Backport the following upstream patches:

http://git.savannah.gnu.org/cgit/emacs.git/patch/?id=9afea93ed536fb9110ac62b413604cf4c4302199

http://git.savannah.gnu.org/cgit/emacs.git/patch/?id=71ca4f6a43bad06192cbc4bb8c7a2d69c179b7b0

http://git.savannah.gnu.org/cgit/emacs.git/patch/?id=1047496722a58ef5b736dae64d32adeb58c5055c

http://git.savannah.gnu.org/cgit/emacs.git/patch/?id=96ac0c3ebce825e60595794f99e703ec8302e240

http://git.savannah.gnu.org/cgit/emacs.git/patch/?id=43986d16fb6ad78a627250e14570ea70bdb1f23a

Resolves: #1398718

commit 9afea93ed536fb9110ac62b413604cf4c4302199

Author: Eli Zaretskii <eliz@gnu.org>

Date:   Sun Oct 23 16:54:00 2016 +0300

    Attempt to catch reads from a buffer that is relocated

    * src/xml.c (parse_region): Add assertion to ensure buffer text is

    not relocated while libxml2 is reading it.  (Bug#24764)

diff --git a/src/xml.c b/src/xml.c

index b1175d1..1ef84bd 100644

--- a/src/xml.c

+++ b/src/xml.c

@@ -181,6 +181,7 @@ parse_region (Lisp_Object start, Lisp_Object end, Lisp_Object base_url,

   Lisp_Object result = Qnil;

   const char *burl = "";

   ptrdiff_t istart, iend, istart_byte, iend_byte;

+  unsigned char *buftext;

   xmlCheckVersion (LIBXML_VERSION);

@@ -200,18 +201,24 @@ parse_region (Lisp_Object start, Lisp_Object end, Lisp_Object base_url,

       burl = SSDATA (base_url);

     }

+  buftext = BYTE_POS_ADDR (istart_byte);

   if (htmlp)

-    doc = htmlReadMemory ((char *) BYTE_POS_ADDR (istart_byte),

+    doc = htmlReadMemory ((char *)buftext,

 			  iend_byte - istart_byte, burl, "utf-8",

 			  HTML_PARSE_RECOVER|HTML_PARSE_NONET|

 			  HTML_PARSE_NOWARNING|HTML_PARSE_NOERROR|

 			  HTML_PARSE_NOBLANKS);

   else

-    doc = xmlReadMemory ((char *) BYTE_POS_ADDR (istart_byte),

+    doc = xmlReadMemory ((char *)buftext,

 			 iend_byte - istart_byte, burl, "utf-8",

 			 XML_PARSE_NONET|XML_PARSE_NOWARNING|

 			 XML_PARSE_NOBLANKS |XML_PARSE_NOERROR);

+  /* If the assertion below fails, malloc was called inside the above

+     libxml2 functions, and ralloc.c caused relocation of buffer text,

+     so we could have read from unrelated memory.  */

+  eassert (buftext == BYTE_POS_ADDR (istart_byte));

+

   if (doc != NULL)

     {

       Lisp_Object r = Qnil;

commit 71ca4f6a43bad06192cbc4bb8c7a2d69c179b7b0

Author: Eli Zaretskii <eliz@gnu.org>

Date:   Sun Oct 23 19:52:56 2016 +0300

    Avoid relocating buffers while libxml2 reads its text

    * src/xml.c (parse_region) [REL_ALLOC]: Freeze the ralloc arena

    while libxml2 reads the current buffer's text.  (Bug#24764)

diff --git a/src/xml.c b/src/xml.c

index 1ef84bd..612b16c 100644

--- a/src/xml.c

+++ b/src/xml.c

@@ -202,6 +202,11 @@ parse_region (Lisp_Object start, Lisp_Object end, Lisp_Object base_url,

     }

   buftext = BYTE_POS_ADDR (istart_byte);

+#ifdef REL_ALLOC

+  /* Prevent ralloc.c from relocating the current buffer while libxml2

+     functions below read its text.  */

+  r_alloc_inhibit_buffer_relocation (1);

+#endif

   if (htmlp)

     doc = htmlReadMemory ((char *)buftext,

 			  iend_byte - istart_byte, burl, "utf-8",

@@ -214,6 +219,9 @@ parse_region (Lisp_Object start, Lisp_Object end, Lisp_Object base_url,

 			 XML_PARSE_NONET|XML_PARSE_NOWARNING|

 			 XML_PARSE_NOBLANKS |XML_PARSE_NOERROR);

+#ifdef REL_ALLOC

+  r_alloc_inhibit_buffer_relocation (0);

+#endif

   /* If the assertion below fails, malloc was called inside the above

      libxml2 functions, and ralloc.c caused relocation of buffer text,

      so we could have read from unrelated memory.  */

commit 1047496722a58ef5b736dae64d32adeb58c5055c

Author: Eli Zaretskii <eliz@gnu.org>

Date:   Mon Oct 24 16:59:34 2016 +0300

    Another fix for using pointer to buffer text

    * src/search.c (Freplace_match): Move the call to BYTE_POS_ADDR

    after the call to xpalloc, to avoid the danger of buffer text

    relocation after its address was taken.  (Bug#24358)

diff --git a/src/search.c b/src/search.c

index 5c04916..f8acd40 100644

--- a/src/search.c

+++ b/src/search.c

@@ -2640,6 +2640,7 @@ since only regular expressions have distinguished subexpressions.  */)

 	  const unsigned char *add_stuff = NULL;

 	  ptrdiff_t add_len = 0;

 	  ptrdiff_t idx = -1;

+	  ptrdiff_t begbyte;

 	  if (str_multibyte)

 	    {

@@ -2702,11 +2703,10 @@ since only regular expressions have distinguished subexpressions.  */)

 	     set up ADD_STUFF and ADD_LEN to point to it.  */

 	  if (idx >= 0)

 	    {

-	      ptrdiff_t begbyte = CHAR_TO_BYTE (search_regs.start[idx]);

+	      begbyte = CHAR_TO_BYTE (search_regs.start[idx]);

 	      add_len = CHAR_TO_BYTE (search_regs.end[idx]) - begbyte;

 	      if (search_regs.start[idx] < GPT && GPT < search_regs.end[idx])

 		move_gap_both (search_regs.start[idx], begbyte);

-	      add_stuff = BYTE_POS_ADDR (begbyte);

 	    }

 	  /* Now the stuff we want to add to SUBSTED

@@ -2719,6 +2719,11 @@ since only regular expressions have distinguished subexpressions.  */)

 		       add_len - (substed_alloc_size - substed_len),

 		       STRING_BYTES_BOUND, 1);

+	  /* We compute this after the call to xpalloc, because that

+	     could cause buffer text be relocated when ralloc.c is used.  */

+	  if (idx >= 0)

+	    add_stuff = BYTE_POS_ADDR (begbyte);

+

 	  /* Now add to the end of SUBSTED.  */

 	  if (add_stuff)

 	    {

commit 96ac0c3ebce825e60595794f99e703ec8302e240

Author: Eli Zaretskii <eliz@gnu.org>

Date:   Mon Oct 24 21:37:20 2016 +0300

    Yet another fix for using pointers into buffer text

    * src/search.c (boyer_moore): Update pointers to buffer text

    after call to set_search_regs.  (Bug#24358)

diff --git a/src/search.c b/src/search.c

index f8acd40..b50e7f0 100644

--- a/src/search.c

+++ b/src/search.c

@@ -2014,13 +2014,20 @@ boyer_moore (EMACS_INT n, unsigned char *base_pat,

 	      cursor += dirlen - i - direction;	/* fix cursor */

 	      if (i + direction == 0)

 		{

-		  ptrdiff_t position, start, end;

+		  ptrdiff_t position, start, end, cursor_off;

 		  cursor -= direction;

 		  position = pos_byte + cursor - p2 + ((direction > 0)

 						       ? 1 - len_byte : 0);

+		  /* set_search_regs might call malloc, which could

+		     cause ralloc.c relocate buffer text.  We need to

+		     update pointers into buffer text due to that.  */

+		  cursor_off = cursor - p2;

 		  set_search_regs (position, len_byte);

+		  p_limit = BYTE_POS_ADDR (limit);

+		  p2 = BYTE_POS_ADDR (pos_byte);

+		  cursor = p2 + cursor_off;

 		  if (NILP (Vinhibit_changing_match_data))

 		    {

commit 43986d16fb6ad78a627250e14570ea70bdb1f23a

Author: Noam Postavsky <npostavs@gmail.com>

Date:   Mon Oct 24 21:22:07 2016 -0400

    Inhibit buffer relocation during regex searches

    * src/search.c (looking_at_1, fast_looking_at, search_buffer): Prevent

    relocation of buffer contents during calls to re_search_2.  This ensures

    the pointers into buffer text won't be invalidated by

    r_alloc_sbrk (called from malloc with configurations where

    REL_ALLOC=yes).

diff --git a/src/search.c b/src/search.c

index fa5ac44..15504be 100644

--- a/src/search.c

+++ b/src/search.c

@@ -308,12 +308,20 @@ looking_at_1 (Lisp_Object string, bool posix)

   re_match_object = Qnil;

+#ifdef REL_ALLOC

+  /* Prevent ralloc.c from relocating the current buffer while

+     searching it.  */

+  r_alloc_inhibit_buffer_relocation (1);

+#endif

   i = re_match_2 (bufp, (char *) p1, s1, (char *) p2, s2,

 		  PT_BYTE - BEGV_BYTE,

 		  (NILP (Vinhibit_changing_match_data)

 		   ? &search_regs : NULL),

 		  ZV_BYTE - BEGV_BYTE);

   immediate_quit = 0;

+#ifdef REL_ALLOC

+  r_alloc_inhibit_buffer_relocation (0);

+#endif

   if (i == -2)

     matcher_overflow ();

@@ -561,8 +569,16 @@ fast_looking_at (Lisp_Object regexp, ptrdiff_t pos, ptrdiff_t pos_byte,

   buf = compile_pattern (regexp, 0, Qnil, 0, multibyte);

   immediate_quit = 1;

+#ifdef REL_ALLOC

+  /* Prevent ralloc.c from relocating the current buffer while

+     searching it.  */

+  r_alloc_inhibit_buffer_relocation (1);

+#endif

   len = re_match_2 (buf, (char *) p1, s1, (char *) p2, s2,

 		    pos_byte, NULL, limit_byte);

+#ifdef REL_ALLOC

+  r_alloc_inhibit_buffer_relocation (0);

+#endif

   immediate_quit = 0;

   return len;

@@ -1213,6 +1229,12 @@ search_buffer (Lisp_Object string, ptrdiff_t pos, ptrdiff_t pos_byte,

 	}

       re_match_object = Qnil;

+#ifdef REL_ALLOC

+  /* Prevent ralloc.c from relocating the current buffer while

+     searching it.  */

+  r_alloc_inhibit_buffer_relocation (1);

+#endif

+

       while (n < 0)

 	{

 	  ptrdiff_t val;

@@ -1254,6 +1276,9 @@ search_buffer (Lisp_Object string, ptrdiff_t pos, ptrdiff_t pos_byte,

 	  else

 	    {

 	      immediate_quit = 0;

+#ifdef REL_ALLOC

+              r_alloc_inhibit_buffer_relocation (0);

+#endif

 	      return (n);

 	    }

 	  n++;

@@ -1296,11 +1321,17 @@ search_buffer (Lisp_Object string, ptrdiff_t pos, ptrdiff_t pos_byte,

 	  else

 	    {

 	      immediate_quit = 0;

+#ifdef REL_ALLOC

+              r_alloc_inhibit_buffer_relocation (0);

+#endif

 	      return (0 - n);

 	    }

 	  n--;

 	}

       immediate_quit = 0;

+#ifdef REL_ALLOC

+      r_alloc_inhibit_buffer_relocation (0);

+#endif

       return (pos);

     }

   else				/* non-RE case */