* lisp.h (eassume): New macro.

Also, include <verify.h>, for 'assume'.
* alloc.c (bool_vector_payload_bytes, Fmake_bool_vector)
(vroundup, vector_nbytes):
* data.c (bool_vector_spare_mask, bool_vector_binop_driver)
(Fbool_vector_not, Fbool_vector_count_matches)
(Fbool_vector_count_matches_at):
Use eassume, not eassert.
* casetab.c (set_identity, shuffle):
* composite.c (composition_gstring_put_cache):
* dispnew.c (update_frame_1):
* ftfont.c (ftfont_shape_by_flt):
* image.c (gif_load):
* intervals.c (offset_intervals):
* macfont.m (macfont_shape):
Remove calls to 'assume' that are no longer needed, because
--enable-gcc-warnings no longer generates bogus warnings
when these calls are removed.

src/ChangeLog

@@ -1,3 +1,24 @@
+2013-10-11  Paul Eggert  <eggert@cs.ucla.edu>
+
+	* lisp.h (eassume): New macro.
+	Also, include <verify.h>, for 'assume'.
+	* alloc.c (bool_vector_payload_bytes, Fmake_bool_vector)
+	(vroundup, vector_nbytes):
+	* data.c (bool_vector_spare_mask, bool_vector_binop_driver)
+	(Fbool_vector_not, Fbool_vector_count_matches)
+	(Fbool_vector_count_matches_at):
+	Use eassume, not eassert.
+	* casetab.c (set_identity, shuffle):
+	* composite.c (composition_gstring_put_cache):
+	* dispnew.c (update_frame_1):
+	* ftfont.c (ftfont_shape_by_flt):
+	* image.c (gif_load):
+	* intervals.c (offset_intervals):
+	* macfont.m (macfont_shape):
+	Remove calls to 'assume' that are no longer needed, because
+	--enable-gcc-warnings no longer generates bogus warnings
+	when these calls are removed.
+
 2013-10-11  Dmitry Antipov  <dmantipov@yandex.ru>
 
 	* xdisp.c (deep_copy_glyph_row): Remove unused locals.

src/alloc.c

@@ -2027,7 +2027,7 @@ bool_vector_payload_bytes (ptrdiff_t nr_bits,
   ptrdiff_t exact_needed_bytes;
   ptrdiff_t needed_bytes;
 
-  eassert (nr_bits >= 0);
+  eassume (nr_bits >= 0);
 
   exact_needed_bytes = ROUNDUP ((size_t) nr_bits, CHAR_BIT) / CHAR_BIT;
   needed_bytes = ROUNDUP ((size_t) nr_bits, BITS_PER_BITS_WORD) / CHAR_BIT;
@@ -2064,8 +2064,8 @@ LENGTH must be a number.  INIT matters only in whether it is t or nil.  */)
   total_payload_bytes = bool_vector_payload_bytes
     (XFASTINT (length), &exact_payload_bytes);
 
-  eassert (exact_payload_bytes <= total_payload_bytes);
-  eassert (0 <= exact_payload_bytes);
+  eassume (exact_payload_bytes <= total_payload_bytes);
+  eassume (0 <= exact_payload_bytes);
 
   needed_elements = ROUNDUP ((size_t) ((bool_header_size - header_size)
                                        + total_payload_bytes),
@@ -2622,7 +2622,7 @@ verify (VECTOR_BLOCK_SIZE <= (1 << PSEUDOVECTOR_SIZE_BITS));
 /* Round up X to nearest mult-of-ROUNDUP_SIZE --- use at compile time.  */
 #define vroundup_ct(x) ROUNDUP ((size_t) (x), roundup_size)
 /* Round up X to nearest mult-of-ROUNDUP_SIZE --- use at runtime.  */
-#define vroundup(x) (assume ((x) >= 0), vroundup_ct (x))
+#define vroundup(x) (eassume ((x) >= 0), vroundup_ct (x))
 
 /* Rounding helps to maintain alignment constraints if USE_LSB_TAG.  */
 
@@ -2820,7 +2820,7 @@ vector_nbytes (struct Lisp_Vector *v)
           ptrdiff_t payload_bytes =
               bool_vector_payload_bytes (bv->size, NULL);
 
-          eassert (payload_bytes >= 0);
+          eassume (payload_bytes >= 0);
           size = bool_header_size + ROUNDUP (payload_bytes, word_size);
         }
       else

src/casetab.c

@@ -205,7 +205,6 @@ set_identity (Lisp_Object table, Lisp_Object c, Lisp_Object elt)
 	from = to = XINT (c);
 
       to++;
-      assume (to <= MAX_CHAR + 1);
       for (; from < to; from++)
 	CHAR_TABLE_SET (table, from, make_number (from));
     }
@@ -232,7 +231,6 @@ shuffle (Lisp_Object table, Lisp_Object c, Lisp_Object elt)
 	from = to = XINT (c);
 
       to++;
-      assume (to <= MAX_CHAR + 1);
       for (; from < to; from++)
 	{
 	  Lisp_Object tem = Faref (table, elt);

src/composite.c

@@ -674,7 +674,6 @@ composition_gstring_put_cache (Lisp_Object gstring, ptrdiff_t len)
       len = j;
     }
 
-  assume (len <= TYPE_MAXIMUM (ptrdiff_t) - 2);
   copy = Fmake_vector (make_number (len + 2), Qnil);
   LGSTRING_SET_HEADER (copy, Fcopy_sequence (header));
   for (i = 0; i < len; i++)

src/data.c

@@ -2969,7 +2969,7 @@ lowercase l) for small endian machines.  */)
 static bits_word
 bool_vector_spare_mask (ptrdiff_t nr_bits)
 {
-  eassert (nr_bits > 0);
+  eassume (nr_bits > 0);
   return (((bits_word) 1) << (nr_bits % BITS_PER_BITS_WORD)) - 1;
 }
 
@@ -3019,7 +3019,7 @@ bool_vector_binop_driver (Lisp_Object op1,
       nr_bits = min (nr_bits, XBOOL_VECTOR (dest)->size);
     }
 
-  eassert (nr_bits >= 0);
+  eassume (nr_bits >= 0);
   nr_words = ROUNDUP (nr_bits, BITS_PER_BITS_WORD) / BITS_PER_BITS_WORD;
 
   adata = (bits_word *) XBOOL_VECTOR (dest)->data;
@@ -3185,7 +3185,7 @@ Return the destination vector.  */)
   bdata = (bits_word *) XBOOL_VECTOR (b)->data;
   adata = (bits_word *) XBOOL_VECTOR (a)->data;
 
-  eassert (nr_bits >= 0);
+  eassume (nr_bits >= 0);
 
   for (i = 0; i < nr_bits / BITS_PER_BITS_WORD; i++)
     bdata[i] = ~adata[i];
@@ -3220,7 +3220,7 @@ A must be a bool vector.  B is a generalized bool.  */)
   match = NILP (b) ? -1 : 0;
   adata = (bits_word *) XBOOL_VECTOR (a)->data;
 
-  eassert (nr_bits >= 0);
+  eassume (nr_bits >= 0);
 
   for (i = 0; i < nr_bits / BITS_PER_BITS_WORD; ++i)
     count += popcount_bits_word (adata[i] ^ match);
@@ -3262,7 +3262,7 @@ index into the vector.  */)
 
   adata = (bits_word *) XBOOL_VECTOR (a)->data;
 
-  assume (nr_bits >= 0);
+  eassume (nr_bits >= 0);
   nr_words = ROUNDUP (nr_bits, BITS_PER_BITS_WORD) / BITS_PER_BITS_WORD;
 
   pos = XFASTINT (i) / BITS_PER_BITS_WORD;

src/dispnew.c

@@ -4480,7 +4480,6 @@ update_frame_1 (struct frame *f, bool force_p, bool inhibit_id_p)
 	}
     }
 
-  assume (0 <= FRAME_LINES (f));
   pause_p = 0 < i && i < FRAME_LINES (f) - 1;
 
   /* Now just clean up termcap drivers and set cursor, etc.  */

src/ftfont.c

@@ -2425,7 +2425,6 @@ ftfont_shape_by_flt (Lisp_Object lgstring, struct font *font,
     }
 
   len = i;
-  assume (len <= STRING_BYTES_BOUND);
 
   if (with_variation_selector)
     {

src/image.c

@@ -7571,10 +7571,7 @@ gif_load (struct frame *f, struct image *img)
 	       y++, row += interlace_increment[pass])
 	    {
 	      while (subimg_height <= row)
-		{
-		  assume (pass < 3);
-		  row = interlace_start[++pass];
-		}
+		row = interlace_start[++pass];
 
 	      for (x = 0; x < subimg_width; x++)
 		{

src/intervals.c

@@ -1404,10 +1404,7 @@ offset_intervals (struct buffer *buffer, ptrdiff_t start, ptrdiff_t length)
     adjust_intervals_for_insertion (buffer_intervals (buffer),
 				    start, length);
   else
-    {
-      assume (- TYPE_MAXIMUM (ptrdiff_t) <= length);
-      adjust_intervals_for_deletion (buffer, start, -length);
-    }
+    adjust_intervals_for_deletion (buffer, start, -length);
 }
 
 /* Merge interval I with its lexicographic successor. The resulting

src/lisp.h

@@ -31,6 +31,7 @@ along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
 #include <limits.h>
 
 #include <intprops.h>
+#include <verify.h>
 
 INLINE_HEADER_BEGIN
 
@@ -113,28 +114,48 @@ typedef EMACS_UINT uprintmax_t;
 
 /* Extra internal type checking?  */
 
-/* Define an Emacs version of 'assert (COND)'.  COND should be free of
-   side effects; it may be evaluated zero or more times.  */
+/* Define Emacs versions of <assert.h>'s 'assert (COND)' and <verify.h>'s
+   'assume (COND)'.  COND should be free of side effects, as it may or
+   may not be evaluated.
+
+   'eassert (COND)' checks COND at runtime if ENABLE_CHECKING is
+   defined and suppress_checking is false, and does nothing otherwise.
+   Emacs dies if COND is checked and is false.  The suppress_checking
+   variable is initialized to 0 in alloc.c.  Set it to 1 using a
+   debugger to temporarily disable aborting on detected internal
+   inconsistencies or error conditions.
+
+   In some cases, a good compiler may be able to optimize away the
+   eassert macro even if ENABLE_CHECKING is true, e.g., if XSTRING (x)
+   uses eassert to test STRINGP (x), but a particular use of XSTRING
+   is invoked only after testing that STRINGP (x) is true, making the
+   test redundant.
+
+   eassume is like eassert except that it also causes the compiler to
+   assume that COND is true afterwards, regardless of whether runtime
+   checking is enabled.  This can improve performance in some cases,
+   though it can degrade performance in others.  It's often suboptimal
+   for COND to call external functions or access volatile storage.  */
+
 #ifndef ENABLE_CHECKING
 # define eassert(cond) ((void) (0 && (cond))) /* Check that COND compiles.  */
+# define eassume(cond) assume (cond)
 #else /* ENABLE_CHECKING */
 
 extern _Noreturn void die (const char *, const char *, int);
 
-/* The suppress_checking variable is initialized to 0 in alloc.c.  Set
-   it to 1 using a debugger to temporarily disable aborting on
-   detected internal inconsistencies or error conditions.
-
-   In some cases, a good compiler may be able to optimize away the
-   eassert macro altogether, e.g., if XSTRING (x) uses eassert to test
-   STRINGP (x), but a particular use of XSTRING is invoked only after
-   testing that STRINGP (x) is true, making the test redundant.  */
 extern bool suppress_checking EXTERNALLY_VISIBLE;
 
 # define eassert(cond)						\
    (suppress_checking || (cond) 				\
     ? (void) 0							\
     : die (# cond, __FILE__, __LINE__))
+# define eassume(cond)						\
+   (suppress_checking						\
+    ? assume (cond)						\
+    : (cond)							\
+    ? (void) 0							\
+    : die (# cond, __FILE__, __LINE__))
 #endif /* ENABLE_CHECKING */
 
 

src/macfont.m

@@ -2817,7 +2817,6 @@ macfont_shape (Lisp_Object lgstring)
     }
 
   len = i;
-  assume (len <= TYPE_MAXIMUM (EMACS_INT) - 2);
 
   if (INT_MAX / 2 < len)
     memory_full (SIZE_MAX);