From a4beea6f113548516cf1e7c4bd16cd0cb7faff16 Mon Sep 17 00:00:00 2001
From: Gareth Rees <gdr@ravenbrook.com>
Date: Fri, 21 Aug 2015 11:14:27 +0100
Subject: [PATCH 01/12] Prefer avert(type, value) to aver(typecheck(value)).

Copied from Perforce
 Change: 188157
 ServerID: perforce.ravenbrook.com
---
 mps/code/cbs.c  |  6 +++---
 mps/code/land.c | 16 ++++++++--------
 mps/code/seg.c  | 14 +++++++-------
 3 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/mps/code/cbs.c b/mps/code/cbs.c
index d98a92cb8c4..0b30b68acb1 100644
--- a/mps/code/cbs.c
+++ b/mps/code/cbs.c
@@ -1,7 +1,7 @@
 /* cbs.c: COALESCING BLOCK STRUCTURE IMPLEMENTATION
  *
  * $Id$
- * Copyright (c) 2001-2014 Ravenbrook Limited.  See end of file for license.
+ * Copyright (c) 2001-2015 Ravenbrook Limited.  See end of file for license.
  *
  * .intro: This is a portable implementation of coalescing block
  * structures.
@@ -1069,7 +1069,7 @@ static Res cbsFindInZones(Bool *foundReturn, Range rangeReturn,
   AVERT(CBS, cbs);
   AVER(IsLandSubclass(CBSLand(cbs), CBSZonedLandClass));
   /* AVERT(ZoneSet, zoneSet); */
-  AVER(BoolCheck(high));
+  AVERT(Bool, high);
 
   landFind = high ? cbsFindLast : cbsFindFirst;
   splayFind = high ? SplayFindLast : SplayFindFirst;
@@ -1208,7 +1208,7 @@ DEFINE_LAND_CLASS(CBSZonedLandClass, class)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2001-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  * 
diff --git a/mps/code/land.c b/mps/code/land.c
index 7dbc7845b5b..18d446288f8 100644
--- a/mps/code/land.c
+++ b/mps/code/land.c
@@ -1,7 +1,7 @@
 /* land.c: LAND (COLLECTION OF ADDRESS RANGES) IMPLEMENTATION
  *
  * $Id$
- * Copyright (c) 2014 Ravenbrook Limited.  See end of file for license.
+ * Copyright (c) 2014-2015 Ravenbrook Limited.  See end of file for license.
  *
  * .design: <design/land/>
  */
@@ -282,7 +282,7 @@ Bool LandFindFirst(Range rangeReturn, Range oldRangeReturn, Land land, Size size
   AVER(oldRangeReturn != NULL);
   AVERT(Land, land);
   AVER(SizeIsAligned(size, land->alignment));
-  AVER(FindDeleteCheck(findDelete));
+  AVERT(FindDelete, findDelete);
   landEnter(land);
 
   b = (*land->class->findFirst)(rangeReturn, oldRangeReturn, land, size,
@@ -306,7 +306,7 @@ Bool LandFindLast(Range rangeReturn, Range oldRangeReturn, Land land, Size size,
   AVER(oldRangeReturn != NULL);
   AVERT(Land, land);
   AVER(SizeIsAligned(size, land->alignment));
-  AVER(FindDeleteCheck(findDelete));
+  AVERT(FindDelete, findDelete);
   landEnter(land);
 
   b = (*land->class->findLast)(rangeReturn, oldRangeReturn, land, size,
@@ -330,7 +330,7 @@ Bool LandFindLargest(Range rangeReturn, Range oldRangeReturn, Land land, Size si
   AVER(oldRangeReturn != NULL);
   AVERT(Land, land);
   AVER(SizeIsAligned(size, land->alignment));
-  AVER(FindDeleteCheck(findDelete));
+  AVERT(FindDelete, findDelete);
   landEnter(land);
 
   b = (*land->class->findLargest)(rangeReturn, oldRangeReturn, land, size,
@@ -470,7 +470,7 @@ Bool LandClassCheck(LandClass class)
 static Res landTrivInit(Land land, ArgList args)
 {
   AVERT(Land, land);
-  AVER(ArgListCheck(args));
+  AVERT(ArgList, args);
   UNUSED(args);
   return ResOK;
 }
@@ -555,7 +555,7 @@ static Bool landNoFind(Range rangeReturn, Range oldRangeReturn, Land land, Size
   AVER(oldRangeReturn != NULL);
   AVERT(Land, land);
   UNUSED(size);
-  AVER(FindDeleteCheck(findDelete));
+  AVERT(FindDelete, findDelete);
   return ResUNIMPL;
 }
 
@@ -567,7 +567,7 @@ static Res landNoFindInZones(Bool *foundReturn, Range rangeReturn, Range oldRang
   AVERT(Land, land);
   UNUSED(size);
   UNUSED(zoneSet);
-  AVER(BoolCheck(high));
+  AVERT(Bool, high);
   return ResUNIMPL;
 }
 
@@ -606,7 +606,7 @@ DEFINE_CLASS(LandClass, class)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2014-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  *
diff --git a/mps/code/seg.c b/mps/code/seg.c
index ab7414eaf4a..7007bca62b7 100644
--- a/mps/code/seg.c
+++ b/mps/code/seg.c
@@ -1,7 +1,7 @@
 /* seg.c: SEGMENTS
  *
  * $Id$
- * Copyright (c) 2001-2014 Ravenbrook Limited.  See end of file for license.
+ * Copyright (c) 2001-2015 Ravenbrook Limited.  See end of file for license.
  *
  * .design: The design for this module is <design/seg/>.
  *
@@ -529,7 +529,7 @@ Bool SegNextOfRing(Seg *segReturn, Arena arena, Pool pool, Ring next)
   AVER_CRITICAL(segReturn != NULL); /* .seg.critical */
   AVERT_CRITICAL(Arena, arena);
   AVERT_CRITICAL(Pool, pool);
-  AVER_CRITICAL(RingCheck(next));
+  AVERT_CRITICAL(Ring, next);
   
   if (next == PoolSegRing(pool)) {
     if (!PoolNext(&pool, arena, pool) ||
@@ -1224,7 +1224,7 @@ static void gcSegSetGrey(Seg seg, TraceSet grey)
   Arena arena;
  
   AVERT_CRITICAL(Seg, seg);            /* .seg.method.check */
-  AVER_CRITICAL(TraceSetCheck(grey));  /* .seg.method.check */
+  AVERT_CRITICAL(TraceSet, grey);      /* .seg.method.check */
   AVER(seg->rankSet != RankSetEMPTY);
   gcseg = SegGCSeg(seg);
   AVERT_CRITICAL(GCSeg, gcseg);
@@ -1264,7 +1264,7 @@ static void gcSegSetWhite(Seg seg, TraceSet white)
   Addr addr, limit;
 
   AVERT_CRITICAL(Seg, seg);            /* .seg.method.check */
-  AVER_CRITICAL(TraceSetCheck(white)); /* .seg.method.check */
+  AVERT_CRITICAL(TraceSet, white);     /* .seg.method.check */
   gcseg = SegGCSeg(seg);
   AVERT_CRITICAL(GCSeg, gcseg);
   AVER_CRITICAL(&gcseg->segStruct == seg);
@@ -1307,7 +1307,7 @@ static void gcSegSetRankSet(Seg seg, RankSet rankSet)
   Arena arena;
 
   AVERT_CRITICAL(Seg, seg);                /* .seg.method.check */
-  AVER_CRITICAL(RankSetCheck(rankSet));    /* .seg.method.check */
+  AVERT_CRITICAL(RankSet, rankSet);        /* .seg.method.check */
   AVER_CRITICAL(rankSet == RankSetEMPTY
                 || RankSetIsSingle(rankSet)); /* .seg.method.check */
   gcseg = SegGCSeg(seg);
@@ -1378,7 +1378,7 @@ static void gcSegSetRankSummary(Seg seg, RankSet rankSet, RefSet summary)
   Arena arena;
 
   AVERT_CRITICAL(Seg, seg);                    /* .seg.method.check */
-  AVER_CRITICAL(RankSetCheck(rankSet));        /* .seg.method.check */
+  AVERT_CRITICAL(RankSet, rankSet);            /* .seg.method.check */
   AVER_CRITICAL(rankSet == RankSetEMPTY
                 || RankSetIsSingle(rankSet));  /* .seg.method.check */
   gcseg = SegGCSeg(seg);
@@ -1701,7 +1701,7 @@ void SegClassMixInNoSplitMerge(SegClass class)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2001-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  * 

From b7cf9d1ba9c20cfc12d1b879803ce59b4832de21 Mon Sep 17 00:00:00 2001
From: Gareth Rees <gdr@ravenbrook.com>
Date: Fri, 21 Aug 2015 11:20:20 +0100
Subject: [PATCH 02/12] Fix broken link to design/thread-safety

Copied from Perforce
 Change: 188158
 ServerID: perforce.ravenbrook.com
---
 mps/code/mpsi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mps/code/mpsi.c b/mps/code/mpsi.c
index a7dec7495c1..283fbc6123e 100644
--- a/mps/code/mpsi.c
+++ b/mps/code/mpsi.c
@@ -8,7 +8,7 @@
  * <code/mps.h>, and the internal MPM interfaces, as defined by
  * <code/mpm.h>.  .purpose.check: It performs checking of the C client's
  * usage of the MPS Interface.  .purpose.thread: It excludes multiple
- * threads from the MPM by locking the Arena (see .thread-safety).
+ * threads from the MPM by locking the Arena (see <design/thread-safety/>).
  *
  * .design: <design/interface-c/>
  *

From ae6473fba883a9295541fdb3f52e2e47b073e86c Mon Sep 17 00:00:00 2001
From: Gareth Rees <gdr@ravenbrook.com>
Date: Wed, 26 Aug 2015 12:31:03 +0100
Subject: [PATCH 03/12] Keyword argument mps_key_rank is optional when creating
 an allocation point for an snc pool.

Copied from Perforce
 Change: 188178
 ServerID: perforce.ravenbrook.com
---
 mps/manual/source/pool/snc.rst | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/mps/manual/source/pool/snc.rst b/mps/manual/source/pool/snc.rst
index 49a43fe37ab..1138bf5375b 100644
--- a/mps/manual/source/pool/snc.rst
+++ b/mps/manual/source/pool/snc.rst
@@ -39,7 +39,7 @@ SNC properties
 
 * Supports allocation via :term:`allocation points` only. If an
   allocation point is created in an SNC pool, the call to
-  :c:func:`mps_ap_create_k` requires one keyword argument,
+  :c:func:`mps_ap_create_k` accepts one optional keyword argument,
   :c:macro:`MPS_KEY_RANK`.
 
 * Does not support deallocation via :c:func:`mps_free`.
@@ -112,11 +112,11 @@ SNC interface
         } MPS_ARGS_END(args);
 
     When creating an :term:`allocation point` on an SNC pool,
-    :c:func:`mps_ap_create_k` requires one keyword argument:
+    :c:func:`mps_ap_create_k` accepts one optional keyword argument:
 
-    * :c:macro:`MPS_KEY_RANK` (type :c:type:`mps_rank_t`) specifies
-      the :term:`rank` of references in objects allocated on this
-      allocation point. It must be :c:func:`mps_rank_exact`.
+    * :c:macro:`MPS_KEY_RANK` (type :c:type:`mps_rank_t`, default
+    :c:func:`mps_rank_exact`) specifies the :term:`rank` of references
+    in objects allocated on this allocation point.
 
     For example::
 

From 3f3c0e6e694a198526ec8f865970789b4ed59a65 Mon Sep 17 00:00:00 2001
From: Gareth Rees <gdr@ravenbrook.com>
Date: Tue, 1 Sep 2015 13:05:33 +0100
Subject: [PATCH 04/12] Correct rest syntax for bulleted list.

Copied from Perforce
 Change: 188192
 ServerID: perforce.ravenbrook.com
---
 mps/manual/source/pool/snc.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mps/manual/source/pool/snc.rst b/mps/manual/source/pool/snc.rst
index 1138bf5375b..d39a392c614 100644
--- a/mps/manual/source/pool/snc.rst
+++ b/mps/manual/source/pool/snc.rst
@@ -115,8 +115,8 @@ SNC interface
     :c:func:`mps_ap_create_k` accepts one optional keyword argument:
 
     * :c:macro:`MPS_KEY_RANK` (type :c:type:`mps_rank_t`, default
-    :c:func:`mps_rank_exact`) specifies the :term:`rank` of references
-    in objects allocated on this allocation point.
+      :c:func:`mps_rank_exact`) specifies the :term:`rank` of references
+      in objects allocated on this allocation point.
 
     For example::
 

From 3772a04825f800858a15fc3b4e5fc0ff78fe600a Mon Sep 17 00:00:00 2001
From: Gareth Rees <gdr@ravenbrook.com>
Date: Tue, 1 Sep 2015 13:06:05 +0100
Subject: [PATCH 05/12] Add note about choice of base/client pointer
 representation.

Copied from Perforce
 Change: 188193
 ServerID: perforce.ravenbrook.com
---
 mps/manual/source/topic/format.rst | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/mps/manual/source/topic/format.rst b/mps/manual/source/topic/format.rst
index 2fe2b4a4e30..7db5c8a1178 100644
--- a/mps/manual/source/topic/format.rst
+++ b/mps/manual/source/topic/format.rst
@@ -179,6 +179,20 @@ There are some cautions to be observed when using in-band headers:
 #. Not all :term:`pool classes` support objects with in-band headers.
    See the documentation for the pool class.
 
+.. note::
+
+    A :term:`client program` that allocates objects with
+    :term:`in-band headers` has to make a choice about how to
+    represent references to those objects. It can represent them using
+    :term:`base pointers` (which is convenient for allocation, since
+    :c:func:`mps_reserve` returns a base pointer, but requires
+    decoding when scanning) or using :term:`client pointers` (which is
+    convenient for scanning, since the :term:`scan method` takes a
+    client pointer, but requires encoding on allocation). Either
+    approach will work, but :term:`client pointers` are normally the
+    better choice, since scanning is normally more
+    performance-critical than allocation.
+   
 
 .. index::
    pair: object format; cautions

From 79e038ea60eedf83b46e50ecf6da64a85eb3642a Mon Sep 17 00:00:00 2001
From: Gareth Rees <gdr@ravenbrook.com>
Date: Tue, 1 Sep 2015 14:00:44 +0100
Subject: [PATCH 06/12] Design.mps.bootstrap

Copied from Perforce
 Change: 188195
 ServerID: perforce.ravenbrook.com
---
 mps/design/bootstrap.txt           | 127 +++++++++++++++++++++++++++++
 mps/design/index.txt               |   2 +
 mps/manual/source/design/index.rst |   1 +
 3 files changed, 130 insertions(+)
 create mode 100644 mps/design/bootstrap.txt

diff --git a/mps/design/bootstrap.txt b/mps/design/bootstrap.txt
new file mode 100644
index 00000000000..7eb79df1475
--- /dev/null
+++ b/mps/design/bootstrap.txt
@@ -0,0 +1,127 @@
+.. mode: -*- rst -*-
+
+Bootstrapping
+=============
+
+:Tag: design.mps.bootstrap
+:Author: Gareth Rees
+:Date: 2015-09-01
+:Status: incomplete design
+:Revision: $Id$
+:Copyright: See section `Copyright and License`_.
+:Index terms: pair: bootsrap; design
+
+
+Introduction
+------------
+
+_`.intro`: This explains how the MPS gets started.
+
+_`.readership`: Any MPS developer.
+
+_`.overview`: The job of the MPS is to allocate memory to a program.
+Before it can allocate memory, the MPS needs to create data structures
+to represent its internal state. But before it can create those data
+structures, it needs to allocate memory to store them in. This
+bootstrapping problem affects the MPS at several points, which are
+listed here, together with their solutions.
+
+
+Bootstrapping problems
+----------------------
+
+Virtual memory descriptor
+.........................
+
+_`.vm`: Before address space can be mapped into main memory, the
+virtual memory descriptor must be initialized. But before the virtual
+memory descriptor can be initialized, some address space must be
+mapped into main memory in order to store it. See
+`design.vm.req.bootstrap`_.
+
+_`.vm.sol`: The virtual memory descriptor is allocated initially on
+the stack, and then copied into its place in the chunk after the
+memory for it has been mapped. See `design.vm.sol.bootstrap`_.
+
+.. _design.vm.req.bootstrap: vm#req.bootstrap
+.. _design.vm.sol.bootstrap: vm#sol.bootstrap
+
+
+Arena descriptor
+................
+
+_`.arena`: Before chunks of address space can be reserved and mapped,
+the virtual memory arena descriptor must be initialized (so that the
+chunks can be added to the arena's chunk tree). But before a virtual
+memory arena descriptor can be initialized, address space must be
+reserved and mapped in order to store it.
+
+_`.arena.sol`: A small amount of address space is reserved and mapped
+directly via ``VMInit()`` and ``VMMap()`` (not via the chunk system)
+in order to provide enough memory for the arena descriptor.
+
+
+Arena's free land
+.................
+
+_`.land`: Before the arena can allocate memory, a range of addresses
+must be inserted into the arena's free land (so that the free land can
+hand out memory from this range). But before addresses can be inserted
+into the arena's free land, the arena must be able to allocate memory
+(to store the nodes in the tree representing those addresses).
+
+_`.land.sol`: The arena has two "back door" mechanisms and uses them
+in combination. First, there is a mechanism for allocating a block of
+memory directly from a chunk, bypassing the free land; second, the MFS
+pool class has a mechanism for extending it with a block of memory.
+
+
+Document History
+----------------
+
+- 2015-09-01 GDR_ Initial draft.
+
+.. _GDR: http://www.ravenbrook.com/consultants/gdr/
+
+
+Copyright and License
+---------------------
+
+Copyright © 2015 Ravenbrook Limited. All rights reserved.
+<http://www.ravenbrook.com/>. This is an open source license. Contact
+Ravenbrook for commercial licensing options.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+#. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+
+#. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+#. Redistributions in any form must be accompanied by information on how
+   to obtain complete source code for this software and any
+   accompanying software that uses this software.  The source code must
+   either be included in the distribution or be available for no more than
+   the cost of distribution plus a nominal fee, and must be freely
+   redistributable under reasonable conditions.  For an executable file,
+   complete source code means the source code for all modules it contains.
+   It does not include source code for modules or files that typically
+   accompany the major components of the operating system on which the
+   executable file runs.
+
+**This software is provided by the copyright holders and contributors
+"as is" and any express or implied warranties, including, but not
+limited to, the implied warranties of merchantability, fitness for a
+particular purpose, or non-infringement, are disclaimed.  In no event
+shall the copyright holders and contributors be liable for any direct,
+indirect, incidental, special, exemplary, or consequential damages
+(including, but not limited to, procurement of substitute goods or
+services; loss of use, data, or profits; or business interruption)
+however caused and on any theory of liability, whether in contract,
+strict liability, or tort (including negligence or otherwise) arising in
+any way out of the use of this software, even if advised of the
+possibility of such damage.**
diff --git a/mps/design/index.txt b/mps/design/index.txt
index 9f4abf7b4f4..7e48b625319 100644
--- a/mps/design/index.txt
+++ b/mps/design/index.txt
@@ -44,6 +44,7 @@ alloc-frame_            Allocation frame protocol
 an_                     Generic modules
 arena_                  Arena
 arenavm_                Virtual memory arena
+bootstrap_              Bootstrapping
 bt_                     Bit tables
 buffer_                 Allocation buffers and allocation points
 cbs_                    Coalescing block structures
@@ -122,6 +123,7 @@ writef_                 The WriteF function
 .. _an: an
 .. _arena: arena
 .. _arenavm: arenavm
+.. _bootstrap: bootstrap
 .. _bt: bt
 .. _buffer: buffer
 .. _cbs: cbs
diff --git a/mps/manual/source/design/index.rst b/mps/manual/source/design/index.rst
index 907c9986bb1..b8da67a4333 100644
--- a/mps/manual/source/design/index.rst
+++ b/mps/manual/source/design/index.rst
@@ -8,6 +8,7 @@ Design
 
     abq
     an
+    bootstrap
     cbs
     config
     critical-path

From 176f119346bf1ea1698b992118c5b9425d35479b Mon Sep 17 00:00:00 2001
From: Gareth Rees <gdr@ravenbrook.com>
Date: Fri, 4 Sep 2015 16:51:33 +0100
Subject: [PATCH 07/12] Correct the manual about the assertion you get when
 destroying a pool without destroying all the allocation points first.

Copied from Perforce
 Change: 188243
 ServerID: perforce.ravenbrook.com
---
 mps/manual/source/topic/error.rst | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/mps/manual/source/topic/error.rst b/mps/manual/source/topic/error.rst
index e13e79a9735..784533d66fa 100644
--- a/mps/manual/source/topic/error.rst
+++ b/mps/manual/source/topic/error.rst
@@ -304,8 +304,15 @@ this documentation.
     The client program destroyed an MPS data structure without having
     destroyed all the data structures that it owns first. For example,
     it destroyed an arena without first destroying all pools in that
-    arena, or it destroyed a pool without first destroying all
-    allocation points created on that pool.
+    arena, or it destroyed a thread without first destroying all
+    roots using that thread.
+
+
+``seg.c: gcseg->buffer == NULL``
+
+    The client program destroyed pool without first destroying all the
+    allocation points created on that pool. The allocation points must
+    be destroyed first.
 
 
 ``trace.c: ss->rank < RankEXACT``

From 144990c99d5cb9c4cdcb23b3868811001cf2db11 Mon Sep 17 00:00:00 2001
From: Gareth Rees <gdr@ravenbrook.com>
Date: Fri, 4 Sep 2015 20:15:36 +0100
Subject: [PATCH 08/12] Add accesssetcheck and check accessset arguments.

Copied from Perforce
 Change: 188251
 ServerID: perforce.ravenbrook.com
---
 mps/code/mpm.c     | 14 ++++++++++++--
 mps/code/mpm.h     |  5 +++--
 mps/code/pool.c    |  6 +++---
 mps/code/poolabs.c | 10 +++++-----
 mps/code/poolawl.c |  5 +++--
 mps/code/protan.c  |  7 +++----
 mps/code/protix.c  |  5 +++--
 mps/code/protw3.c  |  5 +++--
 mps/code/root.c    |  4 ++--
 mps/code/shield.c  |  7 +++++--
 mps/code/trace.c   |  5 +++--
 11 files changed, 45 insertions(+), 28 deletions(-)

diff --git a/mps/code/mpm.c b/mps/code/mpm.c
index d3c32a66daf..aba1ac2f5cb 100644
--- a/mps/code/mpm.c
+++ b/mps/code/mpm.c
@@ -1,7 +1,7 @@
 /* mpm.c: GENERAL MPM SUPPORT
  *
  * $Id$
- * Copyright (c) 2001-2014 Ravenbrook Limited.  See end of file for license.
+ * Copyright (c) 2001-2015 Ravenbrook Limited.  See end of file for license.
  *
  * .purpose: Miscellaneous support for the implementation of the MPM
  * and pool classes.
@@ -137,6 +137,16 @@ Bool AlignCheck(Align align)
 }
 
 
+/* AccessSetCheck -- check that an access set is valid */
+
+Bool AccessSetCheck(AccessSet mode)
+{
+  CHECKL(mode < ((ULongest)1 << AccessLIMIT));
+  UNUSED(mode); /* see .check.unused */
+  return TRUE;
+}
+
+
 #endif /* defined(AVER_AND_CHECK) */
 
 
@@ -638,7 +648,7 @@ Bool StringEqual(const char *s1, const char *s2)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2001-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  * 
diff --git a/mps/code/mpm.h b/mps/code/mpm.h
index a5ac16b41a2..b8cb8c250ee 100644
--- a/mps/code/mpm.h
+++ b/mps/code/mpm.h
@@ -1,7 +1,7 @@
 /* mpm.h: MEMORY POOL MANAGER DEFINITIONS
  *
  * $Id$
- * Copyright (c) 2001-2014 Ravenbrook Limited.  See end of file for license.
+ * Copyright (c) 2001-2015 Ravenbrook Limited.  See end of file for license.
  * Portions copyright (C) 2002 Global Graphics Software.
  *
  * .trans.bufferinit: The Buffer data structure has an Init field and
@@ -46,6 +46,7 @@ extern Bool FunCheck(Fun f);
 extern Bool ShiftCheck(Shift shift);
 extern Bool AttrCheck(Attr attr);
 extern Bool RootVarCheck(RootVar rootVar);
+extern Bool AccessSetCheck(AccessSet mode);
 
 
 /* Address/Size Interface -- see <code/mpm.c> */
@@ -1052,7 +1053,7 @@ extern LandClass LandClassGet(void);
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2001-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  * 
diff --git a/mps/code/pool.c b/mps/code/pool.c
index 945a846edcb..f939bca84e9 100644
--- a/mps/code/pool.c
+++ b/mps/code/pool.c
@@ -1,7 +1,7 @@
 /* pool.c: POOL IMPLEMENTATION
  *
  * $Id$
- * Copyright (c) 2001-2014 Ravenbrook Limited.  See end of file for license.
+ * Copyright (c) 2001-2015 Ravenbrook Limited.  See end of file for license.
  * Portions copyright (C) 2001 Global Graphics Software.
  *
  * DESIGN
@@ -328,7 +328,7 @@ Res PoolAccess(Pool pool, Seg seg, Addr addr,
   AVERT(Seg, seg);
   AVER(SegBase(seg) <= addr);
   AVER(addr < SegLimit(seg));
-  /* Can't check mode as there is no check method */
+  AVERT(AccessSet, mode);
   /* Can't check MutatorFaultContext as there is no check method */
 
   return (*pool->class->access)(pool, seg, addr, mode, context);
@@ -694,7 +694,7 @@ Bool PoolHasRange(Pool pool, Addr base, Addr limit)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2001-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  * 
diff --git a/mps/code/poolabs.c b/mps/code/poolabs.c
index 712f24152e5..30f5d0f999e 100644
--- a/mps/code/poolabs.c
+++ b/mps/code/poolabs.c
@@ -1,7 +1,7 @@
 /* poolabs.c: ABSTRACT POOL CLASSES
  *
  * $Id$
- * Copyright (c) 2001-2014 Ravenbrook Limited.  See end of file for license.
+ * Copyright (c) 2001-2015 Ravenbrook Limited.  See end of file for license.
  * Portions copyright (C) 2002 Global Graphics Software.
  *
  * PURPOSE
@@ -334,7 +334,7 @@ Res PoolNoAccess(Pool pool, Seg seg, Addr addr,
   AVERT(Seg, seg);
   AVER(SegBase(seg) <= addr);
   AVER(addr < SegLimit(seg));
-  /* can't check AccessSet as there is no Check method */
+  AVERT(AccessSet, mode);
   /* can't check context as there is no Check method */
   UNUSED(mode);
   UNUSED(context);
@@ -360,7 +360,7 @@ Res PoolSegAccess(Pool pool, Seg seg, Addr addr,
   AVER(SegBase(seg) <= addr);
   AVER(addr < SegLimit(seg));
   AVER(SegPool(seg) == pool);
-  /* can't check AccessSet as there is no Check method */
+  AVERT(AccessSet, mode);
   /* can't check context as there is no Check method */
 
   UNUSED(addr);
@@ -396,7 +396,7 @@ Res PoolSingleAccess(Pool pool, Seg seg, Addr addr,
   AVER(SegBase(seg) <= addr);
   AVER(addr < SegLimit(seg));
   AVER(SegPool(seg) == pool);
-  /* can't check AccessSet as there is no Check method */
+  AVERT(AccessSet, mode);
   /* can't check context as there is no Check method */
 
   arena = PoolArena(pool);
@@ -691,7 +691,7 @@ Size PoolNoSize(Pool pool)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2001-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  * 
diff --git a/mps/code/poolawl.c b/mps/code/poolawl.c
index 01ca12ea46f..5bb0e6b9025 100644
--- a/mps/code/poolawl.c
+++ b/mps/code/poolawl.c
@@ -1,7 +1,7 @@
 /* poolawl.c: AUTOMATIC WEAK LINKED POOL CLASS
  *
  * $Id$
- * Copyright (c) 2001-2014 Ravenbrook Limited.  See end of file for license.
+ * Copyright (c) 2001-2015 Ravenbrook Limited.  See end of file for license.
  *
  *
  * DESIGN
@@ -1206,6 +1206,7 @@ static Res AWLAccess(Pool pool, Seg seg, Addr addr,
   AVER(SegBase(seg) <= addr);
   AVER(addr < SegLimit(seg));
   AVER(SegPool(seg) == pool);
+  AVERT(AccessSet, mode);
   
   /* Attempt scanning a single reference if permitted */
   if(AWLCanTrySingleAccess(PoolArena(pool), awl, seg, addr)) {
@@ -1375,7 +1376,7 @@ static Bool AWLCheck(AWL awl)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2001-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  * 
diff --git a/mps/code/protan.c b/mps/code/protan.c
index 1959e42395b..0e4771f18da 100644
--- a/mps/code/protan.c
+++ b/mps/code/protan.c
@@ -1,7 +1,7 @@
 /* protan.c: ANSI MEMORY PROTECTION
  *
  * $Id$
- * Copyright (c) 2001-2014 Ravenbrook Limited.  See end of file for license.
+ * Copyright (c) 2001-2015 Ravenbrook Limited.  See end of file for license.
  *
  *
  * DESIGN
@@ -36,8 +36,7 @@ Size ProtGranularity(void)
 void ProtSet(Addr base, Addr limit, AccessSet pm)
 {
   AVER(base < limit);
-  /* .improve.protset.check: There is nor AccessSetCheck, so we */
-  /* don't check it. */
+  AVERT(AccessSet, pm);
   UNUSED(pm);
   NOOP;
 }
@@ -74,7 +73,7 @@ void ProtSync(Arena arena)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2001-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  * 
diff --git a/mps/code/protix.c b/mps/code/protix.c
index ea674ae53d5..a243b009491 100644
--- a/mps/code/protix.c
+++ b/mps/code/protix.c
@@ -1,7 +1,7 @@
 /* protix.c: PROTECTION FOR UNIX
  *
  *  $Id$
- *  Copyright (c) 2001-2014 Ravenbrook Limited.  See end of file for license.
+ *  Copyright (c) 2001-2015 Ravenbrook Limited.  See end of file for license.
  *
  *  Somewhat generic across different Unix systems.  Shared between
  *  OS X, FreeBSD, and Linux.
@@ -66,6 +66,7 @@ void ProtSet(Addr base, Addr limit, AccessSet mode)
   AVER(base < limit);
   AVER(base != 0);
   AVER(AddrOffset(base, limit) <= INT_MAX);     /* should be redundant */
+  AVERT(AccessSet, mode);
 
   /* Convert between MPS AccessSet and UNIX PROT thingies.
      In this function, AccessREAD means protect against read accesses
@@ -122,7 +123,7 @@ Size ProtGranularity(void)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2001-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  * 
diff --git a/mps/code/protw3.c b/mps/code/protw3.c
index 30c3edc0975..a8dddd74fe2 100644
--- a/mps/code/protw3.c
+++ b/mps/code/protw3.c
@@ -1,7 +1,7 @@
 /* protw3.c: PROTECTION FOR WIN32
  *
  *  $Id$
- *  Copyright (c) 2001-2014 Ravenbrook Limited.  See end of file for license.
+ *  Copyright (c) 2001-2015 Ravenbrook Limited.  See end of file for license.
  */
 
 #include "mpm.h"
@@ -26,6 +26,7 @@ void ProtSet(Addr base, Addr limit, AccessSet mode)
 
   AVER(base < limit);
   AVER(base != 0);
+  AVERT(AccessSet, mode);
 
   newProtect = PAGE_EXECUTE_READWRITE;
   if((mode & AccessWRITE) != 0)
@@ -140,7 +141,7 @@ void ProtSync(Arena arena)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2001-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  * 
diff --git a/mps/code/root.c b/mps/code/root.c
index 02f48b38e44..7a3e1205be2 100644
--- a/mps/code/root.c
+++ b/mps/code/root.c
@@ -139,7 +139,7 @@ Bool RootCheck(Root root)
     CHECKL(root->protBase != (Addr)0);
     CHECKL(root->protLimit != (Addr)0);
     CHECKL(root->protBase < root->protLimit);
-    /* there is no AccessSetCheck */
+    CHECKL(AccessSetCheck(root->pm));
   } else {
     CHECKL(root->protBase == (Addr)0);
     CHECKL(root->protLimit == (Addr)0);
@@ -558,7 +558,7 @@ Bool RootOfAddr(Root *rootReturn, Arena arena, Addr addr)
 void RootAccess(Root root, AccessSet mode)
 {
   AVERT(Root, root);
-  /* Can't AVERT mode. */
+  AVERT(AccessSet, mode);
   AVER((root->pm & mode) != AccessSetEMPTY);
   AVER(mode == AccessWRITE); /* only write protection supported */
 
diff --git a/mps/code/shield.c b/mps/code/shield.c
index 55625664ca7..8b73f8f488c 100644
--- a/mps/code/shield.c
+++ b/mps/code/shield.c
@@ -1,7 +1,7 @@
 /* shield.c: SHIELD IMPLEMENTATION
  *
  * $Id$
- * Copyright (c) 2001-2014 Ravenbrook Limited.  See end of file for license.
+ * Copyright (c) 2001-2015 Ravenbrook Limited.  See end of file for license.
  *
  * See: idea.shield, design.mps.shield.
  *
@@ -105,6 +105,7 @@ static void protLower(Arena arena, Seg seg, AccessSet mode)
   AVERT_CRITICAL(Arena, arena);
   UNUSED(arena);
   AVERT_CRITICAL(Seg, seg);
+  AVERT_CRITICAL(AccessSet, mode);
 
   if (SegPM(seg) & mode) {
     SegSetPM(seg, SegPM(seg) & ~mode);
@@ -191,6 +192,7 @@ void (ShieldRaise) (Arena arena, Seg seg, AccessSet mode)
   /* can't check seg. Nor can we check arena as that checks the */
   /* segs in the cache. */
 
+  AVERT(AccessSet, mode);
   AVER((SegSM(seg) & mode) == AccessSetEMPTY);
   SegSetSM(seg, SegSM(seg) | mode); /* inv.prot.shield preserved */
 
@@ -204,6 +206,7 @@ void (ShieldRaise) (Arena arena, Seg seg, AccessSet mode)
 void (ShieldLower)(Arena arena, Seg seg, AccessSet mode)
 {
   /* Don't check seg or arena, see .seg.broken */
+  AVERT(AccessSet, mode);
   AVER((SegSM(seg) & mode) == mode);
   /* synced(seg) is not changed by the following
    * preserving inv.unsynced.suspended
@@ -336,7 +339,7 @@ void (ShieldCover)(Arena arena, Seg seg)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited <http://www.ravenbrook.com/>.
+ * Copyright (C) 2001-2015 Ravenbrook Limited <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.
  * 
diff --git a/mps/code/trace.c b/mps/code/trace.c
index 7aeb70305c7..7e918513279 100644
--- a/mps/code/trace.c
+++ b/mps/code/trace.c
@@ -1,7 +1,7 @@
 /* trace.c: GENERIC TRACER IMPLEMENTATION
  *
  * $Id$
- * Copyright (c) 2001-2014 Ravenbrook Limited.
+ * Copyright (c) 2001-2015 Ravenbrook Limited.
  * See end of file for license.
  * Portions copyright (C) 2002 Global Graphics Software.
  *
@@ -1188,6 +1188,7 @@ void TraceSegAccess(Arena arena, Seg seg, AccessSet mode)
 
   AVERT(Arena, arena);
   AVERT(Seg, seg);
+  AVERT(AccessSet, mode);
 
   /* If it's a read access, then the segment must be grey for a trace */
   /* which is flipped. */
@@ -1962,7 +1963,7 @@ Res TraceDescribe(Trace trace, mps_lib_FILE *stream, Count depth)
 
 /* C. COPYRIGHT AND LICENSE
  *
- * Copyright (C) 2001-2014 Ravenbrook Limited
+ * Copyright (C) 2001-2015 Ravenbrook Limited
  * <http://www.ravenbrook.com/>.
  * All rights reserved.  This is an open source license.  Contact
  * Ravenbrook for commercial licensing options.

From 4e27e572af70c765adf1960743e437127330cafc Mon Sep 17 00:00:00 2001
From: Gareth Rees <gdr@ravenbrook.com>
Date: Sat, 12 Sep 2015 20:59:10 +0100
Subject: [PATCH 09/12] Add more assertions.

Copied from Perforce
 Change: 188304
 ServerID: perforce.ravenbrook.com
---
 mps/manual/source/topic/error.rst | 46 +++++++++++++++++++++++++++----
 1 file changed, 40 insertions(+), 6 deletions(-)

diff --git a/mps/manual/source/topic/error.rst b/mps/manual/source/topic/error.rst
index 784533d66fa..1120b868897 100644
--- a/mps/manual/source/topic/error.rst
+++ b/mps/manual/source/topic/error.rst
@@ -265,6 +265,41 @@ this documentation.
     :c:type:`mps_fmt_t` for this argument.
 
 
+``global.c: RingIsSingle(&arena->chainRing)``
+
+    The client program called :c:func:`mps_arena_destroy` without
+    destroying all the :term:`generation chains` belonging to the
+    arena. It is necessary to call :c:func:`mps_chain_destroy` first.
+
+
+``global.c: RingIsSingle(&arena->formatRing)``
+
+    The client program called :c:func:`mps_arena_destroy` without
+    destroying all the :term:`object formats` belonging to the arena.
+    It is necessary to call :c:func:`mps_fmt_destroy` first.
+
+
+``global.c: RingIsSingle(&arena->rootRing)``
+
+    The client program called :c:func:`mps_arena_destroy` without
+    destroying all the :term:`roots` belonging to the arena.
+    It is necessary to call :c:func:`mps_root_destroy` first.
+
+
+``global.c: RingIsSingle(&arena->threadRing)``
+
+    The client program called :c:func:`mps_arena_destroy` without
+    deregistering all the :term:`threads` belonging to the arena.
+    It is necessary to call :c:func:`mps_thread_dereg` first.
+
+
+``global.c: RingLength(&arenaGlobals->poolRing) == 5``
+
+    The client program called :c:func:`mps_arena_destroy` without
+    destroying all the :term:`pools` belonging to the arena.
+    It is necessary to call :c:func:`mps_pool_destroy` first.
+
+
 ``lockix.c: res == 0``
 
 ``lockw3.c: lock->claims == 0``
@@ -299,13 +334,12 @@ this documentation.
     condition?
 
 
-``ring.c: ring->next == ring``
+``poolsnc.c: foundSeg``
 
-    The client program destroyed an MPS data structure without having
-    destroyed all the data structures that it owns first. For example,
-    it destroyed an arena without first destroying all pools in that
-    arena, or it destroyed a thread without first destroying all
-    roots using that thread.
+    The client program passed an incorrect ``frame`` argument to
+    :c:func:`mps_ap_frame_pop`. This argument must be the result from
+    a previous call to :c:func:`mps_ap_frame_push` on the same
+    allocation point.
 
 
 ``seg.c: gcseg->buffer == NULL``

From b3d356517e6f8adc9150d083fdc6738801b795e1 Mon Sep 17 00:00:00 2001
From: Nick Barnes <nb@ravenbrook.com>
Date: Tue, 13 Oct 2015 15:19:12 +0100
Subject: [PATCH 10/12] Improve documentation of mps_fix_call(): the called
 function must use mps_scan_begin and mps_scan_end itself.

Copied from Perforce
 Change: 188410
 ServerID: perforce.ravenbrook.com
---
 mps/manual/source/topic/scanning.rst | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/mps/manual/source/topic/scanning.rst b/mps/manual/source/topic/scanning.rst
index c9f71e3b503..6b4c4a1d396 100644
--- a/mps/manual/source/topic/scanning.rst
+++ b/mps/manual/source/topic/scanning.rst
@@ -361,9 +361,9 @@ Scanning interface
 
 .. c:function:: MPS_FIX_CALL(ss, call)
 
-    Call a function from within a :term:`scan method`, between
-    :c:func:`MPS_SCAN_BEGIN` and :c:func:`MPS_SCAN_END`, passing
-    the :term:`scan state` correctly.
+    Call a function to do some scanning, from within a :term:`scan
+    method`, between :c:func:`MPS_SCAN_BEGIN` and
+    :c:func:`MPS_SCAN_END`, passing the :term:`scan state` correctly.
 
     ``ss`` is the scan state that was passed to the scan method.
 
@@ -377,6 +377,9 @@ Scanning interface
     must wrap the call with :c:func:`MPS_FIX_CALL` to ensure that the
     scan state is passed correctly.
 
+    The function being called must use :c:func:`MPS_SCAN_BEGIN` and
+    :c:func:`MPS_SCAN_END` appropriately.
+
     In example below, the scan method ``obj_scan`` fixes the object's
     ``left`` and ``right`` references, but delegates the scanning of
     references inside the object's ``data`` member to the function
@@ -406,9 +409,11 @@ Scanning interface
 
     .. warning::
 
-         Use of :c:func:`MPS_FIX_CALL` is best avoided, as it forces
-         values out of registers. The gains in simplicity of the code
-         need to be measured against the loss in performance.
+         Use of :c:func:`MPS_FIX_CALL` is best avoided, as it may
+         force values out of registers (depending on compiler
+         optimisations such as inlining). The gains in simplicity of
+         the code ought to be measured against the loss in
+         performance.
 
 
 .. index::

From 4d94b99a523dbdf157583d2574475a8076d0cbef Mon Sep 17 00:00:00 2001
From: Richard Brooksby <rb@ravenbrook.com>
Date: Mon, 21 Dec 2015 11:06:06 +0000
Subject: [PATCH 11/12] Making lack of section numbers consistent.

Improving attributions.

Copied from Perforce
 Change: 188846
 ServerID: perforce.ravenbrook.com
---
 mps/design/guide.hex.trans.txt | 40 +++++++++++++++++++++++++++++-----
 1 file changed, 34 insertions(+), 6 deletions(-)

diff --git a/mps/design/guide.hex.trans.txt b/mps/design/guide.hex.trans.txt
index 95c533f6bc8..8120f6e53e5 100644
--- a/mps/design/guide.hex.trans.txt
+++ b/mps/design/guide.hex.trans.txt
@@ -22,10 +22,11 @@ hexadecimal digits.
 _`.readership`: This document is intended for anyone devising
 arbitrary constants which may appear in hex-dumps.
 
-_`.sources`: This transliteration was supplied by RHSK in
-`mail.richardk.1997-04-07.13-44`_.
-
-.. _mail.richardk.1997-04-07.13-44: https://info.ravenbrook.com/project/mps/mail/1997/04/07/13-44/0.txt 
+_`.sources`: This transliteration was supplied by Richard Kistruck
+[RHSK-1997-04-07]_ based on magic number encodings for object signatures
+used by Richard Brooksby [RB-1996-02-12]_, the existence of which was
+inspired by the structure marking used in the Multics operating system
+[THVV-1995]_.
 
 
 Transliteration
@@ -78,8 +79,8 @@ _`.trans.t`: T is an exception to `.numbers`_, but is such a common
 letter that it deserves it.
 
 
-4. Notes
---------
+Notes
+-----
 
 _`.change`: This transliteration differs from the old transliteration
 used for signatures (see design.mps.sig_), as follows: J:6->1;
@@ -106,6 +107,33 @@ selected (by capitalisation), e.g.::
     #define SpaceSig        ((Sig)0x5195BACE) /* SIGnature SPACE */
 
 
+References
+----------
+
+.. [RB-1996-02-12]
+   "Signature magic numbers" (e-mail message);
+   `Richard Brooksby`_;
+   Harlequin;
+   1996-12-02 12:05:30Z.
+
+.. _`Richard Brooksby`: mailto:rb@ravenbrook.com
+
+.. [RHSK-1997-04-07]
+   "Alpha-to-Hex v1.0 beta";
+   Richard Kistruck;
+   Ravenbrook;
+   1997-04-07 14:42:02+0100;
+   <https://info.ravenbrook.com/project/mps/mail/1997/04/07/13-44/0.txt>.
+
+.. [THVV-1995]
+   "Structure Marking";
+   Tom Van Vleck;
+   multicians.org_;
+   <http://www.multicians.org/thvv/marking.html>.
+
+.. _multicians.org: http://www.multicians.org/
+
+
 Document History
 ----------------
 2013-05-10  RB_  Converted to reStructuredText and imported to MPS design.

From 6e65f1ff1809f54aa99e646693ba800da3d1b412 Mon Sep 17 00:00:00 2001
From: Richard Brooksby <rptb1+github@pobox.com>
Date: Thu, 14 Jan 2016 17:34:49 +0000
Subject: [PATCH 12/12] Using os-provided getopt_long where available, since it
 doesn't compile cleanly on os x.

The getopt_long code promises that the argv array is const, but permutes it. (This problem is mentioned in the man page.) We have trouble getting this past our strict compiler options, especially under Xcode.

Copied from Perforce
 Change: 188909
 ServerID: perforce.ravenbrook.com
---
 mps/code/djbench.c                     | 7 ++++++-
 mps/code/gcbench.c                     | 7 ++++++-
 mps/code/mps.xcodeproj/project.pbxproj | 8 --------
 3 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/mps/code/djbench.c b/mps/code/djbench.c
index 33cf1d4bdb9..fbc6dcabc1c 100644
--- a/mps/code/djbench.c
+++ b/mps/code/djbench.c
@@ -13,10 +13,15 @@
 
 #include "mps.c"
 
-#include "getopt.h"
 #include "testlib.h"
 #include "testthr.h"
 
+#ifdef MPS_OS_W3
+#include "getopt.h"
+#else
+#include <getopt.h>
+#endif
+
 #include <stdio.h> /* fprintf, stderr */
 #include <stdlib.h> /* alloca, exit, EXIT_SUCCESS, EXIT_FAILURE */
 #include <time.h> /* CLOCKS_PER_SEC, clock */
diff --git a/mps/code/gcbench.c b/mps/code/gcbench.c
index 2ae97104930..6d7f3339667 100644
--- a/mps/code/gcbench.c
+++ b/mps/code/gcbench.c
@@ -7,13 +7,18 @@
  */
 
 #include "mps.c"
-#include "getopt.h"
 #include "testlib.h"
 #include "testthr.h"
 #include "fmtdy.h"
 #include "fmtdytst.h"
 #include "mpm.h"
 
+#ifdef MPS_OS_W3
+#include "getopt.h"
+#else
+#include <getopt.h>
+#endif
+
 #include <stdio.h> /* fprintf, printf, putchars, sscanf, stderr, stdout */
 #include <stdlib.h> /* alloca, exit, EXIT_FAILURE, EXIT_SUCCESS, strtoul */
 #include <time.h> /* clock, CLOCKS_PER_SEC */
diff --git a/mps/code/mps.xcodeproj/project.pbxproj b/mps/code/mps.xcodeproj/project.pbxproj
index 21abc599f2c..30aad557d3b 100644
--- a/mps/code/mps.xcodeproj/project.pbxproj
+++ b/mps/code/mps.xcodeproj/project.pbxproj
@@ -285,7 +285,6 @@
 		3124CAFB156BE82000753214 /* testlib.c in Sources */ = {isa = PBXBuildFile; fileRef = 31EEAC9E156AB73400714D05 /* testlib.c */; };
 		3124CAFC156BE82900753214 /* libmps.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 31EEABFB156AAF9D00714D05 /* libmps.a */; };
 		3150AE53156ABA2500A6E22A /* libmps.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 31EEABFB156AAF9D00714D05 /* libmps.a */; };
-		318DA8D21892B13B0089718C /* getoptl.c in Sources */ = {isa = PBXBuildFile; fileRef = 318DA8D11892B13B0089718C /* getoptl.c */; };
 		318DA8D31892B27E0089718C /* testlib.c in Sources */ = {isa = PBXBuildFile; fileRef = 31EEAC9E156AB73400714D05 /* testlib.c */; };
 		31A47BA4156C1E130039B1C2 /* mps.c in Sources */ = {isa = PBXBuildFile; fileRef = 31A47BA3156C1E130039B1C2 /* mps.c */; };
 		31D60007156D3C6200337B26 /* segsmss.c in Sources */ = {isa = PBXBuildFile; fileRef = 31D60006156D3C5F00337B26 /* segsmss.c */; };
@@ -327,7 +326,6 @@
 		31FCAE161769244F008C034C /* mps.c in Sources */ = {isa = PBXBuildFile; fileRef = 31A47BA3156C1E130039B1C2 /* mps.c */; };
 		31FCAE19176924D4008C034C /* scheme.c in Sources */ = {isa = PBXBuildFile; fileRef = 31FCAE18176924D4008C034C /* scheme.c */; };
 		6313D46918A400B200EB03EF /* testlib.c in Sources */ = {isa = PBXBuildFile; fileRef = 31EEAC9E156AB73400714D05 /* testlib.c */; };
-		6313D46A18A400B200EB03EF /* getoptl.c in Sources */ = {isa = PBXBuildFile; fileRef = 318DA8D11892B13B0089718C /* getoptl.c */; };
 		6313D47318A4028E00EB03EF /* djbench.c in Sources */ = {isa = PBXBuildFile; fileRef = 318DA8CE1892B1210089718C /* djbench.c */; };
 		6313D47418A4029200EB03EF /* gcbench.c in Sources */ = {isa = PBXBuildFile; fileRef = 6313D46618A3FDC900EB03EF /* gcbench.c */; };
 		6313D47518A40C6300EB03EF /* fmtdytst.c in Sources */ = {isa = PBXBuildFile; fileRef = 3124CAC7156BE48D00753214 /* fmtdytst.c */; };
@@ -1635,8 +1633,6 @@
 		317B3C2A1731830100F9A469 /* arg.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = arg.c; sourceTree = "<group>"; };
 		318DA8CD1892B0F30089718C /* djbench */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = djbench; sourceTree = BUILT_PRODUCTS_DIR; };
 		318DA8CE1892B1210089718C /* djbench.c */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; path = djbench.c; sourceTree = "<group>"; };
-		318DA8D01892B13B0089718C /* getopt.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = getopt.h; sourceTree = "<group>"; };
-		318DA8D11892B13B0089718C /* getoptl.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = getoptl.c; sourceTree = "<group>"; };
 		31A47BA3156C1E130039B1C2 /* mps.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; path = mps.c; sourceTree = "<group>"; };
 		31A47BA5156C1E5E0039B1C2 /* ssixi3.c */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; path = ssixi3.c; sourceTree = "<group>"; };
 		31C83ADD1786281C0031A0DB /* protxc.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = protxc.h; sourceTree = "<group>"; };
@@ -2267,8 +2263,6 @@
 		318DA8C21892B0B20089718C /* Benchmarks */ = {
 			isa = PBXGroup;
 			children = (
-				318DA8D01892B13B0089718C /* getopt.h */,
-				318DA8D11892B13B0089718C /* getoptl.c */,
 				318DA8CE1892B1210089718C /* djbench.c */,
 				6313D46618A3FDC900EB03EF /* gcbench.c */,
 			);
@@ -3909,7 +3903,6 @@
 			files = (
 				318DA8D31892B27E0089718C /* testlib.c in Sources */,
 				6313D47318A4028E00EB03EF /* djbench.c in Sources */,
-				318DA8D21892B13B0089718C /* getoptl.c in Sources */,
 				22561A9A18F426BB00372C66 /* testthrix.c in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -4018,7 +4011,6 @@
 				6313D47418A4029200EB03EF /* gcbench.c in Sources */,
 				6313D47518A40C6300EB03EF /* fmtdytst.c in Sources */,
 				6313D47618A40C7B00EB03EF /* fmtdy.c in Sources */,
-				6313D46A18A400B200EB03EF /* getoptl.c in Sources */,
 				22561A9B18F426F300372C66 /* testthrix.c in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;