
+static ptrdiff_t position_indentation (ptrdiff_t);
 
 /* Cache of beginning of line found by the last call of
    current_column. */
 
-static EMACS_INT current_column_bol_cache;
+static ptrdiff_t current_column_bol_cache;
 
 /* Get the display table to use for the current buffer.  */
 
@@ -204,12 +204,12 @@ width_run_cache_on_off (void)
    characters immediately following, then *NEXT_BOUNDARY_P
    will equal the return value.  */
 
-EMACS_INT
-skip_invisible (EMACS_INT pos, EMACS_INT *next_boundary_p, EMACS_INT to, Lisp_Object window)
+ptrdiff_t
+skip_invisible (ptrdiff_t pos, ptrdiff_t *next_boundary_p, ptrdiff_t to, Lisp_Object window)
 {
   Lisp_Object prop, position, overlay_limit, proplimit;
   Lisp_Object buffer, tmp;
-  EMACS_INT end;
+  ptrdiff_t end;
   int inv_p;
 
   XSETFASTINT (position, pos);
@@ -318,13 +318,13 @@ invalidate_current_column (void)
   last_known_column_point = 0;
 }
 
-EMACS_INT
+ptrdiff_t
 current_column (void)
 {
-  register EMACS_INT col;
+  register ptrdiff_t col;
   register unsigned char *ptr, *stop;
   register int tab_seen;
-  EMACS_INT post_tab;
+  ptrdiff_t post_tab;
   register int c;
   int tab_width = SANE_TAB_WIDTH (current_buffer);
   int ctl_arrow = !NILP (BVAR (current_buffer, ctl_arrow));
@@ -360,7 +360,7 @@ current_column (void)
 
   while (1)
     {
-      EMACS_INT i, n;
+      ptrdiff_t i, n;
       Lisp_Object charvec;
 
       if (ptr == stop)
@@ -400,8 +400,7 @@ current_column (void)
 		 next_element_from_display_vector does it.  */
 	      Lisp_Object entry = AREF (charvec, i);
 
-	      if (GLYPH_CODE_P (entry)
-		  && GLYPH_CODE_CHAR_VALID_P (entry))
+	      if (GLYPH_CODE_P (entry))
 		c = GLYPH_CODE_CHAR (entry);
 	      else
 		c = ' ';
@@ -464,7 +463,7 @@ current_column (void)
    in ENDPOS.
    Otherwise just return -1.  */
 static int
-check_display_width (EMACS_INT pos, EMACS_INT col, EMACS_INT *endpos)
+check_display_width (ptrdiff_t pos, ptrdiff_t col, ptrdiff_t *endpos)
 {
   Lisp_Object val, overlay;
 
@@ -474,19 +473,27 @@ check_display_width (EMACS_INT pos, EMACS_INT col, EMACS_INT *endpos)
     { /* FIXME: Use calc_pixel_width_or_height.  */
       Lisp_Object plist = XCDR (val), prop;
       int width = -1;
+      EMACS_INT align_to_max =
+	(col < MOST_POSITIVE_FIXNUM - INT_MAX
+	 ? (EMACS_INT) INT_MAX + col
+	 : MOST_POSITIVE_FIXNUM);
 
-      if ((prop = Fplist_get (plist, QCwidth), NATNUMP (prop)))
+      if ((prop = Fplist_get (plist, QCwidth),
+	   RANGED_INTEGERP (0, prop, INT_MAX)))
 	width = XINT (prop);
-      else if (FLOATP (prop))
+      else if (FLOATP (prop) && 0 <= XFLOAT_DATA (prop)
+	       && XFLOAT_DATA (prop) <= INT_MAX)
 	width = (int)(XFLOAT_DATA (prop) + 0.5);
-      else if ((prop = Fplist_get (plist, QCalign_to), NATNUMP (prop)))
+      else if ((prop = Fplist_get (plist, QCalign_to),
+		RANGED_INTEGERP (col, prop, align_to_max)))
 	width = XINT (prop) - col;
-      else if (FLOATP (prop))
+      else if (FLOATP (prop) && col <= XFLOAT_DATA (prop)
+	       && (XFLOAT_DATA (prop) <= align_to_max))
 	width = (int)(XFLOAT_DATA (prop) + 0.5) - col;
 
       if (width >= 0)
 	{
-	  EMACS_INT start;
+	  ptrdiff_t start;
 	  if (OVERLAYP (overlay))
 	    *endpos = OVERLAY_POSITION (OVERLAY_END (overlay));
 	  else
@@ -504,7 +511,7 @@ check_display_width (EMACS_INT pos, EMACS_INT col, EMACS_INT *endpos)
    PREVCOL gets set to the column of the previous position (it's always
    strictly smaller than the goal column).  */
 static void
-scan_for_column (EMACS_INT *endpos, EMACS_INT *goalcol, EMACS_INT *prevcol)
+scan_for_column (ptrdiff_t *endpos, EMACS_INT *goalcol, ptrdiff_t *prevcol)
 {
   int tab_width = SANE_TAB_WIDTH (current_buffer);
   register int ctl_arrow = !NILP (BVAR (current_buffer, ctl_arrow));
@@ -515,13 +522,13 @@ scan_for_column (EMACS_INT *endpos, EMACS_INT *goalcol, EMACS_INT *prevcol)
   struct window *w;
 
   /* Start the scan at the beginning of this line with column number 0.  */
-  register EMACS_INT col = 0, prev_col = 0;
+  register ptrdiff_t col = 0, prev_col = 0;
   EMACS_INT goal = goalcol ? *goalcol : MOST_POSITIVE_FIXNUM;
-  EMACS_INT end = endpos ? *endpos : PT;
-  EMACS_INT scan, scan_byte;
-  EMACS_INT next_boundary;
+  ptrdiff_t end = endpos ? *endpos : PT;
+  ptrdiff_t scan, scan_byte;
+  ptrdiff_t next_boundary;
   {
-  EMACS_INT opoint = PT, opoint_byte = PT_BYTE;
+  ptrdiff_t opoint = PT, opoint_byte = PT_BYTE;
   scan_newline (PT, PT_BYTE, BEGV, BEGV_BYTE, -1, 1);
   current_column_bol_cache = PT;
   scan = PT, scan_byte = PT_BYTE;
@@ -544,7 +551,7 @@ scan_for_column (EMACS_INT *endpos, EMACS_INT *goalcol, EMACS_INT *prevcol)
       /* Occasionally we may need to skip invisible text.  */
       while (scan == next_boundary)
 	{
-	  EMACS_INT old_scan = scan;
+	  ptrdiff_t old_scan = scan;
 	  /* This updates NEXT_BOUNDARY to the next place
 	     where we might need to skip more invisible text.  */
 	  scan = skip_invisible (scan, &next_boundary, end, Qnil);
@@ -562,7 +569,7 @@ scan_for_column (EMACS_INT *endpos, EMACS_INT *goalcol, EMACS_INT *prevcol)
       prev_col = col;
 
       { /* Check display property.  */
-	EMACS_INT endp;
+	ptrdiff_t endp;
 	int width = check_display_width (scan, col, &endp);
 	if (width >= 0)
 	  {
@@ -608,7 +615,7 @@ scan_for_column (EMACS_INT *endpos, EMACS_INT *goalcol, EMACS_INT *prevcol)
 	  && VECTORP (DISP_CHAR_VECTOR (dp, c)))
 	{
 	  Lisp_Object charvec;
-	  EMACS_INT i, n;
+	  ptrdiff_t i, n;
 
 	  /* This character is displayed using a vector of glyphs.
 	     Update the column/position based on those glyphs.  */
@@ -622,8 +629,7 @@ scan_for_column (EMACS_INT *endpos, EMACS_INT *goalcol, EMACS_INT *prevcol)
 		 next_element_from_display_vector does it.  */
 	      Lisp_Object entry = AREF (charvec, i);
 
-	      if (GLYPH_CODE_P (entry)
-		  && GLYPH_CODE_CHAR_VALID_P (entry))
+	      if (GLYPH_CODE_P (entry))
 		c = GLYPH_CODE_CHAR (entry);
 	      else
 		c = ' ';
@@ -698,11 +704,11 @@ scan_for_column (EMACS_INT *endpos, EMACS_INT *goalcol, EMACS_INT *prevcol)
    This function handles characters that are invisible
    due to text properties or overlays.  */
 
-static EMACS_INT
+static ptrdiff_t
 current_column_1 (void)
 {
   EMACS_INT col = MOST_POSITIVE_FIXNUM;
-  EMACS_INT opoint = PT;
+  ptrdiff_t opoint = PT;
 
   scan_for_column (&opoint, &col, NULL);
   return col;
@@ -798,7 +804,7 @@ The return value is COLUMN.  */)
   (Lisp_Object column, Lisp_Object minimum)
 {
   EMACS_INT mincol;
-  register EMACS_INT fromcol;
+  register ptrdiff_t fromcol;
   int tab_width = SANE_TAB_WIDTH (current_buffer);
 
   CHECK_NUMBER (column);
@@ -845,7 +851,7 @@ following any initial whitespace.  */)
   (void)
 {
   Lisp_Object val;
-  EMACS_INT opoint = PT, opoint_byte = PT_BYTE;
+  ptrdiff_t opoint = PT, opoint_byte = PT_BYTE;
 
   scan_newline (PT, PT_BYTE, BEGV, BEGV_BYTE, -1, 1);
 
@@ -854,16 +860,16 @@ following any initial whitespace.  */)
   return val;
 }
 
-static EMACS_INT
+static ptrdiff_t
 position_indentation (ptrdiff_t pos_byte)
 {
-  register EMACS_INT column = 0;
+  register ptrdiff_t column = 0;
   int tab_width = SANE_TAB_WIDTH (current_buffer);
   register unsigned char *p;
   register unsigned char *stop;
   unsigned char *start;
-  EMACS_INT next_boundary_byte = pos_byte;
-  EMACS_INT ceiling = next_boundary_byte;
+  ptrdiff_t next_boundary_byte = pos_byte;
+  ptrdiff_t ceiling = next_boundary_byte;
 
   p = BYTE_POS_ADDR (pos_byte);
   /* STOP records the value of P at which we will need
@@ -876,7 +882,7 @@ position_indentation (ptrdiff_t pos_byte)
     {
       while (p == stop)
 	{
-	  EMACS_INT stop_pos_byte;
+	  ptrdiff_t stop_pos_byte;
 
 	  /* If we have updated P, set POS_BYTE to match.
 	     The first time we enter the loop, POS_BYTE is already right.  */
@@ -887,8 +893,8 @@ position_indentation (ptrdiff_t pos_byte)
 	    return column;
 	  if (pos_byte == next_boundary_byte)
 	    {
-	      EMACS_INT next_boundary;
-	      EMACS_INT pos = BYTE_TO_CHAR (pos_byte);
+	      ptrdiff_t next_boundary;
+	      ptrdiff_t pos = BYTE_TO_CHAR (pos_byte);
 	      pos = skip_invisible (pos, &next_boundary, ZV, Qnil);
 	      pos_byte = CHAR_TO_BYTE (pos);
 	      next_boundary_byte = CHAR_TO_BYTE (next_boundary);
@@ -942,10 +948,10 @@ position_indentation (ptrdiff_t pos_byte)
    preceding line.  */
 
 int
-indented_beyond_p (EMACS_INT pos, EMACS_INT pos_byte, EMACS_INT column)
+indented_beyond_p (ptrdiff_t pos, ptrdiff_t pos_byte, EMACS_INT column)
 {
-  EMACS_INT val;
-  EMACS_INT opoint = PT, opoint_byte = PT_BYTE;
+  ptrdiff_t val;
+  ptrdiff_t opoint = PT, opoint_byte = PT_BYTE;
 
   SET_PT_BOTH (pos, pos_byte);
   while (PT > BEGV && FETCH_BYTE (PT_BYTE) == '\n')
@@ -976,8 +982,8 @@ COLUMN, add spaces/tabs to get there.
 The return value is the current column.  */)
   (Lisp_Object column, Lisp_Object force)
 {
-  EMACS_INT pos;
-  EMACS_INT col, prev_col;
+  ptrdiff_t pos, prev_col;
+  EMACS_INT col;
   EMACS_INT goal;
 
   CHECK_NATNUM (column);
@@ -994,13 +1000,13 @@ The return value is the current column.  */)
   if (!NILP (force) && col > goal)
     {
       int c;
-      EMACS_INT pos_byte = PT_BYTE;
+      ptrdiff_t pos_byte = PT_BYTE;
 
       DEC_POS (pos_byte);
       c = FETCH_CHAR (pos_byte);
       if (c == '\t' && prev_col < goal)
 	{
-	  EMACS_INT goal_pt, goal_pt_byte;
+	  ptrdiff_t goal_pt, goal_pt_byte;
 
 	  /* Insert spaces in front of the tab to reach GOAL.  Do this
 	     first so that a marker at the end of the tab gets
@@ -1099,13 +1105,13 @@ static struct position val_compute_motion;
    the scroll bars if they are turned on.  */
 
 struct position *
-compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_motion, EMACS_INT to, EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width, EMACS_INT hscroll, EMACS_INT tab_offset, struct window *win)
+compute_motion (ptrdiff_t from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_motion, ptrdiff_t to, EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width, ptrdiff_t hscroll, int tab_offset, struct window *win)
 {
   register EMACS_INT hpos = fromhpos;
   register EMACS_INT vpos = fromvpos;
 
-  register EMACS_INT pos;
-  EMACS_INT pos_byte;
+  register ptrdiff_t pos;
+  ptrdiff_t pos_byte;
   register int c = 0;
   int tab_width = SANE_TAB_WIDTH (current_buffer);
   register int ctl_arrow = !NILP (BVAR (current_buffer, ctl_arrow));
@@ -1114,38 +1120,38 @@ compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_
     = (INTEGERP (BVAR (current_buffer, selective_display))
        ? XINT (BVAR (current_buffer, selective_display))
        : !NILP (BVAR (current_buffer, selective_display)) ? -1 : 0);
-  int selective_rlen
+  ptrdiff_t selective_rlen
     = (selective && dp && VECTORP (DISP_INVIS_VECTOR (dp))
        ? ASIZE (DISP_INVIS_VECTOR (dp)) : 0);
   /* The next location where the `invisible' property changes, or an
      overlay starts or ends.  */
-  EMACS_INT next_boundary = from;
+  ptrdiff_t next_boundary = from;
 
   /* For computing runs of characters with similar widths.
      Invariant: width_run_width is zero, or all the characters
      from width_run_start to width_run_end have a fixed width of
      width_run_width.  */
-  EMACS_INT width_run_start = from;
-  EMACS_INT width_run_end   = from;
-  EMACS_INT width_run_width = 0;
+  ptrdiff_t width_run_start = from;
+  ptrdiff_t width_run_end   = from;
+  ptrdiff_t width_run_width = 0;
   Lisp_Object *width_table;
   Lisp_Object buffer;
 
   /* The next buffer pos where we should consult the width run cache. */
-  EMACS_INT next_width_run = from;
+  ptrdiff_t next_width_run = from;
   Lisp_Object window;
 
   int multibyte = !NILP (BVAR (current_buffer, enable_multibyte_characters));
   /* If previous char scanned was a wide character,
      this is the column where it ended.  Otherwise, this is 0.  */
   EMACS_INT wide_column_end_hpos = 0;
-  EMACS_INT prev_pos;		/* Previous buffer position.  */
-  EMACS_INT prev_pos_byte;	/* Previous buffer position.  */
+  ptrdiff_t prev_pos;		/* Previous buffer position.  */
+  ptrdiff_t prev_pos_byte;	/* Previous buffer position.  */
   EMACS_INT prev_hpos = 0;
   EMACS_INT prev_vpos = 0;
   EMACS_INT contin_hpos;	/* HPOS of last column of continued line.  */
-  EMACS_INT prev_tab_offset;	/* Previous tab offset.  */
-  EMACS_INT continuation_glyph_width;
+  int prev_tab_offset;		/* Previous tab offset.  */
+  int continuation_glyph_width;
 
   struct composition_it cmp_it;
 
@@ -1194,8 +1200,8 @@ compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_
     {
       while (pos == next_boundary)
 	{
-	  EMACS_INT pos_here = pos;
-	  EMACS_INT newpos;
+	  ptrdiff_t pos_here = pos;
+	  ptrdiff_t newpos;
 
 	  /* Don't skip invisible if we are already at the margin.  */
 	  if (vpos > tovpos || (vpos == tovpos && hpos >= tohpos))
@@ -1229,7 +1235,7 @@ compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_
 	       to be changed here.  */
 	    {
 	      unsigned char *ovstr;
-	      EMACS_INT ovlen = overlay_strings (pos, win, &ovstr);
+	      ptrdiff_t ovlen = overlay_strings (pos, win, &ovstr);
 	      hpos += ((multibyte && ovlen > 0)
 		       ? strwidth ((char *) ovstr, ovlen) : ovlen);
 	    }
@@ -1304,7 +1310,7 @@ compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_
 
       if (hpos > width)
 	{
-	  int total_width = width + continuation_glyph_width;
+	  EMACS_INT total_width = width + continuation_glyph_width;
 	  int truncate = 0;
 
 	  if (!NILP (Vtruncate_partial_width_windows)
@@ -1434,7 +1440,7 @@ compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_
              want to skip over it for some other reason.  */
           if (common_width != 0)
             {
-              EMACS_INT run_end_hpos;
+              ptrdiff_t run_end_hpos;
 
               /* Don't go past the final buffer posn the user
                  requested.  */
@@ -1474,7 +1480,7 @@ compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_
       /* We have to scan the text character-by-character.  */
       else
 	{
-	  EMACS_INT i, n;
+	  ptrdiff_t i, n;
 	  Lisp_Object charvec;
 
 	  /* Check composition sequence.  */
@@ -1551,8 +1557,7 @@ compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_
 		     next_element_from_display_vector does it.  */
 		  Lisp_Object entry = AREF (charvec, i);
 
-		  if (GLYPH_CODE_P (entry)
-		      && GLYPH_CODE_CHAR_VALID_P (entry))
+		  if (GLYPH_CODE_P (entry))
 		    c = GLYPH_CODE_CHAR (entry);
 		  else
 		    c = ' ';
@@ -1675,8 +1680,6 @@ compute_motion (EMACS_INT from, EMACS_INT fromvpos, EMACS_INT fromhpos, int did_
     val_compute_motion.prevhpos = contin_hpos;
   else
     val_compute_motion.prevhpos = prev_hpos;
-  /* We alalways handle all of them here; none of them remain to do.  */
-  val_compute_motion.ovstring_chars_done = 0;
 
   /* Nonzero if have just continued a line */
   val_compute_motion.contin = (contin_hpos && prev_hpos == 0);
@@ -1733,7 +1736,8 @@ visible section of the buffer, and pass LINE and COL as TOPOS.  */)
   struct window *w;
   Lisp_Object bufpos, hpos, vpos, prevhpos;
   struct position *pos;
-  EMACS_INT hscroll, tab_offset;
+  ptrdiff_t hscroll;
+  int tab_offset;
 
   CHECK_NUMBER_COERCE_MARKER (from);
   CHECK_CONS (frompos);
@@ -1754,6 +1758,9 @@ visible section of the buffer, and pass LINE and COL as TOPOS.  */)
       CHECK_CONS (offsets);
       CHECK_NUMBER_CAR (offsets);
       CHECK_NUMBER_CDR (offsets);
+      if (! (0 <= XINT (XCAR (offsets)) && XINT (XCAR (offsets)) <= PTRDIFF_MAX
+	     && 0 <= XINT (XCDR (offsets)) && XINT (XCDR (offsets)) <= INT_MAX))
+	args_out_of_range (XCAR (offsets), XCDR (offsets));
       hscroll = XINT (XCAR (offsets));
       tab_offset = XINT (XCDR (offsets));
     }
@@ -1807,22 +1814,22 @@ visible section of the buffer, and pass LINE and COL as TOPOS.  */)
 static struct position val_vmotion;
 
 struct position *
-vmotion (register EMACS_INT from, register EMACS_INT vtarget, struct window *w)
+vmotion (register ptrdiff_t from, register EMACS_INT vtarget, struct window *w)
 {
-  EMACS_INT hscroll = XINT (w->hscroll);
+  ptrdiff_t hscroll = XINT (w->hscroll);
   struct position pos;
   /* vpos is cumulative vertical position, changed as from is changed */
-  register int vpos = 0;
-  EMACS_INT prevline;
-  register EMACS_INT first;
-  EMACS_INT from_byte;
-  EMACS_INT lmargin = hscroll > 0 ? 1 - hscroll : 0;
-  EMACS_INT selective
+  register EMACS_INT vpos = 0;
+  ptrdiff_t prevline;
+  register ptrdiff_t first;
+  ptrdiff_t from_byte;
+  ptrdiff_t lmargin = hscroll > 0 ? 1 - hscroll : 0;
+  ptrdiff_t selective
     = (INTEGERP (BVAR (current_buffer, selective_display))
-       ? XINT (BVAR (current_buffer, selective_display))
+       ? clip_to_bounds (-1, XINT (BVAR (current_buffer, selective_display)),
+			 PTRDIFF_MAX)
        : !NILP (BVAR (current_buffer, selective_display)) ? -1 : 0);
   Lisp_Object window;
-  EMACS_INT start_hpos = 0;
   int did_motion;
   /* This is the object we use for fetching character properties.  */
   Lisp_Object text_prop_object;
@@ -1861,7 +1868,7 @@ vmotion (register EMACS_INT from, register EMACS_INT vtarget, struct window *w)
 			 TEXT_PROP_MEANS_INVISIBLE (propval))))
 	    prevline = find_next_newline_no_quit (prevline - 1, -1);
 	  pos = *compute_motion (prevline, 0,
-				 lmargin + (prevline == BEG ? start_hpos : 0),
+				 lmargin,
 				 0,
 				 from,
 				 /* Don't care for VPOS...  */
@@ -1869,10 +1876,7 @@ vmotion (register EMACS_INT from, register EMACS_INT vtarget, struct window *w)
 				 /* ... nor HPOS.  */
 				 1 << (BITS_PER_SHORT - 1),
 				 -1, hscroll,
-				 /* This compensates for start_hpos
-				    so that a tab as first character
-				    still occupies 8 columns.  */
-				 (prevline == BEG ? -start_hpos : 0),
+				 0,
 				 w);
 	  vpos -= pos.vpos;
 	  first = 0;
@@ -1890,8 +1894,6 @@ vmotion (register EMACS_INT from, register EMACS_INT vtarget, struct window *w)
 	  val_vmotion.hpos = lmargin;
 	  val_vmotion.contin = 0;
 	  val_vmotion.prevhpos = 0;
-	  val_vmotion.ovstring_chars_done = 0;
-	  val_vmotion.tab_offset = 0; /* For accumulating tab offset.  */
 	  return &val_vmotion;
 	}
 
@@ -1918,8 +1920,7 @@ vmotion (register EMACS_INT from, register EMACS_INT vtarget, struct window *w)
 		     TEXT_PROP_MEANS_INVISIBLE (propval))))
 	prevline = find_next_newline_no_quit (prevline - 1, -1);
       pos = *compute_motion (prevline, 0,
-			     lmargin + (prevline == BEG
-					? start_hpos : 0),
+			     lmargin,
 			     0,
 			     from,
 			     /* Don't care for VPOS...  */
@@ -1927,21 +1928,20 @@ vmotion (register EMACS_INT from, register EMACS_INT vtarget, struct window *w)
 			     /* ... nor HPOS.  */
 			     1 << (BITS_PER_SHORT - 1),
 			     -1, hscroll,
-			     (prevline == BEG ? -start_hpos : 0),
+			     0,
 			     w);
       did_motion = 1;
     }
   else
     {
-      pos.hpos = lmargin + (from == BEG ? start_hpos : 0);
+      pos.hpos = lmargin;
       pos.vpos = 0;
-      pos.tab_offset = 0;
       did_motion = 0;
     }
   return compute_motion (from, vpos, pos.hpos, did_motion,
 			 ZV, vtarget, - (1 << (BITS_PER_SHORT - 1)),
 			 -1, hscroll,
-			 pos.tab_offset - (from == BEG ? start_hpos : 0),
+			 0,
 			 w);
 }
 
@@ -2018,7 +2018,7 @@ whether or not it is currently displayed in some window.  */)
     }
   else
     {
-      EMACS_INT it_start;
+      ptrdiff_t it_start;
       int first_x, it_overshoot_expected IF_LINT (= 0);
 
       itdata = bidi_shelve_cache ();
diff --git a/src/indent.h b/src/indent.h
index 07ca4dd87a5..4731bf0994b 100644
--- a/src/indent.h
+++ b/src/indent.h
@@ -16,51 +16,29 @@ GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 
-/* We introduce new member `tab_offset'.  We need it because of the
-   existence of wide-column characters.  There is a case that the
-   line-break occurs at a wide-column character and the number of
-   colums of the line gets less than width.
-
-   Example (where W_ stands for a wide-column character):
-	     ----------
-	     abcdefgh\\
-	     W_
-	     ----------
-
-   To handle this case, we should not calculate the tab offset by
-  	tab_offset += width;
-
-   Instead, we must remember tab_offset of the line.
-
- */
-
 struct position
   {
-    EMACS_INT bufpos;
-    EMACS_INT bytepos;
+    ptrdiff_t bufpos;
+    ptrdiff_t bytepos;
     EMACS_INT hpos;
     EMACS_INT vpos;
     EMACS_INT prevhpos;
-    EMACS_INT contin;
-    /* Number of characters we have already handled
-       from the before and after strings at this position.  */
-    EMACS_INT ovstring_chars_done;
-    EMACS_INT tab_offset;
+    int contin;
   };
 
-struct position *compute_motion (EMACS_INT from, EMACS_INT fromvpos,
-                                 EMACS_INT fromhpos, int did_motion,
-                                 EMACS_INT to, EMACS_INT tovpos,
-                                 EMACS_INT tohpos,
-                                 EMACS_INT width, EMACS_INT hscroll,
-                                 EMACS_INT tab_offset, struct window *);
-struct position *vmotion (EMACS_INT from, EMACS_INT vtarget,
+struct position *compute_motion (ptrdiff_t from, ptrdiff_t fromvpos,
+                                 ptrdiff_t fromhpos, int did_motion,
+                                 ptrdiff_t to, ptrdiff_t tovpos,
+                                 ptrdiff_t tohpos,
+                                 ptrdiff_t width, ptrdiff_t hscroll,
+                                 int tab_offset, struct window *);
+struct position *vmotion (ptrdiff_t from, ptrdiff_t vtarget,
                           struct window *);
-EMACS_INT skip_invisible (EMACS_INT pos, EMACS_INT *next_boundary_p,
-                          EMACS_INT to, Lisp_Object window);
+ptrdiff_t skip_invisible (ptrdiff_t pos, ptrdiff_t *next_boundary_p,
+                          ptrdiff_t to, Lisp_Object window);
 
 /* Value of point when current_column was called */
-extern EMACS_INT last_known_column_point;
+extern ptrdiff_t last_known_column_point;
 
 /* Functions for dealing with the column cache.  */
 
@@ -73,5 +51,3 @@ int disptab_matches_widthtab (struct Lisp_Char_Table *disptab,
 /* Recompute BUF's width table, using the display table DISPTAB.  */
 void recompute_width_table (struct buffer *buf,
                             struct Lisp_Char_Table *disptab);
-
-
diff --git a/src/insdel.c b/src/insdel.c
index 01e5c57b2b0..0a9777ad95e 100644
--- a/src/insdel.c
+++ b/src/insdel.c
@@ -36,14 +36,14 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #endif
 
 static void insert_from_string_1 (Lisp_Object string,
-				  EMACS_INT pos, EMACS_INT pos_byte,
-				  EMACS_INT nchars, EMACS_INT nbytes,
+				  ptrdiff_t pos, ptrdiff_t pos_byte,
+				  ptrdiff_t nchars, ptrdiff_t nbytes,
 				  int inherit, int before_markers);
 static void insert_from_buffer_1 (struct buffer *buf,
-				  EMACS_INT from, EMACS_INT nchars,
+				  ptrdiff_t from, ptrdiff_t nchars,
 				  int inherit);
-static void gap_left (EMACS_INT charpos, EMACS_INT bytepos, int newgap);
-static void gap_right (EMACS_INT charpos, EMACS_INT bytepos);
+static void gap_left (ptrdiff_t charpos, ptrdiff_t bytepos, int newgap);
+static void gap_right (ptrdiff_t charpos, ptrdiff_t bytepos);
 
 static Lisp_Object Fcombine_after_change_execute (void);
 
@@ -64,7 +64,7 @@ static Lisp_Object combine_after_change_buffer;
 
 Lisp_Object Qinhibit_modification_hooks;
 
-static void signal_before_change (EMACS_INT, EMACS_INT, EMACS_INT *);
+static void signal_before_change (ptrdiff_t, ptrdiff_t, ptrdiff_t *);
 
 #define CHECK_MARKERS()				\
   do						\
@@ -97,7 +97,7 @@ check_markers (void)
    Note that this can quit!  */
 
 void
-move_gap (EMACS_INT charpos)
+move_gap (ptrdiff_t charpos)
 {
   move_gap_both (charpos, charpos_to_bytepos (charpos));
 }
@@ -106,7 +106,7 @@ move_gap (EMACS_INT charpos)
    Note that this can quit!  */
 
 void
-move_gap_both (EMACS_INT charpos, EMACS_INT bytepos)
+move_gap_both (ptrdiff_t charpos, ptrdiff_t bytepos)
 {
   if (bytepos < GPT_BYTE)
     gap_left (charpos, bytepos, 0);
@@ -120,11 +120,11 @@ move_gap_both (EMACS_INT charpos, EMACS_INT bytepos)
    If NEWGAP is nonzero, then don't update beg_unchanged and end_unchanged.  */
 
 static void
-gap_left (EMACS_INT charpos, EMACS_INT bytepos, int newgap)
+gap_left (ptrdiff_t charpos, ptrdiff_t bytepos, int newgap)
 {
   register unsigned char *to, *from;
-  register EMACS_INT i;
-  EMACS_INT new_s1;
+  register ptrdiff_t i;
+  ptrdiff_t new_s1;
 
   if (!newgap)
     BUF_COMPUTE_UNCHANGED (current_buffer, charpos, GPT);
@@ -175,11 +175,11 @@ gap_left (EMACS_INT charpos, EMACS_INT bytepos, int newgap)
    and CHARPOS is the corresponding char position.  */
 
 static void
-gap_right (EMACS_INT charpos, EMACS_INT bytepos)
+gap_right (ptrdiff_t charpos, ptrdiff_t bytepos)
 {
   register unsigned char *to, *from;
-  register EMACS_INT i;
-  EMACS_INT new_s1;
+  register ptrdiff_t i;
+  ptrdiff_t new_s1;
 
   BUF_COMPUTE_UNCHANGED (current_buffer, charpos, GPT);
 
@@ -229,12 +229,12 @@ gap_right (EMACS_INT charpos, EMACS_INT bytepos)
    or inside of the range being deleted.  */
 
 void
-adjust_markers_for_delete (EMACS_INT from, EMACS_INT from_byte,
-			   EMACS_INT to, EMACS_INT to_byte)
+adjust_markers_for_delete (ptrdiff_t from, ptrdiff_t from_byte,
+			   ptrdiff_t to, ptrdiff_t to_byte)
 {
   Lisp_Object marker;
   register struct Lisp_Marker *m;
-  register EMACS_INT charpos;
+  register ptrdiff_t charpos;
 
   for (m = BUF_MARKERS (current_buffer); m; m = m->next)
     {
@@ -294,13 +294,13 @@ adjust_markers_for_delete (EMACS_INT from, EMACS_INT from_byte,
    or BEFORE_MARKERS is true.  */
 
 static void
-adjust_markers_for_insert (EMACS_INT from, EMACS_INT from_byte,
-			   EMACS_INT to, EMACS_INT to_byte, int before_markers)
+adjust_markers_for_insert (ptrdiff_t from, ptrdiff_t from_byte,
+			   ptrdiff_t to, ptrdiff_t to_byte, int before_markers)
 {
   struct Lisp_Marker *m;
   int adjusted = 0;
-  EMACS_INT nchars = to - from;
-  EMACS_INT nbytes = to_byte - from_byte;
+  ptrdiff_t nchars = to - from;
+  ptrdiff_t nbytes = to_byte - from_byte;
 
   for (m = BUF_MARKERS (current_buffer); m; m = m->next)
     {
@@ -345,7 +345,7 @@ adjust_markers_for_insert (EMACS_INT from, EMACS_INT from_byte,
    intervals.  */
 
 static void
-adjust_point (EMACS_INT nchars, EMACS_INT nbytes)
+adjust_point (ptrdiff_t nchars, ptrdiff_t nbytes)
 {
   SET_BUF_PT_BOTH (current_buffer, PT + nchars, PT_BYTE + nbytes);
   /* In a single-byte buffer, the two positions must be equal.  */
@@ -358,14 +358,14 @@ adjust_point (EMACS_INT nchars, EMACS_INT nbytes)
    an insertion.  */
 
 static void
-adjust_markers_for_replace (EMACS_INT from, EMACS_INT from_byte,
-			    EMACS_INT old_chars, EMACS_INT old_bytes,
-			    EMACS_INT new_chars, EMACS_INT new_bytes)
+adjust_markers_for_replace (ptrdiff_t from, ptrdiff_t from_byte,
+			    ptrdiff_t old_chars, ptrdiff_t old_bytes,
+			    ptrdiff_t new_chars, ptrdiff_t new_bytes)
 {
   register struct Lisp_Marker *m;
-  EMACS_INT prev_to_byte = from_byte + old_bytes;
-  EMACS_INT diff_chars = new_chars - old_chars;
-  EMACS_INT diff_bytes = new_bytes - old_bytes;
+  ptrdiff_t prev_to_byte = from_byte + old_bytes;
+  ptrdiff_t diff_chars = new_chars - old_chars;
+  ptrdiff_t diff_bytes = new_bytes - old_bytes;
 
   for (m = BUF_MARKERS (current_buffer); m; m = m->next)
     {
@@ -394,13 +394,13 @@ buffer_overflow (void)
 /* Make the gap NBYTES_ADDED bytes longer.  */
 
 static void
-make_gap_larger (EMACS_INT nbytes_added)
+make_gap_larger (ptrdiff_t nbytes_added)
 {
   Lisp_Object tem;
-  EMACS_INT real_gap_loc;
-  EMACS_INT real_gap_loc_byte;
-  EMACS_INT old_gap_size;
-  EMACS_INT current_size = Z_BYTE - BEG_BYTE + GAP_SIZE;
+  ptrdiff_t real_gap_loc;
+  ptrdiff_t real_gap_loc_byte;
+  ptrdiff_t old_gap_size;
+  ptrdiff_t current_size = Z_BYTE - BEG_BYTE + GAP_SIZE;
   enum { enough_for_a_while = 2000 };
 
   if (BUF_BYTES_MAX - current_size < nbytes_added)
@@ -446,15 +446,15 @@ make_gap_larger (EMACS_INT nbytes_added)
 /* Make the gap NBYTES_REMOVED bytes shorter.  */
 
 static void
-make_gap_smaller (EMACS_INT nbytes_removed)
+make_gap_smaller (ptrdiff_t nbytes_removed)
 {
   Lisp_Object tem;
-  EMACS_INT real_gap_loc;
-  EMACS_INT real_gap_loc_byte;
-  EMACS_INT real_Z;
-  EMACS_INT real_Z_byte;
-  EMACS_INT real_beg_unchanged;
-  EMACS_INT new_gap_size;
+  ptrdiff_t real_gap_loc;
+  ptrdiff_t real_gap_loc_byte;
+  ptrdiff_t real_Z;
+  ptrdiff_t real_Z_byte;
+  ptrdiff_t real_beg_unchanged;
+  ptrdiff_t new_gap_size;
 
   /* Make sure the gap is at least 20 bytes.  */
   if (GAP_SIZE - nbytes_removed < 20)
@@ -504,7 +504,7 @@ make_gap_smaller (EMACS_INT nbytes_removed)
 #endif /* USE_MMAP_FOR_BUFFERS || REL_ALLOC || DOUG_LEA_MALLOC */
 
 void
-make_gap (EMACS_INT nbytes_added)
+make_gap (ptrdiff_t nbytes_added)
 {
   if (nbytes_added >= 0)
     make_gap_larger (nbytes_added);
@@ -521,9 +521,9 @@ make_gap (EMACS_INT nbytes_added)
 
    Return the number of bytes stored at TO_ADDR.  */
 
-EMACS_INT
+ptrdiff_t
 copy_text (const unsigned char *from_addr, unsigned char *to_addr,
-	   EMACS_INT nbytes, int from_multibyte, int to_multibyte)
+	   ptrdiff_t nbytes, int from_multibyte, int to_multibyte)
 {
   if (from_multibyte == to_multibyte)
     {
@@ -532,8 +532,8 @@ copy_text (const unsigned char *from_addr, unsigned char *to_addr,
     }
   else if (from_multibyte)
     {
-      EMACS_INT nchars = 0;
-      EMACS_INT bytes_left = nbytes;
+      ptrdiff_t nchars = 0;
+      ptrdiff_t bytes_left = nbytes;
 
       while (bytes_left > 0)
 	{
@@ -580,11 +580,11 @@ copy_text (const unsigned char *from_addr, unsigned char *to_addr,
    prepare_to_modify_buffer could relocate the text.  */
 
 void
-insert (const char *string, EMACS_INT nbytes)
+insert (const char *string, ptrdiff_t nbytes)
 {
   if (nbytes > 0)
     {
-      EMACS_INT len = chars_in_text ((unsigned char *) string, nbytes), opoint;
+      ptrdiff_t len = chars_in_text ((unsigned char *) string, nbytes), opoint;
       insert_1_both (string, len, nbytes, 0, 1, 0);
       opoint = PT - len;
       signal_after_change (opoint, 0, len);
@@ -595,11 +595,11 @@ insert (const char *string, EMACS_INT nbytes)
 /* Likewise, but inherit text properties from neighboring characters.  */
 
 void
-insert_and_inherit (const char *string, EMACS_INT nbytes)
+insert_and_inherit (const char *string, ptrdiff_t nbytes)
 {
   if (nbytes > 0)
     {
-      EMACS_INT len = chars_in_text ((unsigned char *) string, nbytes), opoint;
+      ptrdiff_t len = chars_in_text ((unsigned char *) string, nbytes), opoint;
       insert_1_both (string, len, nbytes, 1, 1, 0);
       opoint = PT - len;
       signal_after_change (opoint, 0, len);
@@ -640,11 +640,11 @@ insert_string (const char *s)
    since gc could happen and relocate it.  */
 
 void
-insert_before_markers (const char *string, EMACS_INT nbytes)
+insert_before_markers (const char *string, ptrdiff_t nbytes)
 {
   if (nbytes > 0)
     {
-      EMACS_INT len = chars_in_text ((unsigned char *) string, nbytes), opoint;
+      ptrdiff_t len = chars_in_text ((unsigned char *) string, nbytes), opoint;
       insert_1_both (string, len, nbytes, 0, 1, 1);
       opoint = PT - len;
       signal_after_change (opoint, 0, len);
@@ -656,11 +656,11 @@ insert_before_markers (const char *string, EMACS_INT nbytes)
 
 void
 insert_before_markers_and_inherit (const char *string,
-				   EMACS_INT nbytes)
+				   ptrdiff_t nbytes)
 {
   if (nbytes > 0)
     {
-      EMACS_INT len = chars_in_text ((unsigned char *) string, nbytes), opoint;
+      ptrdiff_t len = chars_in_text ((unsigned char *) string, nbytes), opoint;
       insert_1_both (string, len, nbytes, 1, 1, 1);
       opoint = PT - len;
       signal_after_change (opoint, 0, len);
@@ -671,7 +671,7 @@ insert_before_markers_and_inherit (const char *string,
 /* Subroutine used by the insert functions above.  */
 
 void
-insert_1 (const char *string, EMACS_INT nbytes,
+insert_1 (const char *string, ptrdiff_t nbytes,
 	  int inherit, int prepare, int before_markers)
 {
   insert_1_both (string, chars_in_text ((unsigned char *) string, nbytes),
@@ -687,8 +687,8 @@ insert_1 (const char *string, EMACS_INT nbytes,
    which combine in this way.  Otherwise, return 0.  */
 
 int
-count_combining_before (const unsigned char *string, EMACS_INT length,
-			EMACS_INT pos, EMACS_INT pos_byte)
+count_combining_before (const unsigned char *string, ptrdiff_t length,
+			ptrdiff_t pos, ptrdiff_t pos_byte)
 {
   int len, combining_bytes;
   const unsigned char *p;
@@ -733,11 +733,11 @@ count_combining_before (const unsigned char *string, EMACS_INT length,
 
 int
 count_combining_after (const unsigned char *string,
-		       EMACS_INT length, EMACS_INT pos, EMACS_INT pos_byte)
+		       ptrdiff_t length, ptrdiff_t pos, ptrdiff_t pos_byte)
 {
-  EMACS_INT opos_byte = pos_byte;
-  EMACS_INT i;
-  EMACS_INT bytes;
+  ptrdiff_t opos_byte = pos_byte;
+  ptrdiff_t i;
+  ptrdiff_t bytes;
   unsigned char *bufp;
 
   if (NILP (current_buffer->enable_multibyte_characters))
@@ -797,7 +797,7 @@ count_combining_after (const unsigned char *string,
 
 void
 insert_1_both (const char *string,
-	       EMACS_INT nchars, EMACS_INT nbytes,
+	       ptrdiff_t nchars, ptrdiff_t nbytes,
 	       int inherit, int prepare, int before_markers)
 {
   if (nchars == 0)
@@ -875,10 +875,10 @@ insert_1_both (const char *string,
    without insert noticing.  */
 
 void
-insert_from_string (Lisp_Object string, EMACS_INT pos, EMACS_INT pos_byte,
-		    EMACS_INT length, EMACS_INT length_byte, int inherit)
+insert_from_string (Lisp_Object string, ptrdiff_t pos, ptrdiff_t pos_byte,
+		    ptrdiff_t length, ptrdiff_t length_byte, int inherit)
 {
-  EMACS_INT opoint = PT;
+  ptrdiff_t opoint = PT;
 
   if (SCHARS (string) == 0)
     return;
@@ -894,11 +894,11 @@ insert_from_string (Lisp_Object string, EMACS_INT pos, EMACS_INT pos_byte,
 
 void
 insert_from_string_before_markers (Lisp_Object string,
-				   EMACS_INT pos, EMACS_INT pos_byte,
-				   EMACS_INT length, EMACS_INT length_byte,
+				   ptrdiff_t pos, ptrdiff_t pos_byte,
+				   ptrdiff_t length, ptrdiff_t length_byte,
 				   int inherit)
 {
-  EMACS_INT opoint = PT;
+  ptrdiff_t opoint = PT;
 
   if (SCHARS (string) == 0)
     return;
@@ -912,12 +912,12 @@ insert_from_string_before_markers (Lisp_Object string,
 /* Subroutine of the insertion functions above.  */
 
 static void
-insert_from_string_1 (Lisp_Object string, EMACS_INT pos, EMACS_INT pos_byte,
-		      EMACS_INT nchars, EMACS_INT nbytes,
+insert_from_string_1 (Lisp_Object string, ptrdiff_t pos, ptrdiff_t pos_byte,
+		      ptrdiff_t nchars, ptrdiff_t nbytes,
 		      int inherit, int before_markers)
 {
   struct gcpro gcpro1;
-  EMACS_INT outgoing_nbytes = nbytes;
+  ptrdiff_t outgoing_nbytes = nbytes;
   INTERVAL intervals;
 
   /* Make OUTGOING_NBYTES describe the text
@@ -1004,7 +1004,7 @@ insert_from_string_1 (Lisp_Object string, EMACS_INT pos, EMACS_INT pos_byte,
    starting at GPT_ADDR.  */
 
 void
-insert_from_gap (EMACS_INT nchars, EMACS_INT nbytes)
+insert_from_gap (ptrdiff_t nchars, ptrdiff_t nbytes)
 {
   if (NILP (BVAR (current_buffer, enable_multibyte_characters)))
     nchars = nbytes;
@@ -1050,9 +1050,9 @@ insert_from_gap (EMACS_INT nchars, EMACS_INT nbytes)
 
 void
 insert_from_buffer (struct buffer *buf,
-		    EMACS_INT charpos, EMACS_INT nchars, int inherit)
+		    ptrdiff_t charpos, ptrdiff_t nchars, int inherit)
 {
-  EMACS_INT opoint = PT;
+  ptrdiff_t opoint = PT;
 
   insert_from_buffer_1 (buf, charpos, nchars, inherit);
   signal_after_change (opoint, 0, PT - opoint);
@@ -1061,13 +1061,13 @@ insert_from_buffer (struct buffer *buf,
 
 static void
 insert_from_buffer_1 (struct buffer *buf,
-		      EMACS_INT from, EMACS_INT nchars, int inherit)
+		      ptrdiff_t from, ptrdiff_t nchars, int inherit)
 {
-  EMACS_INT chunk, chunk_expanded;
-  EMACS_INT from_byte = buf_charpos_to_bytepos (buf, from);
-  EMACS_INT to_byte = buf_charpos_to_bytepos (buf, from + nchars);
-  EMACS_INT incoming_nbytes = to_byte - from_byte;
-  EMACS_INT outgoing_nbytes = incoming_nbytes;
+  ptrdiff_t chunk, chunk_expanded;
+  ptrdiff_t from_byte = buf_charpos_to_bytepos (buf, from);
+  ptrdiff_t to_byte = buf_charpos_to_bytepos (buf, from + nchars);
+  ptrdiff_t incoming_nbytes = to_byte - from_byte;
+  ptrdiff_t outgoing_nbytes = incoming_nbytes;
   INTERVAL intervals;
 
   /* Make OUTGOING_NBYTES describe the text
@@ -1077,8 +1077,8 @@ insert_from_buffer_1 (struct buffer *buf,
     outgoing_nbytes = nchars;
   else if (NILP (BVAR (buf, enable_multibyte_characters)))
     {
-      EMACS_INT outgoing_before_gap = 0;
-      EMACS_INT outgoing_after_gap = 0;
+      ptrdiff_t outgoing_before_gap = 0;
+      ptrdiff_t outgoing_after_gap = 0;
 
       if (from < BUF_GPT (buf))
 	{
@@ -1195,10 +1195,10 @@ insert_from_buffer_1 (struct buffer *buf,
    PREV_TEXT nil means the new text was just inserted.  */
 
 static void
-adjust_after_replace (EMACS_INT from, EMACS_INT from_byte,
-		      Lisp_Object prev_text, EMACS_INT len, EMACS_INT len_byte)
+adjust_after_replace (ptrdiff_t from, ptrdiff_t from_byte,
+		      Lisp_Object prev_text, ptrdiff_t len, ptrdiff_t len_byte)
 {
-  EMACS_INT nchars_del = 0, nbytes_del = 0;
+  ptrdiff_t nchars_del = 0, nbytes_del = 0;
 
 #ifdef BYTE_COMBINING_DEBUG
   if (count_combining_before (GPT_ADDR, len_byte, from, from_byte)
@@ -1263,10 +1263,10 @@ adjust_after_replace (EMACS_INT from, EMACS_INT from_byte,
    - FROM) may be incorrect, the correct length is NEWLEN.  */
 
 void
-adjust_after_insert (EMACS_INT from, EMACS_INT from_byte,
-		     EMACS_INT to, EMACS_INT to_byte, EMACS_INT newlen)
+adjust_after_insert (ptrdiff_t from, ptrdiff_t from_byte,
+		     ptrdiff_t to, ptrdiff_t to_byte, ptrdiff_t newlen)
 {
-  EMACS_INT len = to - from, len_byte = to_byte - from_byte;
+  ptrdiff_t len = to - from, len_byte = to_byte - from_byte;
 
   if (GPT != to)
     move_gap_both (to, to_byte);
@@ -1290,16 +1290,16 @@ adjust_after_insert (EMACS_INT from, EMACS_INT from_byte,
    But if MARKERS is 0, don't relocate markers.  */
 
 void
-replace_range (EMACS_INT from, EMACS_INT to, Lisp_Object new,
+replace_range (ptrdiff_t from, ptrdiff_t to, Lisp_Object new,
 	       int prepare, int inherit, int markers)
 {
-  EMACS_INT inschars = SCHARS (new);
-  EMACS_INT insbytes = SBYTES (new);
-  EMACS_INT from_byte, to_byte;
-  EMACS_INT nbytes_del, nchars_del;
+  ptrdiff_t inschars = SCHARS (new);
+  ptrdiff_t insbytes = SBYTES (new);
+  ptrdiff_t from_byte, to_byte;
+  ptrdiff_t nbytes_del, nchars_del;
   struct gcpro gcpro1;
   INTERVAL intervals;
-  EMACS_INT outgoing_insbytes = insbytes;
+  ptrdiff_t outgoing_insbytes = insbytes;
   Lisp_Object deletion;
 
   CHECK_MARKERS ();
@@ -1309,7 +1309,7 @@ replace_range (EMACS_INT from, EMACS_INT to, Lisp_Object new,
 
   if (prepare)
     {
-      EMACS_INT range_length = to - from;
+      ptrdiff_t range_length = to - from;
       prepare_to_modify_buffer (from, to, &from);
       to = from + range_length;
     }
@@ -1464,12 +1464,12 @@ replace_range (EMACS_INT from, EMACS_INT to, Lisp_Object new,
    prepare_to_modify_buffer and never call signal_after_change.  */
 
 void
-replace_range_2 (EMACS_INT from, EMACS_INT from_byte,
-		 EMACS_INT to, EMACS_INT to_byte,
-		 const char *ins, EMACS_INT inschars, EMACS_INT insbytes,
+replace_range_2 (ptrdiff_t from, ptrdiff_t from_byte,
+		 ptrdiff_t to, ptrdiff_t to_byte,
+		 const char *ins, ptrdiff_t inschars, ptrdiff_t insbytes,
 		 int markers)
 {
-  EMACS_INT nbytes_del, nchars_del;
+  ptrdiff_t nbytes_del, nchars_del;
 
   CHECK_MARKERS ();
 
@@ -1571,7 +1571,7 @@ replace_range_2 (EMACS_INT from, EMACS_INT from_byte,
    If TO comes before FROM, we delete nothing.  */
 
 void
-del_range (EMACS_INT from, EMACS_INT to)
+del_range (ptrdiff_t from, ptrdiff_t to)
 {
   del_range_1 (from, to, 1, 0);
 }
@@ -1580,9 +1580,9 @@ del_range (EMACS_INT from, EMACS_INT to)
    RET_STRING says to return the deleted text. */
 
 Lisp_Object
-del_range_1 (EMACS_INT from, EMACS_INT to, int prepare, int ret_string)
+del_range_1 (ptrdiff_t from, ptrdiff_t to, int prepare, int ret_string)
 {
-  EMACS_INT from_byte, to_byte;
+  ptrdiff_t from_byte, to_byte;
   Lisp_Object deletion;
   struct gcpro gcpro1;
 
@@ -1597,7 +1597,7 @@ del_range_1 (EMACS_INT from, EMACS_INT to, int prepare, int ret_string)
 
   if (prepare)
     {
-      EMACS_INT range_length = to - from;
+      ptrdiff_t range_length = to - from;
       prepare_to_modify_buffer (from, to, &from);
       to = min (ZV, from + range_length);
     }
@@ -1616,9 +1616,9 @@ del_range_1 (EMACS_INT from, EMACS_INT to, int prepare, int ret_string)
 /* Like del_range_1 but args are byte positions, not char positions.  */
 
 void
-del_range_byte (EMACS_INT from_byte, EMACS_INT to_byte, int prepare)
+del_range_byte (ptrdiff_t from_byte, ptrdiff_t to_byte, int prepare)
 {
-  EMACS_INT from, to;
+  ptrdiff_t from, to;
 
   /* Make args be valid */
   if (from_byte < BEGV_BYTE)
@@ -1634,8 +1634,8 @@ del_range_byte (EMACS_INT from_byte, EMACS_INT to_byte, int prepare)
 
   if (prepare)
     {
-      EMACS_INT old_from = from, old_to = Z - to;
-      EMACS_INT range_length = to - from;
+      ptrdiff_t old_from = from, old_to = Z - to;
+      ptrdiff_t range_length = to - from;
       prepare_to_modify_buffer (from, to, &from);
       to = from + range_length;
 
@@ -1659,8 +1659,8 @@ del_range_byte (EMACS_INT from_byte, EMACS_INT to_byte, int prepare)
    and bytepos.  */
 
 void
-del_range_both (EMACS_INT from, EMACS_INT from_byte,
-		EMACS_INT to, EMACS_INT to_byte, int prepare)
+del_range_both (ptrdiff_t from, ptrdiff_t from_byte,
+		ptrdiff_t to, ptrdiff_t to_byte, int prepare)
 {
   /* Make args be valid */
   if (from_byte < BEGV_BYTE)
@@ -1678,8 +1678,8 @@ del_range_both (EMACS_INT from, EMACS_INT from_byte,
 
   if (prepare)
     {
-      EMACS_INT old_from = from, old_to = Z - to;
-      EMACS_INT range_length = to - from;
+      ptrdiff_t old_from = from, old_to = Z - to;
+      ptrdiff_t range_length = to - from;
       prepare_to_modify_buffer (from, to, &from);
       to = from + range_length;
 
@@ -1705,10 +1705,10 @@ del_range_both (EMACS_INT from, EMACS_INT from_byte,
    If RET_STRING is true, the deleted area is returned as a string. */
 
 Lisp_Object
-del_range_2 (EMACS_INT from, EMACS_INT from_byte,
-	     EMACS_INT to, EMACS_INT to_byte, int ret_string)
+del_range_2 (ptrdiff_t from, ptrdiff_t from_byte,
+	     ptrdiff_t to, ptrdiff_t to_byte, int ret_string)
 {
-  register EMACS_INT nbytes_del, nchars_del;
+  register ptrdiff_t nbytes_del, nchars_del;
   Lisp_Object deletion;
 
   CHECK_MARKERS ();
@@ -1792,7 +1792,7 @@ del_range_2 (EMACS_INT from, EMACS_INT from_byte,
    Otherwise set CHARS_MODIFF to the new value of MODIFF.  */
 
 void
-modify_region (struct buffer *buffer, EMACS_INT start, EMACS_INT end,
+modify_region (struct buffer *buffer, ptrdiff_t start, ptrdiff_t end,
 	       int preserve_chars_modiff)
 {
   struct buffer *old_buffer = current_buffer;
@@ -1827,8 +1827,8 @@ modify_region (struct buffer *buffer, EMACS_INT start, EMACS_INT end,
    by holding its value temporarily in a marker.  */
 
 void
-prepare_to_modify_buffer (EMACS_INT start, EMACS_INT end,
-			  EMACS_INT *preserve_ptr)
+prepare_to_modify_buffer (ptrdiff_t start, ptrdiff_t end,
+			  ptrdiff_t *preserve_ptr)
 {
   struct buffer *base_buffer;
 
@@ -1889,8 +1889,8 @@ prepare_to_modify_buffer (EMACS_INT start, EMACS_INT end,
 	  : (!NILP (Vselect_active_regions)
 	     && !NILP (Vtransient_mark_mode))))
     {
-      EMACS_INT b = XMARKER (BVAR (current_buffer, mark))->charpos;
-      EMACS_INT e = PT;
+      ptrdiff_t b = XMARKER (BVAR (current_buffer, mark))->charpos;
+      ptrdiff_t e = PT;
       if (b < e)
 	Vsaved_region_selection = make_buffer_string (b, e, 0);
       else if (b > e)
@@ -1958,14 +1958,14 @@ reset_var_on_error (Lisp_Object val)
    by holding its value temporarily in a marker.  */
 
 static void
-signal_before_change (EMACS_INT start_int, EMACS_INT end_int,
-		      EMACS_INT *preserve_ptr)
+signal_before_change (ptrdiff_t start_int, ptrdiff_t end_int,
+		      ptrdiff_t *preserve_ptr)
 {
   Lisp_Object start, end;
   Lisp_Object start_marker, end_marker;
   Lisp_Object preserve_marker;
   struct gcpro gcpro1, gcpro2, gcpro3;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   if (inhibit_modification_hooks)
     return;
@@ -2036,9 +2036,9 @@ signal_before_change (EMACS_INT start_int, EMACS_INT end_int,
    after the change.  */
 
 void
-signal_after_change (EMACS_INT charpos, EMACS_INT lendel, EMACS_INT lenins)
+signal_after_change (ptrdiff_t charpos, ptrdiff_t lendel, ptrdiff_t lenins)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   if (inhibit_modification_hooks)
     return;
 
@@ -2119,9 +2119,9 @@ DEFUN ("combine-after-change-execute", Fcombine_after_change_execute,
        doc: /* This function is for use internally in `combine-after-change-calls'.  */)
   (void)
 {
-  int count = SPECPDL_INDEX ();
-  EMACS_INT beg, end, change;
-  EMACS_INT begpos, endpos;
+  ptrdiff_t count = SPECPDL_INDEX ();
+  ptrdiff_t beg, end, change;
+  ptrdiff_t begpos, endpos;
   Lisp_Object tail;
 
   if (NILP (combine_after_change_list))
@@ -2155,7 +2155,7 @@ DEFUN ("combine-after-change-execute", Fcombine_after_change_execute,
        tail = XCDR (tail))
     {
       Lisp_Object elt;
-      EMACS_INT thisbeg, thisend, thischange;
+      ptrdiff_t thisbeg, thisend, thischange;
 
       /* Extract the info from the next element.  */
       elt = XCAR (tail);
diff --git a/src/intervals.c b/src/intervals.c
index 2063655cdb9..54b98804d3c 100644
--- a/src/intervals.c
+++ b/src/intervals.c
@@ -223,7 +223,7 @@ traverse_intervals_noorder (INTERVAL tree, void (*function) (INTERVAL, Lisp_Obje
    Pass FUNCTION two args: an interval, and ARG.  */
 
 void
-traverse_intervals (INTERVAL tree, EMACS_INT position,
+traverse_intervals (INTERVAL tree, ptrdiff_t position,
 		    void (*function) (INTERVAL, Lisp_Object), Lisp_Object arg)
 {
   while (!NULL_INTERVAL_P (tree))
@@ -313,7 +313,7 @@ rotate_right (INTERVAL interval)
 {
   INTERVAL i;
   INTERVAL B = interval->left;
-  EMACS_INT old_total = interval->total_length;
+  ptrdiff_t old_total = interval->total_length;
 
   /* Deal with any Parent of A;  make it point to B.  */
   if (! ROOT_INTERVAL_P (interval))
@@ -360,7 +360,7 @@ rotate_left (INTERVAL interval)
 {
   INTERVAL i;
   INTERVAL B = interval->right;
-  EMACS_INT old_total = interval->total_length;
+  ptrdiff_t old_total = interval->total_length;
 
   /* Deal with any parent of A;  make it point to B.  */
   if (! ROOT_INTERVAL_P (interval))
@@ -399,7 +399,7 @@ rotate_left (INTERVAL interval)
 static INTERVAL
 balance_an_interval (INTERVAL i)
 {
-  register EMACS_INT old_diff, new_diff;
+  register ptrdiff_t old_diff, new_diff;
 
   while (1)
     {
@@ -499,11 +499,11 @@ balance_intervals (INTERVAL tree)
    it is still a root after this operation.  */
 
 INTERVAL
-split_interval_right (INTERVAL interval, EMACS_INT offset)
+split_interval_right (INTERVAL interval, ptrdiff_t offset)
 {
   INTERVAL new = make_interval ();
-  EMACS_INT position = interval->position;
-  EMACS_INT new_length = LENGTH (interval) - offset;
+  ptrdiff_t position = interval->position;
+  ptrdiff_t new_length = LENGTH (interval) - offset;
 
   new->position = position + offset;
   SET_INTERVAL_PARENT (new, interval);
@@ -544,10 +544,10 @@ split_interval_right (INTERVAL interval, EMACS_INT offset)
    it is still a root after this operation.  */
 
 INTERVAL
-split_interval_left (INTERVAL interval, EMACS_INT offset)
+split_interval_left (INTERVAL interval, ptrdiff_t offset)
 {
   INTERVAL new = make_interval ();
-  EMACS_INT new_length = offset;
+  ptrdiff_t new_length = offset;
 
   new->position = interval->position;
   interval->position = interval->position + offset;
@@ -610,11 +610,11 @@ interval_start_pos (INTERVAL source)
    will update this cache based on the result of find_interval.  */
 
 INTERVAL
-find_interval (register INTERVAL tree, register EMACS_INT position)
+find_interval (register INTERVAL tree, register ptrdiff_t position)
 {
   /* The distance from the left edge of the subtree at TREE
                     to POSITION.  */
-  register EMACS_INT relative_position;
+  register ptrdiff_t relative_position;
 
   if (NULL_INTERVAL_P (tree))
     return NULL_INTERVAL;
@@ -667,7 +667,7 @@ INTERVAL
 next_interval (register INTERVAL interval)
 {
   register INTERVAL i = interval;
-  register EMACS_INT next_position;
+  register ptrdiff_t next_position;
 
   if (NULL_INTERVAL_P (i))
     return NULL_INTERVAL;
@@ -742,7 +742,7 @@ previous_interval (register INTERVAL interval)
    To speed up the process, we assume that the ->position of
    I and all its parents is already uptodate.  */
 INTERVAL
-update_interval (register INTERVAL i, EMACS_INT pos)
+update_interval (register INTERVAL i, ptrdiff_t pos)
 {
   if (NULL_INTERVAL_P (i))
     return NULL_INTERVAL;
@@ -799,10 +799,10 @@ update_interval (register INTERVAL i, EMACS_INT pos)
    to the root.  */
 
 static INTERVAL
-adjust_intervals_for_insertion (INTERVAL tree, EMACS_INT position,
-				EMACS_INT length)
+adjust_intervals_for_insertion (INTERVAL tree, ptrdiff_t position,
+				ptrdiff_t length)
 {
-  register EMACS_INT relative_position;
+  register ptrdiff_t relative_position;
   register INTERVAL this;
 
   if (TOTAL_LENGTH (tree) == 0)	/* Paranoia */
@@ -861,13 +861,13 @@ adjust_intervals_for_insertion (INTERVAL tree, EMACS_INT position,
 
 static INTERVAL
 adjust_intervals_for_insertion (INTERVAL tree,
-				EMACS_INT position, EMACS_INT length)
+				ptrdiff_t position, ptrdiff_t length)
 {
   register INTERVAL i;
   register INTERVAL temp;
   int eobp = 0;
   Lisp_Object parent;
-  EMACS_INT offset;
+  ptrdiff_t offset;
 
   if (TOTAL_LENGTH (tree) == 0)	/* Paranoia */
     abort ();
@@ -1225,7 +1225,7 @@ static INTERVAL
 delete_node (register INTERVAL i)
 {
   register INTERVAL migrate, this;
-  register EMACS_INT migrate_amt;
+  register ptrdiff_t migrate_amt;
 
   if (NULL_INTERVAL_P (i->left))
     return i->right;
@@ -1258,7 +1258,7 @@ static void
 delete_interval (register INTERVAL i)
 {
   register INTERVAL parent;
-  EMACS_INT amt = LENGTH (i);
+  ptrdiff_t amt = LENGTH (i);
 
   if (amt > 0)			/* Only used on zero-length intervals now.  */
     abort ();
@@ -1308,11 +1308,11 @@ delete_interval (register INTERVAL i)
    Do this by recursing down TREE to the interval in question, and
    deleting the appropriate amount of text.  */
 
-static EMACS_INT
-interval_deletion_adjustment (register INTERVAL tree, register EMACS_INT from,
-			      register EMACS_INT amount)
+static ptrdiff_t
+interval_deletion_adjustment (register INTERVAL tree, register ptrdiff_t from,
+			      register ptrdiff_t amount)
 {
-  register EMACS_INT relative_position = from;
+  register ptrdiff_t relative_position = from;
 
   if (NULL_INTERVAL_P (tree))
     return 0;
@@ -1320,7 +1320,7 @@ interval_deletion_adjustment (register INTERVAL tree, register EMACS_INT from,
   /* Left branch */
   if (relative_position < LEFT_TOTAL_LENGTH (tree))
     {
-      EMACS_INT subtract = interval_deletion_adjustment (tree->left,
+      ptrdiff_t subtract = interval_deletion_adjustment (tree->left,
 							 relative_position,
 							 amount);
       tree->total_length -= subtract;
@@ -1331,7 +1331,7 @@ interval_deletion_adjustment (register INTERVAL tree, register EMACS_INT from,
   else if (relative_position >= (TOTAL_LENGTH (tree)
 				 - RIGHT_TOTAL_LENGTH (tree)))
     {
-      EMACS_INT subtract;
+      ptrdiff_t subtract;
 
       relative_position -= (tree->total_length
 			    - RIGHT_TOTAL_LENGTH (tree));
@@ -1346,7 +1346,7 @@ interval_deletion_adjustment (register INTERVAL tree, register EMACS_INT from,
   else
     {
       /* How much can we delete from this interval?  */
-      EMACS_INT my_amount = ((tree->total_length
+      ptrdiff_t my_amount = ((tree->total_length
 			       - RIGHT_TOTAL_LENGTH (tree))
 			      - relative_position);
 
@@ -1371,12 +1371,12 @@ interval_deletion_adjustment (register INTERVAL tree, register EMACS_INT from,
 
 static void
 adjust_intervals_for_deletion (struct buffer *buffer,
-			       EMACS_INT start, EMACS_INT length)
+			       ptrdiff_t start, ptrdiff_t length)
 {
-  register EMACS_INT left_to_delete = length;
+  register ptrdiff_t left_to_delete = length;
   register INTERVAL tree = BUF_INTERVALS (buffer);
   Lisp_Object parent;
-  EMACS_INT offset;
+  ptrdiff_t offset;
 
   GET_INTERVAL_OBJECT (parent, tree);
   offset = (BUFFERP (parent) ? BUF_BEG (XBUFFER (parent)) : 0);
@@ -1426,8 +1426,8 @@ adjust_intervals_for_deletion (struct buffer *buffer,
    adjust_intervals_for_deletion) from a non-static inline function.  */
 
 static inline void
-static_offset_intervals (struct buffer *buffer, EMACS_INT start,
-			 EMACS_INT length)
+static_offset_intervals (struct buffer *buffer, ptrdiff_t start,
+			 ptrdiff_t length)
 {
   if (NULL_INTERVAL_P (BUF_INTERVALS (buffer)) || length == 0)
     return;
@@ -1436,13 +1436,13 @@ static_offset_intervals (struct buffer *buffer, EMACS_INT start,
     adjust_intervals_for_insertion (BUF_INTERVALS (buffer), start, length);
   else
     {
-      IF_LINT (if (length < - TYPE_MAXIMUM (EMACS_INT)) abort ();)
+      IF_LINT (if (length < - TYPE_MAXIMUM (ptrdiff_t)) abort ();)
       adjust_intervals_for_deletion (buffer, start, -length);
     }
 }
 
 inline void
-offset_intervals (struct buffer *buffer, EMACS_INT start, EMACS_INT length)
+offset_intervals (struct buffer *buffer, ptrdiff_t start, ptrdiff_t length)
 {
   static_offset_intervals (buffer, start, length);
 }
@@ -1459,7 +1459,7 @@ offset_intervals (struct buffer *buffer, EMACS_INT start, EMACS_INT length)
 static INTERVAL
 merge_interval_right (register INTERVAL i)
 {
-  register EMACS_INT absorb = LENGTH (i);
+  register ptrdiff_t absorb = LENGTH (i);
   register INTERVAL successor;
 
   /* Zero out this interval.  */
@@ -1515,7 +1515,7 @@ merge_interval_right (register INTERVAL i)
 INTERVAL
 merge_interval_left (register INTERVAL i)
 {
-  register EMACS_INT absorb = LENGTH (i);
+  register ptrdiff_t absorb = LENGTH (i);
   register INTERVAL predecessor;
 
   /* Zero out this interval.  */
@@ -1609,7 +1609,7 @@ reproduce_tree_obj (INTERVAL source, Lisp_Object parent)
    interval.  */
 
 static INTERVAL
-make_new_interval (INTERVAL intervals, EMACS_INT start, EMACS_INT length)
+make_new_interval (INTERVAL intervals, ptrdiff_t start, ptrdiff_t length)
 {
   INTERVAL slot;
 
@@ -1681,13 +1681,13 @@ make_new_interval (INTERVAL intervals, EMACS_INT start, EMACS_INT length)
    text...  */
 
 void
-graft_intervals_into_buffer (INTERVAL source, EMACS_INT position,
-			     EMACS_INT length, struct buffer *buffer,
+graft_intervals_into_buffer (INTERVAL source, ptrdiff_t position,
+			     ptrdiff_t length, struct buffer *buffer,
 			     int inherit)
 {
   register INTERVAL under, over, this;
   register INTERVAL tree;
-  EMACS_INT over_used;
+  ptrdiff_t over_used;
 
   tree = BUF_INTERVALS (buffer);
 
@@ -1888,7 +1888,7 @@ lookup_char_property (Lisp_Object plist, register Lisp_Object prop, int textprop
 
 inline void
 temp_set_point_both (struct buffer *buffer,
-		     EMACS_INT charpos, EMACS_INT bytepos)
+		     ptrdiff_t charpos, ptrdiff_t bytepos)
 {
   /* In a single-byte buffer, the two positions must be equal.  */
   if (BUF_ZV (buffer) == BUF_ZV_BYTE (buffer)
@@ -1907,7 +1907,7 @@ temp_set_point_both (struct buffer *buffer,
 /* Set point "temporarily", without checking any text properties.  */
 
 inline void
-temp_set_point (struct buffer *buffer, EMACS_INT charpos)
+temp_set_point (struct buffer *buffer, ptrdiff_t charpos)
 {
   temp_set_point_both (buffer, charpos,
 		       buf_charpos_to_bytepos (buffer, charpos));
@@ -1917,7 +1917,7 @@ temp_set_point (struct buffer *buffer, EMACS_INT charpos)
    before an intangible character, move to an ok place.  */
 
 void
-set_point (EMACS_INT charpos)
+set_point (ptrdiff_t charpos)
 {
   set_point_both (charpos, buf_charpos_to_bytepos (current_buffer, charpos));
 }
@@ -1933,8 +1933,8 @@ set_point (EMACS_INT charpos)
    Note that `stickiness' is determined by overlay marker insertion types,
    if the invisible property comes from an overlay.  */
 
-static EMACS_INT
-adjust_for_invis_intang (EMACS_INT pos, EMACS_INT test_offs, EMACS_INT adj,
+static ptrdiff_t
+adjust_for_invis_intang (ptrdiff_t pos, ptrdiff_t test_offs, ptrdiff_t adj,
 			 int test_intang)
 {
   Lisp_Object invis_propval, invis_overlay;
@@ -1973,18 +1973,18 @@ adjust_for_invis_intang (EMACS_INT pos, EMACS_INT test_offs, EMACS_INT adj,
    before an intangible character, move to an ok place.  */
 
 void
-set_point_both (EMACS_INT charpos, EMACS_INT bytepos)
+set_point_both (ptrdiff_t charpos, ptrdiff_t bytepos)
 {
   register INTERVAL to, from, toprev, fromprev;
-  EMACS_INT buffer_point;
-  EMACS_INT old_position = PT;
+  ptrdiff_t buffer_point;
+  ptrdiff_t old_position = PT;
   /* This ensures that we move forward past intangible text when the
      initial position is the same as the destination, in the rare
      instances where this is important, e.g. in line-move-finish
      (simple.el).  */
   int backwards = (charpos < old_position ? 1 : 0);
   int have_overlays;
-  EMACS_INT original_position;
+  ptrdiff_t original_position;
 
   BVAR (current_buffer, point_before_scroll) = Qnil;
 
@@ -2197,7 +2197,7 @@ set_point_both (EMACS_INT charpos, EMACS_INT bytepos)
    segment that reaches all the way to point.  */
 
 void
-move_if_not_intangible (EMACS_INT position)
+move_if_not_intangible (ptrdiff_t position)
 {
   Lisp_Object pos;
   Lisp_Object intangible_propval;
@@ -2260,8 +2260,8 @@ move_if_not_intangible (EMACS_INT position)
    nil means the current buffer. */
 
 int
-get_property_and_range (EMACS_INT pos, Lisp_Object prop, Lisp_Object *val,
-			EMACS_INT *start, EMACS_INT *end, Lisp_Object object)
+get_property_and_range (ptrdiff_t pos, Lisp_Object prop, Lisp_Object *val,
+			ptrdiff_t *start, ptrdiff_t *end, Lisp_Object object)
 {
   INTERVAL i, prev, next;
 
@@ -2304,11 +2304,11 @@ get_property_and_range (EMACS_INT pos, Lisp_Object prop, Lisp_Object *val,
    POSITION must be in the accessible part of BUFFER.  */
 
 Lisp_Object
-get_local_map (register EMACS_INT position, register struct buffer *buffer,
+get_local_map (register ptrdiff_t position, register struct buffer *buffer,
 	       Lisp_Object type)
 {
   Lisp_Object prop, lispy_position, lispy_buffer;
-  EMACS_INT old_begv, old_zv, old_begv_byte, old_zv_byte;
+  ptrdiff_t old_begv, old_zv, old_begv_byte, old_zv_byte;
 
   /* Perhaps we should just change `position' to the limit.  */
   if (position > BUF_ZV (buffer) || position < BUF_BEGV (buffer))
@@ -2355,10 +2355,10 @@ get_local_map (register EMACS_INT position, register struct buffer *buffer,
    The new interval tree has no parent and has a starting-position of 0.  */
 
 INTERVAL
-copy_intervals (INTERVAL tree, EMACS_INT start, EMACS_INT length)
+copy_intervals (INTERVAL tree, ptrdiff_t start, ptrdiff_t length)
 {
   register INTERVAL i, new, t;
-  register EMACS_INT got, prevlen;
+  register ptrdiff_t got, prevlen;
 
   if (NULL_INTERVAL_P (tree) || length <= 0)
     return NULL_INTERVAL;
@@ -2397,7 +2397,7 @@ copy_intervals (INTERVAL tree, EMACS_INT start, EMACS_INT length)
 
 inline void
 copy_intervals_to_string (Lisp_Object string, struct buffer *buffer,
-			  EMACS_INT position, EMACS_INT length)
+			  ptrdiff_t position, ptrdiff_t length)
 {
   INTERVAL interval_copy = copy_intervals (BUF_INTERVALS (buffer),
 					   position, length);
@@ -2415,8 +2415,8 @@ int
 compare_string_intervals (Lisp_Object s1, Lisp_Object s2)
 {
   INTERVAL i1, i2;
-  EMACS_INT pos = 0;
-  EMACS_INT end = SCHARS (s1);
+  ptrdiff_t pos = 0;
+  ptrdiff_t end = SCHARS (s1);
 
   i1 = find_interval (STRING_INTERVALS (s1), 0);
   i2 = find_interval (STRING_INTERVALS (s2), 0);
@@ -2424,9 +2424,9 @@ compare_string_intervals (Lisp_Object s1, Lisp_Object s2)
   while (pos < end)
     {
       /* Determine how far we can go before we reach the end of I1 or I2.  */
-      EMACS_INT len1 = (i1 != 0 ? INTERVAL_LAST_POS (i1) : end) - pos;
-      EMACS_INT len2 = (i2 != 0 ? INTERVAL_LAST_POS (i2) : end) - pos;
-      EMACS_INT distance = min (len1, len2);
+      ptrdiff_t len1 = (i1 != 0 ? INTERVAL_LAST_POS (i1) : end) - pos;
+      ptrdiff_t len2 = (i2 != 0 ? INTERVAL_LAST_POS (i2) : end) - pos;
+      ptrdiff_t distance = min (len1, len2);
 
       /* If we ever find a mismatch between the strings,
 	 they differ.  */
@@ -2451,8 +2451,8 @@ compare_string_intervals (Lisp_Object s1, Lisp_Object s2)
 
 static void
 set_intervals_multibyte_1 (INTERVAL i, int multi_flag,
-			   EMACS_INT start, EMACS_INT start_byte,
-			   EMACS_INT end, EMACS_INT end_byte)
+			   ptrdiff_t start, ptrdiff_t start_byte,
+			   ptrdiff_t end, ptrdiff_t end_byte)
 {
   /* Fix the length of this interval.  */
   if (multi_flag)
@@ -2470,11 +2470,11 @@ set_intervals_multibyte_1 (INTERVAL i, int multi_flag,
   /* Recursively fix the length of the subintervals.  */
   if (i->left)
     {
-      EMACS_INT left_end, left_end_byte;
+      ptrdiff_t left_end, left_end_byte;
 
       if (multi_flag)
 	{
-	  EMACS_INT temp;
+	  ptrdiff_t temp;
 	  left_end_byte = start_byte + LEFT_TOTAL_LENGTH (i);
 	  left_end = BYTE_TO_CHAR (left_end_byte);
 
@@ -2503,11 +2503,11 @@ set_intervals_multibyte_1 (INTERVAL i, int multi_flag,
     }
   if (i->right)
     {
-      EMACS_INT right_start_byte, right_start;
+      ptrdiff_t right_start_byte, right_start;
 
       if (multi_flag)
 	{
-	  EMACS_INT temp;
+	  ptrdiff_t temp;
 
 	  right_start_byte = end_byte - RIGHT_TOTAL_LENGTH (i);
 	  right_start = BYTE_TO_CHAR (right_start_byte);
diff --git a/src/intervals.h b/src/intervals.h
index 720598fe7a6..d7d156b42db 100644
--- a/src/intervals.h
+++ b/src/intervals.h
@@ -27,8 +27,8 @@ struct interval
 {
   /* The first group of entries deal with the tree structure.  */
 
-  EMACS_INT total_length;       /* Length of myself and both children.  */
-  EMACS_INT position;	        /* Cache of interval's character position.  */
+  ptrdiff_t total_length;       /* Length of myself and both children.  */
+  ptrdiff_t position;	        /* Cache of interval's character position.  */
 				/* This field is usually updated
 				   simultaneously with an interval
 				   traversal, there is no guarantee
@@ -254,39 +254,39 @@ extern INTERVAL make_interval (void);
 extern INTERVAL create_root_interval (Lisp_Object);
 extern void copy_properties (INTERVAL, INTERVAL);
 extern int intervals_equal (INTERVAL, INTERVAL);
-extern void traverse_intervals (INTERVAL, EMACS_INT,
+extern void traverse_intervals (INTERVAL, ptrdiff_t,
                                 void (*) (INTERVAL, Lisp_Object),
                                 Lisp_Object);
 extern void traverse_intervals_noorder (INTERVAL,
                                         void (*) (INTERVAL, Lisp_Object),
                                         Lisp_Object);
-extern INTERVAL split_interval_right (INTERVAL, EMACS_INT);
-extern INTERVAL split_interval_left (INTERVAL, EMACS_INT);
-extern INTERVAL find_interval (INTERVAL, EMACS_INT);
+extern INTERVAL split_interval_right (INTERVAL, ptrdiff_t);
+extern INTERVAL split_interval_left (INTERVAL, ptrdiff_t);
+extern INTERVAL find_interval (INTERVAL, ptrdiff_t);
 extern INTERVAL next_interval (INTERVAL);
 extern INTERVAL previous_interval (INTERVAL);
 extern INTERVAL merge_interval_left (INTERVAL);
-extern void offset_intervals (struct buffer *, EMACS_INT, EMACS_INT);
-extern void graft_intervals_into_buffer (INTERVAL, EMACS_INT, EMACS_INT,
+extern void offset_intervals (struct buffer *, ptrdiff_t, ptrdiff_t);
+extern void graft_intervals_into_buffer (INTERVAL, ptrdiff_t, ptrdiff_t,
                                          struct buffer *, int);
 extern void verify_interval_modification (struct buffer *,
-					  EMACS_INT, EMACS_INT);
+					  ptrdiff_t, ptrdiff_t);
 extern INTERVAL balance_intervals (INTERVAL);
 extern void copy_intervals_to_string (Lisp_Object, struct buffer *,
-                                             EMACS_INT, EMACS_INT);
-extern INTERVAL copy_intervals (INTERVAL, EMACS_INT, EMACS_INT);
+                                             ptrdiff_t, ptrdiff_t);
+extern INTERVAL copy_intervals (INTERVAL, ptrdiff_t, ptrdiff_t);
 extern int compare_string_intervals (Lisp_Object, Lisp_Object);
 extern Lisp_Object textget (Lisp_Object, Lisp_Object);
 extern Lisp_Object lookup_char_property (Lisp_Object, Lisp_Object, int);
-extern void move_if_not_intangible (EMACS_INT);
-extern int get_property_and_range (EMACS_INT, Lisp_Object, Lisp_Object *,
-                                   EMACS_INT *, EMACS_INT *, Lisp_Object);
-extern Lisp_Object get_local_map (EMACS_INT, struct buffer *, Lisp_Object);
-extern INTERVAL update_interval (INTERVAL, EMACS_INT);
+extern void move_if_not_intangible (ptrdiff_t);
+extern int get_property_and_range (ptrdiff_t, Lisp_Object, Lisp_Object *,
+                                   ptrdiff_t *, ptrdiff_t *, Lisp_Object);
+extern Lisp_Object get_local_map (ptrdiff_t, struct buffer *, Lisp_Object);
+extern INTERVAL update_interval (INTERVAL, ptrdiff_t);
 extern void set_intervals_multibyte (int);
 extern INTERVAL validate_interval_range (Lisp_Object, Lisp_Object *,
                                          Lisp_Object *, int);
-extern INTERVAL interval_of (EMACS_INT, Lisp_Object);
+extern INTERVAL interval_of (ptrdiff_t, Lisp_Object);
 
 /* Defined in xdisp.c */
 extern int invisible_p (Lisp_Object, Lisp_Object);
diff --git a/src/keyboard.c b/src/keyboard.c
index 26407785c86..318ada35eb3 100644
--- a/src/keyboard.c
+++ b/src/keyboard.c
@@ -122,7 +122,7 @@ static Lisp_Object recent_keys;
    actually mean something.
    It's easier to staticpro a single Lisp_Object than an array.  */
 Lisp_Object this_command_keys;
-int this_command_key_count;
+ptrdiff_t this_command_key_count;
 
 /* 1 after calling Freset_this_command_lengths.
    Usually it is 0.  */
@@ -135,16 +135,16 @@ static int raw_keybuf_count;
 
 #define GROW_RAW_KEYBUF							\
  if (raw_keybuf_count == ASIZE (raw_keybuf))				\
-   raw_keybuf = larger_vector (raw_keybuf, raw_keybuf_count * 2, Qnil)  \
+   raw_keybuf = larger_vector (raw_keybuf, 1, -1)
 
 /* Number of elements of this_command_keys
    that precede this key sequence.  */
-static int this_single_command_key_start;
+static ptrdiff_t this_single_command_key_start;
 
 /* Record values of this_command_key_count and echo_length ()
    before this command was read.  */
-static int before_command_key_count;
-static int before_command_echo_length;
+static ptrdiff_t before_command_key_count;
+static ptrdiff_t before_command_echo_length;
 
 /* For longjmp to where kbd input is being done.  */
 
@@ -208,20 +208,20 @@ EMACS_INT command_loop_level;
 Lisp_Object unread_switch_frame;
 
 /* Last size recorded for a current buffer which is not a minibuffer.  */
-static EMACS_INT last_non_minibuf_size;
+static ptrdiff_t last_non_minibuf_size;
 
 /* Total number of times read_char has returned, modulo UINTMAX_MAX + 1.  */
 uintmax_t num_input_events;
 
 /* Value of num_nonmacro_input_events as of last auto save.  */
 
-static int last_auto_save;
+static EMACS_INT last_auto_save;
 
 /* This is like Vthis_command, except that commands never set it.  */
 Lisp_Object real_this_command;
 
 /* The value of point when the last command was started.  */
-static EMACS_INT last_point_position;
+static ptrdiff_t last_point_position;
 
 /* The buffer that was current when the last command was started.  */
 static Lisp_Object last_point_position_buffer;
@@ -375,7 +375,7 @@ EMACS_TIME timer_check (void);
 
 static void record_menu_key (Lisp_Object c);
 static void echo_now (void);
-static int echo_length (void);
+static ptrdiff_t echo_length (void);
 
 static Lisp_Object Qpolling_period;
 
@@ -446,9 +446,9 @@ static Lisp_Object make_lispy_movement (struct frame *, Lisp_Object,
                                         Lisp_Object, Lisp_Object,
 					Time);
 #endif
-static Lisp_Object modify_event_symbol (EMACS_INT, unsigned, Lisp_Object,
+static Lisp_Object modify_event_symbol (ptrdiff_t, int, Lisp_Object,
                                         Lisp_Object, const char *const *,
-                                        Lisp_Object *, EMACS_INT);
+                                        Lisp_Object *, ptrdiff_t);
 static Lisp_Object make_lispy_switch_frame (Lisp_Object);
 static int help_char_p (Lisp_Object);
 static void save_getcjmp (jmp_buf);
@@ -612,7 +612,7 @@ echo_now (void)
 {
   if (!current_kboard->immediate_echo)
     {
-      int i;
+      ptrdiff_t i;
       current_kboard->immediate_echo = 1;
 
       for (i = 0; i < this_command_key_count; i++)
@@ -670,7 +670,7 @@ cancel_echoing (void)
 
 /* Return the length of the current echo string.  */
 
-static int
+static ptrdiff_t
 echo_length (void)
 {
   return (STRINGP (KVAR (current_kboard, echo_string))
@@ -683,7 +683,7 @@ echo_length (void)
    switches frames while entering a key sequence.  */
 
 static void
-echo_truncate (EMACS_INT nchars)
+echo_truncate (ptrdiff_t nchars)
 {
   if (STRINGP (KVAR (current_kboard, echo_string)))
     KVAR (current_kboard, echo_string)
@@ -712,9 +712,7 @@ add_command_key (Lisp_Object key)
 #endif
 
   if (this_command_key_count >= ASIZE (this_command_keys))
-    this_command_keys = larger_vector (this_command_keys,
-				       2 * ASIZE (this_command_keys),
-				       Qnil);
+    this_command_keys = larger_vector (this_command_keys, 1, -1);
 
   ASET (this_command_keys, this_command_key_count, key);
   ++this_command_key_count;
@@ -724,7 +722,7 @@ add_command_key (Lisp_Object key)
 Lisp_Object
 recursive_edit_1 (void)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object val;
 
   if (command_loop_level > 0)
@@ -792,7 +790,7 @@ Alternatively, `(throw 'exit t)' makes this function signal an error.
 This function is called by the editor initialization to begin editing.  */)
   (void)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object buffer;
 
   /* If we enter while input is blocked, don't lock up here.
@@ -1253,7 +1251,7 @@ Normally, mouse motion is ignored.
 usage: (track-mouse BODY...)  */)
   (Lisp_Object args)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object val;
 
   record_unwind_protect (tracking_off, do_mouse_tracking);
@@ -1304,7 +1302,7 @@ some_mouse_moved (void)
 static int read_key_sequence (Lisp_Object *, int, Lisp_Object,
                               int, int, int);
 void safe_run_hooks (Lisp_Object);
-static void adjust_point_for_property (EMACS_INT, int);
+static void adjust_point_for_property (ptrdiff_t, int);
 
 /* Cancel hourglass from protect_unwind.
    ARG is not used.  */
@@ -1328,7 +1326,7 @@ command_loop_1 (void)
   Lisp_Object cmd;
   Lisp_Object keybuf[30];
   int i;
-  int prev_modiff = 0;
+  EMACS_INT prev_modiff = 0;
   struct buffer *prev_buffer = NULL;
 #if 0 /* This shouldn't be necessary anymore.  --lorentey  */
   int was_locked = single_kboard;
@@ -1400,7 +1398,7 @@ command_loop_1 (void)
 	{
 	  /* Bind inhibit-quit to t so that C-g gets read in
 	     rather than quitting back to the minibuffer.  */
-	  int count = SPECPDL_INDEX ();
+	  ptrdiff_t count = SPECPDL_INDEX ();
 	  specbind (Qinhibit_quit, Qt);
 
 	  sit_for (Vminibuffer_message_timeout, 0, 2);
@@ -1558,7 +1556,7 @@ command_loop_1 (void)
 	  /* Here for a command that isn't executed directly */
 
 #ifdef HAVE_WINDOW_SYSTEM
-            int scount = SPECPDL_INDEX ();
+            ptrdiff_t scount = SPECPDL_INDEX ();
 
             if (display_hourglass_p
                 && NILP (Vexecuting_kbd_macro))
@@ -1651,9 +1649,9 @@ command_loop_1 (void)
 			 && !NILP (Vtransient_mark_mode)))
 		  && !EQ (Vthis_command, Qhandle_switch_frame))
 		{
-		  EMACS_INT beg =
+		  ptrdiff_t beg =
 		    XINT (Fmarker_position (BVAR (current_buffer, mark)));
-		  EMACS_INT end = PT;
+		  ptrdiff_t end = PT;
 		  if (beg < end)
 		    call2 (Qx_set_selection, QPRIMARY,
 			   make_buffer_string (beg, end, 0));
@@ -1713,16 +1711,16 @@ command_loop_1 (void)
    LAST_PT is the last position of point.  */
 
 static void
-adjust_point_for_property (EMACS_INT last_pt, int modified)
+adjust_point_for_property (ptrdiff_t last_pt, int modified)
 {
-  EMACS_INT beg, end;
+  ptrdiff_t beg, end;
   Lisp_Object val, overlay, tmp;
   /* When called after buffer modification, we should temporarily
      suppress the point adjustment for automatic composition so that a
      user can keep inserting another character at point or keep
      deleting characters around point.  */
   int check_composition = ! modified, check_display = 1, check_invisible = 1;
-  EMACS_INT orig_pt = PT;
+  ptrdiff_t orig_pt = PT;
 
   /* FIXME: cycling is probably not necessary because these properties
      can't be usefully combined anyway.  */
@@ -1935,7 +1933,7 @@ safe_run_hooks (Lisp_Object hook)
   /* FIXME: our `internal_condition_case' does not provide any way to pass data
      to its body or to its handlers other than via globals such as
      dynamically-bound variables ;-)  */
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   specbind (Qinhibit_quit, hook);
 
   run_hook_with_args (1, &hook, safe_run_hook_funcall);
@@ -2273,7 +2271,7 @@ read_char (int commandflag, ptrdiff_t nmaps, Lisp_Object *maps,
 	   int *used_mouse_menu, struct timeval *end_time)
 {
   volatile Lisp_Object c;
-  int jmpcount;
+  ptrdiff_t jmpcount;
   jmp_buf local_getcjmp;
   jmp_buf save_jump;
   volatile int key_already_recorded = 0;
@@ -2662,7 +2660,7 @@ read_char (int commandflag, ptrdiff_t nmaps, Lisp_Object *maps,
   if (INTERACTIVE && NILP (c))
     {
       int delay_level;
-      EMACS_INT buffer_size;
+      ptrdiff_t buffer_size;
 
       /* Slow down auto saves logarithmically in size of current buffer,
 	 and garbage collect while we're at it.  */
@@ -2683,8 +2681,9 @@ read_char (int commandflag, ptrdiff_t nmaps, Lisp_Object *maps,
 	  && XINT (Vauto_save_timeout) > 0)
 	{
 	  Lisp_Object tem0;
-	  int timeout = delay_level * XFASTINT (Vauto_save_timeout) / 4;
-
+	  EMACS_INT timeout = (delay_level
+			       * min (XFASTINT (Vauto_save_timeout) / 4,
+				      MOST_POSITIVE_FIXNUM / delay_level));
 	  save_getcjmp (save_jump);
 	  restore_getcjmp (local_getcjmp);
 	  tem0 = sit_for (make_number (timeout), 1, 1);
@@ -2878,7 +2877,7 @@ read_char (int commandflag, ptrdiff_t nmaps, Lisp_Object *maps,
       struct buffer *prev_buffer = current_buffer;
 #if 0 /* This shouldn't be necessary anymore. --lorentey  */
       int was_locked = single_kboard;
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
       record_single_kboard_state ();
 #endif
 
@@ -3000,9 +2999,10 @@ read_char (int commandflag, ptrdiff_t nmaps, Lisp_Object *maps,
       && ' ' <= XINT (c) && XINT (c) < 256 && XINT (c) != 127)
     {
       Lisp_Object keys;
-      int key_count, key_count_reset;
+      ptrdiff_t key_count;
+      int key_count_reset;
       struct gcpro inner_gcpro1;
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
 
       /* Save the echo status.  */
       int saved_immediate_echo = current_kboard->immediate_echo;
@@ -3139,7 +3139,7 @@ read_char (int commandflag, ptrdiff_t nmaps, Lisp_Object *maps,
   /* Process the help character specially if enabled */
   if (!NILP (Vhelp_form) && help_char_p (c))
     {
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
 
       help_form_saved_window_configs
 	= Fcons (Fcurrent_window_configuration (Qnil),
@@ -3299,7 +3299,7 @@ record_char (Lisp_Object c)
 
   if (!recorded)
     {
-      total_keys++;
+      total_keys += total_keys < NUM_RECENT_KEYS;
       ASET (recent_keys, recent_keys_index, c);
       if (++recent_keys_index >= NUM_RECENT_KEYS)
 	recent_keys_index = 0;
@@ -3668,7 +3668,7 @@ kbd_buffer_unget_event (register struct input_event *event)
 
 void
 gen_help_event (Lisp_Object help, Lisp_Object frame, Lisp_Object window,
-		Lisp_Object object, EMACS_INT pos)
+		Lisp_Object object, ptrdiff_t pos)
 {
   struct input_event event;
 
@@ -4418,7 +4418,7 @@ timer_check_2 (void)
 	{
 	  if (NILP (vector[0]))
 	    {
-	      int count = SPECPDL_INDEX ();
+	      ptrdiff_t count = SPECPDL_INDEX ();
 	      Lisp_Object old_deactivate_mark = Vdeactivate_mark;
 
 	      /* Mark the timer as triggered to prevent problems if the lisp
@@ -5129,7 +5129,7 @@ make_lispy_position (struct frame *f, Lisp_Object x, Lisp_Object y,
       /* It's a click in window window at frame coordinates (x,y)  */
       struct window *w = XWINDOW (window);
       Lisp_Object string_info = Qnil;
-      EMACS_INT textpos = -1;
+      ptrdiff_t textpos = -1;
       int col = -1, row = -1;
       int dx  = -1, dy  = -1;
       int width = -1, height = -1;
@@ -5153,7 +5153,7 @@ make_lispy_position (struct frame *f, Lisp_Object x, Lisp_Object y,
       else if (part == ON_MODE_LINE || part == ON_HEADER_LINE)
 	{
 	  Lisp_Object string;
-	  EMACS_INT charpos;
+	  ptrdiff_t charpos;
 
 	  posn = (part == ON_MODE_LINE) ? Qmode_line : Qheader_line;
 	  /* Note that mode_line_string takes COL, ROW as pixels and
@@ -5176,7 +5176,7 @@ make_lispy_position (struct frame *f, Lisp_Object x, Lisp_Object y,
       else if (part == ON_LEFT_MARGIN || part == ON_RIGHT_MARGIN)
 	{
 	  Lisp_Object string;
-	  EMACS_INT charpos;
+	  ptrdiff_t charpos;
 
 	  posn = (part == ON_LEFT_MARGIN) ? Qleft_margin : Qright_margin;
 	  col = wx;
@@ -5404,7 +5404,7 @@ make_lispy_event (struct input_event *event)
 				      Qfunction_key,
 				      KVAR (current_kboard, Vsystem_key_alist),
 				      0, &KVAR (current_kboard, system_key_syms),
-				      TYPE_MAXIMUM (EMACS_INT));
+				      PTRDIFF_MAX);
 	}
 
       return modify_event_symbol (event->code - FUNCTION_KEY_OFFSET,
@@ -5536,9 +5536,10 @@ make_lispy_event (struct input_event *event)
 
 	if (button >= ASIZE (button_down_location))
 	  {
+	    ptrdiff_t incr = button - ASIZE (button_down_location) + 1;
 	    button_down_location = larger_vector (button_down_location,
-						  button + 1, Qnil);
-	    mouse_syms = larger_vector (mouse_syms, button + 1, Qnil);
+						  incr, -1);
+	    mouse_syms = larger_vector (mouse_syms, incr, -1);
 	  }
 
 	start_pos_ptr = &AREF (button_down_location, button);
@@ -5838,7 +5839,9 @@ make_lispy_event (struct input_event *event)
 	event->modifiers &= ~up_modifier;
 
 	if (event->code >= ASIZE (mouse_syms))
-          mouse_syms = larger_vector (mouse_syms, event->code + 1, Qnil);
+          mouse_syms = larger_vector (mouse_syms,
+				      event->code - ASIZE (mouse_syms) + 1,
+				      -1);
 
 	/* Get the symbol we should use for the mouse click.  */
 	head = modify_event_symbol (event->code,
@@ -5941,9 +5944,10 @@ make_lispy_event (struct input_event *event)
 
 	if (button >= ASIZE (button_down_location))
 	  {
+	    ptrdiff_t incr = button - ASIZE (button_down_location) + 1;
 	    button_down_location = larger_vector (button_down_location,
-						  button + 1, Qnil);
-	    mouse_syms = larger_vector (mouse_syms, button + 1, Qnil);
+						  incr, -1);
+	    mouse_syms = larger_vector (mouse_syms, incr, -1);
 	  }
 
 	start_pos_ptr = &AREF (button_down_location, button);
@@ -6045,10 +6049,10 @@ make_lispy_switch_frame (Lisp_Object frame)
    This doesn't use any caches.  */
 
 static int
-parse_modifiers_uncached (Lisp_Object symbol, EMACS_INT *modifier_end)
+parse_modifiers_uncached (Lisp_Object symbol, ptrdiff_t *modifier_end)
 {
   Lisp_Object name;
-  EMACS_INT i;
+  ptrdiff_t i;
   int modifiers;
 
   CHECK_SYMBOL (symbol);
@@ -6056,9 +6060,9 @@ parse_modifiers_uncached (Lisp_Object symbol, EMACS_INT *modifier_end)
   modifiers = 0;
   name = SYMBOL_NAME (symbol);
 
-  for (i = 0; i+2 <= SBYTES (name); )
+  for (i = 0; 2 <= SBYTES (name) - i; )
     {
-      EMACS_INT this_mod_end = 0;
+      ptrdiff_t this_mod_end = 0;
       int this_mod = 0;
 
       /* See if the name continues with a modifier word.
@@ -6255,7 +6259,7 @@ parse_modifiers (Lisp_Object symbol)
     return elements;
   else
     {
-      EMACS_INT end;
+      ptrdiff_t end;
       int modifiers = parse_modifiers_uncached (symbol, &end);
       Lisp_Object unmodified;
       Lisp_Object mask;
@@ -6421,9 +6425,9 @@ reorder_modifiers (Lisp_Object symbol)
    in the symbol's name.  */
 
 static Lisp_Object
-modify_event_symbol (EMACS_INT symbol_num, unsigned int modifiers, Lisp_Object symbol_kind,
+modify_event_symbol (ptrdiff_t symbol_num, int modifiers, Lisp_Object symbol_kind,
 		     Lisp_Object name_alist_or_stem, const char *const *name_table,
-		     Lisp_Object *symbol_table, EMACS_INT table_size)
+		     Lisp_Object *symbol_table, ptrdiff_t table_size)
 {
   Lisp_Object value;
   Lisp_Object symbol_int;
@@ -7525,7 +7529,7 @@ menu_bar_items (Lisp_Object old)
     int i = menu_bar_items_index;
     if (i + 4 > ASIZE (menu_bar_items_vector))
       menu_bar_items_vector =
-	larger_vector (menu_bar_items_vector, 2 * i, Qnil);
+	larger_vector (menu_bar_items_vector, 4, -1);
     /* Add this item.  */
     XVECTOR (menu_bar_items_vector)->contents[i++] = Qnil;
     XVECTOR (menu_bar_items_vector)->contents[i++] = Qnil;
@@ -7596,7 +7600,7 @@ menu_bar_item (Lisp_Object key, Lisp_Object item, Lisp_Object dummy1, void *dumm
     {
       /* If vector is too small, get a bigger one.  */
       if (i + 4 > ASIZE (menu_bar_items_vector))
-	menu_bar_items_vector = larger_vector (menu_bar_items_vector, 2 * i, Qnil);
+	menu_bar_items_vector = larger_vector (menu_bar_items_vector, 4, -1);
       /* Add this item.  */
       XVECTOR (menu_bar_items_vector)->contents[i++] = key;
       XVECTOR (menu_bar_items_vector)->contents[i++]
@@ -7640,7 +7644,7 @@ eval_dyn (Lisp_Object form)
 Lisp_Object
 menu_item_eval_property (Lisp_Object sexpr)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object val;
   specbind (Qinhibit_redisplay, Qt);
   val = internal_condition_case_1 (eval_dyn, sexpr, Qerror,
@@ -8365,13 +8369,14 @@ static void
 append_tool_bar_item (void)
 {
   Lisp_Object *to, *from;
+  ptrdiff_t incr =
+    (ntool_bar_items
+     - (ASIZE (tool_bar_items_vector) - TOOL_BAR_ITEM_NSLOTS));
 
   /* Enlarge tool_bar_items_vector if necessary.  */
-  if (ntool_bar_items + TOOL_BAR_ITEM_NSLOTS
-      >= ASIZE (tool_bar_items_vector))
+  if (0 < incr)
     tool_bar_items_vector
-      = larger_vector (tool_bar_items_vector,
-		       2 * ASIZE (tool_bar_items_vector), Qnil);
+      = larger_vector (tool_bar_items_vector, incr, -1);
 
   /* Append entries from tool_bar_item_properties to the end of
      tool_bar_items_vector.  */
@@ -8948,15 +8953,15 @@ read_key_sequence (Lisp_Object *keybuf, int bufsize, Lisp_Object prompt,
 		   int fix_current_buffer)
 {
   Lisp_Object from_string;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   /* How many keys there are in the current key sequence.  */
   int t;
 
   /* The length of the echo buffer when we started reading, and
      the length of this_command_keys when we started reading.  */
-  int echo_start IF_LINT (= 0);
-  int keys_start;
+  ptrdiff_t echo_start IF_LINT (= 0);
+  ptrdiff_t keys_start;
 
   /* The number of keymaps we're scanning right now, and the number of
      keymaps we have allocated space for.  */
@@ -9212,7 +9217,7 @@ read_key_sequence (Lisp_Object *keybuf, int bufsize, Lisp_Object prompt,
 	 while those allow us to restart the entire key sequence,
 	 echo_local_start and keys_local_start allow us to throw away
 	 just one key.  */
-      int echo_local_start IF_LINT (= 0);
+      ptrdiff_t echo_local_start IF_LINT (= 0);
       int keys_local_start;
       ptrdiff_t local_first_binding;
 
@@ -10089,7 +10094,7 @@ will read just one key sequence.  */)
   Lisp_Object keybuf[30];
   register int i;
   struct gcpro gcpro1;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   if (!NILP (prompt))
     CHECK_STRING (prompt);
@@ -10146,7 +10151,7 @@ DEFUN ("read-key-sequence-vector", Fread_key_sequence_vector,
   Lisp_Object keybuf[30];
   register int i;
   struct gcpro gcpro1;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   if (!NILP (prompt))
     CHECK_STRING (prompt);
@@ -10292,7 +10297,7 @@ give to the command you invoke, if it asks for an argument.  */)
   (Lisp_Object prefixarg)
 {
   Lisp_Object function;
-  EMACS_INT saved_last_point_position;
+  ptrdiff_t saved_last_point_position;
   Lisp_Object saved_keys, saved_last_point_position_buffer;
   Lisp_Object bindings, value;
   struct gcpro gcpro1, gcpro2, gcpro3;
@@ -10386,7 +10391,7 @@ give to the command you invoke, if it asks for an argument.  */)
 	  Lisp_Object binding;
 	  char *newmessage;
 	  int message_p = push_message ();
-	  int count = SPECPDL_INDEX ();
+	  ptrdiff_t count = SPECPDL_INDEX ();
 	  ptrdiff_t newmessage_len, newmessage_alloc;
 	  USE_SAFE_ALLOCA;
 
@@ -10711,7 +10716,7 @@ Some operating systems cannot stop the Emacs process and resume it later.
 On such systems, Emacs starts a subshell instead of suspending.  */)
   (Lisp_Object stuffstring)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   int old_height, old_width;
   int width, height;
   struct gcpro gcpro1;
@@ -10767,7 +10772,7 @@ stuff_buffered_input (Lisp_Object stuffstring)
 
   if (STRINGP (stuffstring))
     {
-      register EMACS_INT count;
+      register ptrdiff_t count;
 
       p = SDATA (stuffstring);
       count = SBYTES (stuffstring);
diff --git a/src/keyboard.h b/src/keyboard.h
index d4339d0529b..9f2be5b531b 100644
--- a/src/keyboard.h
+++ b/src/keyboard.h
@@ -202,7 +202,7 @@ extern int poll_suppress_count;
    sequence; this_command_key_count indicates how many elements
    actually mean something.  */
 extern Lisp_Object this_command_keys;
-extern int this_command_key_count;
+extern ptrdiff_t this_command_key_count;
 
 /* The frame in which the last input event occurred, or Qmacro if the
    last event came from a macro.  We use this to determine when to
@@ -500,7 +500,7 @@ extern void poll_for_input_1 (void);
 extern void show_help_echo (Lisp_Object, Lisp_Object, Lisp_Object,
                             Lisp_Object);
 extern void gen_help_event (Lisp_Object, Lisp_Object, Lisp_Object,
-                            Lisp_Object, EMACS_INT);
+                            Lisp_Object, ptrdiff_t);
 extern void kbd_buffer_store_help_event (Lisp_Object, Lisp_Object);
 extern Lisp_Object menu_item_eval_property (Lisp_Object);
 extern int  kbd_buffer_events_waiting (int);
diff --git a/src/keymap.c b/src/keymap.c
index 4485080db21..2d2f36d91c3 100644
--- a/src/keymap.c
+++ b/src/keymap.c
@@ -1117,12 +1117,12 @@ binding is altered.  If there is no binding for KEY, the new pair
 binding KEY to DEF is added at the front of KEYMAP.  */)
   (Lisp_Object keymap, Lisp_Object key, Lisp_Object def)
 {
-  register int idx;
+  register ptrdiff_t idx;
   register Lisp_Object c;
   register Lisp_Object cmd;
   int metized = 0;
   int meta_bit;
-  int length;
+  ptrdiff_t length;
   struct gcpro gcpro1, gcpro2, gcpro3;
 
   GCPRO3 (keymap, key, def);
@@ -1274,10 +1274,10 @@ third optional argument ACCEPT-DEFAULT is non-nil, `lookup-key' will
 recognize the default bindings, just as `read-key-sequence' does.  */)
   (Lisp_Object keymap, Lisp_Object key, Lisp_Object accept_default)
 {
-  register int idx;
+  register ptrdiff_t idx;
   register Lisp_Object cmd;
   register Lisp_Object c;
-  int length;
+  ptrdiff_t length;
   int t_ok = !NILP (accept_default);
   struct gcpro gcpro1, gcpro2;
 
@@ -1527,6 +1527,19 @@ current_minor_maps (Lisp_Object **modeptr, Lisp_Object **mapptr)
   return i;
 }
 
+/* Return the offset of POSITION, a click position, in the style of
+   the respective argument of Fkey_binding.  */
+static ptrdiff_t
+click_position (Lisp_Object position)
+{
+  EMACS_INT pos = (INTEGERP (position) ? XINT (position)
+		   : MARKERP (position) ? marker_position (position)
+		   : PT);
+  if (! (BEGV <= pos && pos <= ZV))
+    args_out_of_range (Fcurrent_buffer (), position);
+  return pos;
+}
+
 DEFUN ("current-active-maps", Fcurrent_active_maps, Scurrent_active_maps,
        0, 2, 0,
        doc: /* Return a list of the currently active keymaps.
@@ -1535,7 +1548,7 @@ OLP if non-nil indicates that we should obey `overriding-local-map' and
 like in the respective argument of `key-binding'. */)
   (Lisp_Object olp, Lisp_Object position)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   Lisp_Object keymaps = Fcons (current_global_map, Qnil);
 
@@ -1582,10 +1595,7 @@ like in the respective argument of `key-binding'. */)
     {
       Lisp_Object *maps;
       int nmaps, i;
-      EMACS_INT pt
-	= INTEGERP (position) ? XINT (position)
-	: MARKERP (position) ? marker_position (position)
-	: PT;
+      ptrdiff_t pt = click_position (position);
       /* This usually returns the buffer's local map,
 	 but that can be overridden by a `local-map' property.  */
       Lisp_Object local_map = get_local_map (pt, current_buffer, Qlocal_map);
@@ -1904,10 +1914,10 @@ accessible_keymaps_1 (Lisp_Object key, Lisp_Object cmd, Lisp_Object args, void *
   while (!NILP (tem = Frassq (cmd, maps)))
     {
       Lisp_Object prefix = XCAR (tem);
-      int lim = XINT (Flength (XCAR (tem)));
+      ptrdiff_t lim = XINT (Flength (XCAR (tem)));
       if (lim <= XINT (Flength (thisseq)))
 	{ /* This keymap was already seen with a smaller prefix.  */
-	  int i = 0;
+	  ptrdiff_t i = 0;
 	  while (i < lim && EQ (Faref (prefix, make_number (i)),
 				Faref (thisseq, make_number (i))))
 	    i++;
@@ -1960,7 +1970,7 @@ then the value includes only maps for prefixes that start with PREFIX.  */)
   (Lisp_Object keymap, Lisp_Object prefix)
 {
   Lisp_Object maps, tail;
-  int prefixlen = XINT (Flength (prefix));
+  EMACS_INT prefixlen = XFASTINT (Flength (prefix));
 
   /* no need for gcpro because we don't autoload any keymaps.  */
 
@@ -2047,20 +2057,25 @@ Control characters turn into "C-foo" sequences, meta into "M-foo",
 spaces are put between sequence elements, etc.  */)
   (Lisp_Object keys, Lisp_Object prefix)
 {
-  int len = 0;
-  int i, i_byte;
+  ptrdiff_t len = 0;
+  EMACS_INT i;
+  ptrdiff_t i_byte;
   Lisp_Object *args;
-  int size = XINT (Flength (keys));
+  EMACS_INT size = XINT (Flength (keys));
   Lisp_Object list;
   Lisp_Object sep = build_string (" ");
   Lisp_Object key;
+  Lisp_Object result;
   int add_meta = 0;
+  USE_SAFE_ALLOCA;
 
   if (!NILP (prefix))
     size += XINT (Flength (prefix));
 
   /* This has one extra element at the end that we don't pass to Fconcat.  */
-  args = (Lisp_Object *) alloca (size * 4 * sizeof (Lisp_Object));
+  if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (Lisp_Object) / 4 < size)
+    memory_full (SIZE_MAX);
+  SAFE_ALLOCA_LISP (args, size * 4);
 
   /* In effect, this computes
      (mapconcat 'single-key-description keys " ")
@@ -2078,9 +2093,9 @@ spaces are put between sequence elements, etc.  */)
 	  args[len] = Fsingle_key_description (meta_prefix_char, Qnil);
 	  len += 2;
 	}
-      else if (len == 0)
-	return empty_unibyte_string;
-      return Fconcat (len - 1, args);
+      result = len == 0 ? empty_unibyte_string : Fconcat (len - 1, args);
+      SAFE_FREE ();
+      return result;
     }
 
   if (STRINGP (list))
@@ -2342,7 +2357,7 @@ See Info node `(elisp)Describing Characters' for examples.  */)
   char str[6];
   int c;
 
-  CHECK_NUMBER (character);
+  CHECK_CHARACTER (character);
 
   c = XINT (character);
   if (!ASCII_CHAR_P (c))
@@ -2365,8 +2380,8 @@ static int where_is_preferred_modifier;
 static int
 preferred_sequence_p (Lisp_Object seq)
 {
-  int i;
-  int len = XINT (Flength (seq));
+  EMACS_INT i;
+  EMACS_INT len = XFASTINT (Flength (seq));
   int result = 1;
 
   for (i = 0; i < len; i++)
@@ -3083,7 +3098,7 @@ static void
 describe_command (Lisp_Object definition, Lisp_Object args)
 {
   register Lisp_Object tem1;
-  EMACS_INT column = current_column ();
+  ptrdiff_t column = current_column ();
   int description_column;
 
   /* If column 16 is no good, go to col 32;
@@ -3366,7 +3381,7 @@ This is text showing the elements of vector matched against indices.
 DESCRIBER is the output function used; nil means use `princ'.  */)
   (Lisp_Object vector, Lisp_Object describer)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   if (NILP (describer))
     describer = intern ("princ");
   specbind (Qstandard_output, Fcurrent_buffer ());
diff --git a/src/lisp.h b/src/lisp.h
index e9a525a32b5..ed8eb2720b5 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -372,14 +372,13 @@ typedef EMACS_INT Lisp_Object;
 #define LISP_MAKE_RVALUE(o) (0+(o))
 #endif /* USE_LISP_UNION_TYPE */
 
-/* In the size word of a vector, this bit means the vector has been marked.
-   (Shift -1 left, not 1, to avoid provoking overflow diagnostics.)  */
+/* In the size word of a vector, this bit means the vector has been marked.  */
 
-#define ARRAY_MARK_FLAG ((EMACS_INT) -1 << (BITS_PER_EMACS_INT - 1))
+#define ARRAY_MARK_FLAG PTRDIFF_MIN
 
 /* In the size word of a struct Lisp_Vector, this bit means it's really
    some other vector-like object.  */
-#define PSEUDOVECTOR_FLAG ((EMACS_INT) 1 << (BITS_PER_EMACS_INT - 2))
+#define PSEUDOVECTOR_FLAG (PTRDIFF_MAX - PTRDIFF_MAX / 2)
 
 /* In a pseudovector, the size field actually contains a word with one
    PSEUDOVECTOR_FLAG bit set, and exactly one of the following bits to
@@ -582,6 +581,12 @@ extern Lisp_Object make_number (EMACS_INT);
 #define FIXNUM_OVERFLOW_P(i) \
   (! ((0 <= (i) || MOST_NEGATIVE_FIXNUM <= (i)) && (i) <= MOST_POSITIVE_FIXNUM))
 
+static inline ptrdiff_t
+clip_to_bounds (ptrdiff_t lower, EMACS_INT num, ptrdiff_t upper)
+{
+  return num < lower ? lower : num <= upper ? num : upper;
+}
+
 /* Extract a value or address from a Lisp_Object.  */
 
 #define XCONS(a) (eassert (CONSP (a)), (struct Lisp_Cons *) XPNTR (a))
@@ -659,8 +664,7 @@ extern Lisp_Object make_number (EMACS_INT);
 #define XSETWINDOW(a, b) (XSETPSEUDOVECTOR (a, b, PVEC_WINDOW))
 #define XSETTERMINAL(a, b) (XSETPSEUDOVECTOR (a, b, PVEC_TERMINAL))
 /* XSETSUBR is special since Lisp_Subr lacks struct vectorlike_header.  */
-#define XSETSUBR(a, b) \
-  XSETTYPED_PSEUDOVECTOR (a, b, XSUBR (a)->size, PVEC_SUBR)
+#define XSETSUBR(a, b) XSETTYPED_PSEUDOVECTOR (a, b, 0, PVEC_SUBR)
 #define XSETCOMPILED(a, b) (XSETPSEUDOVECTOR (a, b, PVEC_COMPILED))
 #define XSETBUFFER(a, b) (XSETPSEUDOVECTOR (a, b, PVEC_BUFFER))
 #define XSETCHAR_TABLE(a, b) (XSETPSEUDOVECTOR (a, b, PVEC_CHAR_TABLE))
@@ -788,7 +792,7 @@ struct Lisp_Cons
 #ifdef GC_CHECK_STRING_BYTES
 
 struct Lisp_String;
-extern EMACS_INT string_bytes (struct Lisp_String *);
+extern ptrdiff_t string_bytes (struct Lisp_String *);
 #define STRING_BYTES(S) string_bytes ((S))
 
 #else /* not GC_CHECK_STRING_BYTES */
@@ -835,8 +839,8 @@ extern EMACS_INT string_bytes (struct Lisp_String *);
 
 struct Lisp_String
   {
-    EMACS_INT size;
-    EMACS_INT size_byte;
+    ptrdiff_t size;
+    ptrdiff_t size_byte;
     INTERVAL intervals;		/* text properties in this string */
     unsigned char *data;
   };
@@ -850,7 +854,7 @@ struct Lisp_String
    <http://debbugs.gnu.org/cgi/bugreport.cgi?bug=8546>.  */
 struct vectorlike_header
   {
-    EMACS_INT size;
+    ptrdiff_t size;
 
     /* Pointer to the next vector-like object.  It is generally a buffer or a
        Lisp_Vector alias, so for convenience it is a union instead of a
@@ -1045,7 +1049,7 @@ struct Lisp_Bool_Vector
 
 struct Lisp_Subr
   {
-    EMACS_INT size;
+    ptrdiff_t size;
     union {
       Lisp_Object (*a0) (void);
       Lisp_Object (*a1) (Lisp_Object);
@@ -1238,7 +1242,7 @@ struct Lisp_Hash_Table
      a special way (e.g. because of weakness).  */
 
   /* Number of key/value entries in the table.  */
-  EMACS_INT count;
+  ptrdiff_t count;
 
   /* Vector of keys and values.  The key of item I is found at index
      2 * I, the value is found at index 2 * I + 1.
@@ -1355,12 +1359,12 @@ struct Lisp_Marker
      That would also allow to preserve it ordered.  */
   struct Lisp_Marker *next;
   /* This is the char position where the marker points.  */
-  EMACS_INT charpos;
+  ptrdiff_t charpos;
   /* This is the byte position.
      It's mostly used as a charpos<->bytepos cache (i.e. it's not directly
      used to implement the functionality of markers, but rather to (ab)use
      markers as a cache for char<->byte mappings).  */
-  EMACS_INT bytepos;
+  ptrdiff_t bytepos;
 };
 
 /* Forwarding pointer to an int variable.
@@ -1626,18 +1630,24 @@ typedef struct {
    encodes a char code in the lower CHARACTERBITS bits and a (very small)
    face-id in the upper bits, or it may be a cons (CHAR . FACE-ID).  */
 
-#define GLYPH_CODE_CHAR(gc) \
-  (CONSP (gc) ? XINT (XCAR (gc)) : INTEGERP (gc) ? (XINT (gc) & ((1 << CHARACTERBITS)-1)) : 0)
+#define GLYPH_CODE_P(gc)						\
+  (CONSP (gc)								\
+   ? (CHARACTERP (XCAR (gc))						\
+      && RANGED_INTEGERP (0, XCDR (gc), MAX_FACE_ID))			\
+   : (RANGED_INTEGERP							\
+      (0, gc,								\
+       (MAX_FACE_ID < TYPE_MAXIMUM (EMACS_INT) >> CHARACTERBITS		\
+	? ((EMACS_INT) MAX_FACE_ID << CHARACTERBITS) | MAX_CHAR		\
+	: TYPE_MAXIMUM (EMACS_INT)))))
 
-#define GLYPH_CODE_FACE(gc) \
-  (CONSP (gc) ? XINT (XCDR (gc)) : INTEGERP (gc) ? (XINT (gc) >> CHARACTERBITS) : DEFAULT_FACE_ID)
+/* The following are valid only if GLYPH_CODE_P (gc).  */
 
-/* Return 1 if glyph code from display vector contains valid character code.  */
-#define GLYPH_CODE_CHAR_VALID_P(gc) CHAR_VALID_P (GLYPH_CODE_CHAR (gc))
+#define GLYPH_CODE_CHAR(gc) \
+  (CONSP (gc) ? XINT (XCAR (gc)) : XINT (gc) & ((1 << CHARACTERBITS) - 1))
 
-#define GLYPH_CODE_P(gc) ((CONSP (gc) && INTEGERP (XCAR (gc)) && INTEGERP (XCDR (gc))) || INTEGERP (gc))
+#define GLYPH_CODE_FACE(gc) \
+  (CONSP (gc) ? XINT (XCDR (gc)) : XINT (gc) >> CHARACTERBITS)
 
-/* Only called when GLYPH_CODE_P (gc) is true.  */
 #define SET_GLYPH_FROM_GLYPH_CODE(glyph, gc)				\
   do									\
     {									\
@@ -1697,7 +1707,9 @@ typedef struct {
 #define RANGED_INTEGERP(lo, x, hi) \
   (INTEGERP (x) && (lo) <= XINT (x) && XINT (x) <= (hi))
 #define TYPE_RANGED_INTEGERP(type, x) \
-  RANGED_INTEGERP (TYPE_MINIMUM (type), x, TYPE_MAXIMUM (type))
+  (TYPE_SIGNED (type)							\
+   ? RANGED_INTEGERP (TYPE_MINIMUM (type), x, TYPE_MAXIMUM (type))	\
+   : RANGED_INTEGERP (0, x, TYPE_MAXIMUM (type)))
 
 #define INTEGERP(x) (LISP_INT_TAG_P (XTYPE ((x))))
 #define SYMBOLP(x) (XTYPE ((x)) == Lisp_Symbol)
@@ -1820,6 +1832,25 @@ typedef struct {
 #define CHECK_NATNUM(x) \
   CHECK_TYPE (NATNUMP (x), Qwholenump, x)
 
+#define CHECK_RANGED_INTEGER(lo, x, hi)					\
+  do {									\
+    CHECK_NUMBER (x);							\
+    if (! ((lo) <= XINT (x) && XINT (x) <= (hi)))			\
+      args_out_of_range_3						\
+	(x,								\
+	 make_number ((lo) < 0 && (lo) < MOST_NEGATIVE_FIXNUM		\
+		      ? MOST_NEGATIVE_FIXNUM				\
+		      : (lo)),						\
+	 make_number (min (hi, MOST_POSITIVE_FIXNUM)));			\
+  } while (0)
+#define CHECK_TYPE_RANGED_INTEGER(type, x) \
+  do {									\
+    if (TYPE_SIGNED (type))						\
+      CHECK_RANGED_INTEGER (TYPE_MINIMUM (type), x, TYPE_MAXIMUM (type)); \
+    else								\
+      CHECK_RANGED_INTEGER (0, x, TYPE_MAXIMUM (type));			\
+  } while (0)
+
 #define CHECK_MARKER(x) \
   CHECK_TYPE (MARKERP (x), Qmarkerp, x)
 
@@ -2031,9 +2062,9 @@ struct specbinding
 
 extern struct specbinding *specpdl;
 extern struct specbinding *specpdl_ptr;
-extern EMACS_INT specpdl_size;
+extern ptrdiff_t specpdl_size;
 
-#define SPECPDL_INDEX()	((int) (specpdl_ptr - specpdl))
+#define SPECPDL_INDEX()	(specpdl_ptr - specpdl)
 
 /* Everything needed to describe an active condition case.  */
 struct handler
@@ -2086,8 +2117,8 @@ struct catchtag
   jmp_buf jmp;
   struct backtrace *backlist;
   struct handler *handlerlist;
-  int lisp_eval_depth;
-  int pdlcount;
+  EMACS_INT lisp_eval_depth;
+  ptrdiff_t pdlcount;
   int poll_suppress_count;
   int interrupt_input_blocked;
   struct byte_stack *byte_stack;
@@ -2511,8 +2542,8 @@ EXFUN (Fread_coding_system, 2);
 EXFUN (Fread_non_nil_coding_system, 1);
 EXFUN (Ffind_operation_coding_system, MANY);
 EXFUN (Fdecode_coding_string, 4);
-extern Lisp_Object detect_coding_system (const unsigned char *, EMACS_INT,
-                                         EMACS_INT, int, int, Lisp_Object);
+extern Lisp_Object detect_coding_system (const unsigned char *, ptrdiff_t,
+                                         ptrdiff_t, int, int, Lisp_Object);
 extern void init_coding (void);
 extern void init_coding_once (void);
 extern void syms_of_coding (void);
@@ -2520,8 +2551,8 @@ extern void syms_of_coding (void);
 /* Defined in character.c */
 EXFUN (Fchar_width, 1);
 EXFUN (Fstring, MANY);
-extern EMACS_INT chars_in_text (const unsigned char *, EMACS_INT);
-extern EMACS_INT multibyte_chars_in_text (const unsigned char *, EMACS_INT);
+extern ptrdiff_t chars_in_text (const unsigned char *, ptrdiff_t);
+extern ptrdiff_t multibyte_chars_in_text (const unsigned char *, ptrdiff_t);
 extern int multibyte_char_to_unibyte (int);
 extern int multibyte_char_to_unibyte_safe (int);
 extern void init_character_once (void);
@@ -2548,7 +2579,7 @@ extern void syms_of_syntax (void);
 extern Lisp_Object QCrehash_size, QCrehash_threshold;
 enum { NEXT_ALMOST_PRIME_LIMIT = 11 };
 extern EMACS_INT next_almost_prime (EMACS_INT);
-extern Lisp_Object larger_vector (Lisp_Object, EMACS_INT, Lisp_Object);
+extern Lisp_Object larger_vector (Lisp_Object, ptrdiff_t, ptrdiff_t);
 extern void sweep_weak_hash_tables (void);
 extern Lisp_Object Qcursor_in_echo_area;
 extern Lisp_Object Qstring_lessp;
@@ -2580,8 +2611,8 @@ EXFUN (Fstring_as_multibyte, 1);
 EXFUN (Fstring_as_unibyte, 1);
 EXFUN (Fstring_to_multibyte, 1);
 EXFUN (Fsubstring, 3);
-extern Lisp_Object substring_both (Lisp_Object, EMACS_INT, EMACS_INT,
-				   EMACS_INT, EMACS_INT);
+extern Lisp_Object substring_both (Lisp_Object, ptrdiff_t, ptrdiff_t,
+				   ptrdiff_t, ptrdiff_t);
 EXFUN (Fnth, 2);
 EXFUN (Fnthcdr, 2);
 EXFUN (Fmemq, 2);
@@ -2609,8 +2640,8 @@ extern Lisp_Object nconc2 (Lisp_Object, Lisp_Object);
 extern Lisp_Object assq_no_quit (Lisp_Object, Lisp_Object);
 extern Lisp_Object assoc_no_quit (Lisp_Object, Lisp_Object);
 extern void clear_string_char_byte_cache (void);
-extern EMACS_INT string_char_to_byte (Lisp_Object, EMACS_INT);
-extern EMACS_INT string_byte_to_char (Lisp_Object, EMACS_INT);
+extern ptrdiff_t string_char_to_byte (Lisp_Object, ptrdiff_t);
+extern ptrdiff_t string_byte_to_char (Lisp_Object, ptrdiff_t);
 extern Lisp_Object string_to_multibyte (Lisp_Object);
 extern Lisp_Object string_make_unibyte (Lisp_Object);
 EXFUN (Fcopy_alist, 1);
@@ -2648,48 +2679,48 @@ extern void init_image (void);
 
 /* Defined in insdel.c */
 extern Lisp_Object Qinhibit_modification_hooks;
-extern void move_gap (EMACS_INT);
-extern void move_gap_both (EMACS_INT, EMACS_INT);
+extern void move_gap (ptrdiff_t);
+extern void move_gap_both (ptrdiff_t, ptrdiff_t);
 extern void buffer_overflow (void) NO_RETURN;
-extern void make_gap (EMACS_INT);
-extern EMACS_INT copy_text (const unsigned char *, unsigned char *,
-			    EMACS_INT, int, int);
+extern void make_gap (ptrdiff_t);
+extern ptrdiff_t copy_text (const unsigned char *, unsigned char *,
+			    ptrdiff_t, int, int);
 extern int count_combining_before (const unsigned char *,
-				   EMACS_INT, EMACS_INT, EMACS_INT);
+				   ptrdiff_t, ptrdiff_t, ptrdiff_t);
 extern int count_combining_after (const unsigned char *,
-				  EMACS_INT, EMACS_INT, EMACS_INT);
-extern void insert (const char *, EMACS_INT);
-extern void insert_and_inherit (const char *, EMACS_INT);
-extern void insert_1 (const char *, EMACS_INT, int, int, int);
-extern void insert_1_both (const char *, EMACS_INT, EMACS_INT,
+				  ptrdiff_t, ptrdiff_t, ptrdiff_t);
+extern void insert (const char *, ptrdiff_t);
+extern void insert_and_inherit (const char *, ptrdiff_t);
+extern void insert_1 (const char *, ptrdiff_t, int, int, int);
+extern void insert_1_both (const char *, ptrdiff_t, ptrdiff_t,
 			   int, int, int);
-extern void insert_from_gap (EMACS_INT, EMACS_INT);
-extern void insert_from_string (Lisp_Object, EMACS_INT, EMACS_INT,
-				EMACS_INT, EMACS_INT, int);
-extern void insert_from_buffer (struct buffer *, EMACS_INT, EMACS_INT, int);
+extern void insert_from_gap (ptrdiff_t, ptrdiff_t);
+extern void insert_from_string (Lisp_Object, ptrdiff_t, ptrdiff_t,
+				ptrdiff_t, ptrdiff_t, int);
+extern void insert_from_buffer (struct buffer *, ptrdiff_t, ptrdiff_t, int);
 extern void insert_char (int);
 extern void insert_string (const char *);
-extern void insert_before_markers (const char *, EMACS_INT);
-extern void insert_before_markers_and_inherit (const char *, EMACS_INT);
-extern void insert_from_string_before_markers (Lisp_Object, EMACS_INT,
-					       EMACS_INT, EMACS_INT,
-					       EMACS_INT, int);
-extern void del_range (EMACS_INT, EMACS_INT);
-extern Lisp_Object del_range_1 (EMACS_INT, EMACS_INT, int, int);
-extern void del_range_byte (EMACS_INT, EMACS_INT, int);
-extern void del_range_both (EMACS_INT, EMACS_INT, EMACS_INT, EMACS_INT, int);
-extern Lisp_Object del_range_2 (EMACS_INT, EMACS_INT,
-				EMACS_INT, EMACS_INT, int);
-extern void modify_region (struct buffer *, EMACS_INT, EMACS_INT, int);
-extern void prepare_to_modify_buffer (EMACS_INT, EMACS_INT, EMACS_INT *);
-extern void signal_after_change (EMACS_INT, EMACS_INT, EMACS_INT);
-extern void adjust_after_insert (EMACS_INT, EMACS_INT, EMACS_INT,
-				 EMACS_INT, EMACS_INT);
-extern void adjust_markers_for_delete (EMACS_INT, EMACS_INT,
-				       EMACS_INT, EMACS_INT);
-extern void replace_range (EMACS_INT, EMACS_INT, Lisp_Object, int, int, int);
-extern void replace_range_2 (EMACS_INT, EMACS_INT, EMACS_INT, EMACS_INT,
-			     const char *, EMACS_INT, EMACS_INT, int);
+extern void insert_before_markers (const char *, ptrdiff_t);
+extern void insert_before_markers_and_inherit (const char *, ptrdiff_t);
+extern void insert_from_string_before_markers (Lisp_Object, ptrdiff_t,
+					       ptrdiff_t, ptrdiff_t,
+					       ptrdiff_t, int);
+extern void del_range (ptrdiff_t, ptrdiff_t);
+extern Lisp_Object del_range_1 (ptrdiff_t, ptrdiff_t, int, int);
+extern void del_range_byte (ptrdiff_t, ptrdiff_t, int);
+extern void del_range_both (ptrdiff_t, ptrdiff_t, ptrdiff_t, ptrdiff_t, int);
+extern Lisp_Object del_range_2 (ptrdiff_t, ptrdiff_t,
+				ptrdiff_t, ptrdiff_t, int);
+extern void modify_region (struct buffer *, ptrdiff_t, ptrdiff_t, int);
+extern void prepare_to_modify_buffer (ptrdiff_t, ptrdiff_t, ptrdiff_t *);
+extern void signal_after_change (ptrdiff_t, ptrdiff_t, ptrdiff_t);
+extern void adjust_after_insert (ptrdiff_t, ptrdiff_t, ptrdiff_t,
+				 ptrdiff_t, ptrdiff_t);
+extern void adjust_markers_for_delete (ptrdiff_t, ptrdiff_t,
+				       ptrdiff_t, ptrdiff_t);
+extern void replace_range (ptrdiff_t, ptrdiff_t, Lisp_Object, int, int, int);
+extern void replace_range_2 (ptrdiff_t, ptrdiff_t, ptrdiff_t, ptrdiff_t,
+			     const char *, ptrdiff_t, ptrdiff_t, int);
 extern void syms_of_insdel (void);
 
 /* Defined in dispnew.c */
@@ -2697,6 +2728,7 @@ extern Lisp_Object selected_frame;
 extern Lisp_Object Vwindow_system;
 EXFUN (Fding, 1);
 EXFUN (Fredraw_frame, 1);
+void duration_to_sec_usec (double, int *, int *);
 EXFUN (Fsleep_for, 2);
 EXFUN (Fredisplay, 1);
 extern Lisp_Object sit_for (Lisp_Object, int, int);
@@ -2718,7 +2750,7 @@ extern Lisp_Object QCdata, QCfile;
 extern Lisp_Object QCmap;
 extern Lisp_Object Qrisky_local_variable;
 extern struct frame *last_glyphless_glyph_frame;
-extern unsigned last_glyphless_glyph_face_id;
+extern int last_glyphless_glyph_face_id;
 extern int last_glyphless_glyph_merged_face_id;
 extern int noninteractive_need_newline;
 extern Lisp_Object echo_area_buffer[2];
@@ -2734,15 +2766,15 @@ extern void clear_message (int, int);
 extern void message (const char *, ...) ATTRIBUTE_FORMAT_PRINTF (1, 2);
 extern void message1 (const char *);
 extern void message1_nolog (const char *);
-extern void message2 (const char *, EMACS_INT, int);
-extern void message2_nolog (const char *, EMACS_INT, int);
-extern void message3 (Lisp_Object, EMACS_INT, int);
-extern void message3_nolog (Lisp_Object, EMACS_INT, int);
-extern void message_dolog (const char *, EMACS_INT, int, int);
+extern void message2 (const char *, ptrdiff_t, int);
+extern void message2_nolog (const char *, ptrdiff_t, int);
+extern void message3 (Lisp_Object, ptrdiff_t, int);
+extern void message3_nolog (Lisp_Object, ptrdiff_t, int);
+extern void message_dolog (const char *, ptrdiff_t, int, int);
 extern void message_with_string (const char *, Lisp_Object, int);
 extern void message_log_maybe_newline (void);
 extern void update_echo_area (void);
-extern void truncate_echo_area (EMACS_INT);
+extern void truncate_echo_area (ptrdiff_t);
 extern void redisplay (void);
 extern void redisplay_preserve_echo_area (int);
 extern void prepare_menu_bars (void);
@@ -2751,7 +2783,7 @@ void set_frame_cursor_types (struct frame *, Lisp_Object);
 extern void syms_of_xdisp (void);
 extern void init_xdisp (void);
 extern Lisp_Object safe_eval (Lisp_Object);
-extern int pos_visible_p (struct window *, EMACS_INT, int *,
+extern int pos_visible_p (struct window *, ptrdiff_t, int *,
                           int *, int *, int *, int *, int *);
 
 /* Defined in xsettings.c */
@@ -2767,7 +2799,7 @@ extern void reset_malloc_hooks (void);
 extern void uninterrupt_malloc (void);
 extern void malloc_warning (const char *);
 extern void memory_full (size_t) NO_RETURN;
-extern void buffer_memory_full (EMACS_INT) NO_RETURN;
+extern void buffer_memory_full (ptrdiff_t) NO_RETURN;
 extern int survives_gc_p (Lisp_Object);
 extern void mark_object (Lisp_Object);
 #if defined REL_ALLOC && !defined SYSTEM_MALLOC
@@ -2792,26 +2824,26 @@ EXFUN (Fmake_marker, 0);
 extern void string_overflow (void) NO_RETURN;
 EXFUN (Fmake_string, 2);
 extern Lisp_Object build_string (const char *);
-extern Lisp_Object make_string (const char *, EMACS_INT);
-extern Lisp_Object make_unibyte_string (const char *, EMACS_INT);
-extern Lisp_Object make_multibyte_string (const char *, EMACS_INT, EMACS_INT);
+extern Lisp_Object make_string (const char *, ptrdiff_t);
+extern Lisp_Object make_unibyte_string (const char *, ptrdiff_t);
+extern Lisp_Object make_multibyte_string (const char *, ptrdiff_t, ptrdiff_t);
 extern Lisp_Object make_event_array (int, Lisp_Object *);
 extern Lisp_Object make_uninit_string (EMACS_INT);
 extern Lisp_Object make_uninit_multibyte_string (EMACS_INT, EMACS_INT);
-extern Lisp_Object make_string_from_bytes (const char *, EMACS_INT, EMACS_INT);
+extern Lisp_Object make_string_from_bytes (const char *, ptrdiff_t, ptrdiff_t);
 extern Lisp_Object make_specified_string (const char *,
-					  EMACS_INT, EMACS_INT, int);
+					  ptrdiff_t, ptrdiff_t, int);
 EXFUN (Fpurecopy, 1);
-extern Lisp_Object make_pure_string (const char *, EMACS_INT, EMACS_INT, int);
+extern Lisp_Object make_pure_string (const char *, ptrdiff_t, ptrdiff_t, int);
 extern Lisp_Object make_pure_c_string (const char *data);
 extern Lisp_Object pure_cons (Lisp_Object, Lisp_Object);
-extern Lisp_Object make_pure_vector (EMACS_INT);
+extern Lisp_Object make_pure_vector (ptrdiff_t);
 EXFUN (Fgarbage_collect, 0);
 EXFUN (Fmake_byte_code, MANY);
 EXFUN (Fmake_bool_vector, 2);
 extern Lisp_Object Qchar_table_extra_slots;
 extern struct Lisp_Vector *allocate_vector (EMACS_INT);
-extern struct Lisp_Vector *allocate_pseudovector (int memlen, int lisplen, EMACS_INT tag);
+extern struct Lisp_Vector *allocate_pseudovector (int memlen, int lisplen, int tag);
 #define ALLOCATE_PSEUDOVECTOR(typ,field,tag)				\
   ((typ*)								\
    allocate_pseudovector						\
@@ -2825,7 +2857,7 @@ extern int gc_in_progress;
 extern int abort_on_gc;
 extern Lisp_Object make_float (double);
 extern void display_malloc_warning (void);
-extern int inhibit_garbage_collection (void);
+extern ptrdiff_t inhibit_garbage_collection (void);
 extern Lisp_Object make_save_value (void *, ptrdiff_t);
 extern void free_marker (Lisp_Object);
 extern void free_cons (struct Lisp_Cons *);
@@ -2909,7 +2941,7 @@ EXFUN (Fread_event, 3);
 extern Lisp_Object check_obarray (Lisp_Object);
 extern Lisp_Object intern (const char *);
 extern Lisp_Object intern_c_string (const char *);
-extern Lisp_Object oblookup (Lisp_Object, const char *, EMACS_INT, EMACS_INT);
+extern Lisp_Object oblookup (Lisp_Object, const char *, ptrdiff_t, ptrdiff_t);
 #define LOADHIST_ATTACH(x) \
   do {									\
     if (initialized) Vcurrent_load_list = Fcons (x, Vcurrent_load_list); \
@@ -2985,7 +3017,7 @@ extern Lisp_Object internal_condition_case_2 (Lisp_Object (*) (Lisp_Object, Lisp
 extern Lisp_Object internal_condition_case_n (Lisp_Object (*) (ptrdiff_t, Lisp_Object *), ptrdiff_t, Lisp_Object *, Lisp_Object, Lisp_Object (*) (Lisp_Object));
 extern void specbind (Lisp_Object, Lisp_Object);
 extern void record_unwind_protect (Lisp_Object (*) (Lisp_Object), Lisp_Object);
-extern Lisp_Object unbind_to (int, Lisp_Object);
+extern Lisp_Object unbind_to (ptrdiff_t, Lisp_Object);
 extern void error (const char *, ...) NO_RETURN ATTRIBUTE_FORMAT_PRINTF (1, 2);
 extern void verror (const char *, va_list)
   NO_RETURN ATTRIBUTE_FORMAT_PRINTF (1, 0);
@@ -3037,10 +3069,9 @@ EXFUN (Fuser_login_name, 1);
 EXFUN (Fsystem_name, 0);
 EXFUN (Fcurrent_time, 0);
 EXFUN (Fget_internal_run_time, 0);
-extern EMACS_INT clip_to_bounds (EMACS_INT, EMACS_INT, EMACS_INT);
-extern Lisp_Object make_buffer_string (EMACS_INT, EMACS_INT, int);
-extern Lisp_Object make_buffer_string_both (EMACS_INT, EMACS_INT, EMACS_INT,
-					    EMACS_INT, int);
+extern Lisp_Object make_buffer_string (ptrdiff_t, ptrdiff_t, int);
+extern Lisp_Object make_buffer_string_both (ptrdiff_t, ptrdiff_t, ptrdiff_t,
+					    ptrdiff_t, int);
 extern void init_editfns (void);
 const char *get_system_name (void);
 extern void syms_of_editfns (void);
@@ -3054,12 +3085,12 @@ extern void nsberror (Lisp_Object) NO_RETURN;
 EXFUN (Fset_buffer_multibyte, 1);
 EXFUN (Foverlay_start, 1);
 EXFUN (Foverlay_end, 1);
-extern void adjust_overlays_for_insert (EMACS_INT, EMACS_INT);
-extern void adjust_overlays_for_delete (EMACS_INT, EMACS_INT);
-extern void fix_start_end_in_overlays (EMACS_INT, EMACS_INT);
+extern void adjust_overlays_for_insert (ptrdiff_t, ptrdiff_t);
+extern void adjust_overlays_for_delete (ptrdiff_t, ptrdiff_t);
+extern void fix_start_end_in_overlays (ptrdiff_t, ptrdiff_t);
 extern void report_overlay_modification (Lisp_Object, Lisp_Object, int,
                                          Lisp_Object, Lisp_Object, Lisp_Object);
-extern int overlay_touches_p (EMACS_INT);
+extern int overlay_touches_p (ptrdiff_t);
 extern Lisp_Object Vbuffer_alist;
 EXFUN (Fget_buffer, 1);
 EXFUN (Fget_buffer_create, 1);
@@ -3093,17 +3124,17 @@ EXFUN (Fmarker_position, 1);
 EXFUN (Fmarker_buffer, 1);
 EXFUN (Fcopy_marker, 2);
 EXFUN (Fset_marker, 3);
-extern EMACS_INT marker_position (Lisp_Object);
-extern EMACS_INT marker_byte_position (Lisp_Object);
+extern ptrdiff_t marker_position (Lisp_Object);
+extern ptrdiff_t marker_byte_position (Lisp_Object);
 extern void clear_charpos_cache (struct buffer *);
-extern EMACS_INT charpos_to_bytepos (EMACS_INT);
-extern EMACS_INT buf_charpos_to_bytepos (struct buffer *, EMACS_INT);
-extern EMACS_INT buf_bytepos_to_charpos (struct buffer *, EMACS_INT);
+extern ptrdiff_t charpos_to_bytepos (ptrdiff_t);
+extern ptrdiff_t buf_charpos_to_bytepos (struct buffer *, ptrdiff_t);
+extern ptrdiff_t buf_bytepos_to_charpos (struct buffer *, ptrdiff_t);
 extern void unchain_marker (struct Lisp_Marker *marker);
 extern Lisp_Object set_marker_restricted (Lisp_Object, Lisp_Object, Lisp_Object);
-extern Lisp_Object set_marker_both (Lisp_Object, Lisp_Object, EMACS_INT, EMACS_INT);
+extern Lisp_Object set_marker_both (Lisp_Object, Lisp_Object, ptrdiff_t, ptrdiff_t);
 extern Lisp_Object set_marker_restricted_both (Lisp_Object, Lisp_Object,
-                                               EMACS_INT, EMACS_INT);
+                                               ptrdiff_t, ptrdiff_t);
 extern void syms_of_marker (void);
 
 /* Defined in fileio.c */
@@ -3156,18 +3187,18 @@ struct re_registers;
 extern struct re_pattern_buffer *compile_pattern (Lisp_Object,
 						  struct re_registers *,
 						  Lisp_Object, int, int);
-extern EMACS_INT fast_string_match (Lisp_Object, Lisp_Object);
-extern EMACS_INT fast_c_string_match_ignore_case (Lisp_Object, const char *);
-extern EMACS_INT fast_string_match_ignore_case (Lisp_Object, Lisp_Object);
-extern EMACS_INT fast_looking_at (Lisp_Object, EMACS_INT, EMACS_INT,
-                                  EMACS_INT, EMACS_INT, Lisp_Object);
-extern EMACS_INT scan_buffer (int, EMACS_INT, EMACS_INT, EMACS_INT,
-			      EMACS_INT *, int);
-extern EMACS_INT scan_newline (EMACS_INT, EMACS_INT, EMACS_INT, EMACS_INT,
+extern ptrdiff_t fast_string_match (Lisp_Object, Lisp_Object);
+extern ptrdiff_t fast_c_string_match_ignore_case (Lisp_Object, const char *);
+extern ptrdiff_t fast_string_match_ignore_case (Lisp_Object, Lisp_Object);
+extern ptrdiff_t fast_looking_at (Lisp_Object, ptrdiff_t, ptrdiff_t,
+                                  ptrdiff_t, ptrdiff_t, Lisp_Object);
+extern ptrdiff_t scan_buffer (int, ptrdiff_t, ptrdiff_t, ptrdiff_t,
+			      ptrdiff_t *, int);
+extern EMACS_INT scan_newline (ptrdiff_t, ptrdiff_t, ptrdiff_t, ptrdiff_t,
 			       EMACS_INT, int);
-extern EMACS_INT find_next_newline (EMACS_INT, int);
-extern EMACS_INT find_next_newline_no_quit (EMACS_INT, EMACS_INT);
-extern EMACS_INT find_before_next_newline (EMACS_INT, EMACS_INT, EMACS_INT);
+extern ptrdiff_t find_next_newline (ptrdiff_t, int);
+extern ptrdiff_t find_next_newline_no_quit (ptrdiff_t, ptrdiff_t);
+extern ptrdiff_t find_before_next_newline (ptrdiff_t, ptrdiff_t, ptrdiff_t);
 extern void syms_of_search (void);
 extern void clear_regexp_cache (void);
 
@@ -3253,9 +3284,9 @@ extern void keys_of_keyboard (void);
 EXFUN (Fvertical_motion, 2);
 EXFUN (Findent_to, 2);
 EXFUN (Fmove_to_column, 2);
-extern EMACS_INT current_column (void);
+extern ptrdiff_t current_column (void);
 extern void invalidate_current_column (void);
-extern int indented_beyond_p (EMACS_INT, EMACS_INT, EMACS_INT);
+extern int indented_beyond_p (ptrdiff_t, ptrdiff_t, EMACS_INT);
 extern void syms_of_indent (void);
 
 /* Defined in frame.c */
@@ -3386,12 +3417,12 @@ extern Lisp_Object Qapply;
 extern Lisp_Object Qinhibit_read_only;
 EXFUN (Fundo_boundary, 0);
 extern void truncate_undo_list (struct buffer *);
-extern void record_marker_adjustment (Lisp_Object, EMACS_INT);
-extern void record_insert (EMACS_INT, EMACS_INT);
-extern void record_delete (EMACS_INT, Lisp_Object);
+extern void record_marker_adjustment (Lisp_Object, ptrdiff_t);
+extern void record_insert (ptrdiff_t, ptrdiff_t);
+extern void record_delete (ptrdiff_t, Lisp_Object);
 extern void record_first_change (void);
-extern void record_change (EMACS_INT, EMACS_INT);
-extern void record_property_change (EMACS_INT, EMACS_INT,
+extern void record_change (ptrdiff_t, ptrdiff_t);
+extern void record_property_change (ptrdiff_t, ptrdiff_t,
 				    Lisp_Object, Lisp_Object,
                                     Lisp_Object);
 extern void syms_of_undo (void);
@@ -3437,8 +3468,8 @@ extern void init_sys_modes (struct tty_display_info *);
 extern void reset_sys_modes (struct tty_display_info *);
 extern void init_all_sys_modes (void);
 extern void reset_all_sys_modes (void);
-extern void wait_for_termination (int);
-extern void interruptible_wait_for_termination (int);
+extern void wait_for_termination (pid_t);
+extern void interruptible_wait_for_termination (pid_t);
 extern void flush_pending_output (int);
 extern void child_setup_tty (int);
 extern void setup_pty (int);
@@ -3447,8 +3478,8 @@ extern EMACS_INT get_random (void);
 extern void seed_random (long);
 extern int emacs_open (const char *, int, int);
 extern int emacs_close (int);
-extern EMACS_INT emacs_read (int, char *, EMACS_INT);
-extern EMACS_INT emacs_write (int, const char *, EMACS_INT);
+extern ptrdiff_t emacs_read (int, char *, ptrdiff_t);
+extern ptrdiff_t emacs_write (int, const char *, ptrdiff_t);
 enum { READLINK_BUFSIZE = 1024 };
 extern char *emacs_readlink (const char *, char [READLINK_BUFSIZE]);
 
@@ -3674,7 +3705,7 @@ extern void init_system_name (void);
 extern Lisp_Object safe_alloca_unwind (Lisp_Object);
 
 #define USE_SAFE_ALLOCA			\
-  int sa_count = (int) SPECPDL_INDEX (), sa_must_free = 0
+  ptrdiff_t sa_count = SPECPDL_INDEX (); int sa_must_free = 0
 
 /* SAFE_ALLOCA allocates a simple buffer.  */
 
diff --git a/src/lread.c b/src/lread.c
index 11c4cf8c8f4..3a1b3f0c9c5 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -109,9 +109,9 @@ static FILE *instream;
 static int read_pure;
 
 /* For use within read-from-string (this reader is non-reentrant!!)  */
-static EMACS_INT read_from_string_index;
-static EMACS_INT read_from_string_index_byte;
-static EMACS_INT read_from_string_limit;
+static ptrdiff_t read_from_string_index;
+static ptrdiff_t read_from_string_index_byte;
+static ptrdiff_t read_from_string_limit;
 
 /* Number of characters read in the current call to Fread or
    Fread_from_string. */
@@ -209,7 +209,7 @@ readchar (Lisp_Object readcharfun, int *multibyte)
     {
       register struct buffer *inbuffer = XBUFFER (readcharfun);
 
-      EMACS_INT pt_byte = BUF_PT_BYTE (inbuffer);
+      ptrdiff_t pt_byte = BUF_PT_BYTE (inbuffer);
 
       if (pt_byte >= BUF_ZV_BYTE (inbuffer))
 	return -1;
@@ -238,7 +238,7 @@ readchar (Lisp_Object readcharfun, int *multibyte)
     {
       register struct buffer *inbuffer = XMARKER (readcharfun)->buffer;
 
-      EMACS_INT bytepos = marker_byte_position (readcharfun);
+      ptrdiff_t bytepos = marker_byte_position (readcharfun);
 
       if (bytepos >= BUF_ZV_BYTE (inbuffer))
 	return -1;
@@ -372,8 +372,8 @@ unreadchar (Lisp_Object readcharfun, int c)
   else if (BUFFERP (readcharfun))
     {
       struct buffer *b = XBUFFER (readcharfun);
-      EMACS_INT charpos = BUF_PT (b);
-      EMACS_INT bytepos = BUF_PT_BYTE (b);
+      ptrdiff_t charpos = BUF_PT (b);
+      ptrdiff_t bytepos = BUF_PT_BYTE (b);
 
       if (! NILP (BVAR (b, enable_multibyte_characters)))
 	BUF_DEC_POS (b, bytepos);
@@ -385,7 +385,7 @@ unreadchar (Lisp_Object readcharfun, int c)
   else if (MARKERP (readcharfun))
     {
       struct buffer *b = XMARKER (readcharfun)->buffer;
-      EMACS_INT bytepos = XMARKER (readcharfun)->bytepos;
+      ptrdiff_t bytepos = XMARKER (readcharfun)->bytepos;
 
       XMARKER (readcharfun)->charpos--;
       if (! NILP (BVAR (b, enable_multibyte_characters)))
@@ -1023,7 +1023,7 @@ Return t if the file exists and loads successfully.  */)
 {
   register FILE *stream;
   register int fd = -1;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3;
   Lisp_Object found, efound, hist_file_name;
   /* 1 means we printed the ".el is newer" message.  */
@@ -1443,16 +1443,16 @@ int
 openp (Lisp_Object path, Lisp_Object str, Lisp_Object suffixes, Lisp_Object *storeptr, Lisp_Object predicate)
 {
   register int fd;
-  EMACS_INT fn_size = 100;
+  ptrdiff_t fn_size = 100;
   char buf[100];
   register char *fn = buf;
   int absolute = 0;
-  EMACS_INT want_length;
+  ptrdiff_t want_length;
   Lisp_Object filename;
   struct stat st;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5, gcpro6;
   Lisp_Object string, tail, encoded_fn;
-  EMACS_INT max_suffix_len = 0;
+  ptrdiff_t max_suffix_len = 0;
 
   CHECK_STRING (str);
 
@@ -1562,7 +1562,9 @@ openp (Lisp_Object path, Lisp_Object str, Lisp_Object suffixes, Lisp_Object *sto
 		{
 		  /* Check that we can access or open it.  */
 		  if (NATNUMP (predicate))
-		    fd = (access (pfn, XFASTINT (predicate)) == 0) ? 1 : -1;
+		    fd = (((XFASTINT (predicate) & ~INT_MAX) == 0
+			   && access (pfn, XFASTINT (predicate)) == 0)
+			  ? 1 : -1);
 		  else
 		    fd = emacs_open (pfn, O_RDONLY, 0);
 
@@ -1696,7 +1698,7 @@ readevalloop (Lisp_Object readcharfun,
 {
   register int c;
   register Lisp_Object val;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
   struct buffer *b = 0;
   int continue_reading_p;
@@ -1747,7 +1749,7 @@ readevalloop (Lisp_Object readcharfun,
   continue_reading_p = 1;
   while (continue_reading_p)
     {
-      int count1 = SPECPDL_INDEX ();
+      ptrdiff_t count1 = SPECPDL_INDEX ();
 
       if (b != 0 && NILP (BVAR (b, name)))
 	error ("Reading from killed buffer");
@@ -1873,7 +1875,7 @@ DO-ALLOW-PRINT, if non-nil, specifies that `print' and related
 This function preserves the position of point.  */)
   (Lisp_Object buffer, Lisp_Object printflag, Lisp_Object filename, Lisp_Object unibyte, Lisp_Object do_allow_print)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object tem, buf;
 
   if (NILP (buffer))
@@ -1918,7 +1920,7 @@ This function does not move point.  */)
   (Lisp_Object start, Lisp_Object end, Lisp_Object printflag, Lisp_Object read_function)
 {
   /* FIXME: Do the eval-sexp-add-defvars danse!  */
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object tem, cbuf;
 
   cbuf = Fcurrent_buffer ();
@@ -1994,7 +1996,7 @@ read_internal_start (Lisp_Object stream, Lisp_Object start, Lisp_Object end)
   if (STRINGP (stream)
       || ((CONSP (stream) && STRINGP (XCAR (stream)))))
     {
-      EMACS_INT startval, endval;
+      ptrdiff_t startval, endval;
       Lisp_Object string;
 
       if (STRINGP (stream))
@@ -2007,9 +2009,9 @@ read_internal_start (Lisp_Object stream, Lisp_Object start, Lisp_Object end)
       else
 	{
 	  CHECK_NUMBER (end);
-	  endval = XINT (end);
-	  if (endval < 0 || endval > SCHARS (string))
+	  if (! (0 <= XINT (end) && XINT (end) <= SCHARS (string)))
 	    args_out_of_range (string, end);
+	  endval = XINT (end);
 	}
 
       if (NILP (start))
@@ -2017,9 +2019,9 @@ read_internal_start (Lisp_Object stream, Lisp_Object start, Lisp_Object end)
       else
 	{
 	  CHECK_NUMBER (start);
-	  startval = XINT (start);
-	  if (startval < 0 || startval > endval)
+	  if (! (0 <= XINT (start) && XINT (start) <= endval))
 	    args_out_of_range (string, start);
+	  startval = XINT (start);
 	}
       read_from_string_index = startval;
       read_from_string_index_byte = string_char_to_byte (string, startval);
@@ -2495,14 +2497,13 @@ read1 (register Lisp_Object readcharfun, int *pch, int first_in_list)
 	      if (c == '[')
 		{
 		  Lisp_Object tmp;
-		  EMACS_INT depth, size;
+		  int depth;
+		  ptrdiff_t size;
 
 		  tmp = read_vector (readcharfun, 0);
-		  if (!INTEGERP (AREF (tmp, 0)))
+		  if (! RANGED_INTEGERP (1, AREF (tmp, 0), 3))
 		    error ("Invalid depth in char-table");
 		  depth = XINT (AREF (tmp, 0));
-		  if (depth < 1 || depth > 3)
-		    error ("Invalid depth in char-table");
 		  size = ASIZE (tmp) - 2;
 		  if (chartab_size [depth] != size)
 		    error ("Invalid size char-table");
@@ -3099,8 +3100,8 @@ read1 (register Lisp_Object readcharfun, int *pch, int first_in_list)
 	  }
 	{
 	  Lisp_Object name, result;
-	  EMACS_INT nbytes = p - read_buffer;
-	  EMACS_INT nchars
+	  ptrdiff_t nbytes = p - read_buffer;
+	  ptrdiff_t nchars
 	    = (multibyte
 	       ? multibyte_chars_in_text ((unsigned char *) read_buffer,
 					  nbytes)
@@ -3885,7 +3886,7 @@ OBARRAY defaults to the value of the variable `obarray'.  */)
    Also store the bucket number in oblookup_last_bucket_number.  */
 
 Lisp_Object
-oblookup (Lisp_Object obarray, register const char *ptr, EMACS_INT size, EMACS_INT size_byte)
+oblookup (Lisp_Object obarray, register const char *ptr, ptrdiff_t size, ptrdiff_t size_byte)
 {
   size_t hash;
   size_t obsize;
diff --git a/src/macros.c b/src/macros.c
index 4ecf49834a1..4860308367d 100644
--- a/src/macros.c
+++ b/src/macros.c
@@ -95,13 +95,14 @@ macro before appending to it. */)
 	 has put another macro there.  */
       if (current_kboard->kbd_macro_bufsize < len + 30)
 	{
-	  if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (Lisp_Object) - 30
-	      < current_kboard->kbd_macro_bufsize)
+	  if (PTRDIFF_MAX < MOST_POSITIVE_FIXNUM + 30
+	      && PTRDIFF_MAX < len + 30)
 	    memory_full (SIZE_MAX);
-	  current_kboard->kbd_macro_buffer
-	    = (Lisp_Object *)xrealloc (current_kboard->kbd_macro_buffer,
-				       (len + 30) * sizeof (Lisp_Object));
-	  current_kboard->kbd_macro_bufsize = len + 30;
+	  current_kboard->kbd_macro_buffer =
+	    xpalloc (current_kboard->kbd_macro_buffer,
+		     &current_kboard->kbd_macro_bufsize,
+		     len + 30 - current_kboard->kbd_macro_bufsize, -1,
+		     sizeof *current_kboard->kbd_macro_buffer);
 	}
 
       /* Must convert meta modifier when copying string to vector.  */
@@ -301,7 +302,7 @@ each iteration of the macro.  Iteration stops if LOOPFUNC returns nil.  */)
 {
   Lisp_Object final;
   Lisp_Object tem;
-  int pdlcount = SPECPDL_INDEX ();
+  ptrdiff_t pdlcount = SPECPDL_INDEX ();
   EMACS_INT repeat = 1;
   struct gcpro gcpro1, gcpro2;
   EMACS_INT success_count = 0;
diff --git a/src/marker.c b/src/marker.c
index 675bbc5ad73..2b78282e693 100644
--- a/src/marker.c
+++ b/src/marker.c
@@ -26,12 +26,12 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 /* Record one cached position found recently by
    buf_charpos_to_bytepos or buf_bytepos_to_charpos.  */
 
-static EMACS_INT cached_charpos;
-static EMACS_INT cached_bytepos;
+static ptrdiff_t cached_charpos;
+static ptrdiff_t cached_bytepos;
 static struct buffer *cached_buffer;
 static int cached_modiff;
 
-static void byte_char_debug_check (struct buffer *, EMACS_INT, EMACS_INT);
+static void byte_char_debug_check (struct buffer *, ptrdiff_t, ptrdiff_t);
 
 void
 clear_charpos_cache (struct buffer *b)
@@ -55,12 +55,12 @@ clear_charpos_cache (struct buffer *b)
 
 #define CONSIDER(CHARPOS, BYTEPOS)					\
 {									\
-  EMACS_INT this_charpos = (CHARPOS);					\
+  ptrdiff_t this_charpos = (CHARPOS);					\
   int changed = 0;							\
 									\
   if (this_charpos == charpos)						\
     {									\
-      EMACS_INT value = (BYTEPOS);				       	\
+      ptrdiff_t value = (BYTEPOS);				       	\
       if (byte_debug_flag)						\
 	byte_char_debug_check (b, charpos, value);			\
       return value;							\
@@ -85,7 +85,7 @@ clear_charpos_cache (struct buffer *b)
     {									\
       if (best_above - best_below == best_above_byte - best_below_byte)	\
         {								\
-	  EMACS_INT value = best_below_byte + (charpos - best_below);	\
+	  ptrdiff_t value = best_below_byte + (charpos - best_below);	\
 	  if (byte_debug_flag)						\
 	    byte_char_debug_check (b, charpos, value);			\
 	  return value;							\
@@ -94,9 +94,9 @@ clear_charpos_cache (struct buffer *b)
 }
 
 static void
-byte_char_debug_check (struct buffer *b, EMACS_INT charpos, EMACS_INT bytepos)
+byte_char_debug_check (struct buffer *b, ptrdiff_t charpos, ptrdiff_t bytepos)
 {
-  EMACS_INT nchars = 0;
+  ptrdiff_t nchars = 0;
 
   if (bytepos > BUF_GPT_BYTE (b))
     {
@@ -113,18 +113,18 @@ byte_char_debug_check (struct buffer *b, EMACS_INT charpos, EMACS_INT bytepos)
     abort ();
 }
 
-EMACS_INT
-charpos_to_bytepos (EMACS_INT charpos)
+ptrdiff_t
+charpos_to_bytepos (ptrdiff_t charpos)
 {
   return buf_charpos_to_bytepos (current_buffer, charpos);
 }
 
-EMACS_INT
-buf_charpos_to_bytepos (struct buffer *b, EMACS_INT charpos)
+ptrdiff_t
+buf_charpos_to_bytepos (struct buffer *b, ptrdiff_t charpos)
 {
   struct Lisp_Marker *tail;
-  EMACS_INT best_above, best_above_byte;
-  EMACS_INT best_below, best_below_byte;
+  ptrdiff_t best_above, best_above_byte;
+  ptrdiff_t best_below, best_below_byte;
 
   if (charpos < BUF_BEG (b) || charpos > BUF_Z (b))
     abort ();
@@ -242,12 +242,12 @@ buf_charpos_to_bytepos (struct buffer *b, EMACS_INT charpos)
 /* Used for debugging: recompute the bytepos corresponding to CHARPOS
    in the simplest, most reliable way.  */
 
-extern EMACS_INT verify_bytepos (EMACS_INT charpos) EXTERNALLY_VISIBLE;
-EMACS_INT
-verify_bytepos (EMACS_INT charpos)
+extern ptrdiff_t verify_bytepos (ptrdiff_t charpos) EXTERNALLY_VISIBLE;
+ptrdiff_t
+verify_bytepos (ptrdiff_t charpos)
 {
-  EMACS_INT below = 1;
-  EMACS_INT below_byte = 1;
+  ptrdiff_t below = 1;
+  ptrdiff_t below_byte = 1;
 
   while (below != charpos)
     {
@@ -266,12 +266,12 @@ verify_bytepos (EMACS_INT charpos)
 
 #define CONSIDER(BYTEPOS, CHARPOS)					\
 {									\
-  EMACS_INT this_bytepos = (BYTEPOS);					\
+  ptrdiff_t this_bytepos = (BYTEPOS);					\
   int changed = 0;							\
 									\
   if (this_bytepos == bytepos)						\
     {									\
-      EMACS_INT value = (CHARPOS);				       	\
+      ptrdiff_t value = (CHARPOS);				       	\
       if (byte_debug_flag)						\
 	byte_char_debug_check (b, value, bytepos);			\
       return value;							\
@@ -296,7 +296,7 @@ verify_bytepos (EMACS_INT charpos)
     {									\
       if (best_above - best_below == best_above_byte - best_below_byte)	\
 	{								\
-	  EMACS_INT value = best_below + (bytepos - best_below_byte);	\
+	  ptrdiff_t value = best_below + (bytepos - best_below_byte);	\
 	  if (byte_debug_flag)						\
 	    byte_char_debug_check (b, value, bytepos);			\
 	  return value;							\
@@ -304,12 +304,12 @@ verify_bytepos (EMACS_INT charpos)
     }									\
 }
 
-EMACS_INT
-buf_bytepos_to_charpos (struct buffer *b, EMACS_INT bytepos)
+ptrdiff_t
+buf_bytepos_to_charpos (struct buffer *b, ptrdiff_t bytepos)
 {
   struct Lisp_Marker *tail;
-  EMACS_INT best_above, best_above_byte;
-  EMACS_INT best_below, best_below_byte;
+  ptrdiff_t best_above, best_above_byte;
+  ptrdiff_t best_below, best_below_byte;
 
   if (bytepos < BUF_BEG_BYTE (b) || bytepos > BUF_Z_BYTE (b))
     abort ();
@@ -461,7 +461,8 @@ Then it no longer slows down editing in any buffer.
 Returns MARKER.  */)
   (Lisp_Object marker, Lisp_Object position, Lisp_Object buffer)
 {
-  register EMACS_INT charno, bytepos;
+  register ptrdiff_t charno;
+  register ptrdiff_t bytepos;
   register struct buffer *b;
   register struct Lisp_Marker *m;
 
@@ -502,14 +503,7 @@ Returns MARKER.  */)
     }
 
   CHECK_NUMBER_COERCE_MARKER (position);
-
-  charno = XINT (position);
-
-  if (charno < BUF_BEG (b))
-    charno = BUF_BEG (b);
-  if (charno > BUF_Z (b))
-    charno = BUF_Z (b);
-
+  charno = clip_to_bounds (BUF_BEG (b), XINT (position), BUF_Z (b));
   bytepos = buf_charpos_to_bytepos (b, charno);
 
   /* Every character is at least one byte.  */
@@ -536,7 +530,8 @@ Returns MARKER.  */)
 Lisp_Object
 set_marker_restricted (Lisp_Object marker, Lisp_Object pos, Lisp_Object buffer)
 {
-  register EMACS_INT charno, bytepos;
+  register ptrdiff_t charno;
+  register ptrdiff_t bytepos;
   register struct buffer *b;
   register struct Lisp_Marker *m;
 
@@ -577,14 +572,7 @@ set_marker_restricted (Lisp_Object marker, Lisp_Object pos, Lisp_Object buffer)
     }
 
   CHECK_NUMBER_COERCE_MARKER (pos);
-
-  charno = XINT (pos);
-
-  if (charno < BUF_BEGV (b))
-    charno = BUF_BEGV (b);
-  if (charno > BUF_ZV (b))
-    charno = BUF_ZV (b);
-
+  charno = clip_to_bounds (BUF_BEGV (b), XINT (pos), BUF_ZV (b));
   bytepos = buf_charpos_to_bytepos (b, charno);
 
   /* Every character is at least one byte.  */
@@ -609,7 +597,7 @@ set_marker_restricted (Lisp_Object marker, Lisp_Object pos, Lisp_Object buffer)
    character position and the corresponding byte position.  */
 
 Lisp_Object
-set_marker_both (Lisp_Object marker, Lisp_Object buffer, EMACS_INT charpos, EMACS_INT bytepos)
+set_marker_both (Lisp_Object marker, Lisp_Object buffer, ptrdiff_t charpos, ptrdiff_t bytepos)
 {
   register struct buffer *b;
   register struct Lisp_Marker *m;
@@ -657,7 +645,7 @@ set_marker_both (Lisp_Object marker, Lisp_Object buffer, EMACS_INT charpos, EMAC
    be outside the visible part.  */
 
 Lisp_Object
-set_marker_restricted_both (Lisp_Object marker, Lisp_Object buffer, EMACS_INT charpos, EMACS_INT bytepos)
+set_marker_restricted_both (Lisp_Object marker, Lisp_Object buffer, ptrdiff_t charpos, ptrdiff_t bytepos)
 {
   register struct buffer *b;
   register struct Lisp_Marker *m;
@@ -767,7 +755,7 @@ unchain_marker (register struct Lisp_Marker *marker)
 
 /* Return the char position of marker MARKER, as a C integer.  */
 
-EMACS_INT
+ptrdiff_t
 marker_position (Lisp_Object marker)
 {
   register struct Lisp_Marker *m = XMARKER (marker);
@@ -781,12 +769,12 @@ marker_position (Lisp_Object marker)
 
 /* Return the byte position of marker MARKER, as a C integer.  */
 
-EMACS_INT
+ptrdiff_t
 marker_byte_position (Lisp_Object marker)
 {
   register struct Lisp_Marker *m = XMARKER (marker);
   register struct buffer *buf = m->buffer;
-  register EMACS_INT i = m->bytepos;
+  register ptrdiff_t i = m->bytepos;
 
   if (!buf)
     error ("Marker does not point anywhere");
@@ -847,14 +835,9 @@ DEFUN ("buffer-has-markers-at", Fbuffer_has_markers_at, Sbuffer_has_markers_at,
   (Lisp_Object position)
 {
   register struct Lisp_Marker *tail;
-  register EMACS_INT charno;
-
-  charno = XINT (position);
+  register ptrdiff_t charno;
 
-  if (charno < BEG)
-    charno = BEG;
-  if (charno > Z)
-    charno = Z;
+  charno = clip_to_bounds (BEG, XINT (position), Z);
 
   for (tail = BUF_MARKERS (current_buffer); tail; tail = tail->next)
     if (tail->charpos == charno)
diff --git a/src/menu.c b/src/menu.c
index 587f55e14db..90423be5973 100644
--- a/src/menu.c
+++ b/src/menu.c
@@ -175,15 +175,17 @@ save_menu_items (void)
 }
 
 
-/* Make the menu_items vector twice as large.  */
+/* Ensure that there is room for ITEMS items in the menu_items vector.  */
 
 static void
-grow_menu_items (void)
+ensure_menu_items (int items)
 {
-  if ((INT_MAX - MENU_ITEMS_PANE_LENGTH) / 2 < menu_items_allocated)
-    memory_full (SIZE_MAX);
-  menu_items_allocated *= 2;
-  menu_items = larger_vector (menu_items, menu_items_allocated, Qnil);
+  int incr = items - (menu_items_allocated - menu_items_used);
+  if (0 < incr)
+    {
+      menu_items = larger_vector (menu_items, incr, INT_MAX);
+      menu_items_allocated = ASIZE (menu_items);
+    }
 }
 
 #if (defined USE_X_TOOLKIT || defined USE_GTK || defined HAVE_NS \
@@ -194,9 +196,7 @@ grow_menu_items (void)
 static void
 push_submenu_start (void)
 {
-  if (menu_items_used + 1 > menu_items_allocated)
-    grow_menu_items ();
-
+  ensure_menu_items (1);
   XVECTOR (menu_items)->contents[menu_items_used++] = Qnil;
   menu_items_submenu_depth++;
 }
@@ -206,9 +206,7 @@ push_submenu_start (void)
 static void
 push_submenu_end (void)
 {
-  if (menu_items_used + 1 > menu_items_allocated)
-    grow_menu_items ();
-
+  ensure_menu_items (1);
   XVECTOR (menu_items)->contents[menu_items_used++] = Qlambda;
   menu_items_submenu_depth--;
 }
@@ -220,9 +218,7 @@ push_submenu_end (void)
 static void
 push_left_right_boundary (void)
 {
-  if (menu_items_used + 1 > menu_items_allocated)
-    grow_menu_items ();
-
+  ensure_menu_items (1);
   XVECTOR (menu_items)->contents[menu_items_used++] = Qquote;
 }
 
@@ -232,9 +228,7 @@ push_left_right_boundary (void)
 static void
 push_menu_pane (Lisp_Object name, Lisp_Object prefix_vec)
 {
-  if (menu_items_used + MENU_ITEMS_PANE_LENGTH > menu_items_allocated)
-    grow_menu_items ();
-
+  ensure_menu_items (MENU_ITEMS_PANE_LENGTH);
   if (menu_items_submenu_depth == 0)
     menu_items_n_panes++;
   XVECTOR (menu_items)->contents[menu_items_used++] = Qt;
@@ -253,8 +247,7 @@ push_menu_pane (Lisp_Object name, Lisp_Object prefix_vec)
 static void
 push_menu_item (Lisp_Object name, Lisp_Object enable, Lisp_Object key, Lisp_Object def, Lisp_Object equiv, Lisp_Object type, Lisp_Object selected, Lisp_Object help)
 {
-  if (menu_items_used + MENU_ITEMS_ITEM_LENGTH > menu_items_allocated)
-    grow_menu_items ();
+  ensure_menu_items (MENU_ITEMS_ITEM_LENGTH);
 
   ASET (menu_items, menu_items_used + MENU_ITEMS_ITEM_NAME,	name);
   ASET (menu_items, menu_items_used + MENU_ITEMS_ITEM_ENABLE,	enable);
@@ -458,9 +451,9 @@ single_menu_item (Lisp_Object key, Lisp_Object item, Lisp_Object dummy, void *sk
    and generate menu panes for them in menu_items.  */
 
 static void
-keymap_panes (Lisp_Object *keymaps, int nmaps)
+keymap_panes (Lisp_Object *keymaps, ptrdiff_t nmaps)
 {
-  int mapno;
+  ptrdiff_t mapno;
 
   init_menu_items ();
 
@@ -532,16 +525,17 @@ int
 parse_single_submenu (Lisp_Object item_key, Lisp_Object item_name, Lisp_Object maps)
 {
   Lisp_Object length;
-  int len;
+  EMACS_INT len;
   Lisp_Object *mapvec;
-  int i;
+  ptrdiff_t i;
   int top_level_items = 0;
+  USE_SAFE_ALLOCA;
 
   length = Flength (maps);
   len = XINT (length);
 
   /* Convert the list MAPS into a vector MAPVEC.  */
-  mapvec = (Lisp_Object *) alloca (len * sizeof (Lisp_Object));
+  SAFE_ALLOCA_LISP (mapvec, len);
   for (i = 0; i < len; i++)
     {
       mapvec[i] = Fcar (maps);
@@ -571,6 +565,7 @@ parse_single_submenu (Lisp_Object item_key, Lisp_Object item_name, Lisp_Object m
 	}
     }
 
+  SAFE_FREE ();
   return top_level_items;
 }
 
@@ -1006,7 +1001,7 @@ find_and_return_menu_selection (FRAME_PTR f, int keymaps, void *client_data)
         {
           entry
             = XVECTOR (menu_items)->contents[i + MENU_ITEMS_ITEM_VALUE];
-          if ((EMACS_INT)client_data ==  (EMACS_INT)(&XVECTOR (menu_items)->contents[i]))
+          if (&XVECTOR (menu_items)->contents[i] == client_data)
             {
               if (keymaps != 0)
                 {
@@ -1082,7 +1077,7 @@ no quit occurs and `x-popup-menu' returns nil.  */)
   Lisp_Object x, y, window;
   int keymaps = 0;
   int for_click = 0;
-  int specpdl_count = SPECPDL_INDEX ();
+  ptrdiff_t specpdl_count = SPECPDL_INDEX ();
   struct gcpro gcpro1;
 
   if (NILP (position))
@@ -1175,9 +1170,6 @@ no quit occurs and `x-popup-menu' returns nil.  */)
 	  }
       }
 
-    CHECK_NUMBER (x);
-    CHECK_NUMBER (y);
-
     /* Decode where to put the menu.  */
 
     if (FRAMEP (window))
@@ -1200,6 +1192,14 @@ no quit occurs and `x-popup-menu' returns nil.  */)
 	 but I don't want to make one now.  */
       CHECK_WINDOW (window);
 
+    CHECK_RANGED_INTEGER ((xpos < INT_MIN - MOST_NEGATIVE_FIXNUM
+			   ? (EMACS_INT) INT_MIN - xpos
+			   : MOST_NEGATIVE_FIXNUM),
+			  x, INT_MAX - xpos);
+    CHECK_RANGED_INTEGER ((ypos < INT_MIN - MOST_NEGATIVE_FIXNUM
+			   ? (EMACS_INT) INT_MIN - ypos
+			   : MOST_NEGATIVE_FIXNUM),
+			  y, INT_MAX - ypos);
     xpos += XINT (x);
     ypos += XINT (y);
 
@@ -1248,11 +1248,12 @@ no quit occurs and `x-popup-menu' returns nil.  */)
   else if (CONSP (menu) && KEYMAPP (XCAR (menu)))
     {
       /* We were given a list of keymaps.  */
-      int nmaps = XFASTINT (Flength (menu));
-      Lisp_Object *maps
-	= (Lisp_Object *) alloca (nmaps * sizeof (Lisp_Object));
-      int i;
+      EMACS_INT nmaps = XFASTINT (Flength (menu));
+      Lisp_Object *maps;
+      ptrdiff_t i;
+      USE_SAFE_ALLOCA;
 
+      SAFE_ALLOCA_LISP (maps, nmaps);
       title = Qnil;
 
       /* The first keymap that has a prompt string
@@ -1276,6 +1277,8 @@ no quit occurs and `x-popup-menu' returns nil.  */)
 	ASET (menu_items, MENU_ITEMS_PANE_NAME, title);
 
       keymaps = 1;
+
+      SAFE_FREE ();
     }
   else
     {
diff --git a/src/minibuf.c b/src/minibuf.c
index d3f43b06254..66b9a8a1e49 100644
--- a/src/minibuf.c
+++ b/src/minibuf.c
@@ -89,7 +89,7 @@ static Lisp_Object minibuf_prompt;
 /* Width of current mini-buffer prompt.  Only set after display_line
    of the line that contains the prompt.  */
 
-static EMACS_INT minibuf_prompt_width;
+static ptrdiff_t minibuf_prompt_width;
 
 
 /* Put minibuf on currently selected frame's minibuffer.
@@ -172,7 +172,7 @@ without invoking the usual minibuffer commands.  */)
 static Lisp_Object read_minibuf_unwind (Lisp_Object);
 static Lisp_Object run_exit_minibuf_hook (Lisp_Object);
 static Lisp_Object read_minibuf (Lisp_Object, Lisp_Object,
-                                 Lisp_Object, Lisp_Object,
+                                 Lisp_Object,
                                  int, Lisp_Object,
                                  Lisp_Object, Lisp_Object,
                                  int, int);
@@ -192,7 +192,7 @@ string_to_object (Lisp_Object val, Lisp_Object defalt)
 {
   struct gcpro gcpro1, gcpro2;
   Lisp_Object expr_and_pos;
-  EMACS_INT pos;
+  ptrdiff_t pos;
 
   GCPRO2 (val, defalt);
 
@@ -210,7 +210,7 @@ string_to_object (Lisp_Object val, Lisp_Object defalt)
     {
       /* Ignore trailing whitespace; any other trailing junk
 	 is an error.  */
-      EMACS_INT i;
+      ptrdiff_t i;
       pos = string_char_to_byte (val, pos);
       for (i = pos; i < SBYTES (val); i++)
 	{
@@ -335,7 +335,7 @@ DEFUN ("minibuffer-contents", Fminibuffer_contents,
 If the current buffer is not a minibuffer, return its entire contents.  */)
   (void)
 {
-  EMACS_INT prompt_end = XINT (Fminibuffer_prompt_end ());
+  ptrdiff_t prompt_end = XINT (Fminibuffer_prompt_end ());
   return make_buffer_string (prompt_end, ZV, 1);
 }
 
@@ -345,7 +345,7 @@ DEFUN ("minibuffer-contents-no-properties", Fminibuffer_contents_no_properties,
 If the current buffer is not a minibuffer, return its entire contents.  */)
   (void)
 {
-  EMACS_INT prompt_end = XINT (Fminibuffer_prompt_end ());
+  ptrdiff_t prompt_end = XINT (Fminibuffer_prompt_end ());
   return make_buffer_string (prompt_end, ZV, 0);
 }
 
@@ -356,7 +356,7 @@ That is what completion commands operate on.
 If the current buffer is not a minibuffer, return its entire contents.  */)
   (void)
 {
-  EMACS_INT prompt_end = XINT (Fminibuffer_prompt_end ());
+  ptrdiff_t prompt_end = XINT (Fminibuffer_prompt_end ());
   if (PT < prompt_end)
     error ("Cannot do completion in the prompt");
   return make_buffer_string (prompt_end, PT, 1);
@@ -388,16 +388,16 @@ If the current buffer is not a minibuffer, return its entire contents.  */)
 
 static Lisp_Object
 read_minibuf (Lisp_Object map, Lisp_Object initial, Lisp_Object prompt,
-	      Lisp_Object backup_n, int expflag,
+	      int expflag,
 	      Lisp_Object histvar, Lisp_Object histpos, Lisp_Object defalt,
 	      int allow_props, int inherit_input_method)
 {
   Lisp_Object val;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object mini_frame, ambient_dir, minibuffer, input_method;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
   Lisp_Object enable_multibyte;
-  int pos = INTEGERP (backup_n) ? XINT (backup_n) : 0;
+  EMACS_INT pos = 0;
   /* String to add to the history.  */
   Lisp_Object histstring;
 
@@ -423,7 +423,7 @@ read_minibuf (Lisp_Object map, Lisp_Object initial, Lisp_Object prompt,
     {
       if (CONSP (initial))
 	{
-	  backup_n = Fcdr (initial);
+	  Lisp_Object backup_n = Fcdr (initial);
 	  initial = Fcar (initial);
 	  CHECK_STRING (initial);
 	  if (!NILP (backup_n))
@@ -624,7 +624,7 @@ read_minibuf (Lisp_Object map, Lisp_Object initial, Lisp_Object prompt,
 
   /* Erase the buffer.  */
   {
-    int count1 = SPECPDL_INDEX ();
+    ptrdiff_t count1 = SPECPDL_INDEX ();
     specbind (Qinhibit_read_only, Qt);
     specbind (Qinhibit_modification_hooks, Qt);
     Ferase_buffer ();
@@ -798,7 +798,7 @@ get_minibuffer (EMACS_INT depth)
     }
   else
     {
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
       /* `reset_buffer' blindly sets the list of overlays to NULL, so we
 	 have to empty the list, otherwise we end up with overlays that
 	 think they belong to this buffer while the buffer doesn't know about
@@ -866,7 +866,7 @@ read_minibuf_unwind (Lisp_Object data)
 
   /* Erase the minibuffer we were using at this level.  */
   {
-    int count = SPECPDL_INDEX ();
+    ptrdiff_t count = SPECPDL_INDEX ();
     /* Prevent error in erase-buffer.  */
     specbind (Qinhibit_read_only, Qt);
     specbind (Qinhibit_modification_hooks, Qt);
@@ -964,7 +964,7 @@ and some related functions, which use zero-indexing for POSITION.  */)
 
   GCPRO1 (default_value);
   val = read_minibuf (keymap, initial_contents, prompt,
-		      Qnil, !NILP (read),
+		      !NILP (read),
 		      histvar, histpos, default_value,
 		      minibuffer_allow_text_properties,
 		      !NILP (inherit_input_method));
@@ -982,7 +982,7 @@ Such arguments are used as in `read-from-minibuffer'.)  */)
 {
   CHECK_STRING (prompt);
   return read_minibuf (Vminibuffer_local_map, initial_contents,
-		       prompt, Qnil, 1, Qminibuffer_history,
+		       prompt, 1, Qminibuffer_history,
 		       make_number (0), Qnil, 0, 0);
 }
 
@@ -995,7 +995,7 @@ Such arguments are used as in `read-from-minibuffer'.)  */)
   (Lisp_Object prompt, Lisp_Object initial_contents)
 {
   return Feval (read_minibuf (Vread_expression_map, initial_contents,
-			      prompt, Qnil, 1, Qread_expression_history,
+			      prompt, 1, Qread_expression_history,
 			      make_number (0), Qnil, 0, 0),
 		Qnil);
 }
@@ -1041,7 +1041,7 @@ the current input method and the setting of`enable-multibyte-characters'.  */)
   (Lisp_Object prompt, Lisp_Object initial, Lisp_Object inherit_input_method)
 {
   CHECK_STRING (prompt);
-  return read_minibuf (Vminibuffer_local_ns_map, initial, prompt, Qnil,
+  return read_minibuf (Vminibuffer_local_ns_map, initial, prompt,
 		       0, Qminibuffer_history, make_number (0), Qnil, 0,
 		       !NILP (inherit_input_method));
 }
@@ -1121,7 +1121,7 @@ function, instead of the usual behavior.  */)
   Lisp_Object args[4], result;
   char *s;
   ptrdiff_t len;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   if (BUFFERP (def))
     def = BVAR (XBUFFER (def), name);
@@ -1220,9 +1220,9 @@ is used to further constrain the set of candidates.  */)
 {
   Lisp_Object bestmatch, tail, elt, eltstring;
   /* Size in bytes of BESTMATCH.  */
-  int bestmatchsize = 0;
+  ptrdiff_t bestmatchsize = 0;
   /* These are in bytes, too.  */
-  int compare, matchsize;
+  ptrdiff_t compare, matchsize;
   enum { function_table, list_table, obarray_table, hash_table}
     type = (HASH_TABLE_P (collection) ? hash_table
 	    : VECTORP (collection) ? obarray_table
@@ -1231,9 +1231,9 @@ is used to further constrain the set of candidates.  */)
 		    && (!SYMBOLP (XCAR (collection))
 			|| NILP (XCAR (collection)))))
 	       ? list_table : function_table));
-  EMACS_INT idx = 0, obsize = 0;
+  ptrdiff_t idx = 0, obsize = 0;
   int matchcount = 0;
-  int bindcount = -1;
+  ptrdiff_t bindcount = -1;
   Lisp_Object bucket, zero, end, tem;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
 
@@ -1496,8 +1496,8 @@ with a space are ignored unless STRING itself starts with a space.  */)
     : NILP (collection) || (CONSP (collection)
 			    && (!SYMBOLP (XCAR (collection))
 				|| NILP (XCAR (collection))));
-  EMACS_INT idx = 0, obsize = 0;
-  int bindcount = -1;
+  ptrdiff_t idx = 0, obsize = 0;
+  ptrdiff_t bindcount = -1;
   Lisp_Object bucket, tem, zero;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
 
@@ -1806,7 +1806,7 @@ the values STRING, PREDICATE and `lambda'.  */)
   /* Reject this element if it fails to match all the regexps.  */
   if (CONSP (Vcompletion_regexp_list))
     {
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
       specbind (Qcase_fold_search, completion_ignore_case ? Qt : Qnil);
       for (regexps = Vcompletion_regexp_list; CONSP (regexps);
 	   regexps = XCDR (regexps))
diff --git a/src/nsfns.m b/src/nsfns.m
index a09011d8461..80da9d7a9ac 100644
--- a/src/nsfns.m
+++ b/src/nsfns.m
@@ -165,7 +165,7 @@ check_ns_display_info (Lisp_Object frame)
       struct terminal *t = get_terminal (frame, 1);
 
       if (t->type != output_ns)
-        error ("Terminal %ld is not a Nextstep display", (long) XINT (frame));
+        error ("Terminal %"pI"d is not a Nextstep display", XINT (frame));
 
       return t->display_info.ns;
     }
@@ -706,7 +706,7 @@ x_set_menu_bar_lines (struct frame *f, Lisp_Object value, Lisp_Object oldval)
   if (FRAME_MINIBUF_ONLY_P (f))
     return;
 
-  if (INTEGERP (value))
+  if (TYPE_RANGED_INTEGERP (int, value))
     nlines = XINT (value);
   else
     nlines = 0;
@@ -738,7 +738,7 @@ x_set_tool_bar_lines (struct frame *f, Lisp_Object value, Lisp_Object oldval)
   if (FRAME_MINIBUF_ONLY_P (f))
     return;
 
-  if (INTEGERP (value) && XINT (value) >= 0)
+  if (RANGED_INTEGERP (0, value, INT_MAX))
     nlines = XFASTINT (value);
   else
     nlines = 0;
@@ -1062,7 +1062,7 @@ be shared by the new frame.  */)
   Lisp_Object frame, tem;
   Lisp_Object name;
   int minibuffer_only = 0;
-  int count = specpdl_ptr - specpdl;
+  ptrdiff_t count = specpdl_ptr - specpdl;
   Lisp_Object display;
   struct ns_display_info *dpyinfo = NULL;
   Lisp_Object parent;
@@ -1163,9 +1163,9 @@ be shared by the new frame.  */)
   FRAME_NS_DISPLAY_INFO (f) = dpyinfo;
 
   f->output_data.ns->window_desc = desc_ctr++;
-  if (!NILP (parent))
+  if (TYPE_RANGED_INTEGERP (Window, parent))
     {
-      f->output_data.ns->parent_desc = (Window) XFASTINT (parent);
+      f->output_data.ns->parent_desc = XFASTINT (parent);
       f->output_data.ns->explicit_parent = 1;
     }
   else
@@ -2486,7 +2486,7 @@ Text larger than the specified size is clipped.  */)
 {
   int root_x, root_y;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct frame *f;
   char *str;
   NSSize size;
diff --git a/src/nsfont.m b/src/nsfont.m
index c4d9123faef..ca94b07a6bd 100644
--- a/src/nsfont.m
+++ b/src/nsfont.m
@@ -549,8 +549,8 @@ ns_findfonts (Lisp_Object font_spec, BOOL isMatch)
       return ns_fallback_entity ();
 
     if (NSFONT_TRACE)
-	fprintf (stderr, "    Returning %ld entities.\n",
-                 (long) XINT (Flength (list)));
+	fprintf (stderr, "    Returning %"pI"d entities.\n",
+                 XINT (Flength (list)));
 
     return list;
 }
@@ -656,8 +656,8 @@ nsfont_list_family (Lisp_Object frame)
   /* FIXME: escape the name? */
 
   if (NSFONT_TRACE)
-    fprintf (stderr, "nsfont: list families returning %ld entries\n",
-            (long) XINT (Flength (list)));
+    fprintf (stderr, "nsfont: list families returning %"pI"d entries\n",
+	     XINT (Flength (list)));
 
   return list;
 }
diff --git a/src/nsmenu.m b/src/nsmenu.m
index 951282910ac..644576ae559 100644
--- a/src/nsmenu.m
+++ b/src/nsmenu.m
@@ -182,7 +182,7 @@ ns_update_menubar (struct frame *f, int deep_p, EmacsMenu *submenu)
       int *submenu_top_level_items, *submenu_n_panes;
       struct buffer *prev = current_buffer;
       Lisp_Object buffer;
-      int specpdl_count = SPECPDL_INDEX ();
+      ptrdiff_t specpdl_count = SPECPDL_INDEX ();
       int previous_menu_items_used = f->menu_bar_items_used;
       Lisp_Object *previous_items
 	= (Lisp_Object *) alloca (previous_menu_items_used
@@ -449,7 +449,7 @@ ns_update_menubar (struct frame *f, int deep_p, EmacsMenu *submenu)
 	  wv->enabled = 1;
 	  wv->button_type = BUTTON_TYPE_NONE;
 	  wv->help = Qnil;
-	  wv->call_data = (void *) (EMACS_INT) (-1);
+	  wv->call_data = (void *) (intptr_t) (-1);
 
 #ifdef NS_IMPL_COCOA
           /* we'll update the real copy under app menu when time comes */
@@ -763,7 +763,7 @@ ns_menu_show (FRAME_PTR f, int x, int y, int for_click, int keymaps,
   EmacsMenu *pmenu;
   NSPoint p;
   Lisp_Object window, tem, keymap;
-  int specpdl_count = SPECPDL_INDEX ();
+  ptrdiff_t specpdl_count = SPECPDL_INDEX ();
   widget_value *wv, *first_wv = 0;
 
   p.x = x; p.y = y;
@@ -1400,7 +1400,7 @@ ns_popup_dialog (Lisp_Object position, Lisp_Object contents, Lisp_Object header)
   dialog = [[EmacsDialogPanel alloc] initFromContents: contents
                                            isQuestion: isQ];
   {
-    int specpdl_count = SPECPDL_INDEX ();
+    ptrdiff_t specpdl_count = SPECPDL_INDEX ();
     record_unwind_protect (pop_down_menu, make_save_value (dialog, 0));
     popup_activated_flag = 1;
     tem = [dialog runDialogAt: p];
diff --git a/src/nsselect.m b/src/nsselect.m
index 867cf3252e5..655fedc640c 100644
--- a/src/nsselect.m
+++ b/src/nsselect.m
@@ -181,7 +181,7 @@ ns_get_local_selection (Lisp_Object selection_name,
 {
   Lisp_Object local_value;
   Lisp_Object handler_fn, value, type, check;
-  int count;
+  ptrdiff_t count;
 
   local_value = assq_no_quit (selection_name, Vselection_alist);
 
diff --git a/src/print.c b/src/print.c
index 62bd048cf97..28b3dd7cba5 100644
--- a/src/print.c
+++ b/src/print.c
@@ -69,11 +69,11 @@ static Lisp_Object being_printed[PRINT_CIRCLE];
 static char *print_buffer;
 
 /* Size allocated in print_buffer.  */
-static EMACS_INT print_buffer_size;
+static ptrdiff_t print_buffer_size;
 /* Chars stored in print_buffer.  */
-static EMACS_INT print_buffer_pos;
+static ptrdiff_t print_buffer_pos;
 /* Bytes stored in print_buffer.  */
-static EMACS_INT print_buffer_pos_byte;
+static ptrdiff_t print_buffer_pos_byte;
 
 Lisp_Object Qprint_escape_newlines;
 static Lisp_Object Qprint_escape_multibyte, Qprint_escape_nonascii;
@@ -104,9 +104,9 @@ int print_output_debug_flag EXTERNALLY_VISIBLE = 1;
 
 #define PRINTDECLARE							\
    struct buffer *old = current_buffer;					\
-   EMACS_INT old_point = -1, start_point = -1;				\
-   EMACS_INT old_point_byte = -1, start_point_byte = -1;		\
-   int specpdl_count = SPECPDL_INDEX ();				\
+   ptrdiff_t old_point = -1, start_point = -1;				\
+   ptrdiff_t old_point_byte = -1, start_point_byte = -1;		\
+   ptrdiff_t specpdl_count = SPECPDL_INDEX ();				\
    int free_print_buffer = 0;						\
    int multibyte = !NILP (BVAR (current_buffer, enable_multibyte_characters));	\
    Lisp_Object original
@@ -122,7 +122,7 @@ int print_output_debug_flag EXTERNALLY_VISIBLE = 1;
      }									\
    if (MARKERP (printcharfun))						\
      {									\
-       EMACS_INT marker_pos;						\
+       ptrdiff_t marker_pos;						\
        if (! XMARKER (printcharfun)->buffer)				\
          error ("Marker does not point anywhere");			\
        if (XMARKER (printcharfun)->buffer != current_buffer)		\
@@ -156,7 +156,7 @@ int print_output_debug_flag EXTERNALLY_VISIBLE = 1;
 	 }								\
        else								\
 	 {								\
-	   ptrdiff_t new_size = 1000;					\
+	   int new_size = 1000;						\
 	   print_buffer = (char *) xmalloc (new_size);			\
 	   print_buffer_size = new_size;				\
 	   free_print_buffer = 1;					\
@@ -173,12 +173,14 @@ int print_output_debug_flag EXTERNALLY_VISIBLE = 1;
        if (print_buffer_pos != print_buffer_pos_byte			\
 	   && NILP (BVAR (current_buffer, enable_multibyte_characters)))	\
 	 {								\
-	   unsigned char *temp						\
-	     = (unsigned char *) alloca (print_buffer_pos + 1);		\
+	   USE_SAFE_ALLOCA;						\
+	   unsigned char *temp;						\
+	   SAFE_ALLOCA (temp, unsigned char *, print_buffer_pos + 1);	\
 	   copy_text ((unsigned char *) print_buffer, temp,		\
 		      print_buffer_pos_byte, 1, 0);			\
 	   insert_1_both ((char *) temp, print_buffer_pos,		\
 			  print_buffer_pos, 0, 1, 0);			\
+	   SAFE_FREE ();						\
 	 }								\
        else								\
 	 insert_1_both (print_buffer, print_buffer_pos,			\
@@ -233,15 +235,10 @@ printchar (unsigned int ch, Lisp_Object fun)
 
       if (NILP (fun))
 	{
-	  if (print_buffer_size - len <= print_buffer_pos_byte)
-	    {
-	      ptrdiff_t new_size;
-	      if (STRING_BYTES_BOUND / 2 < print_buffer_size)
-		string_overflow ();
-	      new_size = print_buffer_size * 2;
-	      print_buffer = (char *) xrealloc (print_buffer, new_size);
-	      print_buffer_size = new_size;
-	    }
+	  ptrdiff_t incr = len - (print_buffer_size - print_buffer_pos_byte);
+	  if (0 < incr)
+	    print_buffer =
+	      xpalloc (print_buffer, &print_buffer_size, incr, -1, 1);
 	  memcpy (print_buffer + print_buffer_pos_byte, str, len);
 	  print_buffer_pos += 1;
 	  print_buffer_pos_byte += len;
@@ -276,7 +273,7 @@ printchar (unsigned int ch, Lisp_Object fun)
    to data in a Lisp string.  Otherwise that is not safe.  */
 
 static void
-strout (const char *ptr, EMACS_INT size, EMACS_INT size_byte,
+strout (const char *ptr, ptrdiff_t size, ptrdiff_t size_byte,
 	Lisp_Object printcharfun)
 {
   if (size < 0)
@@ -284,15 +281,9 @@ strout (const char *ptr, EMACS_INT size, EMACS_INT size_byte,
 
   if (NILP (printcharfun))
     {
-      if (print_buffer_size - size_byte < print_buffer_pos_byte)
-	{
-	  ptrdiff_t new_size;
-	  if (STRING_BYTES_BOUND / 2 - size_byte < print_buffer_size)
-	    string_overflow ();
-	  new_size = print_buffer_size * 2 + size_byte;
-	  print_buffer = (char *) xrealloc (print_buffer, new_size);
-	  print_buffer_size = new_size;
-	}
+      ptrdiff_t incr = size_byte - (print_buffer_size - print_buffer_pos_byte);
+      if (0 < incr)
+	print_buffer = xpalloc (print_buffer, &print_buffer_size, incr, -1, 1);
       memcpy (print_buffer + print_buffer_pos_byte, ptr, size_byte);
       print_buffer_pos += size;
       print_buffer_pos_byte += size_byte;
@@ -333,7 +324,7 @@ strout (const char *ptr, EMACS_INT size, EMACS_INT size_byte,
   else
     {
       /* PRINTCHARFUN is a Lisp function.  */
-      EMACS_INT i = 0;
+      ptrdiff_t i = 0;
 
       if (size == size_byte)
 	{
@@ -369,7 +360,7 @@ print_string (Lisp_Object string, Lisp_Object printcharfun)
 {
   if (EQ (printcharfun, Qt) || NILP (printcharfun))
     {
-      EMACS_INT chars;
+      ptrdiff_t chars;
 
       if (print_escape_nonascii)
 	string = string_escape_byte8 (string);
@@ -385,7 +376,7 @@ print_string (Lisp_Object string, Lisp_Object printcharfun)
 	     convert STRING to a multibyte string containing the same
 	     character codes.  */
 	  Lisp_Object newstr;
-	  EMACS_INT bytes;
+	  ptrdiff_t bytes;
 
 	  chars = SBYTES (string);
 	  bytes = count_size_as_multibyte (SDATA (string), chars);
@@ -403,7 +394,7 @@ print_string (Lisp_Object string, Lisp_Object printcharfun)
       if (EQ (printcharfun, Qt))
 	{
 	  /* Output to echo area.  */
-	  EMACS_INT nbytes = SBYTES (string);
+	  ptrdiff_t nbytes = SBYTES (string);
 	  char *buffer;
 
 	  /* Copy the string contents so that relocation of STRING by
@@ -425,9 +416,9 @@ print_string (Lisp_Object string, Lisp_Object printcharfun)
     {
       /* Otherwise, string may be relocated by printing one char.
 	 So re-fetch the string address for each character.  */
-      EMACS_INT i;
-      EMACS_INT size = SCHARS (string);
-      EMACS_INT size_byte = SBYTES (string);
+      ptrdiff_t i;
+      ptrdiff_t size = SCHARS (string);
+      ptrdiff_t size_byte = SBYTES (string);
       struct gcpro gcpro1;
       GCPRO1 (string);
       if (size == size_byte)
@@ -498,7 +489,7 @@ write_string_1 (const char *data, int size, Lisp_Object printcharfun)
 void
 temp_output_buffer_setup (const char *bufname)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   register struct buffer *old = current_buffer;
   register Lisp_Object buf;
 
@@ -602,7 +593,7 @@ A printed representation of an object is text which describes that object.  */)
   Lisp_Object printcharfun;
   /* struct gcpro gcpro1, gcpro2; */
   Lisp_Object save_deactivate_mark;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct buffer *previous;
 
   specbind (Qinhibit_modification_hooks, Qt);
@@ -727,7 +718,7 @@ You can call print while debugging emacs, and pass it this function
 to make it write to the debugging output.  */)
   (Lisp_Object character)
 {
-  CHECK_NUMBER (character);
+  CHECK_CHARACTER (character);
   putc ((int) XINT (character), stderr);
 
 #ifdef WINDOWSNT
@@ -875,10 +866,13 @@ print_error_message (Lisp_Object data, Lisp_Object stream, const char *context,
   if (!NILP (caller) && SYMBOLP (caller))
     {
       Lisp_Object cname = SYMBOL_NAME (caller);
-      char *name = alloca (SBYTES (cname));
+      char *name;
+      USE_SAFE_ALLOCA;
+      SAFE_ALLOCA (name, char *, SBYTES (cname));
       memcpy (name, SDATA (cname), SBYTES (cname));
       message_dolog (name, SBYTES (cname), 0, 0);
       message_dolog (": ", 2, 0, 0);
+      SAFE_FREE ();
     }
 
   errname = Fcar (data);
@@ -1092,7 +1086,7 @@ print (Lisp_Object obj, register Lisp_Object printcharfun, int escapeflag)
 	     Maybe a better way to do that is to copy elements to
 	     a new hash table.  */
 	  struct Lisp_Hash_Table *h = XHASH_TABLE (Vprint_number_table);
-	  EMACS_INT i;
+	  ptrdiff_t i;
 
 	  for (i = 0; i < HASH_TABLE_SIZE (h); ++i)
 	    if (!NILP (HASH_HASH (h, i))
@@ -1126,7 +1120,7 @@ static void
 print_preprocess (Lisp_Object obj)
 {
   int i;
-  EMACS_INT size;
+  ptrdiff_t size;
   int loop_count = 0;
   Lisp_Object halftail;
 
@@ -1269,8 +1263,8 @@ print_check_string_charset_prop (INTERVAL interval, Lisp_Object string)
       || ! (print_check_string_result & PRINT_STRING_UNSAFE_CHARSET_FOUND))
     {
       int i, c;
-      EMACS_INT charpos = interval->position;
-      EMACS_INT bytepos = string_char_to_byte (string, charpos);
+      ptrdiff_t charpos = interval->position;
+      ptrdiff_t bytepos = string_char_to_byte (string, charpos);
       Lisp_Object charset;
 
       charset = XCAR (XCDR (val));
@@ -1392,10 +1386,10 @@ print_object (Lisp_Object obj, register Lisp_Object printcharfun, int escapeflag
 	print_string (obj, printcharfun);
       else
 	{
-	  register EMACS_INT i_byte;
+	  register ptrdiff_t i_byte;
 	  struct gcpro gcpro1;
 	  unsigned char *str;
-	  EMACS_INT size_byte;
+	  ptrdiff_t size_byte;
 	  /* 1 means we must ensure that the next character we output
 	     cannot be taken as part of a hex character escape.  */
 	  int need_nonhex = 0;
@@ -1513,8 +1507,8 @@ print_object (Lisp_Object obj, register Lisp_Object printcharfun, int escapeflag
 	register unsigned char *p = SDATA (SYMBOL_NAME (obj));
 	register unsigned char *end = p + SBYTES (SYMBOL_NAME (obj));
 	register int c;
-	int i, i_byte;
-	EMACS_INT size_byte;
+	ptrdiff_t i, i_byte;
+	ptrdiff_t size_byte;
 	Lisp_Object name;
 
 	name = SYMBOL_NAME (obj);
@@ -1705,7 +1699,7 @@ print_object (Lisp_Object obj, register Lisp_Object printcharfun, int escapeflag
 	  ptrdiff_t i;
 	  register unsigned char c;
 	  struct gcpro gcpro1;
-	  EMACS_INT size_in_chars
+	  ptrdiff_t size_in_chars
 	    = ((XBOOL_VECTOR (obj)->size + BOOL_VECTOR_BITS_PER_CHAR - 1)
 	       / BOOL_VECTOR_BITS_PER_CHAR);
 
@@ -1791,8 +1785,8 @@ print_object (Lisp_Object obj, register Lisp_Object printcharfun, int escapeflag
       else if (HASH_TABLE_P (obj))
 	{
 	  struct Lisp_Hash_Table *h = XHASH_TABLE (obj);
-	  int i;
-	  EMACS_INT real_size, size;
+	  ptrdiff_t i;
+	  ptrdiff_t real_size, size;
 #if 0
 	  strout ("#<hash-table", -1, -1, printcharfun);
 	  if (SYMBOLP (h->test))
@@ -1897,7 +1891,7 @@ print_object (Lisp_Object obj, register Lisp_Object printcharfun, int escapeflag
 	}
       else if (FONTP (obj))
 	{
-	  EMACS_INT i;
+	  int i;
 
 	  if (! FONT_OBJECT_P (obj))
 	    {
@@ -1925,7 +1919,7 @@ print_object (Lisp_Object obj, register Lisp_Object printcharfun, int escapeflag
 	}
       else
 	{
-	  EMACS_INT size = ASIZE (obj);
+	  ptrdiff_t size = ASIZE (obj);
 	  if (COMPILEDP (obj))
 	    {
 	      PRINTCHAR ('#');
@@ -1956,7 +1950,7 @@ print_object (Lisp_Object obj, register Lisp_Object printcharfun, int escapeflag
 	  {
 	    register int i;
 	    register Lisp_Object tem;
-	    EMACS_INT real_size = size;
+	    ptrdiff_t real_size = size;
 
 	    /* Don't print more elements than the specified maximum.  */
 	    if (NATNUMP (Vprint_length)
diff --git a/src/process.c b/src/process.c
index 90ad9c21681..d604415bdd0 100644
--- a/src/process.c
+++ b/src/process.c
@@ -761,9 +761,7 @@ nil, indicating the current buffer's process.  */)
     {
 #ifdef SIGCHLD
       Lisp_Object symbol;
-      /* Assignment to EMACS_INT stops GCC whining about limited range
-	 of data type.  */
-      EMACS_INT pid = p->pid;
+      pid_t pid = p->pid;
 
       /* No problem storing the pid here, as it is still in Vprocess_alist.  */
       deleted_pid_list = Fcons (make_fixnum_or_float (pid),
@@ -860,9 +858,7 @@ This is the pid of the external process which PROCESS uses or talks to.
 For a network connection, this value is nil.  */)
   (register Lisp_Object process)
 {
-  /* Assignment to EMACS_INT stops GCC whining about limited range of
-     data type.  */
-  EMACS_INT pid;
+  pid_t pid;
 
   CHECK_PROCESS (process);
   pid = XPROCESS (process)->pid;
@@ -1037,8 +1033,8 @@ DEFUN ("set-process-window-size", Fset_process_window_size,
   (register Lisp_Object process, Lisp_Object height, Lisp_Object width)
 {
   CHECK_PROCESS (process);
-  CHECK_NATNUM (height);
-  CHECK_NATNUM (width);
+  CHECK_RANGED_INTEGER (0, height, INT_MAX);
+  CHECK_RANGED_INTEGER (0, width, INT_MAX);
 
   if (XPROCESS (process)->infd < 0
       || set_window_size (XPROCESS (process)->infd,
@@ -1198,7 +1194,7 @@ Returns nil if format of ADDRESS is invalid.  */)
   if (VECTORP (address))  /* AF_INET or AF_INET6 */
     {
       register struct Lisp_Vector *p = XVECTOR (address);
-      EMACS_INT size = p->header.size;
+      ptrdiff_t size = p->header.size;
       Lisp_Object args[10];
       int nargs, i;
 
@@ -1227,14 +1223,12 @@ Returns nil if format of ADDRESS is invalid.  */)
 
       for (i = 0; i < nargs; i++)
 	{
-	  EMACS_INT element = XINT (p->contents[i]);
-
-	  if (element < 0 || element > 65535)
+	  if (! RANGED_INTEGERP (0, p->contents[i], 65535))
 	    return Qnil;
 
 	  if (nargs <= 5         /* IPv4 */
 	      && i < 4           /* host, not port */
-	      && element > 255)
+	      && XINT (p->contents[i]) > 255)
 	    return Qnil;
 
 	  args[i+1] = p->contents[i];
@@ -1289,7 +1283,7 @@ usage: (start-process NAME BUFFER PROGRAM &rest PROGRAM-ARGS)  */)
   Lisp_Object buffer, name, program, proc, current_dir, tem;
   register unsigned char **new_argv;
   ptrdiff_t i;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   buffer = args[1];
   if (!NILP (buffer))
@@ -2098,7 +2092,8 @@ get_lisp_to_sockaddr_size (Lisp_Object address, int *familyp)
       return sizeof (struct sockaddr_un);
     }
 #endif
-  else if (CONSP (address) && INTEGERP (XCAR (address)) && VECTORP (XCDR (address)))
+  else if (CONSP (address) && TYPE_RANGED_INTEGERP (int, XCAR (address))
+	   && VECTORP (XCDR (address)))
     {
       struct sockaddr *sa;
       *familyp = XINT (XCAR (address));
@@ -2121,6 +2116,7 @@ conv_lisp_to_sockaddr (int family, Lisp_Object address, struct sockaddr *sa, int
   register struct Lisp_Vector *p;
   register unsigned char *cp = NULL;
   register int i;
+  EMACS_INT hostport;
 
   memset (sa, 0, len);
 
@@ -2131,8 +2127,8 @@ conv_lisp_to_sockaddr (int family, Lisp_Object address, struct sockaddr *sa, int
 	{
 	  struct sockaddr_in *sin = (struct sockaddr_in *) sa;
 	  len = sizeof (sin->sin_addr) + 1;
-	  i = XINT (p->contents[--len]);
-	  sin->sin_port = htons (i);
+	  hostport = XINT (p->contents[--len]);
+	  sin->sin_port = htons (hostport);
 	  cp = (unsigned char *)&sin->sin_addr;
 	  sa->sa_family = family;
 	}
@@ -2142,8 +2138,8 @@ conv_lisp_to_sockaddr (int family, Lisp_Object address, struct sockaddr *sa, int
 	  struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) sa;
 	  uint16_t *ip6 = (uint16_t *)&sin6->sin6_addr;
 	  len = sizeof (sin6->sin6_addr) + 1;
-	  i = XINT (p->contents[--len]);
-	  sin6->sin6_port = htons (i);
+	  hostport = XINT (p->contents[--len]);
+	  sin6->sin6_port = htons (hostport);
 	  for (i = 0; i < len; i++)
 	    if (INTEGERP (p->contents[i]))
 	      {
@@ -2298,7 +2294,7 @@ set_socket_option (int s, Lisp_Object opt, Lisp_Object val)
     case SOPT_INT:
       {
 	int optval;
-	if (INTEGERP (val))
+	if (TYPE_RANGED_INTEGERP (int, val))
 	  optval = XINT (val);
 	else
 	  error ("Bad option value for %s", name);
@@ -2337,7 +2333,7 @@ set_socket_option (int s, Lisp_Object opt, Lisp_Object val)
 
 	linger.l_onoff = 1;
 	linger.l_linger = 0;
-	if (INTEGERP (val))
+	if (TYPE_RANGED_INTEGERP (int, val))
 	  linger.l_linger = XINT (val);
 	else
 	  linger.l_onoff = NILP (val) ? 0 : 1;
@@ -2577,7 +2573,7 @@ usage:  (make-serial-process &rest ARGS)  */)
   struct gcpro gcpro1;
   Lisp_Object name, buffer;
   Lisp_Object tem, val;
-  int specpdl_count = -1;
+  ptrdiff_t specpdl_count = -1;
 
   if (nargs == 0)
     return Qnil;
@@ -2877,8 +2873,8 @@ usage: (make-network-process &rest ARGS)  */)
   int xerrno = 0;
   int s = -1, outch, inch;
   struct gcpro gcpro1;
-  int count = SPECPDL_INDEX ();
-  int count1;
+  ptrdiff_t count = SPECPDL_INDEX ();
+  ptrdiff_t count1;
   Lisp_Object QCaddress;  /* one of QClocal or QCremote */
   Lisp_Object tem;
   Lisp_Object name, buffer, host, service, address;
@@ -2925,7 +2921,7 @@ usage: (make-network-process &rest ARGS)  */)
       error ("Network servers not supported");
 #else
       is_server = 1;
-      if (INTEGERP (tem))
+      if (TYPE_RANGED_INTEGERP (int, tem))
 	backlog = XINT (tem);
 #endif
     }
@@ -2991,7 +2987,7 @@ usage: (make-network-process &rest ARGS)  */)
 #endif
   else if (EQ (tem, Qipv4))
     family = AF_INET;
-  else if (INTEGERP (tem))
+  else if (TYPE_RANGED_INTEGERP (int, tem))
     family = XINT (tem);
   else
     error ("Unknown address family");
@@ -3943,7 +3939,7 @@ If JUST-THIS-ONE is an integer, don't run any timers either.
 Return non-nil if we received any output before the timeout expired.  */)
   (register Lisp_Object process, Lisp_Object seconds, Lisp_Object millisec, Lisp_Object just_this_one)
 {
-  int secs, usecs = 0;
+  int secs = -1, usecs = 0;
 
   if (! NILP (process))
     CHECK_PROCESS (process);
@@ -3964,22 +3960,12 @@ Return non-nil if we received any output before the timeout expired.  */)
 
   if (!NILP (seconds))
     {
-      if (INTEGERP (seconds))
-	secs = XINT (seconds);
-      else if (FLOATP (seconds))
-	{
-	  double timeout = XFLOAT_DATA (seconds);
-	  secs = (int) timeout;
-	  usecs = (int) ((timeout - (double) secs) * 1000000);
-	}
-      else
-	wrong_type_argument (Qnumberp, seconds);
-
-      if (secs < 0 || (secs == 0 && usecs == 0))
-	secs = -1, usecs = 0;
+      double duration = extract_float (duration);
+      if (0 < duration)
+	duration_to_sec_usec (duration, &secs, &usecs);
     }
-  else
-    secs = NILP (process) ? -1 : 0;
+  else if (!NILP (process))
+    secs = 0;
 
   return
     (wait_reading_process_output (secs, usecs, 0, 0,
@@ -4292,7 +4278,7 @@ wait_reading_process_output (int time_limit, int microsecs, int read_kbd,
   EMACS_TIME timeout, end_time;
   int wait_channel = -1;
   int got_some_input = 0;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   FD_ZERO (&Available);
   FD_ZERO (&Writeok);
@@ -4995,11 +4981,11 @@ read_process_output (Lisp_Object proc, register int channel)
   char *chars;
   register Lisp_Object outstream;
   register struct Lisp_Process *p = XPROCESS (proc);
-  register EMACS_INT opoint;
+  register ptrdiff_t opoint;
   struct coding_system *coding = proc_decode_coding_system[channel];
   int carryover = p->decoding_carryover;
   int readmax = 4096;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object odeactivate;
 
   chars = (char *) alloca (carryover + readmax);
@@ -5195,10 +5181,10 @@ read_process_output (Lisp_Object proc, register int channel)
   else if (!NILP (p->buffer) && !NILP (BVAR (XBUFFER (p->buffer), name)))
     {
       Lisp_Object old_read_only;
-      EMACS_INT old_begv, old_zv;
-      EMACS_INT old_begv_byte, old_zv_byte;
-      EMACS_INT before, before_byte;
-      EMACS_INT opoint_byte;
+      ptrdiff_t old_begv, old_zv;
+      ptrdiff_t old_begv_byte, old_zv_byte;
+      ptrdiff_t before, before_byte;
+      ptrdiff_t opoint_byte;
       Lisp_Object text;
       struct buffer *b;
 
@@ -5339,7 +5325,7 @@ send_process_trap (int ignore)
 
 static void
 send_process (volatile Lisp_Object proc, const char *volatile buf,
-	      volatile EMACS_INT len, volatile Lisp_Object object)
+	      volatile ptrdiff_t len, volatile Lisp_Object object)
 {
   /* Use volatile to protect variables from being clobbered by longjmp.  */
   struct Lisp_Process *p = XPROCESS (proc);
@@ -5409,8 +5395,8 @@ send_process (volatile Lisp_Object proc, const char *volatile buf,
       coding->dst_object = Qt;
       if (BUFFERP (object))
 	{
-	  EMACS_INT from_byte, from, to;
-	  EMACS_INT save_pt, save_pt_byte;
+	  ptrdiff_t from_byte, from, to;
+	  ptrdiff_t save_pt, save_pt_byte;
 	  struct buffer *cur = current_buffer;
 
 	  set_buffer_internal (XBUFFER (object));
@@ -5464,12 +5450,12 @@ send_process (volatile Lisp_Object proc, const char *volatile buf,
       process_sent_to = proc;
       while (len > 0)
 	{
-	  EMACS_INT this = len;
+	  ptrdiff_t this = len;
 
 	  /* Send this batch, using one or more write calls.  */
 	  while (this > 0)
 	    {
-	      EMACS_INT written = 0;
+	      ptrdiff_t written = 0;
 	      int outfd = p->outfd;
 	      old_sigpipe = (void (*) (int)) signal (SIGPIPE, send_process_trap);
 #ifdef DATAGRAM_SOCKETS
@@ -5524,7 +5510,7 @@ send_process (volatile Lisp_Object proc, const char *volatile buf,
 		       that may allow the program
 		       to finish doing output and read more.  */
 		    {
-		      EMACS_INT offset = 0;
+		      ptrdiff_t offset = 0;
 
 #ifdef BROKEN_PTY_READ_AFTER_EAGAIN
 		      /* A gross hack to work around a bug in FreeBSD.
@@ -5608,7 +5594,7 @@ Output from processes can arrive in between bunches.  */)
   (Lisp_Object process, Lisp_Object start, Lisp_Object end)
 {
   Lisp_Object proc;
-  EMACS_INT start1, end1;
+  ptrdiff_t start1, end1;
 
   proc = get_process (process);
   validate_region (&start, &end);
@@ -5974,24 +5960,33 @@ SIGCODE may be an integer, or a symbol whose name is a signal name.  */)
 
   if (INTEGERP (process))
     {
+      CHECK_TYPE_RANGED_INTEGER (pid_t, process);
       pid = XINT (process);
       goto got_it;
     }
 
   if (FLOATP (process))
     {
-      pid = (pid_t) XFLOAT_DATA (process);
+      double v = XFLOAT_DATA (process);
+      if (! (TYPE_MINIMUM (pid_t) <= v && v < TYPE_MAXIMUM (pid_t) + 1.0))
+	args_out_of_range_3 (process,
+			     make_fixnum_or_float (TYPE_MINIMUM (pid_t)),
+			     make_fixnum_or_float (TYPE_MAXIMUM (pid_t)));
+      pid = v;
       goto got_it;
     }
 
   if (STRINGP (process))
     {
-      Lisp_Object tem;
-      if (tem = Fget_process (process), NILP (tem))
+      Lisp_Object tem = Fget_process (process);
+      if (NILP (tem))
 	{
-	  pid = XINT (Fstring_to_number (process, make_number (10)));
-	  if (pid > 0)
-	    goto got_it;
+	  EMACS_INT v = XINT (Fstring_to_number (process, make_number (10)));
+	  if (0 < v && v <= TYPE_MAXIMUM (pid_t))
+	    {
+	      pid = v;
+	      goto got_it;
+	    }
 	}
       process = tem;
     }
@@ -6013,7 +6008,7 @@ SIGCODE may be an integer, or a symbol whose name is a signal name.  */)
     XSETINT (sigcode, VALUE)
 
   if (INTEGERP (sigcode))
-    ;
+    CHECK_TYPE_RANGED_INTEGER (int, sigcode);
   else
     {
       char *name;
@@ -6276,8 +6271,8 @@ sigchld_handler (int signo)
       for (tail = deleted_pid_list; CONSP (tail); tail = XCDR (tail))
 	{
 	  Lisp_Object xpid = XCAR (tail);
-	  if ((INTEGERP (xpid) && pid == (pid_t) XINT (xpid))
-	      || (FLOATP (xpid) && pid == (pid_t) XFLOAT_DATA (xpid)))
+	  if ((INTEGERP (xpid) && pid == XINT (xpid))
+	      || (FLOATP (xpid) && pid == XFLOAT_DATA (xpid)))
 	    {
 	      XSETCAR (tail, Qnil);
 	      goto sigchld_end_of_loop;
@@ -6393,7 +6388,7 @@ exec_sentinel (Lisp_Object proc, Lisp_Object reason)
 {
   Lisp_Object sentinel, odeactivate;
   register struct Lisp_Process *p = XPROCESS (proc);
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   int outer_running_asynch_code = running_asynch_code;
   int waiting = waiting_for_user_input_p;
 
@@ -6552,8 +6547,8 @@ status_notify (struct Lisp_Process *deleting_process)
 	    {
 	      Lisp_Object tem;
 	      struct buffer *old = current_buffer;
-	      EMACS_INT opoint, opoint_byte;
-	      EMACS_INT before, before_byte;
+	      ptrdiff_t opoint, opoint_byte;
+	      ptrdiff_t before, before_byte;
 
 	      /* Avoid error if buffer is deleted
 		 (probably that's why the process is dead, too) */
diff --git a/src/scroll.c b/src/scroll.c
index 05f6fdf85f0..4e0801f092f 100644
--- a/src/scroll.c
+++ b/src/scroll.c
@@ -94,7 +94,7 @@ calculate_scrolling (FRAME_PTR frame,
 		     int free_at_end)
 {
   register int i, j;
-  EMACS_INT frame_lines = FRAME_LINES (frame);
+  int frame_lines = FRAME_LINES (frame);
   register struct matrix_elt *p, *p1;
   register int cost, cost1;
 
@@ -432,7 +432,7 @@ calculate_direct_scrolling (FRAME_PTR frame,
 			    int free_at_end)
 {
   register int i, j;
-  EMACS_INT frame_lines = FRAME_LINES (frame);
+  int frame_lines = FRAME_LINES (frame);
   register struct matrix_elt *p, *p1;
   register int cost, cost1, delta;
 
@@ -889,8 +889,8 @@ static void
 line_ins_del (FRAME_PTR frame, int ov1, int pf1, int ovn, int pfn,
               register int *ov, register int *mf)
 {
-  register EMACS_INT i;
-  register EMACS_INT frame_lines = FRAME_LINES (frame);
+  register int i;
+  register int frame_lines = FRAME_LINES (frame);
   register int insert_overhead = ov1 * 10;
   register int next_insert_cost = ovn * 10;
 
diff --git a/src/search.c b/src/search.c
index b3d67e6c431..7dc88268c76 100644
--- a/src/search.c
+++ b/src/search.c
@@ -90,16 +90,16 @@ static Lisp_Object Qinvalid_regexp;
 /* Error condition used for failing searches */
 static Lisp_Object Qsearch_failed;
 
-static void set_search_regs (EMACS_INT, EMACS_INT);
+static void set_search_regs (ptrdiff_t, ptrdiff_t);
 static void save_search_regs (void);
-static EMACS_INT simple_search (EMACS_INT, unsigned char *, EMACS_INT,
-				EMACS_INT, Lisp_Object, EMACS_INT, EMACS_INT,
-                                EMACS_INT, EMACS_INT);
-static EMACS_INT boyer_moore (EMACS_INT, unsigned char *, EMACS_INT,
-                              Lisp_Object, Lisp_Object, EMACS_INT,
-                              EMACS_INT, int);
-static EMACS_INT search_buffer (Lisp_Object, EMACS_INT, EMACS_INT,
-                                EMACS_INT, EMACS_INT, EMACS_INT, int,
+static EMACS_INT simple_search (EMACS_INT, unsigned char *, ptrdiff_t,
+				ptrdiff_t, Lisp_Object, ptrdiff_t, ptrdiff_t,
+                                ptrdiff_t, ptrdiff_t);
+static EMACS_INT boyer_moore (EMACS_INT, unsigned char *, ptrdiff_t,
+                              Lisp_Object, Lisp_Object, ptrdiff_t,
+                              ptrdiff_t, int);
+static EMACS_INT search_buffer (Lisp_Object, ptrdiff_t, ptrdiff_t,
+                                ptrdiff_t, ptrdiff_t, EMACS_INT, int,
                                 Lisp_Object, Lisp_Object, int);
 static void matcher_overflow (void) NO_RETURN;
 
@@ -272,8 +272,8 @@ looking_at_1 (Lisp_Object string, int posix)
 {
   Lisp_Object val;
   unsigned char *p1, *p2;
-  EMACS_INT s1, s2;
-  register EMACS_INT i;
+  ptrdiff_t s1, s2;
+  register ptrdiff_t i;
   struct re_pattern_buffer *bufp;
 
   if (running_asynch_code)
@@ -368,10 +368,10 @@ data if you want to preserve them.  */)
 static Lisp_Object
 string_match_1 (Lisp_Object regexp, Lisp_Object string, Lisp_Object start, int posix)
 {
-  EMACS_INT val;
+  ptrdiff_t val;
   struct re_pattern_buffer *bufp;
-  EMACS_INT pos, pos_byte;
-  int i;
+  EMACS_INT pos;
+  ptrdiff_t pos_byte, i;
 
   if (running_asynch_code)
     save_search_regs ();
@@ -383,7 +383,7 @@ string_match_1 (Lisp_Object regexp, Lisp_Object string, Lisp_Object start, int p
     pos = 0, pos_byte = 0;
   else
     {
-      EMACS_INT len = SCHARS (string);
+      ptrdiff_t len = SCHARS (string);
 
       CHECK_NUMBER (start);
       pos = XINT (start);
@@ -468,10 +468,10 @@ matched by parenthesis constructs in the pattern.  */)
    and return the index of the match, or negative on failure.
    This does not clobber the match data.  */
 
-EMACS_INT
+ptrdiff_t
 fast_string_match (Lisp_Object regexp, Lisp_Object string)
 {
-  EMACS_INT val;
+  ptrdiff_t val;
   struct re_pattern_buffer *bufp;
 
   bufp = compile_pattern (regexp, 0, Qnil,
@@ -491,10 +491,10 @@ fast_string_match (Lisp_Object regexp, Lisp_Object string)
    This does not clobber the match data.
    We assume that STRING contains single-byte characters.  */
 
-EMACS_INT
+ptrdiff_t
 fast_c_string_match_ignore_case (Lisp_Object regexp, const char *string)
 {
-  EMACS_INT val;
+  ptrdiff_t val;
   struct re_pattern_buffer *bufp;
   size_t len = strlen (string);
 
@@ -511,10 +511,10 @@ fast_c_string_match_ignore_case (Lisp_Object regexp, const char *string)
 
 /* Like fast_string_match but ignore case.  */
 
-EMACS_INT
+ptrdiff_t
 fast_string_match_ignore_case (Lisp_Object regexp, Lisp_Object string)
 {
-  EMACS_INT val;
+  ptrdiff_t val;
   struct re_pattern_buffer *bufp;
 
   bufp = compile_pattern (regexp, 0, Vascii_canon_table,
@@ -535,14 +535,14 @@ fast_string_match_ignore_case (Lisp_Object regexp, Lisp_Object string)
    indices into the string.  This function doesn't modify the match
    data.  */
 
-EMACS_INT
-fast_looking_at (Lisp_Object regexp, EMACS_INT pos, EMACS_INT pos_byte, EMACS_INT limit, EMACS_INT limit_byte, Lisp_Object string)
+ptrdiff_t
+fast_looking_at (Lisp_Object regexp, ptrdiff_t pos, ptrdiff_t pos_byte, ptrdiff_t limit, ptrdiff_t limit_byte, Lisp_Object string)
 {
   int multibyte;
   struct re_pattern_buffer *buf;
   unsigned char *p1, *p2;
-  EMACS_INT s1, s2;
-  EMACS_INT len;
+  ptrdiff_t s1, s2;
+  ptrdiff_t len;
 
   if (STRINGP (string))
     {
@@ -641,9 +641,9 @@ newline_cache_on_off (struct buffer *buf)
    If ALLOW_QUIT is non-zero, set immediate_quit.  That's good to do
    except when inside redisplay.  */
 
-EMACS_INT
-scan_buffer (register int target, EMACS_INT start, EMACS_INT end,
-	     EMACS_INT count, EMACS_INT *shortage, int allow_quit)
+ptrdiff_t
+scan_buffer (register int target, ptrdiff_t start, ptrdiff_t end,
+	     ptrdiff_t count, ptrdiff_t *shortage, int allow_quit)
 {
   struct region_cache *newline_cache;
   int direction;
@@ -675,9 +675,9 @@ scan_buffer (register int target, EMACS_INT start, EMACS_INT end,
            the position of the last character before the next such
            obstacle --- the last character the dumb search loop should
            examine.  */
-	EMACS_INT ceiling_byte = CHAR_TO_BYTE (end) - 1;
-	EMACS_INT start_byte = CHAR_TO_BYTE (start);
-	EMACS_INT tem;
+	ptrdiff_t ceiling_byte = CHAR_TO_BYTE (end) - 1;
+	ptrdiff_t start_byte = CHAR_TO_BYTE (start);
+	ptrdiff_t tem;
 
         /* If we're looking for a newline, consult the newline cache
            to see where we can avoid some scanning.  */
@@ -748,9 +748,9 @@ scan_buffer (register int target, EMACS_INT start, EMACS_INT end,
     while (start > end)
       {
         /* The last character to check before the next obstacle.  */
-	EMACS_INT ceiling_byte = CHAR_TO_BYTE (end);
-	EMACS_INT start_byte = CHAR_TO_BYTE (start);
-	EMACS_INT tem;
+	ptrdiff_t ceiling_byte = CHAR_TO_BYTE (end);
+	ptrdiff_t start_byte = CHAR_TO_BYTE (start);
+	ptrdiff_t tem;
 
         /* Consult the newline cache, if appropriate.  */
         if (target == '\n' && newline_cache)
@@ -835,8 +835,8 @@ scan_buffer (register int target, EMACS_INT start, EMACS_INT end,
    except in special cases.  */
 
 EMACS_INT
-scan_newline (EMACS_INT start, EMACS_INT start_byte,
-	      EMACS_INT limit, EMACS_INT limit_byte,
+scan_newline (ptrdiff_t start, ptrdiff_t start_byte,
+	      ptrdiff_t limit, ptrdiff_t limit_byte,
 	      register EMACS_INT count, int allow_quit)
 {
   int direction = ((count > 0) ? 1 : -1);
@@ -844,7 +844,7 @@ scan_newline (EMACS_INT start, EMACS_INT start_byte,
   register unsigned char *cursor;
   unsigned char *base;
 
-  EMACS_INT ceiling;
+  ptrdiff_t ceiling;
   register unsigned char *ceiling_addr;
 
   int old_immediate_quit = immediate_quit;
@@ -930,21 +930,21 @@ scan_newline (EMACS_INT start, EMACS_INT start_byte,
   return count * direction;
 }
 
-EMACS_INT
-find_next_newline_no_quit (EMACS_INT from, EMACS_INT cnt)
+ptrdiff_t
+find_next_newline_no_quit (ptrdiff_t from, ptrdiff_t cnt)
 {
-  return scan_buffer ('\n', from, 0, cnt, (EMACS_INT *) 0, 0);
+  return scan_buffer ('\n', from, 0, cnt, (ptrdiff_t *) 0, 0);
 }
 
 /* Like find_next_newline, but returns position before the newline,
    not after, and only search up to TO.  This isn't just
    find_next_newline (...)-1, because you might hit TO.  */
 
-EMACS_INT
-find_before_next_newline (EMACS_INT from, EMACS_INT to, EMACS_INT cnt)
+ptrdiff_t
+find_before_next_newline (ptrdiff_t from, ptrdiff_t to, ptrdiff_t cnt)
 {
-  EMACS_INT shortage;
-  EMACS_INT pos = scan_buffer ('\n', from, to, cnt, &shortage, 1);
+  ptrdiff_t shortage;
+  ptrdiff_t pos = scan_buffer ('\n', from, to, cnt, &shortage, 1);
 
   if (shortage == 0)
     pos--;
@@ -959,7 +959,8 @@ search_command (Lisp_Object string, Lisp_Object bound, Lisp_Object noerror,
 		Lisp_Object count, int direction, int RE, int posix)
 {
   register EMACS_INT np;
-  EMACS_INT lim, lim_byte;
+  EMACS_INT lim;
+  ptrdiff_t lim_byte;
   EMACS_INT n = direction;
 
   if (!NILP (count))
@@ -1035,7 +1036,7 @@ search_command (Lisp_Object string, Lisp_Object bound, Lisp_Object noerror,
 static int
 trivial_regexp_p (Lisp_Object regexp)
 {
-  EMACS_INT len = SBYTES (regexp);
+  ptrdiff_t len = SBYTES (regexp);
   unsigned char *s = SDATA (regexp);
   while (--len >= 0)
     {
@@ -1099,13 +1100,13 @@ while (0)
 static struct re_registers search_regs_1;
 
 static EMACS_INT
-search_buffer (Lisp_Object string, EMACS_INT pos, EMACS_INT pos_byte,
-	       EMACS_INT lim, EMACS_INT lim_byte, EMACS_INT n,
+search_buffer (Lisp_Object string, ptrdiff_t pos, ptrdiff_t pos_byte,
+	       ptrdiff_t lim, ptrdiff_t lim_byte, EMACS_INT n,
 	       int RE, Lisp_Object trt, Lisp_Object inverse_trt, int posix)
 {
-  EMACS_INT len = SCHARS (string);
-  EMACS_INT len_byte = SBYTES (string);
-  register int i;
+  ptrdiff_t len = SCHARS (string);
+  ptrdiff_t len_byte = SBYTES (string);
+  register ptrdiff_t i;
 
   if (running_asynch_code)
     save_search_regs ();
@@ -1121,7 +1122,7 @@ search_buffer (Lisp_Object string, EMACS_INT pos, EMACS_INT pos_byte,
   if (RE && !(trivial_regexp_p (string) && NILP (Vsearch_spaces_regexp)))
     {
       unsigned char *p1, *p2;
-      EMACS_INT s1, s2;
+      ptrdiff_t s1, s2;
       struct re_pattern_buffer *bufp;
 
       bufp = compile_pattern (string,
@@ -1157,7 +1158,7 @@ search_buffer (Lisp_Object string, EMACS_INT pos, EMACS_INT pos_byte,
 
       while (n < 0)
 	{
-	  EMACS_INT val;
+	  ptrdiff_t val;
 	  val = re_search_2 (bufp, (char *) p1, s1, (char *) p2, s2,
 			     pos_byte - BEGV_BYTE, lim_byte - pos_byte,
 			     (NILP (Vinhibit_changing_match_data)
@@ -1201,7 +1202,7 @@ search_buffer (Lisp_Object string, EMACS_INT pos, EMACS_INT pos_byte,
 	}
       while (n > 0)
 	{
-	  EMACS_INT val;
+	  ptrdiff_t val;
 	  val = re_search_2 (bufp, (char *) p1, s1, (char *) p2, s2,
 			     pos_byte - BEGV_BYTE, lim_byte - pos_byte,
 			     (NILP (Vinhibit_changing_match_data)
@@ -1246,8 +1247,8 @@ search_buffer (Lisp_Object string, EMACS_INT pos, EMACS_INT pos_byte,
   else				/* non-RE case */
     {
       unsigned char *raw_pattern, *pat;
-      EMACS_INT raw_pattern_size;
-      EMACS_INT raw_pattern_size_byte;
+      ptrdiff_t raw_pattern_size;
+      ptrdiff_t raw_pattern_size_byte;
       unsigned char *patbuf;
       int multibyte = !NILP (BVAR (current_buffer, enable_multibyte_characters));
       unsigned char *base_pat;
@@ -1441,15 +1442,15 @@ search_buffer (Lisp_Object string, EMACS_INT pos, EMACS_INT pos_byte,
 
 static EMACS_INT
 simple_search (EMACS_INT n, unsigned char *pat,
-	       EMACS_INT len, EMACS_INT len_byte, Lisp_Object trt,
-	       EMACS_INT pos, EMACS_INT pos_byte,
-	       EMACS_INT lim, EMACS_INT lim_byte)
+	       ptrdiff_t len, ptrdiff_t len_byte, Lisp_Object trt,
+	       ptrdiff_t pos, ptrdiff_t pos_byte,
+	       ptrdiff_t lim, ptrdiff_t lim_byte)
 {
   int multibyte = ! NILP (BVAR (current_buffer, enable_multibyte_characters));
   int forward = n > 0;
   /* Number of buffer bytes matched.  Note that this may be different
      from len_byte in a multibyte buffer.  */
-  EMACS_INT match_byte;
+  ptrdiff_t match_byte;
 
   if (lim > pos && multibyte)
     while (n > 0)
@@ -1457,9 +1458,9 @@ simple_search (EMACS_INT n, unsigned char *pat,
 	while (1)
 	  {
 	    /* Try matching at position POS.  */
-	    EMACS_INT this_pos = pos;
-	    EMACS_INT this_pos_byte = pos_byte;
-	    EMACS_INT this_len = len;
+	    ptrdiff_t this_pos = pos;
+	    ptrdiff_t this_pos_byte = pos_byte;
+	    ptrdiff_t this_len = len;
 	    unsigned char *p = pat;
 	    if (pos + len > lim || pos_byte + len_byte > lim_byte)
 	      goto stop;
@@ -1503,8 +1504,8 @@ simple_search (EMACS_INT n, unsigned char *pat,
 	while (1)
 	  {
 	    /* Try matching at position POS.  */
-	    EMACS_INT this_pos = pos;
-	    EMACS_INT this_len = len;
+	    ptrdiff_t this_pos = pos;
+	    ptrdiff_t this_len = len;
 	    unsigned char *p = pat;
 
 	    if (pos + len > lim)
@@ -1542,9 +1543,9 @@ simple_search (EMACS_INT n, unsigned char *pat,
 	while (1)
 	  {
 	    /* Try matching at position POS.  */
-	    EMACS_INT this_pos = pos;
-	    EMACS_INT this_pos_byte = pos_byte;
-	    EMACS_INT this_len = len;
+	    ptrdiff_t this_pos = pos;
+	    ptrdiff_t this_pos_byte = pos_byte;
+	    ptrdiff_t this_len = len;
 	    const unsigned char *p = pat + len_byte;
 
 	    if (this_pos - len < lim || (pos_byte - len_byte) < lim_byte)
@@ -1585,8 +1586,8 @@ simple_search (EMACS_INT n, unsigned char *pat,
 	while (1)
 	  {
 	    /* Try matching at position POS.  */
-	    EMACS_INT this_pos = pos - len;
-	    EMACS_INT this_len = len;
+	    ptrdiff_t this_pos = pos - len;
+	    ptrdiff_t this_len = len;
 	    unsigned char *p = pat;
 
 	    if (this_pos < lim)
@@ -1650,18 +1651,18 @@ simple_search (EMACS_INT n, unsigned char *pat,
 
 static EMACS_INT
 boyer_moore (EMACS_INT n, unsigned char *base_pat,
-	     EMACS_INT len_byte,
+	     ptrdiff_t len_byte,
 	     Lisp_Object trt, Lisp_Object inverse_trt,
-	     EMACS_INT pos_byte, EMACS_INT lim_byte,
+	     ptrdiff_t pos_byte, ptrdiff_t lim_byte,
              int char_base)
 {
   int direction = ((n > 0) ? 1 : -1);
-  register EMACS_INT dirlen;
-  EMACS_INT limit;
+  register ptrdiff_t dirlen;
+  ptrdiff_t limit;
   int stride_for_teases = 0;
   int BM_tab[0400];
   register unsigned char *cursor, *p_limit;
-  register EMACS_INT i;
+  register ptrdiff_t i;
   register int j;
   unsigned char *pat, *pat_end;
   int multibyte = ! NILP (BVAR (current_buffer, enable_multibyte_characters));
@@ -1813,7 +1814,7 @@ boyer_moore (EMACS_INT n, unsigned char *base_pat,
      char if reverse) of pattern would align in a possible match.  */
   while (n != 0)
     {
-      EMACS_INT tail_end;
+      ptrdiff_t tail_end;
       unsigned char *tail_end_ptr;
 
       /* It's been reported that some (broken) compiler thinks that
@@ -1917,7 +1918,7 @@ boyer_moore (EMACS_INT n, unsigned char *base_pat,
 	      cursor += dirlen - i - direction;	/* fix cursor */
 	      if (i + direction == 0)
 		{
-		  EMACS_INT position, start, end;
+		  ptrdiff_t position, start, end;
 
 		  cursor -= direction;
 
@@ -2009,7 +2010,7 @@ boyer_moore (EMACS_INT n, unsigned char *base_pat,
 	      pos_byte += dirlen - i - direction;
 	      if (i + direction == 0)
 		{
-		  EMACS_INT position, start, end;
+		  ptrdiff_t position, start, end;
 		  pos_byte -= direction;
 
 		  position = pos_byte + ((direction > 0) ? 1 - len_byte : 0);
@@ -2050,9 +2051,9 @@ boyer_moore (EMACS_INT n, unsigned char *base_pat,
    Also clear out the match data for registers 1 and up.  */
 
 static void
-set_search_regs (EMACS_INT beg_byte, EMACS_INT nbytes)
+set_search_regs (ptrdiff_t beg_byte, ptrdiff_t nbytes)
 {
-  int i;
+  ptrdiff_t i;
 
   if (!NILP (Vinhibit_changing_match_data))
     return;
@@ -2087,7 +2088,7 @@ static Lisp_Object
 wordify (Lisp_Object string, int lax)
 {
   register unsigned char *o;
-  register EMACS_INT i, i_byte, len, punct_count = 0, word_count = 0;
+  register ptrdiff_t i, i_byte, len, punct_count = 0, word_count = 0;
   Lisp_Object val;
   int prev_c = 0;
   EMACS_INT adjust;
@@ -2124,14 +2125,24 @@ wordify (Lisp_Object string, int lax)
 	return empty_unibyte_string;
     }
 
-  adjust = - punct_count + 5 * (word_count - 1)
+  adjust = word_count - 1;
+  if (INT_MULTIPLY_OVERFLOW (5, adjust))
+    memory_full (SIZE_MAX);
+  adjust = - punct_count + 5 * adjust
     + ((lax && !whitespace_at_end) ? 2 : 4);
   if (STRING_MULTIBYTE (string))
-    val = make_uninit_multibyte_string (len + adjust,
-					SBYTES (string)
-					+ adjust);
+    {
+      if (INT_ADD_OVERFLOW (SBYTES (string), adjust))
+	memory_full (SIZE_MAX);
+      val = make_uninit_multibyte_string (len + adjust,
+					  SBYTES (string) + adjust);
+    }
   else
-    val = make_uninit_string (len + adjust);
+    {
+      if (INT_ADD_OVERFLOW (len, adjust))
+	memory_full (SIZE_MAX);
+      val = make_uninit_string (len + adjust);
+    }
 
   o = SDATA (val);
   *o++ = '\\';
@@ -2141,7 +2152,7 @@ wordify (Lisp_Object string, int lax)
   for (i = 0, i_byte = 0; i < len; )
     {
       int c;
-      EMACS_INT i_byte_orig = i_byte;
+      ptrdiff_t i_byte_orig = i_byte;
 
       FETCH_STRING_CHAR_AS_MULTIBYTE_ADVANCE (c, string, i, i_byte);
 
@@ -2398,14 +2409,14 @@ since only regular expressions have distinguished subexpressions.  */)
   (Lisp_Object newtext, Lisp_Object fixedcase, Lisp_Object literal, Lisp_Object string, Lisp_Object subexp)
 {
   enum { nochange, all_caps, cap_initial } case_action;
-  register EMACS_INT pos, pos_byte;
+  register ptrdiff_t pos, pos_byte;
   int some_multiletter_word;
   int some_lowercase;
   int some_uppercase;
   int some_nonuppercase_initial;
   register int c, prevc;
   ptrdiff_t sub;
-  EMACS_INT opoint, newpoint;
+  ptrdiff_t opoint, newpoint;
 
   CHECK_STRING (newtext);
 
@@ -2448,7 +2459,7 @@ since only regular expressions have distinguished subexpressions.  */)
   if (NILP (fixedcase))
     {
       /* Decide how to casify by examining the matched text. */
-      EMACS_INT last;
+      ptrdiff_t last;
 
       pos = search_regs.start[sub];
       last = search_regs.end[sub];
@@ -2535,19 +2546,19 @@ since only regular expressions have distinguished subexpressions.  */)
 	 if desired.  */
       if (NILP (literal))
 	{
-	  EMACS_INT lastpos = 0;
-	  EMACS_INT lastpos_byte = 0;
+	  ptrdiff_t lastpos = 0;
+	  ptrdiff_t lastpos_byte = 0;
 	  /* We build up the substituted string in ACCUM.  */
 	  Lisp_Object accum;
 	  Lisp_Object middle;
-	  EMACS_INT length = SBYTES (newtext);
+	  ptrdiff_t length = SBYTES (newtext);
 
 	  accum = Qnil;
 
 	  for (pos_byte = 0, pos = 0; pos_byte < length;)
 	    {
-	      EMACS_INT substart = -1;
-	      EMACS_INT subend = 0;
+	      ptrdiff_t substart = -1;
+	      ptrdiff_t subend = 0;
 	      int delbackslash = 0;
 
 	      FETCH_STRING_CHAR_ADVANCE (c, newtext, pos, pos_byte);
@@ -2563,8 +2574,8 @@ since only regular expressions have distinguished subexpressions.  */)
 		    }
 		  else if (c >= '1' && c <= '9')
 		    {
-		      if (search_regs.start[c - '0'] >= 0
-			  && c <= search_regs.num_regs + '0')
+		      if (c - '0' < search_regs.num_regs
+			  && 0 <= search_regs.start[c - '0'])
 			{
 			  substart = search_regs.start[c - '0'];
 			  subend = search_regs.end[c - '0'];
@@ -2702,7 +2713,7 @@ since only regular expressions have distinguished subexpressions.  */)
 
 	      if (c == '&')
 		idx = sub;
-	      else if (c >= '1' && c <= '9' && c <= search_regs.num_regs + '0')
+	      else if (c >= '1' && c <= '9' && c - '0' < search_regs.num_regs)
 		{
 		  if (search_regs.start[c - '0'] >= 1)
 		    idx = c - '0';
@@ -2754,7 +2765,7 @@ since only regular expressions have distinguished subexpressions.  */)
 	{
 	  if (buf_multibyte)
 	    {
-	      EMACS_INT nchars =
+	      ptrdiff_t nchars =
 		multibyte_chars_in_text (substed, substed_len);
 
 	      newtext = make_multibyte_string ((char *) substed, nchars,
@@ -2780,10 +2791,10 @@ since only regular expressions have distinguished subexpressions.  */)
 
   /* Adjust search data for this change.  */
   {
-    EMACS_INT oldend = search_regs.end[sub];
-    EMACS_INT oldstart = search_regs.start[sub];
-    EMACS_INT change = newpoint - search_regs.end[sub];
-    int i;
+    ptrdiff_t oldend = search_regs.end[sub];
+    ptrdiff_t oldstart = search_regs.start[sub];
+    ptrdiff_t change = newpoint - search_regs.end[sub];
+    ptrdiff_t i;
 
     for (i = 0; i < search_regs.num_regs; i++)
       {
@@ -2876,7 +2887,7 @@ Return value is undefined if the last search failed.  */)
 {
   Lisp_Object tail, prev;
   Lisp_Object *data;
-  int i, len;
+  ptrdiff_t i, len;
 
   if (!NILP (reseat))
     for (tail = reuse; CONSP (tail); tail = XCDR (tail))
@@ -2897,7 +2908,7 @@ Return value is undefined if the last search failed.  */)
   len = 0;
   for (i = 0; i < search_regs.num_regs; i++)
     {
-      EMACS_INT start = search_regs.start[i];
+      ptrdiff_t start = search_regs.start[i];
       if (start >= 0)
 	{
 	  if (EQ (last_thing_searched, Qt)
@@ -2988,11 +2999,13 @@ If optional arg RESEAT is non-nil, make markers on LIST point nowhere.  */)
 
   /* Allocate registers if they don't already exist.  */
   {
-    ptrdiff_t length = XFASTINT (Flength (list)) / 2;
+    EMACS_INT length = XFASTINT (Flength (list)) / 2;
 
     if (length > search_regs.num_regs)
       {
 	ptrdiff_t num_regs = search_regs.num_regs;
+	if (PTRDIFF_MAX < length)
+	  memory_full (SIZE_MAX);
 	search_regs.start =
 	  xpalloc (search_regs.start, &num_regs, length - num_regs,
 		   min (PTRDIFF_MAX, UINT_MAX), sizeof (regoff_t));
@@ -3022,7 +3035,7 @@ If optional arg RESEAT is non-nil, make markers on LIST point nowhere.  */)
 	  }
 	else
 	  {
-	    EMACS_INT from;
+	    Lisp_Object from;
 	    Lisp_Object m;
 
 	    m = marker;
@@ -3035,7 +3048,7 @@ If optional arg RESEAT is non-nil, make markers on LIST point nowhere.  */)
 	      }
 
 	    CHECK_NUMBER_COERCE_MARKER (marker);
-	    from = XINT (marker);
+	    from = marker;
 
 	    if (!NILP (reseat) && MARKERP (m))
 	      {
@@ -3052,8 +3065,18 @@ If optional arg RESEAT is non-nil, make markers on LIST point nowhere.  */)
 	      XSETFASTINT (marker, 0);
 
 	    CHECK_NUMBER_COERCE_MARKER (marker);
-	    search_regs.start[i] = from;
-	    search_regs.end[i] = XINT (marker);
+	    if (TYPE_MINIMUM (regoff_t) <= XINT (from)
+		&& XINT (from) <= TYPE_MAXIMUM (regoff_t)
+		&& TYPE_MINIMUM (regoff_t) <= XINT (marker)
+		&& XINT (marker) <= TYPE_MAXIMUM (regoff_t))
+	      {
+		search_regs.start[i] = XINT (from);
+		search_regs.end[i] = XINT (marker);
+	      }
+	    else
+	      {
+		search_regs.start[i] = -1;
+	      }
 
 	    if (!NILP (reseat) && MARKERP (m))
 	      {
diff --git a/src/sound.c b/src/sound.c
index 362c04b7d40..b95fa82202f 100644
--- a/src/sound.c
+++ b/src/sound.c
@@ -235,11 +235,11 @@ struct sound_device
 
   /* Return a preferred data size in bytes to be sent to write (below)
      each time.  2048 is used if this is NULL.  */
-  EMACS_INT (* period_size) (struct sound_device *sd);
+  ptrdiff_t (* period_size) (struct sound_device *sd);
 
   /* Write NYBTES bytes from BUFFER to device SD.  */
   void (* write) (struct sound_device *sd, const char *buffer,
-                  EMACS_INT nbytes);
+                  ptrdiff_t nbytes);
 
   /* A place for devices to store additional data.  */
   void *data;
@@ -291,7 +291,7 @@ static void vox_configure (struct sound_device *);
 static void vox_close (struct sound_device *sd);
 static void vox_choose_format (struct sound_device *, struct sound *);
 static int vox_init (struct sound_device *);
-static void vox_write (struct sound_device *, const char *, EMACS_INT);
+static void vox_write (struct sound_device *, const char *, ptrdiff_t);
 static void find_sound_type (struct sound *);
 static u_int32_t le2hl (u_int32_t);
 static u_int16_t le2hs (u_int16_t);
@@ -600,9 +600,9 @@ wav_play (struct sound *s, struct sound_device *sd)
   else
     {
       char *buffer;
-      EMACS_INT nbytes = 0;
-      EMACS_INT blksize = sd->period_size ? sd->period_size (sd) : 2048;
-      EMACS_INT data_left = header->data_length;
+      ptrdiff_t nbytes = 0;
+      ptrdiff_t blksize = sd->period_size ? sd->period_size (sd) : 2048;
+      ptrdiff_t data_left = header->data_length;
 
       buffer = (char *) alloca (blksize);
       lseek (s->fd, sizeof *header, SEEK_SET);
@@ -690,9 +690,9 @@ au_play (struct sound *s, struct sound_device *sd)
 	       SBYTES (s->data) - header->data_offset);
   else
     {
-      EMACS_INT blksize = sd->period_size ? sd->period_size (sd) : 2048;
+      ptrdiff_t blksize = sd->period_size ? sd->period_size (sd) : 2048;
       char *buffer;
-      EMACS_INT nbytes;
+      ptrdiff_t nbytes;
 
       /* Seek */
       lseek (s->fd, header->data_offset, SEEK_SET);
@@ -895,7 +895,7 @@ vox_init (struct sound_device *sd)
 /* Write NBYTES bytes from BUFFER to device SD.  */
 
 static void
-vox_write (struct sound_device *sd, const char *buffer, EMACS_INT nbytes)
+vox_write (struct sound_device *sd, const char *buffer, ptrdiff_t nbytes)
 {
   if (emacs_write (sd->fd, buffer, nbytes) != nbytes)
     sound_perror ("Error writing to sound device");
@@ -952,7 +952,7 @@ alsa_open (struct sound_device *sd)
     alsa_sound_perror (file, err);
 }
 
-static EMACS_INT
+static ptrdiff_t
 alsa_period_size (struct sound_device *sd)
 {
   struct alsa_params *p = (struct alsa_params *) sd->data;
@@ -1155,13 +1155,13 @@ alsa_choose_format (struct sound_device *sd, struct sound *s)
 /* Write NBYTES bytes from BUFFER to device SD.  */
 
 static void
-alsa_write (struct sound_device *sd, const char *buffer, EMACS_INT nbytes)
+alsa_write (struct sound_device *sd, const char *buffer, ptrdiff_t nbytes)
 {
   struct alsa_params *p = (struct alsa_params *) sd->data;
 
   /* The the third parameter to snd_pcm_writei is frames, not bytes. */
   int fact = snd_pcm_format_size (sd->format, 1) * sd->channels;
-  EMACS_INT nwritten = 0;
+  ptrdiff_t nwritten = 0;
   int err;
 
   while (nwritten < nbytes)
@@ -1348,7 +1348,7 @@ Internal use only, use `play-sound' instead.  */)
   (Lisp_Object sound)
 {
   Lisp_Object attrs[SOUND_ATTR_SENTINEL];
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
 #ifndef WINDOWSNT
   Lisp_Object file;
diff --git a/src/syntax.c b/src/syntax.c
index 3e51099794b..2960a9c96a0 100644
--- a/src/syntax.c
+++ b/src/syntax.c
@@ -94,8 +94,8 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
    string-ender-char to distinguish  comments/strings started by
    comment_fence and string_fence codes.  */
 
-#define ST_COMMENT_STYLE (256 + 1)
-#define ST_STRING_STYLE (256 + 2)
+#define ST_COMMENT_STYLE (SYNTAX_FLAGS_COMMENT_STYLE (~0, ~0) + 1)
+#define ST_STRING_STYLE (MAX_CHAR + 1)
 
 static Lisp_Object Qsyntax_table_p;
 static Lisp_Object Qsyntax_table, Qscan_error;
@@ -111,18 +111,18 @@ Lisp_Object syntax_temp;
 
 struct lisp_parse_state
   {
-    int depth;	   /* Depth at end of parsing.  */
+    EMACS_INT depth;	/* Depth at end of parsing.  */
     int instring;  /* -1 if not within string, else desired terminator.  */
-    int incomment; /* -1 if in unnestable comment else comment nesting */
+    EMACS_INT incomment; /* -1 if in unnestable comment else comment nesting */
     int comstyle;  /* comment style a=0, or b=1, or ST_COMMENT_STYLE.  */
     int quoted;	   /* Nonzero if just after an escape char at end of parsing */
-    int mindepth;  /* Minimum depth seen while scanning.  */
+    EMACS_INT mindepth;	/* Minimum depth seen while scanning.  */
     /* Char number of most recent start-of-expression at current level */
-    EMACS_INT thislevelstart;
+    ptrdiff_t thislevelstart;
     /* Char number of start of containing expression */
-    EMACS_INT prevlevelstart;
-    EMACS_INT location;	     /* Char number at which parsing stopped.  */
-    EMACS_INT comstr_start;  /* Position of last comment/string starter.  */
+    ptrdiff_t prevlevelstart;
+    ptrdiff_t location;	     /* Char number at which parsing stopped.  */
+    ptrdiff_t comstr_start;  /* Position of last comment/string starter.  */
     Lisp_Object levelstarts; /* Char numbers of starts-of-expression
 				of levels (starting from outermost).  */
   };
@@ -135,12 +135,12 @@ struct lisp_parse_state
    find_start_begv is the BEGV value when it was found.
    find_start_modiff is the value of MODIFF when it was found.  */
 
-static EMACS_INT find_start_pos;
-static EMACS_INT find_start_value;
-static EMACS_INT find_start_value_byte;
+static ptrdiff_t find_start_pos;
+static ptrdiff_t find_start_value;
+static ptrdiff_t find_start_value_byte;
 static struct buffer *find_start_buffer;
-static EMACS_INT find_start_begv;
-static int find_start_modiff;
+static ptrdiff_t find_start_begv;
+static EMACS_INT find_start_modiff;
 
 
 static Lisp_Object Fsyntax_table_p (Lisp_Object);
@@ -148,7 +148,7 @@ static Lisp_Object skip_chars (int, Lisp_Object, Lisp_Object, int);
 static Lisp_Object skip_syntaxes (int, Lisp_Object, Lisp_Object);
 static Lisp_Object scan_lists (EMACS_INT, EMACS_INT, EMACS_INT, int);
 static void scan_sexps_forward (struct lisp_parse_state *,
-                                EMACS_INT, EMACS_INT, EMACS_INT, int,
+                                ptrdiff_t, ptrdiff_t, ptrdiff_t, EMACS_INT,
                                 int, Lisp_Object, int);
 static int in_classes (int, Lisp_Object);
 
@@ -177,7 +177,7 @@ struct gl_state_s gl_state;		/* Global state of syntax parser.  */
    start/end of OBJECT.  */
 
 void
-update_syntax_table (EMACS_INT charpos, EMACS_INT count, int init,
+update_syntax_table (ptrdiff_t charpos, EMACS_INT count, int init,
 		     Lisp_Object object)
 {
   Lisp_Object tmp_table;
@@ -339,12 +339,12 @@ update_syntax_table (EMACS_INT charpos, EMACS_INT count, int init,
    or after.  On return global syntax data is good for lookup at CHARPOS. */
 
 static int
-char_quoted (EMACS_INT charpos, EMACS_INT bytepos)
+char_quoted (ptrdiff_t charpos, ptrdiff_t bytepos)
 {
   register enum syntaxcode code;
-  register EMACS_INT beg = BEGV;
+  register ptrdiff_t beg = BEGV;
   register int quoted = 0;
-  EMACS_INT orig = charpos;
+  ptrdiff_t orig = charpos;
 
   while (charpos > beg)
     {
@@ -367,8 +367,8 @@ char_quoted (EMACS_INT charpos, EMACS_INT bytepos)
 /* Return the bytepos one character before BYTEPOS.
    We assume that BYTEPOS is not at the start of the buffer.  */
 
-static inline EMACS_INT
-dec_bytepos (EMACS_INT bytepos)
+static inline ptrdiff_t
+dec_bytepos (ptrdiff_t bytepos)
 {
   if (NILP (BVAR (current_buffer, enable_multibyte_characters)))
     return bytepos - 1;
@@ -391,10 +391,10 @@ dec_bytepos (EMACS_INT bytepos)
    valid on return from the subroutine, so the caller should explicitly
    update the global data.  */
 
-static EMACS_INT
-find_defun_start (EMACS_INT pos, EMACS_INT pos_byte)
+static ptrdiff_t
+find_defun_start (ptrdiff_t pos, ptrdiff_t pos_byte)
 {
-  EMACS_INT opoint = PT, opoint_byte = PT_BYTE;
+  ptrdiff_t opoint = PT, opoint_byte = PT_BYTE;
 
   if (!open_paren_in_column_0_is_defun_start)
     {
@@ -461,7 +461,7 @@ find_defun_start (EMACS_INT pos, EMACS_INT pos_byte)
 /* Return the SYNTAX_COMEND_FIRST of the character before POS, POS_BYTE.  */
 
 static int
-prev_char_comend_first (EMACS_INT pos, EMACS_INT pos_byte)
+prev_char_comend_first (ptrdiff_t pos, ptrdiff_t pos_byte)
 {
   int c, val;
 
@@ -503,7 +503,7 @@ prev_char_comend_first (EMACS_INT pos, EMACS_INT pos_byte)
    the returned value (or at FROM, if the search was not successful).  */
 
 static int
-back_comment (EMACS_INT from, EMACS_INT from_byte, EMACS_INT stop, int comnested, int comstyle, EMACS_INT *charpos_ptr, EMACS_INT *bytepos_ptr)
+back_comment (ptrdiff_t from, ptrdiff_t from_byte, ptrdiff_t stop, int comnested, int comstyle, ptrdiff_t *charpos_ptr, ptrdiff_t *bytepos_ptr)
 {
   /* Look back, counting the parity of string-quotes,
      and recording the comment-starters seen.
@@ -522,14 +522,14 @@ back_comment (EMACS_INT from, EMACS_INT from_byte, EMACS_INT stop, int comnested
      inside another comment).
      Test case:  { a (* b } c (* d *) */
   int comment_lossage = 0;
-  EMACS_INT comment_end = from;
-  EMACS_INT comment_end_byte = from_byte;
-  EMACS_INT comstart_pos = 0;
-  EMACS_INT comstart_byte IF_LINT (= 0);
+  ptrdiff_t comment_end = from;
+  ptrdiff_t comment_end_byte = from_byte;
+  ptrdiff_t comstart_pos = 0;
+  ptrdiff_t comstart_byte IF_LINT (= 0);
   /* Place where the containing defun starts,
      or 0 if we didn't come across it yet.  */
-  EMACS_INT defun_start = 0;
-  EMACS_INT defun_start_byte = 0;
+  ptrdiff_t defun_start = 0;
+  ptrdiff_t defun_start_byte = 0;
   register enum syntaxcode code;
   int nesting = 1;		/* current comment nesting */
   int c;
@@ -543,7 +543,7 @@ back_comment (EMACS_INT from, EMACS_INT from_byte, EMACS_INT stop, int comnested
      that determines quote parity to the comment-end.  */
   while (from != stop)
     {
-      EMACS_INT temp_byte;
+      ptrdiff_t temp_byte;
       int prev_syntax, com2start, com2end;
       int comstart;
 
@@ -581,7 +581,7 @@ back_comment (EMACS_INT from, EMACS_INT from_byte, EMACS_INT stop, int comnested
 	 have %..\n and %{..}%.  */
       if (from > stop && (com2end || comstart))
 	{
-	  EMACS_INT next = from, next_byte = from_byte;
+	  ptrdiff_t next = from, next_byte = from_byte;
 	  int next_c, next_syntax;
 	  DEC_BOTH (next, next_byte);
 	  UPDATE_SYNTAX_TABLE_BACKWARD (next);
@@ -737,7 +737,8 @@ back_comment (EMACS_INT from, EMACS_INT from_byte, EMACS_INT stop, int comnested
 	{
 	  scan_sexps_forward (&state,
 			      defun_start, defun_start_byte,
-			      comment_end, -10000, 0, Qnil, 0);
+			      comment_end, TYPE_MINIMUM (EMACS_INT),
+			      0, Qnil, 0);
 	  defun_start = comment_end;
 	  if (state.incomment == (comnested ? 1 : -1)
 	      && state.comstyle == comstyle)
@@ -1099,13 +1100,13 @@ DEFUN ("internal-describe-syntax-value", Finternal_describe_syntax_value,
   first = XCAR (value);
   match_lisp = XCDR (value);
 
-  if (!INTEGERP (first) || !(NILP (match_lisp) || INTEGERP (match_lisp)))
+  if (!INTEGERP (first) || !(NILP (match_lisp) || CHARACTERP (match_lisp)))
     {
       insert_string ("invalid");
       return syntax;
     }
 
-  syntax_code = XINT (first);
+  syntax_code = XINT (first) & INT_MAX;
   code = (enum syntaxcode) (syntax_code & 0377);
   start1 = SYNTAX_FLAGS_COMSTART_FIRST (syntax_code);
   start2 = SYNTAX_FLAGS_COMSTART_SECOND (syntax_code);;
@@ -1223,12 +1224,12 @@ DEFUN ("internal-describe-syntax-value", Finternal_describe_syntax_value,
    If that many words cannot be found before the end of the buffer, return 0.
    COUNT negative means scan backward and stop at word beginning.  */
 
-EMACS_INT
-scan_words (register EMACS_INT from, register EMACS_INT count)
+ptrdiff_t
+scan_words (register ptrdiff_t from, register EMACS_INT count)
 {
-  register EMACS_INT beg = BEGV;
-  register EMACS_INT end = ZV;
-  register EMACS_INT from_byte = CHAR_TO_BYTE (from);
+  register ptrdiff_t beg = BEGV;
+  register ptrdiff_t end = ZV;
+  register ptrdiff_t from_byte = CHAR_TO_BYTE (from);
   register enum syntaxcode code;
   int ch0, ch1;
   Lisp_Object func, pos;
@@ -1263,7 +1264,7 @@ scan_words (register EMACS_INT from, register EMACS_INT count)
       if (! NILP (Ffboundp (func)))
 	{
 	  pos = call2 (func, make_number (from - 1), make_number (end));
-	  if (INTEGERP (pos) && XINT (pos) > from)
+	  if (RANGED_INTEGERP (from + 1, pos, ZV))
 	    {
 	      from = XINT (pos);
 	      from_byte = CHAR_TO_BYTE (from);
@@ -1313,7 +1314,7 @@ scan_words (register EMACS_INT from, register EMACS_INT count)
       if (! NILP (Ffboundp (func)))
  	{
 	  pos = call2 (func, make_number (from), make_number (beg));
-	  if (INTEGERP (pos) && XINT (pos) < from)
+	  if (RANGED_INTEGERP (BEGV, pos, from - 1))
 	    {
 	      from = XINT (pos);
 	      from_byte = CHAR_TO_BYTE (from);
@@ -1357,7 +1358,7 @@ and the function returns nil.  Field boundaries are not noticed if
   (Lisp_Object arg)
 {
   Lisp_Object tmp;
-  int orig_val, val;
+  ptrdiff_t orig_val, val;
 
   if (NILP (arg))
     XSETFASTINT (arg, 1);
@@ -1432,14 +1433,14 @@ skip_chars (int forwardp, Lisp_Object string, Lisp_Object lim, int handle_iso_cl
   int *char_ranges IF_LINT (= NULL);
   int n_char_ranges = 0;
   int negate = 0;
-  register EMACS_INT i, i_byte;
+  register ptrdiff_t i, i_byte;
   /* Set to 1 if the current buffer is multibyte and the region
      contains non-ASCII chars.  */
   int multibyte;
   /* Set to 1 if STRING is multibyte and it contains non-ASCII
      chars.  */
   int string_multibyte;
-  EMACS_INT size_byte;
+  ptrdiff_t size_byte;
   const unsigned char *str;
   int len;
   Lisp_Object iso_classes;
@@ -1753,9 +1754,9 @@ skip_chars (int forwardp, Lisp_Object string, Lisp_Object lim, int handle_iso_cl
     }
 
   {
-    EMACS_INT start_point = PT;
-    EMACS_INT pos = PT;
-    EMACS_INT pos_byte = PT_BYTE;
+    ptrdiff_t start_point = PT;
+    ptrdiff_t pos = PT;
+    ptrdiff_t pos_byte = PT_BYTE;
     unsigned char *p = PT_ADDR, *endp, *stop;
 
     if (forwardp)
@@ -1925,9 +1926,9 @@ skip_syntaxes (int forwardp, Lisp_Object string, Lisp_Object lim)
   register unsigned int c;
   unsigned char fastmap[0400];
   int negate = 0;
-  register EMACS_INT i, i_byte;
+  register ptrdiff_t i, i_byte;
   int multibyte;
-  EMACS_INT size_byte;
+  ptrdiff_t size_byte;
   unsigned char *str;
 
   CHECK_STRING (string);
@@ -1980,9 +1981,9 @@ skip_syntaxes (int forwardp, Lisp_Object string, Lisp_Object lim)
       fastmap[i] ^= 1;
 
   {
-    EMACS_INT start_point = PT;
-    EMACS_INT pos = PT;
-    EMACS_INT pos_byte = PT_BYTE;
+    ptrdiff_t start_point = PT;
+    ptrdiff_t pos = PT;
+    ptrdiff_t pos_byte = PT_BYTE;
     unsigned char *p = PT_ADDR, *endp, *stop;
 
     if (forwardp)
@@ -2135,10 +2136,10 @@ in_classes (int c, Lisp_Object iso_classes)
    remains valid for forward search starting at the returned position. */
 
 static int
-forw_comment (EMACS_INT from, EMACS_INT from_byte, EMACS_INT stop,
-	      int nesting, int style, int prev_syntax,
-	      EMACS_INT *charpos_ptr, EMACS_INT *bytepos_ptr,
-	      int *incomment_ptr)
+forw_comment (ptrdiff_t from, ptrdiff_t from_byte, ptrdiff_t stop,
+	      EMACS_INT nesting, int style, int prev_syntax,
+	      ptrdiff_t *charpos_ptr, ptrdiff_t *bytepos_ptr,
+	      EMACS_INT *incomment_ptr)
 {
   register int c, c1;
   register enum syntaxcode code;
@@ -2240,17 +2241,17 @@ If COUNT comments are found as expected, with nothing except whitespace
 between them, return t; otherwise return nil.  */)
   (Lisp_Object count)
 {
-  register EMACS_INT from;
-  EMACS_INT from_byte;
-  register EMACS_INT stop;
+  register ptrdiff_t from;
+  ptrdiff_t from_byte;
+  register ptrdiff_t stop;
   register int c, c1;
   register enum syntaxcode code;
   int comstyle = 0;	    /* style of comment encountered */
   int comnested = 0;	    /* whether the comment is nestable or not */
   int found;
   EMACS_INT count1;
-  EMACS_INT out_charpos, out_bytepos;
-  int dummy;
+  ptrdiff_t out_charpos, out_bytepos;
+  ptrdiff_t dummy;
 
   CHECK_NUMBER (count);
   count1 = XINT (count);
@@ -2374,7 +2375,7 @@ between them, return t; otherwise return nil.  */)
 	    {
 	      /* Skip until first preceding unquoted comment_fence.  */
 	      int fence_found = 0;
-	      EMACS_INT ini = from, ini_byte = from_byte;
+	      ptrdiff_t ini = from, ini_byte = from_byte;
 
 	      while (1)
 		{
@@ -2457,21 +2458,22 @@ static Lisp_Object
 scan_lists (register EMACS_INT from, EMACS_INT count, EMACS_INT depth, int sexpflag)
 {
   Lisp_Object val;
-  register EMACS_INT stop = count > 0 ? ZV : BEGV;
+  register ptrdiff_t stop = count > 0 ? ZV : BEGV;
   register int c, c1;
   int stringterm;
   int quoted;
   int mathexit = 0;
   register enum syntaxcode code, temp_code;
-  int min_depth = depth;    /* Err out if depth gets less than this.  */
+  EMACS_INT min_depth = depth;    /* Err out if depth gets less than this.  */
   int comstyle = 0;	    /* style of comment encountered */
   int comnested = 0;	    /* whether the comment is nestable or not */
-  EMACS_INT temp_pos;
+  ptrdiff_t temp_pos;
   EMACS_INT last_good = from;
   int found;
-  EMACS_INT from_byte;
-  EMACS_INT out_bytepos, out_charpos;
-  int temp, dummy;
+  ptrdiff_t from_byte;
+  ptrdiff_t out_bytepos, out_charpos;
+  int temp;
+  ptrdiff_t dummy;
   int multibyte_symbol_p = sexpflag && multibyte_syntax_as_symbol;
 
   if (depth > 0) min_depth = 0;
@@ -2890,11 +2892,11 @@ DEFUN ("backward-prefix-chars", Fbackward_prefix_chars, Sbackward_prefix_chars,
 This includes chars with "quote" or "prefix" syntax (' or p).  */)
   (void)
 {
-  EMACS_INT beg = BEGV;
-  EMACS_INT opoint = PT;
-  EMACS_INT opoint_byte = PT_BYTE;
-  EMACS_INT pos = PT;
-  EMACS_INT pos_byte = PT_BYTE;
+  ptrdiff_t beg = BEGV;
+  ptrdiff_t opoint = PT;
+  ptrdiff_t opoint_byte = PT_BYTE;
+  ptrdiff_t pos = PT;
+  ptrdiff_t pos_byte = PT_BYTE;
   int c;
 
   if (pos <= beg)
@@ -2935,8 +2937,8 @@ This includes chars with "quote" or "prefix" syntax (' or p).  */)
 
 static void
 scan_sexps_forward (struct lisp_parse_state *stateptr,
-		    EMACS_INT from, EMACS_INT from_byte, EMACS_INT end,
-		    int targetdepth, int stopbefore,
+		    ptrdiff_t from, ptrdiff_t from_byte, ptrdiff_t end,
+		    EMACS_INT targetdepth, int stopbefore,
 		    Lisp_Object oldstate, int commentstop)
 {
   struct lisp_parse_state state;
@@ -2944,23 +2946,23 @@ scan_sexps_forward (struct lisp_parse_state *stateptr,
   register enum syntaxcode code;
   int c1;
   int comnested;
-  struct level { int last, prev; };
+  struct level { ptrdiff_t last, prev; };
   struct level levelstart[100];
   register struct level *curlevel = levelstart;
   struct level *endlevel = levelstart + 100;
-  register int depth;	/* Paren depth of current scanning location.
+  register EMACS_INT depth; /* Paren depth of current scanning location.
 			   level - levelstart equals this except
 			   when the depth becomes negative.  */
-  int mindepth;		/* Lowest DEPTH value seen.  */
+  EMACS_INT mindepth;		/* Lowest DEPTH value seen.  */
   int start_quoted = 0;		/* Nonzero means starting after a char quote */
   Lisp_Object tem;
-  EMACS_INT prev_from;		/* Keep one character before FROM.  */
-  EMACS_INT prev_from_byte;
+  ptrdiff_t prev_from;		/* Keep one character before FROM.  */
+  ptrdiff_t prev_from_byte;
   int prev_from_syntax;
   int boundary_stop = commentstop == -1;
   int nofence;
   int found;
-  EMACS_INT out_bytepos, out_charpos;
+  ptrdiff_t out_bytepos, out_charpos;
   int temp;
 
   prev_from = from;
@@ -3004,7 +3006,7 @@ do { prev_from = from;				\
       tem = Fcar (oldstate);
       /* Check whether we are inside string_fence-style string: */
       state.instring = (!NILP (tem)
-			? (INTEGERP (tem) ? XINT (tem) : ST_STRING_STYLE)
+			? (CHARACTERP (tem) ? XFASTINT (tem) : ST_STRING_STYLE)
 			: -1);
 
       oldstate = Fcdr (oldstate);
@@ -3024,19 +3026,21 @@ do { prev_from = from;				\
       tem = Fcar (oldstate);
       state.comstyle = (NILP (tem)
 			? 0
-			: (EQ (tem, Qsyntax_table)
-			   ? ST_COMMENT_STYLE
-			   : INTEGERP (tem) ? XINT (tem) : 1));
+			: (RANGED_INTEGERP (0, tem, ST_COMMENT_STYLE)
+			   ? XINT (tem)
+			   : ST_COMMENT_STYLE));
 
       oldstate = Fcdr (oldstate);
       tem = Fcar (oldstate);
-      state.comstr_start = NILP (tem) ? -1 : XINT (tem) ;
+      state.comstr_start =
+	RANGED_INTEGERP (PTRDIFF_MIN, tem, PTRDIFF_MAX) ? XINT (tem) : -1;
       oldstate = Fcdr (oldstate);
       tem = Fcar (oldstate);
       while (!NILP (tem))		/* >= second enclosing sexps.  */
 	{
-	  /* curlevel++->last ran into compiler bug on Apollo */
-	  curlevel->last = XINT (Fcar (tem));
+	  Lisp_Object temhd = Fcar (tem);
+	  if (RANGED_INTEGERP (PTRDIFF_MIN, temhd, PTRDIFF_MAX))
+	    curlevel->last = XINT (temhd);
 	  if (++curlevel == endlevel)
 	    curlevel--; /* error ("Nesting too deep for parser"); */
 	  curlevel->prev = -1;
@@ -3309,14 +3313,14 @@ Fourth arg STOPBEFORE non-nil means stop when come to
  any character that starts a sexp.
 Fifth arg OLDSTATE is a list like what this function returns.
  It is used to initialize the state of the parse.  Elements number 1, 2, 6
- and 8 are ignored.
+ are ignored.
 Sixth arg COMMENTSTOP non-nil means stop at the start of a comment.
  If it is symbol `syntax-table', stop after the start of a comment or a
  string, or after end of a comment or a string.  */)
   (Lisp_Object from, Lisp_Object to, Lisp_Object targetdepth, Lisp_Object stopbefore, Lisp_Object oldstate, Lisp_Object commentstop)
 {
   struct lisp_parse_state state;
-  int target;
+  EMACS_INT target;
 
   if (!NILP (targetdepth))
     {
@@ -3324,7 +3328,7 @@ Sixth arg COMMENTSTOP non-nil means stop at the start of a comment.
       target = XINT (targetdepth);
     }
   else
-    target = -100000;		/* We won't reach this depth */
+    target = TYPE_MINIMUM (EMACS_INT);	/* We won't reach this depth */
 
   validate_region (&from, &to);
   scan_sexps_forward (&state, XINT (from), CHAR_TO_BYTE (XINT (from)),
diff --git a/src/syntax.h b/src/syntax.h
index 42d689cb96c..1ea37ac5d5f 100644
--- a/src/syntax.h
+++ b/src/syntax.h
@@ -19,7 +19,7 @@ You should have received a copy of the GNU General Public License
 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 
 
-extern void update_syntax_table (EMACS_INT, EMACS_INT, int, Lisp_Object);
+extern void update_syntax_table (ptrdiff_t, EMACS_INT, int, Lisp_Object);
 
 /* The standard syntax table is stored where it will automatically
    be used in all new buffers.  */
@@ -277,15 +277,15 @@ while (0)
 struct gl_state_s
 {
   Lisp_Object object;			/* The object we are scanning. */
-  EMACS_INT start;			/* Where to stop. */
-  EMACS_INT stop;			/* Where to stop. */
+  ptrdiff_t start;			/* Where to stop. */
+  ptrdiff_t stop;			/* Where to stop. */
   int use_global;			/* Whether to use global_code
 					   or c_s_t. */
   Lisp_Object global_code;		/* Syntax code of current char. */
   Lisp_Object current_syntax_table;	/* Syntax table for current pos. */
   Lisp_Object old_prop;			/* Syntax-table prop at prev pos. */
-  EMACS_INT b_property;			/* First index where c_s_t is valid. */
-  EMACS_INT e_property;			/* First index where c_s_t is
+  ptrdiff_t b_property;			/* First index where c_s_t is valid. */
+  ptrdiff_t e_property;			/* First index where c_s_t is
 					   not valid. */
   INTERVAL forward_i;			/* Where to start lookup on forward */
   INTERVAL backward_i;			/* or backward movement.  The
@@ -295,8 +295,8 @@ struct gl_state_s
 					   intervals too, depending
 					   on: */
   /* Offset for positions specified to UPDATE_SYNTAX_TABLE.  */
-  EMACS_INT offset;
+  ptrdiff_t offset;
 };
 
 extern struct gl_state_s gl_state;
-extern EMACS_INT scan_words (EMACS_INT, EMACS_INT);
+extern ptrdiff_t scan_words (ptrdiff_t, EMACS_INT);
diff --git a/src/sysdep.c b/src/sysdep.c
index f97a8585253..ba296a2d094 100644
--- a/src/sysdep.c
+++ b/src/sysdep.c
@@ -296,7 +296,7 @@ int wait_debugging EXTERNALLY_VISIBLE;
 #ifndef MSDOS
 
 static void
-wait_for_termination_1 (int pid, int interruptible)
+wait_for_termination_1 (pid_t pid, int interruptible)
 {
   while (1)
     {
@@ -344,14 +344,14 @@ wait_for_termination_1 (int pid, int interruptible)
    make sure it will get eliminated (not remain forever as a zombie) */
 
 void
-wait_for_termination (int pid)
+wait_for_termination (pid_t pid)
 {
   wait_for_termination_1 (pid, 0);
 }
 
 /* Like the above, but allow keyboard interruption. */
 void
-interruptible_wait_for_termination (int pid)
+interruptible_wait_for_termination (pid_t pid)
 {
   wait_for_termination_1 (pid, 1);
 }
@@ -1895,8 +1895,8 @@ emacs_close (int fd)
 /* Read from FILEDESC to a buffer BUF with size NBYTE, retrying if interrupted.
    Return the number of bytes read, which might be less than NBYTE.
    On error, set errno and return -1.  */
-EMACS_INT
-emacs_read (int fildes, char *buf, EMACS_INT nbyte)
+ptrdiff_t
+emacs_read (int fildes, char *buf, ptrdiff_t nbyte)
 {
   register ssize_t rtnval;
 
@@ -1912,11 +1912,11 @@ emacs_read (int fildes, char *buf, EMACS_INT nbyte)
 /* Write to FILEDES from a buffer BUF with size NBYTE, retrying if interrupted
    or if a partial write occurs.  Return the number of bytes written, setting
    errno if this is less than NBYTE.  */
-EMACS_INT
-emacs_write (int fildes, const char *buf, EMACS_INT nbyte)
+ptrdiff_t
+emacs_write (int fildes, const char *buf, ptrdiff_t nbyte)
 {
   ssize_t rtnval;
-  EMACS_INT bytes_written;
+  ptrdiff_t bytes_written;
 
   bytes_written = 0;
 
@@ -2151,7 +2151,8 @@ set_file_times (const char *filename, EMACS_TIME atime, EMACS_TIME mtime)
 int
 mkdir (char *dpath, int dmode)
 {
-  int cpid, status, fd;
+  pid_t cpid;
+  int status, fd;
   struct stat statbuf;
 
   if (stat (dpath, &statbuf) == 0)
@@ -2681,7 +2682,10 @@ system_process_attributes (Lisp_Object pid)
   char *cmdline = NULL;
   ptrdiff_t cmdsize = 0, cmdline_size;
   unsigned char c;
-  int proc_id, ppid, uid, gid, pgrp, sess, tty, tpgid, thcount;
+  printmax_t proc_id;
+  int ppid, pgrp, sess, tty, tpgid, thcount;
+  uid_t uid;
+  gid_t gid;
   unsigned long long u_time, s_time, cutime, cstime, start;
   long priority, niceness, rss;
   unsigned long minflt, majflt, cminflt, cmajflt, vsize;
@@ -2692,11 +2696,18 @@ system_process_attributes (Lisp_Object pid)
   Lisp_Object attrs = Qnil;
   Lisp_Object cmd_str, decoded_cmd, tem;
   struct gcpro gcpro1, gcpro2;
-  EMACS_INT uid_eint, gid_eint;
 
   CHECK_NUMBER_OR_FLOAT (pid);
-  proc_id = FLOATP (pid) ? XFLOAT_DATA (pid) : XINT (pid);
-  sprintf (procfn, "/proc/%u", proc_id);
+  if (FLOATP (pid))
+    {
+      double v = XFLOAT_DATA (pid);
+      if (! (TYPE_MINIMUM (pid_t) <= v && v < TYPE_MAXIMUM (pid_t) + 1.0))
+	return attrs;
+      proc_id = v;
+    }
+  else
+    proc_id = XINT (pid);
+  sprintf (procfn, "/proc/%"pMd, proc_id);
   if (stat (procfn, &st) < 0)
     return attrs;
 
@@ -2704,9 +2715,7 @@ system_process_attributes (Lisp_Object pid)
 
   /* euid egid */
   uid = st.st_uid;
-  /* Use of EMACS_INT stops GCC whining about limited range of data type.  */
-  uid_eint = uid;
-  attrs = Fcons (Fcons (Qeuid, make_fixnum_or_float (uid_eint)), attrs);
+  attrs = Fcons (Fcons (Qeuid, make_fixnum_or_float (uid)), attrs);
   BLOCK_INPUT;
   pw = getpwuid (uid);
   UNBLOCK_INPUT;
@@ -2714,8 +2723,7 @@ system_process_attributes (Lisp_Object pid)
     attrs = Fcons (Fcons (Quser, build_string (pw->pw_name)), attrs);
 
   gid = st.st_gid;
-  gid_eint = gid;
-  attrs = Fcons (Fcons (Qegid, make_fixnum_or_float (gid_eint)), attrs);
+  attrs = Fcons (Fcons (Qegid, make_fixnum_or_float (gid)), attrs);
   BLOCK_INPUT;
   gr = getgrgid (gid);
   UNBLOCK_INPUT;
@@ -2955,15 +2963,24 @@ system_process_attributes (Lisp_Object pid)
   struct psinfo pinfo;
   int fd;
   ssize_t nread;
-  int proc_id, uid, gid;
+  printmax_t proc_id;
+  uid_t uid;
+  gid_t gid;
   Lisp_Object attrs = Qnil;
   Lisp_Object decoded_cmd, tem;
   struct gcpro gcpro1, gcpro2;
-  EMACS_INT uid_eint, gid_eint;
 
   CHECK_NUMBER_OR_FLOAT (pid);
-  proc_id = FLOATP (pid) ? XFLOAT_DATA (pid) : XINT (pid);
-  sprintf (procfn, "/proc/%u", proc_id);
+  if (FLOATP (pid))
+    {
+      double v = XFLOAT_DATA (pid);
+      if (! (TYPE_MINIMUM (pid_t) <= v && v < TYPE_MAXIMUM (pid_t) + 1.0))
+	return attrs;
+      proc_id = v;
+    }
+  else
+    proc_id = XINT (v);
+  sprintf (procfn, "/proc/%"pMd, proc_id);
   if (stat (procfn, &st) < 0)
     return attrs;
 
@@ -2971,9 +2988,7 @@ system_process_attributes (Lisp_Object pid)
 
   /* euid egid */
   uid = st.st_uid;
-  /* Use of EMACS_INT stops GCC whining about limited range of data type.  */
-  uid_eint = uid;
-  attrs = Fcons (Fcons (Qeuid, make_fixnum_or_float (uid_eint)), attrs);
+  attrs = Fcons (Fcons (Qeuid, make_fixnum_or_float (uid)), attrs);
   BLOCK_INPUT;
   pw = getpwuid (uid);
   UNBLOCK_INPUT;
@@ -2981,8 +2996,7 @@ system_process_attributes (Lisp_Object pid)
     attrs = Fcons (Fcons (Quser, build_string (pw->pw_name)), attrs);
 
   gid = st.st_gid;
-  gid_eint = gid;
-  attrs = Fcons (Fcons (Qegid, make_fixnum_or_float (gid_eint)), attrs);
+  attrs = Fcons (Fcons (Qegid, make_fixnum_or_float (gid)), attrs);
   BLOCK_INPUT;
   gr = getgrgid (gid);
   UNBLOCK_INPUT;
diff --git a/src/term.c b/src/term.c
index 4a671d048c4..fb3166a6e50 100644
--- a/src/term.c
+++ b/src/term.c
@@ -1915,8 +1915,7 @@ produce_special_glyphs (struct it *it, enum display_element_type what)
       else
 	SET_GLYPH_FROM_CHAR (glyph, '\\');
       if (it->dp
-	  && (gc = DISP_CONTINUE_GLYPH (it->dp), GLYPH_CODE_P (gc))
-	  && GLYPH_CODE_CHAR_VALID_P (gc))
+	  && (gc = DISP_CONTINUE_GLYPH (it->dp), GLYPH_CODE_P (gc)))
 	{
 	  /* FIXME: Should we mirror GC for R2L lines?  */
 	  SET_GLYPH_FROM_GLYPH_CODE (glyph, gc);
@@ -1928,8 +1927,7 @@ produce_special_glyphs (struct it *it, enum display_element_type what)
       /* Truncation glyph.  */
       SET_GLYPH_FROM_CHAR (glyph, '$');
       if (it->dp
-	  && (gc = DISP_TRUNC_GLYPH (it->dp), GLYPH_CODE_P (gc))
-	  && GLYPH_CODE_CHAR_VALID_P (gc))
+	  && (gc = DISP_TRUNC_GLYPH (it->dp), GLYPH_CODE_P (gc)))
 	{
 	  /* FIXME: Should we mirror GC for R2L lines?  */
 	  SET_GLYPH_FROM_GLYPH_CODE (glyph, gc);
@@ -2279,7 +2277,7 @@ set_tty_color_mode (struct tty_display_info *tty, struct frame *f)
   else
     color_mode = Qnil;
 
-  mode = INTEGERP (color_mode) ? XINT (color_mode) : 0;
+  mode = TYPE_RANGED_INTEGERP (int, color_mode) ? XINT (color_mode) : 0;
 
   if (mode != tty->previous_color_mode)
     {
diff --git a/src/termhooks.h b/src/termhooks.h
index 63d166b6418..ddcbf53eb6f 100644
--- a/src/termhooks.h
+++ b/src/termhooks.h
@@ -229,7 +229,7 @@ struct input_event
      For a HELP_EVENT, this is the position within the object
       (stored in ARG below) where the help was found.  */
   /* In WindowsNT, for a mouse wheel event, this is the delta.  */
-  EMACS_INT code;
+  ptrdiff_t code;
   enum scroll_bar_part part;
 
   int modifiers;		/* See enum below for interpretation.  */
diff --git a/src/textprop.c b/src/textprop.c
index 29425f7a550..a877e2a67ae 100644
--- a/src/textprop.c
+++ b/src/textprop.c
@@ -124,7 +124,7 @@ INTERVAL
 validate_interval_range (Lisp_Object object, Lisp_Object *begin, Lisp_Object *end, int force)
 {
   register INTERVAL i;
-  EMACS_INT searchpos;
+  ptrdiff_t searchpos;
 
   CHECK_STRING_OR_BUFFER (object);
   CHECK_NUMBER_COERCE_MARKER (*begin);
@@ -160,7 +160,7 @@ validate_interval_range (Lisp_Object object, Lisp_Object *begin, Lisp_Object *en
     }
   else
     {
-      EMACS_INT len = SCHARS (object);
+      ptrdiff_t len = SCHARS (object);
 
       if (! (0 <= XINT (*begin) && XINT (*begin) <= XINT (*end)
 	     && XINT (*end) <= len))
@@ -514,10 +514,10 @@ erase_properties (INTERVAL i)
    POSITION is BEG-based.  */
 
 INTERVAL
-interval_of (EMACS_INT position, Lisp_Object object)
+interval_of (ptrdiff_t position, Lisp_Object object)
 {
   register INTERVAL i;
-  EMACS_INT beg, end;
+  ptrdiff_t beg, end;
 
   if (NILP (object))
     XSETBUFFER (object, current_buffer);
@@ -775,7 +775,7 @@ past position LIMIT; return LIMIT if nothing is found before LIMIT.  */)
   else
     {
       Lisp_Object initial_value, value;
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
 
       if (! NILP (object))
 	CHECK_BUFFER (object);
@@ -858,7 +858,7 @@ position LIMIT; return LIMIT if nothing is found before reaching LIMIT.  */)
     }
   else
     {
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
 
       if (! NILP (object))
 	CHECK_BUFFER (object);
@@ -1140,7 +1140,7 @@ Return t if any property value actually changed, nil otherwise.  */)
   (Lisp_Object start, Lisp_Object end, Lisp_Object properties, Lisp_Object object)
 {
   register INTERVAL i, unchanged;
-  register EMACS_INT s, len;
+  register ptrdiff_t s, len;
   register int modified = 0;
   struct gcpro gcpro1;
 
@@ -1170,7 +1170,7 @@ Return t if any property value actually changed, nil otherwise.  */)
          skip it.  */
       if (interval_has_all_properties (properties, i))
 	{
-	  EMACS_INT got = (LENGTH (i) - (s - i->position));
+	  ptrdiff_t got = (LENGTH (i) - (s - i->position));
 	  if (got >= len)
 	    RETURN_UNGCPRO (Qnil);
 	  len -= got;
@@ -1345,7 +1345,7 @@ void
 set_text_properties_1 (Lisp_Object start, Lisp_Object end, Lisp_Object properties, Lisp_Object buffer, INTERVAL i)
 {
   register INTERVAL prev_changed = NULL_INTERVAL;
-  register EMACS_INT s, len;
+  register ptrdiff_t s, len;
   INTERVAL unchanged;
 
   if (XINT (start) < XINT (end))
@@ -1438,7 +1438,7 @@ Use `set-text-properties' if you want to remove all text properties.  */)
   (Lisp_Object start, Lisp_Object end, Lisp_Object properties, Lisp_Object object)
 {
   register INTERVAL i, unchanged;
-  register EMACS_INT s, len;
+  register ptrdiff_t s, len;
   register int modified = 0;
 
   if (NILP (object))
@@ -1457,7 +1457,7 @@ Use `set-text-properties' if you want to remove all text properties.  */)
          it covers the entire region.  */
       if (! interval_has_some_properties (properties, i))
 	{
-	  EMACS_INT got = (LENGTH (i) - (s - i->position));
+	  ptrdiff_t got = (LENGTH (i) - (s - i->position));
 	  if (got >= len)
 	    return Qnil;
 	  len -= got;
@@ -1524,7 +1524,7 @@ Return t if any property was actually removed, nil otherwise.  */)
   (Lisp_Object start, Lisp_Object end, Lisp_Object list_of_properties, Lisp_Object object)
 {
   register INTERVAL i, unchanged;
-  register EMACS_INT s, len;
+  register ptrdiff_t s, len;
   register int modified = 0;
   Lisp_Object properties;
   properties = list_of_properties;
@@ -1545,7 +1545,7 @@ Return t if any property was actually removed, nil otherwise.  */)
          it covers the entire region.  */
       if (! interval_has_some_properties_list (properties, i))
 	{
-	  EMACS_INT got = (LENGTH (i) - (s - i->position));
+	  ptrdiff_t got = (LENGTH (i) - (s - i->position));
 	  if (got >= len)
 	    return Qnil;
 	  len -= got;
@@ -1634,7 +1634,7 @@ markers).  If OBJECT is a string, START and END are 0-based indices into it.  */
   (Lisp_Object start, Lisp_Object end, Lisp_Object property, Lisp_Object value, Lisp_Object object)
 {
   register INTERVAL i;
-  register EMACS_INT e, pos;
+  register ptrdiff_t e, pos;
 
   if (NILP (object))
     XSETBUFFER (object, current_buffer);
@@ -1670,7 +1670,7 @@ markers).  If OBJECT is a string, START and END are 0-based indices into it.  */
   (Lisp_Object start, Lisp_Object end, Lisp_Object property, Lisp_Object value, Lisp_Object object)
 {
   register INTERVAL i;
-  register EMACS_INT s, e;
+  register ptrdiff_t s, e;
 
   if (NILP (object))
     XSETBUFFER (object, current_buffer);
@@ -1780,7 +1780,7 @@ copy_text_properties (Lisp_Object start, Lisp_Object end, Lisp_Object src, Lisp_
   Lisp_Object res;
   Lisp_Object stuff;
   Lisp_Object plist;
-  EMACS_INT s, e, e2, p, len;
+  ptrdiff_t s, e, e2, p, len;
   int modified = 0;
   struct gcpro gcpro1, gcpro2;
 
@@ -1792,8 +1792,11 @@ copy_text_properties (Lisp_Object start, Lisp_Object end, Lisp_Object src, Lisp_
   {
     Lisp_Object dest_start, dest_end;
 
+    e = XINT (pos) + (XINT (end) - XINT (start));
+    if (MOST_POSITIVE_FIXNUM < e)
+      args_out_of_range (pos, end);
     dest_start = pos;
-    XSETFASTINT (dest_end, XINT (dest_start) + (XINT (end) - XINT (start)));
+    XSETFASTINT (dest_end, e);
     /* Apply this to a copy of pos; it will try to increment its arguments,
        which we don't want.  */
     validate_interval_range (dest, &dest_start, &dest_end, soft);
@@ -1877,12 +1880,12 @@ text_property_list (Lisp_Object object, Lisp_Object start, Lisp_Object end, Lisp
   i = validate_interval_range (object, &start, &end, soft);
   if (!NULL_INTERVAL_P (i))
     {
-      EMACS_INT s = XINT (start);
-      EMACS_INT e = XINT (end);
+      ptrdiff_t s = XINT (start);
+      ptrdiff_t e = XINT (end);
 
       while (s < e)
 	{
-	  EMACS_INT interval_end, len;
+	  ptrdiff_t interval_end, len;
 	  Lisp_Object plist;
 
 	  interval_end = i->position + LENGTH (i);
@@ -1960,7 +1963,7 @@ Lisp_Object
 extend_property_ranges (Lisp_Object list, Lisp_Object new_end)
 {
   Lisp_Object prev = Qnil, head = list;
-  EMACS_INT max = XINT (new_end);
+  ptrdiff_t max = XINT (new_end);
 
   for (; CONSP (list); prev = list, list = XCDR (list))
     {
@@ -2014,7 +2017,7 @@ call_mod_hooks (Lisp_Object list, Lisp_Object start, Lisp_Object end)
 
 void
 verify_interval_modification (struct buffer *buf,
-			      EMACS_INT start, EMACS_INT end)
+			      ptrdiff_t start, ptrdiff_t end)
 {
   register INTERVAL intervals = BUF_INTERVALS (buf);
   register INTERVAL i;
@@ -2035,7 +2038,7 @@ verify_interval_modification (struct buffer *buf,
 
   if (start > end)
     {
-      EMACS_INT temp = start;
+      ptrdiff_t temp = start;
       start = end;
       end = temp;
     }
diff --git a/src/undo.c b/src/undo.c
index 7e121e8b27d..7e999fe5120 100644
--- a/src/undo.c
+++ b/src/undo.c
@@ -30,7 +30,7 @@ static struct buffer *last_undo_buffer;
 
 /* Position of point last time we inserted a boundary.  */
 static struct buffer *last_boundary_buffer;
-static EMACS_INT last_boundary_position;
+static ptrdiff_t last_boundary_position;
 
 Lisp_Object Qinhibit_read_only;
 
@@ -51,7 +51,7 @@ static Lisp_Object pending_boundary;
    undo record that will be added just after this command terminates.  */
 
 static void
-record_point (EMACS_INT pt)
+record_point (ptrdiff_t pt)
 {
   int at_boundary;
 
@@ -113,7 +113,7 @@ record_point (EMACS_INT pt)
    because we don't need to record the contents.)  */
 
 void
-record_insert (EMACS_INT beg, EMACS_INT length)
+record_insert (ptrdiff_t beg, ptrdiff_t length)
 {
   Lisp_Object lbeg, lend;
 
@@ -148,7 +148,7 @@ record_insert (EMACS_INT beg, EMACS_INT length)
    of the characters in STRING, at location BEG.  */
 
 void
-record_delete (EMACS_INT beg, Lisp_Object string)
+record_delete (ptrdiff_t beg, Lisp_Object string)
 {
   Lisp_Object sbeg;
 
@@ -176,7 +176,7 @@ record_delete (EMACS_INT beg, Lisp_Object string)
    won't be inverted automatically by undoing the buffer modification.  */
 
 void
-record_marker_adjustment (Lisp_Object marker, EMACS_INT adjustment)
+record_marker_adjustment (Lisp_Object marker, ptrdiff_t adjustment)
 {
   if (EQ (BVAR (current_buffer, undo_list), Qt))
     return;
@@ -199,7 +199,7 @@ record_marker_adjustment (Lisp_Object marker, EMACS_INT adjustment)
    The replacement must not change the number of characters.  */
 
 void
-record_change (EMACS_INT beg, EMACS_INT length)
+record_change (ptrdiff_t beg, ptrdiff_t length)
 {
   record_delete (beg, make_buffer_string (beg, beg + length, 1));
   record_insert (beg, length);
@@ -233,7 +233,7 @@ record_first_change (void)
    for LENGTH characters starting at position BEG in BUFFER.  */
 
 void
-record_property_change (EMACS_INT beg, EMACS_INT length,
+record_property_change (ptrdiff_t beg, ptrdiff_t length,
 			Lisp_Object prop, Lisp_Object value,
 			Lisp_Object buffer)
 {
@@ -308,11 +308,11 @@ truncate_undo_list (struct buffer *b)
 {
   Lisp_Object list;
   Lisp_Object prev, next, last_boundary;
-  int size_so_far = 0;
+  EMACS_INT size_so_far = 0;
 
   /* Make sure that calling undo-outer-limit-function
      won't cause another GC.  */
-  int count = inhibit_garbage_collection ();
+  ptrdiff_t count = inhibit_garbage_collection ();
 
   /* Make the buffer current to get its local values of variables such
      as undo_limit.  Also so that Vundo_outer_limit_function can
@@ -444,8 +444,8 @@ Return what remains of the list.  */)
 {
   struct gcpro gcpro1, gcpro2;
   Lisp_Object next;
-  int count = SPECPDL_INDEX ();
-  register int arg;
+  ptrdiff_t count = SPECPDL_INDEX ();
+  register EMACS_INT arg;
   Lisp_Object oldlist;
   int did_apply = 0;
 
diff --git a/src/w32fns.c b/src/w32fns.c
index f48e5764b4c..5c135b2e46d 100644
--- a/src/w32fns.c
+++ b/src/w32fns.c
@@ -4059,7 +4059,7 @@ This function is an internal primitive--use `make-frame' instead.  */)
   int minibuffer_only = 0;
   long window_prompting = 0;
   int width, height;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
   Lisp_Object display;
   struct w32_display_info *dpyinfo = NULL;
@@ -5170,7 +5170,7 @@ x_create_tip_frame (struct w32_display_info *dpyinfo,
   Lisp_Object name;
   long window_prompting = 0;
   int width, height;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3;
   struct kboard *kb;
   int face_change_count_before = face_change_count;
@@ -5518,7 +5518,7 @@ Text larger than the specified size is clipped.  */)
   int i, width, height, seen_reversed_p;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
   int old_windows_or_buffers_changed = windows_or_buffers_changed;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   specbind (Qinhibit_redisplay, Qt);
 
@@ -5797,7 +5797,7 @@ DEFUN ("x-hide-tip", Fx_hide_tip, Sx_hide_tip, 0, 0, 0,
 Value is t if tooltip was open, nil otherwise.  */)
   (void)
 {
-  int count;
+  ptrdiff_t count;
   Lisp_Object deleted, frame, timer;
   struct gcpro gcpro1, gcpro2;
 
@@ -5919,7 +5919,7 @@ Otherwise, if ONLY-DIR-P is non-nil, the user can only select directories.  */)
 {
   struct frame *f = SELECTED_FRAME ();
   Lisp_Object file = Qnil;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5, gcpro6;
   char filename[MAX_PATH + 1];
   char init_dir[MAX_PATH + 1];
diff --git a/src/w32menu.c b/src/w32menu.c
index c31a8c1fd96..98b053a9e23 100644
--- a/src/w32menu.c
+++ b/src/w32menu.c
@@ -381,7 +381,7 @@ set_frame_menubar (FRAME_PTR f, int first_time, int deep_p)
 
       struct buffer *prev = current_buffer;
       Lisp_Object buffer;
-      int specpdl_count = SPECPDL_INDEX ();
+      ptrdiff_t specpdl_count = SPECPDL_INDEX ();
       int previous_menu_items_used = f->menu_bar_items_used;
       Lisp_Object *previous_items
 	= (Lisp_Object *) alloca (previous_menu_items_used
diff --git a/src/window.c b/src/window.c
index 39210b91616..3014d90ff79 100644
--- a/src/window.c
+++ b/src/window.c
@@ -63,7 +63,7 @@ static int displayed_window_lines (struct window *);
 static struct window *decode_window (Lisp_Object);
 static int count_windows (struct window *);
 static int get_leaf_windows (struct window *, struct window **, int);
-static void window_scroll (Lisp_Object, int, int, int);
+static void window_scroll (Lisp_Object, EMACS_INT, int, int);
 static void window_scroll_pixel_based (Lisp_Object, int, int, int);
 static void window_scroll_line_based (Lisp_Object, int, int, int);
 static int freeze_window_start (struct window *, void *);
@@ -127,8 +127,8 @@ static int window_scroll_pixel_based_preserve_x;
 static int window_scroll_pixel_based_preserve_y;
 
 /* Same for window_scroll_line_based.  */
-static int window_scroll_preserve_hpos;
-static int window_scroll_preserve_vpos;
+static EMACS_INT window_scroll_preserve_hpos;
+static EMACS_INT window_scroll_preserve_vpos;
 
 static struct window *
 decode_window (register Lisp_Object window)
@@ -379,7 +379,7 @@ select_window (Lisp_Object window, Lisp_Object norecord, int inhibit_point_swap)
      redisplay_window has altered point after scrolling,
      because it makes the change only in the window.  */
   {
-    register EMACS_INT new_point = marker_position (w->pointm);
+    register ptrdiff_t new_point = marker_position (w->pointm);
     if (new_point < BEGV)
       SET_PT (BEGV);
     else if (new_point > ZV)
@@ -691,10 +691,10 @@ window so that the location of point moves off-window.  */)
   (Lisp_Object window, Lisp_Object ncol)
 {
   struct window *w = decode_window (window);
-  int hscroll;
+  ptrdiff_t hscroll;
 
   CHECK_NUMBER (ncol);
-  hscroll = max (0, XINT (ncol));
+  hscroll = clip_to_bounds (0, XINT (ncol), PTRDIFF_MAX);
 
   /* Prevent redisplay shortcuts when changing the hscroll.  */
   if (XINT (w->hscroll) != hscroll)
@@ -1526,7 +1526,8 @@ Return nil if window display is not up-to-date.  In that case, use
   register struct window *w;
   register struct buffer *b;
   struct glyph_row *row, *end_row;
-  int max_y, crop, i, n;
+  int max_y, crop, i;
+  EMACS_INT n;
 
   w = decode_window (window);
 
@@ -2596,7 +2597,7 @@ window-start value is reasonable when this function is called.  */)
   struct window *w, *r, *s;
   struct frame *f;
   Lisp_Object sibling, pwindow, swindow IF_LINT (= Qnil), delta;
-  EMACS_INT startpos IF_LINT (= 0);
+  ptrdiff_t startpos IF_LINT (= 0);
   int top IF_LINT (= 0), new_top, resize_failed;
 
   w = decode_any_window (window);
@@ -2925,7 +2926,7 @@ select_frame_norecord (Lisp_Object frame)
 void
 run_window_configuration_change_hook (struct frame *f)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object frame, global_wcch
     = Fdefault_value (Qwindow_configuration_change_hook);
   XSETFRAME (frame, f);
@@ -2956,7 +2957,7 @@ run_window_configuration_change_hook (struct frame *f)
 	if (!NILP (Flocal_variable_p (Qwindow_configuration_change_hook,
 				      buffer)))
 	  {
-	    int inner_count = SPECPDL_INDEX ();
+	    ptrdiff_t inner_count = SPECPDL_INDEX ();
 	    record_unwind_protect (select_window_norecord, Fselected_window ());
 	    select_window_norecord (window);
 	    run_funs (Fbuffer_local_value (Qwindow_configuration_change_hook,
@@ -2991,7 +2992,7 @@ set_window_buffer (Lisp_Object window, Lisp_Object buffer, int run_hooks_p, int
 {
   struct window *w = XWINDOW (window);
   struct buffer *b = XBUFFER (buffer);
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   int samebuf = EQ (buffer, w->buffer);
 
   w->buffer = buffer;
@@ -3225,7 +3226,7 @@ temp_output_buffer_show (register Lisp_Object buf)
       /* Run temp-buffer-show-hook, with the chosen window selected
 	 and its buffer current.  */
       {
-        int count = SPECPDL_INDEX ();
+        ptrdiff_t count = SPECPDL_INDEX ();
         Lisp_Object prev_window, prev_buffer;
         prev_window = selected_window;
         XSETBUFFER (prev_buffer, old);
@@ -4212,9 +4213,10 @@ window_internal_height (struct window *w)
    respectively.  */
 
 static void
-window_scroll (Lisp_Object window, int n, int whole, int noerror)
+window_scroll (Lisp_Object window, EMACS_INT n, int whole, int noerror)
 {
   immediate_quit = 1;
+  n = clip_to_bounds (INT_MIN, n, INT_MAX);
 
   /* If we must, use the pixel-based version which is much slower than
      the line-based one but can handle varying line heights.  */
@@ -4310,7 +4312,7 @@ window_scroll_pixel_based (Lisp_Object window, int n, int whole, int noerror)
 	      /* Maybe modify window start instead of scrolling.  */
 	      if (rbot > 0 || w->vscroll < 0)
 		{
-		  EMACS_INT spos;
+		  ptrdiff_t spos;
 
 		  Fset_window_vscroll (window, make_number (0), Qt);
 		  /* If there are other text lines above the current row,
@@ -4365,7 +4367,7 @@ window_scroll_pixel_based (Lisp_Object window, int n, int whole, int noerror)
   start_display (&it, w, start);
   if (whole)
     {
-      EMACS_INT start_pos = IT_CHARPOS (it);
+      ptrdiff_t start_pos = IT_CHARPOS (it);
       int dy = WINDOW_FRAME_LINE_HEIGHT (w);
       dy = max ((window_box_height (w)
 		 - next_screen_context_lines * dy),
@@ -4452,8 +4454,8 @@ window_scroll_pixel_based (Lisp_Object window, int n, int whole, int noerror)
 
   if (! vscrolled)
     {
-      EMACS_INT pos = IT_CHARPOS (it);
-      EMACS_INT bytepos;
+      ptrdiff_t pos = IT_CHARPOS (it);
+      ptrdiff_t bytepos;
 
       /* If in the middle of a multi-glyph character move forward to
 	 the next character.  */
@@ -4523,7 +4525,7 @@ window_scroll_pixel_based (Lisp_Object window, int n, int whole, int noerror)
     }
   else if (n < 0)
     {
-      EMACS_INT charpos, bytepos;
+      ptrdiff_t charpos, bytepos;
       int partial_p;
 
       /* Save our position, for the
@@ -4600,12 +4602,12 @@ window_scroll_line_based (Lisp_Object window, int n, int whole, int noerror)
      in `grep-mode-font-lock-keywords').  So we use a marker to record
      the old point position, to prevent crashes in SET_PT_BOTH.  */
   Lisp_Object opoint_marker = Fpoint_marker ();
-  register EMACS_INT pos, pos_byte;
+  register ptrdiff_t pos, pos_byte;
   register int ht = window_internal_height (w);
   register Lisp_Object tem;
   int lose;
   Lisp_Object bolp;
-  EMACS_INT startpos;
+  ptrdiff_t startpos;
   Lisp_Object original_pos = Qnil;
 
   /* If scrolling screen-fulls, compute the number of lines to
@@ -4754,7 +4756,7 @@ window_scroll_line_based (Lisp_Object window, int n, int whole, int noerror)
 static void
 scroll_command (Lisp_Object n, int direction)
 {
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   xassert (eabs (direction) == 1);
 
@@ -4869,7 +4871,7 @@ specifies the window to scroll.  This takes precedence over
 {
   Lisp_Object window;
   struct window *w;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   window = Fother_window_for_scrolling ();
   w = XWINDOW (window);
@@ -4911,7 +4913,7 @@ by this function.  This happens in an interactive call.  */)
   (register Lisp_Object arg, Lisp_Object set_minimum)
 {
   Lisp_Object result;
-  int hscroll;
+  EMACS_INT hscroll;
   struct window *w = XWINDOW (selected_window);
 
   if (NILP (arg))
@@ -4940,7 +4942,7 @@ by this function.  This happens in an interactive call.  */)
   (register Lisp_Object arg, Lisp_Object set_minimum)
 {
   Lisp_Object result;
-  int hscroll;
+  EMACS_INT hscroll;
   struct window *w = XWINDOW (selected_window);
 
   if (NILP (arg))
@@ -5051,7 +5053,7 @@ and redisplay normally--don't erase and redraw the frame.  */)
   struct buffer *buf = XBUFFER (w->buffer);
   struct buffer *obuf = current_buffer;
   int center_p = 0;
-  EMACS_INT charpos, bytepos;
+  ptrdiff_t charpos, bytepos;
   EMACS_INT iarg IF_LINT (= 0);
   int this_scroll_margin;
 
@@ -5400,7 +5402,7 @@ the return value is nil.  Otherwise the value is t.  */)
   Lisp_Object frame;
   Lisp_Object auto_buffer_name;
   FRAME_PTR f;
-  EMACS_INT old_point = -1;
+  ptrdiff_t old_point = -1;
 
   CHECK_WINDOW_CONFIGURATION (configuration);
 
@@ -6117,7 +6119,7 @@ Fourth parameter HORIZONTAL-TYPE is currently unused.  */)
 
   if (!NILP (width))
     {
-      CHECK_NATNUM (width);
+      CHECK_RANGED_INTEGER (0, width, INT_MAX);
 
       if (XINT (width) == 0)
 	vertical_type = Qnil;
diff --git a/src/xdisp.c b/src/xdisp.c
index 6ba92f3ed79..763862cd0e3 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -748,7 +748,7 @@ static Lisp_Object Qinhibit_free_realized_faces;
 Lisp_Object help_echo_string;
 Lisp_Object help_echo_window;
 Lisp_Object help_echo_object;
-EMACS_INT help_echo_pos;
+ptrdiff_t help_echo_pos;
 
 /* Temporary variable for XTread_socket.  */
 
@@ -795,33 +795,33 @@ static Lisp_Object get_it_property (struct it *it, Lisp_Object prop);
 
 static void handle_line_prefix (struct it *);
 
-static void pint2str (char *, int, EMACS_INT);
-static void pint2hrstr (char *, int, EMACS_INT);
+static void pint2str (char *, int, ptrdiff_t);
+static void pint2hrstr (char *, int, ptrdiff_t);
 static struct text_pos run_window_scroll_functions (Lisp_Object,
                                                     struct text_pos);
 static void reconsider_clip_changes (struct window *, struct buffer *);
 static int text_outside_line_unchanged_p (struct window *,
-					  EMACS_INT, EMACS_INT);
+					  ptrdiff_t, ptrdiff_t);
 static void store_mode_line_noprop_char (char);
 static int store_mode_line_noprop (const char *, int, int);
 static void handle_stop (struct it *);
-static void handle_stop_backwards (struct it *, EMACS_INT);
+static void handle_stop_backwards (struct it *, ptrdiff_t);
 static void vmessage (const char *, va_list) ATTRIBUTE_FORMAT_PRINTF (1, 0);
 static void ensure_echo_area_buffers (void);
 static Lisp_Object unwind_with_echo_area_buffer (Lisp_Object);
 static Lisp_Object with_echo_area_buffer_unwind_data (struct window *);
 static int with_echo_area_buffer (struct window *, int,
-                                  int (*) (EMACS_INT, Lisp_Object, EMACS_INT, EMACS_INT),
-                                  EMACS_INT, Lisp_Object, EMACS_INT, EMACS_INT);
+                                  int (*) (ptrdiff_t, Lisp_Object, ptrdiff_t, ptrdiff_t),
+                                  ptrdiff_t, Lisp_Object, ptrdiff_t, ptrdiff_t);
 static void clear_garbaged_frames (void);
-static int current_message_1 (EMACS_INT, Lisp_Object, EMACS_INT, EMACS_INT);
+static int current_message_1 (ptrdiff_t, Lisp_Object, ptrdiff_t, ptrdiff_t);
 static void pop_message (void);
-static int truncate_message_1 (EMACS_INT, Lisp_Object, EMACS_INT, EMACS_INT);
-static void set_message (const char *, Lisp_Object, EMACS_INT, int);
-static int set_message_1 (EMACS_INT, Lisp_Object, EMACS_INT, EMACS_INT);
+static int truncate_message_1 (ptrdiff_t, Lisp_Object, ptrdiff_t, ptrdiff_t);
+static void set_message (const char *, Lisp_Object, ptrdiff_t, int);
+static int set_message_1 (ptrdiff_t, Lisp_Object, ptrdiff_t, ptrdiff_t);
 static int display_echo_area (struct window *);
-static int display_echo_area_1 (EMACS_INT, Lisp_Object, EMACS_INT, EMACS_INT);
-static int resize_mini_window_1 (EMACS_INT, Lisp_Object, EMACS_INT, EMACS_INT);
+static int display_echo_area_1 (ptrdiff_t, Lisp_Object, ptrdiff_t, ptrdiff_t);
+static int resize_mini_window_1 (ptrdiff_t, Lisp_Object, ptrdiff_t, ptrdiff_t);
 static Lisp_Object unwind_redisplay (Lisp_Object);
 static int string_char_and_length (const unsigned char *, int *);
 static struct text_pos display_prop_end (struct it *, Lisp_Object,
@@ -834,10 +834,10 @@ static struct glyph_row *get_overlay_arrow_glyph_row (struct window *,
 static void extend_face_to_end_of_line (struct it *);
 static int append_space_for_newline (struct it *, int);
 static int cursor_row_fully_visible_p (struct window *, int, int);
-static int try_scrolling (Lisp_Object, int, EMACS_INT, EMACS_INT, int, int);
+static int try_scrolling (Lisp_Object, int, ptrdiff_t, ptrdiff_t, int, int);
 static int try_cursor_movement (Lisp_Object, struct text_pos, int *);
-static int trailing_whitespace_p (EMACS_INT);
-static intmax_t message_log_check_duplicate (EMACS_INT, EMACS_INT);
+static int trailing_whitespace_p (ptrdiff_t);
+static intmax_t message_log_check_duplicate (ptrdiff_t, ptrdiff_t);
 static void push_it (struct it *, struct text_pos *);
 static void pop_it (struct it *);
 static void sync_frame_with_window_matrix_rows (struct window *);
@@ -850,7 +850,7 @@ static Lisp_Object redisplay_window_error (Lisp_Object);
 static Lisp_Object redisplay_window_0 (Lisp_Object);
 static Lisp_Object redisplay_window_1 (Lisp_Object);
 static int set_cursor_from_row (struct window *, struct glyph_row *,
-				struct glyph_matrix *, EMACS_INT, EMACS_INT,
+				struct glyph_matrix *, ptrdiff_t, ptrdiff_t,
 				int, int);
 static int update_menu_bar (struct frame *, int, int);
 static int try_window_reusing_current_matrix (struct window *);
@@ -862,14 +862,14 @@ static int display_mode_element (struct it *, int, int, int, Lisp_Object, Lisp_O
 static int store_mode_line_string (const char *, Lisp_Object, int, int, int, Lisp_Object);
 static const char *decode_mode_spec (struct window *, int, int, Lisp_Object *);
 static void display_menu_bar (struct window *);
-static EMACS_INT display_count_lines (EMACS_INT, EMACS_INT, EMACS_INT,
-				      EMACS_INT *);
+static ptrdiff_t display_count_lines (ptrdiff_t, ptrdiff_t, ptrdiff_t,
+				      ptrdiff_t *);
 static int display_string (const char *, Lisp_Object, Lisp_Object,
-                           EMACS_INT, EMACS_INT, struct it *, int, int, int, int);
+                           ptrdiff_t, ptrdiff_t, struct it *, int, int, int, int);
 static void compute_line_metrics (struct it *);
 static void run_redisplay_end_trigger_hook (struct it *);
-static int get_overlay_strings (struct it *, EMACS_INT);
-static int get_overlay_strings_1 (struct it *, EMACS_INT, int);
+static int get_overlay_strings (struct it *, ptrdiff_t);
+static int get_overlay_strings_1 (struct it *, ptrdiff_t, int);
 static void next_overlay_string (struct it *);
 static void reseat (struct it *, struct text_pos, int);
 static void reseat_1 (struct it *, struct text_pos, int);
@@ -884,14 +884,14 @@ static int next_element_from_buffer (struct it *);
 static int next_element_from_composition (struct it *);
 static int next_element_from_image (struct it *);
 static int next_element_from_stretch (struct it *);
-static void load_overlay_strings (struct it *, EMACS_INT);
+static void load_overlay_strings (struct it *, ptrdiff_t);
 static int init_from_display_pos (struct it *, struct window *,
                                   struct display_pos *);
 static void reseat_to_string (struct it *, const char *,
-                              Lisp_Object, EMACS_INT, EMACS_INT, int, int);
+                              Lisp_Object, ptrdiff_t, ptrdiff_t, int, int);
 static int get_next_display_element (struct it *);
 static enum move_it_result
-       move_it_in_display_line_to (struct it *, EMACS_INT, int,
+       move_it_in_display_line_to (struct it *, ptrdiff_t, int,
 				   enum move_operation_enum);
 void move_it_vertically_backward (struct it *, int);
 static void init_to_row_start (struct it *, struct window *,
@@ -901,20 +901,20 @@ static int init_to_row_end (struct it *, struct window *,
 static void back_to_previous_line_start (struct it *);
 static int forward_to_next_line_start (struct it *, int *, struct bidi_it *);
 static struct text_pos string_pos_nchars_ahead (struct text_pos,
-                                                Lisp_Object, EMACS_INT);
-static struct text_pos string_pos (EMACS_INT, Lisp_Object);
-static struct text_pos c_string_pos (EMACS_INT, const char *, int);
-static EMACS_INT number_of_chars (const char *, int);
+                                                Lisp_Object, ptrdiff_t);
+static struct text_pos string_pos (ptrdiff_t, Lisp_Object);
+static struct text_pos c_string_pos (ptrdiff_t, const char *, int);
+static ptrdiff_t number_of_chars (const char *, int);
 static void compute_stop_pos (struct it *);
 static void compute_string_pos (struct text_pos *, struct text_pos,
                                 Lisp_Object);
 static int face_before_or_after_it_pos (struct it *, int);
-static EMACS_INT next_overlay_change (EMACS_INT);
+static ptrdiff_t next_overlay_change (ptrdiff_t);
 static int handle_display_spec (struct it *, Lisp_Object, Lisp_Object,
-				Lisp_Object, struct text_pos *, EMACS_INT, int);
+				Lisp_Object, struct text_pos *, ptrdiff_t, int);
 static int handle_single_display_spec (struct it *, Lisp_Object,
                                        Lisp_Object, Lisp_Object,
-                                       struct text_pos *, EMACS_INT, int, int);
+                                       struct text_pos *, ptrdiff_t, int, int);
 static int underlying_face_id (struct it *);
 static int in_ellipses_for_invisible_text_p (struct display_pos *,
                                              struct window *);
@@ -1218,7 +1218,7 @@ line_bottom_y (struct it *it)
    Set *ROWH and *VPOS to row's visible height and VPOS (row number).  */
 
 int
-pos_visible_p (struct window *w, EMACS_INT charpos, int *x, int *y,
+pos_visible_p (struct window *w, ptrdiff_t charpos, int *x, int *y,
 	       int *rtop, int *rbot, int *rowh, int *vpos)
 {
   struct it it;
@@ -1392,7 +1392,7 @@ string_char_and_length (const unsigned char *str, int *len)
    in STRING, return the position NCHARS ahead (NCHARS >= 0).  */
 
 static struct text_pos
-string_pos_nchars_ahead (struct text_pos pos, Lisp_Object string, EMACS_INT nchars)
+string_pos_nchars_ahead (struct text_pos pos, Lisp_Object string, ptrdiff_t nchars)
 {
   xassert (STRINGP (string) && nchars >= 0);
 
@@ -1420,7 +1420,7 @@ string_pos_nchars_ahead (struct text_pos pos, Lisp_Object string, EMACS_INT ncha
    for character position CHARPOS in STRING.  */
 
 static inline struct text_pos
-string_pos (EMACS_INT charpos, Lisp_Object string)
+string_pos (ptrdiff_t charpos, Lisp_Object string)
 {
   struct text_pos pos;
   xassert (STRINGP (string));
@@ -1435,7 +1435,7 @@ string_pos (EMACS_INT charpos, Lisp_Object string)
    means recognize multibyte characters.  */
 
 static struct text_pos
-c_string_pos (EMACS_INT charpos, const char *s, int multibyte_p)
+c_string_pos (ptrdiff_t charpos, const char *s, int multibyte_p)
 {
   struct text_pos pos;
 
@@ -1465,14 +1465,14 @@ c_string_pos (EMACS_INT charpos, const char *s, int multibyte_p)
 /* Value is the number of characters in C string S.  MULTIBYTE_P
    non-zero means recognize multibyte characters.  */
 
-static EMACS_INT
+static ptrdiff_t
 number_of_chars (const char *s, int multibyte_p)
 {
-  EMACS_INT nchars;
+  ptrdiff_t nchars;
 
   if (multibyte_p)
     {
-      EMACS_INT rest = strlen (s);
+      ptrdiff_t rest = strlen (s);
       int len;
       const unsigned char *p = (const unsigned char *) s;
 
@@ -2188,7 +2188,7 @@ safe_call (ptrdiff_t nargs, Lisp_Object *args)
     val = Qnil;
   else
     {
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
       struct gcpro gcpro1;
 
       GCPRO1 (args[0]);
@@ -2338,7 +2338,7 @@ check_window_end (struct window *w)
 
 void
 init_iterator (struct it *it, struct window *w,
-	       EMACS_INT charpos, EMACS_INT bytepos,
+	       ptrdiff_t charpos, ptrdiff_t bytepos,
 	       struct glyph_row *row, enum face_id base_face_id)
 {
   int highlight_region_p;
@@ -2429,7 +2429,9 @@ init_iterator (struct it *it, struct window *w,
      is invisible.  >0 means lines indented more than this value are
      invisible.  */
   it->selective = (INTEGERP (BVAR (current_buffer, selective_display))
-		   ? XINT (BVAR (current_buffer, selective_display))
+		   ? clip_to_bounds (-1, XINT (BVAR (current_buffer,
+						     selective_display)),
+				     PTRDIFF_MAX)
 		   : (!NILP (BVAR (current_buffer, selective_display))
 		      ? -1 : 0));
   it->selective_display_ellipsis_p
@@ -2462,7 +2464,7 @@ init_iterator (struct it *it, struct window *w,
 	      && WINDOWP (minibuf_selected_window)
 	      && w == XWINDOW (minibuf_selected_window))))
     {
-      EMACS_INT markpos = marker_position (BVAR (current_buffer, mark));
+      ptrdiff_t markpos = marker_position (BVAR (current_buffer, mark));
       it->region_beg_charpos = min (PT, markpos);
       it->region_end_charpos = max (PT, markpos);
     }
@@ -2476,7 +2478,8 @@ init_iterator (struct it *it, struct window *w,
     it->redisplay_end_trigger_charpos
       = marker_position (w->redisplay_end_trigger);
   else if (INTEGERP (w->redisplay_end_trigger))
-    it->redisplay_end_trigger_charpos = XINT (w->redisplay_end_trigger);
+    it->redisplay_end_trigger_charpos =
+      clip_to_bounds (PTRDIFF_MIN, XINT (w->redisplay_end_trigger), PTRDIFF_MAX);
 
   it->tab_width = SANE_TAB_WIDTH (current_buffer);
 
@@ -2716,7 +2719,7 @@ in_ellipses_for_invisible_text_p (struct display_pos *pos, struct window *w)
 {
   Lisp_Object prop, window;
   int ellipses_p = 0;
-  EMACS_INT charpos = CHARPOS (pos->pos);
+  ptrdiff_t charpos = CHARPOS (pos->pos);
 
   /* If POS specifies a position in a display vector, this might
      be for an ellipsis displayed for invisible text.  We won't
@@ -2748,7 +2751,7 @@ in_ellipses_for_invisible_text_p (struct display_pos *pos, struct window *w)
 static int
 init_from_display_pos (struct it *it, struct window *w, struct display_pos *pos)
 {
-  EMACS_INT charpos = CHARPOS (pos->pos), bytepos = BYTEPOS (pos->pos);
+  ptrdiff_t charpos = CHARPOS (pos->pos), bytepos = BYTEPOS (pos->pos);
   int i, overlay_strings_with_newlines = 0;
 
   /* If POS specifies a position in a display vector, this might
@@ -2808,7 +2811,7 @@ init_from_display_pos (struct it *it, struct window *w, struct display_pos *pos)
 	 pos->overlay_string_index is in IT->overlay_strings.  */
       if (pos->overlay_string_index >= OVERLAY_STRING_CHUNK_SIZE)
 	{
-	  int n = pos->overlay_string_index / OVERLAY_STRING_CHUNK_SIZE;
+	  ptrdiff_t n = pos->overlay_string_index / OVERLAY_STRING_CHUNK_SIZE;
 	  it->current.overlay_string_index = 0;
 	  while (n--)
 	    {
@@ -2995,7 +2998,7 @@ compute_stop_pos (struct it *it)
 {
   register INTERVAL iv, next_iv;
   Lisp_Object object, limit, position;
-  EMACS_INT charpos, bytepos;
+  ptrdiff_t charpos, bytepos;
 
   /* If nowhere else, stop at the end.  */
   it->stop_charpos = it->end_charpos;
@@ -3011,7 +3014,7 @@ compute_stop_pos (struct it *it)
     }
   else
     {
-      EMACS_INT pos;
+      ptrdiff_t pos;
 
       /* If next overlay change is in front of the current stop pos
 	 (which is IT->end_charpos), stop there.  Note: value of
@@ -3087,7 +3090,7 @@ compute_stop_pos (struct it *it)
 
   if (it->cmp_it.id < 0)
     {
-      EMACS_INT stoppos = it->end_charpos;
+      ptrdiff_t stoppos = it->end_charpos;
 
       if (it->bidi_p && it->bidi_it.scan_dir < 0)
 	stoppos = -1;
@@ -3106,11 +3109,11 @@ compute_stop_pos (struct it *it)
    follows.  This is like `next-overlay-change' but doesn't use
    xmalloc.  */
 
-static EMACS_INT
-next_overlay_change (EMACS_INT pos)
+static ptrdiff_t
+next_overlay_change (ptrdiff_t pos)
 {
   ptrdiff_t i, noverlays;
-  EMACS_INT endpos;
+  ptrdiff_t endpos;
   Lisp_Object *overlays;
 
   /* Get all overlays at the given position.  */
@@ -3121,7 +3124,7 @@ next_overlay_change (EMACS_INT pos)
   for (i = 0; i < noverlays; ++i)
     {
       Lisp_Object oend;
-      EMACS_INT oendpos;
+      ptrdiff_t oendpos;
 
       oend = OVERLAY_END (overlays[i]);
       oendpos = OVERLAY_POSITION (oend);
@@ -3148,7 +3151,7 @@ next_overlay_change (EMACS_INT pos)
    strings, non-zero otherwise.  It is set to 2 if the display string
    uses any kind of `(space ...)' spec that will produce a stretch of
    white space in the text area.  */
-EMACS_INT
+ptrdiff_t
 compute_display_string_pos (struct text_pos *position,
 			    struct bidi_string_data *string,
 			    int frame_window_p, int *disp_prop)
@@ -3158,10 +3161,10 @@ compute_display_string_pos (struct text_pos *position,
     (string && STRINGP (string->lstring)) ? string->lstring : Qnil;
   Lisp_Object pos, spec, limpos;
   int string_p = (string && (STRINGP (string->lstring) || string->s));
-  EMACS_INT eob = string_p ? string->schars : ZV;
-  EMACS_INT begb = string_p ? 0 : BEGV;
-  EMACS_INT bufpos, charpos = CHARPOS (*position);
-  EMACS_INT lim =
+  ptrdiff_t eob = string_p ? string->schars : ZV;
+  ptrdiff_t begb = string_p ? 0 : BEGV;
+  ptrdiff_t bufpos, charpos = CHARPOS (*position);
+  ptrdiff_t lim =
     (charpos < eob - MAX_DISP_SCAN) ? charpos + MAX_DISP_SCAN : eob;
   struct text_pos tpos;
   int rv = 0;
@@ -3231,14 +3234,14 @@ compute_display_string_pos (struct text_pos *position,
    started at CHARPOS.  A display string is either an overlay with
    `display' property whose value is a string or a `display' text
    property whose value is a string.  */
-EMACS_INT
-compute_display_string_end (EMACS_INT charpos, struct bidi_string_data *string)
+ptrdiff_t
+compute_display_string_end (ptrdiff_t charpos, struct bidi_string_data *string)
 {
   /* OBJECT = nil means current buffer.  */
   Lisp_Object object =
     (string && STRINGP (string->lstring)) ? string->lstring : Qnil;
   Lisp_Object pos = make_number (charpos);
-  EMACS_INT eob =
+  ptrdiff_t eob =
     (STRINGP (object) || (string && string->s)) ? string->schars : ZV;
 
   if (charpos >= eob || (string->s && !STRINGP (object)))
@@ -3287,7 +3290,7 @@ handle_fontified_prop (struct it *it)
 	     no amount of fontifying will be able to change it.  */
 	  NILP (prop) && IT_CHARPOS (*it) < Z))
     {
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
       Lisp_Object val;
       struct buffer *obuf = current_buffer;
       int begv = BEGV, zv = ZV;
@@ -3384,7 +3387,7 @@ static enum prop_handled
 handle_face_prop (struct it *it)
 {
   int new_face_id;
-  EMACS_INT next_stop;
+  ptrdiff_t next_stop;
 
   if (!STRINGP (it->string))
     {
@@ -3425,7 +3428,7 @@ handle_face_prop (struct it *it)
   else
     {
       int base_face_id;
-      EMACS_INT bufpos;
+      ptrdiff_t bufpos;
       int i;
       Lisp_Object from_overlay
 	= (it->current.overlay_string_index >= 0
@@ -3543,7 +3546,7 @@ static int
 face_before_or_after_it_pos (struct it *it, int before_p)
 {
   int face_id, limit;
-  EMACS_INT next_check_charpos;
+  ptrdiff_t next_check_charpos;
   struct it it_copy;
   void *it_copy_data = NULL;
 
@@ -3551,7 +3554,7 @@ face_before_or_after_it_pos (struct it *it, int before_p)
 
   if (STRINGP (it->string))
     {
-      EMACS_INT bufpos, charpos;
+      ptrdiff_t bufpos, charpos;
       int base_face_id;
 
       /* No face change past the end of the string (for the case
@@ -3764,7 +3767,7 @@ handle_invisible_prop (struct it *it)
       if (!NILP (prop)
 	  && IT_STRING_CHARPOS (*it) < it->end_charpos)
 	{
-	  EMACS_INT endpos;
+	  ptrdiff_t endpos;
 
 	  handled = HANDLED_RECOMPUTE_PROPS;
 
@@ -3783,7 +3786,7 @@ handle_invisible_prop (struct it *it)
 	      && (endpos = XFASTINT (end_charpos)) < XFASTINT (limit))
 	    {
 	      struct text_pos old;
-	      EMACS_INT oldpos;
+	      ptrdiff_t oldpos;
 
 	      old = it->current.string_pos;
 	      oldpos = CHARPOS (old);
@@ -3835,7 +3838,7 @@ handle_invisible_prop (struct it *it)
   else
     {
       int invis_p;
-      EMACS_INT newpos, next_stop, start_charpos, tem;
+      ptrdiff_t newpos, next_stop, start_charpos, tem;
       Lisp_Object pos, prop, overlay;
 
       /* First of all, is there invisible text at this position?  */
@@ -4035,7 +4038,7 @@ handle_display_prop (struct it *it)
 {
   Lisp_Object propval, object, overlay;
   struct text_pos *position;
-  EMACS_INT bufpos;
+  ptrdiff_t bufpos;
   /* Nonzero if some property replaces the display of the text itself.  */
   int display_replaced_p = 0;
 
@@ -4100,7 +4103,7 @@ handle_display_prop (struct it *it)
 static int
 handle_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
 		     Lisp_Object overlay, struct text_pos *position,
-		     EMACS_INT bufpos, int frame_window_p)
+		     ptrdiff_t bufpos, int frame_window_p)
 {
   int replacing_p = 0;
   int rv;
@@ -4207,7 +4210,7 @@ display_prop_end (struct it *it, Lisp_Object object, struct text_pos start_pos)
 static int
 handle_single_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
 			    Lisp_Object overlay, struct text_pos *position,
-			    EMACS_INT bufpos, int display_replaced_p,
+			    ptrdiff_t bufpos, int display_replaced_p,
 			    int frame_window_p)
 {
   Lisp_Object form;
@@ -4229,7 +4232,7 @@ handle_single_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
 
   if (!NILP (form) && !EQ (form, Qt))
     {
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
       struct gcpro gcpro1;
 
       /* Bind `object' to the object having the `display' property, a
@@ -4271,7 +4274,7 @@ handle_single_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
 		  && (EQ (XCAR (it->font_height), Qplus)
 		      || EQ (XCAR (it->font_height), Qminus))
 		  && CONSP (XCDR (it->font_height))
-		  && INTEGERP (XCAR (XCDR (it->font_height))))
+		  && RANGED_INTEGERP (0, XCAR (XCDR (it->font_height)), INT_MAX))
 		{
 		  /* `(+ N)' or `(- N)' where N is an integer.  */
 		  int steps = XINT (XCAR (XCDR (it->font_height)));
@@ -4303,7 +4306,7 @@ handle_single_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
 		{
 		  /* Evaluate IT->font_height with `height' bound to the
 		     current specified height to get the new height.  */
-		  int count = SPECPDL_INDEX ();
+		  ptrdiff_t count = SPECPDL_INDEX ();
 
 		  specbind (Qheight, face->lface[LFACE_HEIGHT_INDEX]);
 		  value = safe_eval (it->font_height);
@@ -4632,7 +4635,7 @@ handle_single_display_spec (struct it *it, Lisp_Object spec, Lisp_Object object,
 
 int
 display_prop_intangible_p (Lisp_Object prop, Lisp_Object overlay,
-			   EMACS_INT charpos, EMACS_INT bytepos)
+			   ptrdiff_t charpos, ptrdiff_t bytepos)
 {
   int frame_window_p = FRAME_WINDOW_P (XFRAME (selected_frame));
   struct text_pos position;
@@ -4734,9 +4737,9 @@ display_prop_string_p (Lisp_Object prop, Lisp_Object string)
    This function may only use code that doesn't eval because it is
    called asynchronously from note_mouse_highlight.  */
 
-static EMACS_INT
+static ptrdiff_t
 string_buffer_position_lim (Lisp_Object string,
-			    EMACS_INT from, EMACS_INT to, int back_p)
+			    ptrdiff_t from, ptrdiff_t to, int back_p)
 {
   Lisp_Object limit, prop, pos;
   int found = 0;
@@ -4782,11 +4785,11 @@ string_buffer_position_lim (Lisp_Object string,
    This function may only use code that doesn't eval because it is
    called asynchronously from note_mouse_highlight.  */
 
-static EMACS_INT
-string_buffer_position (Lisp_Object string, EMACS_INT around_charpos)
+static ptrdiff_t
+string_buffer_position (Lisp_Object string, ptrdiff_t around_charpos)
 {
   const int MAX_DISTANCE = 1000;
-  EMACS_INT found = string_buffer_position_lim (string, around_charpos,
+  ptrdiff_t found = string_buffer_position_lim (string, around_charpos,
 						around_charpos + MAX_DISTANCE,
 						0);
 
@@ -4809,7 +4812,7 @@ static enum prop_handled
 handle_composition_prop (struct it *it)
 {
   Lisp_Object prop, string;
-  EMACS_INT pos, pos_byte, start, end;
+  ptrdiff_t pos, pos_byte, start, end;
 
   if (STRINGP (it->string))
     {
@@ -4875,7 +4878,7 @@ struct overlay_entry
 {
   Lisp_Object overlay;
   Lisp_Object string;
-  int priority;
+  EMACS_INT priority;
   int after_string_p;
 };
 
@@ -5001,12 +5004,17 @@ compare_overlay_entries (const void *e1, const void *e2)
       else
 	result = entry1->after_string_p ? -1 : 1;
     }
-  else if (entry1->after_string_p)
-    /* After-strings sorted in order of decreasing priority.  */
-    result = entry2->priority - entry1->priority;
+  else if (entry1->priority != entry2->priority)
+    {
+      if (entry1->after_string_p)
+	/* After-strings sorted in order of decreasing priority.  */
+	result = entry2->priority < entry1->priority ? -1 : 1;
+      else
+	/* Before-strings sorted in order of increasing priority.  */
+	result = entry1->priority < entry2->priority ? -1 : 1;
+    }
   else
-    /* Before-strings sorted in order of increasing priority.  */
-    result = entry1->priority - entry2->priority;
+    result = 0;
 
   return result;
 }
@@ -5037,15 +5045,17 @@ compare_overlay_entries (const void *e1, const void *e2)
    compare_overlay_entries.  */
 
 static void
-load_overlay_strings (struct it *it, EMACS_INT charpos)
+load_overlay_strings (struct it *it, ptrdiff_t charpos)
 {
   Lisp_Object overlay, window, str, invisible;
   struct Lisp_Overlay *ov;
-  EMACS_INT start, end;
-  int size = 20;
-  int n = 0, i, j, invis_p;
+  ptrdiff_t start, end;
+  ptrdiff_t size = 20;
+  ptrdiff_t n = 0, i, j;
+  int invis_p;
   struct overlay_entry *entries
     = (struct overlay_entry *) alloca (size * sizeof *entries);
+  USE_SAFE_ALLOCA;
 
   if (charpos <= 0)
     charpos = IT_CHARPOS (*it);
@@ -5061,13 +5071,10 @@ load_overlay_strings (struct it *it, EMACS_INT charpos)
 									\
       if (n == size)							\
 	{								\
-	  int new_size = 2 * size;					\
 	  struct overlay_entry *old = entries;				\
-	  entries =							\
-            (struct overlay_entry *) alloca (new_size			\
-					     * sizeof *entries);	\
+	  SAFE_NALLOCA (entries, 2, size);				\
 	  memcpy (entries, old, size * sizeof *entries);		\
-	  size = new_size;						\
+	  size *= 2;							\
 	}								\
 									\
       entries[n].string = (STRING);					\
@@ -5180,6 +5187,7 @@ load_overlay_strings (struct it *it, EMACS_INT charpos)
     }
 
   CHECK_IT (it);
+  SAFE_FREE ();
 }
 
 
@@ -5188,7 +5196,7 @@ load_overlay_strings (struct it *it, EMACS_INT charpos)
    least one overlay string was found.  */
 
 static int
-get_overlay_strings_1 (struct it *it, EMACS_INT charpos, int compute_stop_p)
+get_overlay_strings_1 (struct it *it, ptrdiff_t charpos, int compute_stop_p)
 {
   /* Get the first OVERLAY_STRING_CHUNK_SIZE overlay strings to
      process.  This fills IT->overlay_strings with strings, and sets
@@ -5245,7 +5253,7 @@ get_overlay_strings_1 (struct it *it, EMACS_INT charpos, int compute_stop_p)
       /* Set up the bidi iterator for this overlay string.  */
       if (it->bidi_p)
 	{
-	  EMACS_INT pos = (charpos > 0 ? charpos : IT_CHARPOS (*it));
+	  ptrdiff_t pos = (charpos > 0 ? charpos : IT_CHARPOS (*it));
 
 	  it->bidi_it.string.lstring = it->string;
 	  it->bidi_it.string.s = NULL;
@@ -5263,7 +5271,7 @@ get_overlay_strings_1 (struct it *it, EMACS_INT charpos, int compute_stop_p)
 }
 
 static int
-get_overlay_strings (struct it *it, EMACS_INT charpos)
+get_overlay_strings (struct it *it, ptrdiff_t charpos)
 {
   it->string = Qnil;
   it->method = GET_FROM_BUFFER;
@@ -5343,8 +5351,8 @@ static void
 iterate_out_of_display_property (struct it *it)
 {
   int buffer_p = BUFFERP (it->object);
-  EMACS_INT eob = (buffer_p ? ZV : it->end_charpos);
-  EMACS_INT bob = (buffer_p ? BEGV : 0);
+  ptrdiff_t eob = (buffer_p ? ZV : it->end_charpos);
+  ptrdiff_t bob = (buffer_p ? BEGV : 0);
 
   xassert (eob >= CHARPOS (it->position) && CHARPOS (it->position) >= bob);
 
@@ -5504,7 +5512,7 @@ static int
 forward_to_next_line_start (struct it *it, int *skipped_p,
 			    struct bidi_it *bidi_it_prev)
 {
-  EMACS_INT old_selective;
+  ptrdiff_t old_selective;
   int newline_found_p, n;
   const int MAX_NEWLINE_DISTANCE = 500;
 
@@ -5546,8 +5554,8 @@ forward_to_next_line_start (struct it *it, int *skipped_p,
      short-cut.  */
   if (!newline_found_p)
     {
-      EMACS_INT start = IT_CHARPOS (*it);
-      EMACS_INT limit = find_next_newline_no_quit (start, 1);
+      ptrdiff_t start = IT_CHARPOS (*it);
+      ptrdiff_t limit = find_next_newline_no_quit (start, 1);
       Lisp_Object pos;
 
       xassert (!STRINGP (it->string));
@@ -5645,8 +5653,8 @@ back_to_previous_visible_line_start (struct it *it)
       {
 	struct it it2;
 	void *it2data = NULL;
-	EMACS_INT pos;
-	EMACS_INT beg, end;
+	ptrdiff_t pos;
+	ptrdiff_t beg, end;
 	Lisp_Object val, overlay;
 
 	SAVE_IT (it2, *it, it2data);
@@ -5799,7 +5807,7 @@ reseat_at_next_visible_line_start (struct it *it, int on_newline_p)
 static void
 reseat (struct it *it, struct text_pos pos, int force_p)
 {
-  EMACS_INT original_pos = IT_CHARPOS (*it);
+  ptrdiff_t original_pos = IT_CHARPOS (*it);
 
   reseat_1 (it, pos, 0);
 
@@ -5907,7 +5915,7 @@ reseat_1 (struct it *it, struct text_pos pos, int set_stop_p)
 
 static void
 reseat_to_string (struct it *it, const char *s, Lisp_Object string,
-		  EMACS_INT charpos, EMACS_INT precision, int field_width,
+		  ptrdiff_t charpos, ptrdiff_t precision, int field_width,
 		  int multibyte)
 {
   /* No region in strings.  */
@@ -6021,7 +6029,7 @@ reseat_to_string (struct it *it, const char *s, Lisp_Object string,
     }
   if (s == NULL && it->multibyte_p)
     {
-      EMACS_INT endpos = SCHARS (it->string);
+      ptrdiff_t endpos = SCHARS (it->string);
       if (endpos > it->end_charpos)
 	endpos = it->end_charpos;
       composition_compute_stop_pos (&it->cmp_it, charpos, -1, endpos,
@@ -6129,11 +6137,11 @@ lookup_glyphless_char_display (int c, struct it *it)
    end of buffer (or C string) is reached.  */
 
 static struct frame *last_escape_glyph_frame = NULL;
-static unsigned last_escape_glyph_face_id = (1 << FACE_ID_BITS);
+static int last_escape_glyph_face_id = (1 << FACE_ID_BITS);
 static int last_escape_glyph_merged_face_id = 0;
 
 struct frame *last_glyphless_glyph_frame = NULL;
-unsigned last_glyphless_glyph_face_id = (1 << FACE_ID_BITS);
+int last_glyphless_glyph_face_id = (1 << FACE_ID_BITS);
 int last_glyphless_glyph_merged_face_id = 0;
 
 static int
@@ -6258,7 +6266,7 @@ get_next_display_element (struct it *it)
 	      Lisp_Object gc;
 	      int ctl_len;
 	      int face_id;
-	      EMACS_INT lface_id = 0;
+	      int lface_id = 0;
 	      int escape_glyph;
 
 	      /* Handle control characters with ^.  */
@@ -6270,8 +6278,7 @@ get_next_display_element (struct it *it)
 		  g = '^';	     /* default glyph for Control */
 		  /* Set IT->ctl_chars[0] to the glyph for `^'.  */
 		  if (it->dp
-		      && (gc = DISP_CTRL_GLYPH (it->dp), GLYPH_CODE_P (gc))
-		      && GLYPH_CODE_CHAR_VALID_P (gc))
+		      && (gc = DISP_CTRL_GLYPH (it->dp), GLYPH_CODE_P (gc)))
 		    {
 		      g = GLYPH_CODE_CHAR (gc);
 		      lface_id = GLYPH_CODE_FACE (gc);
@@ -6323,8 +6330,7 @@ get_next_display_element (struct it *it)
 	      escape_glyph = '\\';
 
 	      if (it->dp
-		  && (gc = DISP_ESCAPE_GLYPH (it->dp), GLYPH_CODE_P (gc))
-		  && GLYPH_CODE_CHAR_VALID_P (gc))
+		  && (gc = DISP_ESCAPE_GLYPH (it->dp), GLYPH_CODE_P (gc)))
 		{
 		  escape_glyph = GLYPH_CODE_CHAR (gc);
 		  lface_id = GLYPH_CODE_FACE (gc);
@@ -6427,7 +6433,7 @@ get_next_display_element (struct it *it)
 	}
       else
 	{
-	  EMACS_INT pos = (it->s ? -1
+	  ptrdiff_t pos = (it->s ? -1
 		     : STRINGP (it->string) ? IT_STRING_CHARPOS (*it)
 		     : IT_CHARPOS (*it));
 	  int c;
@@ -6479,7 +6485,7 @@ get_next_display_element (struct it *it)
 		       && (it->current.overlay_string_index
 			   == it->n_overlay_strings - 1))
 		{
-		  EMACS_INT ignore;
+		  ptrdiff_t ignore;
 		  int next_face_id;
 		  struct text_pos pos = it->current.pos;
 		  INC_TEXT_POS (pos, it->multibyte_p);
@@ -6581,7 +6587,7 @@ set_iterator_to_next (struct it *it, int reseat_p)
 		{
 		  /* No more grapheme clusters in this composition.
 		     Find the next stop position.  */
-		  EMACS_INT stop = it->end_charpos;
+		  ptrdiff_t stop = it->end_charpos;
 		  if (it->bidi_it.scan_dir < 0)
 		    /* Now we are scanning backward and don't know
 		       where to stop.  */
@@ -6609,7 +6615,7 @@ set_iterator_to_next (struct it *it, int reseat_p)
 		{
 		  /* No more grapheme clusters in this composition.
 		     Find the next stop position.  */
-		  EMACS_INT stop = it->end_charpos;
+		  ptrdiff_t stop = it->end_charpos;
 		  if (it->bidi_it.scan_dir < 0)
 		    /* Now we are scanning backward and don't know
 		       where to stop.  */
@@ -6642,7 +6648,7 @@ set_iterator_to_next (struct it *it, int reseat_p)
 		{
 		  /* As the scan direction was changed, we must
 		     re-compute the stop position for composition.  */
-		  EMACS_INT stop = it->end_charpos;
+		  ptrdiff_t stop = it->end_charpos;
 		  if (it->bidi_it.scan_dir < 0)
 		    stop = -1;
 		  composition_compute_stop_pos (&it->cmp_it, IT_CHARPOS (*it),
@@ -6752,7 +6758,7 @@ set_iterator_to_next (struct it *it, int reseat_p)
 		it->cmp_it.from = it->cmp_it.to;
 	      else
 		{
-		  EMACS_INT stop = it->end_charpos;
+		  ptrdiff_t stop = it->end_charpos;
 		  if (it->bidi_it.scan_dir < 0)
 		    stop = -1;
 		  composition_compute_stop_pos (&it->cmp_it,
@@ -6771,7 +6777,7 @@ set_iterator_to_next (struct it *it, int reseat_p)
 		it->cmp_it.to = it->cmp_it.from;
 	      else
 		{
-		  EMACS_INT stop = it->end_charpos;
+		  ptrdiff_t stop = it->end_charpos;
 		  if (it->bidi_it.scan_dir < 0)
 		    stop = -1;
 		  composition_compute_stop_pos (&it->cmp_it,
@@ -6803,7 +6809,7 @@ set_iterator_to_next (struct it *it, int reseat_p)
 	      IT_STRING_CHARPOS (*it) = it->bidi_it.charpos;
 	      if (prev_scan_dir != it->bidi_it.scan_dir)
 		{
-		  EMACS_INT stop = it->end_charpos;
+		  ptrdiff_t stop = it->end_charpos;
 
 		  if (it->bidi_it.scan_dir < 0)
 		    stop = -1;
@@ -6889,7 +6895,7 @@ next_element_from_display_vector (struct it *it)
      That seemed totally bogus - so I changed it...  */
   gc = it->dpvec[it->current.dpvec_index];
 
-  if (GLYPH_CODE_P (gc) && GLYPH_CODE_CHAR_VALID_P (gc))
+  if (GLYPH_CODE_P (gc))
     {
       it->c = GLYPH_CODE_CHAR (gc);
       it->len = CHAR_BYTES (it->c);
@@ -6901,7 +6907,7 @@ next_element_from_display_vector (struct it *it)
 	it->face_id = it->dpvec_face_id;
       else
 	{
-	  EMACS_INT lface_id = GLYPH_CODE_FACE (gc);
+	  int lface_id = GLYPH_CODE_FACE (gc);
 	  if (lface_id > 0)
 	    it->face_id = merge_faces (it->f, Qt, lface_id,
 				       it->saved_face_id);
@@ -6924,8 +6930,8 @@ static void
 get_visually_first_element (struct it *it)
 {
   int string_p = STRINGP (it->string) || it->s;
-  EMACS_INT eob = (string_p ? it->bidi_it.string.schars : ZV);
-  EMACS_INT bob = (string_p ? 0 : BEGV);
+  ptrdiff_t eob = (string_p ? it->bidi_it.string.schars : ZV);
+  ptrdiff_t bob = (string_p ? 0 : BEGV);
 
   if (STRINGP (it->string))
     {
@@ -6958,7 +6964,7 @@ get_visually_first_element (struct it *it)
     }
   else
     {
-      EMACS_INT orig_bytepos = it->bidi_it.bytepos;
+      ptrdiff_t orig_bytepos = it->bidi_it.bytepos;
 
       /* We need to prime the bidi iterator starting at the line's or
 	 string's beginning, before we will be able to produce the
@@ -6996,7 +7002,7 @@ get_visually_first_element (struct it *it)
 
   if (STRINGP (it->string) || !it->s)
     {
-      EMACS_INT stop, charpos, bytepos;
+      ptrdiff_t stop, charpos, bytepos;
 
       if (STRINGP (it->string))
 	{
@@ -7297,10 +7303,10 @@ compute_stop_pos_backwards (struct it *it)
   struct text_pos pos;
   struct display_pos save_current = it->current;
   struct text_pos save_position = it->position;
-  EMACS_INT charpos = IT_CHARPOS (*it);
-  EMACS_INT where_we_are = charpos;
-  EMACS_INT save_stop_pos = it->stop_charpos;
-  EMACS_INT save_end_pos = it->end_charpos;
+  ptrdiff_t charpos = IT_CHARPOS (*it);
+  ptrdiff_t where_we_are = charpos;
+  ptrdiff_t save_stop_pos = it->stop_charpos;
+  ptrdiff_t save_end_pos = it->end_charpos;
 
   xassert (NILP (it->string) && !it->s);
   xassert (it->bidi_p);
@@ -7338,14 +7344,14 @@ compute_stop_pos_backwards (struct it *it)
    position.  */
 
 static void
-handle_stop_backwards (struct it *it, EMACS_INT charpos)
+handle_stop_backwards (struct it *it, ptrdiff_t charpos)
 {
   int bufp = !STRINGP (it->string);
-  EMACS_INT where_we_are = (bufp ? IT_CHARPOS (*it) : IT_STRING_CHARPOS (*it));
+  ptrdiff_t where_we_are = (bufp ? IT_CHARPOS (*it) : IT_STRING_CHARPOS (*it));
   struct display_pos save_current = it->current;
   struct text_pos save_position = it->position;
   struct text_pos pos1;
-  EMACS_INT next_stop;
+  ptrdiff_t next_stop;
 
   /* Scan in strict logical order.  */
   xassert (it->bidi_p);
@@ -7489,7 +7495,7 @@ next_element_from_buffer (struct it *it)
       /* No face changes, overlays etc. in sight, so just return a
 	 character from current_buffer.  */
       unsigned char *p;
-      EMACS_INT stop;
+      ptrdiff_t stop;
 
       /* Maybe run the redisplay end trigger hook.  Performance note:
 	 This doesn't seem to cost measurable time.  */
@@ -7678,7 +7684,7 @@ next_element_from_composition (struct it *it)
 
 static enum move_it_result
 move_it_in_display_line_to (struct it *it,
-			    EMACS_INT to_charpos, int to_x,
+			    ptrdiff_t to_charpos, int to_x,
 			    enum move_operation_enum op)
 {
   enum move_it_result result = MOVE_UNDEFINED;
@@ -7688,7 +7694,7 @@ move_it_in_display_line_to (struct it *it,
   void *ppos_data = NULL;
   int may_wrap = 0;
   enum it_method prev_method = it->method;
-  EMACS_INT prev_pos = IT_CHARPOS (*it);
+  ptrdiff_t prev_pos = IT_CHARPOS (*it);
   int saw_smaller_pos = prev_pos < to_charpos;
 
   /* Don't produce glyphs in produce_glyphs.  */
@@ -8174,7 +8180,7 @@ move_it_in_display_line_to (struct it *it,
 /* For external use.  */
 void
 move_it_in_display_line (struct it *it,
-			 EMACS_INT to_charpos, int to_x,
+			 ptrdiff_t to_charpos, int to_x,
 			 enum move_operation_enum op)
 {
   if (it->line_wrap == WORD_WRAP
@@ -8217,7 +8223,7 @@ move_it_in_display_line (struct it *it,
    displayed to the right of TO_CHARPOS on the screen.  */
 
 void
-move_it_to (struct it *it, EMACS_INT to_charpos, int to_x, int to_y, int to_vpos, int op)
+move_it_to (struct it *it, ptrdiff_t to_charpos, int to_x, int to_y, int to_vpos, int op)
 {
   enum move_it_result skip, skip2 = MOVE_X_REACHED;
   int line_height, line_start_x = 0, reached = 0;
@@ -8484,7 +8490,7 @@ move_it_vertically_backward (struct it *it, int dy)
   int nlines, h;
   struct it it2, it3;
   void *it2data = NULL, *it3data = NULL;
-  EMACS_INT start_pos;
+  ptrdiff_t start_pos;
 
  move_further_back:
   xassert (dy >= 0);
@@ -8554,7 +8560,7 @@ move_it_vertically_backward (struct it *it, int dy)
       if (it->bidi_p && IT_CHARPOS (*it) > BEGV
 	  && FETCH_BYTE (IT_BYTEPOS (*it) - 1) != '\n')
 	{
-	  EMACS_INT nl_pos =
+	  ptrdiff_t nl_pos =
 	    find_next_newline_no_quit (IT_CHARPOS (*it) - 1, -1);
 
 	  move_it_to (it, nl_pos, -1, -1, -1, MOVE_TO_POS);
@@ -8664,7 +8670,7 @@ move_it_past_eol (struct it *it)
    truncate-lines nil.  */
 
 void
-move_it_by_lines (struct it *it, int dvpos)
+move_it_by_lines (struct it *it, ptrdiff_t dvpos)
 {
 
   /* The commented-out optimization uses vmotion on terminals.  This
@@ -8701,7 +8707,7 @@ move_it_by_lines (struct it *it, int dvpos)
     {
       struct it it2;
       void *it2data = NULL;
-      EMACS_INT start_charpos, i;
+      ptrdiff_t start_charpos, i;
 
       /* Start at the beginning of the screen line containing IT's
 	 position.  This may actually move vertically backwards,
@@ -8787,7 +8793,7 @@ add_to_log (const char *format, Lisp_Object arg1, Lisp_Object arg2)
   Lisp_Object args[3];
   Lisp_Object msg, fmt;
   char *buffer;
-  EMACS_INT len;
+  ptrdiff_t len;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
   USE_SAFE_ALLOCA;
 
@@ -8836,7 +8842,7 @@ message_log_maybe_newline (void)
    so the buffer M must NOT point to a Lisp string.  */
 
 void
-message_dolog (const char *m, EMACS_INT nbytes, int nlflag, int multibyte)
+message_dolog (const char *m, ptrdiff_t nbytes, int nlflag, int multibyte)
 {
   const unsigned char *msg = (const unsigned char *) m;
 
@@ -8848,8 +8854,8 @@ message_dolog (const char *m, EMACS_INT nbytes, int nlflag, int multibyte)
       struct buffer *oldbuf;
       Lisp_Object oldpoint, oldbegv, oldzv;
       int old_windows_or_buffers_changed = windows_or_buffers_changed;
-      EMACS_INT point_at_end = 0;
-      EMACS_INT zv_at_end = 0;
+      ptrdiff_t point_at_end = 0;
+      ptrdiff_t zv_at_end = 0;
       Lisp_Object old_deactivate_mark, tem;
       struct gcpro gcpro1;
 
@@ -8882,7 +8888,7 @@ message_dolog (const char *m, EMACS_INT nbytes, int nlflag, int multibyte)
       if (multibyte
 	  && NILP (BVAR (current_buffer, enable_multibyte_characters)))
 	{
-	  EMACS_INT i;
+	  ptrdiff_t i;
 	  int c, char_bytes;
 	  char work[1];
 
@@ -8900,7 +8906,7 @@ message_dolog (const char *m, EMACS_INT nbytes, int nlflag, int multibyte)
       else if (! multibyte
 	       && ! NILP (BVAR (current_buffer, enable_multibyte_characters)))
 	{
-	  EMACS_INT i;
+	  ptrdiff_t i;
 	  int c, char_bytes;
 	  unsigned char str[MAX_MULTIBYTE_LENGTH];
 	  /* Convert a single-byte string to multibyte
@@ -8918,7 +8924,7 @@ message_dolog (const char *m, EMACS_INT nbytes, int nlflag, int multibyte)
 
       if (nlflag)
 	{
-	  EMACS_INT this_bol, this_bol_byte, prev_bol, prev_bol_byte;
+	  ptrdiff_t this_bol, this_bol_byte, prev_bol, prev_bol_byte;
 	  printmax_t dups;
 	  insert_1 ("\n", 1, 1, 0, 0);
 
@@ -9011,10 +9017,10 @@ message_dolog (const char *m, EMACS_INT nbytes, int nlflag, int multibyte)
    value N > 1 if we should also append " [N times]".  */
 
 static intmax_t
-message_log_check_duplicate (EMACS_INT prev_bol_byte, EMACS_INT this_bol_byte)
+message_log_check_duplicate (ptrdiff_t prev_bol_byte, ptrdiff_t this_bol_byte)
 {
-  EMACS_INT i;
-  EMACS_INT len = Z_BYTE - 1 - this_bol_byte;
+  ptrdiff_t i;
+  ptrdiff_t len = Z_BYTE - 1 - this_bol_byte;
   int seen_dots = 0;
   unsigned char *p1 = BUF_BYTE_ADDRESS (current_buffer, prev_bol_byte);
   unsigned char *p2 = BUF_BYTE_ADDRESS (current_buffer, this_bol_byte);
@@ -9048,7 +9054,7 @@ message_log_check_duplicate (EMACS_INT prev_bol_byte, EMACS_INT this_bol_byte)
    This may GC, so the buffer M must NOT point to a Lisp string.  */
 
 void
-message2 (const char *m, EMACS_INT nbytes, int multibyte)
+message2 (const char *m, ptrdiff_t nbytes, int multibyte)
 {
   /* First flush out any partial line written with print.  */
   message_log_maybe_newline ();
@@ -9061,7 +9067,7 @@ message2 (const char *m, EMACS_INT nbytes, int multibyte)
 /* The non-logging counterpart of message2.  */
 
 void
-message2_nolog (const char *m, EMACS_INT nbytes, int multibyte)
+message2_nolog (const char *m, ptrdiff_t nbytes, int multibyte)
 {
   struct frame *sf = SELECTED_FRAME ();
   message_enable_multibyte = multibyte;
@@ -9123,7 +9129,7 @@ message2_nolog (const char *m, EMACS_INT nbytes, int multibyte)
    This function cancels echoing.  */
 
 void
-message3 (Lisp_Object m, EMACS_INT nbytes, int multibyte)
+message3 (Lisp_Object m, ptrdiff_t nbytes, int multibyte)
 {
   struct gcpro gcpro1;
 
@@ -9155,7 +9161,7 @@ message3 (Lisp_Object m, EMACS_INT nbytes, int multibyte)
    and make this cancel echoing.  */
 
 void
-message3_nolog (Lisp_Object m, EMACS_INT nbytes, int multibyte)
+message3_nolog (Lisp_Object m, ptrdiff_t nbytes, int multibyte)
 {
   struct frame *sf = SELECTED_FRAME ();
   message_enable_multibyte = multibyte;
@@ -9452,12 +9458,12 @@ ensure_echo_area_buffers (void)
 
 static int
 with_echo_area_buffer (struct window *w, int which,
-		       int (*fn) (EMACS_INT, Lisp_Object, EMACS_INT, EMACS_INT),
-		       EMACS_INT a1, Lisp_Object a2, EMACS_INT a3, EMACS_INT a4)
+		       int (*fn) (ptrdiff_t, Lisp_Object, ptrdiff_t, ptrdiff_t),
+		       ptrdiff_t a1, Lisp_Object a2, ptrdiff_t a3, ptrdiff_t a4)
 {
   Lisp_Object buffer;
   int this_one, the_other, clear_buffer_p, rc;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   /* If buffers aren't live, make new ones.  */
   ensure_echo_area_buffers ();
@@ -9633,7 +9639,7 @@ setup_echo_area_for_printing (int multibyte_p)
 
       if (Z > BEG)
 	{
-	  int count = SPECPDL_INDEX ();
+	  ptrdiff_t count = SPECPDL_INDEX ();
 	  specbind (Qinhibit_read_only, Qt);
 	  /* Note that undo recording is always disabled.  */
 	  del_range (BEG, Z);
@@ -9686,14 +9692,14 @@ setup_echo_area_for_printing (int multibyte_p)
 static int
 display_echo_area (struct window *w)
 {
-  int i, no_message_p, window_height_changed_p, count;
+  int i, no_message_p, window_height_changed_p;
 
   /* Temporarily disable garbage collections while displaying the echo
      area.  This is done because a GC can print a message itself.
      That message would modify the echo area buffer's contents while a
      redisplay of the buffer is going on, and seriously confuse
      redisplay.  */
-  count = inhibit_garbage_collection ();
+  ptrdiff_t count = inhibit_garbage_collection ();
 
   /* If there is no message, we must call display_echo_area_1
      nevertheless because it resizes the window.  But we will have to
@@ -9722,7 +9728,7 @@ display_echo_area (struct window *w)
    Value is non-zero if height of W was changed.  */
 
 static int
-display_echo_area_1 (EMACS_INT a1, Lisp_Object a2, EMACS_INT a3, EMACS_INT a4)
+display_echo_area_1 (ptrdiff_t a1, Lisp_Object a2, ptrdiff_t a3, ptrdiff_t a4)
 {
   intptr_t i1 = a1;
   struct window *w = (struct window *) i1;
@@ -9786,7 +9792,7 @@ resize_echo_area_exactly (void)
    resize_mini_window returns.  */
 
 static int
-resize_mini_window_1 (EMACS_INT a1, Lisp_Object exactly, EMACS_INT a3, EMACS_INT a4)
+resize_mini_window_1 (ptrdiff_t a1, Lisp_Object exactly, ptrdiff_t a3, ptrdiff_t a4)
 {
   intptr_t i1 = a1;
   return resize_mini_window ((struct window *) i1, !NILP (exactly));
@@ -9836,7 +9842,8 @@ resize_mini_window (struct window *w, int exact_p)
       struct it it;
       struct window *root = XWINDOW (FRAME_ROOT_WINDOW (f));
       int total_height = WINDOW_TOTAL_LINES (root) + WINDOW_TOTAL_LINES (w);
-      int height, max_height;
+      int height;
+      EMACS_INT max_height;
       int unit = FRAME_LINE_HEIGHT (f);
       struct text_pos start;
       struct buffer *old_current_buffer = NULL;
@@ -9965,7 +9972,7 @@ current_message (void)
 
 
 static int
-current_message_1 (EMACS_INT a1, Lisp_Object a2, EMACS_INT a3, EMACS_INT a4)
+current_message_1 (ptrdiff_t a1, Lisp_Object a2, ptrdiff_t a3, ptrdiff_t a4)
 {
   intptr_t i1 = a1;
   Lisp_Object *msg = (Lisp_Object *) i1;
@@ -10044,7 +10051,7 @@ check_message_stack (void)
    time we display it---but don't redisplay it now.  */
 
 void
-truncate_echo_area (EMACS_INT nchars)
+truncate_echo_area (ptrdiff_t nchars)
 {
   if (nchars == 0)
     echo_area_buffer[0] = Qnil;
@@ -10066,7 +10073,7 @@ truncate_echo_area (EMACS_INT nchars)
    message to at most NCHARS characters.  */
 
 static int
-truncate_message_1 (EMACS_INT nchars, Lisp_Object a2, EMACS_INT a3, EMACS_INT a4)
+truncate_message_1 (ptrdiff_t nchars, Lisp_Object a2, ptrdiff_t a3, ptrdiff_t a4)
 {
   if (BEG + nchars < Z)
     del_range (BEG + nchars, Z);
@@ -10092,7 +10099,7 @@ truncate_message_1 (EMACS_INT nchars, Lisp_Object a2, EMACS_INT a3, EMACS_INT a4
 
 static void
 set_message (const char *s, Lisp_Object string,
-	     EMACS_INT nbytes, int multibyte_p)
+	     ptrdiff_t nbytes, int multibyte_p)
 {
   message_enable_multibyte
     = ((s && multibyte_p)
@@ -10111,7 +10118,7 @@ set_message (const char *s, Lisp_Object string,
    current.  */
 
 static int
-set_message_1 (EMACS_INT a1, Lisp_Object a2, EMACS_INT nbytes, EMACS_INT multibyte_p)
+set_message_1 (ptrdiff_t a1, Lisp_Object a2, ptrdiff_t nbytes, ptrdiff_t multibyte_p)
 {
   intptr_t i1 = a1;
   const char *s = (const char *) i1;
@@ -10132,7 +10139,7 @@ set_message_1 (EMACS_INT a1, Lisp_Object a2, EMACS_INT nbytes, EMACS_INT multiby
 
   if (STRINGP (string))
     {
-      EMACS_INT nchars;
+      ptrdiff_t nchars;
 
       if (nbytes == 0)
 	nbytes = SBYTES (string);
@@ -10151,7 +10158,7 @@ set_message_1 (EMACS_INT a1, Lisp_Object a2, EMACS_INT nbytes, EMACS_INT multiby
       if (multibyte_p && NILP (BVAR (current_buffer, enable_multibyte_characters)))
 	{
 	  /* Convert from multi-byte to single-byte.  */
-	  EMACS_INT i;
+	  ptrdiff_t i;
 	  int c, n;
 	  char work[1];
 
@@ -10169,7 +10176,7 @@ set_message_1 (EMACS_INT a1, Lisp_Object a2, EMACS_INT nbytes, EMACS_INT multiby
 	       && !NILP (BVAR (current_buffer, enable_multibyte_characters)))
 	{
 	  /* Convert from single-byte to multi-byte.  */
-	  EMACS_INT i;
+	  ptrdiff_t i;
 	  int c, n;
 	  unsigned char str[MAX_MULTIBYTE_LENGTH];
 
@@ -10314,7 +10321,7 @@ echo_area_display (int update_frame_p)
 	      /* Must update other windows.  Likewise as in other
 		 cases, don't let this update be interrupted by
 		 pending input.  */
-	      int count = SPECPDL_INDEX ();
+	      ptrdiff_t count = SPECPDL_INDEX ();
 	      specbind (Qredisplay_dont_pause, Qt);
 	      windows_or_buffers_changed = 1;
 	      redisplay_internal ();
@@ -10491,7 +10498,7 @@ store_mode_line_noprop (const char *string, int field_width, int precision)
 {
   const unsigned char *str = (const unsigned char *) string;
   int n = 0;
-  EMACS_INT dummy, nbytes;
+  ptrdiff_t dummy, nbytes;
 
   /* Copy at most PRECISION chars from STR.  */
   nbytes = strlen (string);
@@ -10536,7 +10543,7 @@ x_consider_frame_title (Lisp_Object frame)
       char *title;
       ptrdiff_t len;
       struct it it;
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
 
       for (tail = Vframe_list; CONSP (tail); tail = XCDR (tail))
 	{
@@ -10639,7 +10646,7 @@ prepare_menu_bars (void)
   if (all_windows)
     {
       Lisp_Object tail, frame;
-      int count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
       /* 1 means that update_menu_bar has run its hooks
 	 so any further calls to update_menu_bar shouldn't do so again.  */
       int menu_bar_hooks_run = 0;
@@ -10756,7 +10763,7 @@ update_menu_bar (struct frame *f, int save_match_data, int hooks_run)
 	      != !NILP (w->region_showing)))
 	{
 	  struct buffer *prev = current_buffer;
-	  int count = SPECPDL_INDEX ();
+	  ptrdiff_t count = SPECPDL_INDEX ();
 
 	  specbind (Qinhibit_menubar_update, Qt);
 
@@ -10954,7 +10961,7 @@ update_tool_bar (struct frame *f, int save_match_data)
 	      != !NILP (w->region_showing)))
 	{
 	  struct buffer *prev = current_buffer;
-	  int count = SPECPDL_INDEX ();
+	  ptrdiff_t count = SPECPDL_INDEX ();
 	  Lisp_Object frame, new_tool_bar;
           int new_n_tool_bar;
 	  struct gcpro gcpro1;
@@ -11092,20 +11099,20 @@ build_desired_tool_bar_string (struct frame *f)
 		: DEFAULT_TOOL_BAR_BUTTON_RELIEF);
       hmargin = vmargin = relief;
 
-      if (INTEGERP (Vtool_bar_button_margin)
-	  && XINT (Vtool_bar_button_margin) > 0)
+      if (RANGED_INTEGERP (1, Vtool_bar_button_margin,
+			   INT_MAX - max (hmargin, vmargin)))
 	{
 	  hmargin += XFASTINT (Vtool_bar_button_margin);
 	  vmargin += XFASTINT (Vtool_bar_button_margin);
 	}
       else if (CONSP (Vtool_bar_button_margin))
 	{
-	  if (INTEGERP (XCAR (Vtool_bar_button_margin))
-	      && XINT (XCAR (Vtool_bar_button_margin)) > 0)
+	  if (RANGED_INTEGERP (1, XCAR (Vtool_bar_button_margin),
+			       INT_MAX - hmargin))
 	    hmargin += XFASTINT (XCAR (Vtool_bar_button_margin));
 
-	  if (INTEGERP (XCDR (Vtool_bar_button_margin))
-	      && XINT (XCDR (Vtool_bar_button_margin)) > 0)
+	  if (RANGED_INTEGERP (1, XCDR (Vtool_bar_button_margin),
+			       INT_MAX - vmargin))
 	    vmargin += XFASTINT (XCDR (Vtool_bar_button_margin));
 	}
 
@@ -11451,7 +11458,7 @@ redisplay_tool_bar (struct frame *f)
     {
       int border, rows, height, extra;
 
-      if (INTEGERP (Vtool_bar_border))
+      if (TYPE_RANGED_INTEGERP (int, Vtool_bar_border))
 	border = XINT (Vtool_bar_border);
       else if (EQ (Vtool_bar_border, Qinternal_border_width))
 	border = FRAME_INTERNAL_BORDER_WIDTH (f);
@@ -11639,7 +11646,7 @@ get_tool_bar_item (struct frame *f, int x, int y, struct glyph **glyph,
 
 void
 handle_tool_bar_click (struct frame *f, int x, int y, int down_p,
-		       unsigned int modifiers)
+		       int modifiers)
 {
   Mouse_HLInfo *hlinfo = MOUSE_HL_INFO (f);
   struct window *w = XWINDOW (f->tool_bar_window);
@@ -11818,7 +11825,7 @@ hscroll_window_tree (Lisp_Object window)
 	  hscroll_step_abs = 0;
 	}
     }
-  else if (INTEGERP (Vhscroll_step))
+  else if (TYPE_RANGED_INTEGERP (int, Vhscroll_step))
     {
       hscroll_step_abs = XINT (Vhscroll_step);
       if (hscroll_step_abs < 0)
@@ -11861,9 +11868,9 @@ hscroll_window_tree (Lisp_Object window)
 		      && (w->cursor.x >= text_area_width - h_margin))))
 	    {
 	      struct it it;
-	      int hscroll;
+	      ptrdiff_t hscroll;
 	      struct buffer *saved_current_buffer;
-	      EMACS_INT pt;
+	      ptrdiff_t pt;
 	      int wanted_x;
 
 	      /* Find point in a display of infinite width.  */
@@ -11976,12 +11983,12 @@ static int debug_dvpos, debug_dy;
 
 /* Delta in characters and bytes for try_window_id.  */
 
-static EMACS_INT debug_delta, debug_delta_bytes;
+static ptrdiff_t debug_delta, debug_delta_bytes;
 
 /* Values of window_end_pos and window_end_vpos at the end of
    try_window_id.  */
 
-static EMACS_INT debug_end_vpos;
+static ptrdiff_t debug_end_vpos;
 
 /* Append a string to W->desired_matrix->method.  FMT is a printf
    format string.  If trace_redisplay_p is non-zero also printf the
@@ -12031,7 +12038,7 @@ debug_method_add (struct window *w, char const *fmt, ...)
 
 static inline int
 text_outside_line_unchanged_p (struct window *w,
-			       EMACS_INT start, EMACS_INT end)
+			       ptrdiff_t start, ptrdiff_t end)
 {
   int unchanged_p = 1;
 
@@ -12254,10 +12261,10 @@ overlay_arrow_at_row (struct it *it, struct glyph_row *row)
    position.  BUF and PT are the current point buffer and position.  */
 
 static int
-check_point_in_composition (struct buffer *prev_buf, EMACS_INT prev_pt,
-			    struct buffer *buf, EMACS_INT pt)
+check_point_in_composition (struct buffer *prev_buf, ptrdiff_t prev_pt,
+			    struct buffer *buf, ptrdiff_t pt)
 {
-  EMACS_INT start, end;
+  ptrdiff_t start, end;
   Lisp_Object prop;
   Lisp_Object buffer;
 
@@ -12308,7 +12315,7 @@ reconsider_clip_changes (struct window *w, struct buffer *b)
   if (!b->clip_changed
       && BUFFERP (w->buffer) && !NILP (w->window_end_valid))
     {
-      EMACS_INT pt;
+      ptrdiff_t pt;
 
       if (w == XWINDOW (selected_window))
 	pt = PT;
@@ -12377,7 +12384,7 @@ redisplay_internal (void)
   int must_finish = 0;
   struct text_pos tlbufpos, tlendpos;
   int number_of_visible_frames;
-  int count, count1;
+  ptrdiff_t count, count1;
   struct frame *sf;
   int polling_stopped_here = 0;
   Lisp_Object old_frame = selected_frame;
@@ -12720,7 +12727,7 @@ redisplay_internal (void)
   		{
  		  struct glyph_row *row
  		    = MATRIX_ROW (w->current_matrix, this_line_vpos + 1);
-  		  EMACS_INT delta, delta_bytes;
+  		  ptrdiff_t delta, delta_bytes;
 
 		  /* We used to distinguish between two cases here,
 		     conditioned by Z - CHARPOS (tlendpos) == ZV, for
@@ -13343,18 +13350,18 @@ redisplay_window_1 (Lisp_Object window)
 static int
 set_cursor_from_row (struct window *w, struct glyph_row *row,
 		     struct glyph_matrix *matrix,
-		     EMACS_INT delta, EMACS_INT delta_bytes,
+		     ptrdiff_t delta, ptrdiff_t delta_bytes,
 		     int dy, int dvpos)
 {
   struct glyph *glyph = row->glyphs[TEXT_AREA];
   struct glyph *end = glyph + row->used[TEXT_AREA];
   struct glyph *cursor = NULL;
   /* The last known character position in row.  */
-  EMACS_INT last_pos = MATRIX_ROW_START_CHARPOS (row) + delta;
+  ptrdiff_t last_pos = MATRIX_ROW_START_CHARPOS (row) + delta;
   int x = row->x;
-  EMACS_INT pt_old = PT - delta;
-  EMACS_INT pos_before = MATRIX_ROW_START_CHARPOS (row) + delta;
-  EMACS_INT pos_after = MATRIX_ROW_END_CHARPOS (row) + delta;
+  ptrdiff_t pt_old = PT - delta;
+  ptrdiff_t pos_before = MATRIX_ROW_START_CHARPOS (row) + delta;
+  ptrdiff_t pos_after = MATRIX_ROW_END_CHARPOS (row) + delta;
   struct glyph *glyph_before = glyph - 1, *glyph_after = end;
   /* A glyph beyond the edge of TEXT_AREA which we should never
      touch.  */
@@ -13367,11 +13374,11 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
   int string_seen = 0;
   /* Largest and smalles buffer positions seen so far during scan of
      glyph row.  */
-  EMACS_INT bpos_max = pos_before;
-  EMACS_INT bpos_min = pos_after;
+  ptrdiff_t bpos_max = pos_before;
+  ptrdiff_t bpos_min = pos_after;
   /* Last buffer position covered by an overlay string with an integer
      `cursor' property.  */
-  EMACS_INT bpos_covered = 0;
+  ptrdiff_t bpos_covered = 0;
   /* Non-zero means the display string on which to display the cursor
      comes from a text property, not from an overlay.  */
   int string_from_text_prop = 0;
@@ -13457,7 +13464,7 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
       {
 	if (BUFFERP (glyph->object))
 	  {
-	    EMACS_INT dpos = glyph->charpos - pt_old;
+	    ptrdiff_t dpos = glyph->charpos - pt_old;
 
 	    if (glyph->charpos > bpos_max)
 	      bpos_max = glyph->charpos;
@@ -13494,7 +13501,7 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
 	else if (STRINGP (glyph->object))
 	  {
 	    Lisp_Object chprop;
-	    EMACS_INT glyph_pos = glyph->charpos;
+	    ptrdiff_t glyph_pos = glyph->charpos;
 
 	    chprop = Fget_char_property (make_number (glyph_pos), Qcursor,
 					 glyph->object);
@@ -13533,7 +13540,7 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
       {
 	if (BUFFERP (glyph->object))
 	  {
-	    EMACS_INT dpos = glyph->charpos - pt_old;
+	    ptrdiff_t dpos = glyph->charpos - pt_old;
 
 	    if (glyph->charpos > bpos_max)
 	      bpos_max = glyph->charpos;
@@ -13563,7 +13570,7 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
 	else if (STRINGP (glyph->object))
 	  {
 	    Lisp_Object chprop;
-	    EMACS_INT glyph_pos = glyph->charpos;
+	    ptrdiff_t glyph_pos = glyph->charpos;
 
 	    chprop = Fget_char_property (make_number (glyph_pos), Qcursor,
 					 glyph->object);
@@ -13608,7 +13615,7 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
 
       if (row->ends_in_ellipsis_p && pos_after == last_pos)
 	{
-	  EMACS_INT ellipsis_pos;
+	  ptrdiff_t ellipsis_pos;
 
 	  /* Scan back over the ellipsis glyphs.  */
 	  if (!row->reversed_p)
@@ -13660,7 +13667,7 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
 	     positioned between POS_BEFORE and POS_AFTER in the
 	     buffer.  */
 	  struct glyph *start, *stop;
-	  EMACS_INT pos = pos_before;
+	  ptrdiff_t pos = pos_before;
 
 	  x = -1;
 
@@ -13692,10 +13699,10 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
 	      if (STRINGP (glyph->object))
 		{
 		  Lisp_Object str;
-		  EMACS_INT tem;
+		  ptrdiff_t tem;
 		  /* If the display property covers the newline, we
 		     need to search for it one position farther.  */
-		  EMACS_INT lim = pos_after
+		  ptrdiff_t lim = pos_after
 		    + (pos_after == MATRIX_ROW_END_CHARPOS (row) + delta);
 
 		  string_from_text_prop = 0;
@@ -13721,7 +13728,7 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
 			     be a character in the string with the
 			     `cursor' property, which means display
 			     cursor on that character's glyph.  */
-			  EMACS_INT strpos = glyph->charpos;
+			  ptrdiff_t strpos = glyph->charpos;
 
 			  if (tem)
 			    {
@@ -13734,7 +13741,7 @@ set_cursor_from_row (struct window *w, struct glyph_row *row,
 			       glyph += incr)
 			    {
 			      Lisp_Object cprop;
-			      EMACS_INT gpos = glyph->charpos;
+			      ptrdiff_t gpos = glyph->charpos;
 
 			      cprop = Fget_char_property (make_number (gpos),
 							  Qcursor,
@@ -14004,7 +14011,7 @@ enum
 
 static int
 try_scrolling (Lisp_Object window, int just_this_one_p,
-	       EMACS_INT arg_scroll_conservatively, EMACS_INT scroll_step,
+	       ptrdiff_t arg_scroll_conservatively, ptrdiff_t scroll_step,
 	       int temp_scroll_step, int last_line_misfit)
 {
   struct window *w = XWINDOW (window);
@@ -14638,7 +14645,7 @@ try_cursor_movement (Lisp_Object window, struct text_pos startp, int *scroll_ste
 			MATRIX_ROW (w->current_matrix, w->cursor.vpos);
 		      struct glyph *g =
 			candidate->glyphs[TEXT_AREA] + w->cursor.hpos;
-		      EMACS_INT endpos = MATRIX_ROW_END_CHARPOS (candidate);
+		      ptrdiff_t endpos = MATRIX_ROW_END_CHARPOS (candidate);
 
 		      exact_match_p =
 			(BUFFERP (g->object) && g->charpos == PT)
@@ -14698,7 +14705,7 @@ static
 void
 set_vertical_scroll_bar (struct window *w)
 {
-  EMACS_INT start, end, whole;
+  ptrdiff_t start, end, whole;
 
   /* Calculate the start and end positions for the current window.
      At some point, it would be nice to choose between scrollbars
@@ -14758,11 +14765,11 @@ redisplay_window (Lisp_Object window, int just_this_one_p)
      It indictes that the buffer contents and narrowing are unchanged.  */
   int buffer_unchanged_p = 0;
   int temp_scroll_step = 0;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   int rc;
   int centering_position = -1;
   int last_line_misfit = 0;
-  EMACS_INT beg_unchanged, end_unchanged;
+  ptrdiff_t beg_unchanged, end_unchanged;
 
   SET_TEXT_POS (lpoint, PT, PT_BYTE);
   opoint = lpoint;
@@ -14903,8 +14910,8 @@ redisplay_window (Lisp_Object window, int just_this_one_p)
      window, set up appropriate value.  */
   if (!EQ (window, selected_window))
     {
-      EMACS_INT new_pt = XMARKER (w->pointm)->charpos;
-      EMACS_INT new_pt_byte = marker_byte_position (w->pointm);
+      ptrdiff_t new_pt = XMARKER (w->pointm)->charpos;
+      ptrdiff_t new_pt_byte = marker_byte_position (w->pointm);
       if (new_pt < BEGV)
 	{
 	  new_pt = BEGV;
@@ -15276,7 +15283,7 @@ redisplay_window (Lisp_Object window, int just_this_one_p)
 	scroll_margin > 0
 	? min (scroll_margin, WINDOW_TOTAL_LINES (w) / 4)
 	: 0;
-      EMACS_INT margin_pos = CHARPOS (startp);
+      ptrdiff_t margin_pos = CHARPOS (startp);
       int scrolling_up;
       Lisp_Object aggressive;
 
@@ -16144,7 +16151,7 @@ try_window_reusing_current_matrix (struct window *w)
 
 static struct glyph_row *find_last_unchanged_at_beg_row (struct window *);
 static struct glyph_row *find_first_unchanged_at_end_row (struct window *,
-                                                          EMACS_INT *, EMACS_INT *);
+                                                          ptrdiff_t *, ptrdiff_t *);
 static struct glyph_row *
 find_last_row_displaying_text (struct glyph_matrix *, struct it *,
                                struct glyph_row *);
@@ -16192,7 +16199,7 @@ find_last_row_displaying_text (struct glyph_matrix *matrix, struct it *it,
 static struct glyph_row *
 find_last_unchanged_at_beg_row (struct window *w)
 {
-  EMACS_INT first_changed_pos = BEG + BEG_UNCHANGED;
+  ptrdiff_t first_changed_pos = BEG + BEG_UNCHANGED;
   struct glyph_row *row;
   struct glyph_row *row_found = NULL;
   int yb = window_text_bottom_y (w);
@@ -16240,7 +16247,7 @@ find_last_unchanged_at_beg_row (struct window *w)
 
 static struct glyph_row *
 find_first_unchanged_at_end_row (struct window *w,
-				 EMACS_INT *delta, EMACS_INT *delta_bytes)
+				 ptrdiff_t *delta, ptrdiff_t *delta_bytes)
 {
   struct glyph_row *row;
   struct glyph_row *row_found = NULL;
@@ -16268,11 +16275,11 @@ find_first_unchanged_at_end_row (struct window *w,
 	 corresponds to window_end_pos.  This allows us to translate
 	 buffer positions in the current matrix to current buffer
 	 positions for characters not in changed text.  */
-      EMACS_INT Z_old =
+      ptrdiff_t Z_old =
 	MATRIX_ROW_END_CHARPOS (row) + XFASTINT (w->window_end_pos);
-      EMACS_INT Z_BYTE_old =
+      ptrdiff_t Z_BYTE_old =
 	MATRIX_ROW_END_BYTEPOS (row) + w->window_end_bytepos;
-      EMACS_INT last_unchanged_pos, last_unchanged_pos_old;
+      ptrdiff_t last_unchanged_pos, last_unchanged_pos_old;
       struct glyph_row *first_text_row
 	= MATRIX_FIRST_TEXT_ROW (w->current_matrix);
 
@@ -16359,12 +16366,12 @@ sync_frame_with_window_matrix_rows (struct window *w)
    containing CHARPOS or null.  */
 
 struct glyph_row *
-row_containing_pos (struct window *w, EMACS_INT charpos,
+row_containing_pos (struct window *w, ptrdiff_t charpos,
 		    struct glyph_row *start, struct glyph_row *end, int dy)
 {
   struct glyph_row *row = start;
   struct glyph_row *best_row = NULL;
-  EMACS_INT mindif = BUF_ZV (XBUFFER (w->buffer)) + 1;
+  ptrdiff_t mindif = BUF_ZV (XBUFFER (w->buffer)) + 1;
   int last_y;
 
   /* If we happen to start on a header-line, skip that.  */
@@ -16478,14 +16485,14 @@ try_window_id (struct window *w)
   struct glyph_row *bottom_row;
   int bottom_vpos;
   struct it it;
-  EMACS_INT delta = 0, delta_bytes = 0, stop_pos;
+  ptrdiff_t delta = 0, delta_bytes = 0, stop_pos;
   int dvpos, dy;
   struct text_pos start_pos;
   struct run run;
   int first_unchanged_at_end_vpos = 0;
   struct glyph_row *last_text_row, *last_text_row_at_end;
   struct text_pos start;
-  EMACS_INT first_changed_charpos, last_changed_charpos;
+  ptrdiff_t first_changed_charpos, last_changed_charpos;
 
 #if GLYPH_DEBUG
   if (inhibit_try_window_id)
@@ -16612,7 +16619,7 @@ try_window_id (struct window *w)
 	  || (last_changed_charpos < CHARPOS (start) - 1
 	      && FETCH_BYTE (BYTEPOS (start) - 1) == '\n')))
     {
-      EMACS_INT Z_old, Z_delta, Z_BYTE_old, Z_delta_bytes;
+      ptrdiff_t Z_old, Z_delta, Z_BYTE_old, Z_delta_bytes;
       struct glyph_row *r0;
 
       /* Compute how many chars/bytes have been added to or removed
@@ -17356,7 +17363,7 @@ dump_glyph_row (struct glyph_row *row, int vpos, int glyphs)
 	       row->visible_height,
 	       row->ascent,
 	       row->phys_ascent);
-      fprintf (stderr, "%9d %5d\t%5d\n", row->start.overlay_string_index,
+      fprintf (stderr, "%9"pD"d %5"pD"d\t%5d\n", row->start.overlay_string_index,
 	       row->end.overlay_string_index,
 	       row->continuation_lines_width);
       fprintf (stderr, "%9"pI"d %5"pI"d\n",
@@ -17430,7 +17437,7 @@ glyphs in short form, otherwise show glyphs in long form.  */)
 	   w->cursor.x, w->cursor.y, w->cursor.hpos, w->cursor.vpos);
   fprintf (stderr, "=============================================\n");
   dump_glyph_matrix (w->current_matrix,
-		     NILP (glyphs) ? 0 : XINT (glyphs));
+		     TYPE_RANGED_INTEGERP (int, glyphs) ? XINT (glyphs) : 0);
   return Qnil;
 }
 
@@ -17453,7 +17460,7 @@ GLYPH > 1 or omitted means dump glyphs in long form.  */)
   (Lisp_Object row, Lisp_Object glyphs)
 {
   struct glyph_matrix *matrix;
-  int vpos;
+  EMACS_INT vpos;
 
   CHECK_NUMBER (row);
   matrix = XWINDOW (selected_window)->current_matrix;
@@ -17461,7 +17468,7 @@ GLYPH > 1 or omitted means dump glyphs in long form.  */)
   if (vpos >= 0 && vpos < matrix->nrows)
     dump_glyph_row (MATRIX_ROW (matrix, vpos),
 		    vpos,
-		    INTEGERP (glyphs) ? XINT (glyphs) : 2);
+		    TYPE_RANGED_INTEGERP (int, glyphs) ? XINT (glyphs) : 2);
   return Qnil;
 }
 
@@ -17475,13 +17482,13 @@ GLYPH > 1 or omitted means dump glyphs in long form.  */)
 {
   struct frame *sf = SELECTED_FRAME ();
   struct glyph_matrix *m = XWINDOW (sf->tool_bar_window)->current_matrix;
-  int vpos;
+  EMACS_INT vpos;
 
   CHECK_NUMBER (row);
   vpos = XINT (row);
   if (vpos >= 0 && vpos < m->nrows)
     dump_glyph_row (MATRIX_ROW (m, vpos), vpos,
-		    INTEGERP (glyphs) ? XINT (glyphs) : 2);
+		    TYPE_RANGED_INTEGERP (int, glyphs) ? XINT (glyphs) : 2);
   return Qnil;
 }
 
@@ -17994,9 +18001,9 @@ extend_face_to_end_of_line (struct it *it)
    trailing whitespace.  */
 
 static int
-trailing_whitespace_p (EMACS_INT charpos)
+trailing_whitespace_p (ptrdiff_t charpos)
 {
-  EMACS_INT bytepos = CHAR_TO_BYTE (charpos);
+  ptrdiff_t bytepos = CHAR_TO_BYTE (charpos);
   int c = 0;
 
   while (bytepos < ZV_BYTE
@@ -18312,8 +18319,8 @@ unproduce_glyphs (struct it *it, int n)
    and ROW->maxpos.  */
 static void
 find_row_edges (struct it *it, struct glyph_row *row,
-		EMACS_INT min_pos, EMACS_INT min_bpos,
-		EMACS_INT max_pos, EMACS_INT max_bpos)
+		ptrdiff_t min_pos, ptrdiff_t min_bpos,
+		ptrdiff_t max_pos, ptrdiff_t max_bpos)
 {
   /* FIXME: Revisit this when glyph ``spilling'' in continuation
      lines' rows is implemented for bidi-reordered rows.  */
@@ -18406,11 +18413,11 @@ display_line (struct it *it)
   int wrap_row_ascent IF_LINT (= 0), wrap_row_height IF_LINT (= 0);
   int wrap_row_phys_ascent IF_LINT (= 0), wrap_row_phys_height IF_LINT (= 0);
   int wrap_row_extra_line_spacing IF_LINT (= 0);
-  EMACS_INT wrap_row_min_pos IF_LINT (= 0), wrap_row_min_bpos IF_LINT (= 0);
-  EMACS_INT wrap_row_max_pos IF_LINT (= 0), wrap_row_max_bpos IF_LINT (= 0);
+  ptrdiff_t wrap_row_min_pos IF_LINT (= 0), wrap_row_min_bpos IF_LINT (= 0);
+  ptrdiff_t wrap_row_max_pos IF_LINT (= 0), wrap_row_max_bpos IF_LINT (= 0);
   int cvpos;
-  EMACS_INT min_pos = ZV + 1, max_pos = 0;
-  EMACS_INT min_bpos IF_LINT (= 0), max_bpos IF_LINT (= 0);
+  ptrdiff_t min_pos = ZV + 1, max_pos = 0;
+  ptrdiff_t min_bpos IF_LINT (= 0), max_bpos IF_LINT (= 0);
 
   /* We always start displaying at hpos zero even if hscrolled.  */
   xassert (it->hpos == 0 && it->current_x == 0);
@@ -18482,10 +18489,10 @@ display_line (struct it *it)
   do								\
     {								\
       int composition_p = (IT)->what == IT_COMPOSITION;		\
-      EMACS_INT current_pos =					\
+      ptrdiff_t current_pos =					\
 	composition_p ? (IT)->cmp_it.charpos			\
 		      : IT_CHARPOS (*(IT));			\
-      EMACS_INT current_bpos =					\
+      ptrdiff_t current_bpos =					\
 	composition_p ? CHAR_TO_BYTE (current_pos)		\
 		      : IT_BYTEPOS (*(IT));			\
       if (current_pos < min_pos)				\
@@ -19114,8 +19121,8 @@ See also `bidi-paragraph-direction'.  */)
 	 use current_matrix if it is up to date, but this seems fast
 	 enough as it is.  */
       struct bidi_it itb;
-      EMACS_INT pos = BUF_PT (buf);
-      EMACS_INT bytepos = BUF_PT_BYTE (buf);
+      ptrdiff_t pos = BUF_PT (buf);
+      ptrdiff_t bytepos = BUF_PT_BYTE (buf);
       int c;
 
       set_buffer_temp (buf);
@@ -19401,7 +19408,7 @@ display_mode_line (struct window *w, enum face_id face_id, Lisp_Object format)
 {
   struct it it;
   struct face *face;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   init_iterator (&it, w, -1, -1, NULL, face_id);
   /* Don't extend on a previously drawn mode-line.
@@ -19537,7 +19544,7 @@ display_mode_element (struct it *it, int depth, int field_width, int precision,
       {
 	/* A string: output it and check for %-constructs within it.  */
 	unsigned char c;
-	EMACS_INT offset = 0;
+	ptrdiff_t offset = 0;
 
 	if (SCHARS (elt) > 0
 	    && (!NILP (props) || risky))
@@ -19634,7 +19641,7 @@ display_mode_element (struct it *it, int depth, int field_width, int precision,
 	       && (mode_line_target != MODE_LINE_DISPLAY
 		   || it->current_x < it->last_visible_x))
 	  {
-	    EMACS_INT last_offset = offset;
+	    ptrdiff_t last_offset = offset;
 
 	    /* Advance to end of string or next format specifier.  */
 	    while ((c = SREF (elt, offset++)) != '\0' && c != '%')
@@ -19642,7 +19649,7 @@ display_mode_element (struct it *it, int depth, int field_width, int precision,
 
 	    if (offset - 1 != last_offset)
 	      {
-		EMACS_INT nchars, nbytes;
+		ptrdiff_t nchars, nbytes;
 
 		/* Output to end of string or up to '%'.  Field width
 		   is length of string.  Don't output more than
@@ -19661,9 +19668,9 @@ display_mode_element (struct it *it, int depth, int field_width, int precision,
 		    break;
 		  case MODE_LINE_STRING:
 		    {
-		      EMACS_INT bytepos = last_offset;
-		      EMACS_INT charpos = string_byte_to_char (elt, bytepos);
-		      EMACS_INT endpos = (precision <= 0
+		      ptrdiff_t bytepos = last_offset;
+		      ptrdiff_t charpos = string_byte_to_char (elt, bytepos);
+		      ptrdiff_t endpos = (precision <= 0
 					  ? string_byte_to_char (elt, offset)
 					  : charpos + nchars);
 
@@ -19675,8 +19682,8 @@ display_mode_element (struct it *it, int depth, int field_width, int precision,
 		    break;
 		  case MODE_LINE_DISPLAY:
 		    {
-		      EMACS_INT bytepos = last_offset;
-		      EMACS_INT charpos = string_byte_to_char (elt, bytepos);
+		      ptrdiff_t bytepos = last_offset;
+		      ptrdiff_t charpos = string_byte_to_char (elt, bytepos);
 
 		      if (precision <= 0)
 			nchars = string_byte_to_char (elt, offset) - charpos;
@@ -19689,7 +19696,7 @@ display_mode_element (struct it *it, int depth, int field_width, int precision,
 	      }
 	    else /* c == '%' */
 	      {
-		EMACS_INT percent_position = offset;
+		ptrdiff_t percent_position = offset;
 
 		/* Get the specified minimum width.  Zero means
 		   don't pad.  */
@@ -19711,7 +19718,7 @@ display_mode_element (struct it *it, int depth, int field_width, int precision,
 		else if (c != 0)
 		  {
 		    int multibyte;
-		    EMACS_INT bytepos, charpos;
+		    ptrdiff_t bytepos, charpos;
 		    const char *spec;
 		    Lisp_Object string;
 
@@ -19984,7 +19991,7 @@ static int
 store_mode_line_string (const char *string, Lisp_Object lisp_string, int copy_string,
 			int field_width, int precision, Lisp_Object props)
 {
-  EMACS_INT len;
+  ptrdiff_t len;
   int n = 0;
 
   if (string != NULL)
@@ -20085,7 +20092,7 @@ are the selected window and the WINDOW's buffer).  */)
   struct buffer *old_buffer = NULL;
   int face_id;
   int no_props = INTEGERP (face);
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   Lisp_Object str;
   int string_start = 0;
 
@@ -20171,7 +20178,7 @@ are the selected window and the WINDOW's buffer).  */)
    the positive integer D to BUF using a minimal field width WIDTH.  */
 
 static void
-pint2str (register char *buf, register int width, register EMACS_INT d)
+pint2str (register char *buf, register int width, register ptrdiff_t d)
 {
   register char *p = buf;
 
@@ -20215,11 +20222,11 @@ static const char power_letter[] =
   };
 
 static void
-pint2hrstr (char *buf, int width, EMACS_INT d)
+pint2hrstr (char *buf, int width, ptrdiff_t d)
 {
   /* We aim to represent the nonnegative integer D as
      QUOTIENT.TENTHS * 10 ^ (3 * EXPONENT). */
-  EMACS_INT quotient = d;
+  ptrdiff_t quotient = d;
   int remainder = 0;
   /* -1 means: do not use TENTHS. */
   int tenths = -1;
@@ -20499,7 +20506,7 @@ decode_mode_spec (struct window *w, register int c, int field_width,
 	return "";
       else
 	{
-	  EMACS_INT col = current_column ();
+	  ptrdiff_t col = current_column ();
 	  w->column_number_displayed = make_number (col);
 	  pint2str (decode_mode_spec_buf, field_width, col);
 	  return decode_mode_spec_buf;
@@ -20531,23 +20538,23 @@ decode_mode_spec (struct window *w, register int c, int field_width,
 
     case 'i':
       {
-	EMACS_INT size = ZV - BEGV;
+	ptrdiff_t size = ZV - BEGV;
 	pint2str (decode_mode_spec_buf, field_width, size);
 	return decode_mode_spec_buf;
       }
 
     case 'I':
       {
-	EMACS_INT size = ZV - BEGV;
+	ptrdiff_t size = ZV - BEGV;
 	pint2hrstr (decode_mode_spec_buf, field_width, size);
 	return decode_mode_spec_buf;
       }
 
     case 'l':
       {
-	EMACS_INT startpos, startpos_byte, line, linepos, linepos_byte;
-	EMACS_INT topline, nlines, height;
-	EMACS_INT junk;
+	ptrdiff_t startpos, startpos_byte, line, linepos, linepos_byte;
+	ptrdiff_t topline, nlines, height;
+	ptrdiff_t junk;
 
 	/* %c and %l are ignored in `frame-title-format'.  */
 	if (mode_line_target == MODE_LINE_TITLE)
@@ -20608,10 +20615,10 @@ decode_mode_spec (struct window *w, register int c, int field_width,
 	else if (nlines < height + 25 || nlines > height * 3 + 50
 		 || linepos == BUF_BEGV (b))
 	  {
-	    EMACS_INT limit = BUF_BEGV (b);
-	    EMACS_INT limit_byte = BUF_BEGV_BYTE (b);
-	    EMACS_INT position;
-	    EMACS_INT distance =
+	    ptrdiff_t limit = BUF_BEGV (b);
+	    ptrdiff_t limit_byte = BUF_BEGV_BYTE (b);
+	    ptrdiff_t position;
+	    ptrdiff_t distance =
 	      (height * 2 + 30) * line_number_display_limit_width;
 
 	    if (startpos - distance > limit)
@@ -20673,8 +20680,8 @@ decode_mode_spec (struct window *w, register int c, int field_width,
 
     case 'p':
       {
-	EMACS_INT pos = marker_position (w->start);
-	EMACS_INT total = BUF_ZV (b) - BUF_BEGV (b);
+	ptrdiff_t pos = marker_position (w->start);
+	ptrdiff_t total = BUF_ZV (b) - BUF_BEGV (b);
 
 	if (XFASTINT (w->window_end_pos) <= BUF_Z (b) - BUF_ZV (b))
 	  {
@@ -20704,9 +20711,9 @@ decode_mode_spec (struct window *w, register int c, int field_width,
       /* Display percentage of size above the bottom of the screen.  */
     case 'P':
       {
-	EMACS_INT toppos = marker_position (w->start);
-	EMACS_INT botpos = BUF_Z (b) - XFASTINT (w->window_end_pos);
-	EMACS_INT total = BUF_ZV (b) - BUF_BEGV (b);
+	ptrdiff_t toppos = marker_position (w->start);
+	ptrdiff_t botpos = BUF_Z (b) - XFASTINT (w->window_end_pos);
+	ptrdiff_t total = BUF_ZV (b) - BUF_BEGV (b);
 
 	if (botpos >= BUF_ZV (b))
 	  {
@@ -20746,7 +20753,7 @@ decode_mode_spec (struct window *w, register int c, int field_width,
 
     case '@':
       {
-	int count = inhibit_garbage_collection ();
+	ptrdiff_t count = inhibit_garbage_collection ();
 	Lisp_Object val = call1 (intern ("file-remote-p"),
 				 BVAR (current_buffer, directory));
 	unbind_to (count, Qnil);
@@ -20815,17 +20822,17 @@ decode_mode_spec (struct window *w, register int c, int field_width,
 
    Set *BYTE_POS_PTR to 1 if we found COUNT lines, 0 if we hit LIMIT.  */
 
-static EMACS_INT
-display_count_lines (EMACS_INT start_byte,
-		     EMACS_INT limit_byte, EMACS_INT count,
-		     EMACS_INT *byte_pos_ptr)
+static ptrdiff_t
+display_count_lines (ptrdiff_t start_byte,
+		     ptrdiff_t limit_byte, ptrdiff_t count,
+		     ptrdiff_t *byte_pos_ptr)
 {
   register unsigned char *cursor;
   unsigned char *base;
 
-  register EMACS_INT ceiling;
+  register ptrdiff_t ceiling;
   register unsigned char *ceiling_addr;
-  EMACS_INT orig_count = count;
+  ptrdiff_t orig_count = count;
 
   /* If we are not in selective display mode,
      check only for newlines.  */
@@ -20959,13 +20966,13 @@ display_count_lines (EMACS_INT start_byte,
 
 static int
 display_string (const char *string, Lisp_Object lisp_string, Lisp_Object face_string,
-		EMACS_INT face_string_pos, EMACS_INT start, struct it *it,
+		ptrdiff_t face_string_pos, ptrdiff_t start, struct it *it,
 		int field_width, int precision, int max_x, int multibyte)
 {
   int hpos_at_start = it->hpos;
   int saved_face_id = it->face_id;
   struct glyph_row *row = it->glyph_row;
-  EMACS_INT it_charpos;
+  ptrdiff_t it_charpos;
 
   /* Initialize the iterator IT for iteration over STRING beginning
      with index START.  */
@@ -20980,7 +20987,7 @@ display_string (const char *string, Lisp_Object lisp_string, Lisp_Object face_st
      FACE_STRING, if that's given.  */
   if (STRINGP (face_string))
     {
-      EMACS_INT endptr;
+      ptrdiff_t endptr;
       struct face *face;
 
       it->face_id
@@ -22461,7 +22468,7 @@ compute_overhangs_and_x (struct glyph_string *s, int x, int backward_p)
 
 static int
 draw_glyphs (struct window *w, int x, struct glyph_row *row,
-	     enum glyph_row_area area, EMACS_INT start, EMACS_INT end,
+	     enum glyph_row_area area, ptrdiff_t start, ptrdiff_t end,
 	     enum draw_glyphs_face hl, int overlaps)
 {
   struct glyph_string *head, *tail;
@@ -23912,7 +23919,7 @@ x_produce_glyphs (struct it *it)
 	  XChar2b char2b;
 	  struct font_metrics *pcm;
 	  int font_not_found_p;
-	  EMACS_INT pos;
+	  ptrdiff_t pos;
 
 	  for (glyph_len = cmp->glyph_len; glyph_len > 0; glyph_len--)
 	    if ((c = COMPOSITION_GLYPH (cmp, glyph_len - 1)) != '\t')
@@ -24312,7 +24319,7 @@ x_insert_glyphs (struct glyph *start, int len)
   struct glyph_row *row;
   struct glyph *glyph;
   int frame_x, frame_y;
-  EMACS_INT hpos;
+  ptrdiff_t hpos;
 
   xassert (updated_window && updated_row);
   BLOCK_INPUT;
@@ -24459,8 +24466,7 @@ get_specified_cursor_type (Lisp_Object arg, int *width)
 
   if (CONSP (arg)
       && EQ (XCAR (arg), Qbar)
-      && INTEGERP (XCDR (arg))
-      && XINT (XCDR (arg)) >= 0)
+      && RANGED_INTEGERP (0, XCDR (arg), INT_MAX))
     {
       *width = XINT (XCDR (arg));
       return BAR_CURSOR;
@@ -24474,8 +24480,7 @@ get_specified_cursor_type (Lisp_Object arg, int *width)
 
   if (CONSP (arg)
       && EQ (XCAR (arg), Qhbar)
-      && INTEGERP (XCDR (arg))
-      && XINT (XCDR (arg)) >= 0)
+      && RANGED_INTEGERP (0, XCDR (arg), INT_MAX))
     {
       *width = XINT (XCDR (arg));
       return HBAR_CURSOR;
@@ -25315,7 +25320,7 @@ cursor_in_mouse_face_p (struct window *w)
    change non-linearly with glyph rows.  */
 static void
 rows_from_pos_range (struct window *w,
-		     EMACS_INT start_charpos, EMACS_INT end_charpos,
+		     ptrdiff_t start_charpos, ptrdiff_t end_charpos,
 		     struct glyph_row **start, struct glyph_row **end)
 {
   struct glyph_row *first = MATRIX_FIRST_TEXT_ROW (w->current_matrix);
@@ -25443,9 +25448,9 @@ rows_from_pos_range (struct window *w,
 static void
 mouse_face_from_buffer_pos (Lisp_Object window,
 			    Mouse_HLInfo *hlinfo,
-			    EMACS_INT mouse_charpos,
-			    EMACS_INT start_charpos,
-			    EMACS_INT end_charpos,
+			    ptrdiff_t mouse_charpos,
+			    ptrdiff_t start_charpos,
+			    ptrdiff_t end_charpos,
 			    Lisp_Object before_string,
 			    Lisp_Object after_string,
 			    Lisp_Object cover_string)
@@ -25454,7 +25459,7 @@ mouse_face_from_buffer_pos (Lisp_Object window,
   struct glyph_row *first = MATRIX_FIRST_TEXT_ROW (w->current_matrix);
   struct glyph_row *r1, *r2;
   struct glyph *glyph, *end;
-  EMACS_INT ignore, pos;
+  ptrdiff_t ignore, pos;
   int x;
 
   xassert (NILP (cover_string) || STRINGP (cover_string));
@@ -25776,7 +25781,7 @@ mouse_face_from_buffer_pos (Lisp_Object window,
    Value is non-zero if a glyph was found.  */
 
 static int
-fast_find_string_pos (struct window *w, EMACS_INT pos, Lisp_Object object,
+fast_find_string_pos (struct window *w, ptrdiff_t pos, Lisp_Object object,
 		      int *hpos, int *vpos, int *x, int *y, int right_p)
 {
   int yb = window_text_bottom_y (w);
@@ -25846,7 +25851,7 @@ fast_find_string_pos (struct window *w, EMACS_INT pos, Lisp_Object object,
 static void
 mouse_face_from_string_pos (struct window *w, Mouse_HLInfo *hlinfo,
 			    Lisp_Object object,
-			    EMACS_INT startpos, EMACS_INT endpos)
+			    ptrdiff_t startpos, ptrdiff_t endpos)
 {
   int yb = window_text_bottom_y (w);
   struct glyph_row *r;
@@ -26016,8 +26021,8 @@ on_hot_spot_p (Lisp_Object hot_spot, int x, int y)
 	{
 	  struct Lisp_Vector *v = XVECTOR (XCDR (hot_spot));
 	  Lisp_Object *poly = v->contents;
-	  int n = v->header.size;
-	  int i;
+	  ptrdiff_t n = v->header.size;
+	  ptrdiff_t i;
 	  int inside = 0;
 	  Lisp_Object lx, ly;
 	  int x0, y0;
@@ -26095,7 +26100,9 @@ Returns the alist element for the first matching AREA in MAP.  */)
   CHECK_NUMBER (x);
   CHECK_NUMBER (y);
 
-  return find_hot_spot (map, XINT (x), XINT (y));
+  return find_hot_spot (map,
+			clip_to_bounds (INT_MIN, XINT (x), INT_MAX),
+			clip_to_bounds (INT_MIN, XINT (y), INT_MAX));
 }
 
 
@@ -26154,7 +26161,7 @@ note_mode_line_or_margin_highlight (Lisp_Object window, int x, int y,
   Cursor cursor = No_Cursor;
   Lisp_Object pointer = Qnil;
   int dx, dy, width, height;
-  EMACS_INT charpos;
+  ptrdiff_t charpos;
   Lisp_Object string, object = Qnil;
   Lisp_Object pos, help;
 
@@ -26294,7 +26301,7 @@ note_mode_line_or_margin_highlight (Lisp_Object window, int x, int y,
 	  int gpos;
 	  int gseq_length;
 	  int total_pixel_width;
-	  EMACS_INT begpos, endpos, ignore;
+	  ptrdiff_t begpos, endpos, ignore;
 
 	  int vpos, hpos;
 
@@ -26521,14 +26528,14 @@ note_mouse_highlight (struct frame *f, int x, int y)
       && XFASTINT (w->last_overlay_modified) == BUF_OVERLAY_MODIFF (b))
     {
       int hpos, vpos, dx, dy, area;
-      EMACS_INT pos;
+      ptrdiff_t pos;
       struct glyph *glyph;
       Lisp_Object object;
       Lisp_Object mouse_face = Qnil, position;
       Lisp_Object *overlay_vec = NULL;
       ptrdiff_t i, noverlays;
       struct buffer *obuf;
-      EMACS_INT obegv, ozv;
+      ptrdiff_t obegv, ozv;
       int same_region;
 
       /* Find the glyph under X/Y.  */
@@ -26686,7 +26693,7 @@ note_mouse_highlight (struct frame *f, int x, int y)
 	      /* The mouse-highlighting comes from a display string
 		 with a mouse-face.  */
 	      Lisp_Object s, e;
-	      EMACS_INT ignore;
+	      ptrdiff_t ignore;
 
 	      s = Fprevious_single_property_change
 		(make_number (pos + 1), Qmouse_face, object, Qnil);
@@ -26718,7 +26725,7 @@ note_mouse_highlight (struct frame *f, int x, int y)
 		  /* If we are on a display string with no mouse-face,
 		     check if the text under it has one.  */
 		  struct glyph_row *r = MATRIX_ROW (w->current_matrix, vpos);
-		  EMACS_INT start = MATRIX_ROW_START_CHARPOS (r);
+		  ptrdiff_t start = MATRIX_ROW_START_CHARPOS (r);
 		  pos = string_buffer_position (object, start);
 		  if (pos > 0)
 		    {
@@ -26813,7 +26820,7 @@ note_mouse_highlight (struct frame *f, int x, int y)
 	else
 	  {
 	    Lisp_Object obj = glyph->object;
-	    EMACS_INT charpos = glyph->charpos;
+	    ptrdiff_t charpos = glyph->charpos;
 
 	    /* Try text properties.  */
 	    if (STRINGP (obj)
@@ -26828,8 +26835,8 @@ note_mouse_highlight (struct frame *f, int x, int y)
 		       see if the buffer text ``under'' it does.  */
 		    struct glyph_row *r
 		      = MATRIX_ROW (w->current_matrix, vpos);
-		    EMACS_INT start = MATRIX_ROW_START_CHARPOS (r);
-		    EMACS_INT p = string_buffer_position (obj, start);
+		    ptrdiff_t start = MATRIX_ROW_START_CHARPOS (r);
+		    ptrdiff_t p = string_buffer_position (obj, start);
 		    if (p > 0)
 		      {
 			help = Fget_char_property (make_number (p),
@@ -26869,7 +26876,7 @@ note_mouse_highlight (struct frame *f, int x, int y)
 	  if (NILP (pointer))
 	    {
 	      Lisp_Object obj = glyph->object;
-	      EMACS_INT charpos = glyph->charpos;
+	      ptrdiff_t charpos = glyph->charpos;
 
 	      /* Try text properties.  */
 	      if (STRINGP (obj)
@@ -26884,8 +26891,8 @@ note_mouse_highlight (struct frame *f, int x, int y)
 			 see if the buffer text ``under'' it does.  */
 		      struct glyph_row *r
 			= MATRIX_ROW (w->current_matrix, vpos);
-		      EMACS_INT start = MATRIX_ROW_START_CHARPOS (r);
-		      EMACS_INT p = string_buffer_position (obj, start);
+		      ptrdiff_t start = MATRIX_ROW_START_CHARPOS (r);
+		      ptrdiff_t p = string_buffer_position (obj, start);
 		      if (p > 0)
 			pointer = Fget_char_property (make_number (p),
 						      Qpointer, w->buffer);
@@ -28164,23 +28171,16 @@ start_hourglass (void)
 {
 #if defined (HAVE_WINDOW_SYSTEM)
   EMACS_TIME delay;
-  int secs, usecs = 0;
+  int secs = DEFAULT_HOURGLASS_DELAY, usecs = 0;
 
   cancel_hourglass ();
 
-  if (INTEGERP (Vhourglass_delay)
-      && XINT (Vhourglass_delay) > 0)
-    secs = XFASTINT (Vhourglass_delay);
-  else if (FLOATP (Vhourglass_delay)
-	   && XFLOAT_DATA (Vhourglass_delay) > 0)
+  if (NUMBERP (Vhourglass_delay))
     {
-      Lisp_Object tem;
-      tem = Ftruncate (Vhourglass_delay, Qnil);
-      secs = XFASTINT (tem);
-      usecs = (XFLOAT_DATA (Vhourglass_delay) - secs) * 1000000;
+      double duration = extract_float (Vhourglass_delay);
+      if (0 < duration)
+	duration_to_sec_usec (duration, &secs, &usecs);
     }
-  else
-    secs = DEFAULT_HOURGLASS_DELAY;
 
   EMACS_SET_SECS_USECS (delay, secs, usecs);
   hourglass_atimer = start_atimer (ATIMER_RELATIVE, delay,
diff --git a/src/xfaces.c b/src/xfaces.c
index 9faa7c79e0b..ee41ab69b0b 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -922,7 +922,7 @@ the pixmap.  Bits are stored row by row, each row occupies
   else if (CONSP (object))
     {
       /* Otherwise OBJECT must be (WIDTH HEIGHT DATA), WIDTH and
-	 HEIGHT must be integers > 0, and DATA must be string large
+	 HEIGHT must be ints > 0, and DATA must be string large
 	 enough to hold a bitmap of the specified size.  */
       Lisp_Object width, height, data;
 
@@ -942,11 +942,11 @@ the pixmap.  Bits are stored row by row, each row occupies
 	}
 
       if (STRINGP (data)
-	  && INTEGERP (width) && 0 < XINT (width)
-	  && INTEGERP (height) && 0 < XINT (height))
+	  && RANGED_INTEGERP (1, width, INT_MAX)
+	  && RANGED_INTEGERP (1, height, INT_MAX))
 	{
-	  EMACS_INT bytes_per_row = ((XINT (width) + BITS_PER_CHAR - 1)
-				     / BITS_PER_CHAR);
+	  int bytes_per_row = ((XINT (width) + BITS_PER_CHAR - 1)
+			       / BITS_PER_CHAR);
 	  if (XINT (height) <= SBYTES (data) / bytes_per_row)
 	    pixmap_p = 1;
 	}
@@ -1604,7 +1604,9 @@ compare_fonts_by_sort_order (const void *v1, const void *v2)
       else
 	{
 	  if (INTEGERP (val1))
-	    result = INTEGERP (val2) ? XINT (val1) - XINT (val2) : -1;
+	    result = (INTEGERP (val2) && XINT (val1) >= XINT (val2)
+		      ? XINT (val1) > XINT (val2)
+		      : -1);
 	  else
 	    result = INTEGERP (val2) ? 1 : 0;
 	}
@@ -1633,8 +1635,10 @@ the face font sort order.  */)
   (Lisp_Object family, Lisp_Object frame)
 {
   Lisp_Object font_spec, list, *drivers, vec;
-  int i, nfonts, ndrivers;
+  ptrdiff_t i, nfonts;
+  EMACS_INT ndrivers;
   Lisp_Object result;
+  USE_SAFE_ALLOCA;
 
   if (NILP (frame))
     frame = selected_frame;
@@ -1670,7 +1674,7 @@ the face font sort order.  */)
   font_props_for_sorting[i++] = FONT_REGISTRY_INDEX;
 
   ndrivers = XINT (Flength (list));
-  drivers  = alloca (sizeof (Lisp_Object) * ndrivers);
+  SAFE_ALLOCA_LISP (drivers, ndrivers);
   for (i = 0; i < ndrivers; i++, list = XCDR (list))
     drivers[i] = XCAR (list);
   vec = Fvconcat (ndrivers, drivers);
@@ -1702,6 +1706,7 @@ the face font sort order.  */)
       result = Fcons (v, result);
     }
 
+  SAFE_FREE ();
   return result;
 }
 
@@ -2263,7 +2268,7 @@ merge_face_heights (Lisp_Object from, Lisp_Object to, Lisp_Object invalid)
     {
       if (INTEGERP (to))
 	/* relative X absolute => absolute */
-	result = make_number ((EMACS_INT)(XFLOAT_DATA (from) * XINT (to)));
+	result = make_number (XFLOAT_DATA (from) * XINT (to));
       else if (FLOATP (to))
 	/* relative X relative => relative */
 	result = make_float (XFLOAT_DATA (from) * XFLOAT_DATA (to));
@@ -2683,8 +2688,7 @@ Value is a vector of face attributes.  */)
 	 property `face' of the Lisp face name.  */
       if (next_lface_id == lface_id_to_name_size)
 	lface_id_to_name =
-	  xpalloc (lface_id_to_name, &lface_id_to_name_size, 1,
-		   min (INT_MAX, MOST_POSITIVE_FIXNUM),
+	  xpalloc (lface_id_to_name, &lface_id_to_name_size, 1, MAX_FACE_ID,
 		   sizeof *lface_id_to_name);
 
       lface_id_to_name[next_lface_id] = face;
@@ -5277,7 +5281,7 @@ static int
 realize_basic_faces (struct frame *f)
 {
   int success_p = 0;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   /* Block input here so that we won't be surprised by an X expose
      event, for instance, without having the faces set up.  */
@@ -5960,9 +5964,9 @@ compute_char_face (struct frame *f, int ch, Lisp_Object prop)
    The face returned is suitable for displaying ASCII characters.  */
 
 int
-face_at_buffer_position (struct window *w, EMACS_INT pos,
-			 EMACS_INT region_beg, EMACS_INT region_end,
-			 EMACS_INT *endptr, EMACS_INT limit,
+face_at_buffer_position (struct window *w, ptrdiff_t pos,
+			 ptrdiff_t region_beg, ptrdiff_t region_end,
+			 ptrdiff_t *endptr, ptrdiff_t limit,
 			 int mouse, int base_face_id)
 {
   struct frame *f = XFRAME (w->frame);
@@ -5971,7 +5975,7 @@ face_at_buffer_position (struct window *w, EMACS_INT pos,
   ptrdiff_t i, noverlays;
   Lisp_Object *overlay_vec;
   Lisp_Object frame;
-  EMACS_INT endpos;
+  ptrdiff_t endpos;
   Lisp_Object propname = mouse ? Qmouse_face : Qface;
   Lisp_Object limit1, end;
   struct face *default_face;
@@ -5997,7 +6001,7 @@ face_at_buffer_position (struct window *w, EMACS_INT pos,
 
   /* Look at properties from overlays.  */
   {
-    EMACS_INT next_overlay;
+    ptrdiff_t next_overlay;
 
     GET_OVERLAYS_AT (pos, overlay_vec, noverlays, &next_overlay, 0);
     if (next_overlay < endpos)
@@ -6072,9 +6076,9 @@ face_at_buffer_position (struct window *w, EMACS_INT pos,
    simply disregards the `face' properties of all overlays.  */
 
 int
-face_for_overlay_string (struct window *w, EMACS_INT pos,
-			 EMACS_INT region_beg, EMACS_INT region_end,
-			 EMACS_INT *endptr, EMACS_INT limit,
+face_for_overlay_string (struct window *w, ptrdiff_t pos,
+			 ptrdiff_t region_beg, ptrdiff_t region_end,
+			 ptrdiff_t *endptr, ptrdiff_t limit,
 			 int mouse, Lisp_Object overlay)
 {
   struct frame *f = XFRAME (w->frame);
@@ -6161,9 +6165,9 @@ face_for_overlay_string (struct window *w, EMACS_INT pos,
 
 int
 face_at_string_position (struct window *w, Lisp_Object string,
-			 EMACS_INT pos, EMACS_INT bufpos,
-			 EMACS_INT region_beg, EMACS_INT region_end,
-			 EMACS_INT *endptr, enum face_id base_face_id,
+			 ptrdiff_t pos, ptrdiff_t bufpos,
+			 ptrdiff_t region_beg, ptrdiff_t region_end,
+			 ptrdiff_t *endptr, enum face_id base_face_id,
 			 int mouse_p)
 {
   Lisp_Object prop, position, end, limit;
@@ -6246,7 +6250,7 @@ face_at_string_position (struct window *w, Lisp_Object string,
 */
 
 int
-merge_faces (struct frame *f, Lisp_Object face_name, EMACS_INT face_id,
+merge_faces (struct frame *f, Lisp_Object face_name, int face_id,
 	     int base_face_id)
 {
   Lisp_Object attrs[LFACE_VECTOR_SIZE];
diff --git a/src/xfns.c b/src/xfns.c
index 998c803a7ad..4a7c17e1152 100644
--- a/src/xfns.c
+++ b/src/xfns.c
@@ -1200,7 +1200,7 @@ x_set_menu_bar_lines (struct frame *f, Lisp_Object value, Lisp_Object oldval)
   if (FRAME_MINIBUF_ONLY_P (f))
     return;
 
-  if (INTEGERP (value))
+  if (TYPE_RANGED_INTEGERP (int, value))
     nlines = XINT (value);
   else
     nlines = 0;
@@ -1286,8 +1286,8 @@ x_set_tool_bar_lines (struct frame *f, Lisp_Object value, Lisp_Object oldval)
   if (FRAME_MINIBUF_ONLY_P (f))
     return;
 
-  /* Use VALUE only if an integer >= 0.  */
-  if (INTEGERP (value) && XINT (value) >= 0)
+  /* Use VALUE only if an int >= 0.  */
+  if (RANGED_INTEGERP (0, value, INT_MAX))
     nlines = XFASTINT (value);
   else
     nlines = 0;
@@ -2787,8 +2787,8 @@ x_icon (struct frame *f, Lisp_Object parms)
   icon_y = x_frame_get_and_record_arg (f, parms, Qicon_top, 0, 0, RES_TYPE_NUMBER);
   if (!EQ (icon_x, Qunbound) && !EQ (icon_y, Qunbound))
     {
-      CHECK_NUMBER (icon_x);
-      CHECK_NUMBER (icon_y);
+      CHECK_TYPE_RANGED_INTEGER (int, icon_x);
+      CHECK_TYPE_RANGED_INTEGER (int, icon_y);
     }
   else if (!EQ (icon_x, Qunbound) || !EQ (icon_y, Qunbound))
     error ("Both left and top icon corners of icon must be specified");
@@ -3072,7 +3072,7 @@ This function is an internal primitive--use `make-frame' instead.  */)
   int minibuffer_only = 0;
   long window_prompting = 0;
   int width, height;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
   Lisp_Object display;
   struct x_display_info *dpyinfo = NULL;
@@ -4191,11 +4191,11 @@ FRAME.  Default is to change on the edit X window.  */)
   if (! NILP (format))
     {
       CHECK_NUMBER (format);
-      element_format = XFASTINT (format);
 
-      if (element_format != 8 && element_format != 16
-          && element_format != 32)
+      if (XINT (format) != 8 && XINT (format) != 16
+          && XINT (format) != 32)
         error ("FORMAT must be one of 8, 16 or 32");
+      element_format = XINT (format);
     }
 
   if (CONSP (value))
@@ -4553,7 +4553,7 @@ x_create_tip_frame (struct x_display_info *dpyinfo,
   Lisp_Object frame;
   Lisp_Object name;
   int width, height;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3;
   int face_change_count_before = face_change_count;
   Lisp_Object buffer;
@@ -4948,7 +4948,7 @@ Text larger than the specified size is clipped.  */)
   int i, width, height, seen_reversed_p;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
   int old_windows_or_buffers_changed = windows_or_buffers_changed;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   specbind (Qinhibit_redisplay, Qt);
 
@@ -5058,10 +5058,8 @@ Text larger than the specified size is clipped.  */)
   w->left_col = w->top_line = make_number (0);
 
   if (CONSP (Vx_max_tooltip_size)
-      && INTEGERP (XCAR (Vx_max_tooltip_size))
-      && XINT (XCAR (Vx_max_tooltip_size)) > 0
-      && INTEGERP (XCDR (Vx_max_tooltip_size))
-      && XINT (XCDR (Vx_max_tooltip_size)) > 0)
+      && RANGED_INTEGERP (1, XCAR (Vx_max_tooltip_size), INT_MAX)
+      && RANGED_INTEGERP (1, XCDR (Vx_max_tooltip_size), INT_MAX))
     {
       w->total_cols = XCAR (Vx_max_tooltip_size);
       w->total_lines = XCDR (Vx_max_tooltip_size);
@@ -5207,7 +5205,7 @@ DEFUN ("x-hide-tip", Fx_hide_tip, Sx_hide_tip, 0, 0, 0,
 Value is t if tooltip was open, nil otherwise.  */)
   (void)
 {
-  int count;
+  ptrdiff_t count;
   Lisp_Object deleted, frame, timer;
   struct gcpro gcpro1, gcpro2;
 
@@ -5349,7 +5347,7 @@ Otherwise, if ONLY-DIR-P is non-nil, the user can only select directories.  */)
   Arg al[10];
   int ac = 0;
   XmString dir_xmstring, pattern_xmstring;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5, gcpro6;
 
   check_x ();
@@ -5518,7 +5516,7 @@ Otherwise, if ONLY-DIR-P is non-nil, the user can only select directories.  */)
   char *fn;
   Lisp_Object file = Qnil;
   Lisp_Object decoded_file;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5, gcpro6;
   char *cdef_file;
 
@@ -5581,7 +5579,7 @@ If FRAME is omitted or nil, it defaults to the selected frame. */)
   Lisp_Object font_param;
   char *default_name = NULL;
   struct gcpro gcpro1, gcpro2;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   check_x ();
 
diff --git a/src/xfont.c b/src/xfont.c
index 2c3ca911623..8b1e37aa146 100644
--- a/src/xfont.c
+++ b/src/xfont.c
@@ -248,7 +248,7 @@ xfont_chars_supported (Lisp_Object chars, XFontStruct *xfont,
     }
   else if (VECTORP (chars))
     {
-      int i;
+      ptrdiff_t i;
 
       for (i = ASIZE (chars) - 1; i >= 0; i--)
 	{
diff --git a/src/xmenu.c b/src/xmenu.c
index cf58e85af10..f7497955e93 100644
--- a/src/xmenu.c
+++ b/src/xmenu.c
@@ -315,7 +315,7 @@ for instance using the window manager, then this produces a quit and
     Lisp_Object title;
     const char *error_name;
     Lisp_Object selection;
-    int specpdl_count = SPECPDL_INDEX ();
+    ptrdiff_t specpdl_count = SPECPDL_INDEX ();
 
     /* Decode the dialog items from what was specified.  */
     title = Fcar (contents);
@@ -968,7 +968,7 @@ set_frame_menubar (FRAME_PTR f, int first_time, int deep_p)
 
       struct buffer *prev = current_buffer;
       Lisp_Object buffer;
-      int specpdl_count = SPECPDL_INDEX ();
+      ptrdiff_t specpdl_count = SPECPDL_INDEX ();
       int previous_menu_items_used = f->menu_bar_items_used;
       Lisp_Object *previous_items
 	= (Lisp_Object *) alloca (previous_menu_items_used
@@ -1434,7 +1434,7 @@ create_and_show_popup_menu (FRAME_PTR f, widget_value *first_wv, int x, int y,
   GtkWidget *menu;
   GtkMenuPositionFunc pos_func = 0;  /* Pop up at pointer.  */
   struct next_popup_x_y popup_x_y;
-  int specpdl_count = SPECPDL_INDEX ();
+  ptrdiff_t specpdl_count = SPECPDL_INDEX ();
 
   if (! FRAME_X_P (f))
     abort ();
@@ -1590,7 +1590,7 @@ create_and_show_popup_menu (FRAME_PTR f, widget_value *first_wv,
 
   {
     int fact = 4 * sizeof (LWLIB_ID);
-    int specpdl_count = SPECPDL_INDEX ();
+    ptrdiff_t specpdl_count = SPECPDL_INDEX ();
     record_unwind_protect (pop_down_menu,
                            Fcons (make_number (menu_id >> (fact)),
                                   make_number (menu_id & ~(-1 << (fact)))));
@@ -1909,7 +1909,7 @@ create_and_show_dialog (FRAME_PTR f, widget_value *first_wv)
 
   if (menu)
     {
-      int specpdl_count = SPECPDL_INDEX ();
+      ptrdiff_t specpdl_count = SPECPDL_INDEX ();
       record_unwind_protect (pop_down_menu, make_save_value (menu, 0));
 
       /* Display the menu.  */
@@ -1965,7 +1965,7 @@ create_and_show_dialog (FRAME_PTR f, widget_value *first_wv)
   /* Process events that apply to the dialog box.
      Also handle timers.  */
   {
-    int count = SPECPDL_INDEX ();
+    ptrdiff_t count = SPECPDL_INDEX ();
     int fact = 4 * sizeof (LWLIB_ID);
 
     /* xdialog_show_unwind is responsible for popping the dialog box down.  */
@@ -2262,7 +2262,7 @@ xmenu_show (FRAME_PTR f, int x, int y, int for_click, int keymaps,
   int maxwidth;
   int dummy_int;
   unsigned int dummy_uint;
-  int specpdl_count = SPECPDL_INDEX ();
+  ptrdiff_t specpdl_count = SPECPDL_INDEX ();
 
   if (! FRAME_X_P (f) && ! FRAME_MSDOS_P (f))
     abort ();
diff --git a/src/xml.c b/src/xml.c
index f0422875f7e..0b39f3e6031 100644
--- a/src/xml.c
+++ b/src/xml.c
@@ -89,8 +89,8 @@ parse_region (Lisp_Object start, Lisp_Object end, Lisp_Object base_url, int html
   xmlDoc *doc;
   Lisp_Object result = Qnil;
   const char *burl = "";
-  EMACS_INT bytes;
-  EMACS_INT istart, iend;
+  ptrdiff_t bytes;
+  ptrdiff_t istart, iend;
 
   LIBXML_TEST_VERSION;
 
diff --git a/src/xrdb.c b/src/xrdb.c
index 4237ed11c53..0c916da9ff8 100644
--- a/src/xrdb.c
+++ b/src/xrdb.c
@@ -126,7 +126,7 @@ x_get_customization_string (XrmDatabase db, const char *name,
    Return NULL otherwise.  */
 
 static char *
-magic_file_p (const char *string, EMACS_INT string_len, const char *class,
+magic_file_p (const char *string, ptrdiff_t string_len, const char *class,
 	      const char *escaped_suffix)
 {
   char *lang = getenv ("LANG");
diff --git a/src/xselect.c b/src/xselect.c
index adee1872dba..9eee4ee9593 100644
--- a/src/xselect.c
+++ b/src/xselect.c
@@ -81,13 +81,13 @@ static Lisp_Object clean_local_selection_data (Lisp_Object);
 
 #ifdef TRACE_SELECTION
 #define TRACE0(fmt) \
-  fprintf (stderr, "%d: " fmt "\n", getpid ())
+  fprintf (stderr, "%"pMd": " fmt "\n", (printmax_t) getpid ())
 #define TRACE1(fmt, a0) \
-  fprintf (stderr, "%d: " fmt "\n", getpid (), a0)
+  fprintf (stderr, "%"pMd": " fmt "\n", (printmax_t) getpid (), a0)
 #define TRACE2(fmt, a0, a1) \
-  fprintf (stderr, "%d: " fmt "\n", getpid (), a0, a1)
+  fprintf (stderr, "%"pMd": " fmt "\n", (printmax_t) getpid (), a0, a1)
 #define TRACE3(fmt, a0, a1, a2) \
-  fprintf (stderr, "%d: " fmt "\n", getpid (), a0, a1, a2)
+  fprintf (stderr, "%"pMd": " fmt "\n", (printmax_t) getpid (), a0, a1, a2)
 #else
 #define TRACE0(fmt)		(void) 0
 #define TRACE1(fmt, a0)		(void) 0
@@ -392,7 +392,6 @@ x_get_local_selection (Lisp_Object selection_symbol, Lisp_Object target_type,
 {
   Lisp_Object local_value;
   Lisp_Object handler_fn, value, check;
-  int count;
 
   local_value = LOCAL_SELECTION (selection_symbol, dpyinfo);
 
@@ -409,7 +408,7 @@ x_get_local_selection (Lisp_Object selection_symbol, Lisp_Object target_type,
       /* Don't allow a quit within the converter.
 	 When the user types C-g, he would be surprised
 	 if by luck it came during a converter.  */
-      count = SPECPDL_INDEX ();
+      ptrdiff_t count = SPECPDL_INDEX ();
       specbind (Qinhibit_quit, Qt);
 
       CHECK_SYMBOL (target_type);
@@ -603,7 +602,7 @@ x_reply_selection_request (struct input_event *event,
   Window window = SELECTION_EVENT_REQUESTOR (event);
   ptrdiff_t bytes_remaining;
   int max_bytes = selection_quantum (display);
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   struct selection_data *cs;
 
   reply->type = SelectionNotify;
@@ -792,7 +791,7 @@ x_handle_selection_request (struct input_event *event)
   Atom property = SELECTION_EVENT_PROPERTY (event);
   Lisp_Object local_selection_data;
   int success = 0;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
   GCPRO2 (local_selection_data, target_symbol);
 
   if (!dpyinfo) goto DONE;
@@ -1140,7 +1139,7 @@ static void
 wait_for_property_change (struct prop_location *location)
 {
   int secs, usecs;
-  int count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX ();
 
   if (property_change_reply_object)
     abort ();
@@ -1701,7 +1700,7 @@ selection_data_to_lisp_data (Display *display, const unsigned char *data,
       v = Fmake_vector (make_number (size / 2), make_number (0));
       for (i = 0; i < size / 2; i++)
 	{
-	  EMACS_INT j = ((short *) data) [i];
+	  short j = ((short *) data) [i];
 	  Faset (v, make_number (i), make_number (j));
 	}
       return v;
@@ -2601,13 +2600,12 @@ x_send_client_event (Lisp_Object display, Lisp_Object dest, Lisp_Object from,
   if (x_check_property_data (values) == -1)
     error ("Bad data in VALUES, must be number, cons or string");
 
-  event.xclient.type = ClientMessage;
-  event.xclient.format = XFASTINT (format);
-
-  if (event.xclient.format != 8 && event.xclient.format != 16
-      && event.xclient.format != 32)
+  if (XINT (format) != 8 && XINT (format) != 16 && XINT (format) != 32)
     error ("FORMAT must be one of 8, 16 or 32");
 
+  event.xclient.type = ClientMessage;
+  event.xclient.format = XINT (format);
+
   if (FRAMEP (dest) || NILP (dest))
     {
       struct frame *fdest = check_x_frame (dest);
diff --git a/src/xterm.c b/src/xterm.c
index 4d3b572ade9..f40deca1e88 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -3678,24 +3678,23 @@ x_find_modifier_meanings (struct x_display_info *dpyinfo)
 /* Convert between the modifier bits X uses and the modifier bits
    Emacs uses.  */
 
-EMACS_INT
+int
 x_x_to_emacs_modifiers (struct x_display_info *dpyinfo, int state)
 {
-  EMACS_INT mod_meta = meta_modifier;
-  EMACS_INT mod_alt  = alt_modifier;
-  EMACS_INT mod_hyper = hyper_modifier;
-  EMACS_INT mod_super = super_modifier;
+  int mod_meta = meta_modifier;
+  int mod_alt  = alt_modifier;
+  int mod_hyper = hyper_modifier;
+  int mod_super = super_modifier;
   Lisp_Object tem;
 
   tem = Fget (Vx_alt_keysym, Qmodifier_value);
-  if (INTEGERP (tem)) mod_alt = XINT (tem);
+  if (INTEGERP (tem)) mod_alt = XINT (tem) & INT_MAX;
   tem = Fget (Vx_meta_keysym, Qmodifier_value);
-  if (INTEGERP (tem)) mod_meta = XINT (tem);
+  if (INTEGERP (tem)) mod_meta = XINT (tem) & INT_MAX;
   tem = Fget (Vx_hyper_keysym, Qmodifier_value);
-  if (INTEGERP (tem)) mod_hyper = XINT (tem);
+  if (INTEGERP (tem)) mod_hyper = XINT (tem) & INT_MAX;
   tem = Fget (Vx_super_keysym, Qmodifier_value);
-  if (INTEGERP (tem)) mod_super = XINT (tem);
-
+  if (INTEGERP (tem)) mod_super = XINT (tem) & INT_MAX;
 
   return (  ((state & (ShiftMask | dpyinfo->shift_lock_mask)) ? shift_modifier : 0)
             | ((state & ControlMask)			? ctrl_modifier	: 0)
@@ -3708,10 +3707,10 @@ x_x_to_emacs_modifiers (struct x_display_info *dpyinfo, int state)
 static int
 x_emacs_to_x_modifiers (struct x_display_info *dpyinfo, EMACS_INT state)
 {
-  int mod_meta = meta_modifier;
-  int mod_alt  = alt_modifier;
-  int mod_hyper = hyper_modifier;
-  int mod_super = super_modifier;
+  EMACS_INT mod_meta = meta_modifier;
+  EMACS_INT mod_alt  = alt_modifier;
+  EMACS_INT mod_hyper = hyper_modifier;
+  EMACS_INT mod_super = super_modifier;
 
   Lisp_Object tem;
 
@@ -6456,9 +6455,10 @@ handle_one_xevent (struct x_display_info *dpyinfo, XEvent *eventptr,
 
 	  /* Now non-ASCII.  */
 	  if (HASH_TABLE_P (Vx_keysym_table)
-	      && (NATNUMP (c = Fgethash (make_number (keysym),
- 					 Vx_keysym_table,
- 					 Qnil))))
+	      && (c = Fgethash (make_number (keysym),
+				Vx_keysym_table,
+				Qnil),
+		  NATNUMP (c)))
  	    {
  	      inev.ie.kind = (SINGLE_BYTE_CHAR_P (XFASTINT (c))
                               ? ASCII_KEYSTROKE_EVENT
@@ -7731,7 +7731,7 @@ x_connection_closed (Display *dpy, const char *error_message)
 {
   struct x_display_info *dpyinfo = x_display_info_for_display (dpy);
   Lisp_Object frame, tail;
-  int idx = SPECPDL_INDEX ();
+  ptrdiff_t idx = SPECPDL_INDEX ();
 
   error_msg = (char *) alloca (strlen (error_message) + 1);
   strcpy (error_msg, error_message);
diff --git a/src/xterm.h b/src/xterm.h
index 11d5d50d952..d244aa4be0b 100644
--- a/src/xterm.h
+++ b/src/xterm.h
@@ -775,8 +775,7 @@ enum
 struct scroll_bar
 {
   /* These fields are shared by all vectors.  */
-  EMACS_INT size_from_Lisp_Vector_struct;
-  struct Lisp_Vector *next_from_Lisp_Vector_struct;
+  struct vectorlike_header header;
 
   /* The window we're a scroll bar for.  */
   Lisp_Object window;
@@ -817,12 +816,6 @@ struct scroll_bar
   unsigned int fringe_extended_p : 1;
 };
 
-/* The number of elements a vector holding a struct scroll_bar needs.  */
-#define SCROLL_BAR_VEC_SIZE					\
-  ((sizeof (struct scroll_bar)					\
-    - sizeof (EMACS_INT) - sizeof (struct Lisp_Vector *))	\
-   / sizeof (Lisp_Object))
-
 /* Turning a lisp vector value into a pointer to a struct scroll_bar.  */
 #define XSCROLL_BAR(vec) ((struct scroll_bar *) XVECTOR (vec))
 
@@ -991,7 +984,7 @@ extern void x_mouse_leave (struct x_display_info *);
 #ifdef USE_X_TOOLKIT
 extern int x_dispatch_event (XEvent *, Display *);
 #endif
-extern EMACS_INT x_x_to_emacs_modifiers (struct x_display_info *, int);
+extern int x_x_to_emacs_modifiers (struct x_display_info *, int);
 extern int x_display_pixel_height (struct x_display_info *);
 extern int x_display_pixel_width (struct x_display_info *);